@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/helpers/integration/workflowsFixtures.ts

@@ -120,3 +120,234 @@ export async function cancelWorkflowInstanceIfExists(
     { token },
   ).catch(() => undefined);
 }
+
+/**
+ * Definition with a single USER_TASK queued to a role (not a specific user), so the
+ * generated task is claimable. The array form of `assignedTo` is intentional: the step
+ * handler stores an array `assignedTo` as `assignedToRoles` (a role queue) and leaves
+ * `assignedTo` null — the precondition `claimUserTask` requires. The post-task transition
+ * is `auto` so completing the task advances the instance to END (COMPLETED).
+ */
+export function buildClaimableUserTaskDefinitionPayload(timestamp: number, suffix = '') {
+  const id = `qa-wf-claim${suffix}-${timestamp}`;
+  return {
+    workflowId: id,
+    workflowName: `QA Claimable User Task${suffix} ${timestamp}`,
+    description: `Integration test definition ${id}`,
+    version: 1,
+    definition: {
+      steps: [
+        { stepId: 'start', stepName: 'Start', stepType: 'START' },
+        {
+          stepId: 'review',
+          stepName: 'Review',
+          stepType: 'USER_TASK',
+          userTaskConfig: {
+            assignedTo: ['admin'],
+            formSchema: {
+              properties: {
+                approved: { type: 'boolean' },
+                comments: { type: 'string' },
+              },
+              required: ['approved'],
+            },
+          },
+        },
+        { stepId: 'end', stepName: 'End', stepType: 'END' },
+      ],
+      transitions: [
+        { transitionId: 'start-to-review', fromStepId: 'start', toStepId: 'review', trigger: 'auto' },
+        { transitionId: 'review-to-end', fromStepId: 'review', toStepId: 'end', trigger: 'auto' },
+      ],
+    },
+    enabled: true,
+  };
+}
+
+/**
+ * Definition with a single USER_TASK assigned directly to one user id, so the generated
+ * task carries `assignedTo=<userId>` (and is therefore filterable by `assignedTo`/`myTasks`
+ * and NOT claimable from a role queue).
+ */
+export function buildAssignedUserTaskDefinitionPayload(timestamp: number, assignedUserId: string, suffix = '') {
+  const id = `qa-wf-assigned${suffix}-${timestamp}`;
+  return {
+    workflowId: id,
+    workflowName: `QA Assigned User Task${suffix} ${timestamp}`,
+    description: `Integration test definition ${id}`,
+    version: 1,
+    definition: {
+      steps: [
+        { stepId: 'start', stepName: 'Start', stepType: 'START' },
+        {
+          stepId: 'review',
+          stepName: 'Review',
+          stepType: 'USER_TASK',
+          userTaskConfig: {
+            assignedTo: assignedUserId,
+            formSchema: { properties: { approved: { type: 'boolean' } } },
+          },
+        },
+        { stepId: 'end', stepName: 'End', stepType: 'END' },
+      ],
+      transitions: [
+        { transitionId: 'start-to-review', fromStepId: 'start', toStepId: 'review', trigger: 'auto' },
+        { transitionId: 'review-to-end', fromStepId: 'review', toStepId: 'end', trigger: 'auto' },
+      ],
+    },
+    enabled: true,
+  };
+}
+
+/**
+ * Definition that pauses at a WAIT_FOR_SIGNAL step until the named signal arrives. The
+ * post-signal transition is `auto` so a matching signal resumes the instance to COMPLETED.
+ */
+export function buildSignalDefinitionPayload(timestamp: number, signalName = 'approval', suffix = '') {
+  const id = `qa-wf-signal${suffix}-${timestamp}`;
+  return {
+    workflowId: id,
+    workflowName: `QA Signal Workflow${suffix} ${timestamp}`,
+    description: `Integration test definition ${id}`,
+    version: 1,
+    definition: {
+      steps: [
+        { stepId: 'start', stepName: 'Start', stepType: 'START' },
+        { stepId: 'wait', stepName: 'Wait For Signal', stepType: 'WAIT_FOR_SIGNAL', signalConfig: { signalName } },
+        { stepId: 'end', stepName: 'End', stepType: 'END' },
+      ],
+      transitions: [
+        { transitionId: 'start-to-wait', fromStepId: 'start', toStepId: 'wait', trigger: 'auto' },
+        { transitionId: 'wait-to-end', fromStepId: 'wait', toStepId: 'end', trigger: 'auto' },
+      ],
+    },
+    enabled: true,
+  };
+}
+
+/**
+ * Linear START → mid → END definition whose transitions are all `manual`. The background
+ * executor never auto-fires them, so the instance rests at each step (RUNNING) until the
