@open-mercato/core 0.10.1-develop.7836.1.0ef0f453c6 → 0.10.1-develop.7841.1.af87ac614d

package/src/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.tsx

@@ -6,6 +6,7 @@ import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Globe, Settings } from 'lucide-react'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
+import { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'
 import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
@@ -20,6 +21,7 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
+import { OrganizationSelect } from '@open-mercato/core/modules/directory/components/OrganizationSelect'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'
 import { useDemoPortalAccounts } from '../useDemoPortalAccounts'
@@ -54,38 +56,49 @@ function formatDate(value: string | null | undefined, fallback: string): string
   return date.toLocaleDateString()
 }
 
-async function fetchRoleFilterOptions(): Promise<Array<{ value: string; label: string; id: string }>> {
+type RoleOption = { value: string; label: string; id: string }
+
+type OrganizationRolesState =
+  | { organizationId: string; status: 'loading' | 'error' }
+  | { organizationId: string; status: 'loaded'; options: RoleOption[] }
+
+async function fetchRoleFilterOptions(organizationId?: string | null): Promise<RoleOption[] | null> {
   try {
+    const params = new URLSearchParams({ pageSize: '100' })
+    if (organizationId) params.set('organizationId', organizationId)
     const call = await apiCall<{ items?: Array<{ id: string; name: string }> }>(
-      '/api/customer_accounts/admin/roles?pageSize=100',
+      `/api/customer_accounts/admin/roles?${params.toString()}`,
     )
-    if (!call.ok) return []
-    const items = Array.isArray(call.result?.items) ? call.result!.items : []
+    if (!call.ok || !Array.isArray(call.result?.items)) return null
+    const items = call.result.items
     return items
       .filter((item) => typeof item?.id === 'string' && typeof item?.name === 'string')
       .map((item) => ({ value: item.id, label: item.name, id: item.id }))
   } catch {
-    return []
+    return null
   }
 }
 
 function CreateUserDialog({
   open,
   onOpenChange,
-  roleOptions,
   onCreated,
   onRunMutation,
+  activeOrganizationId,
 }: {
   open: boolean
   onOpenChange: (next: boolean) => void
-  roleOptions: Array<{ id: string; label: string }>
   onCreated: () => void
   onRunMutation: <T>(operation: () => Promise<T>) => Promise<T>
+  activeOrganizationId: string | null
 }) {
   const t = useT()
   const [email, setEmail] = React.useState('')
   const [displayName, setDisplayName] = React.useState('')
   const [password, setPassword] = React.useState('')
+  const [organizationId, setOrganizationId] = React.useState<string | null>(null)
+  const [organizationRoles, setOrganizationRoles] = React.useState<OrganizationRolesState | null>(null)
+  const [roleReloadToken, setRoleReloadToken] = React.useState(0)
   const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])
   const [isSubmitting, setIsSubmitting] = React.useState(false)
 
@@ -93,6 +106,34 @@ function CreateUserDialog({
     setEmail('')
     setDisplayName('')
     setPassword('')
+    setOrganizationId(null)
+    setSelectedRoleIds([])
+  }, [])
+
+  const requireOrganization = !activeOrganizationId
+  const roleOrganizationId = organizationId ?? activeOrganizationId
+
+  React.useEffect(() => {
+    if (!open || !roleOrganizationId) {
+      setOrganizationRoles(null)
+      return
+    }
+    let cancelled = false
+    setOrganizationRoles({ organizationId: roleOrganizationId, status: 'loading' })
+    fetchRoleFilterOptions(roleOrganizationId).then((opts) => {
+      if (cancelled) return
+      setOrganizationRoles(opts === null
+        ? { organizationId: roleOrganizationId, status: 'error' }
+        : { organizationId: roleOrganizationId, status: 'loaded', options: opts })
+    })
+    return () => { cancelled = true }
+  }, [open, roleOrganizationId, roleReloadToken])
+
+  const currentOrganizationRoles = organizationRoles?.organizationId === roleOrganizationId ? organizationRoles : null
+  const availableRoleOptions = currentOrganizationRoles?.status === 'loaded' ? currentOrganizationRoles.options : []
+
+  const handleOrganizationChange = React.useCallback((next: string | null) => {
+    setOrganizationId(next ?? null)
     setSelectedRoleIds([])
   }, [])
 
