@open-mercato/core 0.6.2-develop.3461.1.605f31c2c9 → 0.6.2

package/src/modules/auth/lib/grantChecks.ts

@@ -1,8 +1,8 @@
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { hasFeature } from '@open-mercato/shared/security/features'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Role, RoleAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Role, RoleAcl, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 type ActorAcl = {
@@ -33,6 +33,16 @@ type FeatureGrantCheckInput = GrantCheckContext & {
   organizations?: string[] | null
 }
 
+type SuperAdminUserTargetInput = GrantCheckContext & {
+  targetUserId: string
+  actorIsSuperAdmin?: boolean
+}
+
+type SuperAdminRoleTargetInput = GrantCheckContext & {
+  targetRoleId: string
+  actorIsSuperAdmin?: boolean
+}
+
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 export async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {
@@ -99,6 +109,110 @@ export function normalizeGrantFeatureList(features: unknown): string[] {
   return normalizeStringList(features)
 }
 
+export async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator accounts.')
+  }
+}
+
+export async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator roles.')
+  }
+}
+
+async function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {
+  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin
+  const acl = await loadActorAcl(input)
+  return acl.isSuperAdmin
+}
+
+export async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {
+  const directGrant = await em.findOne(
+    UserAcl,
+    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,
+  )
+  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId as unknown } as FilterQuery<UserRole>,
+    { populate: ['role'] },
+    { tenantId: null, organizationId: null },
+  )
+  const roleIds = (Array.isArray(links) ? links : [])
+    .map((link) => {
+      const role = (link as { role?: { id?: unknown } | string | null }).role
+      if (!role) return null
+      if (typeof role === 'string') return role
+      return role.id ? String(role.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (!roleIds.length) return false
+  const roleGrant = await em.findOne(
+    RoleAcl,
+    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {
+  const grant = await em.findOne(
+    RoleAcl,
+    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {
+  const ids = new Set<string>()
+  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }
+  if (tenantId) userAclFilter.tenantId = tenantId
+  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)
+  for (const acl of userAcls) {
+    const userRef = (acl as { user?: { id?: unknown } | string | null }).user
+    const userId = userRef && typeof userRef === 'object'
+      ? userRef.id
+      : userRef
+    if (userId) ids.add(String(userId))
+  }
+  const roleAcls = await em.find(
+    RoleAcl,
+    { isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  const roleIds = roleAcls
+    .map((acl) => {
+      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role
+      if (!roleRef) return null
+      if (typeof roleRef === 'string') return roleRef
+      return roleRef.id ? String(roleRef.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (roleIds.length) {
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,
+      {},
+      { tenantId: null, organizationId: null },
+    )
+    for (const link of Array.isArray(links) ? links : []) {
+      const userRef = (link as { user?: { id?: unknown } | string | null }).user
+      const userId = userRef && typeof userRef === 'object'
+        ? userRef.id
+        : userRef
+      if (userId) ids.add(String(userId))
+    }
+  }
+  return ids
+}
+
 async function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {
   const actorUserId = normalizeNullableString(input.actorUserId)
   if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')

package/src/modules/business_rules/lib/expression-evaluator.ts

@@ -1,4 +1,5 @@
 import type { ComparisonOperator, LogicalOperator } from '../data/validators'
+import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import { getNestedValue, resolveSpecialValue } from './value-resolver'
 
 /**
@@ -319,11 +320,8 @@ function endsWith(str: any, suffix: any): boolean {
   return String(str).endsWith(String(suffix))
 }
 
-/**
- * Security limits for regex operations
- */
-const REGEX_TIMEOUT_MS = 100
 const MAX_REGEX_LENGTH = 200
+const MAX_REGEX_INPUT_LENGTH = 10_000
 
 /**
  * Check if string matches regex pattern (with ReDoS protection)
@@ -345,18 +343,16 @@ function matches(str: any, pattern: any): boolean {
       return false
     }
 
-    const regex = new RegExp(patternStr)
     const testStr = String(str)
-
-    // Use a simple timeout mechanism
-    const startTime = Date.now()
-    const result = regex.test(testStr)
-
-    if (Date.now() - startTime > REGEX_TIMEOUT_MS) {
-      throw new Error('Regex execution timeout - potential ReDoS pattern detected')
+    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {
+      return false
     }
 
