@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4239.1.4a264a5828

package/src/modules/currencies/backend/currencies/[id]/page.tsx

@@ -12,6 +12,7 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { SendObjectMessageDialog } from '@open-mercato/ui/backend/messages'
 import { DataLoader } from '@open-mercato/ui/primitives/DataLoader'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
 
 type CurrencyData = {
   id: string
@@ -35,6 +36,7 @@ export default function EditCurrencyPage({ params }: { params?: { id?: string }
   const [currency, setCurrency] = React.useState<CurrencyData | null>(null)
   const [loading, setLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
+  const [isNotFound, setIsNotFound] = React.useState(false)
 
   React.useEffect(() => {
     async function loadCurrency() {
@@ -42,8 +44,10 @@ export default function EditCurrencyPage({ params }: { params?: { id?: string }
         const response = await apiCall<{ items: CurrencyData[] }>(`/api/currencies/currencies?id=${params?.id}`)
         if (response.ok && response.result && response.result.items.length > 0) {
           setCurrency(response.result.items[0])
+        } else if (!response.ok) {
+          setError(t('currencies.form.errors.load'))
         } else {
-          setError(t('currencies.form.errors.notFound'))
+          setIsNotFound(true)
         }
       } catch (err) {
         setError(t('currencies.form.errors.load'))
@@ -163,11 +167,26 @@ export default function EditCurrencyPage({ params }: { params?: { id?: string }
     )
   }
 
+  if (isNotFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('currencies.form.errors.notFound', 'Currency not found.')}
+            backHref="/backend/currencies"
+            backLabel={t('currencies.form.actions.backToList', 'Back to currencies')}
+          />
+        </PageBody>
+        {ConfirmDialogElement}
+      </Page>
+    )
+  }
+
   if (error || !currency) {
     return (
       <Page>
         <PageBody>
-          <div className="text-destructive">{error || t('currencies.form.errors.notFound')}</div>
+          <ErrorMessage label={error ?? t('currencies.form.errors.notFound', 'Currency not found.')} />
         </PageBody>
         {ConfirmDialogElement}
       </Page>

package/src/modules/currencies/commands/currencies.ts

@@ -2,6 +2,7 @@ import { registerCommand } from '@open-mercato/shared/lib/commands'
 import type { CommandHandler } from '@open-mercato/shared/lib/commands'
 import { buildChanges, requireId, emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -119,13 +120,19 @@ const createCurrencyCommand: CommandHandler<CurrencyCreateInput, { currencyId: s
       updatedAt: now,
     })
     em.persist(record)
-    
-    // Enforce only one base currency before flush to prevent race conditions
-    if (record.isBase) {
-      await enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
-    }
-    
-    await em.flush()
+
+    // Demote any existing base currency and insert the new record in one
+    // transaction; a partial commit would leave zero or two base currencies.
+    await withAtomicFlush(
+      em,
+      [
+        () =>
+          record.isBase
+            ? enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
+            : undefined,
+      ],
+      { transaction: true },
+    )
 
     const de = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
@@ -227,13 +234,19 @@ const updateCurrencyCommand: CommandHandler<CurrencyUpdateInput, { currencyId: s
       ;(record as any)[key] = change.to
     }
     record.updatedAt = new Date()
-    
-    // Enforce only one base currency before flush to prevent race conditions
-    if (parsed.isBase === true && record.isBase) {
-      await enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
-    }
-    
-    await em.flush()
+
+    // Demote any existing base currency and persist the scalar changes in one
+    // transaction; a partial commit would leave zero or two base currencies.
+    await withAtomicFlush(
+      em,
+      [
+        () =>
+          parsed.isBase === true && record.isBase
+            ? enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)
+            : undefined,
+      ],
+      { transaction: true },
+    )
 
     const de = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({

package/src/modules/currencies/i18n/de.json

@@ -41,6 +41,7 @@
   "currencies.flash.updated": "Währung erfolgreich aktualisiert",
   "currencies.form.action.create": "Währung erstellen",
   "currencies.form.action.save": "Änderungen speichern",
+  "currencies.form.actions.backToList": "Zurück zu Währungen",
   "currencies.form.errors.codeFormat": "Währungscode muss genau 3 Großbuchstaben sein (z.B. USD)",
   "currencies.form.errors.delete": "Währung konnte nicht gelöscht werden",
   "currencies.form.errors.load": "Währung konnte nicht geladen werden",