@@ -102,6 +143,10 @@ function CreateUserDialog({
       flash(t('customer_accounts.admin.createUser.error.required', 'Email, name, and password are required'), 'error')
       return
     }
+    if (requireOrganization && !organizationId) {
+      flash(t('customer_accounts.admin.createUser.error.organizationRequired', 'Select an organization for the new user'), 'error')
+      return
+    }
     setIsSubmitting(true)
     try {
       await onRunMutation(async () => {
@@ -115,6 +160,7 @@ function CreateUserDialog({
               displayName: displayName.trim(),
               password,
               roleIds: selectedRoleIds.length > 0 ? selectedRoleIds : undefined,
+              organizationId: organizationId ?? undefined,
             }),
           },
         )
@@ -133,7 +179,7 @@ function CreateUserDialog({
     } finally {
       setIsSubmitting(false)
     }
-  }, [displayName, email, onCreated, onOpenChange, onRunMutation, password, resetForm, selectedRoleIds, t])
+  }, [displayName, email, onCreated, onOpenChange, onRunMutation, organizationId, password, requireOrganization, resetForm, selectedRoleIds, t])
 
   const handleKeyDown = React.useCallback((event: React.KeyboardEvent) => {
     if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {
@@ -189,11 +235,43 @@ function CreateUserDialog({
               autoComplete="new-password"
             />
           </div>
-          {roleOptions.length > 0 && (
+          <div className="space-y-2">
+            <label className="text-sm font-medium" htmlFor="create-organization">
+              {t('customer_accounts.admin.createUser.fields.organization', 'Organization')}
+            </label>
+            <OrganizationSelect
+              id="create-organization"
+              value={organizationId}
+              onChange={handleOrganizationChange}
+              required={requireOrganization}
+              includeEmptyOption
+              emptyOptionLabel={requireOrganization
+                ? t('customer_accounts.admin.createUser.fields.organizationPlaceholder', 'Select an organization')
+                : t('customer_accounts.admin.createUser.fields.organizationCurrent', 'Current organization')}
+              className="w-full h-9 rounded border px-2 text-sm"
+            />
+          </div>
+          {roleOrganizationId && (
             <div className="space-y-2">
               <p className="text-sm font-medium">{t('customer_accounts.admin.createUser.fields.roles', 'Roles')}</p>
+              {currentOrganizationRoles?.status === 'error' ? (
+                <ErrorMessage
+                  label={t('customer_accounts.admin.createUser.error.loadRoles', 'Could not load roles for this organization')}
+                  action={
+                    <Button type="button" variant="outline" size="sm" onClick={() => setRoleReloadToken((token) => token + 1)}>
+                      {t('customer_accounts.admin.createUser.actions.retryRoles', 'Retry')}
+                    </Button>
+                  }
+                />
+              ) : currentOrganizationRoles?.status !== 'loaded' ? (
+                <LoadingMessage label={t('customer_accounts.admin.createUser.loadingRoles', 'Loading roles...')} />
+              ) : availableRoleOptions.length === 0 ? (
+                <p className="text-sm text-muted-foreground">
+                  {t('customer_accounts.admin.createUser.noRoles', 'No roles are available for this organization')}
+                </p>
+              ) : null}
               <div className="flex flex-wrap gap-2">
-                {roleOptions.map((role) => {
+                {availableRoleOptions.map((role) => {
                   const isSelected = selectedRoleIds.includes(role.id)
                   return (
                     <Button
@@ -233,9 +311,14 @@ function CreateUserDialog({
 export type PortalUsersPageClientProps = {
   portalOrigin: string
   portalOrgSlug?: string | null
+  activeOrganizationId?: string | null
 }
 
