@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/auth/backend/roles/[id]/edit/page.tsx

@@ -2,7 +2,8 @@
 import * as React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { AclEditor, type AclData } from '@open-mercato/core/modules/auth/components/AclEditor'
@@ -16,6 +17,7 @@ import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-
 type EditRoleFormValues = {
   name?: string
   tenantId?: string | null
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 type RoleRecord = {
@@ -24,6 +26,7 @@ type RoleRecord = {
   tenantId: string | null
   tenantName?: string | null
   usersCount?: number | null
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 type RoleListResponse = {
@@ -37,6 +40,7 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
   const [initial, setInitial] = React.useState<RoleRecord | null>(null)
   const [loading, setLoading] = React.useState(true)
   const [aclData, setAclData] = React.useState<AclData>({ isSuperAdmin: false, features: [], organizations: null })
+  const [aclUpdatedAt, setAclUpdatedAt] = React.useState<string | null>(null)
   const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)
   const [selectedTenantId, setSelectedTenantId] = React.useState<string | null>(null)
   const widgetEditorRef = React.useRef<WidgetVisibilityEditorHandle | null>(null)
@@ -158,6 +162,7 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
               canEditOrganizations
               value={aclData}
               onChange={setAclData}
+              onVersionChange={setAclUpdatedAt}
               currentUserIsSuperAdmin={actorIsSuperAdmin}
               tenantId={selectedTenantId ?? null}
               preserveOnTenantChange
@@ -213,17 +218,37 @@ export default function EditRolePage({ params }: { params?: { id?: string } }) {
             if (Object.keys(customFields).length) {
               payload.customFields = customFields
             }
-            await updateCrud('auth/roles', payload)
-            await updateCrud('auth/roles/acl', { roleId: id, tenantId: effectiveTenantId, ...aclData }, {
+            const roleOptimisticLockHeader = buildOptimisticLockHeader(initial?.updatedAt)
+            if (Object.keys(roleOptimisticLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(roleOptimisticLockHeader, () => updateCrud('auth/roles', payload))
+            } else {
+              await updateCrud('auth/roles', payload)
+            }
+            // Optimistic lock the ACL save against the loaded RoleAcl version so a
+            // concurrent permission edit cannot silently overwrite (#2055). CrudForm
+            // surfaces the 409 as the unified conflict bar.
+            const aclLockHeader = buildOptimisticLockHeader(aclUpdatedAt)
+            const saveRoleAcl = () => updateCrud('auth/roles/acl', { roleId: id, tenantId: effectiveTenantId, ...aclData }, {
               errorMessage: t('auth.roles.form.errors.aclUpdate', 'Failed to update role access control'),
             })
+            if (Object.keys(aclLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(aclLockHeader, saveRoleAcl)
+            } else {
+              await saveRoleAcl()
+            }
             await widgetEditorRef.current?.save()
             try { window.dispatchEvent(new Event('om:refresh-sidebar')) } catch {}
           }}
           onDelete={async () => {
-            await deleteCrud('auth/roles', String(id), {
+            const roleOptimisticLockHeader = buildOptimisticLockHeader(initial?.updatedAt)
+            const deleteRole = () => deleteCrud('auth/roles', String(id), {
               errorMessage: t('auth.roles.form.errors.delete', 'Failed to delete role'),
             })
+            if (Object.keys(roleOptimisticLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(roleOptimisticLockHeader, deleteRole)
+            } else {
+              await deleteRole()
+            }
           }}
           deleteRedirect={`/backend/roles?flash=${encodeURIComponent(t('auth.roles.flash.deleted', 'Role deleted'))}&type=success`}
         />

package/src/modules/auth/backend/roles/page.tsx

@@ -6,12 +6,14 @@ import { DataTable } from '@open-mercato/ui/backend/DataTable'
 import type { ColumnDef, SortingState } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type Row = {
   id: string
@@ -20,6 +22,7 @@ type Row = {
   tenantId?: string | null
   tenantIds?: string[]
   tenantName?: string | null
+  updatedAt?: string | null
 }
 
 export default function RolesListPage() {
@@ -77,9 +80,12 @@ export default function RolesListPage() {
     })
     if (!confirmed) return
     try {
-      const call = await apiCall(
-        `/api/auth/roles?id=${encodeURIComponent(row.id)}`,
-        { method: 'DELETE' },
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => apiCall(
+          `/api/auth/roles?id=${encodeURIComponent(row.id)}`,
+          { method: 'DELETE' },
+        ),
       )
       if (!call.ok) {
         await raiseCrudError(call.response, t('auth.roles.list.error.delete', 'Failed to delete role'))
@@ -132,6 +138,13 @@ export default function RolesListPage() {
           sorting={sorting}
           onSortingChange={setSorting}
           perspective={{ tableId: 'auth.roles.list' }}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('auth.roles.list.title', 'Roles')}
+              createHref="/backend/roles/create"
+              createLabel={t('auth.roles.list.actions.create', 'Create')}
+            />
+          )}
           pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />

