@teamscala/service-boot 0.23.466 → 0.23.467

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.466",
+  "version": "0.23.467",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/public-agreement-router.ts

@@ -156,7 +156,29 @@ export const publicAgreementRouter = {
 		});
 		if (!agreement) return { ok: false as const, error: "Agreement not found" };
 
+		// TWO representations, deliberately, because they have two consumers.
+		//
+		// `now` is an ISO STRING and belongs in the parties roster, which is
+		// serialised to JSON in signature_data — a Temporal.Instant would
+		// stringify into that JSON as an object.
+		//
+		// `nowInstant` is what the timestamptz COLUMNS take. Under Prisma 8 the
+		// timestamptz codec ('pg/timestamptz-temporal@1') accepts a
+		// Temporal.Instant and NOTHING ELSE. Measured against the live service:
+		// a string gives "received a string", a Date gives "received a Date",
+		// and only Temporal.Instant writes. Passing `now` therefore threw on
+		// EVERY signature, and the handler's catch reported the generic "Could
+		// not submit your signature." -- so signing was impossible for every
+		// signer with nothing naming the cause.
+		//
+		// The cast is load-bearing and is NOT laziness: the generated Prisma
+		// types declare these fields `string | Date` and reject Instant, so the
+		// client's TYPES and its RUNTIME CODEC disagree. Following the types
+		// produces code that compiles and always throws, which is exactly how
+		// this shipped. The runtime is the authority here; the generated types
+		// are the defect, and they are the thing to fix upstream.
 		const now = new Date().toISOString();
+		const nowInstant = Temporal.Now.instant() as unknown as Date;
 
 		try {
 			// Multi-party path: signature_data holds a parties roster.
@@ -229,10 +251,10 @@ export const publicAgreementRouter = {
 					signature_data: JSON.stringify(
 						evidence ? { parties, evidence } : { parties },
 					),
-					viewed_at: now,
+					viewed_at: nowInstant,
 				};
 				if (executed) {
-					data.signed_at = now;
+					data.signed_at = nowInstant;
 					data.signed_by = agreement.contact_id ?? null;
 				}
 				const updated = await context.prisma.agreements.update({
@@ -309,8 +331,8 @@ export const publicAgreementRouter = {
 				where: { id: agreementId },
 				data: {
 					signature_data: input.signatureData ?? agreement.signer_name ?? "",
-					signed_at: now,
-					viewed_at: now,
+					signed_at: nowInstant,
+					viewed_at: nowInstant,
 					signed_by: agreement.contact_id ?? null,
 					...(input.signerName ? { signer_name: input.signerName } : {}),
 				},

