@open-mercato/core 0.9.1-develop.7499.1.fcec456e4e → 0.9.1-develop.7515.1.e2712c8b00

package/src/modules/warranty_claims/commands/claims.ts

@@ -68,6 +68,7 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   requireScopedClaim,
+  throwUndoRefusal,
   type WarrantyClaimScope,
 } from './shared'
 
@@ -628,8 +629,8 @@ function restoreLineDelta(line: WarrantyClaimLine, before: ClaimLineSnapshot, af
   line.updatedAt = new Date()
 }
 
-function throwClaimUndoConflict(): never {
-  throw new CrudHttpError(409, { error: 'warranty_claims.errors.conflict' })
+function throwClaimUndoConflict(): Promise<never> {
+  return throwUndoRefusal('warranty_claims.errors.conflict', 'This claim changed while you were editing it.')
 }
 
 async function requireCurrentUndoSnapshot(
@@ -645,7 +646,7 @@ async function requireCurrentUndoSnapshot(
     scope,
   )
   const expectedClaimUpdatedAt = toIso(after.updatedAt)
-  if (!claim || !expectedClaimUpdatedAt || toIso(claim.updatedAt) !== expectedClaimUpdatedAt) throwClaimUndoConflict()
+  if (!claim || !expectedClaimUpdatedAt || toIso(claim.updatedAt) !== expectedClaimUpdatedAt) return throwClaimUndoConflict()
   const lines = await findWithDecryption(
     em,
     WarrantyClaimLine,
@@ -654,12 +655,12 @@ async function requireCurrentUndoSnapshot(
     scope,
   )
   const afterLines = Array.isArray(after.lines) ? after.lines : []
-  if (lines.length !== afterLines.length) throwClaimUndoConflict()
+  if (lines.length !== afterLines.length) return throwClaimUndoConflict()
   const afterLinesById = new Map(afterLines.map((line) => [line.id, line]))
   for (const line of lines) {
     const expected = afterLinesById.get(line.id)
     const expectedLineUpdatedAt = toIso(expected?.updatedAt)
-    if (!expectedLineUpdatedAt || toIso(line.updatedAt) !== expectedLineUpdatedAt) throwClaimUndoConflict()
+    if (!expectedLineUpdatedAt || toIso(line.updatedAt) !== expectedLineUpdatedAt) return throwClaimUndoConflict()
   }
   return { claim, lines }
 }
@@ -679,7 +680,7 @@ async function restoreSnapshot(em: EntityManager, before: ClaimSnapshot, after:
   for (const line of lines) {
     const beforeLine = beforeLinesById.get(line.id)
     const afterLine = afterLinesById.get(line.id)
-    if (!beforeLine || !afterLine) throwClaimUndoConflict()
+    if (!beforeLine || !afterLine) return throwClaimUndoConflict()
     if (snapshotValueChanged(beforeLine, afterLine)) restoreLineDelta(line, beforeLine, afterLine)
   }
   return claim
@@ -1690,7 +1691,7 @@ const updateClaimCommand: CommandHandler<ClaimUpdateInput, { claimId: string }>
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let claim!: WarrantyClaim
     await withAtomicFlush(em, [
@@ -1754,7 +1755,7 @@ const deleteClaimCommand: CommandHandler<ClaimDeleteInput, { claimId: string }>
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let claim!: WarrantyClaim
     await withAtomicFlush(em, [
@@ -1939,7 +1940,7 @@ const transitionClaimCommand: CommandHandler<TransitionClaimInput, { claimId: st
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let claim!: WarrantyClaim
     await withAtomicFlush(em, [
@@ -2043,7 +2044,7 @@ const setReturnLabelCommand: CommandHandler<ClaimSetReturnLabelInput, ClaimSetRe
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let claim!: WarrantyClaim
     await withAtomicFlush(em, [
@@ -2522,7 +2523,7 @@ const createSalesReturnCommand: CommandHandler<ClaimCreateSalesReturnInput, Clai
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     await assertUndoSnapshotCurrent(ctx, after)
     const scope: WarrantyClaimScope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const salesReturn = payload?.salesReturn ?? null
@@ -2911,7 +2912,7 @@ const createCreditMemoCommand: CommandHandler<ClaimCreateCreditMemoInput, ClaimC
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     await assertUndoSnapshotCurrent(ctx, after)
     const scope: WarrantyClaimScope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const creditMemo = payload?.creditMemo ?? null
@@ -3275,7 +3276,7 @@ const createReplacementOrderCommand: CommandHandler<ClaimCreateReplacementOrderI
     const before = payload?.before
     if (!before) return
     const after = payload?.after
-    if (!after) throwClaimUndoConflict()
+    if (!after) return throwClaimUndoConflict()
     await assertUndoSnapshotCurrent(ctx, after)
     const scope: WarrantyClaimScope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const replacementOrder = payload?.replacementOrder ?? null

