@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/src/modules/sales/commands/payments.ts

@@ -6,6 +6,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
+import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
 import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'
 import { E } from '#generated/entities.ids.generated'
 import {
@@ -218,7 +219,7 @@ export async function restorePaymentSnapshot(em: EntityManager, snapshot: Paymen
       tenantId: entity.tenantId,
       values:
         snapshot.customFields && typeof snapshot.customFields === 'object'
-          ? (snapshot.customFields as Record<string, unknown>)
+          ? normalizeCustomFieldResponse(snapshot.customFields as Record<string, unknown>) ?? {}
           : {},
     })
   }

package/src/modules/sales/commands/settings.ts

@@ -1,11 +1,30 @@
 import { registerCommand } from '@open-mercato/shared/lib/commands'
-import type { CommandHandler } from '@open-mercato/shared/lib/commands'
+import type { CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { SalesSettings } from '../data/entities'
 import { salesSettingsUpsertSchema, type SalesSettingsUpsertInput } from '../data/validators'
 import { ensureOrganizationScope, ensureTenantScope } from './shared'
 import { SalesDocumentNumberGenerator } from '../services/salesDocumentNumberGenerator'
 
+async function ensureNumberEditPermission(
+  ctx: CommandRuntimeContext,
+  scope: { tenantId: string; organizationId: string }
+) {
+  const rbac = ctx.container.resolve('rbacService') as RbacService | null
+  const auth = ctx.auth
+  if (!rbac || !auth?.sub) return
+  const ok = await rbac.userHasAllFeatures(auth.sub, ['sales.documents.number.edit'], scope)
+  if (!ok) {
+    const { translate } = await resolveTranslations()
+    throw new CrudHttpError(403, {
+      error: translate('sales.documents.errors.number_edit_forbidden', 'Document number cannot be edited.'),
+    })
+  }
+}
+
 export async function loadSalesSettings(
   em: EntityManager,
   params: { tenantId: string; organizationId: string }
@@ -34,6 +53,16 @@ const saveSalesSettingsCommand: CommandHandler<
     ensureTenantScope(ctx, input.tenantId)
     ensureOrganizationScope(ctx, input.organizationId)
 
+    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator
+    const current = await generator.peekSequences(input)
+    const orderNextNumber =
+      input.orderNextNumber && input.orderNextNumber !== current.order ? input.orderNextNumber : undefined
+    const quoteNextNumber =
+      input.quoteNextNumber && input.quoteNextNumber !== current.quote ? input.quoteNextNumber : undefined
+    if (orderNextNumber || quoteNextNumber) {
+      await ensureNumberEditPermission(ctx, { tenantId: input.tenantId, organizationId: input.organizationId })
+    }
+
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let settings = await loadSalesSettings(em, {
       tenantId: input.tenantId,
@@ -67,12 +96,11 @@ const saveSalesSettingsCommand: CommandHandler<
 
     await em.flush()
 
-    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator
-    if (input.orderNextNumber) {
-      await generator.setNextSequence('order', input, input.orderNextNumber)
+    if (orderNextNumber) {
+      await generator.setNextSequence('order', input, orderNextNumber)
     }
-    if (input.quoteNextNumber) {
-      await generator.setNextSequence('quote', input, input.quoteNextNumber)
+    if (quoteNextNumber) {
+      await generator.setNextSequence('quote', input, quoteNextNumber)
     }
     const sequences = await generator.peekSequences(input)
 

package/src/modules/sales/commands/shipments.ts

@@ -7,6 +7,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
+import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
 import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'
 import { E } from '#generated/entities.ids.generated'
 import { SalesOrder, SalesOrderLine, SalesShipment, SalesShipmentItem } from '../data/entities'
@@ -296,7 +297,7 @@ export async function restoreShipmentSnapshot(em: EntityManager, snapshot: Shipm
       recordId: entity.id,
       organizationId: snapshot.organizationId,
       tenantId: snapshot.tenantId,
-      values: normalizeCustomFieldsInput((snapshot as any).customFields),
+      values: normalizeCustomFieldResponse(normalizeCustomFieldsInput((snapshot as any).customFields)) ?? {},
     })
   }
   em.persist(entity)

package/src/modules/sales/components/DocumentNumberSettings.tsx

@@ -5,7 +5,8 @@ import { Loader2, RefreshCw } from 'lucide-react'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
 import { Badge } from '@open-mercato/ui/primitives/badge'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -27,21 +28,21 @@ type SettingsResponse = {
   tokens?: typeof DOCUMENT_NUMBER_TOKENS
 }
 
