@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4239.1.4a264a5828

package/generated/entity-fields-registry.ts

@@ -2480,6 +2480,70 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "deleted_at": "deleted_at"
     },
+    "staff_time_entry": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "staff_member_id": "staff_member_id",
+      "date": "date",
+      "duration_minutes": "duration_minutes",
+      "started_at": "started_at",
+      "ended_at": "ended_at",
+      "notes": "notes",
+      "time_project_id": "time_project_id",
+      "customer_id": "customer_id",
+      "deal_id": "deal_id",
+      "order_id": "order_id",
+      "source": "source",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "staff_time_entry_segment": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "time_entry_id": "time_entry_id",
+      "started_at": "started_at",
+      "ended_at": "ended_at",
+      "segment_type": "segment_type",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "staff_time_project": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "name": "name",
+      "customer_id": "customer_id",
+      "code": "code",
+      "description": "description",
+      "project_type": "project_type",
+      "color": "color",
+      "status": "status",
+      "owner_user_id": "owner_user_id",
+      "cost_center": "cost_center",
+      "start_date": "start_date",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "staff_time_project_member": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "time_project_id": "time_project_id",
+      "staff_member_id": "staff_member_id",
+      "role": "role",
+      "status": "status",
+      "show_in_grid": "show_in_grid",
+      "assigned_start_date": "assigned_start_date",
+      "assigned_end_date": "assigned_end_date",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
     "step_instance": {
       "id": "id",
       "workflow_instance_id": "workflow_instance_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.4-develop.4217.1.c9aa050183",
+  "version": "0.6.4-develop.4239.1.4a264a5828",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -243,16 +243,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.4-develop.4217.1.c9aa050183",
-    "@open-mercato/shared": "0.6.4-develop.4217.1.c9aa050183",
-    "@open-mercato/ui": "0.6.4-develop.4217.1.c9aa050183",
+    "@open-mercato/ai-assistant": "0.6.4-develop.4239.1.4a264a5828",
+    "@open-mercato/shared": "0.6.4-develop.4239.1.4a264a5828",
+    "@open-mercato/ui": "0.6.4-develop.4239.1.4a264a5828",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.4-develop.4217.1.c9aa050183",
-    "@open-mercato/shared": "0.6.4-develop.4217.1.c9aa050183",
-    "@open-mercato/ui": "0.6.4-develop.4217.1.c9aa050183",
+    "@open-mercato/ai-assistant": "0.6.4-develop.4239.1.4a264a5828",
+    "@open-mercato/shared": "0.6.4-develop.4239.1.4a264a5828",
+    "@open-mercato/ui": "0.6.4-develop.4239.1.4a264a5828",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/timesheetFixtures.ts

@@ -0,0 +1,61 @@
+import { expect, type APIRequestContext } from '@playwright/test'
+import { apiRequest } from './api'
+import { deleteStaffEntityIfExists } from './staffFixtures'
+
+export async function createTimeProjectFixture(
+  request: APIRequestContext,
+  token: string,
+  input?: { name?: string; code?: string },
+): Promise<string> {
+  const response = await apiRequest(request, 'POST', '/api/staff/timesheets/time-projects', {
+    token,
+    data: {
+      name: input?.name ?? `QA Project ${Date.now()}`,
+      code: input?.code ?? `QA-${Date.now()}`,
+      projectType: 'internal',
+      status: 'active',
+    },
+  })
+  expect(response.ok(), `Failed to create time project fixture: ${response.status()}`).toBeTruthy()
+  const body = (await response.json()) as { id?: string }
+  expect(typeof body.id === 'string' && body.id.length > 0).toBeTruthy()
+  return body.id as string
+}
+
+export async function assignEmployeeToProjectFixture(
+  request: APIRequestContext,
+  token: string,
+  projectId: string,
+  staffMemberId: string,
+): Promise<string> {
+  const response = await apiRequest(request, 'POST', `/api/staff/timesheets/time-projects/${projectId}/employees`, {
+    token,
+    data: { staffMemberId, status: 'active', assignedStartDate: new Date().toISOString().slice(0, 10) },
+  })
+  expect(response.ok(), `Failed to assign employee to project: ${response.status()}`).toBeTruthy()
+  const body = (await response.json()) as { id?: string }
+  return body.id ?? ''
+}
+
+export async function createTimeEntryFixture(
+  request: APIRequestContext,
+  token: string,
+  input: { staffMemberId: string; timeProjectId: string; date: string; durationMinutes: number },
+): Promise<string> {
+  const response = await apiRequest(request, 'POST', '/api/staff/timesheets/time-entries', {
+    token,
+    data: {
+      staffMemberId: input.staffMemberId,
+      timeProjectId: input.timeProjectId,
+      date: input.date,
+      durationMinutes: input.durationMinutes,
+      source: 'manual',
+    },
+  })
+  expect(response.ok(), `Failed to create time entry fixture: ${response.status()}`).toBeTruthy()
+  const body = (await response.json()) as { id?: string }
+  expect(typeof body.id === 'string' && body.id.length > 0).toBeTruthy()
+  return body.id as string
+}
+
+export { deleteStaffEntityIfExists }

