@open-mercato/core 0.10.1-develop.7752.1.fd7c06569b → 0.10.1-develop.7756.1.8f5dec1b96

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7752.1.fd7c06569b",
+  "version": "0.10.1-develop.7756.1.8f5dec1b96",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7752.1.fd7c06569b",
-    "@open-mercato/shared": "0.10.1-develop.7752.1.fd7c06569b",
-    "@open-mercato/ui": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7756.1.8f5dec1b96",
+    "@open-mercato/shared": "0.10.1-develop.7756.1.8f5dec1b96",
+    "@open-mercato/ui": "0.10.1-develop.7756.1.8f5dec1b96",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7752.1.fd7c06569b",
-    "@open-mercato/shared": "0.10.1-develop.7752.1.fd7c06569b",
-    "@open-mercato/ui": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7756.1.8f5dec1b96",
+    "@open-mercato/shared": "0.10.1-develop.7756.1.8f5dec1b96",
+    "@open-mercato/ui": "0.10.1-develop.7756.1.8f5dec1b96",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/helpers/integration/dbFixtures.ts

@@ -109,7 +109,7 @@ export async function setUserAclInDb(input: {
 }): Promise<void> {
   await withClient(async (client) => {
     const existing = await client.query<{ id: string }>(
-      'select id from user_acls where user_id = $1 and tenant_id = $2 limit 1',
+      'select id from user_acls where user_id = $1 and tenant_id = $2 and deleted_at is null limit 1',
       [input.userId, input.tenantId],
     );
     const featuresJson = JSON.stringify(input.features);

package/src/modules/auth/api/roles/acl/route.ts

@@ -99,7 +99,7 @@ export async function GET(req: Request) {
   }
 
   const acl = tenantScope
-    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })
+    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope, deletedAt: null })
     : null
   const response = acl
     ? {
@@ -178,7 +178,7 @@ export async function PUT(req: Request) {
     }
   }
 
-  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
+  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId, deletedAt: null })
   // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same
   // role's features in parallel cannot silently clobber each other (#2055). The
   // check is strictly additive — when the client sends no expected-version header

package/src/modules/auth/api/roles/route.ts

@@ -201,7 +201,7 @@ export async function GET(req: Request) {
   }
   let superAdminRoleIds: Set<string> | null = null
   if (!isSuperAdmin && actorTenantId) {
-    const superAdminAcls = await findWithDecryption(em, RoleAcl, { tenantId: actorTenantId, isSuperAdmin: true }, {}, { tenantId: actorTenantId, organizationId: null })
+    const superAdminAcls = await findWithDecryption(em, RoleAcl, { tenantId: actorTenantId, isSuperAdmin: true, deletedAt: null }, {}, { tenantId: actorTenantId, organizationId: null })
     if (superAdminAcls.length) {
       superAdminRoleIds = new Set(
         superAdminAcls

package/src/modules/auth/api/users/acl/route.ts

@@ -171,7 +171,11 @@ export async function GET(req: Request) {
     }
   }
   const acl = tenantId
-    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
+    ? await em.findOne(UserAcl, {
+        user: parsed.data.userId as unknown as User,
+        tenantId,
+        deletedAt: null,
+      } as FilterQuery<UserAcl>)
     : null
   const response = acl
     ? {
@@ -268,7 +272,11 @@ export async function PUT(req: Request) {
     }
   }
 
-  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
+  const acl = await em.findOne(UserAcl, {
+    user: parsed.data.userId as unknown as User,
+    tenantId,
+    deletedAt: null,
+  } as FilterQuery<UserAcl>)
   // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits
   // cannot silently clobber each other (#2055). Strictly additive — a no-op when
   // the client sends no expected-version header; skipped when no ACL row exists.

