@open-mercato/core 0.8.1-develop.7241.1.fad7b2ce2a → 0.8.1-develop.7261.1.5d42353f61

package/src/modules/customer_accounts/backend/customer_accounts/users/[id]/PortalUserDetailPageClient.tsx

@@ -259,18 +259,18 @@ export function PortalUserDetailPageClient({ params, portalOrigin }: PortalUserD
     async function loadPersonName() {
       if (!data!.personEntityId) return
       try {
-        const call = await apiCall<{ id?: string; firstName?: string; lastName?: string }>(`/api/customers/people/${encodeURIComponent(data!.personEntityId)}`)
-        if (!cancelled && call.ok && call.result) {
-          setPersonName([call.result.firstName, call.result.lastName].filter(Boolean).join(' ') || call.result.id || null)
+        const call = await apiCall<{ person?: { id?: string; displayName?: string | null } }>(`/api/customers/people/${encodeURIComponent(data!.personEntityId)}`)
+        if (!cancelled && call.ok && call.result?.person) {
+          setPersonName(call.result.person.displayName || call.result.person.id || null)
         }
       } catch { /* ignore */ }
     }
     async function loadCompanyName() {
       if (!data!.customerEntityId) return
       try {
-        const call = await apiCall<{ id?: string; name?: string }>(`/api/customers/${encodeURIComponent(data!.customerEntityId)}`)
-        if (!cancelled && call.ok && call.result) {
-          setCompanyName(call.result.name || call.result.id || null)
+        const call = await apiCall<{ company?: { id?: string; displayName?: string | null } }>(`/api/customers/companies/${encodeURIComponent(data!.customerEntityId)}`)
+        if (!cancelled && call.ok && call.result?.company) {
+          setCompanyName(call.result.company.displayName || call.result.company.id || null)
         }
       } catch { /* ignore */ }
     }
@@ -282,13 +282,13 @@ export function PortalUserDetailPageClient({ params, portalOrigin }: PortalUserD
     setPersonSearchQuery(query)
     if (query.trim().length < 2) { setPersonResults([]); return }
     try {
-      const call = await apiCall<{ items?: Array<{ id: string; firstName?: string; lastName?: string; email?: string }> }>(
+      const call = await apiCall<{ items?: Array<{ id: string; first_name?: string; last_name?: string; primary_email?: string }> }>(
         `/api/customers/people?search=${encodeURIComponent(query.trim())}&pageSize=10`,
       )
       if (call.ok && Array.isArray(call.result?.items)) {
         setPersonResults(call.result!.items.map((person) => ({
           id: person.id,
-          label: [person.firstName, person.lastName].filter(Boolean).join(' ') || person.email || person.id,
+          label: [person.first_name, person.last_name].filter(Boolean).join(' ') || person.primary_email || person.id,
         })))
       }
     } catch { /* ignore */ }
@@ -298,13 +298,13 @@ export function PortalUserDetailPageClient({ params, portalOrigin }: PortalUserD
     setCompanySearchQuery(query)
     if (query.trim().length < 2) { setCompanyResults([]); return }
     try {
-      const call = await apiCall<{ items?: Array<{ id: string; name?: string }> }>(
-        `/api/customers?search=${encodeURIComponent(query.trim())}&pageSize=10`,
+      const call = await apiCall<{ items?: Array<{ id: string; display_name?: string }> }>(
+        `/api/customers/companies?search=${encodeURIComponent(query.trim())}&pageSize=10`,
       )
       if (call.ok && Array.isArray(call.result?.items)) {
         setCompanyResults(call.result!.items.map((company) => ({
           id: company.id,
-          label: company.name || company.id,
+          label: company.display_name || company.id,
         })))
       }
     } catch { /* ignore */ }

package/src/modules/customer_accounts/di.ts

@@ -28,7 +28,7 @@ export function register(container: AppContainer) {
   container.register({ customerInvitationService: asClass(CustomerInvitationService).scoped() })
   container.register({
     domainMappingService: asFunction(
-      function domainMappingServiceFactory(em: EntityManager) {
+      function domainMappingServiceFactory(cradle: { em: EntityManager }) {
         // Resolve the cache lazily so registrations from `bootstrap(container)` (which runs after
         // module DI registrars) are visible. Awilix CLASSIC mode would fail to resolve a
         // destructured `cache` param if the key is not yet registered; using `hasRegistration`
@@ -42,8 +42,8 @@ export function register(container: AppContainer) {
         } catch {
           cacheService = undefined
         }
-        return new DomainMappingService(em, cacheService ? { cacheService } : undefined)
+        return new DomainMappingService(cradle.em, cacheService ? { cacheService } : undefined)
       },
-    ).scoped(),
+    ).scoped().proxy(),
   })
 }

