@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4236.1.9fa6806b34

package/src/modules/catalog/commands/products.ts

@@ -26,6 +26,7 @@ import {
   loadCustomFieldSnapshot,
   buildCustomFieldResetMap,
 } from "@open-mercato/shared/lib/commands/customFieldSnapshots";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
 import { E } from "#generated/entities.ids.generated";
 import { slugifyTagLabel } from "@open-mercato/shared/lib/utils";
 import { parseObjectLike } from "@open-mercato/shared/lib/json/parseObjectLike";
@@ -950,15 +951,15 @@ type VariantCleanupSnapshot = {
   custom: Record<string, unknown> | null;
 };
 
-async function deleteProductVariantsAndRelatedData(opts: {
-  em: EntityManager;
-  product: CatalogProduct;
-  dataEngine: DataEngine;
-  ctx: CommandRuntimeContext;
-}): Promise<void> {
-  const { em, product, dataEngine, ctx } = opts;
+async function collectProductVariantCleanup(
+  em: EntityManager,
+  product: CatalogProduct,
+): Promise<{
+  variants: CatalogProductVariant[];
+  cleanupEntries: VariantCleanupSnapshot[];
+}> {
   const variants = await em.find(CatalogProductVariant, { product });
-  if (!variants.length) return;
+  if (!variants.length) return { variants: [], cleanupEntries: [] };
   const cleanupEntries: VariantCleanupSnapshot[] = await Promise.all(
     variants.map(async (variant) => {
       const custom = await loadCustomFieldSnapshot(em, {
@@ -975,6 +976,14 @@ async function deleteProductVariantsAndRelatedData(opts: {
       };
     }),
   );
+  return { variants, cleanupEntries };
+}
+
+async function removeProductVariants(
+  em: EntityManager,
+  variants: CatalogProductVariant[],
+): Promise<void> {
+  if (!variants.length) return;
   const variantIds = variants.map((variant) => variant.id);
   if (variantIds.length) {
     await em.nativeDelete(CatalogProductPrice, {
@@ -984,7 +993,14 @@ async function deleteProductVariantsAndRelatedData(opts: {
   for (const variant of variants) {
     em.remove(variant);
   }
-  await em.flush();
+}
+
+async function emitProductVariantCleanupSideEffects(opts: {
+  dataEngine: DataEngine;
+  ctx: CommandRuntimeContext;
+  cleanupEntries: VariantCleanupSnapshot[];
+}): Promise<void> {
+  const { dataEngine, ctx, cleanupEntries } = opts;
   for (const cleanup of cleanupEntries) {
     if (!cleanup.custom) continue;
     const resetValues = buildCustomFieldResetMap(cleanup.custom, undefined);
@@ -1307,15 +1323,16 @@ const createProductCommand: CommandHandler<
     }
     em.persist(record);
     try {
-      await em.flush();
-    } catch (error) {
-      await rethrowProductUniqueConstraint(error);
-    }
-    await syncOffers(em, record, parsed.offers);
-    await syncCategoryAssignments(em, record, parsed.categoryIds);
-    await syncProductTags(em, record, parsed.tags);
-    try {
-      await em.flush();
+      await withAtomicFlush(
+        em,
+        [
+          () => em.flush(),
+          () => syncOffers(em, record, parsed.offers),
+          () => syncCategoryAssignments(em, record, parsed.categoryIds),
+          () => syncProductTags(em, record, parsed.tags),
+        ],
+        { transaction: true },
+      );
     } catch (error) {
       await rethrowProductUniqueConstraint(error);
     }
@@ -1614,15 +1631,16 @@ const updateProductCommand: CommandHandler<
       record.isConfigurable = parsed.isConfigurable;
     if (parsed.isActive !== undefined) record.isActive = parsed.isActive;
     try {
-      await em.flush();
-    } catch (error) {
-      await rethrowProductUniqueConstraint(error);
-    }
-    await syncOffers(em, record, parsed.offers);
-    await syncCategoryAssignments(em, record, parsed.categoryIds);
-    await syncProductTags(em, record, parsed.tags);
-    try {
-      await em.flush();
+      await withAtomicFlush(
+        em,
+        [
+          () => em.flush(),
+          () => syncOffers(em, record, parsed.offers),
+          () => syncCategoryAssignments(em, record, parsed.categoryIds),
+          () => syncProductTags(em, record, parsed.tags),
+        ],
+        { transaction: true },
+      );
     } catch (error) {
       await rethrowProductUniqueConstraint(error);
     }
@@ -1732,16 +1750,16 @@ const updateProductCommand: CommandHandler<
     ensureTenantScope(ctx, before.tenantId);
     ensureOrganizationScope(ctx, before.organizationId);
     applyProductSnapshot(em, record, before);
-    await em.flush();
-
-    const relationEm = em.fork();
-    const relationRecord = await findOneWithDecryption(relationEm, CatalogProduct, { id: before.id });
-    if (relationRecord) {
-      await restoreOffersFromSnapshot(relationEm, relationRecord, before.offers);
-      await syncCategoryAssignments(relationEm, relationRecord, before.categoryIds);
-      await syncProductTags(relationEm, relationRecord, before.tags);
-      await relationEm.flush();
-    }
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        () => restoreOffersFromSnapshot(em, record, before.offers),
+        () => syncCategoryAssignments(em, record, before.categoryIds),
+        () => syncProductTags(em, record, before.tags),
+      ],
+      { transaction: true },
+    );
     const dataEngine = ctx.container.resolve("dataEngine") as DataEngine;
     const resetValues = buildCustomFieldResetMap(
       before.custom ?? undefined,
@@ -1803,23 +1821,38 @@ const deleteProductCommand: CommandHandler<
     ensureTenantScope(ctx, record.tenantId);
     ensureOrganizationScope(ctx, record.organizationId);
     const dataEngine = ctx.container.resolve("dataEngine") as DataEngine;
-    await deleteProductVariantsAndRelatedData({
+    const { variants, cleanupEntries } = await collectProductVariantCleanup(
       em,
-      product: record,
+      record,
+    );
+    await withAtomicFlush(
+      em,
+      [
+        () => removeProductVariants(em, variants),
+        async () => {
+          await em.nativeDelete(CatalogProductPrice, { product: record.id });
+        },
+        async () => {
+          const templateToRemove = await resolveOptionSchemaTemplateForRemoval(
+            em,
+            record,
+          );
+          if (templateToRemove) {
+            record.optionSchemaTemplate = null;
+            em.remove(templateToRemove);
+          }
+        },
+        () => {
+          em.remove(record);
+        },
+      ],
+      { transaction: true },
+    );
+    await emitProductVariantCleanupSideEffects({
       dataEngine,
       ctx,
+      cleanupEntries,
     });
-    await em.nativeDelete(CatalogProductPrice, { product: record.id });
-    const templateToRemove = await resolveOptionSchemaTemplateForRemoval(
-      em,
-      record,
-    );
-    if (templateToRemove) {
-      record.optionSchemaTemplate = null;
-      em.remove(templateToRemove);
-    }
-    em.remove(record);
-    await em.flush();
     if (snapshot?.custom && Object.keys(snapshot.custom).length) {
       const resetValues = buildCustomFieldResetMap(snapshot.custom, undefined);
       if (Object.keys(resetValues).length) {
@@ -1908,16 +1941,16 @@ const deleteProductCommand: CommandHandler<
     ensureTenantScope(ctx, before.tenantId);
     ensureOrganizationScope(ctx, before.organizationId);
     applyProductSnapshot(em, record, before);
-    await em.flush();
-
-    const relationEm = em.fork();
-    const relationRecord = await findOneWithDecryption(relationEm, CatalogProduct, { id: before.id });
-    if (relationRecord) {
-      await restoreOffersFromSnapshot(relationEm, relationRecord, before.offers);
-      await syncCategoryAssignments(relationEm, relationRecord, before.categoryIds);
-      await syncProductTags(relationEm, relationRecord, before.tags);
-      await relationEm.flush();
-    }
+    await withAtomicFlush(
+      em,
+      [
+        () => em.flush(),
+        () => restoreOffersFromSnapshot(em, record, before.offers),
+        () => syncCategoryAssignments(em, record, before.categoryIds),
+        () => syncProductTags(em, record, before.tags),
+      ],
+      { transaction: true },
+    );
     const dataEngine = ctx.container.resolve("dataEngine") as DataEngine;
     if (before.custom && Object.keys(before.custom).length) {
       await setCustomFieldsIfAny({