package/src/modules/attachments/api/library/[id]/route.ts

@@ -163,22 +163,25 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
   if (parsed.data.tags) patch.tags = normalizeAttachmentTags(parsed.data.tags)
   if (parsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(parsed.data.assignments)
   record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)
-  await em.flush()
-
-  if (dataEngine && custom && Object.keys(custom).length) {
-    try {
-      await setCustomFieldsIfAny({
-        dataEngine,
-        entityId: E.attachments.attachment,
-        recordId: record.id,
-        tenantId: record.tenantId ?? auth.tenantId ?? null,
-        organizationId: record.organizationId ?? auth.orgId ?? null,
-        values: custom,
-      })
-    } catch (error) {
-      console.error('[attachments] failed to persist custom attributes', error)
-      return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
-    }
+  // Commit the metadata mutation and the custom-field write atomically so a
+  // custom-field failure cannot leave the attachment metadata partially updated.
+  try {
+    await em.transactional(async (tx) => {
+      await tx.flush()
+      if (dataEngine && custom && Object.keys(custom).length) {
+        await setCustomFieldsIfAny({
+          dataEngine,
+          entityId: E.attachments.attachment,
+          recordId: record.id,
+          tenantId: record.tenantId ?? auth.tenantId ?? null,
+          organizationId: record.organizationId ?? auth.orgId ?? null,
+          values: custom,
+        })
+      }
+    })
+  } catch (error) {
+    console.error('[attachments] failed to persist custom attributes', error)
+    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
   }
 
   if (dataEngine) {
@@ -242,8 +245,12 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
     tenantId: record.tenantId ?? auth.tenantId,
     organizationId: record.organizationId ?? auth.orgId,
   })
-  await deleteDriver.delete(record.partitionCode, record.storagePath)
+  // Commit the DB row removal before deleting the irreversible storage file so a
+  // failed commit cannot leave a dangling record whose backing file is already gone.
+  const recordPartitionCode = record.partitionCode
+  const recordStoragePath = record.storagePath
   await em.remove(record).flush()
+  await deleteDriver.delete(recordPartitionCode, recordStoragePath)
 
   if (dataEngine) {
     await emitCrudSideEffects({

package/src/modules/attachments/api/route.ts

@@ -437,7 +437,26 @@ export async function POST(req: Request) {
     content: extractedContent,
     storageMetadata: metadata,
   })
-  await em.persist(att).flush()
+  // Persist the attachment row and its custom-field values atomically so a
+  // custom-field failure cannot leave behind a committed orphan attachment.
+  try {
+    await em.transactional(async (tx) => {
+      await tx.persist(att).flush()
+      if (dataEngine) {
+        await setCustomFieldsIfAny({
+          dataEngine,
+          entityId: E.attachments.attachment,
+          recordId: attachmentId,
+          tenantId,
+          organizationId: orgId,
+          values: customFieldValues,
+        })
+      }
+    })
+  } catch (error) {
+    console.error('[attachments] failed to persist attachment with custom attributes', error)
+    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
+  }
 
   if (useLlmOcr) {
     requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {
@@ -448,19 +467,6 @@ export async function POST(req: Request) {
   }
 
