@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4236.1.9fa6806b34

package/src/modules/auth/api/users/acl/route.ts

@@ -6,6 +6,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { assertActorCanModifySuperAdminUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { EntityManager } from '@mikro-orm/postgresql'
@@ -150,18 +151,22 @@ export async function PUT(req: Request) {
 
   const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
 
-  if (!hasCustomAcl) {
-    if (acl) await em.remove(acl).flush()
-  } else {
-    if (!acl) {
-      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
-    }
-    const aclRecord = acl as any
-    aclRecord.isSuperAdmin = effectiveIsSuperAdmin
-    aclRecord.featuresJson = effectiveFeatures
-    aclRecord.organizationsJson = organizations
-    await em.persist(acl).flush()
-  }
+  await withAtomicFlush(em, [
+    () => {
+      if (!hasCustomAcl) {
+        if (acl) em.remove(acl)
+      } else {
+        if (!acl) {
+          acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+        }
+        const aclRecord = acl as any
+        aclRecord.isSuperAdmin = effectiveIsSuperAdmin
+        aclRecord.featuresJson = effectiveFeatures
+        aclRecord.organizationsJson = organizations
+        em.persist(acl)
+      }
+    },
+  ], { transaction: true })
 
   // Invalidate cache for this user
   await rbacService.invalidateUserCache(parsed.data.userId)

package/src/modules/auth/commands/users.ts

@@ -25,6 +25,7 @@ import {
   diffCustomFieldChanges,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -300,31 +301,37 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
     if (!userId) return
     const snapshot = logEntry?.snapshotAfter as SerializedUser | undefined
     const em = (ctx.container.resolve('em') as EntityManager)
-    await em.nativeDelete(UserAcl, { user: userId })
-    await em.nativeDelete(UserRole, { user: userId })
-    await em.nativeDelete(Session, { user: userId })
-    await em.nativeDelete(PasswordReset, { user: userId })
-
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    if (snapshot?.custom && Object.keys(snapshot.custom).length) {
-      const reset = buildCustomFieldResetMap(undefined, snapshot.custom)
-      if (Object.keys(reset).length) {
-        await setCustomFieldsIfAny({
-          dataEngine: de,
-          entityId: E.auth.user,
-          recordId: userId,
-          organizationId: snapshot.organizationId,
-          tenantId: snapshot.tenantId,
-          values: reset,
-          notify: false,
+
+    let removed: User | null = null
+    await withAtomicFlush(em, [
+      async () => {
+        await em.nativeDelete(UserAcl, { user: userId })
+        await em.nativeDelete(UserRole, { user: userId })
+        await em.nativeDelete(Session, { user: userId })
+        await em.nativeDelete(PasswordReset, { user: userId })
+
+        if (snapshot?.custom && Object.keys(snapshot.custom).length) {
+          const reset = buildCustomFieldResetMap(undefined, snapshot.custom)
+          if (Object.keys(reset).length) {
+            await setCustomFieldsIfAny({
+              dataEngine: de,
+              entityId: E.auth.user,
+              recordId: userId,
+              organizationId: snapshot.organizationId,
+              tenantId: snapshot.tenantId,
+              values: reset,
+              notify: false,
+            })
+          }
+        }
+        removed = await de.deleteOrmEntity({
+          entity: User,
+          where: { id: userId, deletedAt: null } as FilterQuery<User>,
+          soft: false,
         })
-      }
-    }
-    const removed = await de.deleteOrmEntity({
-      entity: User,
-      where: { id: userId, deletedAt: null } as FilterQuery<User>,
-      soft: false,
-    })
+      },
+    ], { transaction: true })
 
     await emitCrudUndoSideEffects({
       dataEngine: de,
@@ -648,19 +655,24 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async execute(input, ctx) {
     const id = requireId(input, 'User id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-
-    await em.nativeDelete(UserAcl, { user: id })
-    await em.nativeDelete(UserRole, { user: id })
-    await em.nativeDelete(Session, { user: id })
-    await em.nativeDelete(PasswordReset, { user: id })
-
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    const user = await de.deleteOrmEntity({
-      entity: User,
-      where: { id, deletedAt: null } as FilterQuery<User>,
-      soft: false,
-    })
-    if (!user) throw new CrudHttpError(404, { error: 'User not found' })
+
+    let user!: User
+    await withAtomicFlush(em, [
+      async () => {
+        await em.nativeDelete(UserAcl, { user: id })
+        await em.nativeDelete(UserRole, { user: id })
+        await em.nativeDelete(Session, { user: id })
+        await em.nativeDelete(PasswordReset, { user: id })
+        const removed = await de.deleteOrmEntity({
+          entity: User,
+          where: { id, deletedAt: null } as FilterQuery<User>,
+          soft: false,
+        })
+        if (!removed) throw new CrudHttpError(404, { error: 'User not found' })
+        user = removed
+      },
+    ], { transaction: true })
 
     await emitCrudSideEffects({
       dataEngine: de,
@@ -707,51 +719,55 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     let user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null })
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
 
