@open-mercato/enterprise 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/src/modules/sso/api/initiate/route.ts

@@ -5,6 +5,9 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { SsoService } from '../../services/ssoService'
 import { ssoInitiateSchema } from '../../data/validators'
 import { emitSsoEvent } from '../../events'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('sso').child({ component: 'initiate' })
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -50,10 +53,10 @@ export async function GET(req: Request) {
     })
     return res
   } catch (err) {
-    console.error('[SSO Initiate] Error:', err)
+    logger.error('SSO initiate error', { err })
     void emitSsoEvent('sso.login.failed', {
       reason: err instanceof Error ? err.message : 'initiate_failed',
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
     return NextResponse.redirect(toAbsoluteUrl(req, '/login?error=sso_failed'))
   }
 }

package/src/modules/sso/backend/sso/config/[id]/page.tsx

@@ -647,7 +647,7 @@ function RoleMappingsTab({
   return (
     <div>
       <p className="text-sm text-muted-foreground mb-4">
-        {t('sso.admin.roles.description', 'Map IdP app role names to local roles. On each SSO login, SSO-sourced roles are synced — roles no longer sent by the IdP are removed, while manually-assigned roles are preserved.')}
+        {t('sso.admin.roles.description', 'Map IdP app role names to local roles. Only explicitly mapped IdP roles grant local roles; on each SSO login, SSO-sourced roles are synced while manually-assigned roles are preserved.')}
       </p>
       <div className="flex items-end gap-2 mb-4">
         <div className="flex-1">
@@ -696,7 +696,7 @@ function RoleMappingsTab({
         </div>
       ) : (
         <p className="text-sm text-muted-foreground py-4 text-center mb-4">
-          {t('sso.admin.roles.empty', 'No role mappings configured. IdP role names will be matched directly against local role names.')}
+          {t('sso.admin.roles.empty', 'No role mappings configured. Users will not receive SSO-sourced roles until an IdP role is explicitly mapped to a local role.')}
         </p>
       )}
 

package/src/modules/sso/i18n/de.json

@@ -72,8 +72,8 @@
   "sso.admin.field.secretRequired": "Client-Geheimnis eingeben",
   "sso.admin.field.secretSet": "Client-Geheimnis ist konfiguriert",
   "sso.admin.new": "Neue SSO-Konfiguration",
-  "sso.admin.roles.description": "Ordnen Sie IdP-App-Rollennamen lokalen Rollen zu. Bei jeder SSO-Anmeldung werden SSO-basierte Rollen synchronisiert — Rollen, die der IdP nicht mehr sendet, werden entfernt, während manuell zugewiesene Rollen erhalten bleiben.",
-  "sso.admin.roles.empty": "Keine Rollenzuordnungen konfiguriert. IdP-Rollennamen werden direkt mit lokalen Rollennamen abgeglichen.",
+  "sso.admin.roles.description": "Ordnen Sie IdP-App-Rollennamen lokalen Rollen zu. Nur ausdrücklich zugeordnete IdP-Rollen vergeben lokale Rollen; bei jeder SSO-Anmeldung werden SSO-basierte Rollen synchronisiert, während manuell zugewiesene Rollen erhalten bleiben.",
+  "sso.admin.roles.empty": "Keine Rollenzuordnungen konfiguriert. Benutzer erhalten keine SSO-basierten Rollen, bis eine IdP-Rolle ausdrücklich einer lokalen Rolle zugeordnet ist.",
   "sso.admin.roles.error.duplicate": "Diese IdP-Rolle ist bereits zugeordnet",
   "sso.admin.roles.error.emptyIdpRole": "IdP-Rollenname ist erforderlich",
   "sso.admin.roles.error.emptyLocalRole": "Wählen Sie eine lokale Rolle",

