@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/directory/commands/tenants.ts

@@ -16,6 +16,7 @@ import {
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
+import { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'
 
 export const tenantCrudEvents: CrudEventsConfig = {
   module: 'directory',
@@ -96,15 +97,27 @@ const createTenantCommand: CommandHandler<TenantPayload, Tenant> = {
     return tenant
   },
   captureAfter: (_input, result) => serializeTenant(result),
-  buildLog: async ({ result, ctx }) => {
+  buildLog: async ({ snapshots, result, ctx }) => {
     const { translate } = await resolveTranslations()
+    const after = (snapshots.after as SerializedTenant | undefined) ?? serializeTenant(result)
     return {
       actionLabel: translate('directory.audit.tenants.create', 'Create tenant'),
       resourceKind: 'directory.tenant',
       resourceId: String(result.id),
       tenantId: ctx.auth?.tenantId ?? null,
+      snapshotAfter: after,
+      payload: { undo: { after } },
     }
   },
+  redo: makeCreateRedo<Tenant, SerializedTenant, TenantPayload, Tenant>({
+    entityClass: Tenant,
+    buildResult: (entity) => entity,
+    events: tenantCrudEvents,
+    indexer: tenantCrudIndexer,
+    afterRestore: ({ entity }) => {
+      Reflect.set(entity, 'tenantId', String(entity.id))
+    },
+  }),
 }
 
 const updateTenantCommand: CommandHandler<TenantPayload, Tenant> = {

package/src/modules/entities/api/records.ts

@@ -10,6 +10,75 @@ import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared
 import { setRecordCustomFields } from '../lib/helpers'
 import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getModules } from '@open-mercato/shared/lib/i18n/server'
+import { assertEntityAclForRequest } from '../lib/entityAcl'
+
+let declaredCustomEntityIds: Set<string> | null = null
+function isDeclaredCustomEntity(entityId: string): boolean {
+  if (declaredCustomEntityIds === null) {
+    try {
+      const mods = getModules() as Array<{ customEntities?: Array<{ id?: string }> }>
+      if (Array.isArray(mods) && mods.length) {
+        const ids = new Set<string>()
+        for (const mod of mods) {
+          for (const spec of mod?.customEntities ?? []) {
+            if (spec?.id) ids.add(spec.id)
+          }
+        }
+        declaredCustomEntityIds = ids
+      }
+    } catch {}
+  }
+  return declaredCustomEntityIds?.has(entityId) ?? false
+}
+
+const CUSTOM_ENTITY_RECORD_RESOURCE_KIND = 'entities.record'
+
+async function detectCustomEntity(em: any, entityId: string): Promise<boolean> {
+  if (isDeclaredCustomEntity(entityId)) return true
+  try {
+    const { CustomEntity } = await import('../data/entities')
+    const found = await em.findOne(CustomEntity as any, { entityId, isActive: true })
+    if (found) return true
+  } catch {}
+  try {
+    const db = em.getKysely()
+    const row = await db
+      .selectFrom('custom_entities_storage' as any)
+      .select(['entity_id' as any])
+      .where('entity_type' as any, '=', entityId)
+      .limit(1)
+      .executeTakeFirst()
+    return !!row
+  } catch {}
+  return false
+}
+
+async function readCustomEntityRecordUpdatedAt(
+  em: any,
+  input: { entityType: string; entityId: string; organizationId: string | null },
+): Promise<string | null> {
+  try {
+    const db = em.getKysely()
+    let query = db
+      .selectFrom('custom_entities_storage' as any)
+      .select(['updated_at' as any])
+      .where('entity_type' as any, '=', input.entityType)
+      .where('entity_id' as any, '=', input.entityId)
+    query = input.organizationId === null
+      ? query.where('organization_id' as any, 'is', null as any)
+      : query.where('organization_id' as any, '=', input.organizationId)
