@open-mercato/core 0.9.1-develop.7518.1.343d9198f1 → 0.9.1-develop.7532.1.8eac7e198f

package/dist/modules/customer_accounts/services/customerUserService.js

@@ -64,22 +64,22 @@ class CustomerUserService {
     return false;
   }
   async incrementFailedAttempts(user) {
-    const newCount = (user.failedLoginAttempts || 0) + 1;
-    const updates = { failedLoginAttempts: newCount };
-    if (newCount >= MAX_FAILED_ATTEMPTS) {
-      updates.lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS);
-    }
-    await this.em.nativeUpdate(CustomerUser, { id: user.id }, updates);
-    user.failedLoginAttempts = newCount;
-    if (updates.lockedUntil) user.lockedUntil = updates.lockedUntil;
+    const lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS);
+    await this.em.getKysely().updateTable("customer_users").set((eb) => ({
+      failed_login_attempts: eb("failed_login_attempts", "+", 1),
+      locked_until: eb.case().when("failed_login_attempts", ">=", MAX_FAILED_ATTEMPTS - 1).then(eb.fn("greatest", [eb.ref("locked_until"), eb.val(lockedUntil)])).else(eb.ref("locked_until")).end()
+    })).where("id", "=", user.id).execute();
+  }
+  async resetFailedAttemptsUnlessLocked(user) {
+    const now = /* @__PURE__ */ new Date();
+    const row = await this.em.getKysely().updateTable("customer_users").set({ failed_login_attempts: 0, locked_until: null }).where("id", "=", user.id).where((eb) => eb.or([eb("locked_until", "is", null), eb("locked_until", "<=", now)])).returning("id").executeTakeFirst();
+    return row !== void 0;
   }
   async resetFailedAttempts(user) {
     await this.em.nativeUpdate(CustomerUser, { id: user.id }, {
       failedLoginAttempts: 0,
       lockedUntil: null
     });
-    user.failedLoginAttempts = 0;
-    user.lockedUntil = null;
   }
   async updatePassword(user, newPassword, em) {
     const passwordHash = await hash(newPassword, BCRYPT_COST);

