@open-mercato/core 0.4.2-canary-f821f89ef6 → 0.4.2-canary-3b5064ce72

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -44,9 +44,13 @@ type UserProps = BaseProps & {
 
 type WidgetVisibilityEditorProps = RoleProps | UserProps
 
+export type WidgetVisibilityEditorHandle = {
+  save: () => Promise<void>
+}
+
 const EMPTY: string[] = []
 
-export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
+export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHandle, WidgetVisibilityEditorProps>(function WidgetVisibilityEditor(props, ref) {
   const t = useT()
   const { kind, targetId, tenantId, organizationId } = props
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
@@ -60,6 +64,15 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   const [originalMode, setOriginalMode] = React.useState<'inherit' | 'override'>('inherit')
   const [effective, setEffective] = React.useState<string[]>(EMPTY)
 
+  const dirty = React.useMemo(() => {
+    if (kind === 'user') {
+      if (mode !== originalMode) return true
+      if (mode === 'override') return selected.join('|') !== original.join('|')
+      return false
+    }
+    return selected.join('|') !== original.join('|')
+  }, [kind, mode, original, originalMode, selected])
+
   const loadCatalog = React.useCallback(async () => {
     const data = await readApiResultOrThrow<{ items?: unknown[] }>(
       '/api/dashboards/widgets/catalog',
@@ -149,6 +162,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   }, [original, originalMode])
 
   const save = React.useCallback(async () => {
+    if (loading) return
+    if (error && catalog.length === 0) return
+    if (!dirty) return
     setSaving(true)
     setError(null)
     try {
@@ -202,16 +218,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
     } finally {
       setSaving(false)
     }
-  }, [kind, mode, organizationId, selected, t, targetId, tenantId])
+  }, [catalog.length, dirty, error, kind, loading, mode, organizationId, selected, t, targetId, tenantId])
 
-  const dirty = React.useMemo(() => {
-    if (kind === 'user') {
-      if (mode !== originalMode) return true
-      if (mode === 'override') return selected.join('|') !== original.join('|')
-      return false
-    }
-    return selected.join('|') !== original.join('|')
-  }, [kind, mode, original, originalMode, selected])
+  React.useImperativeHandle(ref, () => ({ save }), [save])
 
   if (loading) {
     return (
@@ -297,4 +306,6 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
       </div>
     </div>
   )
-}
+})
+
+WidgetVisibilityEditor.displayName = 'WidgetVisibilityEditor'

package/src/modules/dashboards/lib/role-widgets.ts

@@ -0,0 +1,80 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { Role } from '@open-mercato/core/modules/auth/data/entities'
+import { DashboardRoleWidgets } from '../data/entities'
+import { loadAllWidgets } from './widgets'
+
+type RoleWidgetScope = {
+  tenantId: string
+  organizationId?: string | null
+  roleNames: string[]
+  widgetIds: string[]
+}
+
+async function findRoleByName(
+  em: EntityManager,
+  roleName: string,
+  tenantId: string,
+): Promise<Role | null> {
+  const tenantRole = await em.findOne(Role, { name: roleName, tenantId })
+  if (tenantRole) return tenantRole
+  return em.findOne(Role, { name: roleName, tenantId: null })
+}
+
+export async function resolveAnalyticsWidgetIds(): Promise<string[]> {
+  const widgets = await loadAllWidgets()
+  return widgets
+    .filter((widget) => widget.metadata.category === 'analytics' || widget.metadata.id.startsWith('dashboards.analytics.'))
+    .map((widget) => widget.metadata.id)
+}
+
+export async function appendWidgetsToRoles(
+  em: EntityManager,
+  { tenantId, organizationId = null, roleNames, widgetIds }: RoleWidgetScope,
+): Promise<boolean> {
+  const trimmedTenantId = tenantId.trim()
+  const widgets = await loadAllWidgets()
+  const validWidgetIds = new Set(widgets.map((widget) => widget.metadata.id))
+  const resolvedWidgetIds = widgetIds.filter((id) => validWidgetIds.has(id))
+  if (!resolvedWidgetIds.length) return false
+
+  let updated = false
+  await em.transactional(async (tem) => {
+    for (const roleName of roleNames) {
+      const role = await findRoleByName(tem, roleName, trimmedTenantId)
+      if (!role) continue
+
+      const record = await tem.findOne(DashboardRoleWidgets, {
+        roleId: String(role.id),
+        tenantId: trimmedTenantId,
+        organizationId,
+        deletedAt: null,
+      })
+      const roleRecord = record ?? (organizationId
+        ? await tem.findOne(DashboardRoleWidgets, {
+          roleId: String(role.id),
+          tenantId: trimmedTenantId,
+          organizationId: null,
+          deletedAt: null,
+        })
+        : null)
+      if (!roleRecord) continue
+
+      const current = Array.isArray(roleRecord.widgetIdsJson) ? roleRecord.widgetIdsJson : []
+      const next = [...current]
+      const existing = new Set(current)
+      for (const widgetId of resolvedWidgetIds) {
+        if (existing.has(widgetId)) continue
+        existing.add(widgetId)
+        next.push(widgetId)
+      }
+
+      if (next.length === current.length) continue
+      roleRecord.widgetIdsJson = next
+      roleRecord.updatedAt = new Date()
+      tem.persist(roleRecord)
+      updated = true
+    }
+  })
+
+  return updated
+}

