@open-mercato/core 0.9.1-develop.7519.1.38f51f8dbb → 0.9.1-develop.7536.1.f9a5776a07

package/src/modules/currencies/i18n/de.json

@@ -6,6 +6,9 @@
   "currencies.create.title": "Währung erstellen",
   "currencies.currencies.update": "Währung aktualisieren",
   "currencies.edit.title": "Währung bearbeiten",
+  "currencies.errors.baseCurrencyUnset": "Wählen Sie stattdessen eine andere Währung als Basiswährung, anstatt sie zu entfernen.",
+  "currencies.errors.undoHasRates": "Diese Änderung kann nicht rückgängig gemacht werden, da inzwischen Wechselkurse diese Währung verwenden. Löschen oder deaktivieren Sie diese Wechselkurse zuerst.",
+  "currencies.errors.undoWouldClearBase": "Diese Änderung kann nicht rückgängig gemacht werden, da die Organisation sonst keine Basiswährung hätte.",
   "currencies.exchange_rates.update": "Wechselkurs aktualisieren",
   "currencies.fetch.description": "Verwalten Sie den automatischen Abruf von Währungskursen von externen Anbietern",
   "currencies.fetch.disabled": "Deaktiviert",
@@ -54,6 +57,7 @@
   "currencies.form.field.decimalSeparator": "Dezimaltrennzeichen",
   "currencies.form.field.isActive": "Aktiv",
   "currencies.form.field.isBase": "Basiswährung",
+  "currencies.form.field.isBaseLocked": "Dies ist die Basiswährung. Um sie zu ändern, legen Sie eine andere Währung als Basis fest.",
   "currencies.form.field.name": "Währungsname",
   "currencies.form.field.namePlaceholder": "US-Dollar",
   "currencies.form.field.symbol": "Symbol",

package/src/modules/currencies/i18n/en.json

@@ -6,6 +6,9 @@
   "currencies.create.title": "Create Currency",
   "currencies.currencies.update": "Update currency",
   "currencies.edit.title": "Edit Currency",
+  "currencies.errors.baseCurrencyUnset": "Choose another currency as the base instead of clearing it.",
+  "currencies.errors.undoHasRates": "This change can't be undone because exchange rates now use this currency. Delete or deactivate those exchange rates first.",
+  "currencies.errors.undoWouldClearBase": "This change can't be undone because it would leave the organization without a base currency.",
   "currencies.exchange_rates.update": "Update exchange rate",
   "currencies.fetch.description": "Manage automatic currency exchange rate fetching from external providers",
   "currencies.fetch.disabled": "Disabled",
@@ -54,6 +57,7 @@
   "currencies.form.field.decimalSeparator": "Decimal Separator",
   "currencies.form.field.isActive": "Active",
   "currencies.form.field.isBase": "Base Currency",
+  "currencies.form.field.isBaseLocked": "This is the base currency. To change it, set another currency as the base.",
   "currencies.form.field.name": "Currency Name",
   "currencies.form.field.namePlaceholder": "US Dollar",
   "currencies.form.field.symbol": "Symbol",

package/src/modules/currencies/i18n/es.json

@@ -6,6 +6,9 @@
   "currencies.create.title": "Crear Moneda",
   "currencies.currencies.update": "Actualizar moneda",
   "currencies.edit.title": "Editar Moneda",
+  "currencies.errors.baseCurrencyUnset": "Elija otra moneda como base en lugar de quitarla.",
+  "currencies.errors.undoHasRates": "Este cambio no se puede deshacer porque ahora hay tipos de cambio que usan esta moneda. Elimine o desactive primero esos tipos de cambio.",
+  "currencies.errors.undoWouldClearBase": "Este cambio no se puede deshacer porque dejaría a la organización sin moneda base.",
   "currencies.exchange_rates.update": "Actualizar tipo de cambio",
   "currencies.fetch.description": "Gestionar la obtención automática de tipos de cambio desde proveedores externos",
   "currencies.fetch.disabled": "Deshabilitado",
@@ -54,6 +57,7 @@
   "currencies.form.field.decimalSeparator": "Separador Decimal",
   "currencies.form.field.isActive": "Activa",
   "currencies.form.field.isBase": "Moneda Base",
+  "currencies.form.field.isBaseLocked": "Esta es la moneda base. Para cambiarla, establezca otra moneda como base.",
   "currencies.form.field.name": "Nombre de Moneda",
   "currencies.form.field.namePlaceholder": "Dólar estadounidense",
   "currencies.form.field.symbol": "Símbolo",