+ * `/advance` endpoint moves it on — the precondition for exercising manual progression.
+ */
+export function buildManualAdvanceDefinitionPayload(timestamp: number, suffix = '') {
+  const id = `qa-wf-advance${suffix}-${timestamp}`;
+  return {
+    workflowId: id,
+    workflowName: `QA Manual Advance Workflow${suffix} ${timestamp}`,
+    description: `Integration test definition ${id}`,
+    version: 1,
+    definition: {
+      steps: [
+        { stepId: 'start', stepName: 'Start', stepType: 'START' },
+        { stepId: 'mid', stepName: 'Middle', stepType: 'AUTOMATED' },
+        { stepId: 'end', stepName: 'End', stepType: 'END' },
+      ],
+      transitions: [
+        { transitionId: 'start-to-mid', fromStepId: 'start', toStepId: 'mid', trigger: 'manual' },
+        { transitionId: 'mid-to-end', fromStepId: 'mid', toStepId: 'end', trigger: 'manual' },
+      ],
+    },
+    enabled: true,
+  };
+}
+
+export type WorkflowInstanceSnapshot = {
+  id?: string;
+  status?: string;
+  currentStepId?: string;
+  retryCount?: number;
+  correlationKey?: string;
+  context?: Record<string, unknown>;
+};
+
+export async function getWorkflowInstanceSnapshot(
+  request: APIRequestContext,
+  token: string,
+  instanceId: string,
+): Promise<WorkflowInstanceSnapshot | null> {
+  const response = await apiRequest(
+    request,
+    'GET',
+    `/api/workflows/instances/${encodeURIComponent(instanceId)}`,
+    { token },
+  );
+  if (response.status() !== 200) return null;
+  const body = await readJsonSafe<{ data?: WorkflowInstanceSnapshot }>(response);
+  return body?.data ?? null;
+}
+
+/**
+ * Polls instance detail until `predicate` holds or the timeout elapses. Required because
+ * `POST /api/workflows/instances` runs execution in a background `setImmediate` callback,
+ * so the instance reaches its pause/terminal state asynchronously after the 201 response.
+ * Returns the last snapshot seen (so callers can assert on a timeout too).
+ */
+export async function pollWorkflowInstance(
+  request: APIRequestContext,
+  token: string,
+  instanceId: string,
+  predicate: (instance: WorkflowInstanceSnapshot) => boolean,
+  options: { timeoutMs?: number; intervalMs?: number } = {},
+): Promise<WorkflowInstanceSnapshot | null> {
+  const timeoutMs = options.timeoutMs ?? 8_000;
+  const intervalMs = options.intervalMs ?? 250;
+  const deadline = Date.now() + timeoutMs;
+  let last: WorkflowInstanceSnapshot | null = null;
+  for (;;) {
+    last = await getWorkflowInstanceSnapshot(request, token, instanceId);
+    if (last && predicate(last)) return last;
+    if (Date.now() >= deadline) return last;
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+
+export type UserTaskSnapshot = {
+  id?: string;
+  status?: string;
+  assignedTo?: string | null;
+  assignedToRoles?: string[] | null;
+  claimedBy?: string | null;
+  completedBy?: string | null;
+  completedAt?: string | null;
+  workflowInstanceId?: string;
+};
+
+export async function listWorkflowInstanceTasks(
+  request: APIRequestContext,
+  token: string,
+  instanceId: string,
+): Promise<UserTaskSnapshot[]> {
+  const response = await apiRequest(
+    request,
+    'GET',
+    `/api/workflows/tasks?workflowInstanceId=${encodeURIComponent(instanceId)}`,
+    { token },
+  );
+  if (response.status() !== 200) return [];
+  const body = await readJsonSafe<{ data?: UserTaskSnapshot[] }>(response);
+  return body?.data ?? [];
+}
+
+/**
+ * Polls the task list scoped to `instanceId` until a task in one of `statuses` appears
+ * (default PENDING/IN_PROGRESS), accommodating the same background-execution delay.
+ */
+export async function findInstanceUserTask(
+  request: APIRequestContext,
+  token: string,
+  instanceId: string,
+  options: { timeoutMs?: number; intervalMs?: number; statuses?: string[] } = {},
+): Promise<UserTaskSnapshot | null> {
+  const timeoutMs = options.timeoutMs ?? 8_000;
+  const intervalMs = options.intervalMs ?? 250;
+  const statuses = options.statuses ?? ['PENDING', 'IN_PROGRESS'];
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const tasks = await listWorkflowInstanceTasks(request, token, instanceId);
+    const match = tasks.find((task) => typeof task.status === 'string' && statuses.includes(task.status));
+    if (match?.id) return match;
+    if (Date.now() >= deadline) return null;
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}