package/src/modules/auth/backend/users/[id]/edit/page.tsx

@@ -3,7 +3,8 @@ import * as React from 'react'
 import { E } from '#generated/entities.ids.generated'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { CrudForm, type CrudField, type CrudFormGroup, type CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { AclEditor, type AclData } from '@open-mercato/core/modules/auth/components/AclEditor'
@@ -27,6 +28,7 @@ type EditUserFormValues = {
   tenantId: string | null
   organizationId: string | null
   roles: string[]
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 type LoadedUser = {
@@ -40,6 +42,7 @@ type LoadedUser = {
   roles: string[]
   roleIds: string[]
   hasPassword: boolean
+  updatedAt: string | null
 }
 
 type UserApiItem = {
@@ -53,6 +56,8 @@ type UserApiItem = {
   roles?: unknown
   roleIds?: unknown
   hasPassword?: boolean
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 type UserListResponse = {
@@ -60,6 +65,10 @@ type UserListResponse = {
   isSuperAdmin?: boolean
 }
 
+type RoleLookupResponse = {
+  items?: Array<{ id?: string | null; name?: string | null }>
+}
+
 type FeatureCheckResponse = {
   ok?: boolean
 }
@@ -123,9 +132,11 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
   const [isNotFound, setIsNotFound] = React.useState(false)
   const [canEditOrgs, setCanEditOrgs] = React.useState(false)
   const [aclData, setAclData] = React.useState<AclData>({ isSuperAdmin: false, features: [], organizations: null })
+  const [aclUpdatedAt, setAclUpdatedAt] = React.useState<string | null>(null)
   const [customFieldValues, setCustomFieldValues] = React.useState<Record<string, unknown>>({})
   const [actorIsSuperAdmin, setActorIsSuperAdmin] = React.useState(false)
   const [actorResolved, setActorResolved] = React.useState(false)
+  const [initialRoleOptions, setInitialRoleOptions] = React.useState<CrudFieldOption[]>([])
   const widgetEditorRef = React.useRef<WidgetVisibilityEditorHandle | null>(null)
   const [resendingInvite, setResendingInvite] = React.useState(false)
 
@@ -163,6 +174,48 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
       : undefined
   ), [passwordRequirements, t])
 
+  React.useEffect(() => {
+    if (!initialUser) {
+      setInitialRoleOptions([])
+      return
+    }
+    const roleIds = initialUser.roleIds
+      .map((roleId) => (typeof roleId === 'string' ? roleId.trim() : ''))
+      .filter((roleId) => roleId.length > 0)
+    const seedOptions = roleIds.map((roleId, index) => {
+      const label = typeof initialUser.roles[index] === 'string' && initialUser.roles[index].trim().length
+        ? initialUser.roles[index]
+        : roleId
+      return { value: roleId, label }
+    })
+    setInitialRoleOptions(seedOptions)
+    if (!roleIds.length) return
+    let cancelled = false
+    Promise.all(roleIds.map(async (roleId) => {
+      const response = await apiCall<RoleLookupResponse>(
+        `/api/auth/roles?id=${encodeURIComponent(roleId)}&page=1&pageSize=1`,
+        undefined,
+        { fallback: { items: [] } },
+      )
+      if (!response.ok || !Array.isArray(response.result?.items)) return null
+      const item = response.result.items.find((entry) => entry?.id === roleId) ?? response.result.items[0]
+      const name = typeof item?.name === 'string' && item.name.trim().length ? item.name.trim() : null
+      return name ? { value: roleId, label: name } : null
+    }))
+      .then((fetched) => {
+        if (cancelled) return
+        const byId = new Map(seedOptions.map((option) => [option.value, option]))
+        fetched.forEach((option) => {
+          if (option) byId.set(option.value, option)
+        })
+        setInitialRoleOptions(roleIds.map((roleId) => byId.get(roleId) ?? { value: roleId, label: roleId }))
+      })
+      .catch(() => {})
+    return () => {
+      cancelled = true
+    }
+  }, [initialUser])
+
   React.useEffect(() => {
     if (!id) {
       setLoading(false)
@@ -209,6 +262,11 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
               roles: roleNames,
               roleIds: roleIds.length > 0 ? roleIds : roleNames,
               hasPassword: item.hasPassword !== false,
+              updatedAt: typeof item.updatedAt === 'string'
+                ? item.updatedAt
+                : typeof item.updated_at === 'string'
+                  ? item.updated_at
+                  : null,
             })
             setSelectedTenantId(item.tenantId ? String(item.tenantId) : null)
             const custom = extractCustomFieldEntries(item as Record<string, unknown>)
@@ -328,9 +386,15 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
         )
       },
     })
-    items.push({ id: 'roles', label: t('auth.users.form.field.roles', 'Roles'), type: 'tags', loadOptions: loadRoleOptions })
+    items.push({
+      id: 'roles',
+      label: t('auth.users.form.field.roles', 'Roles'),
+      type: 'tags',
+      options: initialRoleOptions,
+      loadOptions: loadRoleOptions,
+    })
     return items
-  }, [actorIsSuperAdmin, loadRoleOptions, passwordDescription, preloadedTenants, selectedOrgId, selectedTenantId, t, userHasPassword])
+  }, [actorIsSuperAdmin, initialRoleOptions, loadRoleOptions, passwordDescription, preloadedTenants, selectedOrgId, selectedTenantId, t, userHasPassword])
 