package/src/modules/customer_accounts/i18n/de.json

@@ -10,6 +10,7 @@
   "customer_accounts.admin.columns.email": "Email",
   "customer_accounts.admin.columns.emailVerified": "Verified",
   "customer_accounts.admin.columns.lastLogin": "Last Login",
+  "customer_accounts.admin.columns.organization": "Organisation",
   "customer_accounts.admin.columns.roles": "Roles",
   "customer_accounts.admin.columns.status": "Status",
   "customer_accounts.admin.confirm.delete": "Delete user \"{{name}}\"?",

package/src/modules/customer_accounts/i18n/en.json

@@ -10,6 +10,7 @@
   "customer_accounts.admin.columns.email": "Email",
   "customer_accounts.admin.columns.emailVerified": "Verified",
   "customer_accounts.admin.columns.lastLogin": "Last Login",
+  "customer_accounts.admin.columns.organization": "Organization",
   "customer_accounts.admin.columns.roles": "Roles",
   "customer_accounts.admin.columns.status": "Status",
   "customer_accounts.admin.confirm.delete": "Delete user \"{{name}}\"?",

package/src/modules/customer_accounts/i18n/es.json

@@ -10,6 +10,7 @@
   "customer_accounts.admin.columns.email": "Email",
   "customer_accounts.admin.columns.emailVerified": "Verified",
   "customer_accounts.admin.columns.lastLogin": "Last Login",
+  "customer_accounts.admin.columns.organization": "Organización",
   "customer_accounts.admin.columns.roles": "Roles",
   "customer_accounts.admin.columns.status": "Status",
   "customer_accounts.admin.confirm.delete": "Delete user \"{{name}}\"?",

package/src/modules/customer_accounts/i18n/ko.json

@@ -10,6 +10,7 @@
   "customer_accounts.admin.columns.email": "이메일",
   "customer_accounts.admin.columns.emailVerified": "확인됨",
   "customer_accounts.admin.columns.lastLogin": "마지막 로그인",
+  "customer_accounts.admin.columns.organization": "조직",
   "customer_accounts.admin.columns.roles": "역할",
   "customer_accounts.admin.columns.status": "상태",
   "customer_accounts.admin.confirm.delete": "사용자 \"{{name}}\"을(를) 삭제하시겠습니까?",

package/src/modules/customer_accounts/i18n/pl.json

@@ -10,6 +10,7 @@
   "customer_accounts.admin.columns.email": "E-mail",
   "customer_accounts.admin.columns.emailVerified": "Zweryfikowany",
   "customer_accounts.admin.columns.lastLogin": "Ostatnie logowanie",
+  "customer_accounts.admin.columns.organization": "Organizacja",
   "customer_accounts.admin.columns.roles": "Role",
   "customer_accounts.admin.columns.status": "Status",
   "customer_accounts.admin.confirm.delete": "Usunąć użytkownika \"{{name}}\"?",

package/src/modules/customer_accounts/lib/customerAuth.ts

@@ -18,6 +18,17 @@ export interface CustomerAuthContext {
   isPortalAdmin?: boolean
 }
 
+async function resolveSessionService(): Promise<
+  InstanceType<typeof import('@open-mercato/core/modules/customer_accounts/services/customerSessionService').CustomerSessionService>
+> {
+  const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
+    import('@open-mercato/shared/lib/di/container'),
+    import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),
+  ])
+  const container = await createRequestContainer()
+  return container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>
+}
+
 async function assertSessionStillActive(input: {
   sessionId: string
   userId: string
@@ -25,12 +36,7 @@ async function assertSessionStillActive(input: {
   organizationId: string
 }): Promise<boolean> {
   try {
-    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
-      import('@open-mercato/shared/lib/di/container'),
-      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),
-    ])
-    const container = await createRequestContainer()
-    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>
+    const service = await resolveSessionService()
     const session = await service.findActiveSessionForClaims(input)
     return session !== null
   } catch {
@@ -40,6 +46,26 @@ async function assertSessionStillActive(input: {
   }
 }
 