package/dist/modules/customer_accounts/services/customerUserService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerUserService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst MAX_FAILED_ATTEMPTS = 5\nconst LOCKOUT_DURATION_MS = 15 * 60 * 1000 // 15 minutes\n\nexport class CustomerUserService {\n  constructor(private em: EntityManager) {}\n\n  async createUser(\n    email: string,\n    password: string,\n    displayName: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerUser> {\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(email)\n    const user = this.em.create(CustomerUser, {\n      email: email.toLowerCase().trim(),\n      emailHash,\n      passwordHash,\n      displayName,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      isActive: true,\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any)\n    return user as CustomerUser\n  }\n\n  async findByEmail(email: string, tenantId: string): Promise<CustomerUser | null> {\n    return findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      {\n        emailHash: { $in: lookupHashCandidates(email) },\n        tenantId,\n        deletedAt: null,\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async findById(\n    id: string,\n    tenantId: string,\n    organizationId?: string | null,\n  ): Promise<CustomerUser | null> {\n    const where: Record<string, unknown> = { id, tenantId, deletedAt: null }\n    if (organizationId !== undefined) where.organizationId = organizationId\n    return findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      where as any,\n      undefined,\n      { tenantId, organizationId },\n    )\n  }\n\n  async verifyPassword(user: CustomerUser, password: string): Promise<boolean> {\n    if (!user.passwordHash) return false\n    return compare(password, user.passwordHash)\n  }\n\n  async updateLastLoginAt(user: CustomerUser): Promise<void> {\n    const now = new Date()\n    await this.em.nativeUpdate(CustomerUser, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  checkLockout(user: CustomerUser): boolean {\n    if (!user.lockedUntil) return false\n    if (user.lockedUntil.getTime() > Date.now()) return true\n    return false\n  }\n\n  async incrementFailedAttempts(user: CustomerUser): Promise<void> {\n    const newCount = (user.failedLoginAttempts || 0) + 1\n    const updates: Record<string, unknown> = { failedLoginAttempts: newCount }\n    if (newCount >= MAX_FAILED_ATTEMPTS) {\n      updates.lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)\n    }\n    await this.em.nativeUpdate(CustomerUser, { id: user.id }, updates)\n    user.failedLoginAttempts = newCount\n    if (updates.lockedUntil) user.lockedUntil = updates.lockedUntil as Date\n  }\n\n  async resetFailedAttempts(user: CustomerUser): Promise<void> {\n    await this.em.nativeUpdate(CustomerUser, { id: user.id }, {\n      failedLoginAttempts: 0,\n      lockedUntil: null,\n    })\n    user.failedLoginAttempts = 0\n    user.lockedUntil = null\n  }\n\n  async updatePassword(user: CustomerUser, newPassword: string, em?: EntityManager): Promise<void> {\n    const passwordHash = await hash(newPassword, BCRYPT_COST)\n    await (em ?? this.em).nativeUpdate(CustomerUser, {\n      id: user.id,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n    }, { passwordHash })\n    user.passwordHash = passwordHash\n  }\n\n  // `display_name` is encrypted at rest. `nativeUpdate` issues raw SQL and fires none of the\n  // flush hooks the tenant-encryption subscriber depends on, so writing it that way persists\n  // plaintext PII into a ciphertext column (#3837). Assign it on the managed entity and flush\n  // so `beforeUpdate` encrypts the value on its way to the database.\n  async updateProfile(user: CustomerUser, data: { displayName?: string }): Promise<void> {\n    if (data.displayName === undefined) return\n    const managed = await findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      { id: user.id, tenantId: user.tenantId, organizationId: user.organizationId, deletedAt: null } as any,\n      undefined,\n      { tenantId: user.tenantId, organizationId: user.organizationId },\n    )\n    if (!managed) return\n    managed.displayName = data.displayName\n    await this.em.flush()\n    user.displayName = data.displayName\n  }\n\n  async softDelete(\n    userId: string,\n    scope?: { tenantId: string; organizationId: string | null },\n  ): Promise<void> {\n    const where: Record<string, unknown> = { id: userId }\n    if (scope) {\n      where.tenantId = scope.tenantId\n      where.organizationId = scope.organizationId\n    }\n    await this.em.nativeUpdate(CustomerUser, where, {\n      deletedAt: new Date(),\n      isActive: false,\n    })\n  }\n}\n"],
-  "mappings": "AACA,SAAS,MAAM,eAAe;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,eAAe,4BAA4B;AACpD,SAAS,6BAA6B;AAEtC,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB,KAAK,KAAK;AAE/B,MAAM,oBAAoB;AAAA,EAC/B,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,WACJ,OACA,UACA,aACA,OACuB;AACvB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAe,UAAgD;AAC/E,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,WAAW,EAAE,KAAK,qBAAqB,KAAK,EAAE;AAAA,QAC9C;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,SACJ,IACA,UACA,gBAC8B;AAC9B,UAAM,QAAiC,EAAE,IAAI,UAAU,WAAW,KAAK;AACvE,QAAI,mBAAmB,OAAW,OAAM,iBAAiB;AACzD,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,UAAU,eAAe;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAoB,UAAoC;AAC3E,QAAI,CAAC,KAAK,aAAc,QAAO;AAC/B,WAAO,QAAQ,UAAU,KAAK,YAAY;AAAA,EAC5C;AAAA,EAEA,MAAM,kBAAkB,MAAmC;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,KAAK,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AAC9E,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,aAAa,MAA6B;AACxC,QAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,QAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,wBAAwB,MAAmC;AAC/D,UAAM,YAAY,KAAK,uBAAuB,KAAK;AACnD,UAAM,UAAmC,EAAE,qBAAqB,SAAS;AACzE,QAAI,YAAY,qBAAqB;AACnC,cAAQ,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,mBAAmB;AAAA,IACjE;AACA,UAAM,KAAK,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,OAAO;AACjE,SAAK,sBAAsB;AAC3B,QAAI,QAAQ,YAAa,MAAK,cAAc,QAAQ;AAAA,EACtD;AAAA,EAEA,MAAM,oBAAoB,MAAmC;AAC3D,UAAM,KAAK,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG;AAAA,MACxD,qBAAqB;AAAA,MACrB,aAAa;AAAA,IACf,CAAC;AACD,SAAK,sBAAsB;AAC3B,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,eAAe,MAAoB,aAAqB,IAAmC;AAC/F,UAAM,eAAe,MAAM,KAAK,aAAa,WAAW;AACxD,WAAO,MAAM,KAAK,IAAI,aAAa,cAAc;AAAA,MAC/C,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,GAAG,EAAE,aAAa,CAAC;AACnB,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAAoB,MAA+C;AACrF,QAAI,KAAK,gBAAgB,OAAW;AACpC,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,KAAK,IAAI,UAAU,KAAK,UAAU,gBAAgB,KAAK,gBAAgB,WAAW,KAAK;AAAA,MAC7F;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AAAA,IACjE;AACA,QAAI,CAAC,QAAS;AACd,YAAQ,cAAc,KAAK;AAC3B,UAAM,KAAK,GAAG,MAAM;AACpB,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,WACJ,QACA,OACe;AACf,UAAM,QAAiC,EAAE,IAAI,OAAO;AACpD,QAAI,OAAO;AACT,YAAM,WAAW,MAAM;AACvB,YAAM,iBAAiB,MAAM;AAAA,IAC/B;AACA,UAAM,KAAK,GAAG,aAAa,cAAc,OAAO;AAAA,MAC9C,WAAW,oBAAI,KAAK;AAAA,MACpB,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash, compare } from 'bcryptjs'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst MAX_FAILED_ATTEMPTS = 5\nconst LOCKOUT_DURATION_MS = 15 * 60 * 1000 // 15 minutes\n\ntype CustomerUserLockoutDatabase = {\n  customer_users: {\n    id: string\n    failed_login_attempts: number\n    locked_until: Date | null\n  }\n}\n\nexport class CustomerUserService {\n  constructor(private em: EntityManager) {}\n\n  async createUser(\n    email: string,\n    password: string,\n    displayName: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerUser> {\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(email)\n    const user = this.em.create(CustomerUser, {\n      email: email.toLowerCase().trim(),\n      emailHash,\n      passwordHash,\n      displayName,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      isActive: true,\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any)\n    return user as CustomerUser\n  }\n\n  async findByEmail(email: string, tenantId: string): Promise<CustomerUser | null> {\n    return findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      {\n        emailHash: { $in: lookupHashCandidates(email) },\n        tenantId,\n        deletedAt: null,\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async findById(\n    id: string,\n    tenantId: string,\n    organizationId?: string | null,\n  ): Promise<CustomerUser | null> {\n    const where: Record<string, unknown> = { id, tenantId, deletedAt: null }\n    if (organizationId !== undefined) where.organizationId = organizationId\n    return findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      where as any,\n      undefined,\n      { tenantId, organizationId },\n    )\n  }\n\n  async verifyPassword(user: CustomerUser, password: string): Promise<boolean> {\n    if (!user.passwordHash) return false\n    return compare(password, user.passwordHash)\n  }\n\n  async updateLastLoginAt(user: CustomerUser): Promise<void> {\n    const now = new Date()\n    await this.em.nativeUpdate(CustomerUser, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  checkLockout(user: CustomerUser): boolean {\n    if (!user.lockedUntil) return false\n    if (user.lockedUntil.getTime() > Date.now()) return true\n    return false\n  }\n\n  async incrementFailedAttempts(user: CustomerUser): Promise<void> {\n    const lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)\n    await this.em.getKysely<CustomerUserLockoutDatabase>()\n      .updateTable('customer_users')\n      .set((eb) => ({\n        failed_login_attempts: eb('failed_login_attempts', '+', 1),\n        locked_until: eb\n          .case()\n          .when('failed_login_attempts', '>=', MAX_FAILED_ATTEMPTS - 1)\n          .then(eb.fn<Date>('greatest', [eb.ref('locked_until'), eb.val(lockedUntil)]))\n          .else(eb.ref('locked_until'))\n          .end(),\n      }))\n      .where('id', '=', user.id)\n      .execute()\n  }\n\n  async resetFailedAttemptsUnlessLocked(user: CustomerUser): Promise<boolean> {\n    const now = new Date()\n    const row = await this.em.getKysely<CustomerUserLockoutDatabase>()\n      .updateTable('customer_users')\n      .set({ failed_login_attempts: 0, locked_until: null })\n      .where('id', '=', user.id)\n      .where((eb) => eb.or([eb('locked_until', 'is', null), eb('locked_until', '<=', now)]))\n      .returning('id')\n      .executeTakeFirst()\n    return row !== undefined\n  }\n\n  async resetFailedAttempts(user: CustomerUser): Promise<void> {\n    await this.em.nativeUpdate(CustomerUser, { id: user.id }, {\n      failedLoginAttempts: 0,\n      lockedUntil: null,\n    })\n  }\n\n  async updatePassword(user: CustomerUser, newPassword: string, em?: EntityManager): Promise<void> {\n    const passwordHash = await hash(newPassword, BCRYPT_COST)\n    await (em ?? this.em).nativeUpdate(CustomerUser, {\n      id: user.id,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n    }, { passwordHash })\n    user.passwordHash = passwordHash\n  }\n\n  // `display_name` is encrypted at rest. `nativeUpdate` issues raw SQL and fires none of the\n  // flush hooks the tenant-encryption subscriber depends on, so writing it that way persists\n  // plaintext PII into a ciphertext column (#3837). Assign it on the managed entity and flush\n  // so `beforeUpdate` encrypts the value on its way to the database.\n  async updateProfile(user: CustomerUser, data: { displayName?: string }): Promise<void> {\n    if (data.displayName === undefined) return\n    const managed = await findOneWithDecryption(\n      this.em,\n      CustomerUser,\n      { id: user.id, tenantId: user.tenantId, organizationId: user.organizationId, deletedAt: null } as any,\n      undefined,\n      { tenantId: user.tenantId, organizationId: user.organizationId },\n    )\n    if (!managed) return\n    managed.displayName = data.displayName\n    await this.em.flush()\n    user.displayName = data.displayName\n  }\n\n  async softDelete(\n    userId: string,\n    scope?: { tenantId: string; organizationId: string | null },\n  ): Promise<void> {\n    const where: Record<string, unknown> = { id: userId }\n    if (scope) {\n      where.tenantId = scope.tenantId\n      where.organizationId = scope.organizationId\n    }\n    await this.em.nativeUpdate(CustomerUser, where, {\n      deletedAt: new Date(),\n      isActive: false,\n    })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,MAAM,eAAe;AAC9B,SAAS,oBAAoB;AAC7B,SAAS,eAAe,4BAA4B;AACpD,SAAS,6BAA6B;AAEtC,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB,KAAK,KAAK;AAU/B,MAAM,oBAAoB;AAAA,EAC/B,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,WACJ,OACA,UACA,aACA,OACuB;AACvB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,MAAM,YAAY,EAAE,KAAK;AAAA,MAChC;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAe,UAAgD;AAC/E,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,WAAW,EAAE,KAAK,qBAAqB,KAAK,EAAE;AAAA,QAC9C;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,SACJ,IACA,UACA,gBAC8B;AAC9B,UAAM,QAAiC,EAAE,IAAI,UAAU,WAAW,KAAK;AACvE,QAAI,mBAAmB,OAAW,OAAM,iBAAiB;AACzD,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,UAAU,eAAe;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAoB,UAAoC;AAC3E,QAAI,CAAC,KAAK,aAAc,QAAO;AAC/B,WAAO,QAAQ,UAAU,KAAK,YAAY;AAAA,EAC5C;AAAA,EAEA,MAAM,kBAAkB,MAAmC;AACzD,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,KAAK,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AAC9E,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,aAAa,MAA6B;AACxC,QAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,QAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,wBAAwB,MAAmC;AAC/D,UAAM,cAAc,IAAI,KAAK,KAAK,IAAI,IAAI,mBAAmB;AAC7D,UAAM,KAAK,GAAG,UAAuC,EAClD,YAAY,gBAAgB,EAC5B,IAAI,CAAC,QAAQ;AAAA,MACZ,uBAAuB,GAAG,yBAAyB,KAAK,CAAC;AAAA,MACzD,cAAc,GACX,KAAK,EACL,KAAK,yBAAyB,MAAM,sBAAsB,CAAC,EAC3D,KAAK,GAAG,GAAS,YAAY,CAAC,GAAG,IAAI,cAAc,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,EAC3E,KAAK,GAAG,IAAI,cAAc,CAAC,EAC3B,IAAI;AAAA,IACT,EAAE,EACD,MAAM,MAAM,KAAK,KAAK,EAAE,EACxB,QAAQ;AAAA,EACb;AAAA,EAEA,MAAM,gCAAgC,MAAsC;AAC1E,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,GAAG,UAAuC,EAC9D,YAAY,gBAAgB,EAC5B,IAAI,EAAE,uBAAuB,GAAG,cAAc,KAAK,CAAC,EACpD,MAAM,MAAM,KAAK,KAAK,EAAE,EACxB,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,gBAAgB,MAAM,IAAI,GAAG,GAAG,gBAAgB,MAAM,GAAG,CAAC,CAAC,CAAC,EACpF,UAAU,IAAI,EACd,iBAAiB;AACpB,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,oBAAoB,MAAmC;AAC3D,UAAM,KAAK,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG;AAAA,MACxD,qBAAqB;AAAA,MACrB,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,eAAe,MAAoB,aAAqB,IAAmC;AAC/F,UAAM,eAAe,MAAM,KAAK,aAAa,WAAW;AACxD,WAAO,MAAM,KAAK,IAAI,aAAa,cAAc;AAAA,MAC/C,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,GAAG,EAAE,aAAa,CAAC;AACnB,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAAoB,MAA+C;AACrF,QAAI,KAAK,gBAAgB,OAAW;AACpC,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,KAAK,IAAI,UAAU,KAAK,UAAU,gBAAgB,KAAK,gBAAgB,WAAW,KAAK;AAAA,MAC7F;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AAAA,IACjE;AACA,QAAI,CAAC,QAAS;AACd,YAAQ,cAAc,KAAK;AAC3B,UAAM,KAAK,GAAG,MAAM;AACpB,SAAK,cAAc,KAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,WACJ,QACA,OACe;AACf,UAAM,QAAiC,EAAE,IAAI,OAAO;AACpD,QAAI,OAAO;AACT,YAAM,WAAW,MAAM;AACvB,YAAM,iBAAiB,MAAM;AAAA,IAC/B;AACA,UAAM,KAAK,GAAG,aAAa,cAAc,OAAO;AAAA,MAC9C,WAAW,oBAAI,KAAK;AAAA,MACpB,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.js

@@ -70,7 +70,7 @@ const openApi = {
   methods: {
     DELETE: {
       summary: "Revoke invitation",
-      description: "Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).",
+      description: "Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404); access tokens already issued for the invitation stop working (401).",
       responses: [{ status: 200, description: "Invitation revoked", schema: deleteResponseSchema }],
       errors: [{ status: 404, description: "Invitation not found", schema: errorSchema }]
     }