-type FormState = {
+export type DocumentNumberSettingsFormState = {
   orderNumberFormat: string
   quoteNumberFormat: string
   orderNextNumber: string
   quoteNextNumber: string
 }
 
-const DEFAULT_STATE: FormState = {
+const DEFAULT_STATE: DocumentNumberSettingsFormState = {
   orderNumberFormat: DEFAULT_ORDER_NUMBER_FORMAT,
   quoteNumberFormat: DEFAULT_QUOTE_NUMBER_FORMAT,
   orderNextNumber: '1',
   quoteNextNumber: '1',
 }
 
-const normalizeState = (payload?: Partial<SettingsResponse> | null): FormState => ({
+const normalizeState = (payload?: Partial<SettingsResponse> | null): DocumentNumberSettingsFormState => ({
   orderNumberFormat:
     typeof payload?.orderNumberFormat === 'string' && payload.orderNumberFormat.trim().length
       ? payload.orderNumberFormat
@@ -60,12 +61,26 @@ const normalizeState = (payload?: Partial<SettingsResponse> | null): FormState =
       : '1',
 })
 
+const parseCounter = (value: string): number | undefined => Number.parseInt(value, 10) || undefined
+
+export function buildDocumentNumberSettingsPayload(formState: DocumentNumberSettingsFormState, loadedState: DocumentNumberSettingsFormState) {
+  const orderNextNumber = parseCounter(formState.orderNextNumber)
+  const quoteNextNumber = parseCounter(formState.quoteNextNumber)
+  return {
+    orderNumberFormat: formState.orderNumberFormat.trim(),
+    quoteNumberFormat: formState.quoteNumberFormat.trim(),
+    orderNextNumber: orderNextNumber !== parseCounter(loadedState.orderNextNumber) ? orderNextNumber : undefined,
+    quoteNextNumber: quoteNextNumber !== parseCounter(loadedState.quoteNextNumber) ? quoteNextNumber : undefined,
+  }
+}
+
 const SAVE_CONTEXT_ID = 'sales-document-number-settings'
 
 export function DocumentNumberSettings() {
   const t = useT()
   const scopeVersion = useOrganizationScopeVersion()
-  const [formState, setFormState] = React.useState<FormState>(DEFAULT_STATE)
+  const [formState, setFormState] = React.useState<DocumentNumberSettingsFormState>(DEFAULT_STATE)
+  const loadedStateRef = React.useRef<DocumentNumberSettingsFormState>(DEFAULT_STATE)
   const [loading, setLoading] = React.useState(false)
   const [saving, setSaving] = React.useState(false)
   const [tokens, setTokens] = React.useState(DOCUMENT_NUMBER_TOKENS)
@@ -112,7 +127,9 @@ export function DocumentNumberSettings() {
     try {
       const call = await apiCall<SettingsResponse>('/api/sales/settings/document-numbers')
       if (call.ok) {
-        setFormState(normalizeState(call.result))
+        const loaded = normalizeState(call.result)
+        loadedStateRef.current = loaded
+        setFormState(loaded)
         setTokens(Array.isArray(call.result?.tokens) && call.result.tokens.length ? call.result.tokens : DOCUMENT_NUMBER_TOKENS)
       } else {
         flash(translations.errors.load, 'error')
@@ -129,7 +146,7 @@ export function DocumentNumberSettings() {
     void handleLoad()
   }, [handleLoad, scopeVersion])
 
-  const handleChange = (key: keyof FormState) => (event: React.ChangeEvent<HTMLInputElement>) => {
+  const handleChange = (key: keyof DocumentNumberSettingsFormState) => (event: React.ChangeEvent<HTMLInputElement>) => {
     setFormState((prev) => ({ ...prev, [key]: event.target.value }))
   }
 