package/src/modules/sso/i18n/en.json

@@ -72,8 +72,8 @@
   "sso.admin.field.secretRequired": "Enter client secret",
   "sso.admin.field.secretSet": "Client secret is configured",
   "sso.admin.new": "New SSO Config",
-  "sso.admin.roles.description": "Map IdP app role names to local roles. On each SSO login, SSO-sourced roles are synced — roles no longer sent by the IdP are removed, while manually-assigned roles are preserved.",
-  "sso.admin.roles.empty": "No role mappings configured. IdP role names will be matched directly against local role names.",
+  "sso.admin.roles.description": "Map IdP app role names to local roles. Only explicitly mapped IdP roles grant local roles; on each SSO login, SSO-sourced roles are synced while manually-assigned roles are preserved.",
+  "sso.admin.roles.empty": "No role mappings configured. Users will not receive SSO-sourced roles until an IdP role is explicitly mapped to a local role.",
   "sso.admin.roles.error.duplicate": "This IdP role is already mapped",
   "sso.admin.roles.error.emptyIdpRole": "IdP role name is required",
   "sso.admin.roles.error.emptyLocalRole": "Select a local role",

package/src/modules/sso/i18n/es.json

@@ -72,8 +72,8 @@
   "sso.admin.field.secretRequired": "Ingrese el secreto de cliente",
   "sso.admin.field.secretSet": "El secreto de cliente está configurado",
   "sso.admin.new": "Nueva configuración SSO",
-  "sso.admin.roles.description": "Asigne nombres de roles de aplicación IdP a roles locales. En cada inicio de sesión SSO, los roles de origen SSO se sincronizan — los roles que el IdP ya no envía se eliminan, mientras que los roles asignados manualmente se conservan.",
-  "sso.admin.roles.empty": "No hay asignaciones de roles configuradas. Los nombres de roles del IdP se compararán directamente con los nombres de roles locales.",
+  "sso.admin.roles.description": "Asigne nombres de roles de aplicación IdP a roles locales. Solo los roles de IdP asignados explícitamente conceden roles locales; en cada inicio de sesión SSO, los roles de origen SSO se sincronizan mientras se conservan los roles asignados manualmente.",
+  "sso.admin.roles.empty": "No hay asignaciones de roles configuradas. Los usuarios no recibirán roles de origen SSO hasta que un rol de IdP se asigne explícitamente a un rol local.",
   "sso.admin.roles.error.duplicate": "Este rol de IdP ya está asignado",
   "sso.admin.roles.error.emptyIdpRole": "El nombre del rol de IdP es obligatorio",
   "sso.admin.roles.error.emptyLocalRole": "Seleccione un rol local",

package/src/modules/sso/i18n/pl.json

@@ -72,8 +72,8 @@
   "sso.admin.field.secretRequired": "Wprowadź client secret",
   "sso.admin.field.secretSet": "Client secret jest skonfigurowany",
   "sso.admin.new": "Nowa konfiguracja SSO",
-  "sso.admin.roles.description": "Mapuj nazwy ról IdP na lokalne role. Przy każdym logowaniu SSO role źródłowe SSO są synchronizowane — role nieotrzymane od IdP są usuwane, role przypisane ręcznie są zachowane.",
-  "sso.admin.roles.empty": "Brak skonfigurowanych mapowań ról. Nazwy ról IdP będą dopasowywane bezpośrednio do nazw lokalnych ról.",
+  "sso.admin.roles.description": "Mapuj nazwy ról IdP na lokalne role. Tylko jawnie zmapowane role IdP nadają lokalne role; przy każdym logowaniu SSO role źródłowe SSO są synchronizowane, a role przypisane ręcznie pozostają zachowane.",
+  "sso.admin.roles.empty": "Brak skonfigurowanych mapowań ról. Użytkownicy nie otrzymają ról źródłowych SSO, dopóki rola IdP nie zostanie jawnie zmapowana na lokalną rolę.",
   "sso.admin.roles.error.duplicate": "Ta rola IdP jest już zmapowana",
   "sso.admin.roles.error.emptyIdpRole": "Nazwa roli IdP jest wymagana",
   "sso.admin.roles.error.emptyLocalRole": "Wybierz lokalną rolę",