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/forms/api/distributions/%5BdistributionId%5D/invitations/%5BinvitationId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  invitationRevokeCommandSchema,\n  type FormInvitationRevokeCommandInput,\n} from '../../../../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../../../../helpers'\nimport { FORM_INVITATION_RESOURCE_KIND } from '../../../../../commands/invitation'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['forms.distribute'] },\n}\n\nconst deleteResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractInvitationId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'invitations')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const invitationId = extractInvitationId(req)\n    if (!invitationId) return jsonError(400, 'forms.errors.invalid_id')\n\n    const scoped = withScopedPayload({ invitationId }, ctx, translate)\n    const input = invitationRevokeCommandSchema.parse(scoped) satisfies FormInvitationRevokeCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_INVITATION_RESOURCE_KIND,\n      resourceId: invitationId,\n      operation: 'delete',\n      request: req,\n      payload: { invitationId },\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormInvitationRevokeCommandInput,\n          { invitationId: string }\n        >('forms.invitation.revoke', { input, ctx })\n        const response = NextResponse.json({ id: result?.invitationId ?? invitationId })\n        return attachOperationMetadata(\n          response,\n          logEntry,\n          FORM_INVITATION_RESOURCE_KIND,\n          result?.invitationId ?? invitationId,\n        )\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('invitations.DELETE', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Revoke an invitation',\n  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),\n  methods: {\n    DELETE: {\n      summary: 'Revoke invitation',\n      description:\n        'Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).',\n      responses: [{ status: 200, description: 'Invitation revoked', schema: deleteResponseSchema }],\n      errors: [{ status: 404, description: 'Invitation not found', schema: errorSchema }],\n    },\n  },\n}\n"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  invitationRevokeCommandSchema,\n  type FormInvitationRevokeCommandInput,\n} from '../../../../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../../../../helpers'\nimport { FORM_INVITATION_RESOURCE_KIND } from '../../../../../commands/invitation'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['forms.distribute'] },\n}\n\nconst deleteResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractInvitationId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'invitations')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const invitationId = extractInvitationId(req)\n    if (!invitationId) return jsonError(400, 'forms.errors.invalid_id')\n\n    const scoped = withScopedPayload({ invitationId }, ctx, translate)\n    const input = invitationRevokeCommandSchema.parse(scoped) satisfies FormInvitationRevokeCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_INVITATION_RESOURCE_KIND,\n      resourceId: invitationId,\n      operation: 'delete',\n      request: req,\n      payload: { invitationId },\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormInvitationRevokeCommandInput,\n          { invitationId: string }\n        >('forms.invitation.revoke', { input, ctx })\n        const response = NextResponse.json({ id: result?.invitationId ?? invitationId })\n        return attachOperationMetadata(\n          response,\n          logEntry,\n          FORM_INVITATION_RESOURCE_KIND,\n          result?.invitationId ?? invitationId,\n        )\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('invitations.DELETE', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Revoke an invitation',\n  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),\n  methods: {\n    DELETE: {\n      summary: 'Revoke invitation',\n      description:\n        'Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404); access tokens already issued for the invitation stop working (401).',\n      responses: [{ status: 200, description: 'Invitation revoked', schema: deleteResponseSchema }],\n      errors: [{ status: 404, description: 'Invitation not found', schema: errorSchema }],\n    },\n  },\n}\n"],
   "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0CAA0C;AAEnD;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACrE;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,SAAS,oBAAoB,KAAsB;AACjD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,QAAM,MAAM,SAAS,UAAU,CAAC,YAAY,YAAY,aAAa;AACrE,SAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,KAAK;AAC9C;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,eAAe,oBAAoB,GAAG;AAC5C,QAAI,CAAC,aAAc,QAAO,UAAU,KAAK,yBAAyB;AAElE,UAAM,SAAS,kBAAkB,EAAE,aAAa,GAAG,KAAK,SAAS;AACjE,UAAM,QAAQ,8BAA8B,MAAM,MAAM;AAExD,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS,EAAE,aAAa;AAAA,MACxB,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,2BAA2B,EAAE,OAAO,IAAI,CAAC;AAC3C,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,aAAa,CAAC;AAC/E,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,gBAAgB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,sBAAsB,KAAK;AAAA,EACrD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC3F,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,qBAAqB,CAAC;AAAA,MAC5F,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY,CAAC;AAAA,IACpF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/forms/api/form-submissions/[id]/submit/route.js

@@ -3,7 +3,14 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
 import { submissionSubmitInputSchema } from "../../../../data/validators.js";
-import { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from "../../../runtime-helpers.js";
+import {
+  buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeSubmission
+} from "../../../runtime-helpers.js";
 const metadata = {
   POST: { requireAuth: false }
 };
@@ -36,10 +43,12 @@ async function POST(req, context) {
       tenantId: auth.tenantId,
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: auth.sub,
-      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata)
+      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: true
     });
     return NextResponse.json({ submission: serializeSubmission(submission) });
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse();
     return mapSubmissionError(error);
   }
 }
@@ -57,6 +66,7 @@ const postMethodDoc = {
   responses: [{ status: 200, description: "Submission submitted", schema: responseSchema }],
   errors: [
     { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "SUBJECT_FORBIDDEN: caller-started submission is not on the caller's own customer subject", schema: errorSchema },
     { status: 404, description: "Submission not found", schema: errorSchema },
     { status: 409, description: "Stale base_revision_id", schema: errorSchema },
     { status: 422, description: "Submission already in terminal state", schema: errorSchema }

package/dist/modules/forms/api/form-submissions/[id]/submit/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/forms/api/form-submissions/%5Bid%5D/submit/route.ts"],
-  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions/:id/submit\n *\n * Final submit. Body: `{ base_revision_id, submit_metadata? }`. Sets\n * status = submitted, captures `submit_metadata` (locale, IP, UA), emits\n * `forms.submission.submitted`. Idempotency hardening lands in 1d once the\n * client renderer is in place; phase 1c rejects double-submits with 422.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../../../services/submission-service'\nimport { submissionSubmitInputSchema } from '../../../../data/validators'\nimport { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from '../../../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionSubmitInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const submission = await service.submit({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      baseRevisionId: parsed.data.base_revision_id,\n      submittedBy: auth.sub,\n      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),\n    })\n    return NextResponse.json({ submission: serializeSubmission(submission) })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({ submission: z.record(z.string(), z.unknown()) })\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit a form submission',\n  description: 'Final submission of a draft submission. Verifies base_revision_id and stores the submit metadata.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionSubmitInputSchema },\n  responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 422, description: 'Submission already in terminal state', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submit a form submission',\n  methods: { POST: postMethodDoc },\n}\n"],
-  "mappings": "AASA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB,oBAAoB,cAAc,2BAA2B;AAEpF,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,4BAA4B,UAAU,GAAG;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,OAAO;AAAA,MACtC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,KAAK;AAAA,MAC5B,aAAa,KAAK;AAAA,MAClB,gBAAgB,oBAAoB,KAAK,OAAO,KAAK,eAAe;AAAA,IACtE,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,YAAY,oBAAoB,UAAU,EAAE,CAAC;AAAA,EAC1E,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AAEjF,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,4BAA4B;AAAA,EACnD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,EAC1F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions/:id/submit\n *\n * Final submit. Body: `{ base_revision_id, submit_metadata? }`. Sets\n * status = submitted, captures `submit_metadata` (locale, IP, UA), emits\n * `forms.submission.submitted`. A submission the caller started themselves\n * must carry their own subject (`lib/portal-subject-policy.ts`), so a draft\n * started for someone else before that check existed cannot be finalized.\n * Idempotency hardening lands in 1d once the client renderer is in place;\n * phase 1c rejects double-submits with 422.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../../../services/submission-service'\nimport { submissionSubmitInputSchema } from '../../../../data/validators'\nimport {\n  buildSubmitMetadata,\n  isPortalSubjectForbiddenError,\n  mapSubmissionError,\n  portalSubjectForbiddenResponse,\n  readJsonBody,\n  serializeSubmission,\n} from '../../../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionSubmitInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const submission = await service.submit({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      baseRevisionId: parsed.data.base_revision_id,\n      submittedBy: auth.sub,\n      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),\n      submittedByPortalCustomer: true,\n    })\n    return NextResponse.json({ submission: serializeSubmission(submission) })\n  } catch (error) {\n    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({ submission: z.record(z.string(), z.unknown()) })\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit a form submission',\n  description: 'Final submission of a draft submission. Verifies base_revision_id and stores the submit metadata.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionSubmitInputSchema },\n  responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'SUBJECT_FORBIDDEN: caller-started submission is not on the caller\\'s own customer subject', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 422, description: 'Submission already in terminal state', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submit a form submission',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AAYA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,4BAA4B,UAAU,GAAG;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,OAAO;AAAA,MACtC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,KAAK;AAAA,MAC5B,aAAa,KAAK;AAAA,MAClB,gBAAgB,oBAAoB,KAAK,OAAO,KAAK,eAAe;AAAA,MACpE,2BAA2B;AAAA,IAC7B,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,YAAY,oBAAoB,UAAU,EAAE,CAAC;AAAA,EAC1E,SAAS,OAAO;AACd,QAAI,8BAA8B,KAAK,EAAG,QAAO,+BAA+B;AAChF,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AAEjF,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,4BAA4B;AAAA,EACnD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4FAA6F,QAAQ,YAAY;AAAA,IAC7I,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,EAC1F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
   "names": []
 }

package/dist/modules/forms/api/form-submissions/route.js

@@ -6,7 +6,15 @@ import {
   resolvePrefillSeed
 } from "../../services/prefill-resolver.js";
 import { submissionStartInputSchema } from "../../data/validators.js";
-import { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from "../runtime-helpers.js";
+import { isPortalSubjectAllowed } from "../../lib/portal-subject-policy.js";
+import {
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeActor,
+  serializeRevision,
+  serializeSubmission
+} from "../runtime-helpers.js";
 const metadata = {
   POST: { requireAuth: false }
 };
@@ -28,6 +36,12 @@ async function POST(req) {
       { status: 422 }
     );
   }
+  if (!isPortalSubjectAllowed(auth.sub, {
+    subjectType: parsed.data.subject_type,
+    subjectId: parsed.data.subject_id
+  })) {
+    return portalSubjectForbiddenResponse();
+  }
   const container = await createRequestContainer();
   const service = container.resolve("formsSubmissionService");
   const prefillResolver = container.resolve("formsPrefillResolver");
@@ -97,6 +111,7 @@ const postMethodDoc = {
   responses: [{ status: 201, description: "Submission started", schema: submissionResponseSchema }],
   errors: [
     { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "SUBJECT_FORBIDDEN: subject is not the caller's own customer subject", schema: errorSchema },
     { status: 404, description: "Form not found", schema: errorSchema },
     { status: 422, description: "Validation or form-state error", schema: errorSchema }
   ]