package/src/modules/currencies/i18n/ko.json

@@ -6,6 +6,9 @@
   "currencies.create.title": "통화 생성",
   "currencies.currencies.update": "통화 수정",
   "currencies.edit.title": "통화 편집",
+  "currencies.errors.baseCurrencyUnset": "기준 통화를 해제하는 대신 다른 통화를 기준 통화로 선택하세요.",
+  "currencies.errors.undoHasRates": "이제 이 통화를 사용하는 환율이 있어 이 변경을 취소할 수 없습니다. 먼저 해당 환율을 삭제하거나 비활성화하세요.",
+  "currencies.errors.undoWouldClearBase": "이 변경을 취소하면 조직에 기준 통화가 없게 되므로 취소할 수 없습니다.",
   "currencies.exchange_rates.update": "환율 수정",
   "currencies.fetch.description": "외부 제공업체로부터 자동 환율 가져오기를 관리합니다",
   "currencies.fetch.disabled": "비활성화됨",
@@ -54,6 +57,7 @@
   "currencies.form.field.decimalSeparator": "소수 구분 기호",
   "currencies.form.field.isActive": "활성",
   "currencies.form.field.isBase": "기준 통화",
+  "currencies.form.field.isBaseLocked": "기준 통화입니다. 변경하려면 다른 통화를 기준 통화로 설정하세요.",
   "currencies.form.field.name": "통화 이름",
   "currencies.form.field.namePlaceholder": "미국 달러",
   "currencies.form.field.symbol": "기호",

package/src/modules/currencies/i18n/pl.json

@@ -6,6 +6,9 @@
   "currencies.create.title": "Utwórz Walutę",
   "currencies.currencies.update": "Aktualizuj walutę",
   "currencies.edit.title": "Edytuj Walutę",
+  "currencies.errors.baseCurrencyUnset": "Zamiast odznaczać walutę bazową, wybierz inną walutę jako bazową.",
+  "currencies.errors.undoHasRates": "Tej zmiany nie można cofnąć, ponieważ kursy wymiany korzystają teraz z tej waluty. Najpierw usuń lub dezaktywuj te kursy wymiany.",
+  "currencies.errors.undoWouldClearBase": "Tej zmiany nie można cofnąć, ponieważ organizacja zostałaby bez waluty bazowej.",
   "currencies.exchange_rates.update": "Aktualizuj kurs wymiany",
   "currencies.fetch.description": "Zarządzaj automatycznym pobieraniem kursów walut od zewnętrznych dostawców",
   "currencies.fetch.disabled": "Wyłączony",
@@ -54,6 +57,7 @@
   "currencies.form.field.decimalSeparator": "Separator Dziesiętny",
   "currencies.form.field.isActive": "Aktywna",
   "currencies.form.field.isBase": "Waluta Bazowa",
+  "currencies.form.field.isBaseLocked": "To jest waluta bazowa. Aby ją zmienić, ustaw inną walutę jako bazową.",
   "currencies.form.field.name": "Nazwa Waluty",
   "currencies.form.field.namePlaceholder": "Dolar amerykański",
   "currencies.form.field.symbol": "Symbol",

package/src/modules/currencies/lib/seeds.ts

@@ -126,6 +126,7 @@ export async function seedExampleCurrencies(em: EntityManager, scope: CurrencySe
   for (const entry of existingEntries) {
     existingMap.set(entry.code, entry)
   }
+  const hasLiveBase = existingEntries.some((entry) => entry.isBase && !entry.deletedAt)
 
   let touched = false
   for (const curr of SEED_CURRENCIES) {
@@ -143,6 +144,7 @@ export async function seedExampleCurrencies(em: EntityManager, scope: CurrencySe
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
       ...curr,
+      isBase: curr.isBase && !hasLiveBase,
       createdAt: new Date(),
       updatedAt: new Date(),
     })

package/src/modules/customer_accounts/api/login.ts

@@ -8,6 +8,7 @@ import { CustomerUserService } from '@open-mercato/core/modules/customer_account
 import { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
 import {
@@ -28,6 +29,10 @@ export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth:
 // so account existence cannot be inferred from a timing side channel. Mirrors signup.ts.
 const TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'
 
