update admin

apps/api/src/modules/customers/customers.service.ts

@@ -18,6 +18,7 @@ const PUBLIC_CUSTOMER_SELECT = {
   businessLicenseUrl: true,
   shopImageUrl: true,
   isActive: true,
+  isArchived: true,
   createdAt: true,
   updatedAt: true,
 } satisfies Prisma.CustomerSelect;
@@ -35,8 +36,16 @@ export class CustomersService {
     return customer;
   }
 
+  // Ported from legacy henza_server's WebApp\AuthController::userAuth() /
+  // ApiMobileController::userAuth(), both of which query
+  // Customer::active()->where('is_archive', 0) — an inactive or archived
+  // customer cannot authenticate in the customer-facing app. This endpoint is
+  // that same lookup surface for the user-app login flow (client-side match
+  // on `mobile`), so it must apply the same two filters, or a
+  // deactivated/archived customer would still be able to log in.
   list() {
     return this.prisma.customer.findMany({
+      where: { isActive: true, isArchived: false },
       select: PUBLIC_CUSTOMER_SELECT,
       orderBy: { createdAt: 'desc' },
     });