@open-mercato/core 0.6.3-develop.3525.3.cc18b8a43f → 0.6.3-develop.3574.1.f3c5dcf345

package/src/modules/auth/api/roles/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { Role, RoleAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
@@ -13,6 +14,8 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { roleCrudEvents, roleCrudIndexer } from '@open-mercato/core/modules/auth/commands/roles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { assertActorCanModifySuperAdminRoleTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const querySchema = z.object({
   id: z.string().uuid().optional(),
@@ -87,7 +90,12 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     update: {
       commandId: 'auth.roles.update',
       schema: rawBodySchema,
-      mapInput: ({ parsed }) => parsed,
+      mapInput: async ({ parsed, ctx }) => {
+        if (ctx.request && typeof parsed.id === 'string' && parsed.id.length) {
+          await assertCanModifySuperAdminRole(ctx.request, parsed.id)
+        }
+        return parsed
+      },
       response: () => ({ ok: true }),
     },
     delete: {
@@ -236,7 +244,35 @@ export async function GET(req: Request) {
 
 export const POST = crud.POST
 export const PUT = crud.PUT
-export const DELETE = crud.DELETE
+export const DELETE = async (req: Request) => {
+  const targetId = new URL(req.url).searchParams.get('id')
+  if (targetId) {
+    try {
+      await assertCanModifySuperAdminRole(req, targetId)
+    } catch (err) {
+      if (err instanceof CrudHttpError) {
+        return NextResponse.json(err.body, { status: err.status })
+      }
+      throw err
+    }
+  }
+  return crud.DELETE(req)
+}
+
+async function assertCanModifySuperAdminRole(req: Request, targetRoleId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanModifySuperAdminRoleTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetRoleId,
+  })
+}
 
 export const openApi: OpenApiRouteDoc = {
   tag: 'Authentication & Accounts',

package/src/modules/auth/api/users/acl/route.ts

@@ -4,8 +4,11 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
-import { forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { assertActorCanModifySuperAdminUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { EntityManager } from '@mikro-orm/postgresql'
 
 const getSchema = z.object({ userId: z.string().uuid() })
 const putSchema = z.object({
@@ -42,6 +45,26 @@ export async function GET(req: Request) {
   if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })
   const container = await createRequestContainer()
   const em = container.resolve('em') as any
+  const rbacService = container.resolve('rbacService') as any
+  const actorAcl = auth.sub
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
+    : null
+  if (!actorAcl?.isSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
   const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   const response = acl
     ? {
@@ -83,6 +106,23 @@ export async function PUT(req: Request) {
     : null
   const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
 
+  if (!actorIsSuperAdmin && auth.sub) {
+    try {
+      await assertActorCanModifySuperAdminUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const requestedFeatures = normalizeFeatureList(parsed.data.features)
   const organizations = Array.isArray(parsed.data.organizations) ? parsed.data.organizations : null
 

package/src/modules/auth/api/users/route.ts

@@ -13,7 +13,11 @@ import { E } from '#generated/entities.ids.generated'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'
-import { assertActorCanGrantRoleTokens } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import {
+  assertActorCanGrantRoleTokens,
+  assertActorCanModifySuperAdminUserTarget,
+  listSuperAdminUserIds,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -21,6 +25,10 @@ import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
+import {
+  getSelectedTenantFromRequest,
+  resolveOrganizationScopeForRequest,
+} from '@open-mercato/core/modules/directory/utils/organizationScope'
 