   if (dataEngine) {
-    try {
-      await setCustomFieldsIfAny({
-        dataEngine,
-        entityId: E.attachments.attachment,
-        recordId: attachmentId,
-        tenantId,
-        organizationId: orgId,
-        values: customFieldValues,
-      })
-    } catch (error) {
-      console.error('[attachments] failed to persist custom attributes', error)
-      return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
-    }
     await emitCrudSideEffects({
       dataEngine,
       action: 'created',

package/src/modules/auth/api/roles/acl/route.ts

@@ -9,6 +9,7 @@ import { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import {
   assertActorCanGrantAcl,
   assertActorCanModifySuperAdminRoleTarget,
@@ -208,11 +209,16 @@ export async function PUT(req: Request) {
     throw err
   }
 
-  acl.organizationsJson = requestedOrganizations
-  acl.isSuperAdmin = requestedIsSuperAdmin
-  acl.featuresJson = requestedFeatures
-  await em.persist(acl).flush()
-  
+  const aclToPersist = acl
+  await withAtomicFlush(em, [
+    () => {
+      aclToPersist.organizationsJson = requestedOrganizations
+      aclToPersist.isSuperAdmin = requestedIsSuperAdmin
+      aclToPersist.featuresJson = requestedFeatures
+      em.persist(aclToPersist)
+    },
+  ], { transaction: true })
+
   // Invalidate cache for all users in this tenant since role ACL changed
   if (targetTenantId) {
     await rbacService.invalidateTenantCache(targetTenantId)

package/src/modules/auth/api/sidebar/preferences/route.ts

@@ -15,6 +15,7 @@ import {
   saveSidebarPreference,
 } from '../../../services/sidebarPreferencesService'
 import { SIDEBAR_PREFERENCES_VERSION } from '@open-mercato/shared/modules/navigation/sidebarPreferences'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { Role, RoleSidebarPreference } from '../../../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { z } from 'zod'
@@ -376,38 +377,46 @@ export async function PUT(req: Request) {
     : []
   const roleMap = new Map<string, Role>(availableRoles.map((role: Role) => [String(role.id), role]))
 
-  const updatedRoleIds: string[] = []
   if (applyToRoles.length > 0) {
     const missing = applyToRoles.filter((id) => !roleMap.has(id))
     if (missing.length) {
       return NextResponse.json({ error: 'Invalid roles', missing }, { status: 400 })
     }
-    for (const roleId of applyToRoles) {
-      const role = roleMap.get(roleId)!
-      await saveRoleSidebarPreference(em, {
-        roleId: role.id,
-        tenantId: auth.tenantId ?? null,
-        locale,
-      }, payload)
-      updatedRoleIds.push(role.id)
-    }
   }
 
-  const filteredClearRoleIds = clearRoleIds.filter((id) => !updatedRoleIds.includes(id) && !applyToRoles.includes(id))
+  const updatedRoleIds: string[] = []
+  const filteredClearRoleIds: string[] = []
+  await withAtomicFlush(em, [
+    async () => {
+      for (const roleId of applyToRoles) {
+        const role = roleMap.get(roleId)!
+        await saveRoleSidebarPreference(em, {
+          roleId: role.id,
+          tenantId: auth.tenantId ?? null,
+          locale,
+        }, payload)
+        updatedRoleIds.push(role.id)
+      }
 
-  if (filteredClearRoleIds.length > 0) {
-    // Cross-locale: role preferences are unique per (role, tenantId); keep the delete
-    // filter aligned with save/load helpers so a clear from one locale does not leave
-    // a row created under another locale orphaned.
-    await em.nativeDelete(RoleSidebarPreference, {
-      role: { $in: filteredClearRoleIds },
-      tenantId: auth.tenantId ?? null,
-    })
-    if (cache?.deleteByTags) {
-      try {
-        await cache.deleteByTags(filteredClearRoleIds.map((roleId) => `nav:sidebar:role:${roleId}`))
-      } catch {}
-    }
+      const clearTargets = clearRoleIds.filter((id) => !updatedRoleIds.includes(id) && !applyToRoles.includes(id))
+      filteredClearRoleIds.push(...clearTargets)
+
+      if (filteredClearRoleIds.length > 0) {
+        // Cross-locale: role preferences are unique per (role, tenantId); keep the delete
+        // filter aligned with save/load helpers so a clear from one locale does not leave
+        // a row created under another locale orphaned.
+        await em.nativeDelete(RoleSidebarPreference, {
+          role: { $in: filteredClearRoleIds },
+          tenantId: auth.tenantId ?? null,
+        })
+      }
+    },
+  ], { transaction: true })
+
+  if (filteredClearRoleIds.length > 0 && cache?.deleteByTags) {
+    try {
+      await cache.deleteByTags(filteredClearRoleIds.map((roleId) => `nav:sidebar:role:${roleId}`))
+    } catch {}
   }
 