-export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: PortalUsersPageClientProps) {
+export function PortalUsersPageClient({
+  portalOrigin,
+  portalOrgSlug = null,
+  activeOrganizationId = null,
+}: PortalUsersPageClientProps) {
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const t = useT()
   const router = useRouter()
@@ -274,7 +357,7 @@ export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: Po
   React.useEffect(() => {
     let cancelled = false
     fetchRoleFilterOptions().then((opts) => {
-      if (!cancelled) setRoleOptions(opts)
+      if (!cancelled) setRoleOptions(opts ?? [])
     })
     return () => { cancelled = true }
   }, [])
@@ -613,9 +696,9 @@ export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: Po
       <CreateUserDialog
         open={createDialogOpen}
         onOpenChange={setCreateDialogOpen}
-        roleOptions={roleOptions}
         onCreated={() => setReloadToken((token) => token + 1)}
         onRunMutation={runMutationWithContext}
+        activeOrganizationId={activeOrganizationId}
       />
       {ConfirmDialogElement}
     </>

package/src/modules/customer_accounts/backend/customer_accounts/users/page.tsx

@@ -1,4 +1,6 @@
 import { headers } from 'next/headers'
+import { getAuthFromCookies } from '@open-mercato/shared/lib/auth/server'
+import { resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { resolvePortalRequestOrigin } from '../../../lib/portalUrl'
 import { resolveCurrentOrgPortalSlug } from '../../../lib/portalOrgSlug'
@@ -7,10 +9,16 @@ import { PortalUsersPageClient } from './PortalUsersPageClient'
 export default async function CustomerAccountsPage() {
   const portalOrigin = resolvePortalRequestOrigin(await headers())
   const portalOrgSlug = await resolveCurrentOrgPortalSlug()
+  const auth = await getAuthFromCookies().catch(() => null)
+  const activeOrganizationId = resolveActiveOrganizationId(auth)
   return (
     <Page>
       <PageBody className="space-y-4">
-        <PortalUsersPageClient portalOrigin={portalOrigin} portalOrgSlug={portalOrgSlug} />
+        <PortalUsersPageClient
+          portalOrigin={portalOrigin}
+          portalOrgSlug={portalOrgSlug}
+          activeOrganizationId={activeOrganizationId}
+        />
       </PageBody>
     </Page>
   )

package/src/modules/customer_accounts/data/validators.ts

@@ -96,6 +96,7 @@ export const adminCreateUserSchema = z.object({
   displayName: displayNameField,
   roleIds: z.array(z.string().uuid()).optional(),
   customerEntityId: z.string().uuid().optional(),
+  organizationId: z.string().uuid().optional(),
 })
 
 export const adminUpdateUserSchema = z.object({

package/src/modules/customer_accounts/i18n/de.json

@@ -18,16 +18,24 @@
   "customer_accounts.admin.createUser.actions.cancel": "Abbrechen",
   "customer_accounts.admin.createUser.actions.create": "Benutzer erstellen",
   "customer_accounts.admin.createUser.actions.creating": "Erstellen...",
+  "customer_accounts.admin.createUser.actions.retryRoles": "Erneut versuchen",
+  "customer_accounts.admin.createUser.error.loadRoles": "Die Rollen dieser Organisation konnten nicht geladen werden",
+  "customer_accounts.admin.createUser.error.organizationRequired": "Wählen Sie eine Organisation für den neuen Benutzer aus",
   "customer_accounts.admin.createUser.error.required": "E-Mail, Name und Passwort sind erforderlich",
   "customer_accounts.admin.createUser.error.save": "Benutzer konnte nicht erstellt werden",
   "customer_accounts.admin.createUser.fields.displayName": "Anzeigename",
   "customer_accounts.admin.createUser.fields.displayNamePlaceholder": "Max Mustermann",
   "customer_accounts.admin.createUser.fields.email": "E-Mail",
   "customer_accounts.admin.createUser.fields.emailPlaceholder": "benutzer@beispiel.de",
+  "customer_accounts.admin.createUser.fields.organization": "Organisation",
+  "customer_accounts.admin.createUser.fields.organizationCurrent": "Aktuelle Organisation",
+  "customer_accounts.admin.createUser.fields.organizationPlaceholder": "Organisation auswählen",
   "customer_accounts.admin.createUser.fields.password": "Passwort",
   "customer_accounts.admin.createUser.fields.passwordPlaceholder": "Min. 8 Zeichen",
   "customer_accounts.admin.createUser.fields.roles": "Rollen",
   "customer_accounts.admin.createUser.flash.created": "Benutzer erstellt",
+  "customer_accounts.admin.createUser.loadingRoles": "Rollen werden geladen...",
+  "customer_accounts.admin.createUser.noRoles": "Für diese Organisation sind keine Rollen verfügbar",
   "customer_accounts.admin.createUser.title": "Kundenbenutzer erstellen",
   "customer_accounts.admin.detail.actions.backToList": "Back to list",
   "customer_accounts.admin.detail.actions.delete": "Delete",
@@ -96,6 +104,8 @@
   "customer_accounts.admin.error.delete": "Failed to delete user",
   "customer_accounts.admin.error.loadUsers": "Failed to load customer users",
   "customer_accounts.admin.error.toggleActive": "Failed to update user status",
+  "customer_accounts.admin.errors.insufficientPermissions": "Unzureichende Berechtigungen",
+  "customer_accounts.admin.errors.organizationNotFound": "Organisation nicht gefunden",
   "customer_accounts.admin.filters.active": "Active",
   "customer_accounts.admin.filters.inactive": "Inactive",
   "customer_accounts.admin.filters.role": "Role",