   const detailFieldIds = React.useMemo(() => {
     const base: string[] = ['email', 'name', 'password', 'organizationId', 'roles']
@@ -353,6 +417,7 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
             canEditOrganizations={canEditOrgs}
             value={aclData}
             onChange={setAclData}
+            onVersionChange={setAclUpdatedAt}
             userRoles={initialUser?.roles || []}
             currentUserIsSuperAdmin={actorIsSuperAdmin}
             tenantId={selectedTenantId ?? null}
@@ -393,6 +458,7 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
         tenantId: initialUser.tenantId,
         organizationId: initialUser.organizationId,
         roles: initialUser.roleIds,
+        updatedAt: initialUser.updatedAt,
         ...customFieldValues,
       }
     }
@@ -471,17 +537,37 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
               roles: Array.isArray(values.roles) ? values.roles : [],
               ...(Object.keys(customFields).length ? { customFields } : {}),
             }
-            await updateCrud('auth/users', payload)
-            await updateCrud('auth/users/acl', { userId: id, ...aclData }, {
+            const userOptimisticLockHeader = buildOptimisticLockHeader(initialUser?.updatedAt)
+            if (Object.keys(userOptimisticLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(userOptimisticLockHeader, () => updateCrud('auth/users', payload))
+            } else {
+              await updateCrud('auth/users', payload)
+            }
+            // Optimistic lock the ACL save against the loaded UserAcl version so a
+            // concurrent permission edit cannot silently overwrite (#2055). CrudForm
+            // surfaces the 409 as the unified conflict bar.
+            const aclLockHeader = buildOptimisticLockHeader(aclUpdatedAt)
+            const saveUserAcl = () => updateCrud('auth/users/acl', { userId: id, ...aclData }, {
               errorMessage: t('auth.users.form.errors.aclUpdate', 'Failed to update user access control'),
             })
+            if (Object.keys(aclLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(aclLockHeader, saveUserAcl)
+            } else {
+              await saveUserAcl()
+            }
             await widgetEditorRef.current?.save()
             try { window.dispatchEvent(new Event('om:refresh-sidebar')) } catch {}
           }}
           onDelete={async () => {
-            await deleteCrud('auth/users', String(id), {
+            const userOptimisticLockHeader = buildOptimisticLockHeader(initialUser?.updatedAt)
+            const deleteUser = () => deleteCrud('auth/users', String(id), {
               errorMessage: t('auth.users.form.errors.delete', 'Failed to delete user'),
             })
+            if (Object.keys(userOptimisticLockHeader).length > 0) {
+              await withScopedApiRequestHeaders(userOptimisticLockHeader, deleteUser)
+            } else {
+              await deleteUser()
+            }
           }}
           deleteRedirect={`/backend/users?flash=${encodeURIComponent(t('auth.users.flash.deleted', 'User deleted'))}&type=success`}
         />

package/src/modules/auth/backend/users/page.tsx

@@ -8,7 +8,8 @@ import type { ColumnDef, SortingState } from '@tanstack/react-table'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
@@ -16,6 +17,7 @@ import { buildOrganizationTreeOptions, formatOrganizationTreeLabel, type Organiz
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type Row = {
   id: string
@@ -26,6 +28,7 @@ type Row = {
   tenantId: string | null
   tenantName?: string | null
   roles: string[]
+  updatedAt?: string | null
 }
 
