@open-mercato/shared 0.6.6-develop.6551.1.1511bfa890 → 0.6.6

package/src/lib/crud/factory.ts

@@ -510,14 +510,6 @@ function json(data: any, init?: ResponseInit) {
   })
 }
 
-// Name of the selected-organization cookie (mirrors the directory module's
-// OrganizationSwitcher, which writes `om_selected_org=...; path=/; samesite=lax`).
-// Kept as a local literal so shared has no import dependency on a domain package.
-const SELECTED_ORG_COOKIE = 'om_selected_org'
-// Set-Cookie value that expires the stale selection so the next request falls
-// back to the caller's home org. Attributes mirror how the switcher sets it.
-const CLEAR_SELECTED_ORG_COOKIE = `${SELECTED_ORG_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax`
-
 function attachOperationHeader(res: Response, logEntry: any) {
   if (!res || !(res instanceof Response)) return res
   if (!logEntry || typeof logEntry !== 'object') return res
@@ -1347,42 +1339,6 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
     return { container, auth: scopedAuth, organizationScope: scope, selectedOrganizationId, organizationIds, request }
   }
 
-  // The caller explicitly selected an organization (selected-org cookie) that no
-  // longer resolves to a real, accessible org — e.g. a stale cookie after a DB
-  // reset, or after the caller lost access to that org. Rather than silently
-  // acting against a fallback org the caller did not select (writes) or showing
-  // a different org's data than the one selected (reads), fail loud on every
-  // org-scoped record operation so the client re-selects. Recovery surfaces
-  // (org switcher, nav, profile) are custom routes, not this factory, so they
-  // keep working. Returns a 422 Response when rejected, otherwise null.
-  function rejectInvalidOrgSelection(ctx: CrudCtx, action: 'list' | 'create' | 'update' | 'delete'): Response | null {
-    if (!ormCfg.orgField) return null
-    if (!(ctx.organizationScope as OrganizationScope | null | undefined)?.selectionRejected) return null
-    logForbidden({
-      resourceKind,
-      action,
-      reason: 'organization_selection_invalid',
-      userId: ctx.auth?.sub ?? null,
-      tenantId: ctx.auth?.tenantId ?? null,
-      organizationIds: ctx.organizationIds,
-    })
-    // Self-heal reads: expire the stale selected-org cookie so the caller's next
-    // request falls back to their home org and the session recovers on its own
-    // (important for single-org users, who have no org switcher to re-select
-    // from). Writes intentionally do NOT clear it — a mutation must go through an
-    // explicit, valid re-selection, never silently target a fallback org.
-    const headers: Record<string, string> = action === 'list'
-      ? { 'set-cookie': CLEAR_SELECTED_ORG_COOKIE }
-      : {}
-    return json(
-      {
-        error: 'Your selected organization is no longer available. Please re-select an organization and try again.',
-        code: 'organization_selection_invalid',
-      },
-      { status: 422, headers },
-    )
-  }
-
   async function GET(request: Request) {
     const profiler = createCrudProfiler(resourceKind, 'list')
     const requestMeta: Record<string, unknown> = { method: request.method }
@@ -1410,11 +1366,6 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         finishProfile({ reason: 'unauthorized' })
         return json({ error: 'Unauthorized' }, { status: 401 })
       }
-      const listSelectionRejected = rejectInvalidOrgSelection(ctx, 'list')
-      if (listSelectionRejected) {
-        finishProfile({ reason: 'organization_selection_invalid' })
-        return listSelectionRejected
-      }
       if (!opts.list) {
         finishProfile({ reason: 'list_not_configured' })
         return json({ error: 'Not implemented' }, { status: 501 })
@@ -2081,8 +2032,6 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (!opts.create && !useCommand) return json({ error: 'Not implemented' }, { status: 501 })
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
-      const createSelectionRejected = rejectInvalidOrgSelection(ctx, 'create')
-      if (createSelectionRejected) return createSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -2353,8 +2302,6 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (!opts.update && !useCommand) return json({ error: 'Not implemented' }, { status: 501 })
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
-      const updateSelectionRejected = rejectInvalidOrgSelection(ctx, 'update')
-      if (updateSelectionRejected) return updateSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -2684,8 +2631,6 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
     try {
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
-      const deleteSelectionRejected = rejectInvalidOrgSelection(ctx, 'delete')
-      if (deleteSelectionRejected) return deleteSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,

package/src/lib/location/countries.ts

@@ -28,18 +28,9 @@ const RAW_COUNTRIES: IsoCountry[] = (registry as RegistryEntry[])
     name: entry.Description.join(', '),
   }))
 