@@ -137,25 +154,19 @@ export function DocumentNumberSettings() {
     event.preventDefault()
     setSaving(true)
     try {
-      const payload = {
-        orderNumberFormat: formState.orderNumberFormat.trim(),
-        quoteNumberFormat: formState.quoteNumberFormat.trim(),
-        orderNextNumber: Number.parseInt(formState.orderNextNumber, 10) || undefined,
-        quoteNextNumber: Number.parseInt(formState.quoteNextNumber, 10) || undefined,
-      }
+      const payload = buildDocumentNumberSettingsPayload(formState, loadedStateRef.current)
       const call = await runMutation({
         // optimistic-lock-exempt: single-row tenant numbering settings blob — no per-record version / concurrent record edit
-        operation: async () => {
-          const response = await apiCall<SettingsResponse>('/api/sales/settings/document-numbers', {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify(payload),
-          })
-          if (!response.ok) {
-            throw new Error(translations.errors.save)
-          }
-          return response
-        },
+        operation: () =>
+          apiCallOrThrow<SettingsResponse>(
+            '/api/sales/settings/document-numbers',
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify(payload),
+            },
+            { errorMessage: translations.errors.save },
+          ),
         context: {
           formId: SAVE_CONTEXT_ID,
           resourceKind: 'sales.settings',
@@ -163,19 +174,21 @@ export function DocumentNumberSettings() {
         },
         mutationPayload: payload,
       })
-      setFormState(normalizeState(call.result))
+      const saved = normalizeState(call.result)
+      loadedStateRef.current = saved
+      setFormState(saved)
       setTokens(Array.isArray(call.result?.tokens) && call.result.tokens.length ? call.result.tokens : DOCUMENT_NUMBER_TOKENS)
       flash(translations.messages.saved, 'success')
     } catch (err) {
       logger.error('sales.document-number-settings.save failed', { err })
-      flash(translations.errors.save, 'error')
+      flash(normalizeCrudServerError(err).message || translations.errors.save, 'error')
     } finally {
       setSaving(false)
     }
-  }, [formState.orderNextNumber, formState.orderNumberFormat, formState.quoteNextNumber, formState.quoteNumberFormat, retryLastMutation, runMutation, translations.errors.save, translations.messages.saved])
+  }, [formState, retryLastMutation, runMutation, translations.errors.save, translations.messages.saved])
 
   const handleReset = React.useCallback(() => {
-    setFormState(DEFAULT_STATE)
+    setFormState(loadedStateRef.current)
     void handleLoad()
   }, [handleLoad])
 

package/src/modules/sales/components/documents/ItemsSection.tsx

@@ -131,6 +131,11 @@ function resolveInjectedColumnValue(
   return current;
 }
 
+const LINES_PAGE_SIZE = 100;
+// Upper bound on line pages fetched for one document, so an API that ignores `page`
+// cannot spin the loader forever.
+const LINES_MAX_PAGES = 200;
+
 const SHIPMENTS_PAGE_SIZE = 100;
 // A single order beyond this many shipment pages is pathological; stopping there
 // keeps the shipped state explicitly unresolved rather than silently partial.
@@ -204,6 +209,7 @@ export function SalesDocumentItemsSection({
   const documentKey = kind === "order" ? "orderId" : "quoteId";
   const lineStatusesLoaded = React.useRef(false);
   const itemsLoadedForDocument = React.useRef<string | null>(null);
+  const itemsLoadSeq = React.useRef(0);
   const shipmentsLoadedForDocument = React.useRef<string | null>(null);
   const loadLineStatuses = React.useCallback(async () => {
     try {
@@ -222,21 +228,58 @@ export function SalesDocumentItemsSection({
   }, []);
 
