@open-mercato/onboarding 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/dist/modules/onboarding/lib/service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/onboarding/lib/service.ts"],
-  "sourcesContent": ["import { randomBytes, createHash } from 'node:crypto'\nimport { hash } from 'bcryptjs'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { OnboardingRequest } from '../data/entities'\nimport type { OnboardingStartInput } from '../data/validators'\n\ntype CreateRequestOptions = {\n  expiresInHours?: number\n}\n\nexport class OnboardingService {\n  constructor(private readonly em: EntityManager) {}\n\n  async createOrUpdateRequest(input: OnboardingStartInput, options: CreateRequestOptions = {}) {\n    const expiresInHours = options.expiresInHours ?? 24\n    const token = randomBytes(32).toString('hex')\n    const tokenHash = hashToken(token)\n    const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)\n    const now = new Date()\n    const passwordHash = await hash(input.password, 10)\n\n    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })\n    if (existing) {\n      const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt\n      if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {\n        const remainingMs = 10 * 60 * 1000 - (Date.now() - lastSentAt.getTime())\n        const waitMinutes = Math.max(1, Math.ceil(remainingMs / (60 * 1000)))\n        throw new Error(`PENDING_REQUEST:${waitMinutes}`)\n      }\n      existing.tokenHash = tokenHash\n      existing.status = 'pending'\n      existing.firstName = input.firstName\n      existing.lastName = input.lastName\n      existing.organizationName = input.organizationName\n      existing.locale = input.locale ?? existing.locale ?? 'en'\n      existing.termsAccepted = true\n      existing.marketingConsent = input.marketingConsent ?? false\n      existing.passwordHash = passwordHash\n      existing.expiresAt = expiresAt\n      existing.completedAt = null\n      existing.processingStartedAt = null\n      existing.tenantId = null\n      existing.organizationId = null\n      existing.userId = null\n      existing.lastEmailSentAt = now\n      existing.preparationCompletedAt = null\n      existing.readyEmailSentAt = null\n      await this.em.flush()\n      return { request: existing, token }\n    }\n\n    const request = this.em.create(OnboardingRequest, {\n      email: input.email,\n      tokenHash,\n      status: 'pending',\n      firstName: input.firstName,\n      lastName: input.lastName,\n      organizationName: input.organizationName,\n      locale: input.locale ?? 'en',\n      termsAccepted: true,\n      marketingConsent: input.marketingConsent ?? false,\n      passwordHash,\n      expiresAt,\n      processingStartedAt: null,\n      lastEmailSentAt: now,\n      createdAt: now,\n      updatedAt: now,\n    })\n    await this.em.persist(request).flush()\n    return { request, token }\n  }\n\n  async findPendingByToken(token: string) {\n    const tokenHash = hashToken(token)\n    const now = new Date()\n    return this.em.findOne(OnboardingRequest, {\n      tokenHash,\n      status: 'pending',\n      expiresAt: { $gt: now } as any,\n    })\n  }\n\n  async findByToken(token: string) {\n    const tokenHash = hashToken(token)\n    return this.em.findOne(OnboardingRequest, { tokenHash })\n  }\n\n  async findById(id: string) {\n    return this.em.findOne(OnboardingRequest, { id })\n  }\n\n  async findLatestByTenantId(tenantId: string) {\n    return this.em.findOne(\n      OnboardingRequest,\n      { tenantId, deletedAt: null },\n      { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },\n    )\n  }\n\n  async startProcessing(request: OnboardingRequest, startedAt: Date) {\n    request.status = 'processing'\n    request.processingStartedAt = startedAt\n    await this.em.flush()\n  }\n\n  async resetProcessing(request: OnboardingRequest) {\n    request.status = 'pending'\n    request.processingStartedAt = null\n    await this.em.flush()\n  }\n\n  async updateProvisioningIds(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    await this.em.flush()\n  }\n\n  async markCompleted(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.status = 'completed'\n    request.completedAt = new Date()\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    request.processingStartedAt = null\n    request.passwordHash = null\n    await this.em.flush()\n  }\n\n  async markReadyEmailSent(request: OnboardingRequest, sentAt: Date) {\n    request.readyEmailSentAt = sentAt\n    await this.em.flush()\n  }\n\n  async markPreparationCompleted(request: OnboardingRequest, completedAt: Date) {\n    request.preparationCompletedAt = completedAt\n    await this.em.flush()\n  }\n}\n\nfunction hashToken(token: string) {\n  return createHash('sha256').update(token).digest('hex')\n}\n"],