-// Codes in common use that the language-subtag registry does not list as region subtags.
-// XK is user-assigned rather than ISO 3166-1 assigned, so it never appears in the registry.
-const SUPPLEMENTAL_COUNTRIES: IsoCountry[] = [
-  { code: 'XK', name: 'Kosovo' },
-]
-
-const RAW_COUNTRY_CODES = new Set(RAW_COUNTRIES.map((entry) => entry.code))
-
-export const ISO_COUNTRIES: IsoCountry[] = [
-  ...RAW_COUNTRIES,
-  ...SUPPLEMENTAL_COUNTRIES.filter((entry) => !RAW_COUNTRY_CODES.has(entry.code)),
-].sort((a, b) => a.name.localeCompare(b.name, 'en', { sensitivity: 'base' }))
+export const ISO_COUNTRIES: IsoCountry[] = [...RAW_COUNTRIES].sort((a, b) =>
+  a.name.localeCompare(b.name, 'en', { sensitivity: 'base' })
+)
 
 export const COUNTRY_PRIORITY: string[] = ['PL', 'DE', 'ES', 'FR', 'IT', 'US', 'GB', 'CA']
 
@@ -67,9 +58,7 @@ export function resolveCountryName(code: string, options: { locale?: string } =
   if (!displayNames) return fallback
   try {
     const label = displayNames.of(normalized as any)
-    // Intl echoes the raw code back when its ICU data cannot resolve the region.
-    if (typeof label !== 'string' || label === normalized) return fallback
-    return label
+    return typeof label === 'string' ? label : fallback
   } catch {
     return fallback
   }

package/src/lib/network.ts

@@ -80,39 +80,12 @@ export function isPrivateIPv6(address: string): boolean {
   if (isIPv4CompatibleIPv6(segments)) return true
 
   const embedded = embeddedIPv4FromIPv6(segments)
-  if (embedded) return isPrivateIPv4(embedded)
+  if (embedded && isPrivateIPv4(embedded)) return true
 
   const [a] = segments
   if ((a & 0xfe00) === 0xfc00) return true
   if ((a & 0xffc0) === 0xfe80) return true
   if ((a & 0xff00) === 0xff00) return true
-  if (
-    a === 0x0100 &&
-    segments[1] === 0 &&
-    segments[2] === 0 &&
-    segments[3] === 0
-  ) {
-    return true
-  }
-  if (a === 0x2001 && (segments[1] & 0xfe00) === 0) {
-    return !isGloballyReachableIetfProtocolAssignment(segments)
-  }
-  if (a === 0x2001 && segments[1] === 0x0db8) return true
-  if ((a & 0xfff0) === 0x3ff0) return true
-  // Except for the explicitly handled IPv4 translation ranges above, globally
-  // routable unicast IPv6 addresses are allocated from 2000::/3.
-  if ((a & 0xe000) !== 0x2000) return true
-  return false
-}
-
-function isGloballyReachableIetfProtocolAssignment(segments: number[]): boolean {
-  const [, b, c, d, e, f, g, h] = segments
-  const trailingZero = c === 0 && d === 0 && e === 0 && f === 0 && g === 0
-  if (b === 0x0001 && trailingZero && h >= 1 && h <= 3) return true
-  if (b === 0x0003) return true
-  if (b === 0x0004 && c === 0x0112) return true
-  if ((b & 0xfff0) === 0x0020) return true
-  if ((b & 0xfff0) === 0x0030) return true
   return false
 }
 

package/src/lib/string.ts

@@ -6,11 +6,3 @@ export function trimToUndefined(value: unknown): string | undefined {
   return trimmed.length > 0 ? trimmed : undefined
 }
 