package/src/modules/catalog/commands/variants.ts

@@ -6,6 +6,7 @@ import { UniqueConstraintViolationException } from '@mikro-orm/core'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { loadCustomFieldSnapshot, buildCustomFieldResetMap } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { E } from '#generated/entities.ids.generated'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -588,21 +589,25 @@ const createVariantCommand: CommandHandler<VariantCreateInput, { variantId: stri
       updatedAt: now,
     })
     em.persist(record)
+    let previousDefaultVariantId: string | null = null
     try {
-      await em.flush()
+      await withAtomicFlush(
+        em,
+        [
+          () => em.flush(),
+          async () => {
+            if (record.isDefault) {
+              previousDefaultVariantId = await enforceSingleDefaultVariant(em, record)
+              await em.flush()
+            }
+          },
+          () => aggregateVariantMediaToProduct(em, record),
+        ],
+        { transaction: true }
+      )
     } catch (error) {
       await rethrowVariantUniqueConstraint(error)
     }
-    let previousDefaultVariantId: string | null = null
-    if (record.isDefault) {
-      previousDefaultVariantId = await enforceSingleDefaultVariant(em, record)
-      try {
-        await em.flush()
-      } catch (error) {
-        await rethrowVariantUniqueConstraint(error)
-      }
-    }
-    await aggregateVariantMediaToProduct(em, record)
     await setCustomFieldsIfAny({
       dataEngine: ctx.container.resolve('dataEngine'),
       entityId: E.catalog.catalog_product_variant,
@@ -753,15 +758,23 @@ const updateVariantCommand: CommandHandler<VariantUpdateInput, { variantId: stri
     }
 