package/src/modules/currencies/i18n/en.json

@@ -41,6 +41,7 @@
   "currencies.flash.updated": "Currency updated successfully",
   "currencies.form.action.create": "Create Currency",
   "currencies.form.action.save": "Save Changes",
+  "currencies.form.actions.backToList": "Back to currencies",
   "currencies.form.errors.codeFormat": "Currency code must be exactly 3 uppercase letters (e.g., USD)",
   "currencies.form.errors.delete": "Failed to delete currency",
   "currencies.form.errors.load": "Failed to load currency",

package/src/modules/currencies/i18n/es.json

@@ -41,6 +41,7 @@
   "currencies.flash.updated": "Moneda actualizada correctamente",
   "currencies.form.action.create": "Crear Moneda",
   "currencies.form.action.save": "Guardar Cambios",
+  "currencies.form.actions.backToList": "Volver a divisas",
   "currencies.form.errors.codeFormat": "El código de moneda debe ser exactamente 3 letras mayúsculas (ej. USD)",
   "currencies.form.errors.delete": "Error al eliminar moneda",
   "currencies.form.errors.load": "Error al cargar moneda",

package/src/modules/currencies/i18n/pl.json

@@ -41,6 +41,7 @@
   "currencies.flash.updated": "Waluta zaktualizowana pomyślnie",
   "currencies.form.action.create": "Utwórz Walutę",
   "currencies.form.action.save": "Zapisz Zmiany",
+  "currencies.form.actions.backToList": "Wróć do walut",
   "currencies.form.errors.codeFormat": "Kod waluty musi składać się z dokładnie 3 wielkich liter (np. USD)",
   "currencies.form.errors.delete": "Nie udało się usunąć waluty",
   "currencies.form.errors.load": "Nie udało się załadować waluty",

package/src/modules/customer_accounts/api/admin/users.ts

@@ -225,35 +225,40 @@ export async function POST(req: Request) {
     { tenantId: auth.tenantId!, organizationId: auth.orgId! },
   )
   user.emailVerifiedAt = new Date()
-  em.persist(user)
-  await em.flush()
 
-  if (parsed.data.customerEntityId) {
-    await em.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })
-  }
+  // Persist the user, its company association, and its role links in one
+  // transaction so a flush failure on the role loop cannot leave a roleless
+  // user committed (privilege gap).
+  await em.transactional(async (tx) => {
+    tx.persist(user)
+    await tx.flush()
 
-  if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
-    const validRoles = await findWithDecryption(
-      em,
-      CustomerRole,
-      {
-        id: { $in: parsed.data.roleIds } as any,
-        tenantId: auth.tenantId,
-        deletedAt: null,
-      } as any,
-      undefined,
-      { tenantId: auth.tenantId, organizationId: auth.orgId },
-    )
-    for (const role of validRoles) {
-      const userRole = em.create(CustomerUserRole, {
-        user,
-        role,
-        createdAt: new Date(),
-      } as any)
-      em.persist(userRole)
+    if (parsed.data.customerEntityId) {
+      await tx.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })
     }
-    await em.flush()
-  }
+
+    if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
+      const validRoles = await findWithDecryption(
+        tx,
+        CustomerRole,
+        {
+          id: { $in: parsed.data.roleIds } as any,
+          tenantId: auth.tenantId,
+          deletedAt: null,
+        } as any,
+        undefined,
+        { tenantId: auth.tenantId, organizationId: auth.orgId },
+      )
+      for (const role of validRoles) {
+        const userRole = tx.create(CustomerUserRole, {
+          user,
+          role,
+          createdAt: new Date(),
+        } as any)
+        tx.persist(userRole)
+      }
+    }
+  })
 
   void emitCustomerAccountsEvent('customer_accounts.user.created', {
     id: user.id,

package/src/modules/customer_accounts/api/password/reset-confirm.ts

@@ -44,14 +44,13 @@ export async function POST(req: Request) {
   await em.transactional(async (trx) => {
     await customerUserService.updatePassword(user, parsed.data.password, trx)
     await customerSessionService.revokeAllUserSessions(user.id, trx)
+    await trx.nativeUpdate(
+      CustomerUser,
+      { id: user.id, emailVerifiedAt: null },
+      { emailVerifiedAt: new Date() },
+    )
   })
 