+    const row = await query.executeTakeFirst()
+    const value = (row as any)?.updated_at
+    if (value instanceof Date) return value.toISOString()
+    if (typeof value === 'string' && value.length > 0) return value
+    return null
+  } catch {
+    return null
+  }
+}
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
@@ -79,12 +148,14 @@ export async function GET(req: Request) {
     const rbac = resolve('rbacService') as RbacService
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
     let organizationIds: string[] | null = scope.filterIds
-    let isCustomEntity = false
-    try {
-      const { CustomEntity } = await import('../data/entities')
-      const found = await em.findOne(CustomEntity as any, { entityId, isActive: true })
-      isCustomEntity = !!found
-    } catch {}
+    // Read/write symmetry: this endpoint writes every record to custom_entities_storage
+    // via the data engine, including module-declared custom entities whose id is a
+    // frozen system id and therefore never registered in `custom_entities`. detectCustomEntity
+    // covers the declared-entity registry plus the custom_entities / doc-storage fallbacks
+    // (mirrors HybridQueryEngine.isCustomEntity) so mapRow strips the cf_ prefix and the edit
+    // form can read back saved values.
+    const isCustomEntity = await detectCustomEntity(em, entityId)
+    await assertEntityAclForRequest({ auth, entityId, action: 'view', isCustomEntity, rbac })
     if (organizationIds && organizationIds.length === 0) {
       return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })
     }
@@ -164,6 +235,41 @@ export async function GET(req: Request) {
     const rawItems = res.items || []
     const viewPageItems = rawItems.map(mapRow)
     const fullPageItems = rawItems.map(mapFullRow)
+
+    // Expose `updated_at` on custom-entity records. The query engine returns only
+    // the `doc` fields + `id`, dropping the base `updated_at` column — which made
+    // optimistic locking impossible end-to-end (no version for the edit page to
+    // round-trip as the lock header). Batch-read it from storage and merge it in.
+    if (isCustomEntity && viewPageItems.length) {
+      try {
+        const recordIds = viewPageItems
+          .map((it: any) => it?.id)
+          .filter((v: any): v is string => typeof v === 'string' && v.length > 0)
+        if (recordIds.length) {
+          const db = em.getKysely()
+          const rows = await db
+            .selectFrom('custom_entities_storage' as any)
+            .select(['entity_id' as any, 'updated_at' as any])
+            .where('entity_type' as any, '=', entityId)
+            .where('entity_id' as any, 'in', recordIds as any)
+            .execute()
+          const updatedById = new Map<string, string>()
+          for (const row of rows as any[]) {
+            const value = row?.updated_at
+            const iso = value instanceof Date ? value.toISOString() : (typeof value === 'string' && value.length > 0 ? value : null)
+            if (iso && row?.entity_id) updatedById.set(String(row.entity_id), iso)
+          }
+          for (const item of viewPageItems as any[]) {
+            const iso = updatedById.get(String(item?.id))
+            if (iso) {
+              item.updated_at = iso
+              item.updatedAt = iso
+            }
+          }
+        }
+      } catch { /* best-effort: locking simply will not engage if storage is unavailable */ }
+    }
+
     const total = typeof res.total === 'number' ? res.total : rawItems.length
     const effectivePageSize = res.pageSize || pageSize
     const payload = {
@@ -210,6 +316,7 @@ export async function GET(req: Request) {
 