package/src/modules/dashboards/services/widgetDataService.ts

@@ -1,6 +1,10 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
 import { createHash } from 'node:crypto'
+import { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
+import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
+import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   type DateRangePreset,
   resolveDateRange,
@@ -17,6 +21,8 @@ import {
 import type { AnalyticsRegistry } from './analyticsRegistry'
 
 const WIDGET_DATA_CACHE_TTL = 120_000
+const WIDGET_DATA_SEGMENT_TTL = 86_400_000
+const WIDGET_DATA_SEGMENT_KEY = 'widget-data:__segment__'
 
 const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/
 
@@ -168,6 +174,11 @@ export class WidgetDataService {
       const tags = this.getCacheTags(request.entityType)
       try {
         await this.cache.set(cacheKey, response, { ttl: WIDGET_DATA_CACHE_TTL, tags })
+        await this.cache.set(
+          WIDGET_DATA_SEGMENT_KEY,
+          { updatedAt: response.metadata.fetchedAt },
+          { ttl: WIDGET_DATA_SEGMENT_TTL, tags: ['widget-data'] },
+        )
       } catch {
       }
     }
@@ -282,6 +293,75 @@ export class WidgetDataService {
     assertSafeIdentifier(config.idColumn, 'id column')
     assertSafeIdentifier(config.labelColumn, 'label column')
 
+    const meta = this.resolveEntityMetadata(config.table)
+    const idProp = meta ? this.resolveEntityPropertyName(meta, config.idColumn) : null
+    const labelProp = meta ? this.resolveEntityPropertyName(meta, config.labelColumn) : null
+    const tenantProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'tenant_id') ?? this.resolveEntityPropertyName(meta, 'tenantId'))
+      : null
+    const organizationProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'organization_id') ?? this.resolveEntityPropertyName(meta, 'organizationId'))
+      : null
+    const entityName = meta ? ((meta as any).class ?? meta.className ?? meta.name) : null
+
+    if (meta && idProp && labelProp && tenantProp && entityName) {
+      const where: Record<string, unknown> = {
+        [idProp]: { $in: uniqueIds },
+        [tenantProp]: this.scope.tenantId,
+      }
+      if (organizationProp && this.scope.organizationIds && this.scope.organizationIds.length > 0) {
+        where[organizationProp] = { $in: this.scope.organizationIds }
+      }
+
+      try {
+        const records = await findWithDecryption(
+          this.em,
+          entityName,
+          where,
+          { fields: [idProp, labelProp, tenantProp, organizationProp].filter(Boolean) },
+          { tenantId: this.scope.tenantId, organizationId: this.resolveOrganizationId() },
+        )
+
+        const encryptionService = resolveTenantEncryptionService(this.em as any)
+        const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
+        let hasEncryptedLabels = false
+        let hasDecryptedLabels = false
+
+        const labelMap = new Map<string, string>()
+        for (const record of records as Array<Record<string, unknown>>) {
+          const id = record[idProp]
+          let labelValue = record[labelProp]
+          if (typeof labelValue === 'string' && this.isEncryptedPayload(labelValue)) {
+            hasEncryptedLabels = true
+            if (dek?.key) {
+              const decrypted = this.decryptWithDek(labelValue, dek.key)
+              if (decrypted !== null) {
+                labelValue = decrypted
+                hasDecryptedLabels = true
+              }
+            }
+          } else if (labelValue != null && labelValue !== '') {
+            hasDecryptedLabels = true
+          }
+
+          if (typeof id === 'string' && labelValue != null && labelValue !== '') {
+            labelMap.set(id, String(labelValue))
+          }
+        }
+
+        if (labelMap.size > 0 && (!hasEncryptedLabels || hasDecryptedLabels)) {
+          return data.map((item) => ({
+            ...item,
+            groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)
+              ? labelMap.get(item.groupKey)!
+              : undefined,
+          }))
+        }
+      } catch {
+        // fall through to SQL resolution
+      }
+    }
+
     const clauses = [`"${config.idColumn}" = ANY(?::uuid[])`, 'tenant_id = ?']
     const params: unknown[] = [`{${uniqueIds.join(',')}}`, this.scope.tenantId]
 