package/src/modules/warranty_claims/commands/shared.ts

@@ -2,13 +2,14 @@ import { randomUUID } from 'crypto'
 import type { FindOneOptions } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import { assertFound } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError, assertFound } from '@open-mercato/shared/lib/crud/errors'
 import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
   WarrantyClaim,
   WarrantyClaimEvent,
@@ -65,6 +66,11 @@ export async function enforceWarrantyClaimOptimisticLock(
   })
 }
 
+export async function throwUndoRefusal(key: string, fallback: string): Promise<never> {
+  const { translate } = await resolveTranslations()
+  throw new CrudHttpError(409, { error: translate(key, fallback), code: key })
+}
+
 export async function loadScopedClaim(
   em: EntityManager,
   id: string,

package/src/modules/wms/api/interceptors.ts

@@ -1,4 +1,5 @@
 import type { ApiInterceptor } from '@open-mercato/shared/lib/crud/api-interceptor'
+import { E } from '#generated/entities.ids.generated'
 import {
   decodeCatalogInventoryProfileIntent,
   WMS_CATALOG_PROFILE_HEADER,
@@ -35,6 +36,12 @@ export const interceptors: ApiInterceptor[] = [
       if (!rawHeader) return { ok: true }
 
       const intent = decodeCatalogInventoryProfileIntent(rawHeader)
+      // CrudForm scopes `onBeforeSave` request headers around the whole
+      // `onSubmit` callback, so a page whose submit handler also creates
+      // other records (e.g. the product-create wizard implicitly creating
+      // its default variant) can leak this header onto those unrelated
+      // requests. Only honor an intent the product form itself computed.
+      if (intent?.sourceEntityId !== E.catalog.catalog_product) return { ok: true }
       return {
         ok: true,
         metadata: { intent, target: 'product' },
@@ -74,6 +81,8 @@ export const interceptors: ApiInterceptor[] = [
       if (!rawHeader) return { ok: true }
 
       const intent = decodeCatalogInventoryProfileIntent(rawHeader)
+      // See the product interceptor's `before` for why this check exists.
+      if (intent?.sourceEntityId !== E.catalog.catalog_product_variant) return { ok: true }
       return {
         ok: true,
         metadata: { intent, target: 'variant' },

package/src/modules/wms/commands/configuration.ts

@@ -1532,6 +1532,28 @@ function restoreInventoryProfileFromSnapshot(em: EntityManager, before: ProductI
   record.deletedAt = null
 }
 