-  "mappings": "AAAA,SAAS,aAAa,kBAAkB;AACxC,SAAS,YAAY;AAErB,SAAS,yBAAyB;AAO3B,MAAM,kBAAkB;AAAA,EAC7B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,sBAAsB,OAA6B,UAAgC,CAAC,GAAG;AAC3F,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,GAAI;AACvE,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,eAAe,MAAM,KAAK,MAAM,UAAU,EAAE;AAElD,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,mBAAmB,EAAE,OAAO,MAAM,MAAM,CAAC;AAChF,QAAI,UAAU;AACZ,YAAM,aAAa,SAAS,mBAAmB,SAAS,aAAa,SAAS;AAC9E,UAAI,CAAC,WAAW,YAAY,EAAE,SAAS,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,KAAM;AAC3H,cAAM,cAAc,KAAK,KAAK,OAAQ,KAAK,IAAI,IAAI,WAAW,QAAQ;AACtE,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,KAAK,eAAe,KAAK,IAAK,CAAC;AACpE,cAAM,IAAI,MAAM,mBAAmB,WAAW,EAAE;AAAA,MAClD;AACA,eAAS,YAAY;AACrB,eAAS,SAAS;AAClB,eAAS,YAAY,MAAM;AAC3B,eAAS,WAAW,MAAM;AAC1B,eAAS,mBAAmB,MAAM;AAClC,eAAS,SAAS,MAAM,UAAU,SAAS,UAAU;AACrD,eAAS,gBAAgB;AACzB,eAAS,mBAAmB,MAAM,oBAAoB;AACtD,eAAS,eAAe;AACxB,eAAS,YAAY;AACrB,eAAS,cAAc;AACvB,eAAS,sBAAsB;AAC/B,eAAS,WAAW;AACpB,eAAS,iBAAiB;AAC1B,eAAS,SAAS;AAClB,eAAS,kBAAkB;AAC3B,eAAS,yBAAyB;AAClC,eAAS,mBAAmB;AAC5B,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,SAAS,UAAU,MAAM;AAAA,IACpC;AAEA,UAAM,UAAU,KAAK,GAAG,OAAO,mBAAmB;AAAA,MAChD,OAAO,MAAM;AAAA,MACb;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,QAAQ,MAAM,UAAU;AAAA,MACxB,eAAe;AAAA,MACf,kBAAkB,MAAM,oBAAoB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,mBAAmB,OAAe;AACtC,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,KAAK,GAAG,QAAQ,mBAAmB;AAAA,MACxC;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,EAAE,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,OAAe;AAC/B,UAAM,YAAY,UAAU,KAAK;AACjC,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,UAAU,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,GAAG,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,qBAAqB,UAAkB;AAC3C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA,EAAE,UAAU,WAAW,KAAK;AAAA,MAC5B,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAA4B,WAAiB;AACjE,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,gBAAgB,SAA4B;AAChD,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,sBAAsB,SAA4B,MAAoE;AAC1H,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,cAAc,SAA4B,MAAoE;AAClH,YAAQ,SAAS;AACjB,YAAQ,cAAc,oBAAI,KAAK;AAC/B,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,YAAQ,sBAAsB;AAC9B,YAAQ,eAAe;AACvB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,mBAAmB,SAA4B,QAAc;AACjE,YAAQ,mBAAmB;AAC3B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,yBAAyB,SAA4B,aAAmB;AAC5E,YAAQ,yBAAyB;AACjC,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,UAAU,OAAe;AAChC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;",
+  "sourcesContent": ["import { randomBytes, createHash } from 'node:crypto'\nimport { hash } from 'bcryptjs'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { OnboardingRequest } from '../data/entities'\nimport type { OnboardingStartInput } from '../data/validators'\n\ntype CreateRequestOptions = {\n  expiresInHours?: number\n}\n\nexport class OnboardingService {\n  constructor(private readonly em: EntityManager) {}\n\n  async createOrUpdateRequest(input: OnboardingStartInput, options: CreateRequestOptions = {}) {\n    const expiresInHours = options.expiresInHours ?? 24\n    const token = randomBytes(32).toString('hex')\n    const tokenHash = hashToken(token)\n    const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)\n    const now = new Date()\n    const passwordHash = await hash(input.password, 10)\n\n    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })\n    if (existing) {\n      const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt\n      if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {\n        const remainingMs = 10 * 60 * 1000 - (Date.now() - lastSentAt.getTime())\n        const waitMinutes = Math.max(1, Math.ceil(remainingMs / (60 * 1000)))\n        throw new Error(`PENDING_REQUEST:${waitMinutes}`)\n      }\n      existing.tokenHash = tokenHash\n      existing.status = 'pending'\n      existing.firstName = input.firstName\n      existing.lastName = input.lastName\n      existing.organizationName = input.organizationName\n      existing.locale = input.locale ?? existing.locale ?? 'en'\n      existing.termsAccepted = true\n      existing.marketingConsent = input.marketingConsent ?? false\n      existing.passwordHash = passwordHash\n      existing.expiresAt = expiresAt\n      existing.completedAt = null\n      existing.processingStartedAt = null\n      existing.tenantId = null\n      existing.organizationId = null\n      existing.userId = null\n      existing.lastEmailSentAt = now\n      existing.preparationCompletedAt = null\n      existing.readyEmailSentAt = null\n      await this.em.flush()\n      return { request: existing, token }\n    }\n\n    const request = this.em.create(OnboardingRequest, {\n      email: input.email,\n      tokenHash,\n      status: 'pending',\n      firstName: input.firstName,\n      lastName: input.lastName,\n      organizationName: input.organizationName,\n      locale: input.locale ?? 'en',\n      termsAccepted: true,\n      marketingConsent: input.marketingConsent ?? false,\n      passwordHash,\n      expiresAt,\n      processingStartedAt: null,\n      lastEmailSentAt: now,\n      createdAt: now,\n      updatedAt: now,\n    })\n    await this.em.persist(request).flush()\n    return { request, token }\n  }\n\n  async findPendingByToken(token: string) {\n    const tokenHash = hashToken(token)\n    const now = new Date()\n    return this.em.findOne(OnboardingRequest, {\n      tokenHash,\n      status: 'pending',\n      expiresAt: { $gt: now } as any,\n    })\n  }\n\n  async findByToken(token: string) {\n    const tokenHash = hashToken(token)\n    return this.em.findOne(OnboardingRequest, { tokenHash })\n  }\n\n  async findById(id: string) {\n    return this.em.findOne(OnboardingRequest, { id })\n  }\n\n  async findLatestByTenantId(tenantId: string) {\n    return this.em.findOne(\n      