 const querySchema = z.object({
   id: z.string().uuid().optional(),
@@ -128,6 +136,9 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       schema: rawBodySchema,
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request) {
+          if (typeof parsed.id === 'string' && parsed.id.length) {
+            await assertCanModifySuperAdminTarget(ctx.request, parsed.id)
+          }
           await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
         }
         return parsed
@@ -158,12 +169,12 @@ export async function GET(req: Request) {
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
   const container = await createRequestContainer()
   const em = (container.resolve('em') as EntityManager)
-  let isSuperAdmin = false
+  let isSuperAdmin = auth.isSuperAdmin === true
   try {
     if (auth.sub) {
       const rbacService = container.resolve('rbacService') as any
       const acl = await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-      isSuperAdmin = !!acl?.isSuperAdmin
+      isSuperAdmin = isSuperAdmin || !!acl?.isSuperAdmin
     }
   } catch (err) {
     console.error('users: failed to resolve rbac', err)
@@ -171,12 +182,51 @@ export async function GET(req: Request) {
   const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
+  let effectiveTenantId: string | null = null
+  let effectiveOrganizationIds: string[] | null = null
+  let effectiveSelectedOrganizationId: string | null = null
+  let usesSelectedTenantScope = false
   if (!isSuperAdmin) {
     if (!actorTenantId) {
       return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
     }
-    filters.push({ tenantId: actorTenantId })
+    effectiveTenantId = actorTenantId
+    const superAdminUserIds = await listSuperAdminUserIds(em, actorTenantId)
+    if (superAdminUserIds.size) {
+      filters.push({ id: { $nin: Array.from(superAdminUserIds) as any } })
+    }
+  } else {
+    const selectedTenantId = getSelectedTenantFromRequest(req)
+    if (typeof selectedTenantId === 'string' && selectedTenantId.trim().length > 0) {
+      const scope = await resolveOrganizationScopeForRequest({
+        container,
+        auth,
+        request: req,
+        tenantId: selectedTenantId.trim(),
+      })
+      if (!scope.tenantId) {
+        return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
+      }
+      effectiveTenantId = scope.tenantId
+      effectiveSelectedOrganizationId = scope.selectedId
+      usesSelectedTenantScope = true
+      if (Array.isArray(scope.filterIds)) {
+        if (scope.filterIds.length === 0) {
+          return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
+        }
+        effectiveOrganizationIds = scope.filterIds
+      }
+    }
+  }
+  if (effectiveTenantId) {
+    filters.push({ tenantId: effectiveTenantId })
   }
+  if (effectiveOrganizationIds) {
+    filters.push({ organizationId: { $in: effectiveOrganizationIds as any } })
+  }
+  const scopeOrganizationId = usesSelectedTenantScope
+    ? effectiveSelectedOrganizationId
+    : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
@@ -204,7 +254,7 @@ export async function GET(req: Request) {
   const trimmedSearch = typeof search === 'string' ? search.trim() : ''
   if (trimmedSearch) {
     // Email is encrypted at rest, so plaintext search must go through search_tokens.
-    const tenantScope: string | null | undefined = isSuperAdmin ? undefined : auth.tenantId ?? null
+    const tenantScope: string | null | undefined = isSuperAdmin ? (effectiveTenantId ?? undefined) : auth.tenantId ?? null
     const searchFilters: any[] = []
 
     const matchedIds = await findUserIdsBySearchTokens(em, E.auth.user, trimmedSearch, tenantScope)
@@ -284,7 +334,10 @@ export async function GET(req: Request) {
         UserRole,
         { user: { $in: userIds as any } } as any,
         { populate: ['role'] },
-        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
+        {
+          tenantId: effectiveTenantId ?? auth.tenantId ?? null,
+          organizationId: scopeOrganizationId,
+        },
       )
     : []
   const roleMap: Record<string, string[]> = {}
@@ -350,7 +403,7 @@ export async function GET(req: Request) {
         recordIds: userIds.map(String),
         tenantIdByRecord: tenantByUser,
         organizationIdByRecord: organizationByUser,
-        tenantFallbacks: auth.tenantId ? [auth.tenantId] : [],
+        tenantFallbacks: effectiveTenantId ? [effectiveTenantId] : auth.tenantId ? [auth.tenantId] : [],
       })
     : {}
 
@@ -379,8 +432,8 @@ export async function GET(req: Request) {
     items,
     idField: 'id',
     resourceKind: 'auth.user',
-    organizationId: null,
-    tenantId: auth.tenantId ?? null,
+    organizationId: effectiveSelectedOrganizationId,
+    tenantId: effectiveTenantId ?? auth.tenantId ?? null,
     query: parsed.data,
     accessType: id ? 'read:item' : undefined,
   })
@@ -395,7 +448,20 @@ export const PUT = async (req: Request) => {
   return crud.PUT(req)
 }
 