 type FilterOption = { value: string; label: string }
@@ -388,7 +391,10 @@ export default function UsersListPage() {
     if (!confirmed) return
     const deleteErrorMessage = t('auth.users.list.error.delete', 'Failed to delete user')
     try {
-      const call = await apiCall(`/api/auth/users?id=${encodeURIComponent(row.id)}`, { method: 'DELETE' })
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => apiCall(`/api/auth/users?id=${encodeURIComponent(row.id)}`, { method: 'DELETE' }),
+      )
       if (!call.ok) {
         await raiseCrudError(call.response, deleteErrorMessage)
       }
@@ -423,6 +429,13 @@ export default function UsersListPage() {
           sorting={sorting}
           onSortingChange={setSorting}
           perspective={{ tableId: 'auth.users.list' }}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('auth.users.list.title', 'Users')}
+              createHref="/backend/users/create"
+              createLabel={t('common.create', 'Create')}
+            />
+          )}
           rowActions={(row) => (
             <RowActions items={[
               { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/users/${row.id}/edit` },

package/src/modules/auth/cli.ts

@@ -7,7 +7,7 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
-import { computeEmailHash } from './lib/emailHash'
+import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
@@ -20,6 +20,14 @@ import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { getCliModules } from '@open-mercato/shared/modules/registry'
 
+async function resolveTenantScopedRole(em: any, name: string, normalizedTenantId: string | null) {
+  const existing = await em.findOne(Role, { name, tenantId: normalizedTenantId })
+  if (existing) return existing
+  const role = em.create(Role, { name, tenantId: normalizedTenantId, createdAt: new Date() })
+  await em.persist(role).flush()
+  return role
+}
+
 const addUser: ModuleCli = {
   command: 'add-user',
   async run(rest) {
@@ -63,17 +71,7 @@ const addUser: ModuleCli = {
     if (rolesCsv) {
       const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
       for (const name of names) {
-        let role = await em.findOne(Role, { name, tenantId: normalizedTenantId })
-        if (!role && normalizedTenantId !== null) {
-          role = await em.findOne(Role, { name, tenantId: null })
-        }
-        if (!role) {
-          role = em.create(Role, { name, tenantId: normalizedTenantId, createdAt: new Date() })
-          await em.persist(role).flush()
-        } else if (normalizedTenantId !== null && role.tenantId !== normalizedTenantId) {
-          role.tenantId = normalizedTenantId
-          await em.persist(role).flush()
-        }
+        const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
         await em.persist(link).flush()
       }
@@ -539,11 +537,7 @@ const setupApp: ModuleCli = {
       if (env.NODE_ENV !== 'test') {
         for (const snapshot of result.users) {
           if (snapshot.created) {
-            if (snapshot.user.email === email && password) {
-              console.log('🎉 Created user', snapshot.user.email, 'password:', password)
-            } else {
-              console.log('🎉 Created user', snapshot.user.email)
-            }
+            console.log('🎉 Created user', snapshot.user.email)
           } else {
             console.log(`Updated user ${snapshot.user.email}`)
           }
@@ -698,12 +692,12 @@ const listUsers: ModuleCli = {
 
       if (user.organizationId) {
         const org = await em.findOne(Organization, { id: user.organizationId })
-        orgName = org?.name?.substring(0, 19) + '...' || user.organizationId.substring(0, 8) + '...'
+        orgName = org?.name ? `${org.name.substring(0, 19)}...` : `${user.organizationId.substring(0, 8)}...`
       }
 
       if (user.tenantId) {
         const tenant = await em.findOne(Tenant, { id: user.tenantId })
-        tenantName = tenant?.name?.substring(0, 19) + '...' || user.tenantId.substring(0, 8) + '...'
+        tenantName = tenant?.name ? `${tenant.name.substring(0, 19)}...` : `${user.tenantId.substring(0, 8)}...`
       }
 
       const id = user.id || 'N/A'
@@ -736,8 +730,13 @@ const setPassword: ModuleCli = {
 
     const { resolve } = await createRequestContainer()
     const em = resolve('em') as any
-    const emailHash = computeEmailHash(email)
-    const user = await em.findOne(User, { $or: [{ email }, { emailHash }] })
+    const user = await findOneWithDecryption(
+      em,
+      User,
+      { $or: [{ email }, { emailHash: { $in: emailHashLookupValues(email) } }] } as any,
+      undefined,
+      { tenantId: null, organizationId: null },
+    )
 
     if (!user) {
       console.error(`User with email "${email}" not found`)

package/src/modules/auth/commands/roles.ts

@@ -23,6 +23,9 @@ import {
   diffCustomFieldChanges,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
+import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 
 type SerializedRole = {
   name: string
@@ -51,6 +54,22 @@ type RoleSnapshots = {
   undo: RoleUndoSnapshot
 }
 