package/src/modules/auth/commands/acl.ts

@@ -390,7 +390,7 @@ const updateRoleAclCommand = createAclUpdateCommand<RoleAclUpdateInput>({
     await lockRoleWriterAuthorizationState(em, [input.roleId])
   },
   loadAcl: (em, input) =>
-    em.findOne(RoleAcl, { role: input.roleId as unknown as Role, tenantId: input.tenantId }),
+    em.findOne(RoleAcl, { role: input.roleId as unknown as Role, tenantId: input.tenantId, deletedAt: null }),
   persist: async ({ em, input, existing }) => {
     const acl =
       (existing as RoleAcl | null) ??
@@ -434,7 +434,7 @@ const updateUserAclCommand = createAclUpdateCommand<UserAclUpdateInput>({
     await lockUserAclWriterAuthorizationState(em, [input.userId])
   },
   loadAcl: (em, input) =>
-    em.findOne(UserAcl, { user: input.userId as unknown as User, tenantId: input.tenantId }),
+    em.findOne(UserAcl, { user: input.userId as unknown as User, tenantId: input.tenantId, deletedAt: null }),
   persist: async ({ em, input, existing }) => {
     if (input.clear) {
       if (!existing) return

package/src/modules/auth/commands/roles.ts

@@ -948,7 +948,7 @@ function captureRoleSnapshots(
 }
 
 async function loadRoleAclSnapshots(em: EntityManager, roleId: string): Promise<RoleAclSnapshot[]> {
-  const entries = await findWithDecryption(em, RoleAcl, { role: roleId as unknown as Role }, {}, { tenantId: null, organizationId: null })
+  const entries = await findWithDecryption(em, RoleAcl, { role: roleId as unknown as Role, deletedAt: null }, {}, { tenantId: null, organizationId: null })
   return entries.map((entry) => ({
     id: entry.id ? String(entry.id) : null,
     tenantId: String(entry.tenantId),

package/src/modules/auth/commands/users.ts

@@ -1687,7 +1687,7 @@ async function syncUserRoles(
   const currentLinks = await findWithDecryption(
     em,
     UserRole,
-    { user },
+    { user, deletedAt: null, role: { deletedAt: null } } as FilterQuery<UserRole>,
     { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: 'ASC' }, refresh: true },
     { tenantId: null, organizationId: null },
   )
@@ -1717,7 +1717,11 @@ async function loadUserRoleNames(em: EntityManager, userId: string): Promise<str
   const links = await findWithDecryption(
     em,
     UserRole,
-    { user: userId as unknown as User },
+    {
+      user: userId as unknown as User,
+      deletedAt: null,
+      role: { deletedAt: null },
+    } as FilterQuery<UserRole>,
     { populate: ['role'] },
     { tenantId: null, organizationId: null },
   )
@@ -1764,7 +1768,7 @@ function captureUserSnapshots(
 }
 
 async function loadUserAclSnapshots(em: EntityManager, userId: string): Promise<UserAclSnapshot[]> {
-  const list = await findWithDecryption(em, UserAcl, { user: userId as unknown as User }, {}, { tenantId: null, organizationId: null })
+  const list = await findWithDecryption(em, UserAcl, { user: userId as unknown as User, deletedAt: null }, {}, { tenantId: null, organizationId: null })
   return list.map((acl) => ({
     tenantId: String(acl.tenantId),
     features: Array.isArray(acl.featuresJson) ? [...acl.featuresJson] : null,

package/src/modules/auth/data/entities.ts

@@ -271,6 +271,11 @@ export class PasswordReset {
 
 // RBAC: Role-level ACL
 @Entity({ tableName: 'role_acls' })
+// Uniqueness is enforced by a partial unique index (`role_acls_active_unique_idx`)
+// on `(role_id, tenant_id)` scoped to live rows (`WHERE deleted_at IS NULL`) and
+// owned by raw SQL in Migration20260828120000_auth. A `@Unique` decorator can't
+// express a partial index, so the entity intentionally omits it — the migration
+// is the source of truth.
 export class RoleAcl {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -309,6 +314,13 @@ export class RoleAcl {
 
 // RBAC: Per-user ACL override
 @Entity({ tableName: 'user_acls' })
+// Uniqueness is enforced by a partial unique index (`user_acls_active_unique_idx`)
+// on `(user_id, tenant_id)` scoped to live rows (`WHERE deleted_at IS NULL`) and
+// owned by raw SQL in Migration20260828120000_auth. A `@Unique` decorator can't
+// express a partial index, so the entity intentionally omits it — the migration
+// is the source of truth. This row REPLACES the user's role ACLs rather than
+// merging with them (see RbacService.loadAcl), so a second live row for the same
+// scope would silently decide the whole feature set.
 export class UserAcl {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string