package/dist/modules/forms/api/form-submissions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/forms/api/form-submissions/route.ts"],
-  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions\n *\n * Starts a new submission for the active version of a form. Customer auth is\n * required. The starter is auto-assigned the form version's\n * `x-om-default-actor-role` (or first declared role) \u2014 admin assignment of\n * additional actors is the admin route.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../services/submission-service'\nimport {\n  resolvePrefillSeed,\n  type PrefillResolver,\n} from '../../services/prefill-resolver'\nimport { submissionStartInputSchema } from '../../data/validators'\nimport { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from '../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(req: NextRequest) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionStartInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n  const prefillResolver = container.resolve('formsPrefillResolver') as PrefillResolver\n\n  try {\n    // Resolve prefill values (W8 / FD-1) for fields declaring `x-om-prefill`.\n    // No declarations \u21D2 no resolver call. Seeds are role-filtered + AJV-validated\n    // inside `start`; resolution failures are non-fatal (submission opens empty).\n    let prefill: Record<string, unknown> | null = null\n    try {\n      const { compiled } = await service.getActiveFormVersionByKey({\n        organizationId: auth.orgId,\n        tenantId: auth.tenantId,\n        formKey: parsed.data.form_key,\n      })\n      const seed = await resolvePrefillSeed({\n        compiled,\n        resolver: prefillResolver,\n        principal: {\n          sub: auth.sub,\n          tenantId: auth.tenantId,\n          organizationId: auth.orgId,\n          email: auth.email,\n          displayName: auth.displayName,\n          customerEntityId: auth.customerEntityId ?? null,\n          personEntityId: auth.personEntityId ?? null,\n        },\n      })\n      if (Object.keys(seed).length > 0) prefill = seed\n    } catch {\n      // Prefill is best-effort \u2014 fall through to start with no seed.\n      prefill = null\n    }\n\n    const view = await service.start({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      formKey: parsed.data.form_key,\n      subjectType: parsed.data.subject_type,\n      subjectId: parsed.data.subject_id,\n      startedBy: auth.sub,\n      prefill,\n    })\n    return NextResponse.json(\n      {\n        submission: serializeSubmission(view.submission),\n        revision: serializeRevision(view.revision),\n        decoded_data: view.decodedData,\n        actors: view.actors.map(serializeActor),\n      },\n      { status: 201 },\n    )\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst submissionResponseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  revision: z.record(z.string(), z.unknown()),\n  decoded_data: z.record(z.string(), z.unknown()),\n  actors: z.array(z.record(z.string(), z.unknown())),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Start a new form submission',\n  description: 'Starts a submission for the active version of a form, auto-assigning the starter to the default actor role.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionStartInputSchema },\n  responses: [{ status: 201, description: 'Submission started', schema: submissionResponseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Form not found', schema: errorSchema },\n    { status: 422, description: 'Validation or form-state error', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Form submission lifecycle',\n  methods: { POST: postMethodDoc },\n}\n"],
-  "mappings": "AASA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB,cAAc,gBAAgB,mBAAmB,2BAA2B;AAElG,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KAAK,KAAkB;AAC3C,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,2BAA2B,UAAU,GAAG;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,kBAAkB,UAAU,QAAQ,sBAAsB;AAEhE,MAAI;AAIF,QAAI,UAA0C;AAC9C,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,0BAA0B;AAAA,QAC3D,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,SAAS,OAAO,KAAK;AAAA,MACvB,CAAC;AACD,YAAM,OAAO,MAAM,mBAAmB;AAAA,QACpC;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,UACT,KAAK,KAAK;AAAA,UACV,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,OAAO,KAAK;AAAA,UACZ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK,oBAAoB;AAAA,UAC3C,gBAAgB,KAAK,kBAAkB;AAAA,QACzC;AAAA,MACF,CAAC;AACD,UAAI,OAAO,KAAK,IAAI,EAAE,SAAS,EAAG,WAAU;AAAA,IAC9C,QAAQ;AAEN,gBAAU;AAAA,IACZ;AAEA,UAAM,OAAO,MAAM,QAAQ,MAAM;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,SAAS,OAAO,KAAK;AAAA,MACrB,aAAa,OAAO,KAAK;AAAA,MACzB,WAAW,OAAO,KAAK;AAAA,MACvB,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,YAAY,oBAAoB,KAAK,UAAU;AAAA,QAC/C,UAAU,kBAAkB,KAAK,QAAQ;AAAA,QACzC,cAAc,KAAK;AAAA,QACnB,QAAQ,KAAK,OAAO,IAAI,cAAc;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,2BAA2B;AAAA,EAClD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,yBAAyB,CAAC;AAAA,EAChG,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EACpF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions\n *\n * Starts a new submission for the active version of a form. Customer auth is\n * required, and the subject must be the caller's own `customer` subject\n * (`lib/portal-subject-policy.ts`); any other pair is refused with 403 before\n * anything is persisted. The starter is auto-assigned the form version's\n * `x-om-default-actor-role` (or first declared role) \u2014 admin assignment of\n * additional actors is the admin route.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../services/submission-service'\nimport {\n  resolvePrefillSeed,\n  type PrefillResolver,\n} from '../../services/prefill-resolver'\nimport { submissionStartInputSchema } from '../../data/validators'\nimport { isPortalSubjectAllowed } from '../../lib/portal-subject-policy'\nimport {\n  mapSubmissionError,\n  portalSubjectForbiddenResponse,\n  readJsonBody,\n  serializeActor,\n  serializeRevision,\n  serializeSubmission,\n} from '../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(req: NextRequest) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionStartInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n  if (\n    !isPortalSubjectAllowed(auth.sub, {\n      subjectType: parsed.data.subject_type,\n      subjectId: parsed.data.subject_id,\n    })\n  ) {\n    return portalSubjectForbiddenResponse()\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n  const prefillResolver = container.resolve('formsPrefillResolver') as PrefillResolver\n\n  try {\n    // Resolve prefill values (W8 / FD-1) for fields declaring `x-om-prefill`.\n    // No declarations \u21D2 no resolver call. Seeds are role-filtered + AJV-validated\n    // inside `start`; resolution failures are non-fatal (submission opens empty).\n    let prefill: Record<string, unknown> | null = null\n    try {\n      const { compiled } = await service.getActiveFormVersionByKey({\n        organizationId: auth.orgId,\n        tenantId: auth.tenantId,\n        formKey: parsed.data.form_key,\n      })\n      const seed = await resolvePrefillSeed({\n        compiled,\n        resolver: prefillResolver,\n        principal: {\n          sub: auth.sub,\n          tenantId: auth.tenantId,\n          organizationId: auth.orgId,\n          email: auth.email,\n          displayName: auth.displayName,\n          customerEntityId: auth.customerEntityId ?? null,\n          personEntityId: auth.personEntityId ?? null,\n        },\n      })\n      if (Object.keys(seed).length > 0) prefill = seed\n    } catch {\n      // Prefill is best-effort \u2014 fall through to start with no seed.\n      prefill = null\n    }\n\n    const view = await service.start({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      formKey: parsed.data.form_key,\n      subjectType: parsed.data.subject_type,\n      subjectId: parsed.data.subject_id,\n      startedBy: auth.sub,\n      prefill,\n    })\n    return NextResponse.json(\n      {\n        submission: serializeSubmission(view.submission),\n        revision: serializeRevision(view.revision),\n        decoded_data: view.decodedData,\n        actors: view.actors.map(serializeActor),\n      },\n      { status: 201 },\n    )\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst submissionResponseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  revision: z.record(z.string(), z.unknown()),\n  decoded_data: z.record(z.string(), z.unknown()),\n  actors: z.array(z.record(z.string(), z.unknown())),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Start a new form submission',\n  description: 'Starts a submission for the active version of a form, auto-assigning the starter to the default actor role.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionStartInputSchema },\n  responses: [{ status: 201, description: 'Submission started', schema: submissionResponseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'SUBJECT_FORBIDDEN: subject is not the caller\\'s own customer subject', schema: errorSchema },\n    { status: 404, description: 'Form not found', schema: errorSchema },\n    { status: 422, description: 'Validation or form-state error', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Form submission lifecycle',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AAWA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KAAK,KAAkB;AAC3C,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,2BAA2B,UAAU,GAAG;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MACE,CAAC,uBAAuB,KAAK,KAAK;AAAA,IAChC,aAAa,OAAO,KAAK;AAAA,IACzB,WAAW,OAAO,KAAK;AAAA,EACzB,CAAC,GACD;AACA,WAAO,+BAA+B;AAAA,EACxC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,kBAAkB,UAAU,QAAQ,sBAAsB;AAEhE,MAAI;AAIF,QAAI,UAA0C;AAC9C,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,0BAA0B;AAAA,QAC3D,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,SAAS,OAAO,KAAK;AAAA,MACvB,CAAC;AACD,YAAM,OAAO,MAAM,mBAAmB;AAAA,QACpC;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,UACT,KAAK,KAAK;AAAA,UACV,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,OAAO,KAAK;AAAA,UACZ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK,oBAAoB;AAAA,UAC3C,gBAAgB,KAAK,kBAAkB;AAAA,QACzC;AAAA,MACF,CAAC;AACD,UAAI,OAAO,KAAK,IAAI,EAAE,SAAS,EAAG,WAAU;AAAA,IAC9C,QAAQ;AAEN,gBAAU;AAAA,IACZ;AAEA,UAAM,OAAO,MAAM,QAAQ,MAAM;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,SAAS,OAAO,KAAK;AAAA,MACrB,aAAa,OAAO,KAAK;AAAA,MACzB,WAAW,OAAO,KAAK;AAAA,MACvB,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,YAAY,oBAAoB,KAAK,UAAU;AAAA,QAC/C,UAAU,kBAAkB,KAAK,QAAQ;AAAA,QACzC,cAAc,KAAK;AAAA,QACnB,QAAQ,KAAK,OAAO,IAAI,cAAc;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,2BAA2B;AAAA,EAClD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,yBAAyB,CAAC;AAAA,EAChG,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,uEAAwE,QAAQ,YAAY;AAAA,IACxH,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EACpF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
   "names": []
 }

