@open-mercato/onboarding 0.6.5-develop.5337.1.534b781eac → 0.6.5

package/src/modules/onboarding/api/get/onboarding/verify.ts

@@ -1,14 +1,9 @@
-import { after } from 'next/server'
+import { after, NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import type { SearchIndexer } from '@open-mercato/search'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import {
-  AppOriginConfigurationError,
-  AppOriginRejectedError,
-  getSecurityEmailBaseUrl,
-} from '@open-mercato/shared/lib/url'
 import { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'
+import type { OnboardingRequest } from '@open-mercato/onboarding/modules/onboarding/data/entities'
 import { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'
 import { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'
 import {
@@ -16,16 +11,18 @@ import {
   redirectToPreparing,
   redirectWithStatus,
 } from '@open-mercato/onboarding/modules/onboarding/lib/verify-redirects'
+import { resolveVerifyRedirectBaseUrl } from '@open-mercato/onboarding/modules/onboarding/lib/verify-base-url'
+import {
+  resolveProvisioningIds,
+  runDeferredProvisioning,
+} from '@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning'
 import { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'
 import { UserConsent } from '@open-mercato/core/modules/auth/data/entities'
 import { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'
 import { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'
-import { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'
-import { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'
-import { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'
-import { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'
-import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { runBestEffortProvisioningStep } from '@open-mercato/onboarding/modules/onboarding/lib/provisioning'
 import { getModules } from '@open-mercato/shared/lib/modules/registry'
+import { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
 export const metadata = {
@@ -35,24 +32,7 @@ export const metadata = {
   },
 }
 
-function resolveTrustedBaseUrl(req: Request): string {
-  try {
-    return getSecurityEmailBaseUrl(req)
-  } catch (error) {
-    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {
-      console.error('[onboarding.verify] rejected request origin for redirect base', {
-        requestUrl: req.url,
-        reason: error.message,
-      })
-      return new URL(req.url).origin
-    }
-    throw error
-  }
-}
-
-const VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000
 const SEED_DEFAULTS_TIMEOUT_MS = 15_000
-const SEED_EXAMPLES_TIMEOUT_MS = 15_000
 
 function createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {
   return new Promise((_, reject) => {
@@ -83,191 +63,59 @@ async function runModuleSetupHook(args: {
       durationMs: Math.max(0, Date.now() - startedAt),
     })
   } catch (error) {
-    console.error('[onboarding.verify] module hook failed', {
-      moduleId: args.moduleId,
-      phase: args.phase,
-      durationMs: Math.max(0, Date.now() - startedAt),
-      timeoutMs: args.timeoutMs,
-      error,
-    })
-    throw error
-  }
-}
-
-async function markWorkspaceReady(args: {
-  requestId: string
-}) {
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const service = new OnboardingService(em)
-  const request = await service.findById(args.requestId)
-  if (!request || request.preparationCompletedAt) return
-  await service.markPreparationCompleted(request, new Date())
-}
-
-async function enqueueVectorReindex(args: {
-  container: { resolve: <T = unknown>(name: string) => T }
-  tenantId: string
-  organizationId: string
-}) {
-  let searchIndexer: SearchIndexer | null = null
-  try {
-    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')
-  } catch {
-    searchIndexer = null
-  }
-  if (!searchIndexer) return
-
-  await Promise.race([
-    searchIndexer.reindexAllToVector({
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      purgeFirst: true,
-      useQueue: true,
-    }),
-    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),
-  ])
-}
-
-async function rebuildTenantQueryIndexes(args: {
-  em: EntityManager
-  tenantId: string
-  organizationId: string
-}) {
-  const coverageRefreshKeys = new Set<string>()
-  try {
-    const allEntities = getEntityIds()
-    const entityIds = flattenSystemEntityIds(allEntities)
-    for (const entityType of entityIds) {
-      try {
-        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })
-      } catch (error) {
-        console.error('[onboarding.verify] failed to purge query index scope', {
-          entityType,
-          tenantId: args.tenantId,
-          error,
-        })
-      }
-      try {
-        await reindexEntity(args.em, {
-          entityType,
-          tenantId: args.tenantId,
-          force: true,
-          emitVectorizeEvents: false,
-          vectorService: null,
-        })
-      } catch (error) {
-        console.error('[onboarding.verify] failed to reindex entity', {
-          entityType,
-          tenantId: args.tenantId,
-          error,
-        })
-      }
-      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)
-      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)
-    }
-  } catch (error) {
-    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })
-  }
-
-  if (!coverageRefreshKeys.size) return
-
-  for (const entry of coverageRefreshKeys) {
-    const [entityType, tenantKey, orgKey] = entry.split('|')
-    const orgScope = orgKey === '__null__' ? null : orgKey
-    try {
-      await refreshCoverageSnapshot(
-        args.em,
-        {
-          entityType,
-          tenantId: tenantKey,
-          organizationId: orgScope,
-          withDeleted: false,
-        },
-      )
-    } catch (error) {
-      console.error('[onboarding.verify] failed to refresh coverage snapshot', {
-        entityType,
-        tenantId: tenantKey,
-        organizationId: orgScope,
+    if (isUniqueViolation(error)) {
+      // A concurrent verify (or a re-verify after the request was already
+      // provisioned) re-runs seedDefaults against rows that exist. seed hooks
+      // are not fully idempotent, so the collision is expected and harmless —
+      // the workspace already exists. Log at info so real failures stand out.
+      console.info('[onboarding.verify] module hook skipped (already seeded)', {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt),
+      })
+    } else {
+      console.error('[onboarding.verify] module hook failed', {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt),
+        timeoutMs: args.timeoutMs,
         error,
       })
     }
+    throw error
   }
 }
 
