@open-mercato/onboarding 0.6.6-develop.5412.1.e2a52b14f0 → 0.6.6-develop.5459.1.170077434e

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:onboarding] found 26 entry points
+[build:onboarding] found 33 entry points
 [build:onboarding] built successfully

package/dist/modules/onboarding/__integration__/TC-ONB-001-self-service-consent.spec.js

@@ -0,0 +1,141 @@
+import { createHash, randomUUID } from "node:crypto";
+import { expect, test } from "@playwright/test";
+import { withClient } from "@open-mercato/core/helpers/integration/dbFixtures";
+const integrationMeta = {
+  dependsOnModules: ["onboarding"],
+  requiredEnvVars: ["SELF_SERVICE_ONBOARDING_ENABLED"],
+  requiredAnyEnvVars: ["CONSENT_INTEGRITY_SECRET", "AUTH_SECRET", "NEXTAUTH_SECRET", "JWT_SECRET"]
+};
+const ONBOARDING_PASSWORD = "IntegrationPass123!";
+const BASE_URL = process.env.BASE_URL?.trim() || "http://localhost:3000";
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+async function replaceVerificationToken(email, token) {
+  return withClient(async (client) => {
+    const result = await client.query(
+      `update onboarding_requests
+         set token_hash = $2,
+             expires_at = now() + interval '24 hours',
+             updated_at = now()
+       where email = $1
+       returning id`,
+      [email, hashToken(token)]
+    );
+    expect(result.rowCount, "onboarding request should exist after submitting the form").toBe(1);
+    return result.rows[0].id;
+  });
+}
+async function readCompletedRequest(requestId) {
+  return withClient(async (client) => {
+    const result = await client.query(
+      `select id, status, tenant_id, organization_id, user_id, marketing_consent, completed_at
+         from onboarding_requests
+        where id = $1`,
+      [requestId]
+    );
+    expect(result.rowCount, "completed onboarding request should remain queryable").toBe(1);
+    return result.rows[0];
+  });
+}
+async function readMarketingConsent(userId) {
+  return withClient(async (client) => {
+    const result = await client.query(
+      `select consent_type, is_granted, source, integrity_hash, granted_at
+         from user_consents
+        where user_id = $1 and consent_type = 'marketing_email'
+        order by created_at desc
+        limit 1`,
+      [userId]
+    );
+    expect(result.rowCount, "marketing consent should be persisted for the onboarded user").toBe(1);
+    return result.rows[0];
+  });
+}
+test.describe("TC-ONB-001: self-service onboarding with marketing consent", () => {
+  test("does not offer tenant login while workspace preparation is still running", async ({ page }) => {
+    const tenantId = "33333333-3333-4333-8333-333333333333";
+    await page.route("**/api/onboarding/onboarding/status?**", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          ok: true,
+          status: "processing",
+          ready: false,
+          emailSent: false,
+          tenantId,
+          loginUrl: null
+        })
+      });
+    });
+    await page.goto(`/onboarding/preparing?tenant=${tenantId}`);
+    await expect(page.getByText("We are preparing your workspace")).toBeVisible();
+    await expect(page.getByRole("link", { name: "Open tenant login" })).toHaveCount(0);
+    await expect(page.getByRole("link", { name: "Go to home page" })).toBeVisible();
+  });
+  test("shows a retryable error when workspace status polling fails", async ({ page }) => {
+    const tenantId = "33333333-3333-4333-8333-333333333333";
+    await page.route("**/api/onboarding/onboarding/status?**", async (route) => {
+      await route.fulfill({
+        status: 400,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: false, error: "Invalid request origin" })
+      });
+    });
+    await page.goto(`/onboarding/preparing?tenant=${tenantId}`);
+    await expect(page.getByText("We are preparing your workspace")).toBeVisible();
+    const statusAlert = page.getByText("Workspace status check failed").locator("..");
+    await expect(statusAlert).toContainText("Invalid request origin");
+    await expect(page.getByRole("link", { name: "Open tenant login" })).toHaveCount(0);
+  });
+  test("creates the workspace, verifies from the email link, and logs in to the new tenant", async ({ page }) => {
+    const unique = randomUUID().slice(0, 8);
+    const email = `qa-onboarding-${unique}@example.test`;
+    const organizationName = `QA Onboarding ${unique}`;
+    const token = `integration-onboarding-${randomUUID().replace(/-/g, "")}`;
+    await page.goto("/onboarding");
+    await expect(page.getByText("Create your Open Mercato workspace")).toBeVisible();
+    await page.getByLabel("Work email").fill(email);
+    await page.getByLabel("First name").fill("QA");
+    await page.getByLabel("Last name").fill("Onboarding");
+    await page.getByLabel("Organization name").fill(organizationName);
+    await page.locator('input[name="password"]').fill(ONBOARDING_PASSWORD);
+    await page.locator('input[name="confirmPassword"]').fill(ONBOARDING_PASSWORD);
+    await page.locator("#terms").click();
+    await page.locator("#marketingConsent").click();
+    await page.getByRole("button", { name: "Send verification email" }).click();
+    await expect(page.getByRole("status")).toContainText("Check your inbox");
+    await expect(page.getByRole("status")).toContainText(email);
+    const requestId = await replaceVerificationToken(email, token);
+    const verifyUrl = `${BASE_URL}/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`;
+    await page.setContent(`<a href="${verifyUrl}">Verify workspace</a>`);
+    await page.getByRole("link", { name: "Verify workspace" }).click();
+    await expect(page).toHaveURL(/\/onboarding\/preparing\?tenant=[0-9a-f-]+/);
+    await expect(page.getByText("We are preparing your workspace")).toBeVisible();
+    const completed = await readCompletedRequest(requestId);
+    expect(completed.status).toBe("completed");
+    expect(completed.marketing_consent).toBe(true);
+    expect(completed.completed_at).toBeTruthy();
+    expect(completed.tenant_id, "tenant id should be recorded").toBeTruthy();
+    expect(completed.organization_id, "organization id should be recorded").toBeTruthy();
+    expect(completed.user_id, "user id should be recorded").toBeTruthy();
+    const consent = await readMarketingConsent(completed.user_id);
+    expect(consent.consent_type).toBe("marketing_email");
+    expect(consent.is_granted).toBe(true);
+    expect(consent.source).toBeTruthy();
+    expect(consent.granted_at).toBeTruthy();
+    expect(consent.integrity_hash, "consent integrity hash should be computed instead of redirecting to status=error").toBeTruthy();
+    await page.goto(`/login?tenant=${encodeURIComponent(completed.tenant_id)}`);
+    await expect(page.locator('form[data-auth-ready="1"]')).toBeVisible();
+    await expect(page.getByText(/You're logging in to/i)).toBeVisible();
+    await page.getByLabel("Email").fill(email);