-export const DELETE = crud.DELETE
+export const DELETE = async (req: Request) => {
+  const targetId = new URL(req.url).searchParams.get('id')
+  if (targetId) {
+    try {
+      await assertCanModifySuperAdminTarget(req, targetId)
+    } catch (err) {
+      if (err instanceof CrudHttpError) {
+        return NextResponse.json(err.body, { status: err.status })
+      }
+      throw err
+    }
+  }
+  return crud.DELETE(req)
+}
 
 async function findUserIdsBySearchTokens(
   em: EntityManager,
@@ -427,6 +493,21 @@ async function findUserIdsBySearchTokens(
     .filter((id): id is string => typeof id === 'string' && id.length > 0)
 }
 
+async function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanModifySuperAdminUserTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetUserId,
+  })
+}
+
 async function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {
   if (!Array.isArray(roles)) return
   const auth = await getAuthFromRequest(req)
@@ -483,7 +564,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the current tenant. Search matches email, organization name, and role name. Super administrators may scope the response via organization or role filters.',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/backend/roles/[id]/edit/page.tsx

@@ -9,6 +9,7 @@ import { AclEditor, type AclData } from '@open-mercato/core/modules/auth/compone
 import { WidgetVisibilityEditor, type WidgetVisibilityEditorHandle } from '@open-mercato/core/modules/dashboards/components/WidgetVisibilityEditor'
 import { E } from '#generated/entities.ids.generated'
 import { TenantSelect } from '@open-mercato/core/modules/directory/components/TenantSelect'
+import { Alert } from '@open-mercato/ui/primitives/alert'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
 
@@ -93,6 +94,7 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
         label: t('auth.roles.form.field.tenant', 'Tenant'),
         type: 'custom',
         required: true,
+        disabled,
         component: ({ value, setValue }) => {
           const normalizedValue = typeof value === 'string'
             ? value
@@ -104,10 +106,13 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
               onChange={(next) => {
                 const resolved = next ?? null
                 setValue(resolved)
+                if (selectedTenantId !== resolved) {
+                  setAclData((prev) => ({ ...prev, organizations: null }))
+                }
                 setSelectedTenantId(resolved)
-                setAclData({ isSuperAdmin: false, features: [], organizations: null })
               }}
               includeEmptyOption
+              disabled={disabled}
               className="w-full h-9 rounded border px-2 text-sm"
               tenants={preloadedTenants}
             />
@@ -131,19 +136,35 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
       id: 'acl',
       title: t('auth.roles.form.group.access', 'Access'),
       column: 1,
-      component: () => (id
-        ? (
-          <AclEditor
-            kind="role"
-            targetId={String(id)}
-            canEditOrganizations
-            value={aclData}
-            onChange={setAclData}
-            currentUserIsSuperAdmin={actorIsSuperAdmin}
-            tenantId={selectedTenantId ?? null}
-          />
+      component: () => {
+        if (!id) return null
+        const initialTenantId = initial?.tenantId ?? null
+        const tenantReassigned = actorIsSuperAdmin
+          && initial != null
+          && (selectedTenantId ?? null) !== (initialTenantId ?? null)
+        return (
+          <div className="space-y-3">
+            {tenantReassigned ? (
+              <Alert status="warning" style="lighter">
+                {t(
+                  'auth.roles.form.tenantReassignWarning',
+                  'This role is being reassigned to a different tenant. The permissions selected here will be saved under the new tenant when you submit.',
+                )}
+              </Alert>
+            ) : null}
+            <AclEditor
+              kind="role"
+              targetId={String(id)}
+              canEditOrganizations
+              value={aclData}
+              onChange={setAclData}
+              currentUserIsSuperAdmin={actorIsSuperAdmin}
+              tenantId={selectedTenantId ?? null}
+              preserveOnTenantChange
+            />
+          </div>
         )
-        : null),
+      },
     },
     {
       id: 'dashboardWidgets',
@@ -155,6 +176,7 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
             kind="role"
             targetId={String(id)}
             tenantId={selectedTenantId ?? (initial?.tenantId ?? null)}
+            preserveOnTenantChange
             ref={widgetEditorRef}
           />
         )