OnboardingRequest,\n      { tenantId, deletedAt: null },\n      { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },\n    )\n  }\n\n  async startProcessing(request: OnboardingRequest, startedAt: Date): Promise<boolean> {\n    const claimedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'pending' },\n      { status: 'processing', processingStartedAt: startedAt, updatedAt: new Date() },\n    )\n    if (claimedRows === 0) return false\n    request.status = 'processing'\n    request.processingStartedAt = startedAt\n    return true\n  }\n\n  async resetProcessing(request: OnboardingRequest): Promise<boolean> {\n    const revertedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'processing' },\n      { status: 'pending', processingStartedAt: null, updatedAt: new Date() },\n    )\n    if (revertedRows === 0) return false\n    request.status = 'pending'\n    request.processingStartedAt = null\n    return true\n  }\n\n  async updateProvisioningIds(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    await this.em.flush()\n  }\n\n  async markCompleted(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.status = 'completed'\n    request.completedAt = new Date()\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    request.processingStartedAt = null\n    request.passwordHash = null\n    await this.em.flush()\n  }\n\n  async markReadyEmailSent(request: OnboardingRequest, sentAt: Date) {\n    request.readyEmailSentAt = sentAt\n    await this.em.flush()\n  }\n\n  async markPreparationCompleted(request: OnboardingRequest, completedAt: Date) {\n    request.preparationCompletedAt = completedAt\n    await this.em.flush()\n  }\n}\n\nfunction hashToken(token: string) {\n  return createHash('sha256').update(token).digest('hex')\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa,kBAAkB;AACxC,SAAS,YAAY;AAErB,SAAS,yBAAyB;AAO3B,MAAM,kBAAkB;AAAA,EAC7B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,sBAAsB,OAA6B,UAAgC,CAAC,GAAG;AAC3F,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,GAAI;AACvE,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,eAAe,MAAM,KAAK,MAAM,UAAU,EAAE;AAElD,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,mBAAmB,EAAE,OAAO,MAAM,MAAM,CAAC;AAChF,QAAI,UAAU;AACZ,YAAM,aAAa,SAAS,mBAAmB,SAAS,aAAa,SAAS;AAC9E,UAAI,CAAC,WAAW,YAAY,EAAE,SAAS,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,KAAM;AAC3H,cAAM,cAAc,KAAK,KAAK,OAAQ,KAAK,IAAI,IAAI,WAAW,QAAQ;AACtE,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,KAAK,eAAe,KAAK,IAAK,CAAC;AACpE,cAAM,IAAI,MAAM,mBAAmB,WAAW,EAAE;AAAA,MAClD;AACA,eAAS,YAAY;AACrB,eAAS,SAAS;AAClB,eAAS,YAAY,MAAM;AAC3B,eAAS,WAAW,MAAM;AAC1B,eAAS,mBAAmB,MAAM;AAClC,eAAS,SAAS,MAAM,UAAU,SAAS,UAAU;AACrD,eAAS,gBAAgB;AACzB,eAAS,mBAAmB,MAAM,oBAAoB;AACtD,eAAS,eAAe;AACxB,eAAS,YAAY;AACrB,eAAS,cAAc;AACvB,eAAS,sBAAsB;AAC/B,eAAS,WAAW;AACpB,eAAS,iBAAiB;AAC1B,eAAS,SAAS;AAClB,eAAS,kBAAkB;AAC3B,eAAS,yBAAyB;AAClC,eAAS,mBAAmB;AAC5B,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,SAAS,UAAU,MAAM;AAAA,IACpC;AAEA,UAAM,UAAU,KAAK,GAAG,OAAO,mBAAmB;AAAA,MAChD,OAAO,MAAM;AAAA,MACb;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,QAAQ,MAAM,UAAU;AAAA,MACxB,eAAe;AAAA,MACf,kBAAkB,MAAM,oBAAoB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,mBAAmB,OAAe;AACtC,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,KAAK,GAAG,QAAQ,mBAAmB;AAAA,MACxC;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,EAAE,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,OAAe;AAC/B,UAAM,YAAY,UAAU,KAAK;AACjC,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,UAAU,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,GAAG,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,qBAAqB,UAAkB;AAC3C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA,EAAE,UAAU,WAAW,KAAK;AAAA,MAC5B,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAA4B,WAAmC;AACnF,UAAM,cAAc,MAAM,KAAK,GAAG;AAAA,MAChC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,UAAU;AAAA,MACpC,EAAE,QAAQ,cAAc,qBAAqB,WAAW,WAAW,oBAAI,KAAK,EAAE;AAAA,IAChF;AACA,QAAI,gBAAgB,EAAG,QAAO;AAC9B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAA8C;AAClE,UAAM,eAAe,MAAM,KAAK,GAAG;AAAA,MACjC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,aAAa;AAAA,MACvC,EAAE,QAAQ,WAAW,qBAAqB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,IACxE;AACA,QAAI,iBAAiB,EAAG,QAAO;AAC/B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,SAA4B,MAAoE;AAC1H,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,cAAc,SAA4B,MAAoE;AAClH,YAAQ,SAAS;AACjB,YAAQ,cAAc,oBAAI,KAAK;AAC/B,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,YAAQ,sBAAsB;AAC9B,YAAQ,eAAe;AACvB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,mBAAmB,SAA4B,QAAc;AACjE,YAAQ,mBAAmB;AAC3B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,yBAAyB,SAA4B,aAAmB;AAC5E,YAAQ,yBAAyB;AACjC,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,UAAU,OAAe;AAChC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.4-develop.4382.1.6b4f656b77",
+  "version": "0.6.4",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -69,10 +69,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.4-develop.4382.1.6b4f656b77"
+    "@open-mercato/shared": "0.6.4"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.4-develop.4382.1.6b4f656b77",
+    "@open-mercato/shared": "0.6.4",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"
@@ -84,6 +84,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/onboarding"
-  },
-  "stableVersion": "0.6.3"
+  }
 }