+function resolveActorTenantScope(ctx: CommandRuntimeContext): string | null {
+  if (ctx.systemActor === true) return null
+  const auth = ctx.auth
+  if (!auth) return null
+  if ((auth as { isSuperAdmin?: boolean }).isSuperAdmin === true) return null
+  return normalizeTenantId(auth.tenantId ?? null) ?? null
+}
+
+function assertRoleTenantInScope(actorTenantScope: string | null, targetTenantId: unknown): void {
+  if (!actorTenantScope) return
+  const targetTenant = normalizeTenantId(targetTenantId) ?? null
+  if (!targetTenant || targetTenant !== actorTenantScope) {
+    throw new CrudHttpError(404, { error: 'Role not found' })
+  }
+}
+
 const RESERVED_ROLE_NAMES = new Set(['superadmin', 'admin'])
 
 function isReservedRoleName(name: string | undefined | null): boolean {
@@ -203,6 +222,56 @@ const createRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
       soft: false,
     })
   },
+  redo: async ({ logEntry, ctx }) => {
+    const after = resolveRedoSnapshot<RoleUndoSnapshot>(logEntry)
+    if (!after) throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for role create' })
+    const em = (ctx.container.resolve('em') as EntityManager)
+    const de = (ctx.container.resolve('dataEngine') as DataEngine)
+    let role = await findOneWithDecryption(em, Role, { id: after.id }, {}, { tenantId: null, organizationId: null })
+    if (role) {
+      role.deletedAt = null
+      role.name = after.name
+      role.tenantId = after.tenantId
+      await em.flush()
+    } else {
+      role = await de.createOrmEntity({
+        entity: Role,
+        data: {
+          id: after.id,
+          name: after.name,
+          tenantId: after.tenantId,
+        },
+      })
+    }
+    await restoreRoleAcls(em, after.id, after.acls)
+    if (after.custom && Object.keys(after.custom).length) {
+      const reset = buildCustomFieldResetMap(after.custom, undefined)
+      if (Object.keys(reset).length) {
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.role,
+          recordId: after.id,
+          organizationId: null,
+          tenantId: after.tenantId ?? null,
+          values: reset,
+          notify: false,
+        })
+      }
+    }
+    await emitCrudSideEffects({
+      dataEngine: de,
+      action: 'created',
+      entity: role,
+      identifiers: {
+        id: after.id,
+        organizationId: null,
+        tenantId: after.tenantId ?? null,
+      },
+      events: roleCrudEvents,
+      indexer: roleCrudIndexer,
+    })
+    return role
+  },
 }
 
 const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
@@ -212,6 +281,7 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!existing) throw new CrudHttpError(404, { error: 'Role not found' })
+    assertRoleTenantInScope(resolveActorTenantScope(ctx), existing.tenantId)
     const acls = await loadRoleAclSnapshots(em, parsed.id)
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
@@ -225,6 +295,8 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     const em = (ctx.container.resolve('em') as EntityManager)
     const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    assertRoleTenantInScope(actorTenantScope, current.tenantId)
     if (parsed.name !== undefined) {
       const nextName = parsed.name
       if (nextName !== current.name) assertRoleNameAllowed(nextName)
@@ -243,10 +315,12 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
       }
       await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
     }
+    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }
+    if (actorTenantScope) updateWhere.tenantId = actorTenantScope
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const role = await de.updateOrmEntity({
       entity: Role,
-      where: { id: parsed.id, deletedAt: null } as FilterQuery<Role>,
+      where: updateWhere as FilterQuery<Role>,
       apply: (entity) => {
         if (parsed.name !== undefined) entity.name = parsed.name
         if (parsed.tenantId !== undefined) entity.tenantId = parsed.tenantId
@@ -374,6 +448,11 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!existing) return {}
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    if (actorTenantScope) {
+      const targetTenant = normalizeTenantId(existing.tenantId) ?? null
+      if (!targetTenant || targetTenant !== actorTenantScope) return {}
+    }
     const acls = await loadRoleAclSnapshots(em, id)
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
@@ -387,6 +466,7 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const em = (ctx.container.resolve('em') as EntityManager)
     const role = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
+    assertRoleTenantInScope(resolveActorTenantScope(ctx), role.tenantId)
     const activeAssignments = await em.count(UserRole, { role, deletedAt: null })
     if (activeAssignments > 0) throw new CrudHttpError(400, { error: 'Role has assigned users' })