package/src/modules/sso/services/accountLinkingService.ts

@@ -6,6 +6,9 @@ import { SsoConfig, SsoIdentity, SsoRoleGrant, ScimToken } from '../data/entitie
 import { emitSsoEvent } from '../events'
 import { EmailNotVerifiedError } from '../lib/errors'
 import type { SsoIdentityPayload } from '../lib/types'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('sso').child({ component: 'account-linking' })
 
 export class AccountLinkingService {
   constructor(private em: EntityManager) {}
@@ -127,7 +130,7 @@ export class AccountLinkingService {
       id: identity.id,
       tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     return { user, identity }
   }
@@ -174,7 +177,7 @@ export class AccountLinkingService {
         id: identity.id,
         tenantId,
         organizationId: config.organizationId,
-      }).catch((e) => console.error('[SSO Event]', e))
+      }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
       return { user, identity }
     })
@@ -311,73 +314,28 @@ function resolveRoleNamesFromIdpGroups(
 
   for (const group of normalizedGroups) {
     const mapped = mergedMappings.get(group)
-    if (mapped?.length) {
-      for (const role of mapped) roleNames.add(role)
-      continue
-    }
+    if (!mapped?.length) continue
 
-    roleNames.add(group)
-    const segmented = group.split(/[\\/:]/).map((part) => normalizeToken(part)).filter((part): part is string => part !== null)
-    for (const candidate of segmented) {
-      roleNames.add(candidate)
-    }
+    for (const role of mapped) roleNames.add(role)
   }
 
   return Array.from(roleNames)
 }
 
 function loadMergedMappings(configMappings?: Record<string, string>): Map<string, string[]> {
-  const envMappings = loadGroupRoleMappingsFromEnv()
+  const mappings = new Map<string, string[]>()
 
-  // Per-config mappings take precedence over env var
   if (configMappings && Object.keys(configMappings).length > 0) {
     for (const [group, roleName] of Object.entries(configMappings)) {
       const normalizedGroup = normalizeToken(group)
       if (!normalizedGroup) continue
       const normalizedRole = normalizeToken(roleName)
       if (!normalizedRole) continue
-      envMappings.set(normalizedGroup, [normalizedRole])
-    }
-  }
-
-  return envMappings
-}
-
-function loadGroupRoleMappingsFromEnv(): Map<string, string[]> {
-  const raw = process.env.SSO_GROUP_ROLE_MAP
-  if (!raw) return new Map()
-
-  try {
-    const parsed = JSON.parse(raw) as Record<string, unknown>
-    const out = new Map<string, string[]>()
-    for (const [group, roleValue] of Object.entries(parsed)) {
-      const normalizedGroup = normalizeToken(group)
-      if (!normalizedGroup) continue
-      const roles = normalizeRoleList(roleValue)
-      if (roles.length > 0) out.set(normalizedGroup, roles)
-    }
-    return out
-  } catch {
-    return new Map()
-  }
-}
-
-function normalizeRoleList(value: unknown): string[] {
-  if (typeof value === 'string') {
-    const token = normalizeToken(value)
-    return token ? [token] : []
-  }
-
-  if (Array.isArray(value)) {
-    const out = new Set<string>()
-    for (const entry of value) {
-      const token = normalizeToken(entry)
-      if (token) out.add(token)
+      mappings.set(normalizedGroup, [normalizedRole])
     }
-    return Array.from(out)
   }
 