package/src/modules/auth/lib/executionPrincipal.ts

@@ -169,7 +169,7 @@ export async function provisionExecutionPrincipal(
     const existingAcl = await findOneWithDecryption(
       trx,
       RoleAcl,
-      { role, tenantId },
+      { role, tenantId, deletedAt: null },
       {},
       { tenantId, organizationId: null },
     )
@@ -204,7 +204,7 @@ export async function provisionExecutionPrincipal(
     const existingLink = await findOneWithDecryption(
       trx,
       UserRole,
-      { user, role },
+      { user, role, deletedAt: null },
       {},
       { tenantId, organizationId: null },
     )

package/src/modules/auth/lib/grantChecks.ts

@@ -189,7 +189,7 @@ export async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Prom
     const acl = await findOneWithDecryption(
       input.em,
       RoleAcl,
-      { role, tenantId } as FilterQuery<RoleAcl>,
+      { role, tenantId, deletedAt: null } as FilterQuery<RoleAcl>,
       {},
       { tenantId, organizationId: null },
     )
@@ -306,16 +306,65 @@ async function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSupe
   return acl.isSuperAdmin
 }
 
+/**
+ * Answers "is this user effectively a super-admin" about a TARGET — the input to
+ * `assertActorCanModifySuperAdminUserTarget`, not to any authorization decision
+ * about the caller.
+ *
+ * It is bound to the target's OWN tenant (`users.tenant_id`) and to live grant
+ * rows, because that is the reading the two authorities already share:
+ * `RbacService.isGlobalSuperAdmin` and `lib/sessionIntegrity.ts`
+ * (`userAclGrantsSuperAdmin` / `roleAclGrantsSuperAdmin`). A protection
+ * predicate that answered differently would protect people who hold nothing —
+ * a grant stamped a foreign tenant, or one that was revoked — while every
+ * authorization path treats them as ordinary users. That over-protection does
+ * not expire: nothing short of a super-admin could edit such an account again,
+ * and revoking someone's super-admin would leave them permanently unmanageable
+ * by their own tenant's admins.
+ *
+ * Two asymmetries with `isGlobalSuperAdmin` are deliberate:
+ *
+ * - Organization-restricted role grants are NOT excluded. That exclusion only
+ *   keeps them out of the GLOBAL answer; `loadAcl`'s scoped projection still
+ *   returns `isSuperAdmin: true` for such a role inside the organizations it
+ *   names, so its holder is a privileged target. A protection predicate may be
+ *   a superset of the authorization answer; it must never be a subset.
+ * - The `User` load carries no `deletedAt` filter, matching the load in
+ *   `assertActorCanAccessUserTarget` below. A soft-deleted super-admin stays
+ *   protected; it is the ACL rows that must be live.
+ *
+ * "No user row" and "no tenant of their own" both answer false, as
+ * `isGlobalSuperAdmin` does. Neither is exploitable, because every call site
+ * pairs this guard with `assertActorCanAccessUserTarget`: that one delegates a
+ * missing target to the caller's own tenant-scoped load, and 404s a target
+ * whose `tenantId` is absent, so no mutation reaches either case.
+ */
 export async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {
+  const target = await findOneWithDecryption(
+    em,
+    User,
+    { id: userId } as FilterQuery<User>,
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  const tenantId = normalizeNullableString((target as { tenantId?: string | null } | null)?.tenantId)
+  if (!tenantId) return false
   const directGrant = await em.findOne(
     UserAcl,
-    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,
+    { user: userId as unknown, tenantId, isSuperAdmin: true, deletedAt: null } as FilterQuery<UserAcl>,
   )
   if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true
   const links = await findWithDecryption(
     em,
     UserRole,
-    { user: userId as unknown } as FilterQuery<UserRole>,
+    // Roles of the user's own tenant, the same restriction `isGlobalSuperAdmin`
+    // applies. The encryption scope stays `{ null, null }`: this is about which
+    // rows count, not about which key decrypts them.
+    {
+      user: userId as unknown,
+      deletedAt: null,
+      role: { tenantId, deletedAt: null },
+    } as FilterQuery<UserRole>,
     { populate: ['role'] },
     { tenantId: null, organizationId: null },
   )
@@ -330,22 +379,75 @@ export async function isUserEffectivelySuperAdmin(em: EntityManager, userId: str
   if (!roleIds.length) return false
   const roleGrant = await em.findOne(
     RoleAcl,
-    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+    { role: { $in: roleIds } as unknown, tenantId, isSuperAdmin: true, deletedAt: null } as FilterQuery<RoleAcl>,
   )
   return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true
 }
 