-  await em.nativeUpdate(
-    CustomerUser,
-    { id: user.id, emailVerifiedAt: null },
-    { emailVerifiedAt: new Date() },
-  )
-
   void emitCustomerAccountsEvent('customer_accounts.password.changed', {
     userId: user.id,
     tenantId: user.tenantId,

package/src/modules/customer_accounts/api/portal/users/[id]/roles.ts

@@ -75,19 +75,20 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     validatedRoles.push(role)
   }
 
-  // Remove existing roles
-  await em.nativeDelete(CustomerUserRole, { user: targetUser.id as any })
-
-  // Assign new roles
-  for (const role of validatedRoles) {
-    const userRole = em.create(CustomerUserRole, {
-      user: targetUser,
-      role,
-      createdAt: new Date(),
-    } as any)
-    em.persist(userRole)
-  }
-  await em.flush()
+  // Replace the role set atomically: deleting the old roles and inserting the new
+  // ones in one transaction prevents a flush failure from leaving the user with
+  // zero roles (portal lockout / privilege loss) (#2337).
+  await em.transactional(async (tx) => {
+    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id as any })
+    for (const role of validatedRoles) {
+      const userRole = tx.create(CustomerUserRole, {
+        user: targetUser,
+        role,
+        createdAt: new Date(),
+      } as any)
+      tx.persist(userRole)
+    }
+  })
 
   await customerRbacService.invalidateUserCache(targetUser.id)
 

package/src/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.tsx

@@ -11,6 +11,7 @@ import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
 
 type RoleDetail = {
   id: string
@@ -146,10 +147,11 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
   const [data, setData] = React.useState<RoleDetail | null>(null)
   const [isLoading, setIsLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
+  const [isNotFound, setIsNotFound] = React.useState(false)
 
   React.useEffect(() => {
     if (!id) {
-      setError(t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found'))
+      setIsNotFound(true)
       setIsLoading(false)
       return
     }
@@ -157,6 +159,7 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
     async function load() {
       setIsLoading(true)
       setError(null)
+      setIsNotFound(false)
       try {
         const payload = await readApiResultOrThrow<RoleDetail>(
           `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,
@@ -167,8 +170,12 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
         setData(payload)
       } catch (err) {
         if (cancelled) return
-        const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')
-        setError(message)
+        if ((err as { status?: number }).status === 404) {
+          setIsNotFound(true)
+        } else {
+          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')
+          setError(message)
+        }
       } finally {
         if (!cancelled) setIsLoading(false)
       }
@@ -300,18 +307,34 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
     )
   }
 
+  if (isNotFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}
+            backHref="/backend/customer_accounts/roles"
+            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
   if (error || !data) {
     return (
       <Page>
         <PageBody>
-          <div className="flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground">
-            <p>{error || t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}</p>
-            <Button asChild variant="outline">
-              <Link href="/backend/customer_accounts/roles">
-                {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}
-              </Link>
-            </Button>
-          </div>
+          <ErrorMessage
+            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}
+            action={
+              <Button asChild variant="outline" size="sm">
+                <Link href="/backend/customer_accounts/roles">
+                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}
+                </Link>
+              </Button>
+            }
+          />
         </PageBody>
       </Page>
     )

package/src/modules/customer_accounts/backend/customer_accounts/users/[id]/page.tsx

@@ -16,6 +16,7 @@ import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
+import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
 
 type UserDetail = {
   id: string
@@ -147,6 +148,7 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
   const [data, setData] = React.useState<UserDetail | null>(null)
   const [isLoading, setIsLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
+  const [isNotFound, setIsNotFound] = React.useState(false)
   const [isSaving, setIsSaving] = React.useState(false)
   const [editActive, setEditActive] = React.useState<boolean | null>(null)
   const [editDisplayName, setEditDisplayName] = React.useState('')
@@ -186,7 +188,7 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
 