-    return result
+    const result = testLinearRegex(patternStr, testStr, {
+      maxPatternLength: MAX_REGEX_LENGTH,
+      maxInputLength: MAX_REGEX_INPUT_LENGTH,
+    })
+    return result.ok ? result.matched : false
   } catch (error) {
     // Log the error for debugging but don't expose to user
     const message = error instanceof Error ? error.message : 'Unknown error'

package/src/modules/business_rules/lib/rule-evaluator.ts

@@ -77,7 +77,7 @@ export async function evaluate(
     }
   }
 
-  const evaluationTime = Date.now() - startTime
+  const evaluationTime = Math.max(0, Date.now() - startTime)
 
   // Determine if conditions were met (at least one rule matched)
   const conditionsPassed = matchedRules.length > 0
@@ -140,7 +140,7 @@ export async function evaluateSingleRule(
     // Evaluate conditions
     const conditionsPassed = await evaluateConditions(rule.conditionExpression, data, context)
 
-    const evaluationTime = Date.now() - startTime
+    const evaluationTime = Math.max(0, Date.now() - startTime)
 
     console.log('[RULE EVAL] Final result:', {
       ruleId: rule.ruleId,
@@ -156,7 +156,7 @@ export async function evaluateSingleRule(
       evaluationTime,
     }
   } catch (error) {
-    const evaluationTime = Date.now() - startTime
+    const evaluationTime = Math.max(0, Date.now() - startTime)
     const errorMessage = error instanceof Error ? error.message : String(error)
 
     console.log('[RULE EVAL] ✗ ERROR:', errorMessage)

package/src/modules/customers/ai-agents.ts

@@ -373,8 +373,12 @@ const DEAL_ANALYZER_PROMPT_SECTIONS: DealAnalyzerPromptSection[] = [
       '2. customers.update_deal_stage — propose a stage move for a stalled high-value deal.',
       '   The runtime intercepts this via the pending-action gate; do NOT claim the change',
       '   is saved until the mutation-result-card arrives.',
+      '   When moving to a named pipeline stage, first call customers.list_pipeline_stages',
+      '   and pass the matching UUID as toPipelineStageId. Only use toStage for top-level',
+      '   status slugs such as open, won, or lost.',
       'Secondary read tools (use when you need more detail):',
       '- customers.list_deals, customers.get_deal, customers.list_activities',
+      '- customers.list_pipeline_stages',
       '- search.hybrid_search, meta.describe_agent',
     ].join('\n'),
   },
@@ -415,7 +419,10 @@ const DEAL_ANALYZER_PROMPT_SECTIONS: DealAnalyzerPromptSection[] = [
       'Lead with a one-paragraph summary of the deal portfolio health, then emit one',
       'deal card per at-risk deal (sorted by health score ascending). After the cards,',
       'propose exactly one stage move for the highest-value stalled deal and call',
-      'customers.update_deal_stage. Then finish with a short conclusion naming the',
+      'customers.update_deal_stage. If the recommended stage is a pipeline stage label',
+      'rather than a status slug, resolve it with customers.list_pipeline_stages first;',
+      'do not ask the operator to paste a stage id unless no matching stage exists.',
+      'Then finish with a short conclusion naming the',
       'highest-value stalled deal, the recommended move, and the approval status.',
     ].join('\n'),
   },
@@ -431,6 +438,7 @@ function compileDealAnalyzerPrompt(): string {
 const DEAL_ANALYZER_ALLOWED_TOOLS: readonly string[] = [
   'customers.analyze_deals',
   'customers.update_deal_stage',
+  'customers.list_pipeline_stages',
   'customers.list_deals',
   'customers.get_deal',
   'customers.list_activities',
@@ -447,6 +455,7 @@ function buildDealAnalyzerPrepareStep() {
           'customers.list_deals',
           'customers.get_deal',
           'customers.list_activities',
+          'customers.list_pipeline_stages',
           'search.hybrid_search',
           'meta.describe_agent',
           'meta.update_task_plan',

package/src/modules/customers/ai-tools/settings-pack.ts

@@ -26,6 +26,10 @@ function buildScope(ctx: CustomersToolContext, tenantId: string) {
 
 const getSettingsInput = z.object({}).passthrough()
 
