@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/customers/api/labels/unassign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/labels/unassign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { CustomerEntity } from '../../../data/entities'\nimport { labelUnassignCommandSchema, labelAssignmentSchema, type LabelUnassignCommandInput } from '../../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport { resolveLabelActorUserId } from '../auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from '../table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('customers')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst labelAssignmentRequestSchema = labelAssignmentSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nfunction resolveResourceKind(kind: 'person' | 'company' | null | undefined): string {\n  if (kind === 'company') return 'customers.company'\n  return 'customers.person'\n}\n\nfunction resolveRequiredFeature(kind: 'person' | 'company' | null | undefined): string {\n  return kind === 'company' ? 'customers.companies.manage' : 'customers.people.manage'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const targetEntity = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      {\n        id: body.entityId,\n        tenantId: auth.tenantId,\n        organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId },\n    )\n    if (!targetEntity) {\n      throw notFound(translate('customers.errors.entity_not_found', 'Entity not found'))\n    }\n    const entityKind = targetEntity.kind === 'person' || targetEntity.kind === 'company' ? targetEntity.kind : null\n    const resourceKind = resolveResourceKind(entityKind)\n\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (!rbac) {\n      throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n    }\n    const requiredFeature = resolveRequiredFeature(entityKind)\n    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasFeature) {\n      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind,\n      resourceId: body.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelUnassignCommandSchema.parse({\n      labelId: body.labelId,\n      entityId: body.entityId,\n      tenantId: auth.tenantId,\n      organizationId,\n    } satisfies LabelUnassignCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelUnassignCommandInput, { assignmentId: string | null; entityKind: 'person' | 'company' | null }>(\n      'customers.labels.unassign',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind,\n        resourceId: body.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result.assignmentId })\n    if (result.assignmentId && logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.labelAssignment',\n          resourceId: logEntry.resourceId ?? result.assignmentId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('customers/labels/unassign.POST', { err })\n    return NextResponse.json({ error: 'Failed to unassign label' }, { status: 500 })\n  }\n}\n\nconst responseSchema = z.object({ id: z.string().uuid().nullable() })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Unassign label from entity',\n  methods: {\n    POST: {\n      summary: 'Unassign label',\n      requestBody: { contentType: 'application/json', schema: labelAssignmentRequestSchema },\n      responses: [\n        { status: 200, description: 'Unassigned', schema: responseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Label or entity not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,6BAA6D;AAClG,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,iBAAiB,gBAAgB;AAKzD,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,+BAA+B,sBAAsB,OAAO;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,SAAS,oBAAoB,MAAuD;AAClF,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAuD;AACrF,SAAO,SAAS,YAAY,+BAA+B;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,6BAA6B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC3E,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,KAAK;AAAA,QACT,UAAU,KAAK;AAAA,QACf;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IAC5C;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,IACnF;AACA,UAAM,aAAa,aAAa,SAAS,YAAY,aAAa,SAAS,YAAY,aAAa,OAAO;AAC3G,UAAM,eAAe,oBAAoB,UAAU;AAEnD,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,IAClG;AACA,UAAM,kBAAkB,uBAAuB,UAAU;AACzD,UAAM,aAAa,MAAM,KAAK,mBAAmB,aAAa,CAAC,eAAe,GAAG;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,IACtG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,2BAA2B,MAAM;AAAA,MACpD,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAqC;AAErC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,aAAa,CAAC;AAC9D,QAAI,OAAO,gBAAgB,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AACnF,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,kCAAkC,EAAE,IAAI,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACpE,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,MACnE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { CustomerEntity } from '../../../data/entities'\nimport { labelUnassignCommandSchema, labelAssignmentSchema, type LabelUnassignCommandInput } from '../../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport { resolveLabelActorUserId } from '../auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from '../table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('customers')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst labelAssignmentRequestSchema = labelAssignmentSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nfunction resolveResourceKind(kind: 'person' | 'company' | null | undefined): string {\n  if (kind === 'company') return 'customers.company'\n  return 'customers.person'\n}\n\nfunction resolveRequiredFeature(kind: 'person' | 'company' | null | undefined): string {\n  return kind === 'company' ? 'customers.companies.manage' : 'customers.people.manage'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const targetEntity = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      {\n        id: body.entityId,\n        tenantId: auth.tenantId,\n        organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId },\n    )\n    if (!targetEntity) {\n      throw notFound(translate('customers.errors.entity_not_found', 'Entity not found'))\n    }\n    const entityKind = targetEntity.kind === 'person' || targetEntity.kind === 'company' ? targetEntity.kind : null\n    const resourceKind = resolveResourceKind(entityKind)\n\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (!rbac) {\n      throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n    }\n    const requiredFeature = resolveRequiredFeature(entityKind)\n    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasFeature) {\n      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind,\n      resourceId: body.