   if (cache?.deleteByTags) {

package/src/modules/auth/api/users/acl/route.ts

@@ -6,6 +6,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { assertActorCanModifySuperAdminUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { EntityManager } from '@mikro-orm/postgresql'
@@ -150,18 +151,22 @@ export async function PUT(req: Request) {
 
   const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
 
-  if (!hasCustomAcl) {
-    if (acl) await em.remove(acl).flush()
-  } else {
-    if (!acl) {
-      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
-    }
-    const aclRecord = acl as any
-    aclRecord.isSuperAdmin = effectiveIsSuperAdmin
-    aclRecord.featuresJson = effectiveFeatures
-    aclRecord.organizationsJson = organizations
-    await em.persist(acl).flush()
-  }
+  await withAtomicFlush(em, [
+    () => {
+      if (!hasCustomAcl) {
+        if (acl) em.remove(acl)
+      } else {
+        if (!acl) {
+          acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+        }
+        const aclRecord = acl as any
+        aclRecord.isSuperAdmin = effectiveIsSuperAdmin
+        aclRecord.featuresJson = effectiveFeatures
+        aclRecord.organizationsJson = organizations
+        em.persist(acl)
+      }
+    },
+  ], { transaction: true })
 
   // Invalidate cache for this user
   await rbacService.invalidateUserCache(parsed.data.userId)

package/src/modules/auth/commands/users.ts

@@ -25,6 +25,7 @@ import {
   diffCustomFieldChanges,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -300,31 +301,37 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
     if (!userId) return
     const snapshot = logEntry?.snapshotAfter as SerializedUser | undefined
     const em = (ctx.container.resolve('em') as EntityManager)
-    await em.nativeDelete(UserAcl, { user: userId })
-    await em.nativeDelete(UserRole, { user: userId })
-    await em.nativeDelete(Session, { user: userId })
-    await em.nativeDelete(PasswordReset, { user: userId })
-
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    if (snapshot?.custom && Object.keys(snapshot.custom).length) {
-      const reset = buildCustomFieldResetMap(undefined, snapshot.custom)
-      if (Object.keys(reset).length) {
-        await setCustomFieldsIfAny({
-          dataEngine: de,
-          entityId: E.auth.user,
-          recordId: userId,
-          organizationId: snapshot.organizationId,
-          tenantId: snapshot.tenantId,
-          values: reset,
-          notify: false,
+
+    let removed: User | null = null
+    await withAtomicFlush(em, [
+      async () => {
+        await em.nativeDelete(UserAcl, { user: userId })
+        await em.nativeDelete(UserRole, { user: userId })
+        await em.nativeDelete(Session, { user: userId })
+        await em.nativeDelete(PasswordReset, { user: userId })
+
+        if (snapshot?.custom && Object.keys(snapshot.custom).length) {
+          const reset = buildCustomFieldResetMap(undefined, snapshot.custom)
+          if (Object.keys(reset).length) {
+            await setCustomFieldsIfAny({
+              dataEngine: de,
+              entityId: E.auth.user,
+              recordId: userId,
+              organizationId: snapshot.organizationId,
+              tenantId: snapshot.tenantId,
+              values: reset,
+              notify: false,
+            })
+          }
+        }
+        removed = await de.deleteOrmEntity({
+          entity: User,
+          where: { id: userId, deletedAt: null } as FilterQuery<User>,
+          soft: false,
         })
-      }
-    }
-    const removed = await de.deleteOrmEntity({
-      entity: User,
-      where: { id: userId, deletedAt: null } as FilterQuery<User>,
-      soft: false,
-    })
+      },
+    ], { transaction: true })
 
