@open-mercato/shared 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/lib/crud/factory.ts

@@ -510,6 +510,14 @@ function json(data: any, init?: ResponseInit) {
   })
 }
 
+// Name of the selected-organization cookie (mirrors the directory module's
+// OrganizationSwitcher, which writes `om_selected_org=...; path=/; samesite=lax`).
+// Kept as a local literal so shared has no import dependency on a domain package.
+const SELECTED_ORG_COOKIE = 'om_selected_org'
+// Set-Cookie value that expires the stale selection so the next request falls
+// back to the caller's home org. Attributes mirror how the switcher sets it.
+const CLEAR_SELECTED_ORG_COOKIE = `${SELECTED_ORG_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax`
+
 function attachOperationHeader(res: Response, logEntry: any) {
   if (!res || !(res instanceof Response)) return res
   if (!logEntry || typeof logEntry !== 'object') return res
@@ -1339,6 +1347,42 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
     return { container, auth: scopedAuth, organizationScope: scope, selectedOrganizationId, organizationIds, request }
   }
 
+  // The caller explicitly selected an organization (selected-org cookie) that no
+  // longer resolves to a real, accessible org — e.g. a stale cookie after a DB
+  // reset, or after the caller lost access to that org. Rather than silently
+  // acting against a fallback org the caller did not select (writes) or showing
+  // a different org's data than the one selected (reads), fail loud on every
+  // org-scoped record operation so the client re-selects. Recovery surfaces
+  // (org switcher, nav, profile) are custom routes, not this factory, so they
+  // keep working. Returns a 422 Response when rejected, otherwise null.
+  function rejectInvalidOrgSelection(ctx: CrudCtx, action: 'list' | 'create' | 'update' | 'delete'): Response | null {
+    if (!ormCfg.orgField) return null
+    if (!(ctx.organizationScope as OrganizationScope | null | undefined)?.selectionRejected) return null
+    logForbidden({
+      resourceKind,
+      action,
+      reason: 'organization_selection_invalid',
+      userId: ctx.auth?.sub ?? null,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationIds: ctx.organizationIds,
+    })
+    // Self-heal reads: expire the stale selected-org cookie so the caller's next
+    // request falls back to their home org and the session recovers on its own
+    // (important for single-org users, who have no org switcher to re-select
+    // from). Writes intentionally do NOT clear it — a mutation must go through an
+    // explicit, valid re-selection, never silently target a fallback org.
+    const headers: Record<string, string> = action === 'list'
+      ? { 'set-cookie': CLEAR_SELECTED_ORG_COOKIE }
+      : {}
+    return json(
+      {
+        error: 'Your selected organization is no longer available. Please re-select an organization and try again.',
+        code: 'organization_selection_invalid',
+      },
+      { status: 422, headers },
+    )
+  }
+
   async function GET(request: Request) {
     const profiler = createCrudProfiler(resourceKind, 'list')
     const requestMeta: Record<string, unknown> = { method: request.method }
@@ -1366,6 +1410,11 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         finishProfile({ reason: 'unauthorized' })
         return json({ error: 'Unauthorized' }, { status: 401 })
       }
+      const listSelectionRejected = rejectInvalidOrgSelection(ctx, 'list')
+      if (listSelectionRejected) {
+        finishProfile({ reason: 'organization_selection_invalid' })
+        return listSelectionRejected
+      }
       if (!opts.list) {
         finishProfile({ reason: 'list_not_configured' })
         return json({ error: 'Not implemented' }, { status: 501 })
@@ -2032,6 +2081,8 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (!opts.create && !useCommand) return json({ error: 'Not implemented' }, { status: 501 })
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
+      const createSelectionRejected = rejectInvalidOrgSelection(ctx, 'create')
+      if (createSelectionRejected) return createSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -2302,6 +2353,8 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (!opts.update && !useCommand) return json({ error: 'Not implemented' }, { status: 501 })
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
+      const updateSelectionRejected = rejectInvalidOrgSelection(ctx, 'update')
+      if (updateSelectionRejected) return updateSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,
@@ -2631,6 +2684,8 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
     try {
       const ctx = await withCtx(request)
       if (!ctx.auth) return json({ error: 'Unauthorized' }, { status: 401 })
+      const deleteSelectionRejected = rejectInvalidOrgSelection(ctx, 'delete')
+      if (deleteSelectionRejected) return deleteSelectionRejected
       if (ormCfg.orgField && ctx.organizationIds && ctx.organizationIds.length === 0) {
         logForbidden({
           resourceKind,