+function reportLoginEventError(error: unknown): void {
+  getTelemetryRuntime()?.reportError(error, { module: 'customer_accounts', code: 'customer_accounts.login_event_failed' })
+}
+
 export async function POST(req: Request) {
   let body: unknown
   try {
@@ -77,26 +82,26 @@ export async function POST(req: Request) {
   // conveyed out-of-band (e.g. email), never in the synchronous response.
   if (!user || !user.passwordHash) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (!user.isActive) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'inactive', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'inactive', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (customerUserService.checkLockout(user)) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   const passwordValid = await customerUserService.verifyPassword(user, password)
   if (!passwordValid) {
     await customerUserService.incrementFailedAttempts(user)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
@@ -105,11 +110,14 @@ export async function POST(req: Request) {
       email,
       reason: 'email_not_verified',
       tenantId,
-    }).catch(() => undefined)
+    }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
-  await customerUserService.resetFailedAttempts(user)
+  if (!(await customerUserService.resetFailedAttemptsUnlessLocked(user))) {
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(reportLoginEventError)
+    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
+  }
   await customerUserService.updateLastLoginAt(user)
 
   if (compoundKey) {
@@ -130,7 +138,7 @@ export async function POST(req: Request) {
     email: user.email,
     tenantId,
     organizationId: user.organizationId,
-  }).catch(() => undefined)
+  }).catch(reportLoginEventError)
 
   const res = NextResponse.json({
     ok: true,

package/src/modules/customer_accounts/services/customerUserService.ts

@@ -8,6 +8,14 @@ const BCRYPT_COST = 10
 const MAX_FAILED_ATTEMPTS = 5
 const LOCKOUT_DURATION_MS = 15 * 60 * 1000 // 15 minutes
 
+type CustomerUserLockoutDatabase = {
+  customer_users: {
+    id: string
+    failed_login_attempts: number
+    locked_until: Date | null
+  }
+}
+
 export class CustomerUserService {
   constructor(private em: EntityManager) {}
 
@@ -81,14 +89,32 @@ export class CustomerUserService {
   }
 
   async incrementFailedAttempts(user: CustomerUser): Promise<void> {
-    const newCount = (user.failedLoginAttempts || 0) + 1
-    const updates: Record<string, unknown> = { failedLoginAttempts: newCount }
-    if (newCount >= MAX_FAILED_ATTEMPTS) {
-      updates.lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)
-    }
-    await this.em.nativeUpdate(CustomerUser, { id: user.id }, updates)
-    user.failedLoginAttempts = newCount
-    if (updates.lockedUntil) user.lockedUntil = updates.lockedUntil as Date
+    const lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)
+    await this.em.getKysely<CustomerUserLockoutDatabase>()
+      .updateTable('customer_users')
+      .set((eb) => ({
+        failed_login_attempts: eb('failed_login_attempts', '+', 1),
+        locked_until: eb
+          .case()
+          .when('failed_login_attempts', '>=', MAX_FAILED_ATTEMPTS - 1)
+          .then(eb.fn<Date>('greatest', [eb.ref('locked_until'), eb.val(lockedUntil)]))
+          .else(eb.ref('locked_until'))
+          .end(),
+      }))
+      .where('id', '=', user.id)
+      .execute()
+  }
+
+  async resetFailedAttemptsUnlessLocked(user: CustomerUser): Promise<boolean> {
+    const now = new Date()
+    const row = await this.em.getKysely<CustomerUserLockoutDatabase>()
+      .updateTable('customer_users')
+      .set({ failed_login_attempts: 0, locked_until: null })
+      .where('id', '=', user.id)
+      .where((eb) => eb.or([eb('locked_until', 'is', null), eb('locked_until', '<=', now)]))
+      .returning('id')
+      .executeTakeFirst()
+    return row !== undefined
   }
 
   async resetFailedAttempts(user: CustomerUser): Promise<void> {
@@ -96,8 +122,6 @@ export class CustomerUserService {
       failedLoginAttempts: 0,
       lockedUntil: null,
     })
-    user.failedLoginAttempts = 0
-    user.lockedUntil = null
   }
 
   async updatePassword(user: CustomerUser, newPassword: string, em?: EntityManager): Promise<void> {