   React.useEffect(() => {
     if (!id) {
-      setError(t('customer_accounts.admin.detail.error.notFound', 'User not found'))
+      setIsNotFound(true)
       setIsLoading(false)
       return
     }
@@ -194,6 +196,7 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     async function load() {
       setIsLoading(true)
       setError(null)
+      setIsNotFound(false)
       try {
         const payload = await readApiResultOrThrow<UserDetail>(
           `/api/customer_accounts/admin/users/${encodeURIComponent(id!)}`,
@@ -209,8 +212,12 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
         setEditCustomerEntityId(payload.customerEntityId)
       } catch (err) {
         if (cancelled) return
-        const message = err instanceof Error ? err.message : t('customer_accounts.admin.detail.error.load', 'Failed to load user')
-        setError(message)
+        if ((err as { status?: number }).status === 404) {
+          setIsNotFound(true)
+        } else {
+          const message = err instanceof Error ? err.message : t('customer_accounts.admin.detail.error.load', 'Failed to load user')
+          setError(message)
+        }
       } finally {
         if (!cancelled) setIsLoading(false)
       }
@@ -463,18 +470,34 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     )
   }
 
+  if (isNotFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('customer_accounts.admin.detail.error.notFound', 'User not found')}
+            backHref="/backend/customer_accounts/users"
+            backLabel={t('customer_accounts.admin.detail.actions.backToList', 'Back to list')}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
   if (error || !data) {
     return (
       <Page>
         <PageBody>
-          <div className="flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground">
-            <p>{error || t('customer_accounts.admin.detail.error.notFound', 'User not found')}</p>
-            <Button asChild variant="outline">
-              <Link href="/backend/customer_accounts/users">
-                {t('customer_accounts.admin.detail.actions.backToList', 'Back to list')}
-              </Link>
-            </Button>
-          </div>
+          <ErrorMessage
+            label={error ?? t('customer_accounts.admin.detail.error.notFound', 'User not found')}
+            action={
+              <Button asChild variant="outline" size="sm">
+                <Link href="/backend/customer_accounts/users">
+                  {t('customer_accounts.admin.detail.actions.backToList', 'Back to list')}
+                </Link>
+              </Button>
+            }
+          />
         </PageBody>
       </Page>
     )

package/src/modules/customers/backend/customers/people/[id]/page.tsx

@@ -20,6 +20,8 @@ import {
   NotesSection,
   type CommentSummary,
   type SectionAction,
+  RecordNotFoundState,
+  ErrorMessage,
 } from '@open-mercato/ui/backend/detail'
 import {
   TagsSection,
@@ -116,6 +118,7 @@ export default function CustomerPersonDetailPage({ params }: { params?: { id?: s
   const [data, setData] = React.useState<PersonOverview | null>(null)
   const [isLoading, setIsLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
+  const [isNotFound, setIsNotFound] = React.useState(false)
   const [activeTab, setActiveTab] = React.useState<SectionKey>(initialTab)
   const [sectionAction, setSectionAction] = React.useState<SectionAction | null>(null)
   const [isDeleting, setIsDeleting] = React.useState(false)
@@ -276,7 +279,7 @@ export default function CustomerPersonDetailPage({ params }: { params?: { id?: s
   const initialLoadDoneRef = React.useRef(false)
   const loadData = React.useCallback(async () => {
     if (!id) {
-      setError(t('customers.people.detail.error.notFound'))
+      setIsNotFound(true)
       setIsLoading(false)
       return
     }
@@ -284,6 +287,7 @@ export default function CustomerPersonDetailPage({ params }: { params?: { id?: s
       setIsLoading(true)
     }
     setError(null)
+    setIsNotFound(false)
     try {
       const payload = await readApiResultOrThrow<PersonOverview>(
         `/api/customers/people/${encodeURIComponent(id)}?include=todos`,
@@ -292,8 +296,12 @@ export default function CustomerPersonDetailPage({ params }: { params?: { id?: s
       )
       setData(payload as PersonOverview)
     } catch (err) {
-      const message = err instanceof Error ? err.message : t('customers.people.detail.error.load')
-      setError(message)
+      if ((err as { status?: number }).status === 404) {
+        setIsNotFound(true)
+      } else {
+        const message = err instanceof Error ? err.message : t('customers.people.detail.error.load')
+        setError(message)
+      }
       if (!initialLoadDoneRef.current) setData(null)
     } finally {
       setIsLoading(false)
@@ -469,18 +477,34 @@ export default function CustomerPersonDetailPage({ params }: { params?: { id?: s
       )
     }
   