     let previousDefaultVariantId: string | null = null
-    if (parsed.isDefault === true) {
-      previousDefaultVariantId = await enforceSingleDefaultVariant(em, record)
-    }
     try {
-      await em.flush()
+      await withAtomicFlush(
+        em,
+        [
+          async () => {
+            if (parsed.isDefault === true) {
+              previousDefaultVariantId = await enforceSingleDefaultVariant(em, record)
+            }
+          },
+          () => em.flush(),
+          () => aggregateVariantMediaToProduct(em, record),
+        ],
+        { transaction: true }
+      )
     } catch (error) {
       await rethrowVariantUniqueConstraint(error)
     }
-    await aggregateVariantMediaToProduct(em, record)
     if (custom && Object.keys(custom).length) {
       await setCustomFieldsIfAny({
         dataEngine: ctx.container.resolve('dataEngine'),

package/src/modules/currencies/commands/currencies.ts

@@ -2,6 +2,7 @@ import { registerCommand } from '@open-mercato/shared/lib/commands'
 import type { CommandHandler } from '@open-mercato/shared/lib/commands'
 import { buildChanges, requireId, emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -119,13 +120,19 @@ const createCurrencyCommand: CommandHandler<CurrencyCreateInput, { currencyId: s
       updatedAt: now,
     })
     em.persist(record)
-    
-    // Enforce only one base currency before flush to prevent race conditions
-    if (record.isBase) {
-      await enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
-    }
-    
-    await em.flush()
+
+    // Demote any existing base currency and insert the new record in one
+    // transaction; a partial commit would leave zero or two base currencies.
+    await withAtomicFlush(
+      em,
+      [
+        () =>
+          record.isBase
+            ? enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
+            : undefined,
+      ],
+      { transaction: true },
+    )
 
     const de = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
@@ -227,13 +234,19 @@ const updateCurrencyCommand: CommandHandler<CurrencyUpdateInput, { currencyId: s
       ;(record as any)[key] = change.to
     }
     record.updatedAt = new Date()
-    
-    // Enforce only one base currency before flush to prevent race conditions
-    if (parsed.isBase === true && record.isBase) {
-      await enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
-    }
-    
-    await em.flush()
+
+    // Demote any existing base currency and persist the scalar changes in one
+    // transaction; a partial commit would leave zero or two base currencies.
+    await withAtomicFlush(
+      em,
+      [
+        () =>
+          parsed.isBase === true && record.isBase
+            ? enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
+            : undefined,
+      ],
+      { transaction: true },
+    )
 
     const de = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({

package/src/modules/customer_accounts/api/admin/users.ts

@@ -225,35 +225,40 @@ export async function POST(req: Request) {
     { tenantId: auth.tenantId!, organizationId: auth.orgId! },
   )
   user.emailVerifiedAt = new Date()
-  em.persist(user)
-  await em.flush()
 
-  if (parsed.data.customerEntityId) {
-    await em.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })
-  }
+  // Persist the user, its company association, and its role links in one
+  // transaction so a flush failure on the role loop cannot leave a roleless
+  // user committed (privilege gap).
+  await em.transactional(async (tx) => {
+    tx.persist(user)
+    await tx.flush()
 
-  if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
-    const validRoles = await findWithDecryption(
-      em,
-      CustomerRole,
-      {
-        id: { $in: parsed.data.roleIds } as any,
-        tenantId: auth.tenantId,
-        deletedAt: null,
-      } as any,
-      undefined,
-      { tenantId: auth.tenantId, organizationId: auth.orgId },
-    )
-    for (const role of validRoles) {
-      const userRole = em.create(CustomerUserRole, {
-        user,
-        role,
-        createdAt: new Date(),
-      } as any)
-      em.persist(userRole)
+    if (parsed.data.customerEntityId) {
+      await tx.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })
     }
-    await em.flush()
-  }
+
+    if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
+      const validRoles = await findWithDecryption(
+        tx,
+        CustomerRole,
+        {
+          id: { $in: parsed.data.roleIds } as any,
+          tenantId: auth.tenantId,
+          deletedAt: null,
+        } as any,
+        undefined,
+        { tenantId: auth.tenantId, organizationId: auth.orgId },
+      )
+      for (const role of validRoles) {
+        const userRole = tx.create(CustomerUserRole, {
+          user,
+          role,
+          createdAt: new Date(),
+        } as any)
+        tx.persist(userRole)
+      }
+    }
+  })
 