package/src/modules/customers/commands/companies.ts

@@ -26,6 +26,12 @@ import {
   CustomerPersonProfile,
   CustomerTagAssignment,
 } from '../data/entities'
+import {
+  captureInteractionRestoreDetails,
+  omitInteractionRestoreDetails,
+  restoreInteractionRestoreDetails,
+  type InteractionRestoreDetails,
+} from './interactionRestoreDetails'
 import {
   companyCreateSchema,
   companyUpdateSchema,
@@ -189,7 +195,7 @@ type CompanyInteractionSnapshot = {
   updatedAt: Date
   deletedAt: Date | null
   custom?: Record<string, unknown>
-}
+} & InteractionRestoreDetails
 
 type CompanySnapshot = {
   entity: {
@@ -246,7 +252,11 @@ type CompanyUndoPayload = {
   after?: CompanySnapshot | null
 }
 
-async function loadCompanySnapshot(em: EntityManager, id: string): Promise<CompanySnapshot | null> {
+async function loadCompanySnapshot(
+  em: EntityManager,
+  id: string,
+  options: { includeInteractionRestoreDetails?: boolean } = {},
+): Promise<CompanySnapshot | null> {
   const entity = await em.findOne(CustomerEntity, { id, deletedAt: null })
   if (!entity || entity.kind !== 'company') return null
   const profile = await em.findOne(CustomerCompanyProfile, { entity })
@@ -408,6 +418,7 @@ async function loadCompanySnapshot(em: EntityManager, id: string): Promise<Compa
         createdAt: interaction.createdAt,
         updatedAt: interaction.updatedAt,
         deletedAt: interaction.deletedAt ?? null,
+        ...(options.includeInteractionRestoreDetails ? captureInteractionRestoreDetails(interaction) : {}),
         custom: await loadCustomFieldSnapshot(em, {
           entityId: INTERACTION_ENTITY_ID,
           recordId: interaction.id,
@@ -998,7 +1009,7 @@ const deleteCompanyCommand: CommandHandler<{ body?: Record<string, unknown>; que
     async prepare(input, ctx) {
       const id = requireId(input, 'Company id required')
       const em = (ctx.container.resolve('em') as EntityManager)
-      const snapshot = await loadCompanySnapshot(em, id)
+      const snapshot = await loadCompanySnapshot(em, id, { includeInteractionRestoreDetails: true })
       return snapshot ? { before: snapshot } : {}
     },
     async execute(input, ctx) {
@@ -1182,7 +1193,7 @@ const deleteCompanyCommand: CommandHandler<{ body?: Record<string, unknown>; que
         resourceId: before.entity.id,
         tenantId: before.entity.tenantId,
         organizationId: before.entity.organizationId,
-        snapshotBefore: before,
+        snapshotBefore: omitInteractionRestoreDetails(before),
         payload: {
           undo: {
             before,
@@ -1421,6 +1432,7 @@ const deleteCompanyCommand: CommandHandler<{ body?: Record<string, unknown>; que
               source: interaction.source,
               appearanceIcon: interaction.appearanceIcon,
               appearanceColor: interaction.appearanceColor,
+              ...restoreInteractionRestoreDetails(interaction),
               createdAt: interaction.createdAt,
               updatedAt: interaction.updatedAt,
               deletedAt: interaction.deletedAt,