+/**
+ * The role twin of `isUserEffectivelySuperAdmin`, and it carries the same
+ * reading for the same reasons: the grant must be live, and it must be stamped
+ * with the role's OWN tenant. A `role_acls` row stamped elsewhere confers
+ * nothing (`RbacService.loadAcl` reads role ACLs `{ tenantId, deletedAt: null }`),
+ * so protecting a role on the strength of one would refuse an edit that every
+ * authorization path considers ordinary.
+ *
+ * A role that does not exist answers false, which its paired guard
+ * `assertActorCanAccessRoleTarget` then delegates to the caller in the same way
+ * the user side does.
+ */
 export async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {
+  const role = await findOneWithDecryption(
+    em,
+    Role,
+    { id: roleId } as FilterQuery<Role>,
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  const tenantId = normalizeNullableString((role as { tenantId?: string | null } | null)?.tenantId)
+  if (!tenantId) return false
   const grant = await em.findOne(
     RoleAcl,
-    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+    { role: roleId as unknown, tenantId, isSuperAdmin: true, deletedAt: null } as FilterQuery<RoleAcl>,
   )
   return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true
 }
 
+/**
+ * The super-admin user ids a non-super-admin must not be shown while looking at
+ * `tenantId` — an exclusion list, not an authorization answer.
+ *
+ * `tenantId` names the tenant whose users are being listed. Because a
+ * super-admin grant is bound to the holder's own tenant (see
+ * `isUserEffectivelySuperAdmin` above and `RbacService.isGlobalSuperAdmin`),
+ * that is also the tenant a grant must be stamped with in order to count here,
+ * so the filter is applied to BOTH ACL tables. It used to reach only
+ * `user_acls`, which made the two halves disagree about what a tenant-scoped
+ * answer meant.
+ *
+ * The narrowing on `role_acls` is only safe TOGETHER with that tenant binding:
+ * while a foreign-stamped row still conferred super-admin, dropping it from this
+ * list would have unhidden a real one.
+ *
+ * The caller owes the other half of the scoping. This returns ids; it is the
+ * caller's own subject query that must already be restricted to `tenantId`.
+ * Both wired call sites are — `auth/api/users/route.ts` filters the user query
+ * by the same tenant, and documents' principals route scopes to `ctx.tenantId`
+ * — so a role member living in another tenant is merely excluded from a list
+ * they were never in. That is not licence to pass a tenant unrelated to the
+ * subject set.
+ *
+ * Deliberately NOT narrowed further: organization-restricted role grants count
+ * (their holders are super-admins inside those organizations), and the
+ * `user_roles` expansion stays tenant-less. Over-inclusion there is bounded by
+ * the caller's subject scoping, and for an exclusion list hiding one user too
+ * many is the safe direction.
+ */
 export async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {
   const ids = new Set<string>()
-  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }
+  // A revoked override must not keep answering — the same rule the ACL reads in
+  // `RbacService` follow.
+  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true, deletedAt: null }
   if (tenantId) userAclFilter.tenantId = tenantId
   const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)
   for (const acl of userAcls) {
@@ -355,10 +457,9 @@ export async function listSuperAdminUserIds(em: EntityManager, tenantId: string
       : userRef
     if (userId) ids.add(String(userId))
   }
-  const roleAcls = await em.find(
-    RoleAcl,
-    { isSuperAdmin: true } as FilterQuery<RoleAcl>,
-  )
+  const roleAclFilter: Record<string, unknown> = { isSuperAdmin: true, deletedAt: null }
+  if (tenantId) roleAclFilter.tenantId = tenantId
+  const roleAcls = await em.find(RoleAcl, roleAclFilter as FilterQuery<RoleAcl>)
   const roleIds = roleAcls
     .map((acl) => {
       const roleRef = (acl as { role?: { id?: unknown } | string | null }).role
@@ -371,7 +472,10 @@ export async function listSuperAdminUserIds(em: EntityManager, tenantId: string
     const links = await findWithDecryption(
       em,
       UserRole,
-      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,
+      {
+        deletedAt: null,
+        role: { id: { $in: roleIds }, deletedAt: null },
+      } as FilterQuery<UserRole>,
       {},
       { tenantId: null, organizationId: null },
     )