-async function runDeferredProvisioning(args: {
-  requestId: string
-  tenantId: string
-  organizationId: string
+async function completeProvisionedRequest(args: {
+  service: OnboardingService
+  request: OnboardingRequest
 }) {
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const modules = getModules()
-
-  for (const mod of modules) {
-    if (!mod.setup?.seedExamples) continue
-    try {
-      await runModuleSetupHook({
-        moduleId: mod.id,
-        phase: 'seedExamples',
-        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,
-        run: () => mod.setup!.seedExamples!({
-          em,
-          tenantId: args.tenantId,
-          organizationId: args.organizationId,
-          container,
-        }),
-      })
-    } catch (error) {
-      console.error('[onboarding.verify] deferred seedExamples failed', {
-        moduleId: mod.id,
-        tenantId: args.tenantId,
-        organizationId: args.organizationId,
-        error,
-      })
-    }
-  }
-
-  await markWorkspaceReady({
-    requestId: args.requestId,
-  })
-
-  await sendWorkspaceReadyEmail({
-    requestId: args.requestId,
-    tenantId: args.tenantId,
-  }).catch((error) => {
-    console.error('[onboarding.verify] ready email failed', {
-      requestId: args.requestId,
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      error,
-    })
-    throw error
-  })
-
-  await rebuildTenantQueryIndexes({
-    em,
-    tenantId: args.tenantId,
-    organizationId: args.organizationId,
-  })
-
-  await enqueueVectorReindex({
-    container,
-    tenantId: args.tenantId,
-    organizationId: args.organizationId,
-  }).catch((error) => {
-    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      reason: error instanceof Error ? error.message : String(error),
+  const ids = resolveProvisioningIds(args.request)
+  if (!ids) return null
+  await args.service.markCompleted(args.request, ids)
+  after(async () => {
+    await runDeferredProvisioning({
+      requestId: args.request.id,
+      tenantId: ids.tenantId,
+      organizationId: ids.organizationId,
     })
   })
+  return ids
 }
 