+    await page.getByLabel("Password", { exact: true }).fill(ONBOARDING_PASSWORD);
+    await page.getByRole("button", { name: "Sign in" }).click();
+    await expect(page).toHaveURL(/\/backend(?:\/.*)?$/);
+  });
+});
+export {
+  integrationMeta
+};
+//# sourceMappingURL=TC-ONB-001-self-service-consent.spec.js.map

package/dist/modules/onboarding/__integration__/TC-ONB-001-self-service-consent.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/__integration__/TC-ONB-001-self-service-consent.spec.ts"],
+  "sourcesContent": ["import { createHash, randomUUID } from 'node:crypto';\nimport { expect, test } from '@playwright/test';\nimport { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';\n\nexport const integrationMeta = {\n  dependsOnModules: ['onboarding'],\n  requiredEnvVars: ['SELF_SERVICE_ONBOARDING_ENABLED'],\n  requiredAnyEnvVars: ['CONSENT_INTEGRITY_SECRET', 'AUTH_SECRET', 'NEXTAUTH_SECRET', 'JWT_SECRET'],\n};\n\ntype OnboardingRequestRow = {\n  id: string;\n  status: string;\n  tenant_id: string | null;\n  organization_id: string | null;\n  user_id: string | null;\n  marketing_consent: boolean | null;\n  completed_at: Date | null;\n};\n\ntype UserConsentRow = {\n  consent_type: string;\n  is_granted: boolean;\n  source: string | null;\n  integrity_hash: string | null;\n  granted_at: Date | null;\n};\n\nconst ONBOARDING_PASSWORD = 'IntegrationPass123!';\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\n\nfunction hashToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex');\n}\n\nasync function replaceVerificationToken(email: string, token: string): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `update onboarding_requests\n         set token_hash = $2,\n             expires_at = now() + interval '24 hours',\n             updated_at = now()\n       where email = $1\n       returning id`,\n      [email, hashToken(token)],\n    );\n    expect(result.rowCount, 'onboarding request should exist after submitting the form').toBe(1);\n    return result.rows[0].id;\n  });\n}\n\nasync function readCompletedRequest(requestId: string): Promise<OnboardingRequestRow> {\n  return withClient(async (client) => {\n    const result = await client.query<OnboardingRequestRow>(\n      `select id, status, tenant_id, organization_id, user_id, marketing_consent, completed_at\n         from onboarding_requests\n        where id = $1`,\n      [requestId],\n    );\n    expect(result.rowCount, 'completed onboarding request should remain queryable').toBe(1);\n    return result.rows[0];\n  });\n}\n\nasync function readMarketingConsent(userId: string): Promise<UserConsentRow> {\n  return withClient(async (client) => {\n    const result = await client.query<UserConsentRow>(\n      `select consent_type, is_granted, source, integrity_hash, granted_at\n         from user_consents\n        where user_id = $1 and consent_type = 'marketing_email'\n        order by created_at desc\n        limit 1`,\n      [userId],\n    );\n    expect(result.rowCount, 'marketing consent should be persisted for the onboarded user').toBe(1);\n    return result.rows[0];\n  });\n}\n\ntest.describe('TC-ONB-001: self-service onboarding with marketing consent', () => {\n  test('does not offer tenant login while workspace preparation is still running', async ({ page }) => {\n    const tenantId = '33333333-3333-4333-8333-333333333333';\n    await page.route('**/api/onboarding/onboarding/status?**', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          ok: true,\n          status: 'processing',\n          ready: false,\n          emailSent: false,\n          tenantId,\n          loginUrl: null,\n        }),\n      });\n    });\n\n    await page.goto(`/onboarding/preparing?tenant=${tenantId}`);\n\n    await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n    await expect(page.getByRole('link', { name: 'Open tenant login' })).toHaveCount(0);\n    await expect(page.getByRole('link', { name: 'Go to home page' })).toBeVisible();\n  });\n\n  test('shows a retryable error when workspace status polling fails', async ({ page }) => {\n    const tenantId = '33333333-3333-4333-8333-333333333333';\n    await page.route('**/api/onboarding/onboarding/status?**', async (route) => {\n      await route.fulfill({\n        status: 400,\n        contentType: 'application/json',\n        body: JSON.stringify({ ok: false, error: 'Invalid request origin' }),\n      });\n    });\n\n    await page.goto(`/onboarding/preparing?tenant=${tenantId}`);\n\n    await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n    const statusAlert = page.getByText('Workspace status check failed').locator('..');\n    await expect(statusAlert).toContainText('Invalid request origin');\n    await expect(page.getByRole('link', { name: 'Open tenant login' })).toHaveCount(0);\n  });\n\n  test('creates the workspace, verifies from the email link, and logs in to the new tenant', async ({ page }) => {\n    const unique = randomUUID().slice(0, 8);\n    const email = `qa-onboarding-${unique}@example.test`;\n    const organizationName = `QA Onboarding ${unique}`;\n    const token = `integration-onboarding-${randomUUID().replace(/-/g, '')}`;\n\n    await page.goto('/onboarding');\n    await expect(page.getByText('Create your Open Mercato workspace')).toBeVisible();\n\n    await page.getByLabel('Work email').fill(email);\n    await page.getByLabel('First name').fill('QA');\n    await page.getByLabel('Last name').fill('Onboarding');\n    await page.getByLabel('Organization name').fill(organizationName);\n    await page.locator('input[name=\"password\"]').fill(ONBOARDING_PASSWORD);\n    await page.locator('input[name=\"confirmPassword\"]').fill(ONBOARDING_PASSWORD);\n    await page.locator('#terms').click();\n    await page.locator('#marketingConsent').click();\n    await page.getByRole('button', { name: 'Send verification email' }).click();\n\n    await expect(page.getByRole('status')).toContainText('Check your inbox');\n    await expect(page.getByRole('status')).toContainText(email);\n\n    const requestId = await replaceVerificationToken(email, token);\n    const verifyUrl = `${BASE_URL}/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`;\n\n    await page.setContent(`<a href=\"${verifyUrl}\">Verify workspace</a>`);\n    await page.getByRole('link', { name: 'Verify workspace' }).click();\n    await expect(page).toHaveURL(/\\/onboarding\\/preparing\\?tenant=[0-9a-f-]+/);\n    await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n\n    const completed = await readCompletedRequest(requestId);\n    expect(completed.status).toBe('completed');\n    expect(completed.marketing_consent).toBe(true);\n    expect(completed.completed_at).toBeTruthy();\n    expect(completed.tenant_id, 'tenant id should be recorded').toBeTruthy();\n    expect(completed.organization_id, 'organization id should be recorded').toBeTruthy();\n    expect(completed.user_id, 'user id should be recorded').toBeTruthy();\n\n    const consent = await readMarketingConsent(completed.user_id!);\n    expect(consent.consent_type).toBe('marketing_email');\n    expect(consent.is_granted).toBe(true);\n    expect(consent.source).toBeTruthy();\n    expect(consent.granted_at).toBeTruthy();\n    expect(consent.integrity_hash, 'consent integrity hash should be computed instead of redirecting to status=error').toBeTruthy();\n\n    await page.goto(`/login?tenant=${encodeURIComponent(completed.tenant_id!)