+const listPipelineStagesInput = z.object({
+  pipelineId: z.string().uuid().optional().describe('Optional pipeline id to restrict returned stages.'),
+}).passthrough()
+
 const getSettingsTool: CustomersAiToolDefinition = {
   name: 'customers.get_settings',
   displayName: 'Get customers module settings',
@@ -116,6 +120,63 @@ const getSettingsTool: CustomersAiToolDefinition = {
   },
 }
 
-export const settingsAiTools: CustomersAiToolDefinition[] = [getSettingsTool]
+const listPipelineStagesTool: CustomersAiToolDefinition = {
+  name: 'customers.list_pipeline_stages',
+  displayName: 'List customer pipeline stages',
+  description:
+    'Return customer deal pipelines and their pipeline stages, including stage ids. Use this before moving a deal to a named pipeline stage.',
+  inputSchema: listPipelineStagesInput,
+  requiredFeatures: ['customers.pipelines.view'],
+  tags: ['read', 'customers', 'pipelines'],
+  isMutation: false,
+  handler: async (rawInput, ctx) => {
+    const { tenantId } = assertTenantScope(ctx)
+    const input = listPipelineStagesInput.parse(rawInput)
+    const em = resolveEm(ctx)
+    const where: Record<string, unknown> = { tenantId }
+    if (ctx.organizationId) where.organizationId = ctx.organizationId
+    const stageWhere: Record<string, unknown> = { ...where }
+    if (input.pipelineId) stageWhere.pipelineId = input.pipelineId
+    const [pipelines, stages] = await Promise.all([
+      findWithDecryption<CustomerPipeline>(
+        em,
+        CustomerPipeline,
+        where as any,
+        { orderBy: { createdAt: 'asc' } as any } as any,
+        buildScope(ctx, tenantId),
+      ),
+      findWithDecryption<CustomerPipelineStage>(
+        em,
+        CustomerPipelineStage,
+        stageWhere as any,
+        { orderBy: { pipelineId: 'asc', order: 'asc' } as any } as any,
+        buildScope(ctx, tenantId),
+      ),
+    ])
+    return {
+      pipelines: pipelines
+        .filter((row) => row.tenantId === tenantId)
+        .map((row) => ({
+          id: row.id,
+          name: row.name,
+          isDefault: !!row.isDefault,
+          organizationId: row.organizationId ?? null,
+          tenantId: row.tenantId ?? null,
+        })),
+      pipelineStages: stages
+        .filter((row) => row.tenantId === tenantId)
+        .map((row) => ({
+          id: row.id,
+          pipelineId: row.pipelineId,
+          label: row.label,
+          order: row.order,
+          organizationId: row.organizationId ?? null,
+          tenantId: row.tenantId ?? null,
+        })),
+    }
+  },
+}
+
+export const settingsAiTools: CustomersAiToolDefinition[] = [getSettingsTool, listPipelineStagesTool]
 
 export default settingsAiTools

package/src/modules/customers/components/detail/schedule/useScheduleFormState.ts

@@ -1,5 +1,4 @@
 import * as React from 'react'
-import { format } from 'date-fns'
 import type { ActivityType } from './fieldConfig'
 
 export type RsvpStatus = 'pending' | 'accepted' | 'declined' | 'tentative'
@@ -63,6 +62,18 @@ const DEFAULT_REMINDER_MINUTES: Record<ActivityType, number> = {
   email: 15,
 }
 