package/src/modules/api_keys/backend/api-keys/page.tsx

@@ -3,10 +3,12 @@ import * as React from 'react'
 import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import type { ColumnDef } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -25,6 +27,7 @@ type Row = {
   lastUsedAt: string | null
   expiresAt: string | null
   roles: RoleSummary[]
+  updatedAt?: string | null
 }
 
 type ResponsePayload = {
@@ -104,10 +107,13 @@ export default function ApiKeysListPage() {
     })
     if (!confirmed) return
     try {
-      const call = await apiCall<{ error?: string }>(
-        `/api/api_keys/keys?id=${encodeURIComponent(row.id)}`,
-        { method: 'DELETE' },
-        { fallback: null },
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => apiCall<{ error?: string }>(
+          `/api/api_keys/keys?id=${encodeURIComponent(row.id)}`,
+          { method: 'DELETE' },
+          { fallback: null },
+        ),
       )
       if (!call.ok) {
         const errorPayload = call.result as { error?: string } | undefined
@@ -184,6 +190,13 @@ export default function ApiKeysListPage() {
               { id: 'delete', label: t('common.delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
             ]} />
           )}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('api_keys.list.title')}
+              createHref="/backend/api-keys/create"
+              createLabel={t('api_keys.list.actions.create')}
+            />
+          )}
           pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />

package/src/modules/api_keys/data/validators.ts

@@ -6,7 +6,9 @@ const expiresAtSchema = z.preprocess((value) => {
   if (value === undefined || value === null || value === '') return null
   const date = value instanceof Date ? value : new Date(String(value))
   return Number.isNaN(date.getTime()) ? undefined : date
-}, z.date().nullable())
+}, z.date().nullable().refine((date) => date === null || date.getTime() > Date.now(), {
+  message: 'expiresAt must be in the future',
+}))
 
 export const createApiKeySchema = z.object({
   name: z.string().min(1).max(120),

package/src/modules/attachments/components/AttachmentPartitionSettings.tsx

@@ -22,7 +22,8 @@ import {
   DialogHeader,
   DialogTitle,
 } from '@open-mercato/ui/primitives/dialog'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -41,6 +42,7 @@ type Partition = {
   configJson: Record<string, unknown> | null
   envKey: string
   createdAt: string | null
+  updatedAt?: string | null
 }
 
 type DialogState =
@@ -230,11 +232,15 @@ export function AttachmentPartitionSettings({ s3Enabled }: AttachmentPartitionSe
         dialog.mode === 'edit'
           ? JSON.stringify({ id: dialog.entry.id, ...payload })
           : JSON.stringify(payload)
-      const call = await apiCall('/api/attachments/partitions', {
-        method,
-        headers: { 'content-type': 'application/json' },
-        body,
-      })
+      const lockHeader =
+        dialog.mode === 'edit' ? buildOptimisticLockHeader(dialog.entry.updatedAt) : {}
+      const call = await withScopedApiRequestHeaders(lockHeader, () =>
+        apiCall('/api/attachments/partitions', {
+          method,
+          headers: { 'content-type': 'application/json' },
+          body,
+        }),
+      )
       if (!call.ok) {
         await raiseCrudError(
           call.response,
@@ -271,9 +277,13 @@ export function AttachmentPartitionSettings({ s3Enabled }: AttachmentPartitionSe
       })
       if (!confirmed) return
       try {
-        const call = await apiCall(`/api/attachments/partitions?id=${encodeURIComponent(entry.id)}`, {
-          method: 'DELETE',
-        })
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(entry.updatedAt),
+          () =>
+            apiCall(`/api/attachments/partitions?id=${encodeURIComponent(entry.id)}`, {
+              method: 'DELETE',
+            }),
+        )
         if (!call.ok) {
           await raiseCrudError(
             call.response,

package/src/modules/attachments/lib/ocrQueue.ts

@@ -88,8 +88,16 @@ export async function requestOcrProcessing(
     tenantId: attachment.tenantId ?? null,
   }
 