-    if (user) {
-      if (user.deletedAt) {
-        user.deletedAt = null
-      }
-      user.email = before.email
-      user.organizationId = before.organizationId ?? null
-      user.tenantId = before.tenantId ?? null
-      user.passwordHash = before.passwordHash ?? null
-      user.name = before.name ?? null
-      user.isConfirmed = before.isConfirmed
-      await em.flush()
-    } else {
-      user = await de.createOrmEntity({
-        entity: User,
-        data: {
-          id: before.id,
-          email: before.email,
-          organizationId: before.organizationId ?? null,
-          tenantId: before.tenantId ?? null,
-          passwordHash: before.passwordHash ?? null,
-          name: before.name ?? null,
-          isConfirmed: before.isConfirmed,
-        },
-      })
-    }
-
-    if (!user) return
-
-    await em.nativeDelete(UserRole, { user: before.id })
-    await syncUserRoles(em, user, before.roles, before.tenantId)
-
-    await restoreUserAcls(em, user, before.acls)
-
-    const reset = buildCustomFieldResetMap(before.custom, undefined)
-    if (Object.keys(reset).length) {
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.user,
-        recordId: before.id,
-        organizationId: before.organizationId ?? null,
-        tenantId: before.tenantId ?? null,
-        values: reset,
-        notify: false,
-      })
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        if (user) {
+          if (user.deletedAt) {
+            user.deletedAt = null
+          }
+          user.email = before.email
+          user.organizationId = before.organizationId ?? null
+          user.tenantId = before.tenantId ?? null
+          user.passwordHash = before.passwordHash ?? null
+          user.name = before.name ?? null
+          user.isConfirmed = before.isConfirmed
+          await em.flush()
+        } else {
+          user = await de.createOrmEntity({
+            entity: User,
+            data: {
+              id: before.id,
+              email: before.email,
+              organizationId: before.organizationId ?? null,
+              tenantId: before.tenantId ?? null,
+              passwordHash: before.passwordHash ?? null,
+              name: before.name ?? null,
+              isConfirmed: before.isConfirmed,
+            },
+          })
+        }
+
+        if (!user) return
+
+        await em.nativeDelete(UserRole, { user: before.id })
+        await syncUserRoles(em, user, before.roles, before.tenantId)
+
+        await restoreUserAcls(em, user, before.acls)
+
+        const reset = buildCustomFieldResetMap(before.custom, undefined)
+        if (Object.keys(reset).length) {
+          await setCustomFieldsIfAny({
+            dataEngine: de,
+            entityId: E.auth.user,
+            recordId: before.id,
+            organizationId: before.organizationId ?? null,
+            tenantId: before.tenantId ?? null,
+            values: reset,
+            notify: false,
+          })
+        }
+      },
+    ], { transaction: true })
 
     await invalidateUserCache(ctx, before.id)
   },

package/src/modules/auth/services/sidebarPreferencesService.ts

@@ -1,5 +1,6 @@
 import { EntityManager, type FilterQuery } from '@mikro-orm/postgresql'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { Role, RoleSidebarPreference, SidebarVariant, User, UserSidebarPreference } from '../data/entities'
 import {
   SIDEBAR_PREFERENCES_VERSION,
@@ -346,21 +347,24 @@ export async function createSidebarVariant(
     version: input.settings?.version ?? SIDEBAR_PREFERENCES_VERSION,
   })
 
-  if (input.isActive === true) {
-    await deactivateAllVariants(em, scope)
-  }
-
-  const variant = em.create(SidebarVariant, {
-    user: em.getReference(User, userId),
-    tenantId,
-    organizationId,
-    locale,
-    name: finalName,
-    settingsJson: settings,
-    isActive: input.isActive === true,
-    createdAt: new Date(),
-  })
-  await em.flush()
+  let variant!: SidebarVariant
+  await withAtomicFlush(em, [
+    async () => {
+      if (input.isActive === true) {
+        await deactivateAllVariants(em, scope)
+      }
+      variant = em.create(SidebarVariant, {
+        user: em.getReference(User, userId),
+        tenantId,
+        organizationId,
+        locale,
+        name: finalName,
+        settingsJson: settings,
+        isActive: input.isActive === true,
+        createdAt: new Date(),
+      })
+    },
+  ], { transaction: true })
   return toVariantRecord(variant)
 }
 