+/**
+ * Liveness re-check for a legacy token that carries no `sid` claim. It cannot name the session it
+ * was issued for, so the check falls back to the strongest available statement: the customer must
+ * still be signed in somewhere. Once every session is revoked — logout, per-device revoke, admin
+ * action — the token stops authenticating instead of surviving until its own expiry.
+ */
+async function assertUserStillHasActiveSession(input: {
+  userId: string
+  tenantId: string
+  organizationId: string
+}): Promise<boolean> {
+  try {
+    const service = await resolveSessionService()
+    return await service.hasActiveSessionForUser(input)
+  } catch {
+    // Same fail-closed contract as the sid-bound check above.
+    return false
+  }
+}
+
 export function readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {
   if (!header) return undefined
   const parts = header.split(';')
@@ -129,6 +155,9 @@ export async function getCustomerAuthFromRequest(req: Request): Promise<Customer
     const userId = String(payload.sub)
     const tenantId = String(payload.tenantId)
     const organizationId = String(payload.orgId)
+    // Every accepted token is re-checked for liveness, exactly like the SSR path does — a token
+    // without a `sid` is checked against the customer's remaining sessions rather than skipped,
+    // so session revocation is never structurally unreachable on the API path.
     const stillActive = sid
       ? await assertSessionStillActive({
           sessionId: sid,
@@ -136,7 +165,7 @@ export async function getCustomerAuthFromRequest(req: Request): Promise<Customer
           tenantId,
           organizationId,
         })
-      : true
+      : await assertUserStillHasActiveSession({ userId, tenantId, organizationId })
     if (!stillActive) return null
 
     const userState = await validateUserState(

package/src/modules/customer_accounts/services/customerSessionService.ts

@@ -126,6 +126,34 @@ export class CustomerSessionService {
     return session
   }
 
+  /**
+   * Liveness probe for tokens that carry no `sid` claim — the pre-migration customer JWTs the
+   * legacy raw-secret fallback still admits during a key rotation. Such a token cannot name the
+   * session it was issued for, so the strongest statement we can make about it is whether the
+   * customer is still signed in anywhere. A customer whose sessions have all been revoked
+   * (logout, per-device revoke, admin action) has none, and the token must stop working.
+   *
+   * Existence is the whole answer, so this reads no encrypted column and needs no decryption
+   * round-trip on the authentication path — the same reason `findActiveSessionForClaims` next to
+   * it queries directly. Scope comes from the owning user, since sessions carry no scope columns.
+   */
+  async hasActiveSessionForUser(input: {
+    userId: string
+    tenantId: string
+    organizationId: string
+  }): Promise<boolean> {
+    const session = await this.em.findOne(CustomerUserSession, {
+      user: {
+        id: input.userId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      },
+      deletedAt: null,
+      expiresAt: { $gt: new Date() },
+    })
+    return session !== null
+  }
+
   async revokeSession(sessionId: string): Promise<void> {
     await this.em.nativeUpdate(CustomerUserSession, { id: sessionId }, { deletedAt: new Date() })
   }

