@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/customer_accounts/api/admin/users.ts

@@ -9,8 +9,9 @@ import { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { adminCreateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
-import { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { findAndCountWithDecryption, findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isOwnedCompanyEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { E } from '#generated/entities.ids.generated'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
@@ -82,7 +83,7 @@ export async function GET(req: Request) {
 
     // Also support exact email lookup via emailHash
     if (EMAIL_LIKE_PATTERN.test(search)) {
-      searchFilter.push({ emailHash: hashForLookup(search) })
+      searchFilter.push({ emailHash: { $in: lookupHashCandidates(search) } })
     }
 
     if (searchFilter.length > 0) {
@@ -106,6 +107,26 @@ export async function GET(req: Request) {
 
   let userIds: string[] | null = null
   if (roleId) {
+    // Validate the roleId against the scoped CustomerRole set before touching the
+    // junction table. CustomerUserRole carries no tenant/org column of its own,
+    // so an unscoped lookup here is a role-UUID existence oracle and is brittle
+    // against future code that reads the link rows directly (#2693, defence-in-depth).
+    const scopedRole = await findOneWithDecryption(
+      em,
+      CustomerRole,
+      { id: roleId, tenantId: auth.tenantId, organizationId: auth.orgId, deletedAt: null } as any,
+      undefined,
+      { tenantId: auth.tenantId, organizationId: auth.orgId },
+    )
+    if (!scopedRole) {
+      return NextResponse.json({
+        ok: true,
+        items: [],
+        total: 0,
+        totalPages: 1,
+        page,
+      })
+    }
     const roleLinks = await findWithDecryption(
       em,
       CustomerUserRole,
@@ -171,6 +192,7 @@ export async function GET(req: Request) {
     customerEntityId: user.customerEntityId || null,
     personEntityId: user.personEntityId || null,
     createdAt: user.createdAt,
+    updatedAt: user.updatedAt || null,
     roles: rolesByUserId.get(user.id) ?? [],
   }))
 
@@ -218,6 +240,47 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'A user with this email already exists' }, { status: 409 })
   }
 
+  // Resolve roles up front, scoped to the caller's tenant AND organization, and
+  // reject the request if any requested role is missing from the scoped set.
+  // CustomerRole is org-scoped, so omitting organizationId here would let an
+  // admin in org A link roles from org B in the same tenant — a cross-org
+  // privilege grant (#2693). Invalid IDs must be rejected, not silently dropped.
+  let resolvedRoles: Array<{ id: string }> = []
+  if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
+    const requestedRoleIds = parsed.data.roleIds
+    const validRoles = await findWithDecryption(
+      em,
+      CustomerRole,
+      {
+        id: { $in: requestedRoleIds } as any,
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+        deletedAt: null,
+      } as any,
+      undefined,
+      { tenantId: auth.tenantId, organizationId: auth.orgId },
+    )
+    if (validRoles.length !== requestedRoleIds.length) {
+      const foundIds = new Set(validRoles.map((role) => role.id))
+      const missingId = requestedRoleIds.find((roleId) => !foundIds.has(roleId))
+      return NextResponse.json({ ok: false, error: `Role ${missingId} not found` }, { status: 400 })
+    }
+    resolvedRoles = validRoles
+  }
+
+  // Reject a customerEntityId the caller does not own. Without this check a
+  // mislinked company FK persists indefinitely and cross-links the user into
+  // another org/company's portal context (#2693).
+  if (parsed.data.customerEntityId) {
+    const owned = await isOwnedCompanyEntity(em, parsed.data.customerEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Company not found' }, { status: 400 })
+    }
+  }
+
   const user = await customerUserService.createUser(
     parsed.data.email,
     parsed.data.password,
@@ -237,26 +300,13 @@ export async function POST(req: Request) {
       await tx.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })
     }
 
-    if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
-      const validRoles = await findWithDecryption(
-        tx,
-        CustomerRole,
-        {
-          id: { $in: parsed.data.roleIds } as any,
-          tenantId: auth.tenantId,
-          deletedAt: null,
-        } as any,
-        undefined,
-        { tenantId: auth.tenantId, organizationId: auth.orgId },
-      )
-      for (const role of validRoles) {
-        const userRole = tx.create(CustomerUserRole, {
-          user,
-          role,
-          createdAt: new Date(),
-        } as any)
-        tx.persist(userRole)
-      }
+    for (const role of resolvedRoles) {
+      const userRole = tx.create(CustomerUserRole, {
+        user,
+        role,
+        createdAt: new Date(),
+      } as any)
+      tx.persist(userRole)
     }
   })
 