package/src/__tests__/consentClientIp.test.ts

@@ -0,0 +1,47 @@
+import { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'
+
+const getCachedRateLimiterService = jest.fn()
+
+jest.mock('@open-mercato/core/bootstrap', () => ({
+  getCachedRateLimiterService: () => getCachedRateLimiterService(),
+}))
+
+function makeRequest(headers: Record<string, string>): Request {
+  return new Request('http://localhost/onboarding/onboarding/verify', { headers })
+}
+
+describe('resolveConsentClientIp', () => {
+  beforeEach(() => {
+    getCachedRateLimiterService.mockReset()
+  })
+
+  it('ignores a spoofed X-Forwarded-For when no proxy is trusted (trustProxyDepth=0)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 0 })
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6' })
+    expect(resolveConsentClientIp(req)).toBeNull()
+  })
+
+  it('honors the configured trust depth instead of a hardcoded 1 (trustProxyDepth=2)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 2 })
+    const req = makeRequest({ 'x-forwarded-for': 'client, proxy2, proxy1' })
+    expect(resolveConsentClientIp(req)).toBe('proxy2')
+  })
+
+  it('records the trusted client IP for a single-proxy deployment (trustProxyDepth=1)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 1 })
+    const req = makeRequest({ 'x-forwarded-for': 'client, edge' })
+    expect(resolveConsentClientIp(req)).toBe('edge')
+  })
+
+  it('falls back to X-Real-IP when X-Forwarded-For is untrusted', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 0 })
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6', 'x-real-ip': '10.0.0.5' })
+    expect(resolveConsentClientIp(req)).toBe('10.0.0.5')
+  })
+
+  it('returns null when the rate limiter service is unavailable', () => {
+    getCachedRateLimiterService.mockReturnValue(null)
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6' })
+    expect(resolveConsentClientIp(req)).toBeNull()
+  })
+})