package/src/modules/customers/ai-tools/activities-tasks-pack.ts

@@ -77,41 +77,56 @@ async function loadDealForScope(
 /**
  * `CustomerDeal` does NOT carry a direct `entity` field — deals are linked
  * to people / companies via the `customer_deal_person_links` and
- * `customer_deal_company_links` tables. Comments however need a non-null
- * `entity_id` (the timeline owner) so this helper resolves the deal's
- * first linked person, then falls back to its first linked company. When
- * neither exists, the caller MUST instruct the operator to link a contact
- * before commenting on the deal.
+ * `customer_deal_company_links` tables. Comments and activities however need
+ * a non-null `entity_id` (the timeline owner) so this helper resolves the
+ * deal's primary linked person, then the oldest person, then the oldest company.
+ * When neither exists, the caller MUST instruct the operator to link a
+ * contact before writing to the deal.
+ *
+ * The relations are `CustomerDealPersonLink.person` and
+ * `CustomerDealCompanyLink.company` (#6119): populating them under any other
+ * name makes MikroORM reject the query, so every write failed even for a deal
+ * with linked contacts.
+ *
+ * The link tables carry no `tenant_id` / `organization_id` column either, so the
+ * deal id is the whole criterion — the same query `api/deals/[id]/route.ts` runs.
+ * Callers pass a deal already returned by `loadDealForScope`; that check is what
+ * keeps the lookup inside the caller's tenant and organization.
  */
-async function resolveDealCommentEntityId(
-  em: EntityManager,
-  ctx: CustomersToolContext,
-  tenantId: string,
-  dealId: string,
-): Promise<string | null> {
+async function resolveDealLinkedEntityId(em: EntityManager, dealId: string): Promise<string | null> {
   const personLink = await em.findOne(
     CustomerDealPersonLink,
-    { deal: dealId, tenantId } as never,
-    { populate: ['personEntity'] as never },
+    { deal: dealId } as never,
+    {
+      populate: ['person'] as never,
+      orderBy: { isPrimary: 'DESC', createdAt: 'ASC', id: 'ASC' },
+    },
   )
-  if (personLink) {
-    const linked = (personLink as unknown as { personEntity?: { id?: string | null } | null }).personEntity
-    if (linked && typeof linked === 'object' && typeof linked.id === 'string') return linked.id
-    const raw = (personLink as unknown as { personEntity?: unknown }).personEntity
-    if (typeof raw === 'string') return raw
-  }
+  const personId = linkedEntityIdOf(personLink, 'person')
+  if (personId) return personId
   const companyLink = await em.findOne(
     CustomerDealCompanyLink,
-    { deal: dealId, tenantId } as never,
-    { populate: ['companyEntity'] as never },
+    { deal: dealId } as never,
+    {
+      populate: ['company'] as never,
+      orderBy: { createdAt: 'ASC', id: 'ASC' },
+    },
   )
-  if (companyLink) {
-    const linked = (companyLink as unknown as { companyEntity?: { id?: string | null } | null }).companyEntity
-    if (linked && typeof linked === 'object' && typeof linked.id === 'string') return linked.id
-    const raw = (companyLink as unknown as { companyEntity?: unknown }).companyEntity
-    if (typeof raw === 'string') return raw
+  return linkedEntityIdOf(companyLink, 'company')
+}
+
+/** Id of a populated relation, or the raw foreign key when it was not loaded. */
+function linkedEntityIdOf(row: unknown, relation: 'person' | 'company'): string | null {
+  if (!row || typeof row !== 'object') return null
+  const value = (row as Record<string, unknown>)[relation]
+  if (value && typeof value === 'object' && typeof (value as { id?: unknown }).id === 'string') {
+    return (value as { id: string }).id
   }
-  return null
+  return typeof value === 'string' ? value : null
+}
+
+function dealHasNoLinkedContactMessage(dealId: string, what: 'comment' | 'activity'): string {
+  return `Deal "${dealId}" has no linked person or company. Link a contact to the deal in the backoffice before adding ${what === 'comment' ? 'a comment' : 'an activity'}, or post the ${what} directly on the person/company record instead.`
 }
 
 async function loadCommentForScope(
@@ -493,11 +508,9 @@ const manageDealCommentTool: CustomersAiToolDefinition = {
       // people/companies via two link tables. Resolve the first available
       // person, then fall back to the first linked company. Only fail the
       // operation when the deal has no linked contacts at all.
-      const dealEntityId = await resolveDealCommentEntityId(em, ctx, tenantId, deal.id)
+      const dealEntityId = await resolveDealLinkedEntityId(em, deal.id)
       if (!dealEntityId) {
-        throw new Error(
-          `Deal "${deal.id}" has no linked person or company. Link a contact to the deal in the backoffice before adding a comment, or post the comment directly on the person/company record instead.`,
-        )
+        throw new Error(dealHasNoLinkedContactMessage(deal.id, 'comment'))
       }
       const body: Record<string, unknown> = {
         tenantId,
@@ -656,15 +669,12 @@ const manageDealActivityTool: CustomersAiToolDefinition = {
       if (!deal) throw new Error(`Deal "${input.dealId}" is not accessible to the caller.`)
       const organizationId = deal.organizationId
       if (!organizationId) throw new Error(`Deal "${deal.id}" has no organization scope.`)
-      const dealEntity = (deal as unknown as { entity?: unknown }).entity
-      const entityId =
-        dealEntity && typeof dealEntity === 'object'
-          ? (dealEntity as { id?: string | null }).id ?? null
-          : typeof dealEntity === 'string'
-            ? dealEntity
-            : null
+      // Same rule as the comment tool (#6119): `CustomerDeal` has no `.entity`,
+      // the activity's timeline owner is the deal's first linked person, then
+      // its first linked company.
+      const entityId = await resolveDealLinkedEntityId(em, deal.id)
       if (!entityId) {
-        throw new Error(`Deal "${deal.id}" has no associated person/company; cannot attach an activity.`)
+        throw new Error(dealHasNoLinkedContactMessage(deal.id, 'activity'))
       }
       const body: Record<string, unknown> = {
         tenantId,