}`);\n    await expect(page.locator('form[data-auth-ready=\"1\"]')).toBeVisible();\n    await expect(page.getByText(/You're logging in to/i)).toBeVisible();\n    await page.getByLabel('Email').fill(email);\n    await page.getByLabel('Password', { exact: true }).fill(ONBOARDING_PASSWORD);\n    await page.getByRole('button', { name: 'Sign in' }).click();\n    await expect(page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,YAAY,kBAAkB;AACvC,SAAS,QAAQ,YAAY;AAC7B,SAAS,kBAAkB;AAEpB,MAAM,kBAAkB;AAAA,EAC7B,kBAAkB,CAAC,YAAY;AAAA,EAC/B,iBAAiB,CAAC,iCAAiC;AAAA,EACnD,oBAAoB,CAAC,4BAA4B,eAAe,mBAAmB,YAAY;AACjG;AAoBA,MAAM,sBAAsB;AAC5B,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,UAAU,OAAuB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,eAAe,yBAAyB,OAAe,OAAgC;AACrF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,OAAO,UAAU,KAAK,CAAC;AAAA,IAC1B;AACA,WAAO,OAAO,UAAU,2DAA2D,EAAE,KAAK,CAAC;AAC3F,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAEA,eAAe,qBAAqB,WAAkD;AACpF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA,MAGA,CAAC,SAAS;AAAA,IACZ;AACA,WAAO,OAAO,UAAU,sDAAsD,EAAE,KAAK,CAAC;AACtF,WAAO,OAAO,KAAK,CAAC;AAAA,EACtB,CAAC;AACH;AAEA,eAAe,qBAAqB,QAAyC;AAC3E,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,MAAM;AAAA,IACT;AACA,WAAO,OAAO,UAAU,8DAA8D,EAAE,KAAK,CAAC;AAC9F,WAAO,OAAO,KAAK,CAAC;AAAA,EACtB,CAAC;AACH;AAEA,KAAK,SAAS,8DAA8D,MAAM;AAChF,OAAK,4EAA4E,OAAO,EAAE,KAAK,MAAM;AACnG,UAAM,WAAW;AACjB,UAAM,KAAK,MAAM,0CAA0C,OAAO,UAAU;AAC1E,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,IAAI;AAAA,UACJ,QAAQ;AAAA,UACR,OAAO;AAAA,UACP,WAAW;AAAA,UACX;AAAA,UACA,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,gCAAgC,QAAQ,EAAE;AAE1D,UAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAC5E,UAAM,OAAO,KAAK,UAAU,QAAQ,EAAE,MAAM,oBAAoB,CAAC,CAAC,EAAE,YAAY,CAAC;AACjF,UAAM,OAAO,KAAK,UAAU,QAAQ,EAAE,MAAM,kBAAkB,CAAC,CAAC,EAAE,YAAY;AAAA,EAChF,CAAC;AAED,OAAK,+DAA+D,OAAO,EAAE,KAAK,MAAM;AACtF,UAAM,WAAW;AACjB,UAAM,KAAK,MAAM,0CAA0C,OAAO,UAAU;AAC1E,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,yBAAyB,CAAC;AAAA,MACrE,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,gCAAgC,QAAQ,EAAE;AAE1D,UAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAC5E,UAAM,cAAc,KAAK,UAAU,+BAA+B,EAAE,QAAQ,IAAI;AAChF,UAAM,OAAO,WAAW,EAAE,cAAc,wBAAwB;AAChE,UAAM,OAAO,KAAK,UAAU,QAAQ,EAAE,MAAM,oBAAoB,CAAC,CAAC,EAAE,YAAY,CAAC;AAAA,EACnF,CAAC;AAED,OAAK,sFAAsF,OAAO,EAAE,KAAK,MAAM;AAC7G,UAAM,SAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,UAAM,QAAQ,iBAAiB,MAAM;AACrC,UAAM,mBAAmB,iBAAiB,MAAM;AAChD,UAAM,QAAQ,0BAA0B,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAEtE,UAAM,KAAK,KAAK,aAAa;AAC7B,UAAM,OAAO,KAAK,UAAU,oCAAoC,CAAC,EAAE,YAAY;AAE/E,UAAM,KAAK,WAAW,YAAY,EAAE,KAAK,KAAK;AAC9C,UAAM,KAAK,WAAW,YAAY,EAAE,KAAK,IAAI;AAC7C,UAAM,KAAK,WAAW,WAAW,EAAE,KAAK,YAAY;AACpD,UAAM,KAAK,WAAW,mBAAmB,EAAE,KAAK,gBAAgB;AAChE,UAAM,KAAK,QAAQ,wBAAwB,EAAE,KAAK,mBAAmB;AACrE,UAAM,KAAK,QAAQ,+BAA+B,EAAE,KAAK,mBAAmB;AAC5E,UAAM,KAAK,QAAQ,QAAQ,EAAE,MAAM;AACnC,UAAM,KAAK,QAAQ,mBAAmB,EAAE,MAAM;AAC9C,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,0BAA0B,CAAC,EAAE,MAAM;AAE1E,UAAM,OAAO,KAAK,UAAU,QAAQ,CAAC,EAAE,cAAc,kBAAkB;AACvE,UAAM,OAAO,KAAK,UAAU,QAAQ,CAAC,EAAE,cAAc,KAAK;AAE1D,UAAM,YAAY,MAAM,yBAAyB,OAAO,KAAK;AAC7D,UAAM,YAAY,GAAG,QAAQ,2CAA2C,mBAAmB,KAAK,CAAC;AAEjG,UAAM,KAAK,WAAW,YAAY,SAAS,wBAAwB;AACnE,UAAM,KAAK,UAAU,QAAQ,EAAE,MAAM,mBAAmB,CAAC,EAAE,MAAM;AACjE,UAAM,OAAO,IAAI,EAAE,UAAU,4CAA4C;AACzE,UAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAE5E,UAAM,YAAY,MAAM,qBAAqB,SAAS;AACtD,WAAO,UAAU,MAAM,EAAE,KAAK,WAAW;AACzC,WAAO,UAAU,iBAAiB,EAAE,KAAK,IAAI;AAC7C,WAAO,UAAU,YAAY,EAAE,WAAW;AAC1C,WAAO,UAAU,WAAW,8BAA8B,EAAE,WAAW;AACvE,WAAO,UAAU,iBAAiB,oCAAoC,EAAE,WAAW;AACnF,WAAO,UAAU,SAAS,4BAA4B,EAAE,WAAW;AAEnE,UAAM,UAAU,MAAM,qBAAqB,UAAU,OAAQ;AAC7D,WAAO,QAAQ,YAAY,EAAE,KAAK,iBAAiB;AACnD,WAAO,QAAQ,UAAU,EAAE,KAAK,IAAI;AACpC,WAAO,QAAQ,MAAM,EAAE,WAAW;AAClC,WAAO,QAAQ,UAAU,EAAE,WAAW;AACtC,WAAO,QAAQ,gBAAgB,kFAAkF,EAAE,WAAW;AAE9H,UAAM,KAAK,KAAK,iBAAiB,mBAAmB,UAAU,SAAU,CAAC,EAAE;AAC3E,UAAM,OAAO,KAAK,QAAQ,2BAA2B,CAAC,EAAE,YAAY;AACpE,UAAM,OAAO,KAAK,UAAU,uBAAuB,CAAC,EAAE,YAAY;AAClE,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,KAAK;AACzC,UAAM,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,mBAAmB;AAC3E,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM;AAC1D,UAAM,OAAO,IAAI,EAAE,UAAU,qBAAqB;AAAA,EACpD,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.js

@@ -0,0 +1,158 @@
+import { createHash, randomUUID } from "node:crypto";
+import { expect, test } from "@playwright/test";
+import { withClient } from "@open-mercato/core/helpers/integration/dbFixtures";
+const integrationMeta = {
+  dependsOnModules: ["onboarding"],
+  requiredEnvVars: ["SELF_SERVICE_ONBOARDING_ENABLED"],
+  requiredAnyEnvVars: ["CONSENT_INTEGRITY_SECRET", "AUTH_SECRET", "NEXTAUTH_SECRET", "JWT_SECRET"]
+};
+const BASE_URL = process.env.BASE_URL?.trim() || "http://localhost:3000";
+const ONBOARDING_PASSWORD = "ParallelPass123!";
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+async function replaceVerificationToken(email, token) {
+  return withClient(async (client) => {
+    const result = await client.query(
+      `update onboarding_requests
+         set token_hash = $2,
+             expires_at = now() + interval '24 hours',
+             updated_at = now()
+       where email = $1
+       returning id`,
+      [email, hashToken(token)]
+    );
+    expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);
+    return result.rows[0].id;
+  });
+}
+async function readPreparationState(requestId) {
+  return withClient(async (client) => {
+    const result = await client.query(
+      `select preparation_completed_at, preparation_started_at
+         from onboarding_requests
+        where id = $1`,
+      [requestId]
+    );
+    expect(result.rowCount, `onboarding request ${requestId} should remain queryable`).toBe(1);
+    return result.rows[0];
+  });
+}
+async function waitForPreparationComplete(requestId) {
+  const deadline = Date.now() + 6e4;
+  let lastState = null;
+  while (Date.now() < deadline) {
+    lastState = await readPreparationState(requestId);
+    if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  expect(lastState?.preparation_started_at, "deferred preparation lease should be cleared after completion").toBeNull();
+  expect(lastState?.preparation_completed_at, "workspace preparation should complete").toBeTruthy();
+}
+async function submitOnboarding(request, tenant) {