-export function parseCommaSeparatedList(value: string | null | undefined): string[] {
-  if (typeof value !== 'string') return []
-  return value
-    .split(',')
-    .map((entry) => entry.trim())
-    .filter(Boolean)
-}
-

package/src/lib/url-safety.ts

@@ -1,6 +1,6 @@
 import { lookup } from 'node:dns/promises'
 import { isIP } from 'node:net'
-import { Agent, fetch as undiciFetch, type Dispatcher } from 'undici'
+import { Agent, type Dispatcher } from 'undici'
 import { isBlockedHostname, isPrivateIpAddress } from './network'
 
 export type UrlSafetyReason =
@@ -102,8 +102,6 @@ export function assertStaticallySafeOutboundUrl(
 
 export type AssertSafeOutboundUrlOptions = AssertStaticUrlOptions & {
   lookupHost?: HostLookup
-  /** Resolve and return DNS answers even when private addresses are explicitly allowed. */
-  pinAllowedPrivate?: boolean
 }
 
 export async function assertSafeOutboundUrl(
@@ -120,8 +118,7 @@ export type ResolveSafeOutboundUrlResult = {
   hostname: string
   /**
    * The validated DNS records, in lookup order. `null` when the hostname is an IP literal
-   * (no DNS lookup performed) or when `allowPrivate` short-circuited validation without
-   * `pinAllowedPrivate`.
+   * (no DNS lookup performed) or when `allowPrivate` short-circuited validation.
    */
   addresses: ReadonlyArray<ResolvedHostAddress> | null
 }
@@ -139,16 +136,14 @@ export async function resolveSafeOutboundUrl(
   const subject = options.subject ?? 'URL'
   const factory = options.errorFactory ?? defaultErrorFactory
   const { url, hostname } = parseOutboundUrl(rawUrl, options)
-  if (options.allowPrivate && !options.pinAllowedPrivate) {
-    return { url, hostname, addresses: null }
-  }
+  if (options.allowPrivate) return { url, hostname, addresses: null }
 
-  if (!options.allowPrivate && isBlockedHostname(hostname)) {
+  if (isBlockedHostname(hostname)) {
     throw factory('blocked_hostname', `${subject} host "${hostname}" is not allowed`)
   }
 
   if (isIP(hostname)) {
-    if (!options.allowPrivate && isPrivateIpAddress(hostname)) {
+    if (isPrivateIpAddress(hostname)) {
       throw factory(
         'private_ip_literal',
         `${subject} host "${hostname}" resolves to a private or reserved IP range`,
@@ -184,7 +179,7 @@ export async function resolveSafeOutboundUrl(
   }
 
   for (const record of addresses) {
-    if (!options.allowPrivate && isPrivateIpAddress(record.address)) {
+    if (isPrivateIpAddress(record.address)) {
       throw factory(
         'private_ip_resolved',
         `${subject} host "${hostname}" resolves to a private or reserved IP address (${record.address})`,
@@ -202,23 +197,16 @@ export type SafeOutboundFetchOptions = AssertSafeOutboundUrlOptions & {
    * not actually open sockets, so DNS pinning is unnecessary and would just complicate mocking.
    */
   fetchImpl?: typeof fetch
-  /** Test seam for the dispatcher-compatible fetch used by DNS-pinned requests. */
-  pinnedFetchImpl?: PinnedFetch
 }
 