-  return []
+  return mappings
 }
 
 function normalizeToken(value: unknown): string | null {

package/src/modules/sso/services/ssoConfigService.ts

@@ -8,6 +8,9 @@ import type { SsoConfigAdminCreateInput, SsoConfigAdminUpdateInput, SsoConfigLis
 import { emitSsoEvent } from '../events'
 import { validateDomain, normalizeDomain, uniqueDomains, checkDomainLimit } from '../lib/domains'
 import type { SsoProviderRegistry } from '../lib/registry'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('sso').child({ component: 'config' })
 
 export interface SsoAdminScope {
   isSuperAdmin: boolean
@@ -138,7 +141,7 @@ export class SsoConfigService {
       id: config.id,
       tenantId: config.tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     return this.toPublic(config)
   }
@@ -178,7 +181,7 @@ export class SsoConfigService {
       id: config.id,
       tenantId: config.tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     return this.toPublic(config)
   }
@@ -197,7 +200,7 @@ export class SsoConfigService {
       id: config.id,
       tenantId: config.tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
   }
 
   async activate(scope: SsoAdminScope, id: string, active: boolean): Promise<SsoConfigPublic> {
@@ -229,13 +232,13 @@ export class SsoConfigService {
           id: config.id,
           tenantId: config.tenantId,
           organizationId: config.organizationId,
-        }).catch((e) => console.error('[SSO Event]', e))
+        }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
       } else if (!active && wasActive) {
         void emitSsoEvent('sso.config.deactivated', {
           id: config.id,
           tenantId: config.tenantId,
           organizationId: config.organizationId,
-        }).catch((e) => console.error('[SSO Event]', e))
+        }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
       }
 
       return this.toPublic(config)
@@ -276,7 +279,7 @@ export class SsoConfigService {
         tenantId: config.tenantId,
         organizationId: config.organizationId,
         domain: normalized,
-      }).catch((e) => console.error('[SSO Event]', e))
+      }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
       return this.toPublic(config)
     })
@@ -294,7 +297,7 @@ export class SsoConfigService {
       tenantId: config.tenantId,
       organizationId: config.organizationId,
       domain: normalized,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     return this.toPublic(config)
   }

package/src/modules/sso/services/ssoService.ts

@@ -10,6 +10,9 @@ import type { AccountLinkingService } from './accountLinkingService'
 import { encryptStateCookie, decryptStateCookie, createFlowState } from '../lib/state-cookie'
 import { emitSsoEvent } from '../events'
 import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('sso').child({ component: 'service' })
 
 export class SsoService {
   constructor(
@@ -60,7 +63,7 @@ export class SsoService {
     void emitSsoEvent('sso.login.initiated', {
       tenantId: config.tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     const authUrl = await provider.buildAuthUrl(config, {
       state: state.state,
@@ -144,7 +147,7 @@ export class SsoService {
       id: String(user.id),
       tenantId: config.tenantId,
       organizationId: config.organizationId,
-    }).catch((e) => console.error('[SSO Event]', e))
+    }).catch((eventError) => logger.error('SSO event emit failed', { err: eventError }))
 
     return {
       token,

package/src/modules/system_status_overlays/subscribers/application-bootstrap-enterprise-warning.ts

@@ -1,3 +1,7 @@
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('system_status_overlays')
+
 const APP_BOOTSTRAP_EVENT = 'application.bootstrap.completed'
 const ENTERPRISE_WARNING_GLOBAL_KEY = '__openMercatoEnterpriseLicenseWarningShown__'
 
@@ -11,7 +15,7 @@ export default async function handle() {
   if ((globalThis as Record<string, unknown>)[ENTERPRISE_WARNING_GLOBAL_KEY] === true) return
 
   ;(globalThis as Record<string, unknown>)[ENTERPRISE_WARNING_GLOBAL_KEY] = true
-  console.warn(
-    '[enterprise] Enterprise modules are enabled. Developer preview is free, but production usage requires a commercial enterprise license. See: https://github.com/open-mercato/open-mercato/blob/main/packages/enterprise/README.md',
+  logger.warn(
+    'Enterprise modules are enabled. Developer preview is free, but production usage requires a commercial enterprise license. See: https://github.com/open-mercato/open-mercato/blob/main/packages/enterprise/README.md',
   )
 }