package/src/modules/customers/backend/customers/deals/map/page.tsx

@@ -14,11 +14,22 @@ import {
 import { SearchInput } from '@open-mercato/ui/primitives/search-input'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
-import { ViewTabsRow } from '../pipeline/components/ViewTabsRow'
+import { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'
+import {
+  ViewTabsRow,
+  VIEW_TABS_ROW_COMPONENT_ID,
+  type ViewTabsRowProps,
+} from '../pipeline/components/ViewTabsRow'
 import { DealsMapView } from './components/DealsMapView'
 
 export default function DealsMapPage(): React.ReactElement {
   const t = useT()
+  // Resolved through the component registry so downstream apps can hide a view
+  // (or replace the whole switcher) without forking this page.
+  const DealsViewTabsRow = useRegisteredComponent<ViewTabsRowProps>(
+    VIEW_TABS_ROW_COMPONENT_ID,
+    ViewTabsRow,
+  )
   const [search, setSearch] = React.useState('')
 
   return (
@@ -68,7 +79,7 @@ export default function DealsMapPage(): React.ReactElement {
           </div>
         </div>
 
-        <ViewTabsRow active="map" className="mt-4" />
+        <DealsViewTabsRow active="map" className="mt-4" />
 
         <DealsMapView search={search} />
       </PageBody>

package/src/modules/customers/backend/customers/deals/page.tsx

@@ -30,7 +30,12 @@ import { SimpleTooltip } from '@open-mercato/ui/primitives/tooltip'
 import { Briefcase, AlertTriangle, X } from 'lucide-react'
 import { isLostDealStatus, isWonDealStatus } from '../../../lib/dealStatus'
 import { formatRelativeTime } from '@open-mercato/shared/lib/time'
-import { ViewTabsRow } from './pipeline/components/ViewTabsRow'
+import { useRegisteredComponent } from '@open-mercato/ui/backend/injection/useRegisteredComponent'
+import {
+  ViewTabsRow,
+  VIEW_TABS_ROW_COMPONENT_ID,
+  type ViewTabsRowProps,
+} from './pipeline/components/ViewTabsRow'
 import { DealsKpiStrip } from '../../../components/DealsKpiStrip'
 import { E } from '#generated/entities.ids.generated'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -195,6 +200,12 @@ function formatGroupedAmount(amount: number | null | undefined): string | null {
 
 export default function CustomersDealsPage() {
   const t = useT()
+  // Resolved through the component registry so downstream apps can hide a view
+  // (or replace the whole switcher) without forking this page.
+  const DealsViewTabsRow = useRegisteredComponent<ViewTabsRowProps>(
+    VIEW_TABS_ROW_COMPONENT_ID,
+    ViewTabsRow,
+  )
   const locale = useLocale()
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const router = useRouter()
@@ -1064,7 +1075,7 @@ export default function CustomersDealsPage() {
   return (
     <Page>
       <PageBody>
-        <ViewTabsRow active="list" className="mb-4" />
+        <DealsViewTabsRow active="list" className="mb-4" />
         <DealsKpiStrip
           ownerNames={ownerNames}
           stageDictionary={dictionaryMaps['pipeline-stages'] ?? {}}

package/src/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.tsx

@@ -7,24 +7,76 @@ import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
 
 export type KanbanView = 'kanban' | 'list' | 'map'
 