+function padDatePart(value: number): string {
+  return String(value).padStart(2, '0')
+}
+
+function formatLocalDateInput(date: Date): string {
+  return `${date.getFullYear()}-${padDatePart(date.getMonth() + 1)}-${padDatePart(date.getDate())}`
+}
+
+function formatLocalTimeInput(date: Date): string {
+  return `${padDatePart(date.getHours())}:${padDatePart(date.getMinutes())}`
+}
+
 interface UseScheduleFormStateParams {
   open: boolean
   editData: ScheduleActivityEditData | null | undefined
@@ -71,7 +82,7 @@ interface UseScheduleFormStateParams {
 export function useScheduleFormState({ open, editData }: UseScheduleFormStateParams) {
   const [activityType, setActivityType] = React.useState<ActivityType>('meeting')
   const [title, setTitle] = React.useState('')
-  const [date, setDate] = React.useState(() => format(new Date(), 'yyyy-MM-dd'))
+  const [date, setDate] = React.useState(() => formatLocalDateInput(new Date()))
   const [startTime, setStartTime] = React.useState('10:00')
   const [duration, setDuration] = React.useState(30)
   const [allDay, setAllDay] = React.useState(false)
@@ -101,15 +112,15 @@ export function useScheduleFormState({ open, editData }: UseScheduleFormStatePar
         // For historical activities the canonical timestamp is `occurredAt`; for
         // planned/future ones it's `scheduledAt`. Without this fallback editing a
         // past activity prefilled to "today" instead of its actual moment (#1807).
-        // Use `date-fns` `format(...)` so the seed values are in the user's local
-        // timezone (matches the cluster-E local-day convention).
+        // Keep seed values in the user's local timezone, matching the cluster-E
+        // local-day convention.
         const sourceTimestamp = editData.occurredAt ?? editData.scheduledAt ?? null
         const seedDate = sourceTimestamp ? new Date(sourceTimestamp) : new Date()
         const seedDateValid = !Number.isNaN(seedDate.getTime())
         const fallbackNow = new Date()
         const dateForForm = seedDateValid ? seedDate : fallbackNow
-        setDate(format(dateForForm, 'yyyy-MM-dd'))
-        setStartTime(format(dateForForm, 'HH:mm'))
+        setDate(formatLocalDateInput(dateForForm))
+        setStartTime(formatLocalTimeInput(dateForForm))
         setDuration(editData.durationMinutes ?? 30)
         setAllDay(editData.allDay ?? false)
         setDescription(editData.body ?? '')
@@ -170,7 +181,7 @@ export function useScheduleFormState({ open, editData }: UseScheduleFormStatePar
         // Create mode: reset all fields
         setActivityType('meeting')
         setTitle('')
-        setDate(format(new Date(), 'yyyy-MM-dd'))
+        setDate(formatLocalDateInput(new Date()))
         setStartTime('10:00')
         setDuration(30)
         setAllDay(false)

package/src/modules/customers/lib/personCompanyLinkTable.ts

@@ -1,54 +1,46 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { sql } from '@mikro-orm/postgresql'
 
-const PERSON_COMPANY_LINKS_TABLE = 'customer_person_company_links'
-const PERSON_COMPANY_LINKS_DELETED_AT_COLUMN = 'deleted_at'
+// The previous implementation probed `information_schema.columns` on every
+// first call via `em.getKysely()` to decide whether to add a `deletedAt: null`
+// filter. When that probe ran inside an already-active MikroORM transaction it
+// shared the transaction's connection — and any failure (including transient
+// connection-pool state, an aborted TX from a sibling query, or pg returning
+// 25P02) propagated back into the host transaction, poisoning every following
+// query with `current transaction is aborted, commands ignored until end of
+// transaction block`. That is what produced the standalone-CI failure burst
+// (loadPersonCompanyLinks → 25P02 → customers.people.create → 500) and the
+// sync_excel worker `failedCount: 1` regression.
+//
+// The `deleted_at` column on `customer_person_company_links` has been part of
+// the committed module snapshot since `Migration20260415095203` (April 2026)
+// and is referenced by `Migration20260417140000` (partial unique index uses
+// `where deleted_at is null`). Any environment running these migrations
+// already has the column. So the probe is no longer load-bearing — it only
+// adds risk. We now unconditionally include `deletedAt: null` in the filter.
+// If a downstream DB is genuinely un-migrated, the underlying `em.find` will
+// surface the authentic `column "deleted_at" of relation
+// "customer_person_company_links" does not exist` (pg 42703) pointing the
+// operator at the real fix (`yarn db:migrate`).
+//
+// `customerPersonCompanyLinksSupportDeletedAt` and
+// `warnMissingCustomerPersonCompanyLinksDeletedAt` are kept as exported
+// no-op-equivalents so external callers (and the published @open-mercato/core
+// API surface) don't break.
 