@@ -383,23 +387,27 @@ export async function updateSidebarVariant(
     { tenantId, organizationId },
   )
   if (!variant) return null
-  if (typeof input.name === 'string' && input.name.trim().length > 0) {
-    variant.name = input.name.trim()
-  }
-  if (input.settings) {
-    variant.settingsJson = normalizeSidebarSettings({
-      ...input.settings,
-      version: input.settings.version ?? SIDEBAR_PREFERENCES_VERSION,
-    })
-  }
-  if (typeof input.isActive === 'boolean') {
-    if (input.isActive) {
-      await deactivateAllVariants(em, scope, variantId)
-    }
-    variant.isActive = input.isActive
-  }
-  await em.flush()
-  return toVariantRecord(variant)
+  const target = variant
+  await withAtomicFlush(em, [
+    async () => {
+      if (typeof input.name === 'string' && input.name.trim().length > 0) {
+        target.name = input.name.trim()
+      }
+      if (input.settings) {
+        target.settingsJson = normalizeSidebarSettings({
+          ...input.settings,
+          version: input.settings.version ?? SIDEBAR_PREFERENCES_VERSION,
+        })
+      }
+      if (typeof input.isActive === 'boolean') {
+        if (input.isActive) {
+          await deactivateAllVariants(em, scope, variantId)
+        }
+        target.isActive = input.isActive
+      }
+    },
+  ], { transaction: true })
+  return toVariantRecord(target)
 }
 
 export async function deleteSidebarVariant(

package/src/modules/catalog/commands/categories.ts

@@ -2,6 +2,7 @@ import { registerCommand } from '@open-mercato/shared/lib/commands'
 import type { CommandHandler } from '@open-mercato/shared/lib/commands'
 import { buildChanges, requireId, parseWithCustomFields, setCustomFieldsIfAny, emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { loadCustomFieldSnapshot, buildCustomFieldResetMap } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -160,8 +161,16 @@ const createCategoryCommand: CommandHandler<CategoryCreateInput, { categoryId: s
       updatedAt: now,
     })
     em.persist(record)
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     await setCustomFieldsIfAny({
       dataEngine: ctx.container.resolve('dataEngine'),
       entityId: E.catalog.catalog_product_category,
@@ -215,8 +224,16 @@ const createCategoryCommand: CommandHandler<CategoryCreateInput, { categoryId: s
     ensureOrganizationScope(ctx, record.organizationId)
     record.deletedAt = new Date()
     record.isActive = false
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     const resetValues = buildCustomFieldResetMap(undefined, after.custom ?? undefined)
     if (Object.keys(resetValues).length) {
       await setCustomFieldsIfAny({
@@ -288,8 +305,16 @@ const updateCategoryCommand: CommandHandler<CategoryUpdateInput, { categoryId: s
       record.isActive = parsed.isActive
     }
 
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     await setCustomFieldsIfAny({
       dataEngine: ctx.container.resolve('dataEngine'),
       entityId: E.catalog.catalog_product_category,
@@ -377,8 +402,16 @@ const updateCategoryCommand: CommandHandler<CategoryUpdateInput, { categoryId: s
       record.isActive = before.isActive
       record.deletedAt = null
     }
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, before.organizationId, before.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, before.organizationId, before.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     const resetValues = buildCustomFieldResetMap(payload?.after?.custom ?? undefined, before.custom ?? undefined)
     if (Object.keys(resetValues).length) {
       await setCustomFieldsIfAny({
@@ -417,8 +450,16 @@ const deleteCategoryCommand: CommandHandler<{ id?: string }, { categoryId: strin
 
     record.deletedAt = new Date()
     record.isActive = false
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, record.organizationId, record.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     if (snapshot?.custom && Object.keys(snapshot.custom).length) {
       const resetValues = buildCustomFieldResetMap(snapshot.custom, undefined)
       if (Object.keys(resetValues).length) {
@@ -504,8 +545,16 @@ const deleteCategoryCommand: CommandHandler<{ id?: string }, { categoryId: strin
       record.childIds = before.childIds
       record.descendantIds = before.descendantIds
     }
-    await em.flush()
-    await rebuildCategoryHierarchyForOrganization(em, before.organizationId, before.tenantId)
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        async () => {
+          await rebuildCategoryHierarchyForOrganization(em, before.organizationId, before.tenantId)
+        },
+      ],
+      { transaction: true }
+    )
     if (before.custom && Object.keys(before.custom).length) {
       await setCustomFieldsIfAny({
         dataEngine: ctx.container.resolve('dataEngine'),