-type ViewTabsRowProps = {
+/**
+ * Canonical left-to-right order of the deals views. `visibleViews` selects a
+ * subset of these; it never reorders them, so a host that hides one view keeps
+ * the same tab order as every other deployment.
+ */
+export const DEALS_VIEWS: readonly KanbanView[] = ['kanban', 'list', 'map']
+
+export type ViewTabsRowProps = {
   active: KanbanView
   className?: string
+  /**
+   * Views exposed in the tab row. Defaults to all of `DEALS_VIEWS`; pass a
+   * subset to hide a view a deployment has no use for (e.g. omit `'map'` when
+   * deal addresses are never geocoded). Unknown and duplicated entries are
+   * ignored, and `active` is always rendered — a tab row that omits the page it
+   * is sitting on would show no selected tab at all.
+   */
+  visibleViews?: readonly KanbanView[]
+}
+
+/**
+ * Registered component id for the deals view switcher. Downstream apps can
+ * target it from `widgets/components.ts` to replace or wrap the row, or — the
+ * reason it is resolved through the registry at all — to transform its props
+ * from one place instead of forking each of the three pages that render it:
+ *
+ * ```ts
+ * export const componentOverrides: ComponentOverride[] = [{
+ *   target: { componentId: 'section:customers.deals.viewTabs' },
+ *   priority: 50,
+ *   metadata: { module: 'my_module' },
+ *   propsTransform: (props) => ({ ...props, visibleViews: ['kanban', 'list'] }),
+ * }]
+ * ```
+ *
+ * Hiding a tab does not unpublish its route; an app that also wants the page
+ * gone disables it through `entry.overrides.pages` (#5923).
+ */
+export const VIEW_TABS_ROW_COMPONENT_ID = 'section:customers.deals.viewTabs'
+
+const VIEW_HREFS: Record<KanbanView, string> = {
+  kanban: '/backend/customers/deals/pipeline',
+  list: '/backend/customers/deals',
+  map: '/backend/customers/deals/map',
 }
 
-const VIEW_KANBAN_HREF = '/backend/customers/deals/pipeline'
-const VIEW_LIST_HREF = '/backend/customers/deals'
-const VIEW_MAP_HREF = '/backend/customers/deals/map'
+/**
+ * Narrows `visibleViews` to the tabs this row renders, in canonical order.
+ * Exported so the contract — canonical order, deduplication, unknown entries
+ * dropped, `active` always kept — is testable without rendering.
+ */
+export function resolveVisibleViews(
+  active: KanbanView,
+  visibleViews?: readonly KanbanView[],
+): KanbanView[] {
+  if (!visibleViews) return [...DEALS_VIEWS]
+  const requested = new Set<KanbanView>(visibleViews.filter((view) => DEALS_VIEWS.includes(view)))
+  requested.add(active)
+  return DEALS_VIEWS.filter((view) => requested.has(view))
+}
 
-export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.ReactElement {
+export function ViewTabsRow({ active, className, visibleViews }: ViewTabsRowProps): React.ReactElement {
   const t = useT()
-  const labels = {
+  const labels: Record<KanbanView, string> = {
     kanban: translateWithFallback(t, 'customers.deals.kanban.view.kanban', 'Kanban'),
     list: translateWithFallback(t, 'customers.deals.kanban.view.list', 'List'),
     map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),
   }
 
-  // Link-based tab row (two routes), so the Tabs primitive (state-driven,
+  // Link-based tab row (three routes), so the Tabs primitive (state-driven,
   // onValueChange) does not fit — real <Link> semantics must stay. Classes
   // mirror the Tabs underline variant: accent-indigo active border,
   // shadow-focus halo.
@@ -33,14 +85,9 @@ export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.Reac
   const activeTab = 'border-b-2 border-accent-indigo font-semibold text-foreground'
   const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'
 
-  // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,
-  // so the user can always round-trip between kanban and list from either page. Previously
-  // the kanban tab was a hardcoded `<span>` because the row was only rendered on the kanban
-  // page — adding it to the list page (item 7 of the SPEC-048 UX review) requires it to
-  // navigate back to /pipeline.
-  const isKanbanActive = active === 'kanban'
-  const isListActive = active === 'list'
-  const isMapActive = active === 'map'
+  // The active tab renders as a non-navigating `<span>` and every other tab as a
+  // `<Link>`, so the user can always round-trip between the views from any page.
+  const views = resolveVisibleViews(active, visibleViews)
 