@@ -290,17 +370,43 @@ export class WidgetDataService {
       params.push(`{${this.scope.organizationIds.join(',')}}`)
     }
 
-    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label FROM "${config.table}" WHERE ${clauses.join(
+    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label, tenant_id, organization_id FROM "${config.table}" WHERE ${clauses.join(
       ' AND ',
     )}`
 
     try {
       const labelRows = await this.em.getConnection().execute(sql, params)
+      const entityId = this.resolveEntityId(meta)
+      const encryptionService = resolveTenantEncryptionService(this.em as any)
+      const organizationId = this.resolveOrganizationId()
+      const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
 
       const labelMap = new Map<string, string>()
-      for (const row of labelRows as Array<{ id: string; label: string | null }>) {
-        if (row.id && row.label != null && row.label !== '') {
-          labelMap.set(row.id, row.label)
+      for (const row of labelRows as Array<{ id: string; label: string | null; tenant_id?: string | null; organization_id?: string | null }>) {
+        let labelValue = row.label
+        if (entityId && encryptionService?.isEnabled() && labelValue != null) {
+          const rowOrgId = row.organization_id ?? organizationId ?? null
+          const decrypted = await encryptionService.decryptEntityPayload(
+            entityId,
+            { [config.labelColumn]: labelValue },
+            this.scope.tenantId,
+            rowOrgId,
+          )
+          const resolved = decrypted[config.labelColumn]
+          if (typeof resolved === 'string' || typeof resolved === 'number') {
+            labelValue = String(resolved)
+          }
+        }
+
+        if (labelValue && dek?.key && this.isEncryptedPayload(labelValue)) {
+          const decrypted = this.decryptWithDek(labelValue, dek.key)
+          if (decrypted !== null) {
+            labelValue = decrypted
+          }
+        }
+
+        if (row.id && labelValue != null && labelValue !== '') {
+          labelMap.set(row.id, labelValue)
         }
       }
 
@@ -317,6 +423,60 @@ export class WidgetDataService {
       }))
     }
   }
+
+  private resolveOrganizationId(): string | null {
+    if (!this.scope.organizationIds || this.scope.organizationIds.length !== 1) return null
+    return this.scope.organizationIds[0] ?? null
+  }
+
+  private resolveEntityMetadata(tableName: string): Record<string, any> | null {
+    const registry = (this.em as any)?.getMetadata?.()
+    if (!registry) return null
+    const entries =
+      (typeof registry.getAll === 'function' && registry.getAll()) ||
+      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))
+    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})
+    const match = metas.find((meta: any) => {
+      const table = meta?.tableName ?? meta?.collection
+      if (typeof table !== 'string') return false
+      if (table === tableName) return true
+      return table.split('.').pop() === tableName
+    })
+    return match ?? null
+  }
+
+  private resolveEntityPropertyName(meta: Record<string, any>, columnName: string): string | null {
+    const properties = meta?.properties ? Object.values(meta.properties) : []
+    for (const prop of properties as Array<Record<string, any>>) {
+      const fieldName = prop?.fieldName
+      const fieldNames = prop?.fieldNames
+      if (typeof fieldName === 'string' && fieldName === columnName) return prop?.name ?? null
+      if (Array.isArray(fieldNames) && fieldNames.includes(columnName)) return prop?.name ?? null
+      if (prop?.name === columnName) return prop?.name ?? null
+    }
+    return null
+  }
+
+  private resolveEntityId(meta: Record<string, any> | null): string | null {
+    if (!meta) return null
+    try {
+      return resolveEntityIdFromMetadata(meta as any)
+    } catch {
+      return null
+    }
+  }
+
+  private isEncryptedPayload(value: string): boolean {
+    const parts = value.split(':')
+    return parts.length === 4 && parts[3] === 'v1'
+  }
+
+  private decryptWithDek(value: string, dek: string): string | null {
+    const first = decryptWithAesGcm(value, dek)
+    if (first === null) return null
+    if (!this.isEncryptedPayload(first)) return first
+    return decryptWithAesGcm(first, dek) ?? first
+  }
 }
 