+  if (typeof (em as { fork?: unknown })?.fork !== 'function') {
+    throw new Error(
+      '[internal] attachments OCR background processing requires an EntityManager that exposes fork(); ' +
+        'reusing the request-scoped EntityManager in the async worker would race with later request mutations.',
+    )
+  }
+
+  const workerEm = em.fork()
+
   setImmediate(() => {
-    const workerEm = typeof (em as any)?.fork === 'function' ? (em as any).fork() : em
     processAttachmentOcr(workerEm, payload, driver).catch((error) => {
       console.error(`[attachments.ocr] Background processing error:`, error)
     })

package/src/modules/attachments/lib/security.ts

@@ -78,7 +78,7 @@ export function hasDangerousExecutableExtension(fileName: string | null | undefi
   const parts = trimmed.split('.').filter(Boolean)
   if (parts.length < 2) return false
   for (let i = 1; i < parts.length; i += 1) {
-    const segment = parts[i]!.toLowerCase()
+    const segment = parts[i]!.toLowerCase().replace(/[^a-z0-9]/g, '')
     if (DANGEROUS_EXECUTABLE_EXTENSIONS.has(segment)) return true
   }
   return false

package/src/modules/audit_logs/api/audit-logs/actions/redo/route.ts

@@ -78,9 +78,10 @@ export async function POST(req: Request) {
   }
 
   const lookupActorId = canRedoTenant ? (log.actorUserId ?? auth.sub) : auth.sub
+  const latestUndoneOrganizationId = log.organizationId ?? null
   const latestUndone = await logs.latestUndoneForActor(lookupActorId, {
     tenantId: auth.tenantId ?? null,
-    organizationId: scopedOrgId,
+    organizationId: latestUndoneOrganizationId,
   })
   if (!latestUndone || latestUndone.id !== log.id) {
     return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })
@@ -119,6 +120,7 @@ export async function POST(req: Request) {
       input: commandInput,
       ctx,
       metadata,
+      redoLogEntry: log,
     })
     await logs.markRedone(log.id)
     const actionLog = asActionLog(logEntry)

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -65,11 +65,22 @@ export async function POST(req: Request) {
   if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
-  if (target.tenantId && auth.tenantId && target.tenantId !== auth.tenantId) {
+  // Fail closed on tenant scope: `audit_logs.undo_tenant` only widens scope WITHIN a
+  // tenant, never across tenants, so a tenant-scoped target always requires a caller
+  // bound to that same tenant. A caller whose tenantId is null (tenant-less global
+  // account or unscoped API key) must never undo a tenant-scoped row (issue #2685).
+  if (target.tenantId && target.tenantId !== (auth.tenantId ?? null)) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
   const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null
-  if (target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId) {
+  // Tenant-level undoers may undo across organizations within the tenant, so an
+  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.
+  // Every other caller must resolve to the target's own organization — a null caller
+  // org must not bypass an org-scoped target (issue #2685).
+  const orgScopeMismatch = canUndoTenant
+    ? Boolean(target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId)
+    : Boolean(target.organizationId && target.organizationId !== scopedOrgId)
+  if (orgScopeMismatch) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
 

package/src/modules/audit_logs/data/entities.ts

@@ -1,7 +1,7 @@
 import { Entity, Index, PrimaryKey, Property } from '@mikro-orm/decorators/legacy'
 import type { ActionLogProjectionType, ActionLogSourceKey } from '@open-mercato/core/modules/audit_logs/lib/projections'
 
-export type ActionLogExecutionState = 'done' | 'undone' | 'failed' | 'redone'
+export type ActionLogExecutionState = 'done' | 'undoing' | 'undone' | 'failed' | 'redone'
 