   return (
     <div
@@ -48,60 +95,26 @@ export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.Reac
       aria-label={translateWithFallback(t, 'customers.deals.kanban.view.tablistLabel', 'Deals views')}
       className={`flex items-end gap-1 border-b border-border ${className ?? ''}`.trim()}
     >
-      {isKanbanActive ? (
-        <span
-          role="tab"
-          aria-selected={true}
-          className={`${baseTab} ${activeTab}`}
-        >
-          {labels.kanban}
-        </span>
-      ) : (
-        <Link
-          href={VIEW_KANBAN_HREF}
-          role="tab"
-          aria-selected={false}
-          className={`${baseTab} ${inactiveTab}`}
-        >
-          {labels.kanban}
-        </Link>
-      )}
-      {isListActive ? (
-        <span
-          role="tab"
-          aria-selected={true}
-          className={`${baseTab} ${activeTab}`}
-        >
-          {labels.list}
-        </span>
-      ) : (
-        <Link
-          href={VIEW_LIST_HREF}
-          role="tab"
-          aria-selected={false}
-          className={`${baseTab} ${inactiveTab}`}
-        >
-          {labels.list}
-        </Link>
-      )}
-      {isMapActive ? (
+      {views.map((view) => (view === active ? (
         <span
+          key={view}
           role="tab"
           aria-selected={true}
           className={`${baseTab} ${activeTab}`}
         >
-          {labels.map}
+          {labels[view]}
         </span>
       ) : (
         <Link
-          href={VIEW_MAP_HREF}
+          key={view}
+          href={VIEW_HREFS[view]}
           role="tab"
           aria-selected={false}
           className={`${baseTab} ${inactiveTab}`}
         >
-          {labels.map}
+          {labels[view]}
         </Link>
-      )}
+      )))}
     </div>
   )
 }

package/src/modules/customers/backend/customers/deals/pipeline/page.tsx

@@ -54,7 +54,7 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import type { FilterOptionTone } from '@open-mercato/shared/lib/query/advanced-filter'
-import { ViewTabsRow } from './components/ViewTabsRow'
+import { ViewTabsRow, VIEW_TABS_ROW_COMPONENT_ID, type ViewTabsRowProps } from './components/ViewTabsRow'
 import { LANE_WIDTH_CLASS } from './components/constants'
 import { useCurrencyDictionary } from '../../../../components/detail/hooks/useCurrencyDictionary'
 import { FilterBarRow, type KanbanFilterChip } from './components/FilterBarRow'
@@ -419,6 +419,12 @@ export default function DealsKanbanPage(): React.ReactElement {
     QUICK_DEAL_DIALOG_COMPONENT_ID,
     DefaultQuickDealDialog,
   )
+  // Same reason: an app that does not use one of the three views hides it with a
+  // props override on this handle instead of forking all three deals pages.
+  const DealsViewTabsRow = useRegisteredComponent<ViewTabsRowProps>(
+    VIEW_TABS_ROW_COMPONENT_ID,
+    ViewTabsRow,
+  )
   const router = useRouter()
   const scopeVersion = useOrganizationScopeVersion()
   const queryClient = useQueryClient()
@@ -2558,7 +2564,7 @@ export default function DealsKanbanPage(): React.ReactElement {
   return (
     <Page>
       <PageBody>
-        <ViewTabsRow active="kanban" className="mb-4" />
+        <DealsViewTabsRow active="kanban" className="mb-4" />
         <div className="flex flex-col gap-2">
           <Breadcrumb>
             <BreadcrumbList>

package/src/modules/customers/commands/companies.ts

@@ -1035,6 +1035,14 @@ const deleteCompanyCommand: CommandHandler<{ body?: Record<string, unknown>; que
         }
 
         await em.nativeUpdate(CustomerPersonProfile, { company: record }, { company: null })
+        // Soft-deleted person links keep their `company_entity_id` foreign key, so the hard
+        // delete below would violate it. The guard above already proved no active link
+        // remains, and restricting the filter to `deletedAt != null` keeps that guarantee.
+        await em.nativeDelete(CustomerPersonCompanyLink, {
+          company: record,
+          deletedAt: { $ne: null },
+          ...dependentScope,
+        })
         await em.nativeDelete(CustomerDealCompanyLink, { company: record })
         await em.nativeDelete(CustomerActivity, { entity: record, organizationId: record.organizationId, tenantId: record.tenantId })
         await em.nativeDelete(CustomerInteraction, { entity: record, organizationId: record.organizationId, tenantId: record.tenantId })