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelUnassignCommandSchema.parse({\n      labelId: body.labelId,\n      entityId: body.entityId,\n      tenantId: auth.tenantId,\n      organizationId,\n    } satisfies LabelUnassignCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelUnassignCommandInput, { assignmentId: string | null; entityKind: 'person' | 'company' | null }>(\n      'customers.labels.unassign',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind,\n        resourceId: body.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result.assignmentId })\n    if (result.assignmentId && logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.labelAssignment',\n          resourceId: logEntry.resourceId ?? result.assignmentId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('customers/labels/unassign.POST', { err })\n    return NextResponse.json({ error: 'Failed to unassign label' }, { status: 500 })\n  }\n}\n\nconst responseSchema = z.object({ id: z.string().uuid().nullable() })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Unassign label from entity',\n  methods: {\n    POST: {\n      summary: 'Unassign label',\n      requestBody: { contentType: 'application/json', schema: labelAssignmentRequestSchema },\n      responses: [\n        { status: 200, description: 'Unassigned', schema: responseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Label or entity not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,6BAA6D;AAClG,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,iBAAiB,gBAAgB;AAKzD,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,+BAA+B,sBAAsB,OAAO;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,SAAS,oBAAoB,MAAuD;AAClF,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAuD;AACrF,SAAO,SAAS,YAAY,+BAA+B;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,6BAA6B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC3E,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,KAAK;AAAA,QACT,UAAU,KAAK;AAAA,QACf;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IAC5C;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,IACnF;AACA,UAAM,aAAa,aAAa,SAAS,YAAY,aAAa,SAAS,YAAY,aAAa,OAAO;AAC3G,UAAM,eAAe,oBAAoB,UAAU;AAEnD,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,IAClG;AACA,UAAM,kBAAkB,uBAAuB,UAAU;AACzD,UAAM,aAAa,MAAM,KAAK,mBAAmB,aAAa,CAAC,eAAe,GAAG;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,IACtG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,2BAA2B,MAAM;AAAA,MACpD,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAqC;AAErC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,aAAa,CAAC;AAC9D,QAAI,OAAO,gBAAgB,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AACnF,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,kCAAkC,EAAE,IAAI,CAAC;AACtD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACpE,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,eAAe;AAAA,MACnE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/people/[id]/companies/context.js

@@ -6,6 +6,7 @@ import {
   CustomerPersonProfile
 } from "@open-mercato/core/modules/customers/data/entities";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { isExplicitlyEmptyOrganizationScope } from "@open-mercato/shared/lib/auth/organizationScope";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -18,10 +19,14 @@ async function loadPersonContext(req, personId) {
   const authenticatedAuth = auth;
   const container = await createRequestContainer();
   const scope = await resolveOrganizationScopeForRequest({ container, auth: authenticatedAuth, request: req });
+  if (isExplicitlyEmptyOrganizationScope(scope)) {
+    throw notFound(translate("customers.errors.person_not_found", "Person not found"));
+  }
   const em = container.resolve("em").fork();
+  const selectedOrganizationId = scope?.selectedId ?? authenticatedAuth.orgId ?? null;
   const decryptionScope = {
     tenantId: authenticatedAuth.tenantId,
-    organizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null
+    organizationId: selectedOrganizationId
   };
   const person = await findOneWithDecryption(
     em,
@@ -52,7 +57,7 @@ async function loadPersonContext(req, personId) {
   return {
     container,
     auth: authenticatedAuth,
-    selectedOrganizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null,
+    selectedOrganizationId,
     em,
     person,
     profile

package/dist/modules/customers/api/people/[id]/companies/context.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/people/%5Bid%5D/companies/context.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  CustomerEntity,\n  CustomerPersonProfile,\n} from '@open-mercato/core/modules/customers/data/entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport async function loadPersonContext(req: Request, personId: string) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n  const authenticatedAuth = auth as typeof auth & { tenantId: string }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth: authenticatedAuth, request: req })\n  const em = (container.resolve('em') as EntityManager).fork()\n  const decryptionScope = {\n    tenantId: authenticatedAuth.tenantId,\n    organizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null,\n  }\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    { id: personId, kind: 'person', tenantId: authenticatedAuth.tenantId, deletedAt: null },\n    {},\n    decryptionScope,\n  )\n\n  if (!person) {\n    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))\n  }\n\n  // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n  // the parent-not-found above \u2014 so it cannot reveal that a person exists in an\n  // organization the caller cannot see.\n  if (!isOrganizationReadAccessAllowed({ scope, auth: authenticatedAuth, organizationId: person.organizationId })) {\n    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))\n  }\n\n  const profile = await findOneWithDecryption(\n    em,\n    CustomerPersonProfile,\n    { entity: person, tenantId: person.tenantId, organizationId: person.organizationId },\n    { populate: ['company'] },\n    {\n      tenantId: person.tenantId,\n      organizationId: person.organizationId,\n    },\n  )\n  if (!profile) {\n    throw notFound(translate('customers.errors.person_profile_not_found', 'Person profile not found'))\n  }\n\n  return {\n    container,\n    auth: authenticatedAuth,\n    selectedOrganizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null,\n    em,\n    person,\n    profile,\n  }\n}\n"],