package/src/modules/customer_accounts/i18n/en.json

@@ -18,16 +18,24 @@
   "customer_accounts.admin.createUser.actions.cancel": "Cancel",
   "customer_accounts.admin.createUser.actions.create": "Create User",
   "customer_accounts.admin.createUser.actions.creating": "Creating...",
+  "customer_accounts.admin.createUser.actions.retryRoles": "Retry",
+  "customer_accounts.admin.createUser.error.loadRoles": "Could not load roles for this organization",
+  "customer_accounts.admin.createUser.error.organizationRequired": "Select an organization for the new user",
   "customer_accounts.admin.createUser.error.required": "Email, name, and password are required",
   "customer_accounts.admin.createUser.error.save": "Failed to create user",
   "customer_accounts.admin.createUser.fields.displayName": "Display Name",
   "customer_accounts.admin.createUser.fields.displayNamePlaceholder": "John Doe",
   "customer_accounts.admin.createUser.fields.email": "Email",
   "customer_accounts.admin.createUser.fields.emailPlaceholder": "user@example.com",
+  "customer_accounts.admin.createUser.fields.organization": "Organization",
+  "customer_accounts.admin.createUser.fields.organizationCurrent": "Current organization",
+  "customer_accounts.admin.createUser.fields.organizationPlaceholder": "Select an organization",
   "customer_accounts.admin.createUser.fields.password": "Password",
   "customer_accounts.admin.createUser.fields.passwordPlaceholder": "Min. 8 characters",
   "customer_accounts.admin.createUser.fields.roles": "Roles",
   "customer_accounts.admin.createUser.flash.created": "User created",
+  "customer_accounts.admin.createUser.loadingRoles": "Loading roles...",
+  "customer_accounts.admin.createUser.noRoles": "No roles are available for this organization",
   "customer_accounts.admin.createUser.title": "Create Customer User",
   "customer_accounts.admin.detail.actions.backToList": "Back to list",
   "customer_accounts.admin.detail.actions.delete": "Delete",
@@ -96,6 +104,8 @@
   "customer_accounts.admin.error.delete": "Failed to delete user",
   "customer_accounts.admin.error.loadUsers": "Failed to load customer users",
   "customer_accounts.admin.error.toggleActive": "Failed to update user status",
+  "customer_accounts.admin.errors.insufficientPermissions": "Insufficient permissions",
+  "customer_accounts.admin.errors.organizationNotFound": "Organization not found",
   "customer_accounts.admin.filters.active": "Active",
   "customer_accounts.admin.filters.inactive": "Inactive",
   "customer_accounts.admin.filters.role": "Role",