   void emitCustomerAccountsEvent('customer_accounts.user.created', {
     id: user.id,

package/src/modules/customer_accounts/api/password/reset-confirm.ts

@@ -44,14 +44,13 @@ export async function POST(req: Request) {
   await em.transactional(async (trx) => {
     await customerUserService.updatePassword(user, parsed.data.password, trx)
     await customerSessionService.revokeAllUserSessions(user.id, trx)
+    await trx.nativeUpdate(
+      CustomerUser,
+      { id: user.id, emailVerifiedAt: null },
+      { emailVerifiedAt: new Date() },
+    )
   })
 
-  await em.nativeUpdate(
-    CustomerUser,
-    { id: user.id, emailVerifiedAt: null },
-    { emailVerifiedAt: new Date() },
-  )
-
   void emitCustomerAccountsEvent('customer_accounts.password.changed', {
     userId: user.id,
     tenantId: user.tenantId,

package/src/modules/customer_accounts/api/portal/users/[id]/roles.ts

@@ -75,19 +75,20 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     validatedRoles.push(role)
   }
 
-  // Remove existing roles
-  await em.nativeDelete(CustomerUserRole, { user: targetUser.id as any })
-
-  // Assign new roles
-  for (const role of validatedRoles) {
-    const userRole = em.create(CustomerUserRole, {
-      user: targetUser,
-      role,
-      createdAt: new Date(),
-    } as any)
-    em.persist(userRole)
-  }
-  await em.flush()
+  // Replace the role set atomically: deleting the old roles and inserting the new
+  // ones in one transaction prevents a flush failure from leaving the user with
+  // zero roles (portal lockout / privilege loss) (#2337).
+  await em.transactional(async (tx) => {
+    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id as any })
+    for (const role of validatedRoles) {
+      const userRole = tx.create(CustomerUserRole, {
+        user: targetUser,
+        role,
+        createdAt: new Date(),
+      } as any)
+      tx.persist(userRole)
+    }
+  })
 
   await customerRbacService.invalidateUserCache(targetUser.id)
 

package/src/modules/customers/commands/addresses.ts

@@ -17,6 +17,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig, CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 
 const addressCrudIndexer: CrudIndexerConfig<CustomerAddress> = {
   entityType: E.customers.customer_address,
@@ -130,13 +131,15 @@ const createAddressCommand: CommandHandler<AddressCreateInput, { addressId: stri
       createdAt: new Date(),
       updatedAt: new Date(),
     })
-    em.persist(address)
-    await em.flush()
-
-    if (address.isPrimary) {
-      await enforcePrimaryAddress(em, entity.id, address.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        em.persist(address)
+        await em.flush()
+        if (address.isPrimary) {
+          await enforcePrimaryAddress(em, entity.id, address.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudSideEffects({
@@ -225,12 +228,13 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
     if (parsed.longitude !== undefined) address.longitude = parsed.longitude ?? null
     if (parsed.isPrimary !== undefined) address.isPrimary = parsed.isPrimary
 
-    await em.flush()
-
-    if (address.isPrimary) {
-      await enforcePrimaryAddress(em, typeof address.entity === 'string' ? address.entity : address.entity.id, address.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        if (address.isPrimary) {
+          await enforcePrimaryAddress(em, typeof address.entity === 'string' ? address.entity : address.entity.id, address.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudSideEffects({
@@ -348,11 +352,15 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
       address.longitude = before.longitude
       address.isPrimary = before.isPrimary
     }
-    await em.flush()
-    if (before.isPrimary) {
-      await enforcePrimaryAddress(em, before.entityId, before.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        em.persist(address)
+        await em.flush()
+        if (before.isPrimary) {
+          await enforcePrimaryAddress(em, before.entityId, before.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudUndoSideEffects({
@@ -471,11 +479,15 @@ const deleteAddressCommand: CommandHandler<{ body?: Record<string, unknown>; que
         address.longitude = before.longitude
         address.isPrimary = before.isPrimary
       }
-      await em.flush()
-      if (before.isPrimary) {
-        await enforcePrimaryAddress(em, before.entityId, before.id)
-        await em.flush()
-      }
+      await withAtomicFlush(em, [
+        async () => {
+          em.persist(address)
+          await em.flush()
+          if (before.isPrimary) {
+            await enforcePrimaryAddress(em, before.entityId, before.id)
+          }
+        },
+      ], { transaction: true })
 
       const de = (ctx.container.resolve('dataEngine') as DataEngine)
       await emitCrudUndoSideEffects({