-  "mappings": "AACA,SAAS,eAAe,gBAAgB;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAChD,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,eAAsB,kBAAkB,KAAc,UAAkB;AACtE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AACA,QAAM,oBAAoB;AAE1B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,mBAAmB,SAAS,IAAI,CAAC;AAC3G,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,kBAAkB;AAAA,IACtB,UAAU,kBAAkB;AAAA,IAC5B,gBAAgB,OAAO,cAAc,kBAAkB,SAAS;AAAA,EAClE;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,UAAU,kBAAkB,UAAU,WAAW,KAAK;AAAA,IACtF,CAAC;AAAA,IACD;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ;AACX,UAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,EACnF;AAKA,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,mBAAmB,gBAAgB,OAAO,eAAe,CAAC,GAAG;AAC/G,UAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,EACnF;AAEA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,QAAQ,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe;AAAA,IACnF,EAAE,UAAU,CAAC,SAAS,EAAE;AAAA,IACxB;AAAA,MACE,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,SAAS,UAAU,6CAA6C,0BAA0B,CAAC;AAAA,EACnG;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,wBAAwB,OAAO,cAAc,kBAAkB,SAAS;AAAA,IACxE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport {\n  CustomerEntity,\n  CustomerPersonProfile,\n} from '@open-mercato/core/modules/customers/data/entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isExplicitlyEmptyOrganizationScope } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport async function loadPersonContext(req: Request, personId: string) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n  const authenticatedAuth = auth as typeof auth & { tenantId: string }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth: authenticatedAuth, request: req })\n  // An explicitly empty organization scope is deny-all: the caller can see no\n  // organization, so every person is not-found. Answering 404 here (rather than\n  // letting the scope resolver throw a 403) keeps the #5504 existence-oracle\n  // collapse intact \u2014 a foreign-org id and a non-existent id stay identical.\n  if (isExplicitlyEmptyOrganizationScope(scope)) {\n    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))\n  }\n  const em = (container.resolve('em') as EntityManager).fork()\n  const selectedOrganizationId = scope?.selectedId ?? authenticatedAuth.orgId ?? null\n  const decryptionScope = {\n    tenantId: authenticatedAuth.tenantId,\n    organizationId: selectedOrganizationId,\n  }\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    { id: personId, kind: 'person', tenantId: authenticatedAuth.tenantId, deletedAt: null },\n    {},\n    decryptionScope,\n  )\n\n  if (!person) {\n    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))\n  }\n\n  // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n  // the parent-not-found above \u2014 so it cannot reveal that a person exists in an\n  // organization the caller cannot see.\n  if (!isOrganizationReadAccessAllowed({ scope, auth: authenticatedAuth, organizationId: person.organizationId })) {\n    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))\n  }\n\n  const profile = await findOneWithDecryption(\n    em,\n    CustomerPersonProfile,\n    { entity: person, tenantId: person.tenantId, organizationId: person.organizationId },\n    { populate: ['company'] },\n    {\n      tenantId: person.tenantId,\n      organizationId: person.organizationId,\n    },\n  )\n  if (!profile) {\n    throw notFound(translate('customers.errors.person_profile_not_found', 'Person profile not found'))\n  }\n\n  return {\n    container,\n    auth: authenticatedAuth,\n    selectedOrganizationId,\n    em,\n    person,\n    profile,\n  }\n}\n"],
+  "mappings": "AACA,SAAS,eAAe,gBAAgB;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAChD,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAEtC,eAAsB,kBAAkB,KAAc,UAAkB;AACtE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AACA,QAAM,oBAAoB;AAE1B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,mBAAmB,SAAS,IAAI,CAAC;AAK3G,MAAI,mCAAmC,KAAK,GAAG;AAC7C,UAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,EACnF;AACA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,yBAAyB,OAAO,cAAc,kBAAkB,SAAS;AAC/E,QAAM,kBAAkB;AAAA,IACtB,UAAU,kBAAkB;AAAA,IAC5B,gBAAgB;AAAA,EAClB;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,UAAU,kBAAkB,UAAU,WAAW,KAAK;AAAA,IACtF,CAAC;AAAA,IACD;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ;AACX,UAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,EACnF;AAKA,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,mBAAmB,gBAAgB,OAAO,eAAe,CAAC,GAAG;AAC/G,UAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,EACnF;AAEA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,QAAQ,UAAU,OAAO,UAAU,gBAAgB,OAAO,eAAe;AAAA,IACnF,EAAE,UAAU,CAAC,SAAS,EAAE;AAAA,IACxB;AAAA,MACE,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,SAAS,UAAU,6CAA6C,0BAA0B,CAAC;AAAA,EACnG;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/people/[id]/email-share/route.js

@@ -0,0 +1,218 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { readOptimisticLockExpected } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
+import { CustomerEntity } from "../../../../data/entities.js";
+import {
+  canShareConversation,
+  listSharesForPerson
+} from "../../../../lib/conversationShares.js";
+import { resolveUserNames } from "../../../../lib/userNames.js";
+import { invalidatePersonDetailCache } from "../../../../lib/personDetailCacheTags.js";
+const metadata = {
+  path: "/customers/people/[id]/email-share",
+  GET: {
+    requireAuth: true,
+    requireFeatures: ["customers.people.view"]
+  },
+  PUT: {
+    requireAuth: true,
+    requireFeatures: ["customers.email.share_conversation"]
+  }
+};
+const bodySchema = z.object({ shared: z.boolean() }).strict();
+async function resolvePerson(req, personId) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const container = await createRequestContainer();
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+  const em = container.resolve("em").fork();
+  const person = await findOneWithDecryption(
+    em,
+    CustomerEntity,
+    { id: personId, kind: "person", tenantId: auth.tenantId, deletedAt: null },
+    void 0,
+    {
+      tenantId: auth.tenantId,
+      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
+    }
+  );
+  if (!person) {
+    return NextResponse.json({ error: "Person not found" }, { status: 404 });
+  }
+  const organizationId = person.organizationId ?? null;
+  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {
+    return NextResponse.json({ error: "Person not found" }, { status: 404 });
+  }
+  return {
+    person,
+    organizationId,
+    tenantId: auth.tenantId,
+    viewerUserId: auth.isApiKey ? null : auth.sub ?? null,
+    em,
+    container
+  };
+}
+async function GET(req, context) {
+  const { id: personId } = await context.params;
+  if (!z.string().uuid().safeParse(personId).success) {
+    return NextResponse.json({ error: "Invalid person id" }, { status: 400 });