package/src/modules/customers/commands/interactionRestoreDetails.ts

@@ -0,0 +1,110 @@
+import { reviveSnapshotDates } from '@open-mercato/shared/lib/commands/undo'
+import type { CustomerInteraction } from '../data/entities'
+
+/**
+ * Interaction columns a Person/Company delete snapshot must carry so that undo can recreate each interaction
+ * exactly as it was. Every key is optional because delete logs written before these columns were captured
+ * do not contain them.
+ */
+export type InteractionRestoreDetails = {
+  externalMessageId?: string | null
+  channelProviderKey?: string | null
+  channelId?: string | null
+  durationMinutes?: number | null
+  location?: string | null
+  allDay?: boolean | null
+  recurrenceRule?: string | null
+  recurrenceEnd?: Date | string | null
+  participants?: CustomerInteraction['participants']
+  reminderMinutes?: number | null
+  visibility?: string | null
+  linkedEntities?: CustomerInteraction['linkedEntities']
+  guestPermissions?: CustomerInteraction['guestPermissions']
+  pinned?: boolean
+}
+
+const INTERACTION_RESTORE_DETAIL_KEYS = [
+  'externalMessageId',
+  'channelProviderKey',
+  'channelId',
+  'durationMinutes',
+  'location',
+  'allDay',
+  'recurrenceRule',
+  'recurrenceEnd',
+  'participants',
+  'reminderMinutes',
+  'visibility',
+  'linkedEntities',
+  'guestPermissions',
+  'pinned',
+] as const satisfies ReadonlyArray<keyof InteractionRestoreDetails>
+
+export function captureInteractionRestoreDetails(interaction: CustomerInteraction): Required<InteractionRestoreDetails> {
+  return {
+    externalMessageId: interaction.externalMessageId ?? null,
+    channelProviderKey: interaction.channelProviderKey ?? null,
+    channelId: interaction.channelId ?? null,
+    durationMinutes: interaction.durationMinutes ?? null,
+    location: interaction.location ?? null,
+    allDay: interaction.allDay ?? null,
+    recurrenceRule: interaction.recurrenceRule ?? null,
+    recurrenceEnd: interaction.recurrenceEnd ?? null,
+    participants: interaction.participants ?? null,
+    reminderMinutes: interaction.reminderMinutes ?? null,
+    visibility: interaction.visibility ?? null,
+    linkedEntities: interaction.linkedEntities ?? null,
+    guestPermissions: interaction.guestPermissions ?? null,
+    pinned: interaction.pinned === true,
+  }
+}
+
+/**
+ * A delete log written before visibility was captured cannot tell whether an email was private. An email that
+ * has an author is restored private: its author still reads it and can share it again. An email without an
+ * author keeps the previous behaviour, because a private row without an author is readable and changeable by
+ * nobody.
+ */
+function resolveRestoredVisibility(snapshot: { interactionType: string; authorUserId: string | null } & InteractionRestoreDetails): string | null {
+  if (Object.prototype.hasOwnProperty.call(snapshot, 'visibility')) return snapshot.visibility ?? null
+  return snapshot.interactionType === 'email' && snapshot.authorUserId ? 'private' : null
+}
+
+export function restoreInteractionRestoreDetails(
+  snapshot: { interactionType: string; authorUserId: string | null } & InteractionRestoreDetails,
+) {
+  const { recurrenceEnd } = reviveSnapshotDates({ recurrenceEnd: snapshot.recurrenceEnd ?? null }, ['recurrenceEnd'])
+  return {
+    externalMessageId: snapshot.externalMessageId ?? null,
+    channelProviderKey: snapshot.channelProviderKey ?? null,
+    channelId: snapshot.channelId ?? null,
+    durationMinutes: snapshot.durationMinutes ?? null,
+    location: snapshot.location ?? null,
+    allDay: snapshot.allDay ?? null,
+    recurrenceRule: snapshot.recurrenceRule ?? null,
+    recurrenceEnd: recurrenceEnd as Date | null,
+    participants: snapshot.participants ?? null,
+    reminderMinutes: snapshot.reminderMinutes ?? null,
+    visibility: resolveRestoredVisibility(snapshot),
+    linkedEntities: snapshot.linkedEntities ?? null,
+    guestPermissions: snapshot.guestPermissions ?? null,
+    pinned: snapshot.pinned === true,
+  }
+}
+
+/**
+ * The delete log's `snapshotBefore` is what the audit log shows; the restore details stay in the undo payload only.
+ */
+export function omitInteractionRestoreDetails<TSnapshot extends { interactions?: ReadonlyArray<InteractionRestoreDetails> }>(
+  snapshot: TSnapshot,
+): TSnapshot {
+  if (!Array.isArray(snapshot.interactions)) return snapshot
+  return {
+    ...snapshot,
+    interactions: snapshot.interactions.map((interaction) => {
+      const visible: Record<string, unknown> = { ...interaction }
+      for (const key of INTERACTION_RESTORE_DETAIL_KEYS) delete visible[key]
+      return visible
+    }),
+  }
+}