-export type PinnedFetch = (
-  rawUrl: string,
-  init: RequestInit & { dispatcher: Dispatcher },
-) => Promise<Response>
-
 /**
  * Validates an outbound URL and performs `fetch()` with the connection pinned to a
  * pre-validated IP address, so DNS cannot be re-resolved between validation and connect
  * (DNS rebinding). Always defaults to `redirect: 'manual'` — callers MUST decide what to
  * do with 3xx responses (re-validate the redirect target before following).
  *
- * For IP literal hosts no DNS pinning is performed because there is no DNS lookup to defeat.
- * Callers that allow private hostnames can set `pinAllowedPrivate` to retain DNS pinning.
+ * For IP literal hosts and `allowPrivate=true`, no DNS pinning is performed because there
+ * is no DNS lookup to defeat.
  */
 export async function safeOutboundFetch(
   rawUrl: string,
@@ -249,8 +237,9 @@ export async function safeOutboundFetch(
   })
 
   try {
-    const pinnedFetch = options.pinnedFetchImpl ?? (undiciFetch as unknown as PinnedFetch)
-    return await pinnedFetch(rawUrl, { ...mergedInit, dispatcher })
+    return await globalThis.fetch(rawUrl, { ...mergedInit, dispatcher } as RequestInit & {
+      dispatcher: Dispatcher
+    })
   } finally {
     dispatcher.close().catch(() => {})
   }
@@ -258,12 +247,8 @@ export async function safeOutboundFetch(
 
 export type PinnedDnsLookup = (
   host: string,
-  opts: { all?: boolean },
-  cb: (
-    err: NodeJS.ErrnoException | null,
-    address: string | ResolvedHostAddress[],
-    family?: number,
-  ) => void,
+  opts: unknown,
+  cb: (err: NodeJS.ErrnoException | null, address: string, family: number) => void,
 ) => void
 
 /**
@@ -276,7 +261,7 @@ export function createPinnedDnsLookup(
   expectedHostname: string,
   pinned: ResolvedHostAddress,
 ): PinnedDnsLookup {
-  return (host, opts, cb) => {
+  return (host, _opts, cb) => {
     if (host !== expectedHostname) {
       const err: NodeJS.ErrnoException = new Error(
         `Refusing DNS lookup for unexpected host "${host}" (expected "${expectedHostname}")`,
@@ -285,10 +270,6 @@ export function createPinnedDnsLookup(
       cb(err, '', 0)
       return
     }
-    if (opts.all) {
-      cb(null, [pinned])
-      return
-    }
     cb(null, pinned.address, pinned.family)
   }
 }

package/src/modules/payment_gateways/types.ts

@@ -117,8 +117,6 @@ export type PaymentGatewayClientSession =
 export interface CreateSessionInput {
   orderId?: string
   paymentId: string
-  /** Stable operation key for provider-native session creation idempotency. */
-  idempotencyKey?: string
   tenantId: string
   organizationId: string
   amount: number

package/src/lib/__tests__/string.test.ts

@@ -1,49 +0,0 @@
-import { parseCommaSeparatedList, trimToUndefined } from '../string'
-
-describe('parseCommaSeparatedList', () => {
-  it('splits a comma-separated string into entries', () => {
-    expect(parseCommaSeparatedList('low,medium,high')).toEqual(['low', 'medium', 'high'])
-  })
-
-  it('trims surrounding whitespace from every entry', () => {
-    expect(parseCommaSeparatedList(' admin ,  editor,viewer  ')).toEqual(['admin', 'editor', 'viewer'])
-  })
-
-  it('drops empty entries produced by repeated or trailing separators', () => {
-    expect(parseCommaSeparatedList('a,,b,')).toEqual(['a', 'b'])
-    expect(parseCommaSeparatedList(',a, ,b')).toEqual(['a', 'b'])
-  })
-
-  it('returns an empty array when every entry is blank', () => {
-    expect(parseCommaSeparatedList(',,')).toEqual([])
-    expect(parseCommaSeparatedList('  ,  ')).toEqual([])
-  })
-
-  it('returns an empty array for blank or non-string inputs', () => {
-    expect(parseCommaSeparatedList('')).toEqual([])
-    expect(parseCommaSeparatedList('   ')).toEqual([])
-    expect(parseCommaSeparatedList(null)).toEqual([])
-    expect(parseCommaSeparatedList(undefined)).toEqual([])
-  })
-
-  it('returns a single entry when the input has no separator', () => {
-    expect(parseCommaSeparatedList('admin')).toEqual(['admin'])
-    expect(parseCommaSeparatedList('  admin  ')).toEqual(['admin'])
-  })
-
-  it('preserves interior whitespace within an entry', () => {
-    expect(parseCommaSeparatedList('order created, order shipped')).toEqual(['order created', 'order shipped'])
-  })
-})
-
-describe('trimToUndefined', () => {
-  it('returns the trimmed value when it is a non-blank string', () => {
-    expect(trimToUndefined('  value  ')).toBe('value')
-  })
-
-  it('returns undefined for blank or non-string values', () => {
-    expect(trimToUndefined('   ')).toBeUndefined()
-    expect(trimToUndefined(null)).toBeUndefined()
-    expect(trimToUndefined(42)).toBeUndefined()
-  })
-})