+  }
+  const resolved = await resolvePerson(req, personId);
+  if (resolved instanceof Response) return resolved;
+  const { em, tenantId, organizationId, viewerUserId } = resolved;
+  const scope = { tenantId, organizationId };
+  const [shares, canShare] = await Promise.all([
+    listSharesForPerson(em, scope, personId),
+    canShareConversation(em, scope, viewerUserId, personId)
+  ]);
+  const ownShare = viewerUserId ? shares.find((row) => row.ownerUserId === viewerUserId) ?? null : null;
+  const othersShares = shares.filter((row) => row.ownerUserId !== viewerUserId);
+  const ownerNames = await resolveUserNames(
+    em,
+    tenantId,
+    organizationId,
+    othersShares.map((row) => row.ownerUserId)
+  );
+  return NextResponse.json({
+    sharedByMe: !!ownShare,
+    canShare,
+    updatedAt: ownShare?.updatedAt ? ownShare.updatedAt.toISOString() : null,
+    sharedBy: othersShares.map((row) => ({
+      userId: row.ownerUserId,
+      userName: ownerNames.get(row.ownerUserId) ?? null,
+      sharedAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : null
+    }))
+  });
+}
+async function PUT(req, context) {
+  const { id: personId } = await context.params;
+  if (!z.string().uuid().safeParse(personId).success) {
+    return NextResponse.json({ error: "Invalid person id" }, { status: 400 });
+  }
+  let body;
+  try {
+    body = bodySchema.parse(await readJsonSafe(req, null));
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Invalid request body" },
+      { status: 422 }
+    );
+  }
+  const resolved = await resolvePerson(req, personId);
+  if (resolved instanceof Response) return resolved;
+  const { em, tenantId, organizationId, viewerUserId, container } = resolved;
+  if (!viewerUserId) {
+    return NextResponse.json({ error: "Person not found" }, { status: 404 });
+  }
+  if (!organizationId) {
+    return NextResponse.json({ error: "Person not found" }, { status: 404 });
+  }
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId,
+    organizationId,
+    userId: viewerUserId,
+    resourceKind: "customers.email_conversation_share",
+    resourceId: personId,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
+  const expectedUpdatedAt = readOptimisticLockExpected(req);
+  const commandBus = container.resolve("commandBus");
+  let result;
+  try {
+    const executed = await commandBus.execute("customers.email_conversation_shares.set", {
+      input: {
+        tenantId,
+        organizationId,
+        personEntityId: personId,
+        shared: body.shared,
+        expectedUpdatedAt
+      },
+      ctx: {
+        container,
+        auth: await getAuthFromRequest(req),
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: [organizationId]
+      }
+    });
+    result = executed.result;
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    throw err;
+  }
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId,
+      organizationId,
+      userId: viewerUserId,
+      resourceKind: "customers.email_conversation_share",
+      resourceId: personId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  await invalidatePersonDetailCache(container, tenantId, organizationId);
+  return NextResponse.json({ ok: true, changed: result.changed, shared: body.shared });
+}
+const openApi = {
+  tags: ["Customers", "Email"],
+  methods: {
+    GET: {
+      summary: "Read the conversation-share state for a Person",
+      tags: ["Customers", "Email"],
+      responses: [
+        { status: 200, description: "Share state for the calling user" },
+        { status: 400, description: "Invalid person id" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Person not found or not visible to caller" }
+      ]
+    },
+    PUT: {
+      summary: "Share or un-share your own email conversation with a Person",
+      tags: ["Customers", "Email"],
+      responses: [
+        { status: 200, description: "Share state updated" },
+        { status: 400, description: "Invalid id, or no private conversation to share" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Person not found or not visible to caller" },
+        { status: 409, description: "Optimistic lock conflict" },
+        { status: 422, description: "Invalid body" }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/customers/api/people/[id]/email-share/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/customers/api/people/%5Bid%5D/email-share/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerEntity } from '../../../../data/entities'\nimport type { EmailConversationShareSetCommandInput } from '../../../../data/validators'\nimport {\n  canShareConversation,\n  listSharesForPerson,\n} from '../../../../lib/conversationShares'\nimport { resolveUserNames } from '../../../../lib/userNames'\nimport { invalidatePersonDetailCache } from '../../../../lib/personDetailCacheTags'\n\nexport const metadata = {\n  path: '/customers/people/[id]/email-share',\n  GET: {\n    requireAuth: true,\n    requireFeatures: ['customers.people.view'],\n  },\n  PUT: {\n    requireAuth: true,\n    requireFeatures: ['customers.email.share_conversation'],\n  },\n}\n\nconst bodySchema = z.object({ shared: z.boolean() }).strict()\n\ntype RouteContext = { params: Promise<{ id: string }> | { id: string } }\n\ntype ResolvedPerson = {\n  person: { id: string; organizationId?: string | null; tenantId?: string | null }\n  organizationId: string | null\n  tenantId: string\n  viewerUserId: string | null\n  em: EntityManager\n  container: Awaited<ReturnType<typeof createRequestContainer>>\n}\n\n/**\n * Load the Person in the caller's scope, or return a 404 response.\n *\n * Loading by tenant + id (rather than a hand-rolled selected org) keeps this\n * working under the \"All organizations\" scope, then fails closed on the record's\n * own organization \u2014 the same shape the sibling person routes use.\n */\nasync function resolvePerson(\n  req: Request,\n  personId: string,\n): Promise<ResolvedPerson | Response> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  const person = (await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    { id: personId, kind: 'person', tenantId: auth.tenantId, deletedAt: null } as never,\n    undefined,\n    {\n      tenantId: auth.tenantId as string,\n      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    },\n  )) as { id: string; organizationId?: string | null; tenantId?: string | null } | null\n\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const organizationId = person.organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  return {\n    person,\n    organizationId,\n    tenantId: auth.tenantId as string,\n    viewerUserId: auth.isApiKey ? null : auth.sub ?? null,\n    em,\n    container,\n  }\n}\n\nexport async function GET(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const resolved = await resolvePerson(req, personId)\n  if (resolved instanceof Response) return resolved\n  const { em, tenantId, organizationId, viewerUserId } = resolved\n  const scope = { tenantId, organizationId }\n\n  const [shares, canShare] = await Promise.all([\n    listSharesForPerson(em, scope, personId),\n    canShareConversation(em, scope, viewerUserId, personId),\n  ])\n\n  const ownShare = viewerUserId\n    ? shares.find((row) => row.ownerUserId === viewerUserId) ?? null\n    : null\n\n  // Shares granted BY OTHER owners \u2014 what the UI renders as \"Shared by Ann\".