package/dist/modules/forms/api/public/submissions/[id]/submit/route.js

@@ -6,7 +6,9 @@ import { submissionSubmitInputSchema } from "../../../../../data/validators.js";
 import { resolveRuntimePrincipal } from "../../../../../lib/runtime-principal.js";
 import {
   buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
   mapDistributionError,
+  portalSubjectForbiddenResponse,
   readJsonBody,
   serializeSubmission
 } from "../../../../runtime-helpers.js";
@@ -71,7 +73,8 @@ async function POST(req, context) {
       submissionId,
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: principal.principal,
-      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata)
+      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: principal.source === "customer"
     });
     if (principal.source === "token") {
       const distributionService = container.resolve("formsDistributionService");
@@ -87,6 +90,7 @@ async function POST(req, context) {
       redirect_url: distribution?.redirectUrl ?? null
     });
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse();
     return mapDistributionError(error);
   }
 }
@@ -107,6 +111,7 @@ const postMethodDoc = {
   responses: [{ status: 200, description: "Submission submitted", schema: responseSchema }],
   errors: [
     { status: 401, description: "Missing or invalid access token / session", schema: errorSchema },
+    { status: 403, description: "SUBJECT_FORBIDDEN: customer-started submission is not on the caller's own customer subject", schema: errorSchema },
     { status: 404, description: "Submission or invitation not found", schema: errorSchema },
     { status: 409, description: "Stale base_revision_id", schema: errorSchema },
     { status: 410, description: "Distribution response cap reached or unavailable", schema: errorSchema },

package/dist/modules/forms/api/public/submissions/[id]/submit/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/forms/api/public/submissions/%5Bid%5D/submit/route.ts"],
-  "sourcesContent": ["/**\n * Public runtime API \u2014 POST /api/forms/public/submissions/:id/submit\n *\n * Finalizes an anonymous (token) or customer-session submission.\n *\n * For token-authorized submits the order is load-bearing for atomic cap\n * enforcement (R-2d-5): FIRST reserve a response slot on the distribution\n * (derived from the invitation), and only if that succeeds proceed to submit,\n * then mark the invitation submitted. A capped distribution returns 410 BEFORE\n * any submission state changes. Customer-session submits skip the\n * reserve/mark-invitation steps \u2014 those are anonymous-distribution concerns.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { SubmissionService } from '../../../../../services/submission-service'\nimport type { DistributionService } from '../../../../../services/distribution-service'\nimport { FormDistribution, FormInvitation } from '../../../../../data/entities'\nimport { submissionSubmitInputSchema } from '../../../../../data/validators'\nimport { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'\nimport {\n  buildSubmitMetadata,\n  mapDistributionError,\n  readJsonBody,\n  serializeSubmission,\n} from '../../../../runtime-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-submit', submissionId),\n  )\n  if (limited) return limited\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapDistributionError(error)\n  }\n  const parsed = submissionSubmitInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  try {\n    let distribution: FormDistribution | null = null\n\n    if (principal.source === 'token') {\n      const invitation = await em.findOne(FormInvitation, {\n        id: principal.principal,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        deletedAt: null,\n      })\n      if (!invitation) {\n        return NextResponse.json({ error: 'NOT_FOUND', message: 'Invitation not found.' }, { status: 404 })\n      }\n      distribution = await em.findOne(FormDistribution, {\n        id: invitation.distributionId,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        deletedAt: null,\n      })\n\n      const distributionService = container.resolve('formsDistributionService') as DistributionService\n      // Reserve BEFORE submitting \u2014 a capped distribution must 410 without\n      // mutating the submission.\n      await distributionService.reserveResponseSlot({\n        distributionId: invitation.distributionId,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n      })\n    }\n\n    const submission = await service.submit({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      baseRevisionId: parsed.data.base_revision_id,\n      submittedBy: principal.principal,\n      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),\n    })\n\n    if (principal.source === 'token') {\n      const distributionService = container.resolve('formsDistributionService') as DistributionService\n      await distributionService.markInvitationSubmitted({\n        invitationId: principal.principal,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        submissionId,\n      })\n    }\n\n    return NextResponse.json({\n      submission: serializeSubmission(submission),\n      redirect_url: distribution?.redirectUrl ?? null,\n    })\n  } catch (error) {\n    return mapDistributionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  redirect_url: z.string().nullable(),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit a public submission',\n  description: 'Finalizes the submission named in the access token / session, enforcing the distribution response cap atomically before submitting.',\n  tags: ['Forms Public Runtime'],\n  requestBody: { schema: submissionSubmitInputSchema },\n  responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },\n    { status: 404, description: 'Submission or invitation not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 410, description: 'Distribution response cap reached or unavailable', schema: errorSchema },\n    { status: 422, description: 'Validation failed or submission in terminal state', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submit a public submission',\n  methods: { POST: postMethodDoc },\n}\n"],
-  "mappings": "AAaA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAGvC,SAAS,kBAAkB,sBAAsB;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,qBAAqB,YAAY;AAAA,EAC3D;AACA,MAAI,QAAS,QAAO;AAEpB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACA,QAAM,SAAS,4BAA4B,UAAU,GAAG;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,MAAI;AACF,QAAI,eAAwC;AAE5C,QAAI,UAAU,WAAW,SAAS;AAChC,YAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAClD,IAAI,UAAU;AAAA,QACd,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB,WAAW;AAAA,MACb,CAAC;AACD,UAAI,CAAC,YAAY;AACf,eAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpG;AACA,qBAAe,MAAM,GAAG,QAAQ,kBAAkB;AAAA,QAChD,IAAI,WAAW;AAAA,QACf,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB,WAAW;AAAA,MACb,CAAC;AAED,YAAM,sBAAsB,UAAU,QAAQ,0BAA0B;AAGxE,YAAM,oBAAoB,oBAAoB;AAAA,QAC5C,gBAAgB,WAAW;AAAA,QAC3B,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM,QAAQ,OAAO;AAAA,MACtC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA,gBAAgB,OAAO,KAAK;AAAA,MAC5B,aAAa,UAAU;AAAA,MACvB,gBAAgB,oBAAoB,KAAK,OAAO,KAAK,eAAe;AAAA,IACtE,CAAC;AAED,QAAI,UAAU,WAAW,SAAS;AAChC,YAAM,sBAAsB,UAAU,QAAQ,0BAA0B;AACxE,YAAM,oBAAoB,wBAAwB;AAAA,QAChD,cAAc,UAAU;AAAA,QACxB,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,YAAY,oBAAoB,UAAU;AAAA,MAC1C,cAAc,cAAc,eAAe;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,aAAa,EAAE,QAAQ,4BAA4B;AAAA,EACnD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,YAAY;AAAA,IACpG,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,YAAY;AAAA,IACrG,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "sourcesContent": ["/**\n * Public runtime API \u2014 POST /api/forms/public/submissions/:id/submit\n *\n * Finalizes an anonymous (token) or customer-session submission.\n *\n * For token-authorized submits the order is load-bearing for atomic cap\n * enforcement (R-2d-5): FIRST reserve a response slot on the distribution\n * (derived from the invitation), and only if that succeeds proceed to submit,\n * then mark the invitation submitted. A capped distribution returns 410 BEFORE\n * any submission state changes. Customer-session submits skip the\n * reserve/mark-invitation steps \u2014 those are anonymous-distribution concerns.\n * A customer-session submit of a submission the caller started themselves\n * must carry their own subject (`lib/portal-subject-policy.ts`).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { SubmissionService } from '../../../../../services/submission-service'\nimport type { DistributionService } from '../../../../../services/distribution-service'\nimport { FormDistribution, FormInvitation } from '../../../../../data/entities'\nimport { submissionSubmitInputSchema } from '../../../../../data/validators'\nimport { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'\nimport {\n  buildSubmitMetadata,\n  isPortalSubjectForbiddenError,\n  mapDistributionError,\n  portalSubjectForbiddenResponse,\n  readJsonBody,\n  serializeSubmission,\n} from '../../../../runtime-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('submission-submit', submissionId),\n  )\n  if (limited) return limited\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapDistributionError(error)\n  }\n  const parsed = submissionSubmitInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  const principal = await resolveRuntimePrincipal({ req, submissionId, em })\n  if (!principal) return NextResponse.json({ error: 'UNAUTHORIZED' }, { status: 401 })\n\n  try {\n    let distribution: FormDistribution | null = null\n\n    if (principal.source === 'token') {\n      const invitation = await em.findOne(FormInvitation, {\n        id: principal.principal,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        deletedAt: null,\n      })\n      if (!invitation) {\n        return NextResponse.json({ error: 'NOT_FOUND', message: 'Invitation not found.' }, { status: 404 })\n      }\n      distribution = await em.findOne(FormDistribution, {\n        id: invitation.distributionId,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        deletedAt: null,\n      })\n\n      const distributionService = container.resolve('formsDistributionService') as DistributionService\n      // Reserve BEFORE submitting \u2014 a capped distribution must 410 without\n      // mutating the submission.\n      await distributionService.reserveResponseSlot({\n        distributionId: invitation.distributionId,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n      })\n    }\n\n    const submission = await service.submit({\n      organizationId: principal.organizationId,\n      tenantId: principal.tenantId,\n      submissionId,\n      baseRevisionId: parsed.data.base_revision_id,\n      submittedBy: principal.principal,\n      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),\n      submittedByPortalCustomer: principal.source === 'customer',\n    })\n\n    if (principal.source === 'token') {\n      const distributionService = container.resolve('formsDistributionService') as DistributionService\n      await distributionService.markInvitationSubmitted({\n        invitationId: principal.principal,\n        organizationId: principal.organizationId,\n        tenantId: principal.tenantId,\n        submissionId,\n      })\n    }\n\n    return NextResponse.json({\n      submission: serializeSubmission(submission),\n      redirect_url: distribution?.redirectUrl ?? null,\n    })\n  } catch (error) {\n    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()\n    return mapDistributionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  redirect_url: z.string().nullable(),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit a public submission',\n  description: 'Finalizes the submission named in the access token / session, enforcing the distribution response cap atomically before submitting.',\n  tags: ['Forms Public Runtime'],\n  requestBody: { schema: submissionSubmitInputSchema },\n  responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },\n    { status: 403, description: 'SUBJECT_FORBIDDEN: customer-started submission is not on the caller\\'s own customer subject', schema: errorSchema },\n    { status: 404, description: 'Submission or invitation not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 410, description: 'Distribution response cap reached or unavailable', schema: errorSchema },\n    { status: 422, description: 'Validation failed or submission in terminal state', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submit a public submission',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AAeA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAGvC,SAAS,kBAAkB,sBAAsB;AACjD,SAAS,mCAAmC;AAC5C,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,qBAAqB,YAAY;AAAA,EAC3D;AACA,MAAI,QAAS,QAAO;AAEpB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACA,QAAM,SAAS,4BAA4B,UAAU,GAAG;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,QAAM,YAAY,MAAM,wBAAwB,EAAE,KAAK,cAAc,GAAG,CAAC;AACzE,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEnF,MAAI;AACF,QAAI,eAAwC;AAE5C,QAAI,UAAU,WAAW,SAAS;AAChC,YAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAClD,IAAI,UAAU;AAAA,QACd,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB,WAAW;AAAA,MACb,CAAC;AACD,UAAI,CAAC,YAAY;AACf,eAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpG;AACA,qBAAe,MAAM,GAAG,QAAQ,kBAAkB;AAAA,QAChD,IAAI,WAAW;AAAA,QACf,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB,WAAW;AAAA,MACb,CAAC;AAED,YAAM,sBAAsB,UAAU,QAAQ,0BAA0B;AAGxE,YAAM,oBAAoB,oBAAoB;AAAA,QAC5C,gBAAgB,WAAW;AAAA,QAC3B,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,aAAa,MAAM,QAAQ,OAAO;AAAA,MACtC,gBAAgB,UAAU;AAAA,MAC1B,UAAU,UAAU;AAAA,MACpB;AAAA,MACA,gBAAgB,OAAO,KAAK;AAAA,MAC5B,aAAa,UAAU;AAAA,MACvB,gBAAgB,oBAAoB,KAAK,OAAO,KAAK,eAAe;AAAA,MACpE,2BAA2B,UAAU,WAAW;AAAA,IAClD,CAAC;AAED,QAAI,UAAU,WAAW,SAAS;AAChC,YAAM,sBAAsB,UAAU,QAAQ,0BAA0B;AACxE,YAAM,oBAAoB,wBAAwB;AAAA,QAChD,cAAc,UAAU;AAAA,QACxB,gBAAgB,UAAU;AAAA,QAC1B,UAAU,UAAU;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,YAAY,oBAAoB,UAAU;AAAA,MAC1C,cAAc,cAAc,eAAe;AAAA,IAC7C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,8BAA8B,KAAK,EAAG,QAAO,+BAA+B;AAChF,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,cAAc,EAAE,OAAO,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,aAAa,EAAE,QAAQ,4BAA4B;AAAA,EACnD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,8FAA+F,QAAQ,YAAY;AAAA,IAC/I,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,YAAY;AAAA,IACpG,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,YAAY;AAAA,IACrG,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
   "names": []
 }