 export async function GET(req: Request) {
   const url = new URL(req.url)
-  const baseUrl = resolveTrustedBaseUrl(req)
+  const baseUrlResult = resolveVerifyRedirectBaseUrl(req)
+  if (!baseUrlResult.ok) {
+    if (baseUrlResult.redirectOrigin) {
+      return redirectWithStatus(baseUrlResult.redirectOrigin, baseUrlResult.status)
+    }
+    return NextResponse.json(
+      { ok: false, error: baseUrlResult.message },
+      { status: baseUrlResult.httpStatus },
+    )
+  }
+  const baseUrl = baseUrlResult.baseUrl
   const token = url.searchParams.get('token') ?? ''
   const parsed = onboardingVerifySchema.safeParse({ token })
   if (!parsed.success) {
@@ -309,9 +157,13 @@ export async function GET(req: Request) {
   const processingStartedAt = request.processingStartedAt?.getTime() ?? 0
   const processingFresh = request.status === 'processing' && processingStartedAt > Date.now() - lockWindowMs
   if (processingFresh) {
+    const recovered = await completeProvisionedRequest({ service, request })
+    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)
     return redirectToPreparing(baseUrl, request.tenantId ?? null)
   }
   if (request.status === 'processing' && !processingFresh) {
+    const recovered = await completeProvisionedRequest({ service, request })
+    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)
     await service.resetProcessing(request)
   }
   if (request.status !== 'pending') {
@@ -323,12 +175,17 @@ export async function GET(req: Request) {
     // Re-read on a fresh fork — the request EM's identity map still holds the stale
     // pre-claim copy — and route off the winner's committed state instead of re-running
     // provisioning, which would throw USER_EXISTS and could strand the request (#2742).
-    const current = await new OnboardingService(em.fork()).findById(request.id)
+    const currentService = new OnboardingService(em.fork())
+    const current = await currentService.findById(request.id)
     if (current?.status === 'completed' && current.tenantId) {
       return current.preparationCompletedAt
         ? redirectToLogin(baseUrl, current.tenantId)
         : redirectToPreparing(baseUrl, current.tenantId)
     }
+    if (current?.status === 'processing') {
+      const recovered = await completeProvisionedRequest({ service: currentService, request: current })
+      if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)
+    }
     return redirectToPreparing(baseUrl, current?.tenantId ?? request.tenantId ?? null)
   }
   if (!request.passwordHash) {
@@ -386,43 +243,55 @@ export async function GET(req: Request) {
         ipAddress: clientIp,
         source: 'onboarding',
       })
-      // Wrap the request-em consent write in a transaction so it commits
-      // all-or-nothing. setupInitialTenant already manages its own internal
-      // transactions, and the seedDefaults hooks below resolve container
-      // services that fork their own EM (and may enqueue work), so neither can
-      // join this transaction — only the direct request-em writes are wrapped.
-      await em.transactional(async (txEm) => {
-        txEm.create(UserConsent, {
-          userId: resolvedUserId,
-          tenantId: resolvedTenantId,
-          organizationId: resolvedOrganizationId,
-          consentType: 'marketing_email',
-          isGranted: true,
-          grantedAt: now,
-          source: 'onboarding',
-          ipAddress: clientIp,
-          integrityHash,
-          createdAt: now,
-        })
-      })
+      // Persist the marketing consent on an isolated EM fork wrapped in a
+      // transaction so it commits all-or-nothing AND a failure here can neither
+      // abort provisioning nor poison the request EM's unit of work before
+      // markCompleted runs. Recording the consent is best-effort: the workspace
+      // is already provisioned, and a lost consent record fails safe (treated as
+      // not granted) and is logged for follow-up rather than stranding the user.
+      await runBestEffortProvisioningStep('marketing-consent', () =>
+        em.fork().transactional(async (txEm) => {
+          txEm.create(UserConsent, {
+            userId: resolvedUserId,
+            tenantId: resolvedTenantId,
+            organizationId: resolvedOrganizationId,
+            consentType: 'marketing_email',
+            isGranted: true,
+            grantedAt: now,
+            source: 'onboarding',
+            ipAddress: clientIp,
+            integrityHash,
+            createdAt: now,
+          })
+        }),
+      )
     }
 
-    // Call module seedDefaults + seedExamples hooks
+    // Call module seedDefaults hooks. Each hook is best-effort and runs on its
+    // own isolated EM fork: a single module's throw or 15s timeout must not
+    // strand the freshly provisioned workspace — the tenant/org/user already
+    // exist and the request must still reach markCompleted so the user can sign
+    // in. A per-module fork also keeps a failed module's unflushed unit of work
+    // from leaking into (or aborting) the next module's flush. Failures are
+    // logged for follow-up (deferred seedExamples is already non-fatal in the
+    // same way).
     const modules = getModules()
     for (const mod of modules) {
-      if (mod.setup?.seedDefaults) {
-        await runModuleSetupHook({
+      if (!mod.setup?.seedDefaults) continue
+      const seedEm = em.fork()
+      await runBestEffortProvisioningStep(`seedDefaults:${mod.id}`, () =>
+        runModuleSetupHook({
           moduleId: mod.id,
           phase: 'seedDefaults',
           timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,
           run: () => mod.setup!.seedDefaults!({
-            em,
+            em: seedEm,
             tenantId: resolvedTenantId,
             organizationId: resolvedOrganizationId,
             container,
           }),
-        })
-      }
+        }),
+      )
     }
     await service.markCompleted(request, {
       tenantId: resolvedTenantId,