     await emitCrudUndoSideEffects({
       dataEngine: de,
@@ -648,19 +655,24 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async execute(input, ctx) {
     const id = requireId(input, 'User id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-
-    await em.nativeDelete(UserAcl, { user: id })
-    await em.nativeDelete(UserRole, { user: id })
-    await em.nativeDelete(Session, { user: id })
-    await em.nativeDelete(PasswordReset, { user: id })
-
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    const user = await de.deleteOrmEntity({
-      entity: User,
-      where: { id, deletedAt: null } as FilterQuery<User>,
-      soft: false,
-    })
-    if (!user) throw new CrudHttpError(404, { error: 'User not found' })
+
+    let user!: User
+    await withAtomicFlush(em, [
+      async () => {
+        await em.nativeDelete(UserAcl, { user: id })
+        await em.nativeDelete(UserRole, { user: id })
+        await em.nativeDelete(Session, { user: id })
+        await em.nativeDelete(PasswordReset, { user: id })
+        const removed = await de.deleteOrmEntity({
+          entity: User,
+          where: { id, deletedAt: null } as FilterQuery<User>,
+          soft: false,
+        })
+        if (!removed) throw new CrudHttpError(404, { error: 'User not found' })
+        user = removed
+      },
+    ], { transaction: true })
 
     await emitCrudSideEffects({
       dataEngine: de,
@@ -707,51 +719,55 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     let user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null })
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
 
-    if (user) {
-      if (user.deletedAt) {
-        user.deletedAt = null
-      }
-      user.email = before.email
-      user.organizationId = before.organizationId ?? null
-      user.tenantId = before.tenantId ?? null
-      user.passwordHash = before.passwordHash ?? null
-      user.name = before.name ?? null
-      user.isConfirmed = before.isConfirmed
-      await em.flush()
-    } else {
-      user = await de.createOrmEntity({
-        entity: User,
-        data: {
-          id: before.id,
-          email: before.email,
-          organizationId: before.organizationId ?? null,
-          tenantId: before.tenantId ?? null,
-          passwordHash: before.passwordHash ?? null,
-          name: before.name ?? null,
-          isConfirmed: before.isConfirmed,
-        },
-      })
-    }
-
-    if (!user) return
-
-    await em.nativeDelete(UserRole, { user: before.id })
-    await syncUserRoles(em, user, before.roles, before.tenantId)
-
-    await restoreUserAcls(em, user, before.acls)
-
-    const reset = buildCustomFieldResetMap(before.custom, undefined)
-    if (Object.keys(reset).length) {
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.user,
-        recordId: before.id,
-        organizationId: before.organizationId ?? null,
-        tenantId: before.tenantId ?? null,
-        values: reset,
-        notify: false,
-      })
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        if (user) {
+          if (user.deletedAt) {
+            user.deletedAt = null
+          }
+          user.email = before.email
+          user.organizationId = before.organizationId ?? null
+          user.tenantId = before.tenantId ?? null
+          user.passwordHash = before.passwordHash ?? null
+          user.name = before.name ?? null
+          user.isConfirmed = before.isConfirmed
+          await em.flush()
+        } else {
+          user = await de.createOrmEntity({
+            entity: User,
+            data: {
+              id: before.id,
+              email: before.email,
+              organizationId: before.organizationId ?? null,
+              tenantId: before.tenantId ?? null,
+              passwordHash: before.passwordHash ?? null,
+              name: before.name ?? null,
+              isConfirmed: before.isConfirmed,
+            },
+          })
+        }
+
+        if (!user) return
+
+        await em.nativeDelete(UserRole, { user: before.id })
+        await syncUserRoles(em, user, before.roles, before.tenantId)
+
+        await restoreUserAcls(em, user, before.acls)
+
+        const reset = buildCustomFieldResetMap(before.custom, undefined)
+        if (Object.keys(reset).length) {
+          await setCustomFieldsIfAny({
+            dataEngine: de,
+            entityId: E.auth.user,
+            recordId: before.id,
+            organizationId: before.organizationId ?? null,
+            tenantId: before.tenantId ?? null,
+            values: reset,
+            notify: false,
+          })
+        }
+      },
+    ], { transaction: true })
 
     await invalidateUserCache(ctx, before.id)
   },