@@ -286,6 +336,7 @@ const userSchema = z.object({
   customerEntityId: z.string().uuid().nullable(),
   personEntityId: z.string().uuid().nullable(),
   createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime().nullable(),
   roles: z.array(roleSchema),
 })
 

package/src/modules/customer_accounts/api/login.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { compare as bcryptCompare } from 'bcryptjs'
 import { z } from 'zod'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import { loginSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
@@ -22,6 +23,11 @@ import {
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
+// Precomputed bcrypt cost-10 hash of an unknowable random 32-byte input; used to equalize
+// response latency between the real-account and unknown/inactive/locked/no-hash login branches
+// so account existence cannot be inferred from a timing side channel. Mirrors signup.ts.
+const TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'
+
 export async function POST(req: Request) {
   let body: unknown
   try {
@@ -38,7 +44,9 @@ export async function POST(req: Request) {
   const { email, password } = parsed.data
   let tenantId: string
   try {
-    const context = await resolveTenantContext(req, parsed.data.tenantId)
+    const context = await resolveTenantContext(req, parsed.data.tenantId, {
+      organizationId: parsed.data.organizationId ?? null,
+    })
     tenantId = context.tenantId
   } catch (err) {
     if (err instanceof TenantResolutionError) {
@@ -61,18 +69,28 @@ export async function POST(req: Request) {
   const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService
 
   const user = await customerUserService.findByEmail(email, tenantId)
+
+  // Equalize response timing and error responses across every failed-login branch so an
+  // attacker cannot enumerate which emails have an account in this tenant. Unknown,
+  // password-less, inactive, locked, wrong-password, and unverified accounts all run a
+  // bcrypt comparison and return the same generic 401 — lockout/deactivation guidance is
+  // conveyed out-of-band (e.g. email), never in the synchronous response.
   if (!user || !user.passwordHash) {
+    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
     void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (!user.isActive) {
-    return NextResponse.json({ ok: false, error: 'Account is deactivated' }, { status: 401 })
+    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'inactive', tenantId }).catch(() => undefined)
+    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (customerUserService.checkLockout(user)) {
+    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
     void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)
-    return NextResponse.json({ ok: false, error: 'Account is temporarily locked. Please try again later.' }, { status: 423 })
+    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   const passwordValid = await customerUserService.verifyPassword(user, password)
@@ -171,7 +189,6 @@ const methodDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Validation failed', schema: errorSchema },
     { status: 401, description: 'Invalid credentials', schema: errorSchema },
-    { status: 423, description: 'Account locked', schema: errorSchema },
     { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },
   ],
 }

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -8,6 +8,13 @@ import { CustomerRbacService } from '@open-mercato/core/modules/customer_account
 import { CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import {
+  checkAuthRateLimit,
+  customerInviteRateLimitConfig,
+  customerInviteIpRateLimitConfig,
+} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
+import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -17,6 +24,15 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })
   }
 
+  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)
+  const { error: rateLimitError } = await checkAuthRateLimit({
+    req,
+    ipConfig: customerInviteIpRateLimitConfig,
+    compoundConfig: customerInviteRateLimitConfig,
+    compoundIdentifier: rateLimitEmail,
+  })
+  if (rateLimitError) return rateLimitError
+
   const container = await createRequestContainer()
   const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService
 
@@ -109,6 +125,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 400, description: 'Validation failed', schema: errorSchema },
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },
+    { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
   ],
 }
 

package/src/modules/customer_accounts/api/signup.ts

@@ -72,7 +72,9 @@ export async function POST(req: Request) {
   let tenantId: string
   let organizationId: string | null
   try {
-    const context = await resolveTenantContext(req, parsed.data.tenantId)
+    const context = await resolveTenantContext(req, parsed.data.tenantId, {
+      organizationId: parsed.data.organizationId ?? null,
+    })
     tenantId = context.tenantId
     organizationId = context.organizationId ?? parsed.data.organizationId ?? null
   } catch (err) {

package/src/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.tsx

@@ -8,7 +8,9 @@ import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
 import type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
@@ -22,6 +24,8 @@ type RoleDetail = {
   isSystem: boolean
   customerAssignable: boolean
   features: string[]
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 const PORTAL_FEATURES = [
@@ -241,25 +245,30 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
       isDefault: data.isDefault,
       customerAssignable: data.customerAssignable,
       features: data.features,
+      updatedAt: data.updatedAt ?? data.updated_at ?? null,
     }
   }, [data])
 