-let supportsDeletedAtColumnPromise: Promise<boolean> | null = null
-let warnedAboutMissingDeletedAtColumn = false
-
-export async function customerPersonCompanyLinksSupportDeletedAt(em: EntityManager): Promise<boolean> {
-  if (typeof (em as { getKysely?: unknown }).getKysely !== 'function') {
-    return true
-  }
-  if (!supportsDeletedAtColumnPromise) {
-    const db = em.getKysely<any>() as any
-    const probe: Promise<boolean> = db
-      .selectFrom('information_schema.columns')
-      .select(['column_name'])
-      .where(sql<boolean>`table_schema = current_schema()`)
-      .where('table_name', '=', PERSON_COMPANY_LINKS_TABLE)
-      .where('column_name', '=', PERSON_COMPANY_LINKS_DELETED_AT_COLUMN)
-      .executeTakeFirst()
-      .then((row: unknown) => !!row)
-      .catch(() => false)
-    supportsDeletedAtColumnPromise = probe
-    return probe
-  }
-  return supportsDeletedAtColumnPromise
+export async function customerPersonCompanyLinksSupportDeletedAt(_em: EntityManager): Promise<boolean> {
+  return true
 }
 
-export function warnMissingCustomerPersonCompanyLinksDeletedAt(source: string): void {
-  if (warnedAboutMissingDeletedAtColumn) {
-    return
-  }
-  warnedAboutMissingDeletedAtColumn = true
-  console.warn(
-    `[${source}] missing ${PERSON_COMPANY_LINKS_TABLE}.${PERSON_COMPANY_LINKS_DELETED_AT_COLUMN}; ` +
-      'continuing without link soft-delete filtering. Run yarn db:migrate.',
-  )
+export function warnMissingCustomerPersonCompanyLinksDeletedAt(_source: string): void {
+  // No-op: column is guaranteed present by Migration20260415095203 and the
+  // module snapshot. Kept for backward-compatible exports.
 }
 
 export async function withActiveCustomerPersonCompanyLinkFilter<T extends Record<string, unknown>>(
-  em: EntityManager,
+  _em: EntityManager,
   where: T,
-  source: string,
+  _source: string,
 ): Promise<T & { deletedAt?: null }> {
-  const supportsDeletedAt = await customerPersonCompanyLinksSupportDeletedAt(em)
-  if (!supportsDeletedAt) {
-    warnMissingCustomerPersonCompanyLinksDeletedAt(source)
-    return { ...where }
-  }
   return { ...where, deletedAt: null }
 }
 

package/src/modules/customers/migrations/Migration20260521175027.ts

@@ -0,0 +1,39 @@
+import { Migration } from '@mikro-orm/migrations';
+
+/**
+ * Idempotent backstop for `customer_person_company_links.deleted_at`.
+ *
+ * The column was originally added by `Migration20260415095203` and is
+ * referenced by `Migration20260417140000`'s partial unique index
+ * (`where "deleted_at" is null`). It is part of the committed
+ * `migrations/.snapshot-open-mercato.json`.
+ *
+ * However, the runtime defensive probe that lived in
+ * `packages/core/src/modules/customers/lib/personCompanyLinkTable.ts`
+ * historically existed because an aborted-transaction state on a
+ * shared connection could (very rarely) make `loadPersonCompanyLinks`
+ * fail in a way that *looked* like the column was missing — and the
+ * cached fallback then silently dropped the `deletedAt: null` filter.
+ * That probe is removed in the same change as this migration (no
+ * Kysely query is ever issued from inside an active MikroORM TX);
+ * this migration is the matching belt-and-suspenders guarantee that
+ * the column is physically present so the unconditional `deletedAt:
+ * null` filter cannot 42703.
+ *
+ * Postgres-native `add column if not exists` is used so this re-applies
+ * cleanly on already-migrated databases without raising.
+ */
+export class Migration20260521175027 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "customer_person_company_links" add column if not exists "deleted_at" timestamptz null;`);
+  }
+
+  override async down(): Promise<void> {
+    // No-op on the way down: dropping the column would break
+    // `Migration20260417140000`'s partial unique index, which is the
+    // authoritative owner of the column going forward. The original
+    // `Migration20260415095203` down still drops it for full rollback.
+  }
+
+}

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -32,6 +32,7 @@ type UserResponse = {
 type BaseProps = {
   tenantId?: string | null
   organizationId?: string | null
+  preserveOnTenantChange?: boolean
 }
 
 type RoleProps = BaseProps & {
@@ -92,7 +93,7 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     (widget: WidgetCatalogItem) => resolveWidgetText(t, widget.id, 'description', widget.description || ''),
     [t],
   )
-  const { kind, targetId, tenantId, organizationId } = props
+  const { kind, targetId, tenantId, organizationId, preserveOnTenantChange = false } = props
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
   const [loading, setLoading] = React.useState(true)
   const [saving, setSaving] = React.useState(false)
@@ -136,10 +137,16 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setCatalog(mapped)
   }, [])
 