package/src/modules/auth/backend/users/[id]/edit/page.tsx

@@ -254,7 +254,7 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
     if (!actorResolved) return []
     if (actorIsSuperAdmin) {
       if (!selectedTenantId) return []
-      return fetchRoleOptions(query, { tenantId: selectedTenantId })
+      return fetchRoleOptions(query, { tenantId: selectedTenantId, includeSuperAdmin: true })
     }
     return fetchRoleOptions(query)
   }, [actorIsSuperAdmin, actorResolved, selectedTenantId])

package/src/modules/auth/backend/users/create/page.tsx

@@ -171,7 +171,7 @@ export default function CreateUserPage() {
     if (!actorResolved) return []
     if (actorIsSuperAdmin) {
       if (!selectedTenantId) return []
-      return fetchRoleOptions(query, { tenantId: selectedTenantId })
+      return fetchRoleOptions(query, { tenantId: selectedTenantId, includeSuperAdmin: true })
     }
     return fetchRoleOptions(query)
   }, [actorIsSuperAdmin, actorResolved, selectedTenantId])

package/src/modules/auth/backend/users/roleOptions.ts

@@ -7,6 +7,7 @@ type RoleListResponse = {
 
 type FetchRoleOptionsParams = {
   tenantId?: string | null
+  includeSuperAdmin?: boolean
 }
 
 export async function fetchRoleOptions(query?: string, params?: FetchRoleOptionsParams): Promise<CrudFieldOption[]> {
@@ -28,7 +29,7 @@ export async function fetchRoleOptions(query?: string, params?: FetchRoleOptions
         const id = typeof item?.id === 'string' ? item.id.trim() : ''
         const name = typeof item?.name === 'string' ? item?.name.trim() : ''
         if (!id || !name) return null
-        if (name === 'superadmin') return null
+        if (name === 'superadmin' && !params?.includeSuperAdmin) return null
         return { value: id, label: name }
       })
       .filter((opt): opt is CrudFieldOption => !!opt)

package/src/modules/auth/commands/roles.ts

@@ -235,6 +235,14 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
         }
       }
     }
+    const wantsTenantChange = parsed.tenantId !== undefined && parsed.tenantId !== current.tenantId
+    if (wantsTenantChange) {
+      const assignments = await em.count(UserRole, { role: current, deletedAt: null })
+      if (assignments > 0) {
+        throw new CrudHttpError(400, { error: 'Role cannot be moved to another tenant while users are assigned' })
+      }
+      await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
+    }
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const role = await de.updateOrmEntity({
       entity: Role,

package/src/modules/auth/commands/users.ts

@@ -286,6 +286,7 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
       resourceKind: 'auth.user',
       resourceId: String(user.id),
       tenantId: user.tenantId ? String(user.tenantId) : null,
+      organizationId: user.organizationId ? String(user.organizationId) : null,
       snapshotAfter: snapshot.view,
       payload: {
         undo: {
@@ -559,6 +560,7 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       resourceKind: 'auth.user',
       resourceId: String(result.id),
       tenantId: result.tenantId ? String(result.tenantId) : null,
+      organizationId: result.organizationId ? String(result.organizationId) : null,
       changes,
       snapshotBefore: before ?? null,
       snapshotAfter: after,
@@ -689,6 +691,7 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
       resourceId: id,
       snapshotBefore: before ?? null,
       tenantId: before?.tenantId ?? null,
+      organizationId: before?.organizationId ?? null,
       payload: {
         undo: {
           before: beforeUndo,

package/src/modules/auth/components/AclEditor.tsx

@@ -100,6 +100,7 @@ export function AclEditor({
   userRoles,
   currentUserIsSuperAdmin,
   tenantId,
+  preserveOnTenantChange = false,
 }: {
   kind: 'user' | 'role'
   targetId: string
@@ -109,6 +110,7 @@ export function AclEditor({
   userRoles?: string[]
   currentUserIsSuperAdmin?: boolean
   tenantId?: string | null
+  preserveOnTenantChange?: boolean
 }) {
   const actorIsSuperAdmin = !!currentUserIsSuperAdmin
   const [loading, setLoading] = React.useState(true)
@@ -142,8 +144,33 @@ export function AclEditor({
     [actorSanitizeFeatures],
   )
 