package/src/modules/auth/lib/setup-app.ts

@@ -488,7 +488,7 @@ export async function setupInitialTenant(
           roleIds: assignedRoles.map((role) => String(role.id)),
         })
         for (const role of assignedRoles) {
-          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role }, {}, { tenantId: tenantId ?? null, organizationId: null })
+          const existingLink = await findOneWithDecryption(tem, UserRole, { user, role, deletedAt: null }, {}, { tenantId: tenantId ?? null, organizationId: null })
           if (!existingLink) tem.persist(tem.create(UserRole, { user, role, createdAt: new Date() }))
         }
         await tem.flush()
@@ -713,7 +713,7 @@ async function ensureRoleAclFor(
   const uniqueFeatures = Array.from(new Set(features))
   await withAtomicFlush(em, [async () => {
     await lockRoleAclWriterAuthorizationState(em, [String(role.id)])
-    const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId }, {}, { tenantId, organizationId: null })
+    const existing = await findOneWithDecryption(em, RoleAcl, { role, tenantId, deletedAt: null }, {}, { tenantId, organizationId: null })
     if (!existing) {
       const acl = em.create(RoleAcl, {
         role,

package/src/modules/auth/migrations/Migration20260828120000_auth.ts

@@ -0,0 +1,70 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// `user_acls` and `role_acls` decide what a principal may do, and neither had
+// any uniqueness beyond its primary key. `RbacService.loadAcl` resolves the
+// per-user row with a bare `findOne` and RETURNS EARLY on a hit — the per-user
+// ACL replaces the role ACLs rather than merging with them — so two rows for
+// the same `(user_id, tenant_id)` were schema-legal and resolved with no
+// `ORDER BY`: whichever row Postgres happened to return decided the user's
+// entire feature set, and could change between requests.
+//
+// The write path makes that reachable rather than theoretical:
+// `auth.user_acl.update` reads with `findOne` and creates when it misses, so
+// two concurrent saves for the same user both miss and both insert.
+//
+// Partial unique indexes scoped to live rows (`where deleted_at is null`),
+// matching the shape already used for the sidebar tables in
+// Migration20260427143311. A `@Unique` decorator cannot express a partial
+// index, so the entities carry a comment pointing here instead.
+//
+// Historical duplicates are collapsed first — most recently updated row wins,
+// the rest are soft-deleted, never dropped — so the indexes can be created on
+// a database that already carries some.
+export class Migration20260828120000_auth extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`
+      with ranked as (
+        select id,
+               row_number() over (
+                 partition by user_id, tenant_id
+                 order by coalesce(updated_at, created_at) desc, created_at desc, id desc
+               ) as rn
+        from user_acls
+        where deleted_at is null
+      )
+      update user_acls
+      set deleted_at = now()
+      from ranked
+      where user_acls.id = ranked.id and ranked.rn > 1;
+    `);
+    this.addSql(`create unique index if not exists "user_acls_active_unique_idx" on "user_acls" ("user_id", "tenant_id") where "deleted_at" is null;`);
+
+    this.addSql(`
+      with ranked as (
+        select id,
+               row_number() over (
+                 partition by role_id, tenant_id
+                 order by coalesce(updated_at, created_at) desc, created_at desc, id desc
+               ) as rn
+        from role_acls
+        where deleted_at is null
+      )
+      update role_acls
+      set deleted_at = now()
+      from ranked
+      where role_acls.id = ranked.id and ranked.rn > 1;
+    `);
+    this.addSql(`create unique index if not exists "role_acls_active_unique_idx" on "role_acls" ("role_id", "tenant_id") where "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    // Only the indexes are reversible. The collapse soft-deleted rows rather
+    // than dropping them, so the data is still there to un-delete by hand if a
+    // deployment ever needs it; un-deleting automatically would recreate the
+    // ambiguity this migration exists to remove.
+    this.addSql(`drop index if exists "user_acls_active_unique_idx";`);
+    this.addSql(`drop index if exists "role_acls_active_unique_idx";`);
+  }
+
+}