   const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {
     if (!id) return
-    const roleCall = await apiCall(
-      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
-      {
-        method: 'PUT',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          name: (values.name as string)?.trim(),
-          description: (values.description as string)?.trim() || null,
-          isDefault: values.isDefault,
-          customerAssignable: values.customerAssignable,
-        }),
-      },
-    )
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)
+    const roleCall = await withScopedApiRequestHeaders(headers, () => (
+      apiCall(
+        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
+        {
+          method: 'PUT',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            name: (values.name as string)?.trim(),
+            description: (values.description as string)?.trim() || null,
+            isDefault: values.isDefault,
+            customerAssignable: values.customerAssignable,
+          }),
+        },
+      )
+    ))
     if (!roleCall.ok) {
+      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return
       flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')
       return
     }
@@ -278,21 +287,25 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
     }
     flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')
     router.push('/backend/customer_accounts/roles')
-  }, [id, router, t])
+  }, [data?.updatedAt, data?.updated_at, id, router, t])
 
   const handleDelete = React.useCallback(async () => {
     if (!id) return
-    const call = await apiCall(
-      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
-      { method: 'DELETE' },
-    )
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)
+    const call = await withScopedApiRequestHeaders(headers, () => (
+      apiCall(
+        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
+        { method: 'DELETE' },
+      )
+    ))
     if (!call.ok) {
+      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
       flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')
       return
     }
     flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')
     router.push('/backend/customer_accounts/roles')
-  }, [id, router, t])
+  }, [data?.updatedAt, data?.updated_at, id, router, t])
 
   if (isLoading) {
     return (
@@ -349,6 +362,7 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
           fields={fields}
           groups={groups}
           initialValues={initialValues}
+          optimisticLockUpdatedAt={data.updatedAt ?? data.updated_at ?? null}
           entityId="customer_accounts:customer_role"
           onSubmit={handleSubmit}
           onDelete={!data.isSystem ? handleDelete : undefined}

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -7,11 +7,14 @@ import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
 import type { ColumnDef } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Badge } from '@open-mercato/ui/primitives/badge'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type RoleRow = {
   id: string
@@ -22,6 +25,7 @@ type RoleRow = {
   isDefault: boolean
   customerAssignable: boolean
   createdAt: string
+  updatedAt?: string | null
 }
 
 type RolesResponse = {
@@ -91,9 +95,12 @@ export default function CustomerRolesPage() {
     })
     if (!confirmed) return
     try {
-      const call = await apiCall(
-        `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
-        { method: 'DELETE' },
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(role.updatedAt),
+        () => apiCall(
+          `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
+          { method: 'DELETE' },
+        ),
       )
       if (!call.ok) {
         flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')
@@ -159,9 +166,9 @@ export default function CustomerRolesPage() {
       header: t('customer_accounts.admin.roles.columns.customerAssignable', 'Self-assignable'),
       cell: ({ row }) => (
         row.original.customerAssignable ? (
-          <span className="inline-flex items-center rounded-full bg-purple-100 px-2 py-0.5 text-xs font-medium text-purple-800 dark:bg-purple-900 dark:text-purple-200">
+          <Badge variant="brand">
             {t('customer_accounts.admin.roles.assignable', 'Yes')}
-          </span>
+          </Badge>
         ) : (
           <span className="text-muted-foreground text-sm">
             {t('customer_accounts.admin.roles.notAssignable', 'No')}
@@ -189,6 +196,13 @@ export default function CustomerRolesPage() {
           onSearchChange={(value) => { setSearch(value); setPage(1) }}
           searchPlaceholder={t('customer_accounts.admin.roles.searchPlaceholder', 'Search roles...')}
           perspective={{ tableId: 'customer_accounts.admin.roles' }}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('customer_accounts.admin.roles.title', 'Customer Roles')}
+              createHref="/backend/customer_accounts/roles/create"
+              createLabel={t('customer_accounts.admin.roles.actions.create', 'Create Role')}
+            />
+          )}
           onRowClick={(row) => router.push(`/backend/customer_accounts/roles/${row.id}`)}
           rowActions={(row) => (
             <RowActions

package/src/modules/customer_accounts/backend/customer_accounts/settings/domain/page.tsx