package/src/__tests__/ready-email.test.ts

@@ -0,0 +1,114 @@
+import { OnboardingRequest } from '../modules/onboarding/data/entities'
+
+const sendEmailMock = jest.fn().mockResolvedValue(undefined)
+const findByIdMock = jest.fn()
+const markReadyEmailSentMock = jest.fn().mockResolvedValue(undefined)
+const workspaceReadyEmailMock = jest.fn().mockReturnValue(null)
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn().mockResolvedValue({
+    resolve: () => ({}),
+  }),
+}))
+
+jest.mock('@open-mercato/shared/lib/email/send', () => ({
+  sendEmail: (...args: unknown[]) => sendEmailMock(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  loadDictionary: jest.fn().mockResolvedValue({}),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/translate', () => ({
+  createFallbackTranslator: () => (_key: string, fallback: string) => fallback,
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/service', () => ({
+  OnboardingService: jest.fn().mockImplementation(() => ({
+    findById: (...args: unknown[]) => findByIdMock(...args),
+    markReadyEmailSent: (...args: unknown[]) => markReadyEmailSentMock(...args),
+  })),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/emails/WorkspaceReadyEmail', () => ({
+  __esModule: true,
+  default: (props: { loginUrl: string }) => workspaceReadyEmailMock(props),
+}))
+
+import { sendWorkspaceReadyEmail } from '../modules/onboarding/lib/ready-email'
+
+function makeReadyRequest(overrides: Record<string, unknown> = {}) {
+  return Object.assign(new OnboardingRequest(), {
+    id: 'req-1',
+    email: 'owner@example.com',
+    status: 'completed',
+    firstName: 'Jane',
+    lastName: 'Doe',
+    organizationName: 'Acme Corp',
+    locale: 'en',
+    tenantId: 'tenant-uuid',
+    readyEmailSentAt: null,
+    ...overrides,
+  })
+}
+
+describe('sendWorkspaceReadyEmail', () => {
+  const originalEnv = { ...process.env }
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    process.env = { ...originalEnv }
+    delete process.env.NEXT_PUBLIC_APP_URL
+    delete process.env.APP_URL
+    delete process.env.APP_ALLOWED_ORIGINS
+    process.env.NODE_ENV = 'test'
+    findByIdMock.mockResolvedValue(makeReadyRequest())
+  })
+
+  afterAll(() => {
+    process.env = originalEnv
+  })
+
+  it('builds the login link from the configured APP_URL, not a request header', async () => {
+    process.env.APP_URL = 'https://app.openmercato.com'
+
+    const sent = await sendWorkspaceReadyEmail({ requestId: 'req-1', tenantId: 'tenant-uuid' })
+
+    expect(sent).toBe(true)
+    expect(workspaceReadyEmailMock).toHaveBeenCalledTimes(1)
+    const props = workspaceReadyEmailMock.mock.calls[0][0]
+    expect(props.loginUrl).toBe('https://app.openmercato.com/login?tenant=tenant-uuid')
+    expect(props.loginUrl).not.toContain('evil.com')
+    expect(sendEmailMock).toHaveBeenCalledTimes(1)
+    expect(markReadyEmailSentMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('falls back to the dev origin outside production when APP_URL is unset', async () => {
+    const sent = await sendWorkspaceReadyEmail({ requestId: 'req-1', tenantId: 'tenant-uuid' })
+
+    expect(sent).toBe(true)
+    const props = workspaceReadyEmailMock.mock.calls[0][0]
+    expect(props.loginUrl).toBe('http://localhost:3000/login?tenant=tenant-uuid')
+  })
+
+  it('throws in production when APP_URL is not configured instead of trusting a host', async () => {
+    process.env.NODE_ENV = 'production'
+
+    await expect(
+      sendWorkspaceReadyEmail({ requestId: 'req-1', tenantId: 'tenant-uuid' }),
+    ).rejects.toThrow(/APP_URL/)
+
+    expect(sendEmailMock).not.toHaveBeenCalled()
+    expect(markReadyEmailSentMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when the request is missing or already notified', async () => {
+    findByIdMock.mockResolvedValueOnce(null)
+    expect(await sendWorkspaceReadyEmail({ requestId: 'req-1', tenantId: 'tenant-uuid' })).toBe(false)
+
+    findByIdMock.mockResolvedValueOnce(makeReadyRequest({ readyEmailSentAt: new Date() }))
+    expect(await sendWorkspaceReadyEmail({ requestId: 'req-1', tenantId: 'tenant-uuid' })).toBe(false)
+
+    expect(sendEmailMock).not.toHaveBeenCalled()
+  })
+})

package/src/__tests__/service.test.ts

@@ -75,6 +75,38 @@ function createMockEm(overrides: Record<string, unknown> = {}): MockEm {
   } as unknown as MockEm
 }
 