 export function createWidgetDataService(

package/src/modules/dashboards/widgets/dashboard/aov-kpi/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import AovKpiWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type AovKpiSettings } from './config'
+const AovKpiWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<AovKpiSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/new-customers-kpi/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import NewCustomersKpiWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type NewCustomersKpiSettings } from './config'
+const NewCustomersKpiWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<NewCustomersKpiSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/orders-by-status/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import OrdersByStatusWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type OrdersByStatusSettings } from './config'
+const OrdersByStatusWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<OrdersByStatusSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/orders-kpi/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import OrdersKpiWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type OrdersKpiSettings } from './config'
+const OrdersKpiWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<OrdersKpiSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/pipeline-summary/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import PipelineSummaryWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type PipelineSummarySettings } from './config'
+const PipelineSummaryWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<PipelineSummarySettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/revenue-kpi/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import RevenueKpiWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type RevenueKpiSettings } from './config'
+const RevenueKpiWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<RevenueKpiSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/revenue-trend/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import RevenueTrendWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type RevenueTrendSettings } from './config'
+const RevenueTrendWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<RevenueTrendSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/sales-by-region/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import SalesByRegionWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type SalesByRegionSettings } from './config'
+const SalesByRegionWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<SalesByRegionSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/top-customers/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import TopCustomersWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type TopCustomersSettings } from './config'
+const TopCustomersWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<TopCustomersSettings> = {
   metadata: {

package/src/modules/dashboards/widgets/dashboard/top-products/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import TopProductsWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type TopProductsSettings } from './config'
+const TopProductsWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<TopProductsSettings> = {
   metadata: {

package/src/modules/dictionaries/components/DictionaryTable.tsx

@@ -171,12 +171,14 @@ export function DictionaryTable({
               const items: RowActionItem[] = []
               if (onEdit) {
                 items.push({
+                  id: 'edit',
                   label: translations.editLabel,
                   onSelect: () => onEdit(entry),
                 })
               }
               if (onDelete) {
                 items.push({
+                  id: 'delete',
                   label: translations.deleteLabel,
                   onSelect: () => onDelete(entry),
                   destructive: true,

package/src/modules/directory/api/get/tenants/lookup.ts

@@ -0,0 +1,75 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
+import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+
+export const metadata = {
+  GET: {
+    requireAuth: false,
+  },
+}
+
+const tenantLookupQuerySchema = z.object({
+  tenantId: z.string().uuid(),
+})
+
+export async function GET(req: Request) {
+  const url = new URL(req.url)
+  const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''
+  const parsed = tenantLookupQuerySchema.safeParse({ tenantId })
+  if (!parsed.success) {
+    return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })
+  }
+
+  const container = await createRequestContainer()
+  const em = (container.resolve('em') as EntityManager)
+  const tenant = await em.findOne(Tenant, { id: parsed.data.tenantId, deletedAt: null })
+  if (!tenant) {
+    return NextResponse.json({ ok: false, error: 'Tenant not found.' }, { status: 404 })
+  }
+  return NextResponse.json({
+    ok: true,
+    tenant: { id: String(tenant.id), name: tenant.name },
+  })
+}
+
+const lookupTag = 'Directory'
+
+const tenantLookupSuccessSchema = z.object({
+  ok: z.literal(true),
+  tenant: z.object({
+    id: z.string().uuid(),
+    name: z.string(),
+  }),
+})
+
+const tenantLookupErrorSchema = z.object({
+  ok: z.literal(false),
+  error: z.string(),
+})
+
+const tenantLookupDoc: OpenApiMethodDoc = {
+  summary: 'Public tenant lookup',
+  description: 'Resolves tenant metadata for login/activation flows.',
+  tags: [lookupTag],
+  query: tenantLookupQuerySchema,
+  responses: [
+    { status: 200, description: 'Tenant resolved.', schema: tenantLookupSuccessSchema },
+  ],
+  errors: [
+    { status: 400, description: 'Invalid tenant id', schema: tenantLookupErrorSchema },
+    { status: 404, description: 'Tenant not found', schema: tenantLookupErrorSchema },
+  ],
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: lookupTag,
+  summary: 'Public tenant lookup',
+  methods: {
+    GET: tenantLookupDoc,
+  },
+}
+
+export default GET