package/src/lib/location/__tests__/countries.test.ts

@@ -0,0 +1,82 @@
+import {
+  COUNTRY_PRIORITY,
+  ISO_COUNTRIES,
+  buildCountryOptions,
+  resolveCountryName,
+} from '../countries'
+
+describe('ISO_COUNTRIES', () => {
+  it('includes Kosovo, which the language-subtag registry does not list', () => {
+    const kosovo = ISO_COUNTRIES.filter((entry) => entry.code === 'XK')
+    expect(kosovo).toEqual([{ code: 'XK', name: 'Kosovo' }])
+  })
+
+  it('does not duplicate any country code', () => {
+    const codes = ISO_COUNTRIES.map((entry) => entry.code)
+    expect(codes).toHaveLength(new Set(codes).size)
+  })
+
+  it('keeps registry-derived countries intact', () => {
+    expect(ISO_COUNTRIES).toEqual(
+      expect.arrayContaining([
+        { code: 'PL', name: 'Poland' },
+        { code: 'DE', name: 'Germany' },
+      ])
+    )
+  })
+
+  it('stays sorted by name', () => {
+    const names = ISO_COUNTRIES.map((entry) => entry.name)
+    const sorted = [...names].sort((a, b) => a.localeCompare(b, 'en', { sensitivity: 'base' }))
+    expect(names).toEqual(sorted)
+  })
+})
+
+describe('resolveCountryName', () => {
+  it('resolves Kosovo for XK', () => {
+    expect(resolveCountryName('XK')).toBe('Kosovo')
+  })
+
+  it('resolves Kosovo for a lowercase xk', () => {
+    expect(resolveCountryName('xk')).toBe('Kosovo')
+  })
+
+  it('still resolves registry-backed countries', () => {
+    expect(resolveCountryName('PL')).toBe('Poland')
+  })
+
+  it('falls back to the raw code for an unknown region', () => {
+    expect(resolveCountryName('ZZZ')).toBe('ZZZ')
+  })
+})
+
+describe('buildCountryOptions', () => {
+  it('offers Kosovo as a selectable option', () => {
+    const options = buildCountryOptions()
+    expect(options).toEqual(expect.arrayContaining([{ code: 'XK', label: 'Kosovo' }]))
+  })
+
+  it('offers exactly one Kosovo option', () => {
+    const options = buildCountryOptions().filter((option) => option.code === 'XK')
+    expect(options).toHaveLength(1)
+  })
+
+  it('lists Kosovo after the prioritized countries', () => {
+    const options = buildCountryOptions()
+    const kosovoIndex = options.findIndex((option) => option.code === 'XK')
+    expect(kosovoIndex).toBeGreaterThanOrEqual(COUNTRY_PRIORITY.length)
+  })
+
+  it('keeps the prioritized countries at the top', () => {
+    const options = buildCountryOptions()
+    const leading = options.slice(0, COUNTRY_PRIORITY.length).map((option) => option.code)
+    expect(leading.slice().sort()).toEqual(COUNTRY_PRIORITY.slice().sort())
+  })
+
+  it('applies transformLabel to the supplemental country too', () => {
+    const options = buildCountryOptions({
+      transformLabel: (code, defaultLabel) => `${defaultLabel} (${code})`,
+    })
+    expect(options).toEqual(expect.arrayContaining([{ code: 'XK', label: 'Kosovo (XK)' }]))
+  })
+})

package/src/lib/location/countries.ts

@@ -28,9 +28,18 @@ const RAW_COUNTRIES: IsoCountry[] = (registry as RegistryEntry[])
     name: entry.Description.join(', '),
   }))
 
-export const ISO_COUNTRIES: IsoCountry[] = [...RAW_COUNTRIES].sort((a, b) =>
-  a.name.localeCompare(b.name, 'en', { sensitivity: 'base' })
-)
+// Codes in common use that the language-subtag registry does not list as region subtags.
+// XK is user-assigned rather than ISO 3166-1 assigned, so it never appears in the registry.
+const SUPPLEMENTAL_COUNTRIES: IsoCountry[] = [
+  { code: 'XK', name: 'Kosovo' },
+]
+
+const RAW_COUNTRY_CODES = new Set(RAW_COUNTRIES.map((entry) => entry.code))
+
+export const ISO_COUNTRIES: IsoCountry[] = [
+  ...RAW_COUNTRIES,
+  ...SUPPLEMENTAL_COUNTRIES.filter((entry) => !RAW_COUNTRY_CODES.has(entry.code)),
+].sort((a, b) => a.name.localeCompare(b.name, 'en', { sensitivity: 'base' }))
 
 export const COUNTRY_PRIORITY: string[] = ['PL', 'DE', 'ES', 'FR', 'IT', 'US', 'GB', 'CA']
 