+type DbRow = { id: string; status: string; processingStartedAt: Date | null }
+
+// EntityManager mock backed by a single persisted row. `nativeUpdate` honours the
+// status guard in its WHERE clause (so it returns 0 when the row has already moved
+// on), while `flush` writes the tracked managed entity's scalars back to the row —
+// reproducing MikroORM's last-write-wins behaviour for the unconditional code path.
+function createRowBackedEm(dbRow: DbRow, trackedEntity?: OnboardingRequest): EntityManager {
+  const flush = jest.fn(async () => {
+    if (!trackedEntity) return
+    dbRow.status = trackedEntity.status
+    dbRow.processingStartedAt = trackedEntity.processingStartedAt ?? null
+  })
+  const nativeUpdate = jest.fn(
+    async (_entity: unknown, where: Record<string, unknown>, data: Record<string, unknown>) => {
+      const matches = Object.entries(where).every(
+        ([key, value]) => (dbRow as unknown as Record<string, unknown>)[key] === value,
+      )
+      if (!matches) return 0
+      if ('status' in data) dbRow.status = data.status as string
+      if ('processingStartedAt' in data) dbRow.processingStartedAt = (data.processingStartedAt as Date | null) ?? null
+      return 1
+    },
+  )
+  return {
+    findOne: jest.fn().mockResolvedValue(null),
+    create: jest.fn(),
+    persist: jest.fn(() => ({ flush })),
+    flush,
+    nativeUpdate,
+  } as unknown as EntityManager
+}
+
 describe('OnboardingService', () => {
   describe('createOrUpdateRequest', () => {
     it('creates a new pending request when no existing email found', async () => {
@@ -126,4 +158,54 @@ describe('OnboardingService', () => {
       expect(em.flush).toHaveBeenCalled()
     })
   })
+
+  // Regression coverage for #2742: two concurrent verify requests carrying the same
+  // token must not corrupt the persisted state. The fix makes the pending→processing
+  // transition an atomic claim and the processing→pending reset conditional, so a
+  // request that lost the race can never clobber a sibling that already completed.
+  describe('startProcessing (atomic claim, #2742)', () => {
+    it('lets only one concurrent caller claim a pending request', async () => {
+      const dbRow: DbRow = { id: 'req-1', status: 'pending', processingStartedAt: null }
+      const em = createRowBackedEm(dbRow)
+      const service = new OnboardingService(em)
+      const requestA = makeRequest({ id: 'req-1', status: 'pending', processingStartedAt: null })
+      const requestB = makeRequest({ id: 'req-1', status: 'pending', processingStartedAt: null })
+
+      const claimedA = await service.startProcessing(requestA, new Date())
+      const claimedB = await service.startProcessing(requestB, new Date())
+
+      expect(claimedA).toBe(true)
+      expect(claimedB).toBe(false)
+      expect(dbRow.status).toBe('processing')
+    })
+  })
+
+  describe('resetProcessing (conditional revert, #2742)', () => {
+    it('does not revert a request a concurrent worker already completed', async () => {
+      // A sibling worker already advanced the persisted row to 'completed'.
+      const dbRow: DbRow = { id: 'req-1', status: 'completed', processingStartedAt: null }
+      // This worker still holds an in-memory copy it believes is 'processing'.
+      const staleRequest = makeRequest({ id: 'req-1', status: 'processing', processingStartedAt: new Date() })
+      const em = createRowBackedEm(dbRow, staleRequest)
+      const service = new OnboardingService(em)
+
+      const reverted = await service.resetProcessing(staleRequest)
+
+      expect(reverted).toBe(false)
+      expect(dbRow.status).toBe('completed')
+    })
+
+    it('reverts a request that is still processing', async () => {
+      const dbRow: DbRow = { id: 'req-1', status: 'processing', processingStartedAt: new Date() }
+      const request = makeRequest({ id: 'req-1', status: 'processing', processingStartedAt: new Date() })
+      const em = createRowBackedEm(dbRow, request)
+      const service = new OnboardingService(em)
+
+      const reverted = await service.resetProcessing(request)
+
+      expect(reverted).toBe(true)
+      expect(dbRow.status).toBe('pending')
+      expect(dbRow.processingStartedAt).toBeNull()
+    })
+  })
 })