package/dist/modules/forms/api/runtime-helpers.js

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { SubmissionServiceError, isSubmissionServiceError } from "../services/submission-service.js";
 import { isDistributionServiceError } from "../services/distribution-service.js";
 import { readEmbedSettings } from "../lib/embed-frame-policy.js";
@@ -12,6 +13,19 @@ function mapSubmissionError(error) {
   const message = error instanceof Error ? error.message : "Unknown error";
   return NextResponse.json({ error: "INTERNAL_ERROR", message }, { status: 500 });
 }
+function isPortalSubjectForbiddenError(error) {
+  return isSubmissionServiceError(error) && error.code === "SUBJECT_FORBIDDEN";
+}
+async function portalSubjectForbiddenResponse() {
+  const { translate } = await resolveTranslations();
+  return NextResponse.json(
+    {
+      error: "SUBJECT_FORBIDDEN",
+      message: translate("forms.errors.subject_forbidden", "You can only start or submit this form for yourself.")
+    },
+    { status: 403 }
+  );
+}
 function mapDistributionError(error) {
   if (isDistributionServiceError(error)) {
     return NextResponse.json(
@@ -138,8 +152,10 @@ function serializeActor(actor) {
 }
 export {
   buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
   mapDistributionError,
   mapSubmissionError,
+  portalSubjectForbiddenResponse,
   readJsonBody,
   serializeActor,
   serializeFormContext,