package/src/register-registry-page-route/apply-page-branding.test.ts

@@ -0,0 +1,118 @@
+/**
+ * @system ui-service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * applySessionOrgBranding must never repaint a TENANT document in the
+ * VIEWER's brand.
+ *
+ * A public document belongs to the org that PUBLISHED it and must look
+ * identical to every reader. Personalising to the reader's org is right for a
+ * portal (you are looking at your own workspace) and wrong for a document.
+ *
+ * The regression this locks: sign.scala.business's website is owned by the
+ * PLATFORM org, so the website-level test passed and the session override
+ * fired on agreements owned by tenants. Every signed-in staff viewer saw a
+ * GMG APAC agreement in their own org's brand while an anonymous client saw
+ * it correctly — so the only people who could not see what the client sees
+ * were the people reviewing it before sending.
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+const PLATFORM_ORG = "c503629a-85d9-4d25-9431-f6fa59504868";
+const TENANT_ORG = "5b742740-0f37-494c-a059-d8399ae4b350";
+const VIEWER_ORG = PLATFORM_ORG;
+
+mock.module("@teamscala/db/registry/platform", () => ({
+	getPlatformOrgId: () => PLATFORM_ORG,
+}));
+
+// The override's only way to change anything is to fetch the viewer org's
+// branding. If it is never called, no personalisation happened.
+const fetchBranding = mock(async () => ({
+	company_name: "Viewer Org",
+	company_friendly_name: "Viewer Org",
+	brand_primary_color: "#000080",
+	brand_heading_font: null,
+	brand_body_font: null,
+	company_logo_for_light_theme: "/viewer-light.png",
+	company_logo_for_dark_theme: "/viewer-dark.png",
+}));
+mock.module("@teamscala/db/fetch-organisation-page-branding", () => ({
+	fetchOrganisationPageBranding: fetchBranding,
+}));
+mock.module("../page-server-orpc/server-client.ts", () => ({
+	getServerClient: () => ({}),
+}));
+
+const { applySessionOrgBranding } = await import("./apply-page-branding.ts");
+
+function pageOwnedBy(pageOrgId: string, websiteOrgId: string) {
+	return {
+		orgId: pageOrgId,
+		website: { organisation_id: websiteOrgId },
+		brand: { companyName: "Publisher", primaryColor: "#FF4500" },
+	} as Record<string, unknown>;
+}
+
+describe("applySessionOrgBranding — a document is never repainted for its reader", () => {
+	test("a TENANT document on a PLATFORM-owned website keeps the publisher's brand", async () => {
+		fetchBranding.mockClear();
+		// Exactly the sign.scala.business shape: the website is the platform's,
+		// the agreement belongs to the tenant, the viewer is platform staff.
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+		expect((pageData.brand as { primaryColor: string }).primaryColor).toBe(
+			"#FF4500",
+		);
+	});
+
+	test("a TENANT-owned website is untouched too", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, TENANT_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+	});
+
+	test("an anonymous reader is never personalised", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, undefined);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+		expect(pageData.orgId).toBe(TENANT_ORG);
+	});
+
+	test("a public render mode is never personalised", async () => {
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(TENANT_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, "public", VIEWER_ORG);
+
+		expect(fetchBranding).not.toHaveBeenCalled();
+	});
+
+	test("a genuine PLATFORM page still personalises to the viewer's org", async () => {
+		// The behaviour the override exists for: a shared platform portal page,
+		// viewed by a member of another org, shows that member their own brand.
+		fetchBranding.mockClear();
+		const pageData = pageOwnedBy(PLATFORM_ORG, PLATFORM_ORG);
+
+		await applySessionOrgBranding(pageData, undefined, TENANT_ORG);
+
+		expect(fetchBranding).toHaveBeenCalledTimes(1);
+		expect(pageData.orgId).toBe(TENANT_ORG);
+		expect((pageData.brand as { companyName: string }).companyName).toBe(
+			"Viewer Org",
+		);
+	});
+});

package/src/register-registry-page-route/apply-page-branding.ts

@@ -135,6 +135,7 @@ export async function applySessionOrgBranding(
 	renderMode: string | undefined,
 	sessionOrgId: string | undefined,
 ): Promise<void> {
+	const platformOrgId = getPlatformOrgId();
 	if (
 		renderMode !== "public" &&
 		sessionOrgId &&
@@ -144,9 +145,27 @@ export async function applySessionOrgBranding(
 		// (super-admin org). A TENANT-owned site (a customer GPT/quiz/portal)
 		// keeps its page-org brand regardless of the viewer session org. The
 		// old pageData.orgId===website.org mis-fired for a tenant whose page org equals their own website org.
-		getPlatformOrgId() ===
+		platformOrgId ===
 			((pageData.website as { organisation_id?: string | null } | undefined)
-				?.organisation_id ?? undefined)
+				?.organisation_id ?? undefined) &&
+		// ...AND the PAGE itself must be platform-owned. A platform-owned
+		// WEBSITE also hosts tenant DOCUMENTS — an agreement, a proposal, a
+		// signed contract — and those belong to the org that published them.
+		// Testing only the website let the viewer's own org repaint a tenant
+		// document, which is the same defect this rule already fixed once at
+		// the website level (2026-08-17, the Launcha Authority Blueprint).
+		//
+		// It recurred on sign.scala.business, whose website IS owned by the
+		// platform org (c503629a), so the website test passed and every
+		// signed-in staff viewer saw a GMG APAC agreement painted in their own
+		// org's brand — while an anonymous client saw it correctly. That is
+		// the worst possible shape: the only people who cannot see what the
+		// client sees are the people reviewing it before it is sent.
+		//
+		// A public document belongs to the org that PUBLISHED it and must look
+		// identical to every reader, so a page whose org is not the platform's
+		// is never personalised.
+		platformOrgId === (pageData.orgId as string | undefined)
 	) {
 		try {
 			const branding = await fetchOrganisationPageBranding(