   const loadItems = React.useCallback(async () => {
+    const loadSeq = ++itemsLoadSeq.current;
+    const isCurrentLoad = () => loadSeq === itemsLoadSeq.current;
     setLoading(true);
     setError(null);
     try {
-      const params = new URLSearchParams({
-        page: "1",
-        pageSize: "100",
-        [documentKey]: documentId,
-      });
-      const response = await apiCall<{
-        items?: Array<Record<string, unknown>>;
-      }>(`/api/${resourcePath}?${params.toString()}`, undefined, {
-        fallback: { items: [] },
-      });
-      if (response.ok && Array.isArray(response.result?.items)) {
-        const mapped = response.result.items.flatMap<SalesLineRecord>(
+      const collectedItems: Array<Record<string, unknown>> = [];
+      const seenIds = new Set<string>();
+      let loaded = false;
+      let complete = false;
+      let page = 1;
+      while (page <= LINES_MAX_PAGES) {
+        const params = new URLSearchParams({
+          page: String(page),
+          pageSize: String(LINES_PAGE_SIZE),
+          [documentKey]: documentId,
+        });
+        const response = await apiCall<{
+          items?: Array<Record<string, unknown>>;
+          total?: unknown;
+        }>(`/api/${resourcePath}?${params.toString()}`, undefined, {
+          fallback: { items: [] },
+        });
+        if (!response.ok || !Array.isArray(response.result?.items)) {
+          if (page > 1) throw new Error("[internal] sales line page failed to load");
+          complete = true;
+          break;
+        }
+        loaded = true;
+        const pageItems = response.result.items;
+        let added = 0;
+        pageItems.forEach((item) => {
+          const id = typeof item.id === "string" ? item.id : null;
+          if (id && seenIds.has(id)) return;
+          if (id) seenIds.add(id);
+          collectedItems.push(item);
+          added += 1;
+        });
+        const reportedTotal = normalizeNumber(response.result?.total, Number.NaN);
+        const hasMore =
+          added > 0 &&
+          pageItems.length >= LINES_PAGE_SIZE &&
+          (!Number.isFinite(reportedTotal) || collectedItems.length < reportedTotal);
+        if (!hasMore) {
+          complete = true;
+          break;
+        }
+        page += 1;
+      }
+      if (!complete) throw new Error("[internal] sales line page limit reached");
+      if (!isCurrentLoad()) return;
+      if (loaded) {
+        const mapped = collectedItems.flatMap<SalesLineRecord>(
           (item) => {
             const id = typeof item.id === "string" ? item.id : null;
             if (!id) return [];
@@ -380,11 +423,13 @@ export function SalesDocumentItemsSection({
         if (onItemsChange) onItemsChange([]);
       }
     } catch (err) {
+      if (!isCurrentLoad()) return;
       logger.error('sales.document.items.load', { err });
       setError(t("sales.documents.items.errorLoad", "Failed to load items."));
+      setItems([]);
       if (onItemsChange) onItemsChange([]);
     } finally {
-      setLoading(false);
+      if (isCurrentLoad()) setLoading(false);
     }
   }, [currencyCode, documentId, documentKey, onItemsChange, resourcePath, t]);
 

package/src/modules/sales/i18n/de.json

@@ -845,6 +845,8 @@
   "sales.documents.errors.number_generate_failed": "Dokumentnummer konnte nicht generiert werden.",
   "sales.documents.errors.organization_required": "Organisationskontext ist erforderlich.",
   "sales.documents.errors.unauthorized": "Nicht autorisiert",
+  "sales.documents.errors.undoStaleOrder": "Diese Änderung kann nicht mehr rückgängig gemacht werden, da der Auftrag danach geändert wurde.",
+  "sales.documents.errors.undoStaleQuote": "Diese Änderung kann nicht mehr rückgängig gemacht werden, da das Angebot danach geändert wurde.",
   "sales.documents.form.address.city": "Stadt",
   "sales.documents.form.address.company": "Firma (optional)",
   "sales.documents.form.address.country": "Land",

package/src/modules/sales/i18n/en.json

@@ -845,6 +845,8 @@
   "sales.documents.errors.number_generate_failed": "Failed to generate document number.",
   "sales.documents.errors.organization_required": "Organization context is required.",
   "sales.documents.errors.unauthorized": "Unauthorized",
+  "sales.documents.errors.undoStaleOrder": "This change can no longer be undone because the order was changed afterwards.",
+  "sales.documents.errors.undoStaleQuote": "This change can no longer be undone because the quote was changed afterwards.",
   "sales.documents.form.address.city": "City",
   "sales.documents.form.address.company": "Company (optional)",
   "sales.documents.form.address.country": "Country",

package/src/modules/sales/i18n/es.json

@@ -845,6 +845,8 @@
   "sales.documents.errors.number_generate_failed": "No se pudo generar el número de documento.",
   "sales.documents.errors.organization_required": "Se requiere contexto de organización.",
   "sales.documents.errors.unauthorized": "No autorizado",
+  "sales.documents.errors.undoStaleOrder": "Este cambio ya no se puede deshacer porque el pedido se modificó después.",
+  "sales.documents.errors.undoStaleQuote": "Este cambio ya no se puede deshacer porque la cotización se modificó después.",
   "sales.documents.form.address.city": "Ciudad",
   "sales.documents.form.address.company": "Empresa (opcional)",
   "sales.documents.form.address.country": "País",