+  const tenantIdRef = React.useRef(tenantId)
+  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])
+  const hasMountedRef = React.useRef(false)
+
+  const fetchAclState = React.useCallback(async (forTenantId: string | null | undefined, cancelledRef: { current: boolean }) => {
+    try {
+      const aclQuery = new URLSearchParams()
+      aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)
+      if (forTenantId) aclQuery.set('tenantId', forTenantId)
+      const aclQueryString = aclQuery.toString()
+      const aclJson = await readJsonOr<AclPayload>(
+        `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,
+        undefined,
+        { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },
+      )
+      if (cancelledRef.current) return
+      const customAclExists = aclJson.hasCustomAcl !== false
+      setHasCustomAcl(customAclExists)
+      setOverrideEnabled(customAclExists)
+      setIsSuperAdmin(!!aclJson.isSuperAdmin)
+      setGranted(actorSanitizeFeatures(aclJson.features))
+      setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])
+    } catch {}
+  }, [kind, targetId, actorSanitizeFeatures])
+
   React.useEffect(() => {
-    let cancelled = false
+    const cancelled = { current: false }
     async function load() {
       setLoading(true)
       try {
@@ -152,30 +179,30 @@ export function AclEditor({
           undefined,
           { items: [], modules: [] },
         )
-        if (!cancelled) {
+        if (!cancelled.current) {
           setFeatures(fJson.items || [])
           setModules(fJson.modules || [])
         }
       } catch {}
-      try {
-        const aclQuery = new URLSearchParams()
-        aclQuery.set(kind === 'user' ? 'userId' : 'roleId', targetId)
-        if (tenantId) aclQuery.set('tenantId', tenantId)
-        const aclQueryString = aclQuery.toString()
-        const aclJson = await readJsonOr<AclPayload>(
-          `/api/auth/${kind === 'user' ? 'users' : 'roles'}/acl${aclQueryString ? `?${aclQueryString}` : ''}`,
-          undefined,
-          { hasCustomAcl: true, isSuperAdmin: false, features: [], organizations: null },
-        )
-        if (!cancelled) {
-          const customAclExists = aclJson.hasCustomAcl !== false
-          setHasCustomAcl(customAclExists)
-          setOverrideEnabled(customAclExists)
-          setIsSuperAdmin(!!aclJson.isSuperAdmin)
-          setGranted(actorSanitizeFeatures(aclJson.features))
-          setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])
-        }
-      } catch {}
+      await fetchAclState(tenantIdRef.current, cancelled)
+      hasMountedRef.current = true
+      if (!cancelled.current) setLoading(false)
+    }
+    load()
+    return () => { cancelled.current = true }
+  }, [kind, targetId, fetchAclState])
+
+  React.useEffect(() => {
+    if (!hasMountedRef.current) return
+    if (preserveOnTenantChange) return
+    const cancelled = { current: false }
+    fetchAclState(tenantId, cancelled)
+    return () => { cancelled.current = true }
+  }, [tenantId, preserveOnTenantChange, fetchAclState])
+
+  React.useEffect(() => {
+    let cancelled = false
+    async function loadTenantScoped() {
       if (canEditOrganizations) {
         try {
           const orgQuery = new URLSearchParams()
@@ -206,11 +233,10 @@ export function AclEditor({
           }
         } catch {}
       }
-      if (!cancelled) setLoading(false)
     }
-    load()
+    loadTenantScoped()
     return () => { cancelled = true }
-  }, [kind, targetId, canEditOrganizations, userRoles, actorSanitizeFeatures, tenantId])
+  }, [kind, canEditOrganizations, userRoles, tenantId])
 
   // Notify parent of changes
   React.useEffect(() => {