+type InventoryProfileEventSource = {
+  id: string
+  catalogProductId: string
+  catalogVariantId?: string | null
+  tenantId: string
+  organizationId: string
+}
+
+function emitInventoryProfileEvent(
+  eventId: 'wms.inventory_profile.created' | 'wms.inventory_profile.updated' | 'wms.inventory_profile.deleted',
+  profile: InventoryProfileEventSource,
+): void {
+  void emitWmsEvent(eventId, {
+    id: profile.id,
+    profileId: profile.id,
+    catalogProductId: profile.catalogProductId,
+    catalogVariantId: profile.catalogVariantId ?? null,
+    tenantId: profile.tenantId,
+    organizationId: profile.organizationId,
+  }).catch(() => undefined)
+}
+
 const createProductInventoryProfileCommand: CommandHandler<ProductInventoryProfileCreateInput, { profileId: string }> = {
   id: 'wms.inventoryProfiles.create',
   async execute(rawInput, ctx) {
@@ -1555,14 +1577,7 @@ const createProductInventoryProfileCommand: CommandHandler<ProductInventoryProfi
       metadata: toJsonValue(parsed.metadata),
     })
     await em.persist(profile).flush()
-    void emitWmsEvent('wms.inventory_profile.created', {
-      id: profile.id,
-      profileId: profile.id,
-      catalogProductId: profile.catalogProductId,
-      catalogVariantId: profile.catalogVariantId ?? null,
-      tenantId: profile.tenantId,
-      organizationId: profile.organizationId,
-    }).catch(() => undefined)
+    emitInventoryProfileEvent('wms.inventory_profile.created', profile)
     return { profileId: profile.id }
   },
   captureAfter: async (_input, result, ctx) => {
@@ -1591,6 +1606,7 @@ const createProductInventoryProfileCommand: CommandHandler<ProductInventoryProfi
     ensureOrganizationScope(ctx, record.organizationId)
     record.deletedAt = new Date()
     await em.flush()
+    emitInventoryProfileEvent('wms.inventory_profile.deleted', record)
   },
 }
 
@@ -1629,14 +1645,7 @@ const updateProductInventoryProfileCommand: CommandHandler<ProductInventoryProfi
     if (parsed.safetyStock !== undefined) profile.safetyStock = toNumericString(parsed.safetyStock)
     if (parsed.metadata !== undefined) profile.metadata = toJsonValue(parsed.metadata)
     await em.flush()
-    void emitWmsEvent('wms.inventory_profile.updated', {
-      id: profile.id,
-      profileId: profile.id,
-      catalogProductId: profile.catalogProductId,
-      catalogVariantId: profile.catalogVariantId ?? null,
-      tenantId: profile.tenantId,
-      organizationId: profile.organizationId,
-    }).catch(() => undefined)
+    emitInventoryProfileEvent('wms.inventory_profile.updated', profile)
     return { profileId: profile.id }
   },
   captureAfter: async (_input, result, ctx) => {
@@ -1686,6 +1695,7 @@ const updateProductInventoryProfileCommand: CommandHandler<ProductInventoryProfi
       restoreInventoryProfileFromSnapshot(em, before, record)
     }
     await em.flush()
+    emitInventoryProfileEvent('wms.inventory_profile.updated', before)
   },
 }
 
@@ -1703,6 +1713,7 @@ const deleteProductInventoryProfileCommand: CommandHandler<{ id?: string }, { pr
     const profile = await loadProfile(em, ctx, profileId)
     profile.deletedAt = new Date()
     await em.flush()
+    emitInventoryProfileEvent('wms.inventory_profile.deleted', profile)
     return { profileId: profile.id }
   },
   buildLog: async ({ input, result, ctx, snapshots }) => {
@@ -1747,6 +1758,7 @@ const deleteProductInventoryProfileCommand: CommandHandler<{ id?: string }, { pr
       restoreInventoryProfileFromSnapshot(em, before, record)
     }
     await em.flush()
+    emitInventoryProfileEvent('wms.inventory_profile.created', before)
   },
 }
 