package/src/__tests__/status-endpoint-auth.test.ts

@@ -0,0 +1,111 @@
+import { OnboardingRequest } from '../modules/onboarding/data/entities'
+
+const findLatestByTenantId = jest.fn()
+const sendWorkspaceReadyEmail = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(async () => ({
+    resolve: (name: string) => {
+      if (name === 'em') return {}
+      throw new Error(`unexpected resolve(${name})`)
+    },
+  })),
+}))
+
+jest.mock('@open-mercato/shared/lib/url', () => ({
+  getSecurityEmailBaseUrl: () => 'https://app.example.com',
+  mapSecurityEmailUrlError: () => null,
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/service', () => ({
+  OnboardingService: jest.fn().mockImplementation(() => ({
+    findLatestByTenantId,
+  })),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/ready-email', () => ({
+  sendWorkspaceReadyEmail,
+}))
+
+import { GET } from '../modules/onboarding/api/get/onboarding/status'
+
+const TENANT_ID = '11111111-1111-4111-8111-111111111111'
+const OTHER_TENANT_ID = '22222222-2222-4222-8222-222222222222'
+
+function makeRequest(overrides: Record<string, unknown> = {}) {
+  return Object.assign(new OnboardingRequest(), {
+    id: 'req-1',
+    status: 'completed',
+    tenantId: TENANT_ID,
+    organizationId: 'org-1',
+    preparationCompletedAt: new Date(),
+    readyEmailSentAt: new Date(),
+    ...overrides,
+  })
+}
+
+function buildRequest(args: { tenantId: string; cookie?: string }) {
+  const headers = new Headers()
+  if (args.cookie !== undefined) headers.set('cookie', args.cookie)
+  return new Request(`https://app.example.com/api/onboarding/onboarding/status?tenantId=${args.tenantId}`, {
+    headers,
+  })
+}
+
+describe('onboarding status endpoint authorization', () => {
+  beforeEach(() => {
+    findLatestByTenantId.mockReset()
+    sendWorkspaceReadyEmail.mockReset()
+    findLatestByTenantId.mockResolvedValue(makeRequest())
+  })
+
+  it('returns 403 and does not look up tenant state when no om_login_tenant cookie is present', async () => {
+    const res = await GET(buildRequest({ tenantId: TENANT_ID }))
+    expect(res.status).toBe(403)
+    const body = await res.json()
+    expect(body).toEqual({ ok: false, error: 'Not authorized for this tenant.' })
+    expect(findLatestByTenantId).not.toHaveBeenCalled()
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the om_login_tenant cookie is for a different tenant', async () => {
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${OTHER_TENANT_ID}` }),
+    )
+    expect(res.status).toBe(403)
+    expect(findLatestByTenantId).not.toHaveBeenCalled()
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('does not trigger the ready email side effect for an unauthorized caller', async () => {
+    findLatestByTenantId.mockResolvedValue(
+      makeRequest({ readyEmailSentAt: null }),
+    )
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${OTHER_TENANT_ID}` }),
+    )
+    expect(res.status).toBe(403)
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('returns the status when the om_login_tenant cookie matches the requested tenant', async () => {
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `other=foo; om_login_tenant=${TENANT_ID}` }),
+    )
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.ok).toBe(true)
+    expect(body.tenantId).toBe(TENANT_ID)
+    expect(body.ready).toBe(true)
+    expect(body.loginUrl).toBe(`https://app.example.com/login?tenant=${TENANT_ID}`)
+    expect(findLatestByTenantId).toHaveBeenCalledWith(TENANT_ID)
+  })
+
+  it('returns 404 for an authorized caller when no onboarding record exists', async () => {
+    findLatestByTenantId.mockResolvedValue(null)
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${TENANT_ID}` }),
+    )
+    expect(res.status).toBe(404)
+  })
+})

package/src/modules/onboarding/api/get/onboarding/status.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { getAppBaseUrl } from '@open-mercato/shared/lib/url'
+import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'
 import { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'
 import { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -14,10 +14,30 @@ export const metadata = {
   },
 }
 
+const ONBOARDING_LOGIN_TENANT_COOKIE = 'om_login_tenant'
+
 const onboardingStatusQuerySchema = z.object({
   tenantId: z.string().uuid(),
 })
 
+function readCookie(req: Request, name: string): string | null {
+  const header = req.headers.get('cookie')
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const separatorIndex = part.indexOf('=')
+    if (separatorIndex === -1) continue
+    const key = part.slice(0, separatorIndex).trim()
+    if (key !== name) continue
+    const rawValue = part.slice(separatorIndex + 1).trim()
+    try {
+      return decodeURIComponent(rawValue)
+    } catch {
+      return rawValue
+    }
+  }
+  return null
+}
+
 export async function GET(req: Request) {
   const url = new URL(req.url)
   const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''
@@ -26,7 +46,22 @@ export async function GET(req: Request) {
     return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })
   }
 
-  const baseUrl = getAppBaseUrl(req)
+  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE)
+  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {
+    return NextResponse.json({ ok: false, error: 'Not authorized for this tenant.' }, { status: 403 })
+  }
+
+  let baseUrl: string
+  try {
+    baseUrl = getSecurityEmailBaseUrl(req)
+  } catch (error) {
+    const mapped = mapSecurityEmailUrlError(error, {
+      scope: 'onboarding.status',
+      configMessage: 'Onboarding status is not configured.',
+    })
+    if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })
+    throw error
+  }
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   const service = new OnboardingService(em)
@@ -43,7 +78,6 @@ export async function GET(req: Request) {
     try {
       emailSent = await sendWorkspaceReadyEmail({
         requestId: request.id,
-        baseUrl,
         tenantId: request.tenantId,
       })
     } catch (error) {
@@ -91,8 +125,10 @@ const onboardingStatusDoc: OpenApiMethodDoc = {
     { status: 200, description: 'Onboarding status resolved.', schema: onboardingStatusSuccessSchema },
   ],
   errors: [
-    { status: 400, description: 'Invalid tenant id.', schema: onboardingStatusErrorSchema },
+    { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },
+    { status: 403, description: 'Caller is not authorized for this tenant.', schema: onboardingStatusErrorSchema },
     { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },
+    { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },
   ],
 }
 

package/src/modules/onboarding/api/get/onboarding/verify.ts

@@ -3,14 +3,18 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { SearchIndexer } from '@open-mercato/search'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { getAppBaseUrl } from '@open-mercato/shared/lib/url'
+import {
+  AppOriginConfigurationError,
+  AppOriginRejectedError,
+  getSecurityEmailBaseUrl,
+} from '@open-mercato/shared/lib/url'
 import { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'
 import { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'
 import { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'
 import { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'
 import { UserConsent } from '@open-mercato/core/modules/auth/data/entities'
 import { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'
-import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'
 import { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'
 import { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'
 import { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'
@@ -26,6 +30,21 @@ export const metadata = {
   },
 }
 