\n  const othersShares = shares.filter((row) => row.ownerUserId !== viewerUserId)\n  const ownerNames = await resolveUserNames(\n    em,\n    tenantId,\n    organizationId,\n    othersShares.map((row) => row.ownerUserId),\n  )\n\n  return NextResponse.json({\n    sharedByMe: !!ownShare,\n    canShare,\n    updatedAt: ownShare?.updatedAt ? ownShare.updatedAt.toISOString() : null,\n    sharedBy: othersShares.map((row) => ({\n      userId: row.ownerUserId,\n      userName: ownerNames.get(row.ownerUserId) ?? null,\n      sharedAt: row.createdAt instanceof Date ? row.createdAt.toISOString() : null,\n    })),\n  })\n}\n\nexport async function PUT(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const resolved = await resolvePerson(req, personId)\n  if (resolved instanceof Response) return resolved\n  const { em, tenantId, organizationId, viewerUserId, container } = resolved\n\n  // An API-key principal owns no mailbox, so it has nothing to share. 404 rather\n  // than 403, matching the per-message toggle's row-existence masking.\n  if (!viewerUserId) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  if (!organizationId) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId,\n    userId: viewerUserId,\n    resourceKind: 'customers.email_conversation_share',\n    resourceId: personId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  // Version token for optimistic locking, taken only from the request. An absent\n  // header means \"no expectation\" and is strictly additive \u2014 the shared assertion\n  // helper skips the check rather than blocking clients that never send it.\n  const expectedUpdatedAt = readOptimisticLockExpected(req)\n\n  const commandBus = container.resolve('commandBus') as CommandBus\n  let result: { shareId: string | null; changed: boolean }\n  try {\n    const executed = await commandBus.execute<\n      EmailConversationShareSetCommandInput,\n      { shareId: string | null; changed: boolean }\n    >('customers.email_conversation_shares.set', {\n      input: {\n        tenantId,\n        organizationId,\n        personEntityId: personId,\n        shared: body.shared,\n        expectedUpdatedAt,\n      },\n      ctx: {\n        container,\n        auth: (await getAuthFromRequest(req)) as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: [organizationId],\n      },\n    })\n    result = executed.result\n  } catch (err) {\n    // Surfaces the 409 conflict body and the 400 \"nothing to share\" case with\n    // their intended status instead of a generic 500.\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    throw err\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId,\n      userId: viewerUserId,\n      resourceKind: 'customers.email_conversation_share',\n      resourceId: personId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  // The person-detail cache is tagged on customers resources only, and this write\n  // lands in a different table, so the interaction collection tags are invalidated\n  // explicitly or a teammate would keep seeing the pre-share view until TTL.\n  await invalidatePersonDetailCache(container, tenantId, organizationId)\n\n  return NextResponse.json({ ok: true, changed: result.changed, shared: body.shared })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    GET: {\n      summary: 'Read the conversation-share state for a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Share state for the calling user' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Person not found or not visible to caller' },\n      ],\n    },\n    PUT: {\n      summary: 'Share or un-share your own email conversation with a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Share state updated' },\n        { status: 400, description: 'Invalid id, or no private conversation to share' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Person not found or not visible to caller' },\n        { status: 409, description: 'Optimistic lock conflict' },\n        { status: 422, description: 'Invalid body' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,sBAAsB;AAE/B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAErC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,iBAAiB,CAAC,uBAAuB;AAAA,EAC3C;AAAA,EACA,KAAK;AAAA,IACH,aAAa;AAAA,IACb,iBAAiB,CAAC,oCAAoC;AAAA,EACxD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO;AAoB5D,eAAe,cACb,KACA,UACoC;AACpC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,QAAM,SAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IACzE;AAAA,IACA;AAAA,MACE,UAAU,KAAK;AAAA,MACf,gBAAgB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IACpE;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,iBAAiB,OAAO,kBAAkB;AAChD,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,KAAK;AAAA,IACf,cAAc,KAAK,WAAW,OAAO,KAAK,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,WAAW,MAAM,cAAc,KAAK,QAAQ;AAClD,MAAI,oBAAoB,SAAU,QAAO;AACzC,QAAM,EAAE,IAAI,UAAU,gBAAgB,aAAa,IAAI;AACvD,QAAM,QAAQ,EAAE,UAAU,eAAe;AAEzC,QAAM,CAAC,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC3C,oBAAoB,IAAI,OAAO,QAAQ;AAAA,IACvC,qBAAqB,IAAI,OAAO,cAAc,QAAQ;AAAA,EACxD,CAAC;AAED,QAAM,WAAW,eACb,OAAO,KAAK,CAAC,QAAQ,IAAI,gBAAgB,YAAY,KAAK,OAC1D;AAGJ,QAAM,eAAe,OAAO,OAAO,CAAC,QAAQ,IAAI,gBAAgB,YAAY;AAC5E,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,IAAI,CAAC,QAAQ,IAAI,WAAW;AAAA,EAC3C;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,YAAY,CAAC,CAAC;AAAA,IACd;AAAA,IACA,WAAW,UAAU,YAAY,SAAS,UAAU,YAAY,IAAI;AAAA,IACpE,UAAU,aAAa,IAAI,CAAC,SAAS;AAAA,MACnC,QAAQ,IAAI;AAAA,MACZ,UAAU,WAAW,IAAI,IAAI,WAAW,KAAK;AAAA,MAC7C,UAAU,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,IAC1E,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,cAAc,KAAK,QAAQ;AAClD,MAAI,oBAAoB,SAAU,QAAO;AACzC,QAAM,EAAE,IAAI,UAAU,gBAAgB,cAAc,UAAU,IAAI;AAIlE,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAKA,QAAM,oBAAoB,2BAA2B,GAAG;AAExD,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,WAAW,QAGhC,2CAA2C;AAAA,MAC3C,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,gBAAgB;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA,MAAO,MAAM,mBAAmB,GAAG;AAAA,QACnC,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,CAAC,cAAc;AAAA,MAClC;AAAA,IACF,CAAC;AACD,aAAS,SAAS;AAAA,EACpB,SAAS,KAAK;AAGZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM;AAAA,EACR;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAKA,QAAM,4BAA4B,WAAW,UAAU,cAAc;AAErE,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,OAAO,SAAS,QAAQ,KAAK,OAAO,CAAC;AACrF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,4CAA4C;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,QAClD,EAAE,QAAQ,KAAK,aAAa,kDAAkD;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,4CAA4C;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,QACvD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customers/api/people/[id]/email-threads/route.js