+    if (isNotFound) {
+      return (
+        <Page>
+          <PageBody>
+            <RecordNotFoundState
+              label={t('customers.people.detail.error.notFound', 'Person not found.')}
+              backHref="/backend/customers/people"
+              backLabel={t('customers.people.detail.actions.backToList', 'Back to people')}
+            />
+          </PageBody>
+        </Page>
+      )
+    }
+
     if (error || !data || !personId) {
       return (
         <Page>
           <PageBody>
-            <div className="flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground">
-              <p>{error || t('customers.people.detail.error.notFound')}</p>
-              <Button asChild variant="outline">
-                <Link href="/backend/customers/people">
-                  {t('customers.people.detail.actions.backToList')}
-                </Link>
-              </Button>
-            </div>
+            <ErrorMessage
+              label={error ?? t('customers.people.detail.error.notFound', 'Person not found.')}
+              action={
+                <Button asChild variant="outline" size="sm">
+                  <Link href="/backend/customers/people">
+                    {t('customers.people.detail.actions.backToList', 'Back to people')}
+                  </Link>
+                </Button>
+              }
+            />
           </PageBody>
         </Page>
       )

package/src/modules/customers/commands/addresses.ts

@@ -17,6 +17,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig, CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 
 const addressCrudIndexer: CrudIndexerConfig<CustomerAddress> = {
   entityType: E.customers.customer_address,
@@ -130,13 +131,15 @@ const createAddressCommand: CommandHandler<AddressCreateInput, { addressId: stri
       createdAt: new Date(),
       updatedAt: new Date(),
     })
-    em.persist(address)
-    await em.flush()
-
-    if (address.isPrimary) {
-      await enforcePrimaryAddress(em, entity.id, address.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        em.persist(address)
+        await em.flush()
+        if (address.isPrimary) {
+          await enforcePrimaryAddress(em, entity.id, address.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudSideEffects({
@@ -225,12 +228,13 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
     if (parsed.longitude !== undefined) address.longitude = parsed.longitude ?? null
     if (parsed.isPrimary !== undefined) address.isPrimary = parsed.isPrimary
 
-    await em.flush()
-
-    if (address.isPrimary) {
-      await enforcePrimaryAddress(em, typeof address.entity === 'string' ? address.entity : address.entity.id, address.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        if (address.isPrimary) {
+          await enforcePrimaryAddress(em, typeof address.entity === 'string' ? address.entity : address.entity.id, address.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudSideEffects({
@@ -348,11 +352,15 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
       address.longitude = before.longitude
       address.isPrimary = before.isPrimary
     }
-    await em.flush()
-    if (before.isPrimary) {
-      await enforcePrimaryAddress(em, before.entityId, before.id)
-      await em.flush()
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        em.persist(address)
+        await em.flush()
+        if (before.isPrimary) {
+          await enforcePrimaryAddress(em, before.entityId, before.id)
+        }
+      },
+    ], { transaction: true })
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     await emitCrudUndoSideEffects({
@@ -471,11 +479,15 @@ const deleteAddressCommand: CommandHandler<{ body?: Record<string, unknown>; que
         address.longitude = before.longitude
         address.isPrimary = before.isPrimary
       }
-      await em.flush()
-      if (before.isPrimary) {
-        await enforcePrimaryAddress(em, before.entityId, before.id)
-        await em.flush()
-      }
+      await withAtomicFlush(em, [
+        async () => {
+          em.persist(address)
+          await em.flush()
+          if (before.isPrimary) {
+            await enforcePrimaryAddress(em, before.entityId, before.id)
+          }
+        },
+      ], { transaction: true })
 
       const de = (ctx.container.resolve('dataEngine') as DataEngine)
       await emitCrudUndoSideEffects({