 @Entity({ tableName: 'action_logs' })
 @Index({ name: 'action_logs_tenant_idx', properties: ['tenantId', 'createdAt'] })

package/src/modules/audit_logs/services/actionLogService.ts

@@ -508,6 +508,24 @@ export class ActionLogService {
     return entry
   }
 
+  async claimForUndo(id: string): Promise<boolean> {
+    const affected = await this.em.nativeUpdate(
+      ActionLog,
+      { id, executionState: 'done', deletedAt: null },
+      { executionState: 'undoing' },
+    )
+    return affected === 1
+  }
+
+  async releaseUndoClaim(id: string): Promise<boolean> {
+    const affected = await this.em.nativeUpdate(
+      ActionLog,
+      { id, executionState: 'undoing', deletedAt: null },
+      { executionState: 'done' },
+    )
+    return affected === 1
+  }
+
   async markUndone(id: string, traceInput?: ActionLogCreateInput) {
     const fork = this.em.fork()
     const log = await fork.findOne(ActionLog, { id, deletedAt: null })

package/src/modules/auth/api/logout.ts

@@ -45,12 +45,7 @@ export async function POST(req: Request) {
   return res
 }
 
-export async function GET(req: Request) {
-  return POST(req)
-}
-
 export const metadata = {
-  GET: { requireAuth: true },
   POST: { requireAuth: true },
 }
 
@@ -65,12 +60,5 @@ export const openApi: OpenApiRouteDoc = {
         { status: 302, description: 'Redirect to login after successful logout', mediaType: 'text/html' },
       ],
     },
-    GET: {
-      summary: 'Log out (legacy GET)',
-      description: 'For convenience, the GET variant performs the same logout logic as POST and issues a redirect.',
-      responses: [
-        { status: 302, description: 'Redirect to login after successful logout', mediaType: 'text/html' },
-      ],
-    },
   },
 }

package/src/modules/auth/api/roles/acl/route.ts

@@ -5,11 +5,12 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import {
   assertActorCanGrantAcl,
   assertActorCanModifySuperAdminRoleTarget,
@@ -39,6 +40,7 @@ const roleAclResponseSchema = z.object({
   isSuperAdmin: z.boolean(),
   features: z.array(z.string()),
   organizations: z.array(z.string()).nullable(),
+  updatedAt: z.string().nullable(),
 })
 
 const roleAclUpdateResponseSchema = z.object({
@@ -101,8 +103,9 @@ export async function GET(req: Request) {
         isSuperAdmin: !!acl.isSuperAdmin,
         features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],
         organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,
+        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,
       }
-    : { isSuperAdmin: false, features: [], organizations: null }
+    : { isSuperAdmin: false, features: [], organizations: null, updatedAt: null }
 
   await logCrudAccess({
     container,
@@ -173,7 +176,24 @@ export async function PUT(req: Request) {
   }
 
   let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
-  if (!acl) {
+  // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same
+  // role's features in parallel cannot silently clobber each other (#2055). The
+  // check is strictly additive — when the client sends no expected-version header
+  // it is a no-op. Skipped when the ACL row does not exist yet (first grant has
+  // no prior version to conflict with).
+  if (acl) {
+    try {
+      enforceCommandOptimisticLock({
+        resourceKind: 'auth.role_acl',
+        resourceId: acl.id,
+        current: acl.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  } else {
     acl = em.create(RoleAcl, {
       role,
       tenantId: targetTenantId,
@@ -209,15 +229,21 @@ export async function PUT(req: Request) {
     throw err
   }
 
+  // Persist the ACL mutation inside a transaction so the role-permission write
+  // commits atomically (proper ACL-edit transaction handling).
   const aclToPersist = acl
-  await withAtomicFlush(em, [
-    () => {
-      aclToPersist.organizationsJson = requestedOrganizations
-      aclToPersist.isSuperAdmin = requestedIsSuperAdmin
-      aclToPersist.featuresJson = requestedFeatures
-      em.persist(aclToPersist)
-    },
-  ], { transaction: true })
+  await withAtomicFlush(
+    em,
+    [
+      () => {
+        aclToPersist.organizationsJson = requestedOrganizations
+        aclToPersist.isSuperAdmin = requestedIsSuperAdmin
+        aclToPersist.featuresJson = requestedFeatures
+        em.persist(aclToPersist)
+      },
+    ],
+    { transaction: true },
+  )
 
   // Invalidate cache for all users in this tenant since role ACL changed
   if (targetTenantId) {