@@ -4,9 +4,11 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
 import { CustomerEntity } from "../../../../data/entities.js";
 import { buildPersonEmailThreads } from "../../../../lib/personEmailThreads.js";
+import { listGrantsForViewerOnPerson, listSharedChannelIds } from "../../../../lib/conversationShares.js";
 const metadata = {
   path: "/customers/people/[id]/email-threads",
   GET: {
@@ -36,7 +38,7 @@ async function GET(req, context) {
       deletedAt: null
     },
     void 0,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null }
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null }
   );
   if (!person) {
     return NextResponse.json({ error: "Person not found" }, { status: 404 });
@@ -46,6 +48,11 @@ async function GET(req, context) {
     return NextResponse.json({ error: "Person not found" }, { status: 404 });
   }
   const viewerUserId = auth.isApiKey ? null : auth.sub ?? null;
+  const shareScope = { tenantId: auth.tenantId, organizationId };
+  const [sharedConversations, sharedChannelIds] = await Promise.all([
+    listGrantsForViewerOnPerson(em, shareScope, viewerUserId, personId),
+    listSharedChannelIds(em, shareScope, viewerUserId)
+  ]);
   const threads = await buildPersonEmailThreads(em, {
     personId,
     tenantId: auth.tenantId,
@@ -54,7 +61,9 @@ async function GET(req, context) {
     // The v1 visibility filter is owner-only and ignores `userFeatures`; match
     // the sibling read routes (people/[id], interactions) by passing `undefined`
     // rather than paying an RBAC round-trip the filter discards.
-    userFeatures: void 0
+    userFeatures: void 0,
+    sharedConversations,
+    sharedChannelIds
   });
   return NextResponse.json({ threads });
 }

package/dist/modules/customers/api/people/[id]/email-threads/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/people/%5Bid%5D/email-threads/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerEntity } from '../../../../data/entities'\nimport { buildPersonEmailThreads } from '../../../../lib/personEmailThreads'\n\nexport const metadata = {\n  path: '/customers/people/[id]/email-threads',\n  GET: {\n    requireAuth: true,\n    requireFeatures: ['customers.people.view'],\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function GET(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // Verify the Person exists in the caller's tenant, then fail-closed on the\n  // record's own organization \u2014 same pattern as the [id] detail route. Loading\n  // by tenant + id (not a hand-rolled selected org) keeps this working under the\n  // \"All organizations\" scope, where no concrete org is carried.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: scope?.selectedId ?? (auth as { orgId?: string | null }).orgId ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const viewerUserId = auth.isApiKey ? null : auth.sub ?? null\n\n  const threads = await buildPersonEmailThreads(em, {\n    personId,\n    tenantId: auth.tenantId as string,\n    organizationId,\n    viewerUserId,\n    // The v1 visibility filter is owner-only and ignores `userFeatures`; match\n    // the sibling read routes (people/[id], interactions) by passing `undefined`\n    // rather than paying an RBAC round-trip the filter discards.\n    userFeatures: undefined,\n  })\n\n  return NextResponse.json({ threads })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    GET: {\n      summary: 'List a Person\\'s email threads (Gmail-style conversation grouping)',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email threads for the person, grouped by conversation' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.people.view feature' },\n        { status: 404, description: 'Person not found' },\n      ],\n    },\n  },\n}\n\nexport default GET\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAChD,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AAEjC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,iBAAiB,CAAC,uBAAuB;AAAA,EAC3C;AACF;AAMA,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAM3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,OAAO,cAAe,KAAmC,SAAS,KAAK;AAAA,EAC9H;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,eAAe,KAAK,WAAW,OAAO,KAAK,OAAO;AAExD,QAAM,UAAU,MAAM,wBAAwB,IAAI;AAAA,IAChD;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,cAAc;AAAA,EAChB,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AACtC;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerEntity } from '../../../../data/entities'\nimport { buildPersonEmailThreads } from '../../../../lib/personEmailThreads'\nimport { listGrantsForViewerOnPerson, listSharedChannelIds } from '../../../../lib/conversationShares'\n\nexport const metadata = {\n  path: '/customers/people/[id]/email-threads',\n  GET: {\n    requireAuth: true,\n    requireFeatures: ['customers.people.view'],\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function GET(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // Verify the Person exists in the caller's tenant, then fail-closed on the\n  // record's own organization \u2014 same pattern as the [id] detail route. Loading\n  // by tenant + id (not a hand-rolled selected org) keeps this working under the\n  // \"All organizations\" scope, where no concrete org is carried.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const viewerUserId = auth.isApiKey ? null : auth.sub ?? null\n\n  // Conversation shares this viewer benefits from, scoped to THIS Person, so the\n  // Emails tab shows a handed-over history. Person-scoped, so it can never hit\n  // the SHARE_ARM_MAX cap.\n  const shareScope = { tenantId: auth.tenantId as string, organizationId }\n  const [sharedConversations, sharedChannelIds] = await Promise.all([\n    listGrantsForViewerOnPerson(em, shareScope, viewerUserId, personId),\n    listSharedChannelIds(em, shareScope, viewerUserId),\n  ])\n\n  const threads = await buildPersonEmailThreads(em, {\n    personId,\n    tenantId: auth.tenantId as string,\n    organizationId,\n    viewerUserId,\n    // The v1 visibility filter is owner-only and ignores `userFeatures`; match\n    // the sibling read routes (people/[id], interactions) by passing `undefined`\n    // rather than paying an RBAC round-trip the filter discards.