@@ -8,7 +8,8 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { EmptyState } from '@open-mercato/ui/backend/EmptyState'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -211,6 +212,7 @@ export default function CustomerDomainSettingsPage() {
           if (registerMode === 'change' && replaceTargetId) {
             body.replacesDomainId = replaceTargetId
           }
+          // optimistic-lock-exempt: registers a new domain mapping (create), not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string; domainMapping?: DomainMappingRow }>(
             '/api/customer_accounts/admin/domain-mappings',
             {
@@ -240,6 +242,7 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
+          // optimistic-lock-exempt: DNS verify action endpoint, not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string }>(
             `/api/customer_accounts/admin/domain-mappings/${encodeURIComponent(mapping.id)}/verify`,
             { method: 'POST' },
@@ -263,6 +266,7 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
+          // optimistic-lock-exempt: TLS health-check action endpoint, not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string }>(
             `/api/customer_accounts/admin/domain-mappings/${encodeURIComponent(mapping.id)}/health-check`,
             { method: 'POST' },
@@ -299,9 +303,12 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
-          const call = await apiCall<{ ok: boolean; error?: string }>(
-            `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
-            { method: 'DELETE' },
+          const call = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(mapping.updatedAt),
+            () => apiCall<{ ok: boolean; error?: string }>(
+              `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
+              { method: 'DELETE' },
+            ),
           )
           if (!call.ok || !call.result?.ok) {
             const message = call.result?.error || t('customer_accounts.domainMapping.error.load', 'Could not load custom-domain configuration')

package/src/modules/customer_accounts/backend/customer_accounts/users/[id]/page.tsx

@@ -11,7 +11,9 @@ import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { SwitchField } from '@open-mercato/ui/primitives/switch-field'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -332,21 +334,25 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     setIsSaving(true)
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall<{ ok: boolean; error?: string }>(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
-          {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-              displayName: editDisplayName.trim() || undefined,
-              isActive: editActive,
-              roleIds: selectedRoleIds,
-              personEntityId: editPersonEntityId,
-              customerEntityId: editCustomerEntityId,
-            }),
-          },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(data.updatedAt),
+          () => apiCall<{ ok: boolean; error?: string; updatedAt?: string | null }>(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({
+                displayName: editDisplayName.trim() || undefined,
+                isActive: editActive,
+                roleIds: selectedRoleIds,
+                personEntityId: editPersonEntityId,
+                customerEntityId: editCustomerEntityId,
+              }),
+            },
+          ),
         )
         if (!call.ok) {
+          if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
           flash(call.result?.error || t('customer_accounts.admin.detail.error.save', 'Failed to save user'), 'error')
           return
         }
@@ -357,6 +363,7 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
           displayName: editDisplayName.trim() || prev.displayName,
           personEntityId: editPersonEntityId,
           customerEntityId: editCustomerEntityId,
+          updatedAt: call.result?.updatedAt ?? prev.updatedAt,
         } : prev)
       }, { displayName: editDisplayName, isActive: editActive, roleIds: selectedRoleIds, personEntityId: editPersonEntityId, customerEntityId: editCustomerEntityId })
     } catch (err) {
@@ -378,11 +385,15 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
-          { method: 'DELETE' },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(data.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
+            { method: 'DELETE' },
+          ),
         )
         if (!call.ok) {
+          if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
           flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')
           return
         }

package/src/modules/customer_accounts/backend/customer_accounts/users/page.tsx

@@ -13,11 +13,13 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { EmailInput } from '@open-mercato/ui/primitives/email-input'
 import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 
 type UserRow = {
@@ -29,6 +31,7 @@ type UserRow = {
   lastLoginAt: string | null
   roles: Array<{ id: string; name: string; slug: string }>
   createdAt: string
+  updatedAt?: string | null
   personEntityId: string | null
   customerEntityId: string | null
 }
@@ -339,13 +342,16 @@ export default function CustomerAccountsPage() {
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
-          {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ isActive: nextActive }),
-          },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(user.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ isActive: nextActive }),
+            },
+          ),
         )
         if (!call.ok) {
           flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')
@@ -375,9 +381,12 @@ export default function CustomerAccountsPage() {
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
-          { method: 'DELETE' },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(user.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
+            { method: 'DELETE' },
+          ),
         )
         if (!call.ok) {
           flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')
@@ -538,6 +547,13 @@ export default function CustomerAccountsPage() {
           onFiltersApply={handleFiltersApply}
           onFiltersClear={handleFiltersClear}
           perspective={{ tableId: 'customer_accounts.admin.users' }}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('customer_accounts.admin.title', 'Users')}
+              onCreate={() => setCreateDialogOpen(true)}
+              createLabel={t('customer_accounts.admin.actions.createUser', 'Create User')}
+            />
+          )}
           onRowClick={(row) => router.push(`/backend/customer_accounts/users/${row.id}`)}
           rowActions={(row) => (
             <RowActions

package/src/modules/customer_accounts/data/validators.ts

@@ -17,6 +17,7 @@ export const loginSchema = z.object({
   email: emailField,
   password: z.string().min(1).max(128),
   tenantId: z.string().uuid().optional(),
+  organizationId: z.string().uuid().optional(),
 })
 
 export const emailVerifySchema = z.object({