+function resolveTrustedBaseUrl(req: Request): string {
+  try {
+    return getSecurityEmailBaseUrl(req)
+  } catch (error) {
+    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {
+      console.error('[onboarding.verify] rejected request origin for redirect base', {
+        requestUrl: req.url,
+        reason: error.message,
+      })
+      return new URL(req.url).origin
+    }
+    throw error
+  }
+}
+
 function clearAuthCookies(response: NextResponse) {
   response.cookies.set('auth_token', '', { path: '/', maxAge: 0 })
   response.cookies.set('session_token', '', { path: '/', maxAge: 0 })
@@ -218,7 +237,6 @@ async function rebuildTenantQueryIndexes(args: {
 
 async function runDeferredProvisioning(args: {
   requestId: string
-  baseUrl: string
   tenantId: string
   organizationId: string
 }) {
@@ -256,7 +274,6 @@ async function runDeferredProvisioning(args: {
 
   await sendWorkspaceReadyEmail({
     requestId: args.requestId,
-    baseUrl: args.baseUrl,
     tenantId: args.tenantId,
   }).catch((error) => {
     console.error('[onboarding.verify] ready email failed', {
@@ -289,7 +306,7 @@ async function runDeferredProvisioning(args: {
 
 export async function GET(req: Request) {
   const url = new URL(req.url)
-  const baseUrl = getAppBaseUrl(req)
+  const baseUrl = resolveTrustedBaseUrl(req)
   const token = url.searchParams.get('token') ?? ''
   const parsed = onboardingVerifySchema.safeParse({ token })
   if (!parsed.success) {
@@ -314,7 +331,6 @@ export async function GET(req: Request) {
       after(async () => {
         await sendWorkspaceReadyEmail({
           requestId: request.id,
-          baseUrl,
           tenantId: request.tenantId!,
         }).catch((error) => {
           console.error('[onboarding.verify] retry ready email failed', {
@@ -340,7 +356,20 @@ export async function GET(req: Request) {
   if (request.status !== 'pending') {
     return redirectWithStatus(baseUrl, 'invalid')
   }
-  await service.startProcessing(request, new Date())
+  const claimed = await service.startProcessing(request, new Date())
+  if (!claimed) {
+    // A concurrent verify request already claimed this token (pending → processing).
+    // Re-read on a fresh fork — the request EM's identity map still holds the stale
+    // pre-claim copy — and route off the winner's committed state instead of re-running
+    // provisioning, which would throw USER_EXISTS and could strand the request (#2742).
+    const current = await new OnboardingService(em.fork()).findById(request.id)
+    if (current?.status === 'completed' && current.tenantId) {
+      return current.preparationCompletedAt
+        ? redirectToLogin(baseUrl, current.tenantId)
+        : redirectToPreparing(baseUrl, current.tenantId)
+    }
+    return redirectToPreparing(baseUrl, current?.tenantId ?? request.tenantId ?? null)
+  }
   if (!request.passwordHash) {
     console.error('[onboarding.verify] missing password hash for request', request.id)
     await service.resetProcessing(request)
@@ -387,7 +416,7 @@ export async function GET(req: Request) {
 
     if (request.marketingConsent) {
       const now = new Date()
-      const clientIp = getClientIp(req, 1) ?? null
+      const clientIp = resolveConsentClientIp(req)
       const integrityHash = computeConsentIntegrityHash({
         userId: resolvedUserId,
         consentType: 'marketing_email',
@@ -444,7 +473,6 @@ export async function GET(req: Request) {
     after(async () => {
       await runDeferredProvisioning({
         requestId: request.id,
-        baseUrl,
         tenantId: resolvedTenantId,
         organizationId: resolvedOrganizationId,
       })

package/src/modules/onboarding/api/post/onboarding.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { getAppBaseUrl } from '@open-mercato/shared/lib/url'
+import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'
 import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
 import { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'
 import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'
@@ -125,7 +125,17 @@ export async function POST(req: Request) {
       throw err
     }
 
-    const baseUrl = getAppBaseUrl(req)
+    let baseUrl: string
+    try {
+      baseUrl = getSecurityEmailBaseUrl(req)
+    } catch (error) {
+      const mapped = mapSecurityEmailUrlError(error, {
+        scope: 'onboarding.start',
+        configMessage: 'Self-service onboarding is not configured.',
+      })
+      if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })
+      throw error
+    }
     const verifyUrl = `${baseUrl}/api/onboarding/onboarding/verify?token=${token}`
 
     const firstName = request.firstName || parsed.data.firstName