package/src/modules/onboarding/api/post/onboarding.ts

@@ -15,11 +15,19 @@ import { User } from '@open-mercato/core/modules/auth/data/entities'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
+import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 
 export const metadata = {
   path: '/onboarding/onboarding',
   POST: {
     requireAuth: false,
+    rateLimit: readEndpointRateLimitConfig('ONBOARDING', {
+      points: 10,
+      duration: 60,
+      blockDuration: 60,
+      keyPrefix: 'onboarding',
+    }),
   },
 }
 
@@ -242,6 +250,7 @@ const onboardingPostDoc: OpenApiMethodDoc = {
     { status: 400, description: 'Validation failed', schema: onboardingErrorSchema },
     { status: 404, description: 'Self-service onboarding disabled', schema: onboardingErrorSchema },
     { status: 409, description: 'Existing account or pending request', schema: onboardingErrorSchema },
+    { status: 429, description: 'Too many onboarding submissions from this IP', schema: rateLimitErrorSchema },
     { status: 500, description: 'Unexpected server error', schema: onboardingErrorSchema },
   ],
 }

package/src/modules/onboarding/data/entities.ts

@@ -60,6 +60,9 @@ export class OnboardingRequest {
   @Property({ name: 'last_email_sent_at', type: Date, nullable: true })
   lastEmailSentAt?: Date | null
 
+  @Property({ name: 'preparation_started_at', type: Date, nullable: true })
+  preparationStartedAt?: Date | null
+
   @Property({ name: 'preparation_completed_at', type: Date, nullable: true })
   preparationCompletedAt?: Date | null
 

package/src/modules/onboarding/frontend/onboarding/OnboardingPageClient.tsx

@@ -3,6 +3,7 @@
 import Image from 'next/image'
 import Link from 'next/link'
 import { useState } from 'react'
+import { useSearchParams } from 'next/navigation'
 import { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'
 import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
 import { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'
@@ -31,6 +32,7 @@ export default function OnboardingPageClient({ onboardingEnabled }: Props) {
   const translate = (key: string, fallback: string, params?: Record<string, string | number>) =>
     translateWithFallback(t, key, fallback, params)
   const locale = useLocale()
+  const searchParams = useSearchParams()
   const [state, setState] = useState<SubmissionState>('idle')
   const [globalError, setGlobalError] = useState<string | null>(null)
   const [fieldErrors, setFieldErrors] = useState<FieldErrors>({})
@@ -152,6 +154,34 @@ export default function OnboardingPageClient({ onboardingEnabled }: Props) {
   const onboardingDisabled = !onboardingEnabled
   const submitting = state === 'loading'
   const disabled = onboardingDisabled || submitting || state === 'success'
+  const verifyStatusMessages: Record<string, string> = {
+    redirect_misconfigured: translate(
+      'onboarding.verifyStatus.redirectMisconfigured',
+      'The verification link cannot redirect safely because APP_URL does not match the URL that handled the request. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.',
+    ),
+    origin_not_allowed: translate(
+      'onboarding.verifyStatus.originNotAllowed',
+      'The verification link was opened from an origin that is not allowed. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.',
+    ),
+    url_not_configured: translate(
+      'onboarding.verifyStatus.urlNotConfigured',
+      'Onboarding verification is not configured. APP_URL must be set before verification links can be used.',
+    ),
+    already_exists: translate(
+      'onboarding.verifyStatus.alreadyExists',
+      'We already have an account with this email. Try signing in or resetting your password.',
+    ),
+    invalid: translate(
+      'onboarding.verifyStatus.invalid',
+      'The verification link is invalid or expired. Submit the onboarding form again to receive a new link.',
+    ),
+    error: translate(
+      'onboarding.verifyStatus.error',
+      'We could not complete verification. Please try again or contact support.',
+    ),
+  }
+  const verifyStatus = searchParams.get('status') ?? ''
+  const verifyStatusError = verifyStatusMessages[verifyStatus] ?? null
 
   return (
     <div className="relative flex min-h-svh items-center justify-center bg-muted/50 px-4 pb-24">
@@ -204,9 +234,9 @@ export default function OnboardingPageClient({ onboardingEnabled }: Props) {
               </p>
             </div>
           )}
-          {state !== 'success' && globalError && (
+          {state !== 'success' && (globalError || verifyStatusError) && (
             <div className="mb-4 rounded-md border border-red-200 bg-red-50 px-4 py-3 text-sm text-red-700" role="alert" aria-live="assertive">
-              {globalError}
+              {globalError || verifyStatusError}
             </div>
           )}
           <form className="grid gap-4" onSubmit={onSubmit} noValidate>

package/src/modules/onboarding/frontend/onboarding/preparing/PreparingPageClient.tsx