package/src/modules/customer_accounts/i18n/es.json

@@ -18,16 +18,24 @@
   "customer_accounts.admin.createUser.actions.cancel": "Cancelar",
   "customer_accounts.admin.createUser.actions.create": "Crear usuario",
   "customer_accounts.admin.createUser.actions.creating": "Creando...",
+  "customer_accounts.admin.createUser.actions.retryRoles": "Reintentar",
+  "customer_accounts.admin.createUser.error.loadRoles": "No se pudieron cargar los roles de esta organización",
+  "customer_accounts.admin.createUser.error.organizationRequired": "Selecciona una organización para el nuevo usuario",
   "customer_accounts.admin.createUser.error.required": "Correo, nombre y contraseña son obligatorios",
   "customer_accounts.admin.createUser.error.save": "No se pudo crear el usuario",
   "customer_accounts.admin.createUser.fields.displayName": "Nombre para mostrar",
   "customer_accounts.admin.createUser.fields.displayNamePlaceholder": "Juan García",
   "customer_accounts.admin.createUser.fields.email": "Correo electrónico",
   "customer_accounts.admin.createUser.fields.emailPlaceholder": "usuario@ejemplo.com",
+  "customer_accounts.admin.createUser.fields.organization": "Organización",
+  "customer_accounts.admin.createUser.fields.organizationCurrent": "Organización actual",
+  "customer_accounts.admin.createUser.fields.organizationPlaceholder": "Selecciona una organización",
   "customer_accounts.admin.createUser.fields.password": "Contraseña",
   "customer_accounts.admin.createUser.fields.passwordPlaceholder": "Mín. 8 caracteres",
   "customer_accounts.admin.createUser.fields.roles": "Roles",
   "customer_accounts.admin.createUser.flash.created": "Usuario creado",
+  "customer_accounts.admin.createUser.loadingRoles": "Cargando roles...",
+  "customer_accounts.admin.createUser.noRoles": "No hay roles disponibles para esta organización",
   "customer_accounts.admin.createUser.title": "Crear usuario de cliente",
   "customer_accounts.admin.detail.actions.backToList": "Back to list",
   "customer_accounts.admin.detail.actions.delete": "Delete",
@@ -96,6 +104,8 @@
   "customer_accounts.admin.error.delete": "Failed to delete user",
   "customer_accounts.admin.error.loadUsers": "Failed to load customer users",
   "customer_accounts.admin.error.toggleActive": "Failed to update user status",
+  "customer_accounts.admin.errors.insufficientPermissions": "Permisos insuficientes",
+  "customer_accounts.admin.errors.organizationNotFound": "Organización no encontrada",
   "customer_accounts.admin.filters.active": "Active",
   "customer_accounts.admin.filters.inactive": "Inactive",
   "customer_accounts.admin.filters.role": "Role",

package/src/modules/customer_accounts/i18n/ko.json

@@ -18,16 +18,24 @@
   "customer_accounts.admin.createUser.actions.cancel": "취소",
   "customer_accounts.admin.createUser.actions.create": "사용자 생성",
   "customer_accounts.admin.createUser.actions.creating": "생성 중...",
+  "customer_accounts.admin.createUser.actions.retryRoles": "다시 시도",
+  "customer_accounts.admin.createUser.error.loadRoles": "이 조직의 역할을 불러오지 못했습니다",
+  "customer_accounts.admin.createUser.error.organizationRequired": "새 사용자의 조직을 선택하세요",
   "customer_accounts.admin.createUser.error.required": "이메일, 이름, 비밀번호는 필수입니다",
   "customer_accounts.admin.createUser.error.save": "사용자 생성에 실패했습니다",
   "customer_accounts.admin.createUser.fields.displayName": "표시 이름",
   "customer_accounts.admin.createUser.fields.displayNamePlaceholder": "홍길동",
   "customer_accounts.admin.createUser.fields.email": "이메일",
   "customer_accounts.admin.createUser.fields.emailPlaceholder": "user@example.com",
+  "customer_accounts.admin.createUser.fields.organization": "조직",
+  "customer_accounts.admin.createUser.fields.organizationCurrent": "현재 조직",
+  "customer_accounts.admin.createUser.fields.organizationPlaceholder": "조직 선택",
   "customer_accounts.admin.createUser.fields.password": "비밀번호",
   "customer_accounts.admin.createUser.fields.passwordPlaceholder": "최소 8자",
   "customer_accounts.admin.createUser.fields.roles": "역할",
   "customer_accounts.admin.createUser.flash.created": "사용자가 생성되었습니다",
+  "customer_accounts.admin.createUser.loadingRoles": "역할을 불러오는 중...",
+  "customer_accounts.admin.createUser.noRoles": "이 조직에 사용 가능한 역할이 없습니다",
   "customer_accounts.admin.createUser.title": "고객 사용자 생성",
   "customer_accounts.admin.detail.actions.backToList": "목록으로 돌아가기",
   "customer_accounts.admin.detail.actions.delete": "삭제",
@@ -96,6 +104,8 @@
   "customer_accounts.admin.error.delete": "사용자 삭제에 실패했습니다",
   "customer_accounts.admin.error.loadUsers": "고객 사용자를 불러오지 못했습니다",
   "customer_accounts.admin.error.toggleActive": "사용자 상태 업데이트에 실패했습니다",
+  "customer_accounts.admin.errors.insufficientPermissions": "권한이 부족합니다",
+  "customer_accounts.admin.errors.organizationNotFound": "조직을 찾을 수 없습니다",
   "customer_accounts.admin.filters.active": "활성",
   "customer_accounts.admin.filters.inactive": "비활성",
   "customer_accounts.admin.filters.role": "역할",