package/src/modules/sales/i18n/ko.json

@@ -845,6 +845,8 @@
   "sales.documents.errors.number_generate_failed": "문서 번호를 생성하지 못했습니다.",
   "sales.documents.errors.organization_required": "조직 컨텍스트가 필요합니다.",
   "sales.documents.errors.unauthorized": "권한이 없습니다",
+  "sales.documents.errors.undoStaleOrder": "이후에 주문이 변경되어 이 변경 사항을 더 이상 실행 취소할 수 없습니다.",
+  "sales.documents.errors.undoStaleQuote": "이후에 견적이 변경되어 이 변경 사항을 더 이상 실행 취소할 수 없습니다.",
   "sales.documents.form.address.city": "도시",
   "sales.documents.form.address.company": "회사명 (선택)",
   "sales.documents.form.address.country": "국가",

package/src/modules/sales/i18n/pl.json

@@ -845,6 +845,8 @@
   "sales.documents.errors.number_generate_failed": "Nie udało się wygenerować numeru dokumentu.",
   "sales.documents.errors.organization_required": "Wymagany jest kontekst organizacji.",
   "sales.documents.errors.unauthorized": "Brak autoryzacji",
+  "sales.documents.errors.undoStaleOrder": "Tej zmiany nie można już cofnąć, ponieważ zamówienie zostało później zmienione.",
+  "sales.documents.errors.undoStaleQuote": "Tej zmiany nie można już cofnąć, ponieważ oferta została później zmieniona.",
   "sales.documents.form.address.city": "Miasto",
   "sales.documents.form.address.company": "Firma (opcjonalnie)",
   "sales.documents.form.address.country": "Kraj",

package/src/modules/sales/lib/lineSnapshots.ts

@@ -138,3 +138,39 @@ export function resolveUpsertTotalsOrigin(
   if (callerTotalNetAmount !== null && callerTotalNetAmount !== undefined) return {}
   return existingSnapshot != null ? { totalsFromStoredRow: true } : {}
 }
+
+/** Reuse stored tax/gross only while the edited line's pricing inputs are unchanged. */
+export function resolveUpsertCalculatedAmounts(
+  caller: Pick<SalesLineSnapshot, 'taxAmount' | 'totalGrossAmount'>,
+  nextSnapshot: SalesLineSnapshot,
+  existingSnapshot: SalesLineSnapshot | null,
+): Pick<SalesLineSnapshot, 'taxAmount' | 'totalGrossAmount'> {
+  const pricingFields = [
+    'quantity',
+    'unitPriceNet',
+    'unitPriceGross',
+    'taxRate',
+  ] as const
+  const nextDiscountAmount = nextSnapshot.discountAmount ?? 0
+  const nextDiscountLineAmount = nextSnapshot.discountAmountFromStoredRow === true ||
+    nextSnapshot.discountAmountBasis === 'line'
+    ? nextDiscountAmount
+    : nextDiscountAmount * nextSnapshot.quantity
+  const discountChanged =
+    (nextSnapshot.discountPercent ?? 0) !== (existingSnapshot?.discountPercent ?? 0) ||
+    ((nextSnapshot.discountPercent ?? 0) === 0 &&
+      Math.round((nextDiscountLineAmount + Number.EPSILON) * 1e4) / 1e4 !==
+        (existingSnapshot?.discountAmount ?? 0))
+  const pricingChanged = existingSnapshot === null || discountChanged ||
+    pricingFields.some((field) => (nextSnapshot[field] ?? 0) !== (existingSnapshot[field] ?? 0))
+  const grossChanged = caller.totalGrossAmount !== undefined && caller.totalGrossAmount !== null &&
+    caller.totalGrossAmount !== existingSnapshot?.totalGrossAmount
+  const taxChanged = caller.taxAmount !== undefined && caller.taxAmount !== null &&
+    caller.taxAmount !== existingSnapshot?.taxAmount
+  return {
+    taxAmount: caller.taxAmount ??
+      (pricingChanged || grossChanged ? null : existingSnapshot?.taxAmount ?? null),
+    totalGrossAmount: caller.totalGrossAmount ??
+      (pricingChanged || taxChanged ? null : existingSnapshot?.totalGrossAmount ?? null),
+  }
+}