package/src/lib/location/__tests__/countries.test.ts

@@ -1,82 +0,0 @@
-import {
-  COUNTRY_PRIORITY,
-  ISO_COUNTRIES,
-  buildCountryOptions,
-  resolveCountryName,
-} from '../countries'
-
-describe('ISO_COUNTRIES', () => {
-  it('includes Kosovo, which the language-subtag registry does not list', () => {
-    const kosovo = ISO_COUNTRIES.filter((entry) => entry.code === 'XK')
-    expect(kosovo).toEqual([{ code: 'XK', name: 'Kosovo' }])
-  })
-
-  it('does not duplicate any country code', () => {
-    const codes = ISO_COUNTRIES.map((entry) => entry.code)
-    expect(codes).toHaveLength(new Set(codes).size)
-  })
-
-  it('keeps registry-derived countries intact', () => {
-    expect(ISO_COUNTRIES).toEqual(
-      expect.arrayContaining([
-        { code: 'PL', name: 'Poland' },
-        { code: 'DE', name: 'Germany' },
-      ])
-    )
-  })
-
-  it('stays sorted by name', () => {
-    const names = ISO_COUNTRIES.map((entry) => entry.name)
-    const sorted = [...names].sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' }))
-    expect(names).toEqual(sorted)
-  })
-})
-
-describe('resolveCountryName', () => {
-  it('resolves Kosovo for XK', () => {
-    expect(resolveCountryName('XK')).toBe('Kosovo')
-  })
-
-  it('resolves Kosovo for a lowercase xk', () => {
-    expect(resolveCountryName('xk')).toBe('Kosovo')
-  })
-
-  it('still resolves registry-backed countries', () => {
-    expect(resolveCountryName('PL')).toBe('Poland')
-  })
-
-  it('falls back to the raw code for an unknown region', () => {
-    expect(resolveCountryName('ZZZ')).toBe('ZZZ')
-  })
-})
-
-describe('buildCountryOptions', () => {
-  it('offers Kosovo as a selectable option', () => {
-    const options = buildCountryOptions()
-    expect(options).toEqual(expect.arrayContaining([{ code: 'XK', label: 'Kosovo' }]))
-  })
-
-  it('offers exactly one Kosovo option', () => {
-    const options = buildCountryOptions().filter((option) => option.code === 'XK')
-    expect(options).toHaveLength(1)
-  })
-
-  it('lists Kosovo after the prioritized countries', () => {
-    const options = buildCountryOptions()
-    const kosovoIndex = options.findIndex((option) => option.code === 'XK')
-    expect(kosovoIndex).toBeGreaterThanOrEqual(COUNTRY_PRIORITY.length)
-  })
-
-  it('keeps the prioritized countries at the top', () => {
-    const options = buildCountryOptions()
-    const leading = options.slice(0, COUNTRY_PRIORITY.length).map((option) => option.code)
-    expect(leading.slice().sort()).toEqual(COUNTRY_PRIORITY.slice().sort())
-  })
-
-  it('applies transformLabel to the supplemental country too', () => {
-    const options = buildCountryOptions({
-      transformLabel: (code, defaultLabel) => `${defaultLabel} (${code})`,
-    })
-    expect(options).toEqual(expect.arrayContaining([{ code: 'XK', label: 'Kosovo (XK)' }]))
-  })
-})