\n    userFeatures: undefined,\n    sharedConversations,\n    sharedChannelIds,\n  })\n\n  return NextResponse.json({ threads })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    GET: {\n      summary: 'List a Person\\'s email threads (Gmail-style conversation grouping)',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email threads for the person, grouped by conversation' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.people.view feature' },\n        { status: 404, description: 'Person not found' },\n      ],\n    },\n  },\n}\n\nexport default GET\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,6BAA6B,4BAA4B;AAE3D,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,iBAAiB,CAAC,uBAAuB;AAAA,EAC3C;AACF;AAMA,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAM3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EAC9G;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,eAAe,KAAK,WAAW,OAAO,KAAK,OAAO;AAKxD,QAAM,aAAa,EAAE,UAAU,KAAK,UAAoB,eAAe;AACvE,QAAM,CAAC,qBAAqB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChE,4BAA4B,IAAI,YAAY,cAAc,QAAQ;AAAA,IAClE,qBAAqB,IAAI,YAAY,YAAY;AAAA,EACnD,CAAC;AAED,QAAM,UAAU,MAAM,wBAAwB,IAAI;AAAA,IAChD;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AACtC;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wDAAwD;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customers/api/people/[id]/emails/route.js

@@ -9,6 +9,7 @@ import {
   runCrudMutationGuardAfterSuccess
 } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
 import { resolveAuthActorId } from "../../../../lib/interactionRequestContext.js";
 import { CustomerEntity } from "../../../../data/entities.js";
@@ -64,7 +65,7 @@ async function POST(req, context) {
       deletedAt: null
     },
     void 0,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null }
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null }
   );
   if (!person) {
     return NextResponse.json({ error: "Person not found" }, { status: 404 });

package/dist/modules/customers/api/people/[id]/emails/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/people/%5Bid%5D/emails/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveAuthActorId } from '../../../../lib/interactionRequestContext'\nimport { CustomerEntity } from '../../../../data/entities'\nimport type { SendAsUserService } from '@open-mercato/core/modules/communication_channels/lib/send-as-user'\n\nexport const metadata = {\n  path: '/customers/people/[id]/emails',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['customers.email.compose'],\n  },\n}\n\nconst composeSchema = z\n  .object({\n    userChannelId: z.string().uuid(),\n    to: z.array(z.string().email()).min(1).max(50),\n    cc: z.array(z.string().email()).max(50).optional(),\n    bcc: z.array(z.string().email()).max(50).optional(),\n    subject: z.string().min(1).max(500),\n    body: z.string().min(1).max(200_000),\n    bodyFormat: z.enum(['text', 'html']).default('html'),\n    visibility: z.enum(['private', 'shared']).default('private'),\n    inReplyTo: z.string().max(500).optional(),\n    references: z.array(z.string().max(500)).max(50).optional(),\n    parentMessageId: z.string().uuid().optional(),\n  })\n  .strict()\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof composeSchema>\n  try {\n    body = composeSchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const userId = resolveAuthActorId(auth)\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // 1. Verify the Person exists in the caller's tenant, then fail-closed on the\n  //    record's own organization \u2014 same pattern as the [id]/route.ts GET handler.\n  //    Loading by tenant + id (not a hand-rolled selected org) keeps this working\n  //    under the \"All organizations\" scope; the record's own org then becomes the\n  //    concrete org the guard and the outbound message are attributed to.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: scope?.selectedId ?? (auth as { orgId?: string | null }).orgId ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId,\n    resourceKind: 'customers.person',\n    resourceId: personId,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  // 2. Call the hub's send-as-user facade in-process (resolved via DI) so the\n  //    customers module makes no HTTP self-call. `crmVisibility` and `crmPersonId`\n  //    are injected as channelMetadata so the link-channel-message subscriber can\n  //    anchor the sent message back to this Person on the\n  //    `communication_channels.message.sent` event.\n  const sendAsUserService = container.resolve(\n    'communicationChannelsSendAsUser',\n  ) as SendAsUserService\n\n  const sendResult = await sendAsUserService(\n    container,\n    { userId: auth.sub as string, tenantId: auth.tenantId as string, organizationId, auth },\n    {\n      userChannelId: body.userChannelId,\n      to: body.to,\n      cc: body.cc,\n      bcc: body.bcc,\n      subject: body.subject,\n      body: body.bodyFormat === 'html' ? { html: body.body } : { plain: body.body },\n      inReplyTo: body.inReplyTo,\n      references: body.references,\n      parentMessageId: body.parentMessageId,\n      channelMetadata: {\n        crmVisibility: body.visibility,\n        crmPersonId: personId,\n      },\n    },\n  )\n\n  if (!sendResult.ok) {\n    return NextResponse.json({ error: sendResult.error }, { status: sendResult.status })\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId,\n      resourceKind: 'customers.person',\n      resourceId: personId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  // Delivery is async (handled by the outbound queue worker), so this is the\n  // enqueue time \u2014 not the provider send time \u2014 and the provider's external\n  // message id is not known yet (the worker assigns it on successful delivery).