package/src/modules/sales/setup.ts

@@ -2,10 +2,6 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
 import { SalesSettings, SalesDocumentSequence, SalesTaxRate } from './data/entities'
 import { DEFAULT_ORDER_NUMBER_FORMAT, DEFAULT_QUOTE_NUMBER_FORMAT } from './lib/documentNumberTokens'
-import { seedSalesStatusDictionaries, seedSalesAdjustmentKinds } from './lib/dictionaries'
-import { seedSalesChannelsToggle } from './lib/salesChannelsToggleSeed'
-import { ensureExampleShippingMethods, ensureExamplePaymentMethods } from './seed/examples-data'
-import { seedSalesExamples } from './seed/examples'
 import { createDocumentSequence } from './services/salesDocumentNumberGenerator'
 
 type SeedScope = { tenantId: string; organizationId: string }
@@ -123,6 +119,9 @@ export const setup: ModuleSetupConfig = {
   },
 
   async seedDefaults({ em, tenantId, organizationId }) {
+    const { seedSalesStatusDictionaries, seedSalesAdjustmentKinds } = await import('./lib/dictionaries')
+    const { ensureExampleShippingMethods, ensureExamplePaymentMethods } = await import('./seed/examples-data')
+    const { seedSalesChannelsToggle } = await import('./lib/salesChannelsToggleSeed')
     const scope = { tenantId, organizationId }
     await seedSalesTaxRates(em, scope)
     await seedSalesStatusDictionaries(em, scope)
@@ -133,6 +132,7 @@ export const setup: ModuleSetupConfig = {
   },
 
   async seedExamples({ em, container, tenantId, organizationId }) {
+    const { seedSalesExamples } = await import('./seed/examples')
     const scope = { tenantId, organizationId }
     await seedSalesExamples(em, container, scope)
   },

package/src/modules/sales/widgets/notifications/SalesOrderCreatedRenderer.tsx

@@ -46,7 +46,7 @@ export function SalesOrderCreatedRenderer({
   const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null
 
   const handleView = async () => {
-    if (!viewAction) {
+    if (!viewAction || notification.status === 'actioned') {
       if (notification.linkHref) router.push(notification.linkHref)
       return
     }
@@ -128,7 +128,7 @@ export function SalesOrderCreatedRenderer({
               e.stopPropagation()
               handleView()
             }}
-            disabled={executing || (!viewAction && !notification.linkHref)}
+            disabled={executing || (!viewAction && !notification.linkHref) || (notification.status === 'actioned' && !notification.linkHref)}
           >
             <ExternalLink className="size-3.5" aria-hidden="true" />
             {t('sales.notifications.renderer.viewOrder', 'View Order')}

package/src/modules/sales/widgets/notifications/SalesQuoteCreatedRenderer.tsx

@@ -45,7 +45,7 @@ export function SalesQuoteCreatedRenderer({
   const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null
 
   const handleView = async () => {
-    if (!viewAction) {
+    if (!viewAction || notification.status === 'actioned') {
       if (notification.linkHref) router.push(notification.linkHref)
       return
     }
@@ -125,7 +125,7 @@ export function SalesQuoteCreatedRenderer({
                 e.stopPropagation()
                 handleView()
               }}
-              disabled={executing || (!viewAction && !notification.linkHref)}
+              disabled={executing || (!viewAction && !notification.linkHref) || (notification.status === 'actioned' && !notification.linkHref)}
               className="gap-1"
             >
               <ExternalLink className="h-3 w-3" />

package/src/modules/staff/api/leave-requests/accept/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -35,7 +36,7 @@ async function buildContext(
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req,
   }

package/src/modules/staff/api/leave-requests/reject/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -35,7 +36,7 @@ async function buildContext(
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req,
   }

package/src/modules/staff/api/leave-requests.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -92,7 +93,7 @@ async function resolveLeaveRequestAccess(ctx: any): Promise<LeaveRequestAccess>
     return { canManage: false, canSend: false, canView: false, memberId: null }
   }
   const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null
-  const organizationId = ctx.selectedOrganizationId ?? ctx.organizationScope?.selectedId ?? auth.orgId ?? null
+  const organizationId = ctx.selectedOrganizationId ?? resolveSingleOrganizationIdOrDeny(ctx.organizationScope, auth) ?? null
   const rbac = (ctx.container.resolve('rbacService') as RbacService)
   const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([
     rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),

package/src/modules/staff/api/team-members/self/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -42,7 +43,7 @@ async function buildContext(
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req,
   }

package/src/modules/staff/api/team-members/tags/assign/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -38,7 +39,7 @@ async function buildContext(
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req,
   }

package/src/modules/staff/api/team-members/tags/unassign/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -38,7 +39,7 @@ async function buildContext(
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req,
   }