@@ -20,6 +20,7 @@ export default function PreparingPageClient() {
   const tenantId = (searchParams.get('tenant') || '').trim()
   const [tenantName, setTenantName] = useState<string | null>(null)
   const [redirecting, setRedirecting] = useState(false)
+  const [statusError, setStatusError] = useState<string | null>(null)
 
   useEffect(() => {
     if (!tenantId) {
@@ -47,15 +48,36 @@ export default function PreparingPageClient() {
     if (!tenantId) return
     let active = true
     let timeoutId: ReturnType<typeof setTimeout> | null = null
+    const genericStatusError = translate(
+      'onboarding.preparing.statusErrorBody',
+      'We could not check the workspace status. The workspace may still be preparing; this page will keep retrying.',
+    )
+    function schedulePoll() {
+      if (!active) return
+      timeoutId = setTimeout(() => {
+        void poll()
+      }, 3000)
+    }
 
-    const poll = async () => {
+    async function poll() {
       try {
         const { result } = await apiCall<{
           ok?: boolean
           ready?: boolean
           loginUrl?: string | null
+          error?: string
         }>(`/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(tenantId)}`)
-        if (!active || !result?.ok) return
+        if (!active) return
+        if (!result?.ok) {
+          setStatusError(
+            typeof result?.error === 'string' && result.error.trim()
+              ? result.error
+              : genericStatusError,
+          )
+          schedulePoll()
+          return
+        }
+        setStatusError(null)
         if (result.ready && result.loginUrl) {
           setRedirecting(true)
           router.replace(result.loginUrl)
@@ -63,11 +85,9 @@ export default function PreparingPageClient() {
         }
       } catch {
         if (!active) return
+        setStatusError(genericStatusError)
       }
-      if (!active) return
-      timeoutId = setTimeout(() => {
-        void poll()
-      }, 3000)
+      schedulePoll()
     }
 
     void poll()
@@ -116,6 +136,18 @@ export default function PreparingPageClient() {
                   'You do not need to keep this page open. We will email you when everything is ready.',
                 )}
           </div>
+          {statusError ? (
+            <div
+              className="rounded-md border border-red-200 bg-red-50 px-4 py-3 text-left text-sm text-red-700"
+              role="alert"
+              aria-live="assertive"
+            >
+              <strong className="block text-sm font-medium">
+                {translate('onboarding.preparing.statusErrorTitle', 'Workspace status check failed')}
+              </strong>
+              <p className="mt-1">{statusError}</p>
+            </div>
+          ) : null}
           <div className="flex flex-col items-center justify-center gap-3 sm:flex-row">
             <Button asChild>
               <Link href="/">