+  const response = await request.post(`${BASE_URL}/api/onboarding/onboarding`, {
+    data: {
+      email: tenant.email,
+      firstName: "Parallel",
+      lastName: "Login",
+      organizationName: tenant.organizationName,
+      password: ONBOARDING_PASSWORD,
+      confirmPassword: ONBOARDING_PASSWORD,
+      termsAccepted: true,
+      marketingConsent: true,
+      locale: "en"
+    }
+  });
+  expect(response.status(), `onboarding start should succeed for ${tenant.email}`).toBe(200);
+}
+async function verifyTenantInBrowser(browser, token) {
+  const context = await browser.newContext({ baseURL: BASE_URL });
+  const page = await context.newPage();
+  const refreshRequests = [];
+  page.on("request", (browserRequest) => {
+    const url = browserRequest.url();
+    if (url.includes("/api/auth/session/refresh")) refreshRequests.push(url);
+  });
+  await page.goto(`/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`);
+  await expect(page).toHaveURL(/\/onboarding\/preparing\?tenant=[0-9a-f-]+/);
+  await expect(page.getByText("We are preparing your workspace")).toBeVisible();
+  const tenantId = new URL(page.url()).searchParams.get("tenant");
+  expect(tenantId, "verify redirect should include tenant id").toMatch(
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+  );
+  return { context, page, refreshRequests, tenantId };
+}
+async function pollOnboardingStatus(request, tenantId) {
+  return request.get(`${BASE_URL}/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(tenantId)}`, {
+    headers: {
+      Cookie: `om_login_tenant=${encodeURIComponent(tenantId)}`
+    }
+  });
+}
+async function loginAndAssertBackend(session, tenant) {
+  expect(tenant.tenantId, `tenant id should exist for ${tenant.email}`).toBeTruthy();
+  await expect(session.page).toHaveURL(new RegExp(`/login\\?tenant=${tenant.tenantId}`));
+  await expect(session.page.locator('form[data-auth-ready="1"]')).toBeVisible();
+  await session.page.getByLabel("Email").fill(tenant.email);
+  await session.page.getByLabel("Password", { exact: true }).fill(ONBOARDING_PASSWORD);
+  await session.page.getByRole("button", { name: "Sign in" }).click();
+  await expect(session.page, `browser login should land ${tenant.email} in the backend`).toHaveURL(/\/backend(?:\/.*)?$/);
+  await expect(session.page.getByText(/Session expired/i)).toHaveCount(0);
+  const profileResult = await session.page.evaluate(async () => {
+    const response = await fetch("/api/auth/profile", { credentials: "include" });
+    const body = await response.json().catch(() => null);
+    return { status: response.status, body };
+  });
+  expect(profileResult.status, `browser page should keep ${tenant.email} authenticated`).toBe(200);
+  const profile = profileResult.body;
+  expect(profile.email).toBe(tenant.email);
+  expect(profile.roles).toContain("admin");
+  await session.page.goto("/backend");
+  await expect(session.page).toHaveURL(/\/backend(?:\/.*)?$/);
+  expect(session.refreshRequests, `backend should not bounce ${tenant.email} through session refresh`).toHaveLength(0);
+}
+test.describe("TC-ONB-002: multi-tenant onboarding parallel login", () => {
+  test("creates two self-service tenants, handles repeated status polling, and keeps both logins authenticated", async ({
+    browser,
+    request
+  }) => {
+    test.setTimeout(12e4);
+    const unique = randomUUID().slice(0, 8);
+    const tenants = [1, 2].map((index) => ({
+      email: `qa-onboarding-parallel-${unique}-${index}@example.test`,
+      organizationName: `QA Onboarding Parallel ${unique} ${index}`,
+      token: `integration-parallel-${index}-${randomUUID().replace(/-/g, "")}`
+    }));
+    await Promise.all(tenants.map((tenant) => submitOnboarding(request, tenant)));
+    for (const tenant of tenants) {
+      tenant.requestId = await replaceVerificationToken(tenant.email, tenant.token);
+    }
+    const browserSessions = await Promise.all(
+      tenants.map(async (tenant) => {
+        const session = await verifyTenantInBrowser(browser, tenant.token);
+        tenant.tenantId = session.tenantId;
+        return session;
+      })
+    );
+    try {
+      const statusResponses = await Promise.all(
+        tenants.flatMap(
+          (tenant) => Array.from({ length: 6 }, () => pollOnboardingStatus(request, tenant.tenantId))
+        )
+      );
+      for (const response of statusResponses) {
+        expect(response.status(), "status polling should not exhaust the app DB pool").toBe(200);
+      }
+      await Promise.all(tenants.map((tenant) => waitForPreparationComplete(tenant.requestId)));
+      await Promise.all(
+        tenants.map((tenant, index) => loginAndAssertBackend(browserSessions[index], tenant))
+      );
+    } finally {
+      await Promise.all(browserSessions.map((session) => session.context.close()));
+    }
+  });
+});
+export {
+  integrationMeta
+};
+//# sourceMappingURL=TC-ONB-002-multi-tenant-parallel-login.spec.js.map

package/dist/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.ts"],
+  "sourcesContent": ["// Adapted from PR #3007 (pkarw) \u2014 multi-tenant parallel onboarding repro for the\n// 2026-06-11 demo pool-exhaustion outage, ported to the preparation_started_at\n// lease column introduced by the single-flight deferred-provisioning fix.\nimport { createHash, randomUUID } from 'node:crypto';\nimport { expect, test, type APIRequestContext, type Browser, type BrowserContext, type Page } from '@playwright/test';\nimport { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';\n\nexport const integrationMeta = {\n  dependsOnModules: ['onboarding'],\n  requiredEnvVars: ['SELF_SERVICE_ONBOARDING_ENABLED'],\n  requiredAnyEnvVars: ['CONSENT_INTEGRITY_SECRET', 'AUTH_SECRET', 'NEXTAUTH_SECRET', 'JWT_SECRET'],\n};\n\ntype OnboardingTenant = {\n  email: string;\n  organizationName: string;\n  token: string;\n  requestId?: string;\n  tenantId?: string;\n};\n\ntype BrowserTenantSession = {\n  context: BrowserContext;\n  page: Page;\n  refreshRequests: string[];\n};\n\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\nconst ONBOARDING_PASSWORD = 'ParallelPass123!';\n\nfunction hashToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex');\n}\n\nasync function replaceVerificationToken(email: string, token: string): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `update onboarding_requests\n         set token_hash = $2,\n             expires_at = now() + interval '24 hours',\n             updated_at = now()\n       where email = $1\n       returning id`,\n      [email, hashToken(token)],\n    );\n    expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);\n    return result.rows[0].id;\n  });\n}\n\nasync function readPreparationState(requestId: string): Promise<{\n  preparation_completed_at: Date | null;\n  preparation_started_at: Date | null;\n}> {\n  return withClient(async (client) => {\n    const result = await client.query<{\n      preparation_completed_at: Date | null;\n      preparation_started_at: Date | null;\n    }>(\n      `select preparation_completed_at, preparation_started_at\n         from onboarding_requests\n        where id = $1`,\n      [requestId],\n    );\n    expect(result.rowCount, `onboarding request ${requestId} should remain queryable`).toBe(1);\n    return result.rows[0];\n  });\n}\n\nasync function waitForPreparationComplete(requestId: string): Promise<void> {\n  const deadline = Date.now() + 60_000;\n  let lastState: Awaited<ReturnType<typeof readPreparationState>> | null = null;\n  while (Date.now() < deadline) {\n    lastState = await readPreparationState(requestId);\n    if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;\n    await new Promise((resolve) => setTimeout(resolve, 500));\n  }\n  expect(lastState?.preparation_started_at, 'deferred preparation lease should be cleared after completion').toBeNull();\n  expect(lastState?.preparation_completed_at, 'workspace preparation should complete').toBeTruthy();\n}\n\nasync function submitOnboarding(request: APIRequestContext, tenant: OnboardingTenant): Promise<void> {\n  const response = await request.post(`${BASE_URL}/api/onboarding/onboarding`, {\n    data: {\n      email: tenant.email,\n      firstName: 'Parallel',\n      lastName: 'Login',\n      organizationName: tenant.organizationName,\n      password: ONBOARDING_PASSWORD,\n      confirmPassword: ONBOARDING_PASSWORD,\n      termsAccepted: true,\n      marketingConsent: true,\n      locale: 'en',\n    },\n  });\n  expect(response.status(), `onboarding start should succeed for ${tenant.email}`).toBe(200);\n}\n\nasync function verifyTenantInBrowser(browser: Browser, token: string): Promise<BrowserTenantSession & { tenantId: string }> {\n  const context = await browser.newContext({ baseURL: BASE_URL });\n  const page = await context.newPage();\n  const refreshRequests: string[] = [];\n  page.on('request', (browserRequest) => {\n    const url = browserRequest.url();\n    if (url.includes('/api/auth/session/refresh')) refreshRequests.push(url);\n  });\n\n  await page.goto(`/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`);\n  await expect(page).toHaveURL(/\\/onboarding\\/preparing\\?tenant=[0-9a-f-]+/);\n  await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n  const tenantId = new URL(page.url()).searchParams.get('tenant');\n  expect(tenantId, 'verify redirect should include tenant id').toMatch(\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,\n  );\n  return { context, page, refreshRequests, tenantId: tenantId! };\n}\n\nasync function pollOnboardingStatus(request: APIRequestContext, tenantId: string) {\n  return request.get(`${BASE_URL}/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(tenantId)}`, {\n    headers: {\n      Cookie: `om_login_tenant=${encodeURIComponent(tenantId)}`,\n    },\n  });\n}\n\nasync function loginAndAssertBackend(session: BrowserTenantSession, tenant: OnboardingTenant): Promise<void> {\n  expect(tenant.tenantId, `tenant id should exist for ${tenant.email}`).toBeTruthy();\n  await expect(session.page).toHaveURL(new RegExp(`/login\\\\?tenant=${tenant.tenantId}`));\n  await expect(session.page.locator('form[data-auth-ready=\"1\"]')).toBeVisible();\n  await session.page.getByLabel('Email').fill(tenant.email);\n  await session.page.getByLabel('Password', { exact: true }).fill(ONBOARDING_PASSWORD);\n  await session.page.getByRole('button', { name: 'Sign in' }).click();\n  await expect(session.page, `browser login should land ${tenant.email} in the backend`).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  await expect(session.page.getByText(/Session expired/i)).toHaveCount(0);\n\n  const profileResult = await session.page.evaluate(async () => {\n    const response = await fetch('/api/auth/profile', { credentials: 'include' });\n    const body = await response.json().catch(() => null);\n    return { status: response.status, body };\n  });\n  expect(profileResult.status, `browser page should keep ${tenant.email} authenticated`).toBe(200);\n  const profile = profileResult.body;\n  expect(profile.email).toBe(tenant.email);\n  expect(profile.roles).toContain('admin');\n\n  await session.page.goto('/backend');\n  await expect(session.page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  expect(session.refreshRequests, `backend should not bounce ${tenant.email} through session refresh`).toHaveLength(0);\n}\n\ntest.describe('TC-ONB-002: multi-tenant onboarding parallel login', () => {\n  test('creates two self-service tenants, handles repeated status polling, and keeps both logins authenticated', async ({\n    browser,\n    request,\n  }) => {\n    // Two full onboardings + parallel browser logins + DB-polled preparation\n    // far exceed the 20s suite default (house pattern: TC-AI-AGENT-SETTINGS-005).\n    test.setTimeout(120_000);\n    const unique = randomUUID().slice(0, 8);\n    const tenants: OnboardingTenant[] = [1, 2].map((index) => ({\n      email: `qa-onboarding-parallel-${unique}-${index}@example.test`,\n      organizationName: `QA Onboarding Parallel ${unique} ${index}`,\n      token: `integration-parallel-${index}-${randomUUID().replace(/-/g, '')}`,\n    }));\n\n    await Promise.all(tenants.map((tenant) => submitOnboarding(request, tenant)));\n\n    for (const tenant of tenants) {\n      tenant.requestId = await replaceVerificationToken(tenant.email, tenant.token);\n    }\n\n    const browserSessions = await Promise.all(\n      tenants.map(async (tenant) => {\n        const session = await verifyTenantInBrowser(browser, tenant.token);\n        tenant.tenantId = session.tenantId;\n        return session;\n      }),\n    );\n\n    try {\n      const statusResponses = await Promise.all(\n        tenants.flatMap((tenant) =>\n          Array.from({ length: 6 }, () => pollOnboardingStatus(request, tenant.tenantId!)),\n        ),\n      );\n      for (const response of statusResponses) {\n        expect(response.status(), 'status polling should not exhaust the app DB pool').toBe(200);\n      }\n\n      await Promise.all(tenants.map((tenant) => waitForPreparationComplete(tenant.requestId!)));\n      await Promise.all(\n        tenants.map((tenant, index) => loginAndAssertBackend(browserSessions[index], tenant)),\n      );\n    } finally {\n      await Promise.all(browserSessions.map((session) => session.context.close()));\n    }\n  });\n});\n"],