package/src/modules/customer_accounts/i18n/pl.json

@@ -18,16 +18,24 @@
   "customer_accounts.admin.createUser.actions.cancel": "Anuluj",
   "customer_accounts.admin.createUser.actions.create": "Utwórz użytkownika",
   "customer_accounts.admin.createUser.actions.creating": "Tworzenie...",
+  "customer_accounts.admin.createUser.actions.retryRoles": "Spróbuj ponownie",
+  "customer_accounts.admin.createUser.error.loadRoles": "Nie udało się wczytać ról tej organizacji",
+  "customer_accounts.admin.createUser.error.organizationRequired": "Wybierz organizację dla nowego użytkownika",
   "customer_accounts.admin.createUser.error.required": "E-mail, nazwa i hasło są wymagane",
   "customer_accounts.admin.createUser.error.save": "Nie udało się utworzyć użytkownika",
   "customer_accounts.admin.createUser.fields.displayName": "Nazwa wyświetlana",
   "customer_accounts.admin.createUser.fields.displayNamePlaceholder": "Jan Kowalski",
   "customer_accounts.admin.createUser.fields.email": "E-mail",
   "customer_accounts.admin.createUser.fields.emailPlaceholder": "uzytkownik@przyklad.pl",
+  "customer_accounts.admin.createUser.fields.organization": "Organizacja",
+  "customer_accounts.admin.createUser.fields.organizationCurrent": "Bieżąca organizacja",
+  "customer_accounts.admin.createUser.fields.organizationPlaceholder": "Wybierz organizację",
   "customer_accounts.admin.createUser.fields.password": "Hasło",
   "customer_accounts.admin.createUser.fields.passwordPlaceholder": "Min. 8 znaków",
   "customer_accounts.admin.createUser.fields.roles": "Role",
   "customer_accounts.admin.createUser.flash.created": "Użytkownik utworzony",
+  "customer_accounts.admin.createUser.loadingRoles": "Wczytywanie ról...",
+  "customer_accounts.admin.createUser.noRoles": "W tej organizacji nie ma dostępnych ról",
   "customer_accounts.admin.createUser.title": "Utwórz użytkownika klienta",
   "customer_accounts.admin.detail.actions.backToList": "Powrót do listy",
   "customer_accounts.admin.detail.actions.delete": "Usuń",
@@ -96,6 +104,8 @@
   "customer_accounts.admin.error.delete": "Nie udało się usunąć użytkownika",
   "customer_accounts.admin.error.loadUsers": "Nie udało się załadować kont klientów",
   "customer_accounts.admin.error.toggleActive": "Nie udało się zmienić statusu użytkownika",
+  "customer_accounts.admin.errors.insufficientPermissions": "Niewystarczające uprawnienia",
+  "customer_accounts.admin.errors.organizationNotFound": "Nie znaleziono organizacji",
   "customer_accounts.admin.filters.active": "Aktywny",
   "customer_accounts.admin.filters.inactive": "Nieaktywny",
   "customer_accounts.admin.filters.role": "Rola",