@@ -58,7 +67,9 @@ export function resolveCountryName(code: string, options: { locale?: string } =
   if (!displayNames) return fallback
   try {
     const label = displayNames.of(normalized as any)
-    return typeof label === 'string' ? label : fallback
+    // Intl echoes the raw code back when its ICU data cannot resolve the region.
+    if (typeof label !== 'string' || label === normalized) return fallback
+    return label
   } catch {
     return fallback
   }

package/src/lib/network.ts

@@ -80,12 +80,39 @@ export function isPrivateIPv6(address: string): boolean {
   if (isIPv4CompatibleIPv6(segments)) return true
 
   const embedded = embeddedIPv4FromIPv6(segments)
-  if (embedded && isPrivateIPv4(embedded)) return true
+  if (embedded) return isPrivateIPv4(embedded)
 
   const [a] = segments
   if ((a & 0xfe00) === 0xfc00) return true
   if ((a & 0xffc0) === 0xfe80) return true
   if ((a & 0xff00) === 0xff00) return true
+  if (
+    a === 0x0100 &&
+    segments[1] === 0 &&
+    segments[2] === 0 &&
+    segments[3] === 0
+  ) {
+    return true
+  }
+  if (a === 0x2001 && (segments[1] & 0xfe00) === 0) {
+    return !isGloballyReachableIetfProtocolAssignment(segments)
+  }
+  if (a === 0x2001 && segments[1] === 0x0db8) return true
+  if ((a & 0xfff0) === 0x3ff0) return true
+  // Except for the explicitly handled IPv4 translation ranges above, globally
+  // routable unicast IPv6 addresses are allocated from 2000::/3.
+  if ((a & 0xe000) !== 0x2000) return true
+  return false
+}
+
+function isGloballyReachableIetfProtocolAssignment(segments: number[]): boolean {
+  const [, b, c, d, e, f, g, h] = segments
+  const trailingZero = c === 0 && d === 0 && e === 0 && f === 0 && g === 0
+  if (b === 0x0001 && trailingZero && h >= 1 && h <= 3) return true
+  if (b === 0x0003) return true
+  if (b === 0x0004 && c === 0x0112) return true
+  if ((b & 0xfff0) === 0x0020) return true
+  if ((b & 0xfff0) === 0x0030) return true
   return false
 }
 

package/src/lib/string.ts

@@ -6,3 +6,11 @@ export function trimToUndefined(value: unknown): string | undefined {
   return trimmed.length > 0 ? trimmed : undefined
 }
 
+export function parseCommaSeparatedList(value: string | null | undefined): string[] {
+  if (typeof value !== 'string') return []
+  return value
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+}
+

package/src/lib/url-safety.ts

@@ -1,6 +1,6 @@
 import { lookup } from 'node:dns/promises'
 import { isIP } from 'node:net'
-import { Agent, type Dispatcher } from 'undici'
+import { Agent, fetch as undiciFetch, type Dispatcher } from 'undici'
 import { isBlockedHostname, isPrivateIpAddress } from './network'
 
 export type UrlSafetyReason =
@@ -102,6 +102,8 @@ export function assertStaticallySafeOutboundUrl(
 
 export type AssertSafeOutboundUrlOptions = AssertStaticUrlOptions & {
   lookupHost?: HostLookup
+  /** Resolve and return DNS answers even when private addresses are explicitly allowed. */
+  pinAllowedPrivate?: boolean
 }
 
 export async function assertSafeOutboundUrl(
@@ -118,7 +120,8 @@ export type ResolveSafeOutboundUrlResult = {
   hostname: string
   /**
    * The validated DNS records, in lookup order. `null` when the hostname is an IP literal
-   * (no DNS lookup performed) or when `allowPrivate` short-circuited validation.
+   * (no DNS lookup performed) or when `allowPrivate` short-circuited validation without
+   * `pinAllowedPrivate`.
    */
   addresses: ReadonlyArray<ResolvedHostAddress> | null
 }
@@ -136,14 +139,16 @@ export async function resolveSafeOutboundUrl(
   const subject = options.subject ?? 'URL'
   const factory = options.errorFactory ?? defaultErrorFactory
   const { url, hostname } = parseOutboundUrl(rawUrl, options)
-  if (options.allowPrivate) return { url, hostname, addresses: null }
+  if (options.allowPrivate && !options.pinAllowedPrivate) {
+    return { url, hostname, addresses: null }
+  }
 