\n  return NextResponse.json({\n    messageId: sendResult.messageId,\n    threadId: sendResult.threadId,\n    queuedAt: new Date().toISOString(),\n  })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    POST: {\n      summary: 'Compose + send an email anchored to a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email queued for send' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.email.compose feature or mutation guard rejection' },\n        { status: 404, description: 'Person or channel not found' },\n        { status: 409, description: 'Channel not connected' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Send failed' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAGxB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,yBAAyB;AAAA,EAC7C;AACF;AAEA,MAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC7C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACjD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAClD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA,EACnD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC9C,CAAC,EACA,OAAO;AAMV,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,cAAc,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,SAAS,mBAAmB,IAAI;AACtC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAO3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,OAAO,cAAe,KAAmC,SAAS,KAAK;AAAA,EAC9H;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAOA,QAAM,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,QAAQ,KAAK,KAAe,UAAU,KAAK,UAAoB,gBAAgB,KAAK;AAAA,IACtF;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,IAAI,KAAK;AAAA,MACT,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,MAAM,KAAK,eAAe,SAAS,EAAE,MAAM,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,KAAK;AAAA,MAC5E,WAAW,KAAK;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,iBAAiB,KAAK;AAAA,MACtB,iBAAiB;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,MAAM,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAKA,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveAuthActorId } from '../../../../lib/interactionRequestContext'\nimport { CustomerEntity } from '../../../../data/entities'\nimport type { SendAsUserService } from '@open-mercato/core/modules/communication_channels/lib/send-as-user'\n\nexport const metadata = {\n  path: '/customers/people/[id]/emails',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['customers.email.compose'],\n  },\n}\n\nconst composeSchema = z\n  .object({\n    userChannelId: z.string().uuid(),\n    to: z.array(z.string().email()).min(1).max(50),\n    cc: z.array(z.string().email()).max(50).optional(),\n    bcc: z.array(z.string().email()).max(50).optional(),\n    subject: z.string().min(1).max(500),\n    body: z.string().min(1).max(200_000),\n    bodyFormat: z.enum(['text', 'html']).default('html'),\n    visibility: z.enum(['private', 'shared']).default('private'),\n    inReplyTo: z.string().max(500).optional(),\n    references: z.array(z.string().max(500)).max(50).optional(),\n    parentMessageId: z.string().uuid().optional(),\n  })\n  .strict()\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof composeSchema>\n  try {\n    body = composeSchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const userId = resolveAuthActorId(auth)\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // 1. Verify the Person exists in the caller's tenant, then fail-closed on the\n  //    record's own organization \u2014 same pattern as the [id]/route.ts GET handler.\n  //    Loading by tenant + id (not a hand-rolled selected org) keeps this working\n  //    under the \"All organizations\" scope; the record's own org then becomes the\n  //    concrete org the guard and the outbound message are attributed to.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId,\n    resourceKind: 'customers.person',\n    resourceId: personId,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  // 2. Call the hub's send-as-user facade in-process (resolved via DI) so the\n  //    customers module makes no HTTP self-call. `crmVisibility` and `crmPersonId`\n  //    are injected as channelMetadata so the link-channel-message subscriber can\n  //    anchor the sent message back to this Person on the\n  //    `communication_channels.message.sent` event.\n  const sendAsUserService = container.resolve(\n    'communicationChannelsSendAsUser',\n  ) as SendAsUserService\n\n  const sendResult = await sendAsUserService(\n    container,\n    { userId: auth.sub as string, tenantId: auth.tenantId as string, organizationId, auth },\n    {\n      userChannelId: body.userChannelId,\n      to: body.to,\n      cc: body.cc,\n      bcc: body.bcc,\n      subject: body.subject,\n      body: body.bodyFormat === 'html' ? { html: body.body } : { plain: body.body },\n      inReplyTo: body.inReplyTo,\n      references: body.references,\n      parentMessageId: body.parentMessageId,\n      channelMetadata: {\n        crmVisibility: body.visibility,\n        crmPersonId: personId,\n      },\n    },\n  )\n\n  if (!sendResult.ok) {\n    return NextResponse.json({ error: sendResult.error }, { status: sendResult.status })\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId,\n      resourceKind: 'customers.person',\n      resourceId: personId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  // Delivery is async (handled by the outbound queue worker), so this is the\n  // enqueue time \u2014 not the provider send time \u2014 and the provider's external\n  // message id is not known yet (the worker assigns it on successful delivery).\n  return NextResponse.json({\n    messageId: sendResult.messageId,\n    threadId: sendResult.threadId,\n    queuedAt: new Date().toISOString(),\n  })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    POST: {\n      summary: 'Compose + send an email anchored to a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email queued for send' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.email.compose feature or mutation guard rejection' },\n        { status: 404, description: 'Person or channel not found' },\n        { status: 409, description: 'Channel not connected' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Send failed' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAGxB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,yBAAyB;AAAA,EAC7C;AACF;AAEA,MAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC7C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACjD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAClD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA,EACnD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC9C,CAAC,EACA,OAAO;AAMV,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,cAAc,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,SAAS,mBAAmB,IAAI;AACtC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAO3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EAC9G;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAOA,QAAM,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,QAAQ,KAAK,KAAe,UAAU,KAAK,UAAoB,gBAAgB,KAAK;AAAA,IACtF;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,IAAI,KAAK;AAAA,MACT,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,MAAM,KAAK,eAAe,SAAS,EAAE,MAAM,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,KAAK;AAAA,MAC5E,WAAW,KAAK;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,iBAAiB,KAAK;AAAA,MACtB,iBAAiB;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,MAAM,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAKA,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
   "names": []
 }