+  "mappings": "AAGA,SAAS,YAAY,kBAAkB;AACvC,SAAS,QAAQ,YAAkF;AACnG,SAAS,kBAAkB;AAEpB,MAAM,kBAAkB;AAAA,EAC7B,kBAAkB,CAAC,YAAY;AAAA,EAC/B,iBAAiB,CAAC,iCAAiC;AAAA,EACnD,oBAAoB,CAAC,4BAA4B,eAAe,mBAAmB,YAAY;AACjG;AAgBA,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AACjD,MAAM,sBAAsB;AAE5B,SAAS,UAAU,OAAuB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,eAAe,yBAAyB,OAAe,OAAgC;AACrF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,OAAO,UAAU,KAAK,CAAC;AAAA,IAC1B;AACA,WAAO,OAAO,UAAU,uCAAuC,KAAK,EAAE,EAAE,KAAK,CAAC;AAC9E,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAEA,eAAe,qBAAqB,WAGjC;AACD,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAI1B;AAAA;AAAA;AAAA,MAGA,CAAC,SAAS;AAAA,IACZ;AACA,WAAO,OAAO,UAAU,sBAAsB,SAAS,0BAA0B,EAAE,KAAK,CAAC;AACzF,WAAO,OAAO,KAAK,CAAC;AAAA,EACtB,CAAC;AACH;AAEA,eAAe,2BAA2B,WAAkC;AAC1E,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,YAAqE;AACzE,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,gBAAY,MAAM,qBAAqB,SAAS;AAChD,QAAI,UAAU,4BAA4B,CAAC,UAAU,uBAAwB;AAC7E,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,EACzD;AACA,SAAO,WAAW,wBAAwB,+DAA+D,EAAE,SAAS;AACpH,SAAO,WAAW,0BAA0B,uCAAuC,EAAE,WAAW;AAClG;AAEA,eAAe,iBAAiB,SAA4B,QAAyC;AACnG,QAAM,WAAW,MAAM,QAAQ,KAAK,GAAG,QAAQ,8BAA8B;AAAA,IAC3E,MAAM;AAAA,MACJ,OAAO,OAAO;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,MACV,kBAAkB,OAAO;AAAA,MACzB,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,uCAAuC,OAAO,KAAK,EAAE,EAAE,KAAK,GAAG;AAC3F;AAEA,eAAe,sBAAsB,SAAkB,OAAqE;AAC1H,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,SAAS,CAAC;AAC9D,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,kBAA4B,CAAC;AACnC,OAAK,GAAG,WAAW,CAAC,mBAAmB;AACrC,UAAM,MAAM,eAAe,IAAI;AAC/B,QAAI,IAAI,SAAS,2BAA2B,EAAG,iBAAgB,KAAK,GAAG;AAAA,EACzE,CAAC;AAED,QAAM,KAAK,KAAK,2CAA2C,mBAAmB,KAAK,CAAC,EAAE;AACtF,QAAM,OAAO,IAAI,EAAE,UAAU,4CAA4C;AACzE,QAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAC5E,QAAM,WAAW,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,aAAa,IAAI,QAAQ;AAC9D,SAAO,UAAU,0CAA0C,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,iBAAiB,SAAoB;AAC/D;AAEA,eAAe,qBAAqB,SAA4B,UAAkB;AAChF,SAAO,QAAQ,IAAI,GAAG,QAAQ,8CAA8C,mBAAmB,QAAQ,CAAC,IAAI;AAAA,IAC1G,SAAS;AAAA,MACP,QAAQ,mBAAmB,mBAAmB,QAAQ,CAAC;AAAA,IACzD;AAAA,EACF,CAAC;AACH;AAEA,eAAe,sBAAsB,SAA+B,QAAyC;AAC3G,SAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,EAAE,EAAE,WAAW;AACjF,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,IAAI,OAAO,mBAAmB,OAAO,QAAQ,EAAE,CAAC;AACrF,QAAM,OAAO,QAAQ,KAAK,QAAQ,2BAA2B,CAAC,EAAE,YAAY;AAC5E,QAAM,QAAQ,KAAK,WAAW,OAAO,EAAE,KAAK,OAAO,KAAK;AACxD,QAAM,QAAQ,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,mBAAmB;AACnF,QAAM,QAAQ,KAAK,UAAU,UAAU,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM;AAClE,QAAM,OAAO,QAAQ,MAAM,6BAA6B,OAAO,KAAK,iBAAiB,EAAE,UAAU,qBAAqB;AACtH,QAAM,OAAO,QAAQ,KAAK,UAAU,kBAAkB,CAAC,EAAE,YAAY,CAAC;AAEtE,QAAM,gBAAgB,MAAM,QAAQ,KAAK,SAAS,YAAY;AAC5D,UAAM,WAAW,MAAM,MAAM,qBAAqB,EAAE,aAAa,UAAU,CAAC;AAC5E,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,WAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK;AAAA,EACzC,CAAC;AACD,SAAO,cAAc,QAAQ,4BAA4B,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG;AAC/F,QAAM,UAAU,cAAc;AAC9B,SAAO,QAAQ,KAAK,EAAE,KAAK,OAAO,KAAK;AACvC,SAAO,QAAQ,KAAK,EAAE,UAAU,OAAO;AAEvC,QAAM,QAAQ,KAAK,KAAK,UAAU;AAClC,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,qBAAqB;AAC1D,SAAO,QAAQ,iBAAiB,6BAA6B,OAAO,KAAK,0BAA0B,EAAE,aAAa,CAAC;AACrH;AAEA,KAAK,SAAS,sDAAsD,MAAM;AACxE,OAAK,0GAA0G,OAAO;AAAA,IACpH;AAAA,IACA;AAAA,EACF,MAAM;AAGJ,SAAK,WAAW,IAAO;AACvB,UAAM,SAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,UAAM,UAA8B,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW;AAAA,MACzD,OAAO,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAChD,kBAAkB,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAC3D,OAAO,wBAAwB,KAAK,IAAI,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,IACxE,EAAE;AAEF,UAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,iBAAiB,SAAS,MAAM,CAAC,CAAC;AAE5E,eAAW,UAAU,SAAS;AAC5B,aAAO,YAAY,MAAM,yBAAyB,OAAO,OAAO,OAAO,KAAK;AAAA,IAC9E;AAEA,UAAM,kBAAkB,MAAM,QAAQ;AAAA,MACpC,QAAQ,IAAI,OAAO,WAAW;AAC5B,cAAM,UAAU,MAAM,sBAAsB,SAAS,OAAO,KAAK;AACjE,eAAO,WAAW,QAAQ;AAC1B,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,kBAAkB,MAAM,QAAQ;AAAA,QACpC,QAAQ;AAAA,UAAQ,CAAC,WACf,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,SAAS,OAAO,QAAS,CAAC;AAAA,QACjF;AAAA,MACF;AACA,iBAAW,YAAY,iBAAiB;AACtC,eAAO,SAAS,OAAO,GAAG,mDAAmD,EAAE,KAAK,GAAG;AAAA,MACzF;AAEA,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,2BAA2B,OAAO,SAAU,CAAC,CAAC;AACxF,YAAM,QAAQ;AAAA,QACZ,QAAQ,IAAI,CAAC,QAAQ,UAAU,sBAAsB,gBAAgB,KAAK,GAAG,MAAM,CAAC;AAAA,MACtF;AAAA,IACF,UAAE;AACA,YAAM,QAAQ,IAAI,gBAAgB,IAAI,CAAC,YAAY,QAAQ,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC7E;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/onboarding/api/get/onboarding/status.js

@@ -1,9 +1,14 @@
-import { NextResponse } from "next/server";
+import { after, NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from "@open-mercato/shared/lib/url";
+import { assertAllowedAppOrigin, mapSecurityEmailUrlError } from "@open-mercato/shared/lib/url";
 import { OnboardingService } from "@open-mercato/onboarding/modules/onboarding/lib/service";
 import { sendWorkspaceReadyEmail } from "@open-mercato/onboarding/modules/onboarding/lib/ready-email";
+import {
+  resolveProvisioningIds,
+  runDeferredProvisioning
+} from "@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning";
+import { isPreparationClaimActive } from "@open-mercato/onboarding/modules/onboarding/lib/preparation-claim";
 const metadata = {
   path: "/onboarding/onboarding/status",
   GET: {
@@ -42,9 +47,8 @@ async function GET(req) {
   if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {
     return NextResponse.json({ ok: false, error: "Not authorized for this tenant." }, { status: 403 });
   }
-  let baseUrl;
   try {
-    baseUrl = getSecurityEmailBaseUrl(req);
+    assertAllowedAppOrigin(req);
   } catch (error) {
     const mapped = mapSecurityEmailUrlError(error, {
       scope: "onboarding.status",
@@ -60,23 +64,37 @@ async function GET(req) {
   if (!request) {
     return NextResponse.json({ ok: false, error: "Onboarding request not found." }, { status: 404 });
   }
-  let emailSent = Boolean(request.readyEmailSentAt);
-  const ready = request.status === "completed" && Boolean(request.preparationCompletedAt);
-  const loginUrl = ready && request.tenantId ? `${baseUrl}/login?tenant=${encodeURIComponent(request.tenantId)}` : null;
-  if (ready && request.tenantId && !request.readyEmailSentAt) {
-    try {
-      emailSent = await sendWorkspaceReadyEmail({
+  const provisioningIds = resolveProvisioningIds(request);
+  if (provisioningIds && request.status === "processing") {
+    await service.markCompleted(request, provisioningIds);
+  }
+  if (provisioningIds && request.status === "completed" && !request.preparationCompletedAt && !isPreparationClaimActive(request.preparationStartedAt)) {
+    after(async () => {
+      await runDeferredProvisioning({
         requestId: request.id,
-        tenantId: request.tenantId
+        tenantId: provisioningIds.tenantId,
+        organizationId: provisioningIds.organizationId
       });
-    } catch (error) {
-      console.error("[onboarding.status] ready email retry failed", {
+    });
+  }
+  const emailSent = Boolean(request.readyEmailSentAt);
+  const ready = request.status === "completed" && Boolean(request.preparationCompletedAt);