package/src/modules/customer_accounts/lib/adminOrganizationScope.ts

@@ -0,0 +1,71 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import {
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId,
+} from '@open-mercato/shared/lib/auth/organizationScope'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+export type AdminTargetOrganizationResult =
+  | { ok: true; organizationId: string }
+  | { ok: false; response: Response }
+
+const organizationIdSchema = z.string().uuid()
+
+async function organizationNotFound(): Promise<AdminTargetOrganizationResult> {
+  const { translate } = await resolveTranslations()
+  return {
+    ok: false,
+    response: NextResponse.json({ ok: false, error: translate('customer_accounts.admin.errors.organizationNotFound', 'Organization not found') }, { status: 400 }),
+  }
+}
+
+/**
+ * Resolves the organization a staff-initiated customer-accounts write targets.
+ *
+ * Without a request the caller's active organization is used, falling back to the
+ * actor's own organization under an "all organizations" selection.
+ *
+ * An explicitly requested organization is honored only when the organization-scope
+ * resolver grants it for the caller's own tenant: it must exist, not be deleted, and
+ * sit inside the caller's allowed organization set.
+ */
+export async function resolveAdminTargetOrganization({
+  container,
+  auth,
+  request,
+  requestedOrganizationId,
+}: {
+  container: AwilixContainer
+  auth: NonNullable<AuthContext>
+  request: Request
+  requestedOrganizationId?: string | null
+}): Promise<AdminTargetOrganizationResult> {
+  const requested = typeof requestedOrganizationId === 'string' && requestedOrganizationId.trim().length > 0
+    ? requestedOrganizationId.trim()
+    : null
+  const activeOrganizationId = resolveActiveOrganizationId(auth)
+
+  if (!requested) {
+    if (!activeOrganizationId) return { ok: false, response: organizationScopeRequiredResponse() }
+    return { ok: true, organizationId: activeOrganizationId }
+  }
+
+  if (!organizationIdSchema.safeParse(requested).success) return organizationNotFound()
+  if (requested === activeOrganizationId) return { ok: true, organizationId: requested }
+
+  const scope = await resolveOrganizationScopeForRequest({
+    container,
+    auth,
+    request,
+    selectedId: requested,
+    tenantId: auth.tenantId ?? null,
+  })
+  if (scope.selectionRejected || scope.selectedId !== requested || scope.tenantId !== (auth.tenantId ?? null)) {
+    return organizationNotFound()
+  }
+  return { ok: true, organizationId: requested }
+}

package/src/modules/customers/api/customer-dictionary-entries/route.ts

@@ -0,0 +1,82 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { FilterQuery } from '@mikro-orm/core'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { CustomerDictionaryEntry } from '../../data/entities'
+import { resolveDictionaryRouteContext } from '../dictionaries/context'
+import { createPagedListResponseSchema } from '../openapi'
+
+const querySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(100).default(20),
+  search: z.string().trim().max(150).optional(),
+  id: z.string().uuid().optional(),
+})
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.settings.manage', 'translations.view'] },
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const query = querySchema.parse({
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+      search: url.searchParams.get('search') ?? undefined,
+      id: url.searchParams.get('id') ?? undefined,
+    })
+    const { em, tenantId, organizationId, translate } = await resolveDictionaryRouteContext(req)
+    if (!organizationId) {
+      return NextResponse.json({ error: translate('customers.errors.organization_required', 'Organization context is required') }, { status: 400 })
+    }
+    const where: FilterQuery<CustomerDictionaryEntry> = {
+      tenantId,
+      organizationId,
+      ...(query.id ? { id: query.id } : {}),
+      ...(query.search ? { label: { $ilike: `%${escapeLikePattern(query.search)}%` } } : {}),
+    }
+    const total = await em.count(CustomerDictionaryEntry, where)
+    const entries = await findWithDecryption(em, CustomerDictionaryEntry, where, {
+      orderBy: { kind: 'asc', label: 'asc', id: 'asc' },
+      limit: query.pageSize,
+      offset: (query.page - 1) * query.pageSize,
+    }, { tenantId, organizationId })
+    return NextResponse.json({
+      items: entries.map(({ id, kind, value, label, updatedAt }) => ({ id, kind, value, label, updatedAt })),
+      total,
+      page: query.page,
+      pageSize: query.pageSize,
+      totalPages: Math.ceil(total / query.pageSize),
+    })
+  } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
+    if (error instanceof z.ZodError) {
+      const { translate } = await resolveTranslations()
+      return NextResponse.json({ error: translate('customers.errors.invalid_query', 'Invalid query parameters') }, { status: 400 })
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Customer dictionary translation records',
+  methods: {
+    GET: {
+      summary: 'List base labels for translation management',
+      query: querySchema,
+      responses: [{
+        status: 200,
+        description: 'Dictionary entries in the selected organization with their stored base labels',
+        schema: createPagedListResponseSchema(z.object({
+          id: z.string().uuid(), kind: z.string(), value: z.string(), label: z.string(), updatedAt: z.string(),
+        })),
+      }],
+    },
+  },
+}