package/dist/modules/forms/api/runtime-helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/forms/api/runtime-helpers.ts"],
-  "sourcesContent": ["/**\n * Shared helpers for forms runtime API routes.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { SubmissionServiceError, isSubmissionServiceError } from '../services/submission-service'\nimport { DistributionServiceError, isDistributionServiceError } from '../services/distribution-service'\nimport { readEmbedSettings } from '../lib/embed-frame-policy'\nimport type { CompiledFormVersion } from '../services/form-version-compiler'\nimport type {\n  Form,\n  FormDistribution,\n  FormSubmission,\n  FormSubmissionActor,\n  FormSubmissionRevision,\n  FormVersion,\n} from '../data/entities'\n\nexport function mapSubmissionError(error: unknown): NextResponse {\n  if (isSubmissionServiceError(error)) {\n    return NextResponse.json(\n      { error: error.code, message: error.message, details: error.details ?? null },\n      { status: error.httpStatus },\n    )\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\nexport function mapDistributionError(error: unknown): NextResponse {\n  if (isDistributionServiceError(error)) {\n    return NextResponse.json(\n      { error: error.code, message: error.message, details: error.details ?? null },\n      { status: error.httpStatus },\n    )\n  }\n  if (isSubmissionServiceError(error)) {\n    return mapSubmissionError(error)\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\n/**\n * Builds the authoritative submit metadata recorded on `form_submission`.\n *\n * Signing audit (CN-3): the IP, user-agent, and UTC submit timestamp are\n * derived SERVER-SIDE here \u2014 the client cannot forge them. Any client-supplied\n * `submit_metadata` (e.g. locale, timezone hints) is preserved but the\n * server-derived `ip` / `userAgent` / `serverSubmittedAt` always win.\n *\n * Together with the version-pinned (immutable) schema and the encrypted,\n * append-only revision answers (which carry the signature payload incl. the\n * consent clause SHA-256 and the signer's affirmation), this metadata forms\n * the tamper-evident signed record. Full PDF reproduction of that bundle is W3.\n */\nexport function buildSubmitMetadata(\n  req: NextRequest,\n  clientMetadata: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n  const forwardedFor = req.headers.get('x-forwarded-for')\n  const ip = forwardedFor?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || null\n  const userAgent = req.headers.get('user-agent') || null\n  return {\n    ...(clientMetadata ?? {}),\n    ip,\n    userAgent,\n    serverSubmittedAt: new Date().toISOString(),\n  }\n}\n\n/**\n * Serializes the published form version a distribution serves into the same\n * shape the public renderer already understands (mirrors\n * `/api/forms/by-key/:key/active`), exposing the JSON schema, ui schema, and a\n * flattened field index. Anonymous participants are never sliced by caller\n * role here \u2014 the distribution carries the default actor role.\n */\n/**\n * Reads the optional `settings.completion.{title,message}` from a distribution\n * `settings` json bag, guarding for the untyped shape. Empty / whitespace-only\n * strings collapse to `null` so the renderer falls back to its default copy.\n */\nfunction readCompletionCopy(\n  settings: Record<string, unknown> | null | undefined,\n): { title: string | null; message: string | null } {\n  const completion =\n    settings && typeof settings === 'object' && !Array.isArray(settings)\n      ? (settings as Record<string, unknown>).completion\n      : undefined\n  if (!completion || typeof completion !== 'object' || Array.isArray(completion)) {\n    return { title: null, message: null }\n  }\n  const record = completion as Record<string, unknown>\n  const title = typeof record.title === 'string' && record.title.trim() ? record.title : null\n  const message =\n    typeof record.message === 'string' && record.message.trim() ? record.message : null\n  return { title, message }\n}\n\n/**\n * Reads the PUBLIC-SAFE embed display hints from a distribution's `settings`\n * bag \u2014 `theme` and `autoResize` only, and only when embedding is enabled. The\n * framing allowlist (`allowedDomains`) is NEVER echoed to a public context\n * payload (R-RS-1); it is consumed exclusively server-side by the CSP builder.\n */\nfunction readEmbedContext(\n  distribution: FormDistribution | undefined,\n): { theme: 'light' | 'dark' | 'auto' | null; autoResize: boolean } | null {\n  const embed = readEmbedSettings(distribution?.settings)\n  if (!embed || embed.enabled !== true) return null\n  return {\n    theme: embed.theme ?? null,\n    autoResize: embed.autoResize !== false,\n  }\n}\n\nexport function serializeFormContext(args: {\n  form: Form\n  formVersion: FormVersion\n  compiled: CompiledFormVersion\n  distribution?: FormDistribution\n}) {\n  const { form, formVersion, compiled, distribution } = args\n  const fieldIndex: Record<string, unknown> = {}\n  for (const [fieldKey, descriptor] of Object.entries(compiled.fieldIndex)) {\n    fieldIndex[fieldKey] = {\n      key: descriptor.key,\n      type: descriptor.type,\n      sectionKey: descriptor.sectionKey,\n      sensitive: descriptor.sensitive,\n      editableBy: descriptor.editableBy,\n      visibleTo: descriptor.visibleTo,\n      required: descriptor.required,\n    }\n  }\n  return {\n    form: {\n      key: form.key,\n      name: form.name,\n      defaultLocale: form.defaultLocale,\n      supportedLocales: form.supportedLocales,\n    },\n    schema: formVersion.schema,\n    ui_schema: formVersion.uiSchema,\n    fieldIndex,\n    completion: readCompletionCopy(distribution?.settings),\n    redirect_url: distribution?.redirectUrl ?? null,\n    embed: readEmbedContext(distribution),\n  }\n}\n\nexport async function readJsonBody<T = unknown>(req: Request): Promise<T> {\n  try {\n    return (await req.json()) as T\n  } catch {\n    throw new SubmissionServiceError('VALIDATION_FAILED', 'Invalid JSON body.', 400)\n  }\n}\n\nexport function serializeSubmission(submission: FormSubmission) {\n  return {\n    id: submission.id,\n    organizationId: submission.organizationId,\n    tenantId: submission.tenantId,\n    formVersionId: submission.formVersionId,\n    subjectType: submission.subjectType,\n    subjectId: submission.subjectId,\n    status: submission.status,\n    currentRevisionId: submission.currentRevisionId ?? null,\n    startedBy: submission.startedBy,\n    submittedBy: submission.submittedBy ?? null,\n    firstSavedAt: submission.firstSavedAt?.toISOString() ?? null,\n    submittedAt: submission.submittedAt?.toISOString() ?? null,\n    submitMetadata: submission.submitMetadata ?? null,\n    pdfSnapshotAttachmentId: submission.pdfSnapshotAttachmentId ?? null,\n    anonymizedAt: submission.anonymizedAt?.toISOString() ?? null,\n    createdAt: submission.createdAt?.toISOString() ?? null,\n    updatedAt: submission.updatedAt?.toISOString() ?? null,\n  }\n}\n\nexport function serializeRevision(revision: FormSubmissionRevision) {\n  return {\n    id: revision.id,\n    submissionId: revision.submissionId,\n    revisionNumber: revision.revisionNumber,\n    encryptionKeyVersion: revision.encryptionKeyVersion,\n    savedAt: revision.savedAt?.toISOString() ?? null,\n    savedBy: revision.savedBy,\n    savedByRole: revision.savedByRole,\n    changeSource: revision.changeSource,\n    changedFieldKeys: revision.changedFieldKeys ?? [],\n    changeSummary: revision.changeSummary ?? null,\n    anonymizedAt: revision.anonymizedAt?.toISOString() ?? null,\n  }\n}\n\nexport function serializeActor(actor: FormSubmissionActor) {\n  return {\n    id: actor.id,\n    submissionId: actor.submissionId,\n    userId: actor.userId,\n    role: actor.role,\n    assignedAt: actor.assignedAt?.toISOString() ?? null,\n    revokedAt: actor.revokedAt?.toISOString() ?? null,\n  }\n}\n"],
-  "mappings": "AAIA,SAAS,oBAAsC;AAC/C,SAAS,wBAAwB,gCAAgC;AACjE,SAAmC,kCAAkC;AACrE,SAAS,yBAAyB;AAW3B,SAAS,mBAAmB,OAA8B;AAC/D,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,WAAW,KAAK;AAAA,MAC5E,EAAE,QAAQ,MAAM,WAAW;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAEO,SAAS,qBAAqB,OAA8B;AACjE,MAAI,2BAA2B,KAAK,GAAG;AACrC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,WAAW,KAAK;AAAA,MAC5E,EAAE,QAAQ,MAAM,WAAW;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAeO,SAAS,oBACd,KACA,gBACyB;AACzB,QAAM,eAAe,IAAI,QAAQ,IAAI,iBAAiB;AACtD,QAAM,KAAK,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,IAAI,WAAW,KAAK;AAClF,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,SAAO;AAAA,IACL,GAAI,kBAAkB,CAAC;AAAA,IACvB;AAAA,IACA;AAAA,IACA,oBAAmB,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC5C;AACF;AAcA,SAAS,mBACP,UACkD;AAClD,QAAM,aACJ,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,IAC9D,SAAqC,aACtC;AACN,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E,WAAO,EAAE,OAAO,MAAM,SAAS,KAAK;AAAA,EACtC;AACA,QAAM,SAAS;AACf,QAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,IAAI,OAAO,QAAQ;AACvF,QAAM,UACJ,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AACjF,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAQA,SAAS,iBACP,cACyE;AACzE,QAAM,QAAQ,kBAAkB,cAAc,QAAQ;AACtD,MAAI,CAAC,SAAS,MAAM,YAAY,KAAM,QAAO;AAC7C,SAAO;AAAA,IACL,OAAO,MAAM,SAAS;AAAA,IACtB,YAAY,MAAM,eAAe;AAAA,EACnC;AACF;AAEO,SAAS,qBAAqB,MAKlC;AACD,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,IAAI;AACtD,QAAM,aAAsC,CAAC;AAC7C,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,SAAS,UAAU,GAAG;AACxE,eAAW,QAAQ,IAAI;AAAA,MACrB,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,MACvB,WAAW,WAAW;AAAA,MACtB,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,eAAe,KAAK;AAAA,MACpB,kBAAkB,KAAK;AAAA,IACzB;AAAA,IACA,QAAQ,YAAY;AAAA,IACpB,WAAW,YAAY;AAAA,IACvB;AAAA,IACA,YAAY,mBAAmB,cAAc,QAAQ;AAAA,IACrD,cAAc,cAAc,eAAe;AAAA,IAC3C,OAAO,iBAAiB,YAAY;AAAA,EACtC;AACF;AAEA,eAAsB,aAA0B,KAA0B;AACxE,MAAI;AACF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,uBAAuB,qBAAqB,sBAAsB,GAAG;AAAA,EACjF;AACF;AAEO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO;AAAA,IACL,IAAI,WAAW;AAAA,IACf,gBAAgB,WAAW;AAAA,IAC3B,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,IAC1B,aAAa,WAAW;AAAA,IACxB,WAAW,WAAW;AAAA,IACtB,QAAQ,WAAW;AAAA,IACnB,mBAAmB,WAAW,qBAAqB;AAAA,IACnD,WAAW,WAAW;AAAA,IACtB,aAAa,WAAW,eAAe;AAAA,IACvC,cAAc,WAAW,cAAc,YAAY,KAAK;AAAA,IACxD,aAAa,WAAW,aAAa,YAAY,KAAK;AAAA,IACtD,gBAAgB,WAAW,kBAAkB;AAAA,IAC7C,yBAAyB,WAAW,2BAA2B;AAAA,IAC/D,cAAc,WAAW,cAAc,YAAY,KAAK;AAAA,IACxD,WAAW,WAAW,WAAW,YAAY,KAAK;AAAA,IAClD,WAAW,WAAW,WAAW,YAAY,KAAK;AAAA,EACpD;AACF;AAEO,SAAS,kBAAkB,UAAkC;AAClE,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,cAAc,SAAS;AAAA,IACvB,gBAAgB,SAAS;AAAA,IACzB,sBAAsB,SAAS;AAAA,IAC/B,SAAS,SAAS,SAAS,YAAY,KAAK;AAAA,IAC5C,SAAS,SAAS;AAAA,IAClB,aAAa,SAAS;AAAA,IACtB,cAAc,SAAS;AAAA,IACvB,kBAAkB,SAAS,oBAAoB,CAAC;AAAA,IAChD,eAAe,SAAS,iBAAiB;AAAA,IACzC,cAAc,SAAS,cAAc,YAAY,KAAK;AAAA,EACxD;AACF;AAEO,SAAS,eAAe,OAA4B;AACzD,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,cAAc,MAAM;AAAA,IACpB,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,IAC/C,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,EAC/C;AACF;",