+  const loginUrl = ready && request.tenantId ? `/login?tenant=${encodeURIComponent(request.tenantId)}` : null;
+  if (ready && request.tenantId && !request.readyEmailSentAt) {
+    const readyTenantId = request.tenantId;
+    after(async () => {
+      await sendWorkspaceReadyEmail({
         requestId: request.id,
-        tenantId: request.tenantId,
-        organizationId: request.organizationId,
-        error
+        tenantId: readyTenantId
+      }).catch((error) => {
+        console.error("[onboarding.status] ready email retry failed", {
+          requestId: request.id,
+          tenantId: readyTenantId,
+          organizationId: request.organizationId,
+          error
+        });
       });
-    }
+    });
   }
   return NextResponse.json({
     ok: true,

package/dist/modules/onboarding/api/get/onboarding/status.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/onboarding/api/get/onboarding/status.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/status',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst ONBOARDING_LOGIN_TENANT_COOKIE = 'om_login_tenant'\n\nconst onboardingStatusQuerySchema = z.object({\n  tenantId: z.string().uuid(),\n})\n\nfunction readCookie(req: Request, name: string): string | null {\n  const header = req.headers.get('cookie')\n  if (!header) return null\n  for (const part of header.split(';')) {\n    const separatorIndex = part.indexOf('=')\n    if (separatorIndex === -1) continue\n    const key = part.slice(0, separatorIndex).trim()\n    if (key !== name) continue\n    const rawValue = part.slice(separatorIndex + 1).trim()\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n  return null\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''\n  const parsed = onboardingStatusQuerySchema.safeParse({ tenantId })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })\n  }\n\n  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE)\n  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Not authorized for this tenant.' }, { status: 403 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'onboarding.status',\n      configMessage: 'Onboarding status is not configured.',\n    })\n    if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n    throw error\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findLatestByTenantId(parsed.data.tenantId)\n  if (!request) {\n    return NextResponse.json({ ok: false, error: 'Onboarding request not found.' }, { status: 404 })\n  }\n\n  let emailSent = Boolean(request.readyEmailSentAt)\n  const ready = request.status === 'completed' && Boolean(request.preparationCompletedAt)\n  const loginUrl = ready && request.tenantId ? `${baseUrl}/login?tenant=${encodeURIComponent(request.tenantId)}` : null\n\n  if (ready && request.tenantId && !request.readyEmailSentAt) {\n    try {\n      emailSent = await sendWorkspaceReadyEmail({\n        requestId: request.id,\n        tenantId: request.tenantId,\n      })\n    } catch (error) {\n      console.error('[onboarding.status] ready email retry failed', {\n        requestId: request.id,\n        tenantId: request.tenantId,\n        organizationId: request.organizationId,\n        error,\n      })\n    }\n  }\n\n  return NextResponse.json({\n    ok: true,\n    status: request.status,\n    ready,\n    emailSent,\n    tenantId: request.tenantId ?? parsed.data.tenantId,\n    loginUrl,\n  })\n}\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingStatusSuccessSchema = z.object({\n  ok: z.literal(true),\n  status: z.enum(['pending', 'processing', 'completed', 'expired']),\n  ready: z.boolean(),\n  emailSent: z.boolean(),\n  tenantId: z.string().uuid(),\n  loginUrl: z.string().nullable(),\n})\n\nconst onboardingStatusErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst onboardingStatusDoc: OpenApiMethodDoc = {\n  summary: 'Get onboarding preparation status',\n  description: 'Resolves whether a tenant workspace finished deferred onboarding preparation and can be opened.',\n  tags: [onboardingTag],\n  query: onboardingStatusQuerySchema,\n  responses: [\n    { status: 200, description: 'Onboarding status resolved.', schema: onboardingStatusSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },\n    { status: 403, description: 'Caller is not authorized for this tenant.', schema: onboardingStatusErrorSchema },\n    { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },\n    { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding preparation status',\n  methods: {\n    GET: onboardingStatusDoc,\n  },\n}\n\nexport default GET\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,iCAAiC;AAEvC,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,SAAS,WAAW,KAAc,MAA6B;AAC7D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,iBAAiB,KAAK,QAAQ,GAAG;AACvC,QAAI,mBAAmB,GAAI;AAC3B,UAAM,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,KAAK;AAC/C,QAAI,QAAQ,KAAM;AAClB,UAAM,WAAW,KAAK,MAAM,iBAAiB,CAAC,EAAE,KAAK;AACrD,QAAI;AACF,aAAO,mBAAmB,QAAQ;AAAA,IACpC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,aAAa,IAAI,QAAQ,KAAK;AACvF,QAAM,SAAS,4BAA4B,UAAU,EAAE,SAAS,CAAC;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,oBAAoB,WAAW,KAAK,8BAA8B;AACxE,MAAI,CAAC,qBAAqB,sBAAsB,OAAO,KAAK,UAAU;AACpE,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,UAAM;AAAA,EACR;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,qBAAqB,OAAO,KAAK,QAAQ;AACvE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AAEA,MAAI,YAAY,QAAQ,QAAQ,gBAAgB;AAChD,QAAM,QAAQ,QAAQ,WAAW,eAAe,QAAQ,QAAQ,sBAAsB;AACtF,QAAM,WAAW,SAAS,QAAQ,WAAW,GAAG,OAAO,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC,KAAK;AAEjH,MAAI,SAAS,QAAQ,YAAY,CAAC,QAAQ,kBAAkB;AAC1D,QAAI;AACF,kBAAY,MAAM,wBAAwB;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,gDAAgD;AAAA,QAC5D,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC1C;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB;AAEtB,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,KAAK,CAAC,WAAW,cAAc,aAAa,SAAS,CAAC;AAAA,EAChE,OAAO,EAAE,QAAQ;AAAA,EACjB,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,8BAA8B;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,IACxG,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,4BAA4B;AAAA,IAC7G,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,4BAA4B;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,EAC1G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;AAEA,IAAO,iBAAQ;",