package/src/modules/directory/backend/directory/organizations/page.tsx

@@ -235,8 +235,8 @@ export default function DirectoryOrganizationsPage() {
             canManage ? (
               <RowActions
                 items={[
-                  { label: t('directory.organizations.list.actions.edit', 'Edit'), href: `/backend/directory/organizations/${row.id}/edit` },
-                  { label: t('directory.organizations.list.actions.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
+                  { id: 'edit', label: t('directory.organizations.list.actions.edit', 'Edit'), href: `/backend/directory/organizations/${row.id}/edit` },
+                  { id: 'delete', label: t('directory.organizations.list.actions.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
                 ]}
               />
             ) : null

package/src/modules/directory/backend/directory/tenants/page.tsx

@@ -160,8 +160,8 @@ export default function DirectoryTenantsPage() {
             canManage ? (
               <RowActions
                 items={[
-                  { label: t('common.edit', 'Edit'), href: `/backend/directory/tenants/${row.id}/edit` },
-                  { label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
+                  { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/directory/tenants/${row.id}/edit` },
+                  { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
                 ]}
               />
             ) : null

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -338,8 +338,8 @@ export RECORD_ID="<record uuid>"`}</code></pre>
           rowActions={(row) => (
             <RowActions
               items={[
-                { label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
-                { label: 'Delete', destructive: true, onSelect: async () => {
+                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
+                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
                   try {
                     if (typeof window !== 'undefined') {
                       const ok = window.confirm('Delete this record?')

package/src/modules/entities/components/SystemEntitiesTable.tsx

@@ -88,7 +88,7 @@ export default function SystemEntitiesTable() {
       rowActions={(row) => (
         <RowActions
           items={[
-            { label: 'Edit', href: `/backend/entities/system/${encodeURIComponent(row.entityId)}` },
+            { id: 'edit', label: 'Edit', href: `/backend/entities/system/${encodeURIComponent(row.entityId)}` },
           ]}
         />
       )}

package/src/modules/entities/components/UserEntitiesTable.tsx

@@ -110,8 +110,8 @@ export default function UserEntitiesTable() {
       rowActions={(row) => (
         <RowActions
           items={[
-            { label: t('common.edit', 'Edit'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}` },
-            { label: t('entities.user.table.actions.showRecords', 'Show records'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}/records` },
+            { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}` },
+            { id: 'show-records', label: t('entities.user.table.actions.showRecords', 'Show records'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}/records` },
           ]}
         />
       )}

package/src/modules/feature_toggles/components/FeatureTogglesTable.tsx

@@ -205,12 +205,11 @@ export function FeatureTogglesTable() {
       }}
       rowActions={(row) => (
         <RowActions items={[
-          { label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.id}/edit` },
-          { label: t('common.view', 'Overrides'), href: `/backend/feature-toggles/global/${row.id}` },
-          { label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
+          { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.id}/edit` },
+          { id: 'view', label: t('common.view', 'Overrides'), href: `/backend/feature-toggles/global/${row.id}` },
+          { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
         ]} />
       )}
     />
   )
 }
-

package/src/modules/feature_toggles/components/OverridesTable.tsx

@@ -161,7 +161,7 @@ export default function OverridesTable() {
             }}
             rowActions={(row) => (
                 <RowActions items={[
-                    { label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.toggleId}` },
+                    { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.toggleId}` },
                 ]} />
             )}
             error={error ? error.message : undefined}