package/src/modules/customers/commands/people.ts

@@ -24,6 +24,12 @@ import {
   CustomerPersonProfile,
   CustomerTagAssignment,
 } from '../data/entities'
+import {
+  captureInteractionRestoreDetails,
+  omitInteractionRestoreDetails,
+  restoreInteractionRestoreDetails,
+  type InteractionRestoreDetails,
+} from './interactionRestoreDetails'
 import { resolvePersonCustomFieldRouting, CUSTOMER_ENTITY_ID, PERSON_ENTITY_ID } from '../lib/customFieldRouting'
 import { CustomFieldValue } from '@open-mercato/core/modules/entities/data/entities'
 import {
@@ -133,7 +139,7 @@ type PersonInteractionSnapshot = {
   updatedAt: Date
   deletedAt: Date | null
   custom?: Record<string, unknown>
-}
+} & InteractionRestoreDetails
 
 type PersonSnapshot = {
   entity: {
@@ -380,7 +386,11 @@ function serializePersonSnapshot(
   }
 }
 
-async function loadPersonSnapshot(em: EntityManager, entityId: string): Promise<PersonSnapshot | null> {
+async function loadPersonSnapshot(
+  em: EntityManager,
+  entityId: string,
+  options: { includeInteractionRestoreDetails?: boolean } = {},
+): Promise<PersonSnapshot | null> {
   const entity = await em.findOne(CustomerEntity, { id: entityId, deletedAt: null })
   if (!entity || entity.kind !== 'person') return null
   const profile = await findOneWithDecryption(
@@ -455,6 +465,7 @@ async function loadPersonSnapshot(em: EntityManager, entityId: string): Promise<
       createdAt: interaction.createdAt,
       updatedAt: interaction.updatedAt,
       deletedAt: interaction.deletedAt ?? null,
+      ...(options.includeInteractionRestoreDetails ? captureInteractionRestoreDetails(interaction) : {}),
       custom: await loadCustomFieldSnapshot(em, {
         entityId: INTERACTION_ENTITY_ID,
         recordId: interaction.id,
@@ -1231,7 +1242,7 @@ const deletePersonCommand: CommandHandler<{ body?: Record<string, unknown>; quer
     async prepare(input, ctx) {
       const id = requireId(input, 'Person id required')
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const snapshot = await loadPersonSnapshot(em, id)
+      const snapshot = await loadPersonSnapshot(em, id, { includeInteractionRestoreDetails: true })
       return snapshot ? { before: snapshot } : {}
     },
     async execute(input, ctx) {
@@ -1355,7 +1366,7 @@ const deletePersonCommand: CommandHandler<{ body?: Record<string, unknown>; quer
         resourceId: before.entity.id,
         tenantId: before.entity.tenantId,
         organizationId: before.entity.organizationId,
-        snapshotBefore: before,
+        snapshotBefore: omitInteractionRestoreDetails(before),
         payload: {
           undo: {
             before,
@@ -1646,6 +1657,7 @@ const deletePersonCommand: CommandHandler<{ body?: Record<string, unknown>; quer
           source: interaction.source,
           appearanceIcon: interaction.appearanceIcon,
           appearanceColor: interaction.appearanceColor,
+          ...restoreInteractionRestoreDetails(interaction),
           createdAt: interaction.createdAt,
           updatedAt: interaction.updatedAt,
           deletedAt: interaction.deletedAt,

package/src/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.ts

@@ -84,7 +84,7 @@ export const openApi: OpenApiRouteDoc = {
     DELETE: {
       summary: 'Revoke invitation',
       description:
-        'Soft-revokes an invitation — the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).',
+        'Soft-revokes an invitation — the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404); access tokens already issued for the invitation stop working (401).',
       responses: [{ status: 200, description: 'Invitation revoked', schema: deleteResponseSchema }],
       errors: [{ status: 404, description: 'Invitation not found', schema: errorSchema }],
     },

package/src/modules/forms/api/form-submissions/[id]/submit/route.ts

@@ -3,8 +3,11 @@
  *
  * Final submit. Body: `{ base_revision_id, submit_metadata? }`. Sets
  * status = submitted, captures `submit_metadata` (locale, IP, UA), emits
- * `forms.submission.submitted`. Idempotency hardening lands in 1d once the
- * client renderer is in place; phase 1c rejects double-submits with 422.
+ * `forms.submission.submitted`. A submission the caller started themselves
+ * must carry their own subject (`lib/portal-subject-policy.ts`), so a draft
+ * started for someone else before that check existed cannot be finalized.
+ * Idempotency hardening lands in 1d once the client renderer is in place;
+ * phase 1c rejects double-submits with 422.
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
@@ -14,7 +17,14 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { SubmissionService } from '../../../../services/submission-service'
 import { submissionSubmitInputSchema } from '../../../../data/validators'
-import { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from '../../../runtime-helpers'
+import {
+  buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeSubmission,
+} from '../../../runtime-helpers'
 