package/src/modules/onboarding/i18n/de.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "Wir schließen die Vorbereitung der Demo-Umgebung für {tenant} ab. Sobald alles bereit ist, senden wir Ihnen eine E-Mail mit dem korrekten Tenant-Login-Link.",
   "onboarding.preparing.emailNotice": "Sie müssen diese Seite nicht geöffnet lassen. Wir senden Ihnen eine E-Mail, sobald alles bereit ist.",
   "onboarding.preparing.homeCta": "Zur Startseite",
+  "onboarding.preparing.loginCta": "Tenant-Login öffnen",
   "onboarding.preparing.redirecting": "Ihr Arbeitsbereich ist bereit. Wir leiten Sie jetzt zur Tenant-Anmeldung weiter.",
+  "onboarding.preparing.statusErrorBody": "Der Arbeitsbereichstatus konnte nicht geprüft werden. Der Arbeitsbereich wird möglicherweise noch vorbereitet; diese Seite versucht es weiter.",
+  "onboarding.preparing.statusErrorTitle": "Statusprüfung fehlgeschlagen",
   "onboarding.preparing.title": "Wir bereiten Ihren Arbeitsbereich vor",
   "onboarding.readyEmail.body": "Ihr Open Mercato-Arbeitsbereich für {organizationName} ist fertig vorbereitet. Verwenden Sie den sicheren Link unten, um sich anzumelden.",
   "onboarding.readyEmail.cta": "Login öffnen",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Ihr Arbeitsbereich ist bereit. Verwenden Sie Ihren sicheren Login-Link zur Anmeldung.",
   "onboarding.readyEmail.subject": "Ihr Open Mercato-Arbeitsbereich ist bereit",
   "onboarding.subtitle": "Erzählen Sie uns ein wenig über sich und wir richten alles für Sie ein.",
-  "onboarding.title": "Erstellen Sie Ihren Open Mercato-Arbeitsbereich"
+  "onboarding.title": "Erstellen Sie Ihren Open Mercato-Arbeitsbereich",
+  "onboarding.verifyStatus.alreadyExists": "Es existiert bereits ein Konto mit dieser E-Mail-Adresse. Versuchen Sie, sich anzumelden oder Ihr Passwort zurückzusetzen.",
+  "onboarding.verifyStatus.error": "Die Verifizierung konnte nicht abgeschlossen werden. Bitte versuchen Sie es erneut oder kontaktieren Sie den Support.",
+  "onboarding.verifyStatus.invalid": "Der Verifizierungslink ist ungültig oder abgelaufen. Senden Sie das Onboarding-Formular erneut, um einen neuen Link zu erhalten.",
+  "onboarding.verifyStatus.originNotAllowed": "Der Verifizierungslink wurde von einem nicht erlaubten Origin geöffnet. Prüfen Sie APP_URL und APP_ALLOWED_ORIGINS und öffnen Sie den Link erneut.",
+  "onboarding.verifyStatus.redirectMisconfigured": "Der Verifizierungslink kann nicht sicher weiterleiten, weil APP_URL nicht zur URL passt, die die Anfrage verarbeitet hat. Prüfen Sie APP_URL und APP_ALLOWED_ORIGINS und öffnen Sie den Link erneut.",
+  "onboarding.verifyStatus.urlNotConfigured": "Die Onboarding-Verifizierung ist nicht konfiguriert. APP_URL muss gesetzt sein, bevor Verifizierungslinks verwendet werden können."
 }

package/src/modules/onboarding/i18n/en.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "We are finishing the demo environment for {tenant}. We will send you an email with the correct tenant login link as soon as it is ready.",
   "onboarding.preparing.emailNotice": "You do not need to keep this page open. We will email you when everything is ready.",
   "onboarding.preparing.homeCta": "Go to home page",
+  "onboarding.preparing.loginCta": "Open tenant login",
   "onboarding.preparing.redirecting": "Your workspace is ready. Redirecting you to the tenant login page now.",
+  "onboarding.preparing.statusErrorBody": "We could not check the workspace status. The workspace may still be preparing; this page will keep retrying.",
+  "onboarding.preparing.statusErrorTitle": "Workspace status check failed",
   "onboarding.preparing.title": "We are preparing your workspace",
   "onboarding.readyEmail.body": "Your Open Mercato workspace for {organizationName} has finished preparing. Use the secure link below to sign in.",
   "onboarding.readyEmail.cta": "Open login",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Your workspace is ready. Use your secure login link to sign in.",
   "onboarding.readyEmail.subject": "Your Open Mercato workspace is ready",
   "onboarding.subtitle": "Tell us a bit about you and we will set everything up.",
-  "onboarding.title": "Create your Open Mercato workspace"
+  "onboarding.title": "Create your Open Mercato workspace",
+  "onboarding.verifyStatus.alreadyExists": "We already have an account with this email. Try signing in or resetting your password.",
+  "onboarding.verifyStatus.error": "We could not complete verification. Please try again or contact support.",
+  "onboarding.verifyStatus.invalid": "The verification link is invalid or expired. Submit the onboarding form again to receive a new link.",
+  "onboarding.verifyStatus.originNotAllowed": "The verification link was opened from an origin that is not allowed. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.",
+  "onboarding.verifyStatus.redirectMisconfigured": "The verification link cannot redirect safely because APP_URL does not match the URL that handled the request. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.",
+  "onboarding.verifyStatus.urlNotConfigured": "Onboarding verification is not configured. APP_URL must be set before verification links can be used."
 }