+  "sourcesContent": ["/**\n * Shared helpers for forms runtime API routes.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { SubmissionServiceError, isSubmissionServiceError } from '../services/submission-service'\nimport { DistributionServiceError, isDistributionServiceError } from '../services/distribution-service'\nimport { readEmbedSettings } from '../lib/embed-frame-policy'\nimport type { CompiledFormVersion } from '../services/form-version-compiler'\nimport type {\n  Form,\n  FormDistribution,\n  FormSubmission,\n  FormSubmissionActor,\n  FormSubmissionRevision,\n  FormVersion,\n} from '../data/entities'\n\nexport function mapSubmissionError(error: unknown): NextResponse {\n  if (isSubmissionServiceError(error)) {\n    return NextResponse.json(\n      { error: error.code, message: error.message, details: error.details ?? null },\n      { status: error.httpStatus },\n    )\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\nexport function isPortalSubjectForbiddenError(error: unknown): boolean {\n  return isSubmissionServiceError(error) && error.code === 'SUBJECT_FORBIDDEN'\n}\n\nexport async function portalSubjectForbiddenResponse(): Promise<NextResponse> {\n  const { translate } = await resolveTranslations()\n  return NextResponse.json(\n    {\n      error: 'SUBJECT_FORBIDDEN',\n      message: translate('forms.errors.subject_forbidden', 'You can only start or submit this form for yourself.'),\n    },\n    { status: 403 },\n  )\n}\n\nexport function mapDistributionError(error: unknown): NextResponse {\n  if (isDistributionServiceError(error)) {\n    return NextResponse.json(\n      { error: error.code, message: error.message, details: error.details ?? null },\n      { status: error.httpStatus },\n    )\n  }\n  if (isSubmissionServiceError(error)) {\n    return mapSubmissionError(error)\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\n/**\n * Builds the authoritative submit metadata recorded on `form_submission`.\n *\n * Signing audit (CN-3): the IP, user-agent, and UTC submit timestamp are\n * derived SERVER-SIDE here \u2014 the client cannot forge them. Any client-supplied\n * `submit_metadata` (e.g. locale, timezone hints) is preserved but the\n * server-derived `ip` / `userAgent` / `serverSubmittedAt` always win.\n *\n * Together with the version-pinned (immutable) schema and the encrypted,\n * append-only revision answers (which carry the signature payload incl. the\n * consent clause SHA-256 and the signer's affirmation), this metadata forms\n * the tamper-evident signed record. Full PDF reproduction of that bundle is W3.\n */\nexport function buildSubmitMetadata(\n  req: NextRequest,\n  clientMetadata: Record<string, unknown> | null | undefined,\n): Record<string, unknown> {\n  const forwardedFor = req.headers.get('x-forwarded-for')\n  const ip = forwardedFor?.split(',')[0]?.trim() || req.headers.get('x-real-ip') || null\n  const userAgent = req.headers.get('user-agent') || null\n  return {\n    ...(clientMetadata ?? {}),\n    ip,\n    userAgent,\n    serverSubmittedAt: new Date().toISOString(),\n  }\n}\n\n/**\n * Serializes the published form version a distribution serves into the same\n * shape the public renderer already understands (mirrors\n * `/api/forms/by-key/:key/active`), exposing the JSON schema, ui schema, and a\n * flattened field index. Anonymous participants are never sliced by caller\n * role here \u2014 the distribution carries the default actor role.\n */\n/**\n * Reads the optional `settings.completion.{title,message}` from a distribution\n * `settings` json bag, guarding for the untyped shape. Empty / whitespace-only\n * strings collapse to `null` so the renderer falls back to its default copy.\n */\nfunction readCompletionCopy(\n  settings: Record<string, unknown> | null | undefined,\n): { title: string | null; message: string | null } {\n  const completion =\n    settings && typeof settings === 'object' && !Array.isArray(settings)\n      ? (settings as Record<string, unknown>).completion\n      : undefined\n  if (!completion || typeof completion !== 'object' || Array.isArray(completion)) {\n    return { title: null, message: null }\n  }\n  const record = completion as Record<string, unknown>\n  const title = typeof record.title === 'string' && record.title.trim() ? record.title : null\n  const message =\n    typeof record.message === 'string' && record.message.trim() ? record.message : null\n  return { title, message }\n}\n\n/**\n * Reads the PUBLIC-SAFE embed display hints from a distribution's `settings`\n * bag \u2014 `theme` and `autoResize` only, and only when embedding is enabled. The\n * framing allowlist (`allowedDomains`) is NEVER echoed to a public context\n * payload (R-RS-1); it is consumed exclusively server-side by the CSP builder.\n */\nfunction readEmbedContext(\n  distribution: FormDistribution | undefined,\n): { theme: 'light' | 'dark' | 'auto' | null; autoResize: boolean } | null {\n  const embed = readEmbedSettings(distribution?.settings)\n  if (!embed || embed.enabled !== true) return null\n  return {\n    theme: embed.theme ?? null,\n    autoResize: embed.autoResize !== false,\n  }\n}\n\nexport function serializeFormContext(args: {\n  form: Form\n  formVersion: FormVersion\n  compiled: CompiledFormVersion\n  distribution?: FormDistribution\n}) {\n  const { form, formVersion, compiled, distribution } = args\n  const fieldIndex: Record<string, unknown> = {}\n  for (const [fieldKey, descriptor] of Object.entries(compiled.fieldIndex)) {\n    fieldIndex[fieldKey] = {\n      key: descriptor.key,\n      type: descriptor.type,\n      sectionKey: descriptor.sectionKey,\n      sensitive: descriptor.sensitive,\n      editableBy: descriptor.editableBy,\n      visibleTo: descriptor.visibleTo,\n      required: descriptor.required,\n    }\n  }\n  return {\n    form: {\n      key: form.key,\n      name: form.name,\n      defaultLocale: form.defaultLocale,\n      supportedLocales: form.supportedLocales,\n    },\n    schema: formVersion.schema,\n    ui_schema: formVersion.uiSchema,\n    fieldIndex,\n    completion: readCompletionCopy(distribution?.settings),\n    redirect_url: distribution?.redirectUrl ?? null,\n    embed: readEmbedContext(distribution),\n  }\n}\n\nexport async function readJsonBody<T = unknown>(req: Request): Promise<T> {\n  try {\n    return (await req.json()) as T\n  } catch {\n    throw new SubmissionServiceError('VALIDATION_FAILED', 'Invalid JSON body.', 400)\n  }\n}\n\nexport function serializeSubmission(submission: FormSubmission) {\n  return {\n    id: submission.id,\n    organizationId: submission.organizationId,\n    tenantId: submission.tenantId,\n    formVersionId: submission.formVersionId,\n    subjectType: submission.subjectType,\n    subjectId: submission.subjectId,\n    status: submission.status,\n    currentRevisionId: submission.currentRevisionId ?? null,\n    startedBy: submission.startedBy,\n    submittedBy: submission.submittedBy ?? null,\n    firstSavedAt: submission.firstSavedAt?.toISOString() ?? null,\n    submittedAt: submission.submittedAt?.toISOString() ?? null,\n    submitMetadata: submission.submitMetadata ?? null,\n    pdfSnapshotAttachmentId: submission.pdfSnapshotAttachmentId ?? null,\n    anonymizedAt: submission.anonymizedAt?.toISOString() ?? null,\n    createdAt: submission.createdAt?.toISOString() ?? null,\n    updatedAt: submission.updatedAt?.toISOString() ?? null,\n  }\n}\n\nexport function serializeRevision(revision: FormSubmissionRevision) {\n  return {\n    id: revision.id,\n    submissionId: revision.submissionId,\n    revisionNumber: revision.revisionNumber,\n    encryptionKeyVersion: revision.encryptionKeyVersion,\n    savedAt: revision.savedAt?.toISOString() ?? null,\n    savedBy: revision.savedBy,\n    savedByRole: revision.savedByRole,\n    changeSource: revision.changeSource,\n    changedFieldKeys: revision.changedFieldKeys ?? [],\n    changeSummary: revision.changeSummary ?? null,\n    anonymizedAt: revision.anonymizedAt?.toISOString() ?? null,\n  }\n}\n\nexport function serializeActor(actor: FormSubmissionActor) {\n  return {\n    id: actor.id,\n    submissionId: actor.submissionId,\n    userId: actor.userId,\n    role: actor.role,\n    assignedAt: actor.assignedAt?.toISOString() ?? null,\n    revokedAt: actor.revokedAt?.toISOString() ?? null,\n  }\n}\n"],
+  "mappings": "AAIA,SAAS,oBAAsC;AAC/C,SAAS,2BAA2B;AACpC,SAAS,wBAAwB,gCAAgC;AACjE,SAAmC,kCAAkC;AACrE,SAAS,yBAAyB;AAW3B,SAAS,mBAAmB,OAA8B;AAC/D,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,WAAW,KAAK;AAAA,MAC5E,EAAE,QAAQ,MAAM,WAAW;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAEO,SAAS,8BAA8B,OAAyB;AACrE,SAAO,yBAAyB,KAAK,KAAK,MAAM,SAAS;AAC3D;AAEA,eAAsB,iCAAwD;AAC5E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,aAAa;AAAA,IAClB;AAAA,MACE,OAAO;AAAA,MACP,SAAS,UAAU,kCAAkC,sDAAsD;AAAA,IAC7G;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,SAAS,qBAAqB,OAA8B;AACjE,MAAI,2BAA2B,KAAK,GAAG;AACrC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,WAAW,KAAK;AAAA,MAC5E,EAAE,QAAQ,MAAM,WAAW;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAeO,SAAS,oBACd,KACA,gBACyB;AACzB,QAAM,eAAe,IAAI,QAAQ,IAAI,iBAAiB;AACtD,QAAM,KAAK,cAAc,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,IAAI,WAAW,KAAK;AAClF,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,SAAO;AAAA,IACL,GAAI,kBAAkB,CAAC;AAAA,IACvB;AAAA,IACA;AAAA,IACA,oBAAmB,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC5C;AACF;AAcA,SAAS,mBACP,UACkD;AAClD,QAAM,aACJ,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,IAC9D,SAAqC,aACtC;AACN,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,GAAG;AAC9E,WAAO,EAAE,OAAO,MAAM,SAAS,KAAK;AAAA,EACtC;AACA,QAAM,SAAS;AACf,QAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,IAAI,OAAO,QAAQ;AACvF,QAAM,UACJ,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AACjF,SAAO,EAAE,OAAO,QAAQ;AAC1B;AAQA,SAAS,iBACP,cACyE;AACzE,QAAM,QAAQ,kBAAkB,cAAc,QAAQ;AACtD,MAAI,CAAC,SAAS,MAAM,YAAY,KAAM,QAAO;AAC7C,SAAO;AAAA,IACL,OAAO,MAAM,SAAS;AAAA,IACtB,YAAY,MAAM,eAAe;AAAA,EACnC;AACF;AAEO,SAAS,qBAAqB,MAKlC;AACD,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,IAAI;AACtD,QAAM,aAAsC,CAAC;AAC7C,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,SAAS,UAAU,GAAG;AACxE,eAAW,QAAQ,IAAI;AAAA,MACrB,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,YAAY,WAAW;AAAA,MACvB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,MACvB,WAAW,WAAW;AAAA,MACtB,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,eAAe,KAAK;AAAA,MACpB,kBAAkB,KAAK;AAAA,IACzB;AAAA,IACA,QAAQ,YAAY;AAAA,IACpB,WAAW,YAAY;AAAA,IACvB;AAAA,IACA,YAAY,mBAAmB,cAAc,QAAQ;AAAA,IACrD,cAAc,cAAc,eAAe;AAAA,IAC3C,OAAO,iBAAiB,YAAY;AAAA,EACtC;AACF;AAEA,eAAsB,aAA0B,KAA0B;AACxE,MAAI;AACF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,uBAAuB,qBAAqB,sBAAsB,GAAG;AAAA,EACjF;AACF;AAEO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO;AAAA,IACL,IAAI,WAAW;AAAA,IACf,gBAAgB,WAAW;AAAA,IAC3B,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,IAC1B,aAAa,WAAW;AAAA,IACxB,WAAW,WAAW;AAAA,IACtB,QAAQ,WAAW;AAAA,IACnB,mBAAmB,WAAW,qBAAqB;AAAA,IACnD,WAAW,WAAW;AAAA,IACtB,aAAa,WAAW,eAAe;AAAA,IACvC,cAAc,WAAW,cAAc,YAAY,KAAK;AAAA,IACxD,aAAa,WAAW,aAAa,YAAY,KAAK;AAAA,IACtD,gBAAgB,WAAW,kBAAkB;AAAA,IAC7C,yBAAyB,WAAW,2BAA2B;AAAA,IAC/D,cAAc,WAAW,cAAc,YAAY,KAAK;AAAA,IACxD,WAAW,WAAW,WAAW,YAAY,KAAK;AAAA,IAClD,WAAW,WAAW,WAAW,YAAY,KAAK;AAAA,EACpD;AACF;AAEO,SAAS,kBAAkB,UAAkC;AAClE,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,cAAc,SAAS;AAAA,IACvB,gBAAgB,SAAS;AAAA,IACzB,sBAAsB,SAAS;AAAA,IAC/B,SAAS,SAAS,SAAS,YAAY,KAAK;AAAA,IAC5C,SAAS,SAAS;AAAA,IAClB,aAAa,SAAS;AAAA,IACtB,cAAc,SAAS;AAAA,IACvB,kBAAkB,SAAS,oBAAoB,CAAC;AAAA,IAChD,eAAe,SAAS,iBAAiB;AAAA,IACzC,cAAc,SAAS,cAAc,YAAY,KAAK;AAAA,EACxD;AACF;AAEO,SAAS,eAAe,OAA4B;AACzD,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,cAAc,MAAM;AAAA,IACpB,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,IAC/C,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,EAC/C;AACF;",
   "names": []
 }