 export const metadata = {
   POST: { requireAuth: false },
@@ -56,9 +66,11 @@ export async function POST(
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: auth.sub,
       submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: true,
     })
     return NextResponse.json({ submission: serializeSubmission(submission) })
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()
     return mapSubmissionError(error)
   }
 }
@@ -79,6 +91,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],
   errors: [
     { status: 401, description: 'Not authenticated', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: caller-started submission is not on the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Submission not found', schema: errorSchema },
     { status: 409, description: 'Stale base_revision_id', schema: errorSchema },
     { status: 422, description: 'Submission already in terminal state', schema: errorSchema },

package/src/modules/forms/api/form-submissions/route.ts

@@ -2,7 +2,9 @@
  * Runtime API — POST /api/form-submissions
  *
  * Starts a new submission for the active version of a form. Customer auth is
- * required. The starter is auto-assigned the form version's
+ * required, and the subject must be the caller's own `customer` subject
+ * (`lib/portal-subject-policy.ts`); any other pair is refused with 403 before
+ * anything is persisted. The starter is auto-assigned the form version's
  * `x-om-default-actor-role` (or first declared role) — admin assignment of
  * additional actors is the admin route.
  */
@@ -18,7 +20,15 @@ import {
   type PrefillResolver,
 } from '../../services/prefill-resolver'
 import { submissionStartInputSchema } from '../../data/validators'
-import { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from '../runtime-helpers'
+import { isPortalSubjectAllowed } from '../../lib/portal-subject-policy'
+import {
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeActor,
+  serializeRevision,
+  serializeSubmission,
+} from '../runtime-helpers'
 
 export const metadata = {
   POST: { requireAuth: false },
@@ -43,6 +53,14 @@ export async function POST(req: NextRequest) {
       { status: 422 },
     )
   }
+  if (
+    !isPortalSubjectAllowed(auth.sub, {
+      subjectType: parsed.data.subject_type,
+      subjectId: parsed.data.subject_id,
+    })
+  ) {
+    return portalSubjectForbiddenResponse()
+  }
 
   const container = await createRequestContainer()
   const service = container.resolve('formsSubmissionService') as SubmissionService
@@ -122,6 +140,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 201, description: 'Submission started', schema: submissionResponseSchema }],
   errors: [
     { status: 401, description: 'Not authenticated', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: subject is not the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Form not found', schema: errorSchema },
     { status: 422, description: 'Validation or form-state error', schema: errorSchema },
   ],

package/src/modules/forms/api/public/submissions/[id]/submit/route.ts

@@ -9,6 +9,8 @@
  * then mark the invitation submitted. A capped distribution returns 410 BEFORE
  * any submission state changes. Customer-session submits skip the
  * reserve/mark-invitation steps — those are anonymous-distribution concerns.
+ * A customer-session submit of a submission the caller started themselves
+ * must carry their own subject (`lib/portal-subject-policy.ts`).
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
@@ -23,7 +25,9 @@ import { submissionSubmitInputSchema } from '../../../../../data/validators'
 import { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'
 import {
   buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
   mapDistributionError,
+  portalSubjectForbiddenResponse,
   readJsonBody,
   serializeSubmission,
 } from '../../../../runtime-helpers'
@@ -104,6 +108,7 @@ export async function POST(
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: principal.principal,
       submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: principal.source === 'customer',
     })
 
     if (principal.source === 'token') {
@@ -121,6 +126,7 @@ export async function POST(
       redirect_url: distribution?.redirectUrl ?? null,
     })
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()
     return mapDistributionError(error)
   }
 }
@@ -144,6 +150,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],
   errors: [
     { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: customer-started submission is not on the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Submission or invitation not found', schema: errorSchema },
     { status: 409, description: 'Stale base_revision_id', schema: errorSchema },
     { status: 410, description: 'Distribution response cap reached or unavailable', schema: errorSchema },