-  if (isBlockedHostname(hostname)) {
+  if (!options.allowPrivate && isBlockedHostname(hostname)) {
     throw factory('blocked_hostname', `${subject} host "${hostname}" is not allowed`)
   }
 
   if (isIP(hostname)) {
-    if (isPrivateIpAddress(hostname)) {
+    if (!options.allowPrivate && isPrivateIpAddress(hostname)) {
       throw factory(
         'private_ip_literal',
         `${subject} host "${hostname}" resolves to a private or reserved IP range`,
@@ -179,7 +184,7 @@ export async function resolveSafeOutboundUrl(
   }
 
   for (const record of addresses) {
-    if (isPrivateIpAddress(record.address)) {
+    if (!options.allowPrivate && isPrivateIpAddress(record.address)) {
       throw factory(
         'private_ip_resolved',
         `${subject} host "${hostname}" resolves to a private or reserved IP address (${record.address})`,
@@ -197,16 +202,23 @@ export type SafeOutboundFetchOptions = AssertSafeOutboundUrlOptions & {
    * not actually open sockets, so DNS pinning is unnecessary and would just complicate mocking.
    */
   fetchImpl?: typeof fetch
+  /** Test seam for the dispatcher-compatible fetch used by DNS-pinned requests. */
+  pinnedFetchImpl?: PinnedFetch
 }
 
+export type PinnedFetch = (
+  rawUrl: string,
+  init: RequestInit & { dispatcher: Dispatcher },
+) => Promise<Response>
+
 /**
  * Validates an outbound URL and performs `fetch()` with the connection pinned to a
  * pre-validated IP address, so DNS cannot be re-resolved between validation and connect
  * (DNS rebinding). Always defaults to `redirect: 'manual'` — callers MUST decide what to
  * do with 3xx responses (re-validate the redirect target before following).
  *
- * For IP literal hosts and `allowPrivate=true`, no DNS pinning is performed because there
- * is no DNS lookup to defeat.
+ * For IP literal hosts no DNS pinning is performed because there is no DNS lookup to defeat.
+ * Callers that allow private hostnames can set `pinAllowedPrivate` to retain DNS pinning.
  */
 export async function safeOutboundFetch(
   rawUrl: string,
@@ -237,9 +249,8 @@ export async function safeOutboundFetch(
   })
 
   try {
-    return await globalThis.fetch(rawUrl, { ...mergedInit, dispatcher } as RequestInit & {
-      dispatcher: Dispatcher
-    })
+    const pinnedFetch = options.pinnedFetchImpl ?? (undiciFetch as unknown as PinnedFetch)
+    return await pinnedFetch(rawUrl, { ...mergedInit, dispatcher })
   } finally {
     dispatcher.close().catch(() => {})
   }
@@ -247,8 +258,12 @@ export async function safeOutboundFetch(
 
 export type PinnedDnsLookup = (
   host: string,
-  opts: unknown,
-  cb: (err: NodeJS.ErrnoException | null, address: string, family: number) => void,
+  opts: { all?: boolean },
+  cb: (
+    err: NodeJS.ErrnoException | null,
+    address: string | ResolvedHostAddress[],
+    family?: number,
+  ) => void,
 ) => void
 
 /**
@@ -261,7 +276,7 @@ export function createPinnedDnsLookup(
   expectedHostname: string,
   pinned: ResolvedHostAddress,
 ): PinnedDnsLookup {
-  return (host, _opts, cb) => {
+  return (host, opts, cb) => {
     if (host !== expectedHostname) {
       const err: NodeJS.ErrnoException = new Error(
         `Refusing DNS lookup for unexpected host "${host}" (expected "${expectedHostname}")`,
@@ -270,6 +285,10 @@ export function createPinnedDnsLookup(
       cb(err, '', 0)
       return
     }
+    if (opts.all) {
+      cb(null, [pinned])
+      return
+    }
     cb(null, pinned.address, pinned.family)
   }
 }

package/src/modules/payment_gateways/types.ts

@@ -117,6 +117,8 @@ export type PaymentGatewayClientSession =
 export interface CreateSessionInput {
   orderId?: string
   paymentId: string
+  /** Stable operation key for provider-native session creation idempotency. */
+  idempotencyKey?: string
   tenantId: string
   organizationId: string
   amount: number