package/src/modules/wms/events.ts

@@ -9,6 +9,7 @@ const events = [
   { id: 'wms.location.updated', label: 'Warehouse Location Updated', entity: 'location', category: 'crud' },
   { id: 'wms.inventory_profile.created', label: 'Inventory Profile Created', entity: 'inventory_profile', category: 'crud' },
   { id: 'wms.inventory_profile.updated', label: 'Inventory Profile Updated', entity: 'inventory_profile', category: 'crud' },
+  { id: 'wms.inventory_profile.deleted', label: 'Inventory Profile Deleted', entity: 'inventory_profile', category: 'crud' },
   { id: 'wms.inventory_balance.created', label: 'Inventory Balance Created', entity: 'inventory_balance', category: 'crud' },
   { id: 'wms.inventory_balance.updated', label: 'Inventory Balance Updated', entity: 'inventory_balance', category: 'crud' },
   { id: 'wms.inventory_balance.deleted', label: 'Inventory Balance Deleted', entity: 'inventory_balance', category: 'crud' },

package/src/modules/wms/lib/catalogInventoryProfileIntent.ts

@@ -3,6 +3,15 @@ import { z } from 'zod'
 const inventoryStrategySchema = z.enum(['fifo', 'lifo', 'fefo'])
 
 export const catalogInventoryProfileIntentSchema = z.object({
+  // Identifies which host CrudForm (product vs. variant) computed this intent.
+  // CrudForm scopes `onBeforeSave` request headers around the whole `onSubmit`
+  // callback, not around a single HTTP call, so a page whose submit handler
+  // creates secondary records (e.g. the product-create wizard implicitly
+  // creating its default variant) can leak this header onto those unrelated
+  // requests. Each interceptor only acts when this matches its own target
+  // entity, so a leaked intent is ignored rather than creating a profile the
+  // user never asked for on that other entity.
+  sourceEntityId: z.string(),
   manageInventory: z.boolean(),
   defaultUom: z.string().trim().max(32).nullable().optional(),
   defaultStrategy: inventoryStrategySchema.optional(),

package/src/modules/wms/widgets/injection/catalog-inventory-profile/widget.ts

@@ -1,4 +1,4 @@
-import type { InjectionFieldWidget } from '@open-mercato/shared/modules/widgets/injection'
+import type { InjectionContext, InjectionFieldWidget } from '@open-mercato/shared/modules/widgets/injection'
 import {
   encodeCatalogInventoryProfileIntent,
   WMS_CATALOG_PROFILE_HEADER,
@@ -29,8 +29,9 @@ function readNumber(value: unknown): number | undefined {
   return undefined
 }
 
-function buildIntent(data: RecordLike): CatalogInventoryProfileIntent {
+function buildIntent(data: RecordLike, sourceEntityId: string): CatalogInventoryProfileIntent {
   return {
+    sourceEntityId,
     manageInventory: readBoolean(data['wms.manageInventory']),
     defaultUom: readString(data['wms.defaultUom']).trim() || null,
     defaultStrategy: (() => {
@@ -47,6 +48,10 @@ function buildIntent(data: RecordLike): CatalogInventoryProfileIntent {
   }
 }
 
+function hasLoadedInventoryProfile(data: RecordLike): boolean {
+  return Boolean(asRecord(asRecord(data._wms)?.inventoryProfile))
+}
+
 function buildDisplayState(data: RecordLike): RecordLike {
   const wms = asRecord(data._wms)
   const inventoryProfile = asRecord(wms?.inventoryProfile)
@@ -170,12 +175,16 @@ const widget: InjectionFieldWidget = {
       if (!source) return data
       return buildDisplayState(source) as typeof data
     },
-    async onBeforeSave(data) {
+    async onBeforeSave(data, context: InjectionContext) {
       const source = asRecord(data)
       if (!source) return { ok: true }
 
-      const intent = buildIntent(source)
+      const sourceEntityId = readString(context?.entityId)
+      const intent = buildIntent(source, sourceEntityId)
       if (!intent.manageInventory) {
+        if (source['wms.manageInventory'] !== false || !hasLoadedInventoryProfile(source)) {
+          return { ok: true }
+        }
         return {
           ok: true,
           requestHeaders: {