+  "sourcesContent": ["import { after, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { assertAllowedAppOrigin, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport {\n  resolveProvisioningIds,\n  runDeferredProvisioning,\n} from '@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning'\nimport { isPreparationClaimActive } from '@open-mercato/onboarding/modules/onboarding/lib/preparation-claim'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/status',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst ONBOARDING_LOGIN_TENANT_COOKIE = 'om_login_tenant'\n\nconst onboardingStatusQuerySchema = z.object({\n  tenantId: z.string().uuid(),\n})\n\nfunction readCookie(req: Request, name: string): string | null {\n  const header = req.headers.get('cookie')\n  if (!header) return null\n  for (const part of header.split(';')) {\n    const separatorIndex = part.indexOf('=')\n    if (separatorIndex === -1) continue\n    const key = part.slice(0, separatorIndex).trim()\n    if (key !== name) continue\n    const rawValue = part.slice(separatorIndex + 1).trim()\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n  return null\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''\n  const parsed = onboardingStatusQuerySchema.safeParse({ tenantId })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })\n  }\n\n  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE)\n  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Not authorized for this tenant.' }, { status: 403 })\n  }\n\n  try {\n    assertAllowedAppOrigin(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'onboarding.status',\n      configMessage: 'Onboarding status is not configured.',\n    })\n    if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n    throw error\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findLatestByTenantId(parsed.data.tenantId)\n  if (!request) {\n    return NextResponse.json({ ok: false, error: 'Onboarding request not found.' }, { status: 404 })\n  }\n\n  const provisioningIds = resolveProvisioningIds(request)\n  if (provisioningIds && request.status === 'processing') {\n    await service.markCompleted(request, provisioningIds)\n  }\n  // Schedule deferred provisioning only while no runner holds a fresh claim \u2014\n  // otherwise every ~1s poll piles another full seed + reindex chain onto the\n  // connection pool. The atomic claim inside runDeferredProvisioning remains\n  // the authoritative gate; this check just keeps polls cheap.\n  if (\n    provisioningIds &&\n    request.status === 'completed' &&\n    !request.preparationCompletedAt &&\n    !isPreparationClaimActive(request.preparationStartedAt)\n  ) {\n    after(async () => {\n      await runDeferredProvisioning({\n        requestId: request.id,\n        tenantId: provisioningIds.tenantId,\n        organizationId: provisioningIds.organizationId,\n      })\n    })\n  }\n\n  const emailSent = Boolean(request.readyEmailSentAt)\n  const ready = request.status === 'completed' && Boolean(request.preparationCompletedAt)\n  const loginUrl = ready && request.tenantId ? `/login?tenant=${encodeURIComponent(request.tenantId)}` : null\n\n  if (ready && request.tenantId && !request.readyEmailSentAt) {\n    const readyTenantId = request.tenantId\n    after(async () => {\n      await sendWorkspaceReadyEmail({\n        requestId: request.id,\n        tenantId: readyTenantId,\n      }).catch((error) => {\n        console.error('[onboarding.status] ready email retry failed', {\n          requestId: request.id,\n          tenantId: readyTenantId,\n          organizationId: request.organizationId,\n          error,\n        })\n      })\n    })\n  }\n\n  return NextResponse.json({\n    ok: true,\n    status: request.status,\n    ready,\n    emailSent,\n    tenantId: request.tenantId ?? parsed.data.tenantId,\n    loginUrl,\n  })\n}\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingStatusSuccessSchema = z.object({\n  ok: z.literal(true),\n  status: z.enum(['pending', 'processing', 'completed', 'expired']),\n  ready: z.boolean(),\n  emailSent: z.boolean(),\n  tenantId: z.string().uuid(),\n  loginUrl: z.string().nullable(),\n})\n\nconst onboardingStatusErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst onboardingStatusDoc: OpenApiMethodDoc = {\n  summary: 'Get onboarding preparation status',\n  description: 'Resolves whether a tenant workspace finished deferred onboarding preparation and can be opened.',\n  tags: [onboardingTag],\n  query: onboardingStatusQuerySchema,\n  responses: [\n    { status: 200, description: 'Onboarding status resolved.', schema: onboardingStatusSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },\n    { status: 403, description: 'Caller is not authorized for this tenant.', schema: onboardingStatusErrorSchema },\n    { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },\n    { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding preparation status',\n  methods: {\n    GET: onboardingStatusDoc,\n  },\n}\n\nexport default GET\n"],
+  "mappings": "AAAA,SAAS,OAAO,oBAAoB;AACpC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,wBAAwB,gCAAgC;AACjE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gCAAgC;AAGlC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,iCAAiC;AAEvC,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,SAAS,WAAW,KAAc,MAA6B;AAC7D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,iBAAiB,KAAK,QAAQ,GAAG;AACvC,QAAI,mBAAmB,GAAI;AAC3B,UAAM,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,KAAK;AAC/C,QAAI,QAAQ,KAAM;AAClB,UAAM,WAAW,KAAK,MAAM,iBAAiB,CAAC,EAAE,KAAK;AACrD,QAAI;AACF,aAAO,mBAAmB,QAAQ;AAAA,IACpC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,aAAa,IAAI,QAAQ,KAAK;AACvF,QAAM,SAAS,4BAA4B,UAAU,EAAE,SAAS,CAAC;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,oBAAoB,WAAW,KAAK,8BAA8B;AACxE,MAAI,CAAC,qBAAqB,sBAAsB,OAAO,KAAK,UAAU;AACpE,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,MAAI;AACF,2BAAuB,GAAG;AAAA,EAC5B,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,qBAAqB,OAAO,KAAK,QAAQ;AACvE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AAEA,QAAM,kBAAkB,uBAAuB,OAAO;AACtD,MAAI,mBAAmB,QAAQ,WAAW,cAAc;AACtD,UAAM,QAAQ,cAAc,SAAS,eAAe;AAAA,EACtD;AAKA,MACE,mBACA,QAAQ,WAAW,eACnB,CAAC,QAAQ,0BACT,CAAC,yBAAyB,QAAQ,oBAAoB,GACtD;AACA,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU,gBAAgB;AAAA,QAC1B,gBAAgB,gBAAgB;AAAA,MAClC,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,QAAQ,QAAQ,gBAAgB;AAClD,QAAM,QAAQ,QAAQ,WAAW,eAAe,QAAQ,QAAQ,sBAAsB;AACtF,QAAM,WAAW,SAAS,QAAQ,WAAW,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC,KAAK;AAEvG,MAAI,SAAS,QAAQ,YAAY,CAAC,QAAQ,kBAAkB;AAC1D,UAAM,gBAAgB,QAAQ;AAC9B,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,MACZ,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,gBAAQ,MAAM,gDAAgD;AAAA,UAC5D,WAAW,QAAQ;AAAA,UACnB,UAAU;AAAA,UACV,gBAAgB,QAAQ;AAAA,UACxB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC1C;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB;AAEtB,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,KAAK,CAAC,WAAW,cAAc,aAAa,SAAS,CAAC;AAAA,EAChE,OAAO,EAAE,QAAQ;AAAA,EACjB,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,8BAA8B;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,IACxG,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,4BAA4B;AAAA,IAC7G,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,4BAA4B;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,EAC1G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;AAEA,IAAO,iBAAQ;",
   "names": []
 }