-  const loadRoleData = React.useCallback(async () => {
+  const tenantIdRef = React.useRef(tenantId)
+  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])
+  const organizationIdRef = React.useRef(organizationId)
+  React.useEffect(() => { organizationIdRef.current = organizationId }, [organizationId])
+  const hasMountedRef = React.useRef(false)
+
+  const loadRoleData = React.useCallback(async (forTenantId: string | null | undefined, forOrganizationId: string | null | undefined) => {
     const params = new URLSearchParams({ roleId: targetId })
-    if (tenantId) params.set('tenantId', tenantId)
-    if (organizationId) params.set('organizationId', organizationId)
+    if (forTenantId) params.set('tenantId', forTenantId)
+    if (forOrganizationId) params.set('organizationId', forOrganizationId)
     const data = await readApiResultOrThrow<RoleResponse>(
       `/api/dashboards/roles/widgets?${params.toString()}`,
       undefined,
@@ -151,12 +158,12 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setMode('override')
     setOriginalMode('override')
     setEffective(ids)
-  }, [organizationId, targetId, tenantId])
+  }, [targetId])
 
-  const loadUserData = React.useCallback(async () => {
+  const loadUserData = React.useCallback(async (forTenantId: string | null | undefined, forOrganizationId: string | null | undefined) => {
     const params = new URLSearchParams({ userId: targetId })
-    if (tenantId) params.set('tenantId', tenantId)
-    if (organizationId) params.set('organizationId', organizationId)
+    if (forTenantId) params.set('tenantId', forTenantId)
+    if (forOrganizationId) params.set('organizationId', forOrganizationId)
     const data = await readApiResultOrThrow<UserResponse>(
       `/api/dashboards/users/widgets?${params.toString()}`,
       undefined,
@@ -168,7 +175,7 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setMode(data.mode || 'inherit')
     setOriginalMode(data.mode || 'inherit')
     setEffective(Array.isArray(data.effectiveWidgetIds) ? data.effectiveWidgetIds : [])
-  }, [organizationId, targetId, tenantId])
+  }, [targetId])
 
   React.useEffect(() => {
     let cancelled = false
@@ -177,21 +184,40 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
       setError(null)
       try {
         await loadCatalog()
-        if (kind === 'role') await loadRoleData()
-        else await loadUserData()
+        if (kind === 'role') await loadRoleData(tenantIdRef.current, organizationIdRef.current)
+        else await loadUserData(tenantIdRef.current, organizationIdRef.current)
       } catch (err) {
         console.error('Failed to load widget visibility data', err)
         if (!cancelled) {
           setError(tRef.current('dashboards.widgets.error.load', 'Unable to load widget configuration.'))
         }
       } finally {
-        if (!cancelled) setLoading(false)
+        if (!cancelled) {
+          setLoading(false)
+          hasMountedRef.current = true
+        }
       }
     }
     load()
     return () => { cancelled = true }
   }, [kind, loadCatalog, loadRoleData, loadUserData])
 
+  React.useEffect(() => {
+    if (!hasMountedRef.current) return
+    if (preserveOnTenantChange) return
+    let cancelled = false
+    async function refetch() {
+      try {
+        if (kind === 'role') await loadRoleData(tenantId, organizationId)
+        else await loadUserData(tenantId, organizationId)
+      } catch (err) {
+        console.error('Failed to reload widget visibility data', err)
+      }
+    }
+    refetch()
+    return () => { cancelled = true }
+  }, [tenantId, organizationId, kind, loadRoleData, loadUserData, preserveOnTenantChange])
+
   const toggle = React.useCallback((id: string) => {
     setSelected((prev) => (prev.includes(id) ? prev.filter((value) => value !== id) : [...prev, id]))
   }, [])

package/src/modules/data_sync/api/options.ts

@@ -44,6 +44,8 @@ export async function GET(req: Request) {
           description: integration.description ?? null,
           providerKey: integration.providerKey ?? null,
           direction: adapter.direction,
+          runMode: adapter.runMode ?? 'generic',
+          canStartRun: adapter.runMode !== 'provider',
           supportedEntities: adapter.supportedEntities,
           hasCredentials: Boolean(credentials),
           isEnabled: state.isEnabled,