     return NextResponse.json(payload)
   } catch (e) {
+    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })
     try { console.error('[entities.records.GET] Error', e) } catch {}
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
@@ -256,6 +363,8 @@ export async function POST(req: Request) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
     const targetOrgId = scope.selectedId ?? auth.orgId
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
+    const isCustomEntity = await detectCustomEntity(em, entityId)
+    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, rbac })
     const norm = normalizeValues(values)
 
     // Validate against custom field definitions
@@ -284,6 +393,7 @@ export async function POST(req: Request) {
 
     return NextResponse.json({ ok: true, item: { entityId, recordId: id } })
   } catch (e) {
+    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })
     try { console.error('[entities.records.POST] Error', e) } catch {}
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
@@ -317,6 +427,8 @@ export async function PUT(req: Request) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
     const targetOrgId = scope.selectedId ?? auth.orgId
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
+    const isCustomEntity = await detectCustomEntity(em, entityId)
+    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, rbac })
     const norm = normalizeValues(values)
 
     // Validate against custom field definitions
@@ -343,6 +455,25 @@ export async function PUT(req: Request) {
       return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })
     }
 
+    try {
+      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {
+        entityType: entityId,
+        entityId: rid,
+        organizationId: targetOrgId,
+      })
+      enforceCommandOptimisticLock({
+        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,
+        resourceId: rid,
+        current: currentUpdatedAt,
+        request: req,
+      })
+    } catch (lockError) {
+      if (isCrudHttpError(lockError)) {
+        return NextResponse.json(lockError.body, { status: lockError.status })
+      }
+      throw lockError
+    }
+
     await de.updateCustomEntityRecord({
       entityId,
       recordId: rid,
@@ -352,6 +483,7 @@ export async function PUT(req: Request) {
     })
     return NextResponse.json({ ok: true, item: { entityId, recordId: rid } })
   } catch (e) {
+    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 }
@@ -384,9 +516,12 @@ export async function DELETE(req: Request) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
     const targetOrgId = scope.selectedId ?? auth.orgId
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
+    const isCustomEntity = await detectCustomEntity(em, entityId)
+    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, rbac })
     await de.deleteCustomEntityRecord({ entityId, recordId, organizationId: targetOrgId, tenantId: auth.tenantId!, soft: true })
     return NextResponse.json({ ok: true })
   } catch (e) {
+    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
 }

package/src/modules/entities/backend/entities/user/[entityId]/records/[recordId]/page.tsx

@@ -79,6 +79,13 @@ export default function EditRecordPage({ params }: { params: { entityId?: string
       entityId={entityId}
       customEntity
       initialValues={initialValues || {}}
+      optimisticLockUpdatedAt={
+        typeof initialValues?.updatedAt === 'string'
+          ? initialValues.updatedAt
+          : typeof initialValues?.updated_at === 'string'
+            ? initialValues.updated_at
+            : null
+      }
       isLoading={loading}
       loadingMessage={t('entities.userEntities.records.loading', 'Loading record...')}
       submitLabel={t('entities.userEntities.records.form.submitSave', 'Save')}

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -11,7 +11,8 @@ import { ContextHelp } from '@open-mercato/ui/backend/ContextHelp'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import Link from 'next/link'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -349,9 +350,12 @@ export RECORD_ID="<record uuid>"`}</code></pre>
                       variant: 'destructive',
                     })
                     if (!confirmed) return
-                    const deleteCall = await apiCall(
-                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(String((row as any).id))}`,
-                      { method: 'DELETE' },
+                    const deleteCall = await withScopedApiRequestHeaders(
+                      buildOptimisticLockHeader((row as any).updatedAt),
+                      () => apiCall(
+                        `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(String((row as any).id))}`,
+                        { method: 'DELETE' },
+                      ),
                     )
                     if (!deleteCall.ok) {
                       await raiseCrudError(deleteCall.response, 'Failed to delete record')

package/src/modules/entities/components/UserEntitiesTable.tsx

@@ -5,6 +5,7 @@ import Link from 'next/link'
 import { useQuery } from '@tanstack/react-query'
 import type { ColumnDef, SortingState } from '@tanstack/react-table'
 import { DataTable, RowActions, Button } from '@open-mercato/ui'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -107,6 +108,13 @@ export default function UserEntitiesTable() {
       sorting={sorting}
       onSortingChange={setSorting}
       perspective={{ tableId: 'entities.user.list' }}
+      emptyState={(
+        <ListEmptyState
+          entityName={t('entities.user.table.title', 'User Entities')}
+          createHref="/backend/entities/user/create"
+          createLabel={t('common.create', 'Create')}
+        />
+      )}
       rowActions={(row) => (
         <RowActions
           items={[

package/src/modules/entities/lib/entityAcl.ts

@@ -0,0 +1,108 @@
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { hasAllFeatures } from '@open-mercato/shared/security/features'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+
+export type EntityAclRequirement = {
+  view: string[]
+  manage: string[]
+  platformOnly?: boolean
+}
+
+const ENTITY_ACL_REQUIREMENTS: Record<string, EntityAclRequirement> = {
+  'directory:tenant': {
+    view: ['directory.tenants.view'],
+    manage: ['directory.tenants.manage'],
+    platformOnly: true,
+  },
+  'directory:organization': {
+    view: ['directory.organizations.view'],
+    manage: ['directory.organizations.manage'],
+  },
+  'customers:customer_person_profile': {
+    view: ['customers.people.view'],
+    manage: ['customers.people.manage'],
+  },
+  'customers:customer_company_profile': {
+    view: ['customers.companies.view'],
+    manage: ['customers.companies.manage'],
+  },
+  'customers:customer_deal': {
+    view: ['customers.deals.view'],
+    manage: ['customers.deals.manage'],
+  },
+  'customers:customer_activity': {
+    view: ['customers.activities.view'],
+    manage: ['customers.activities.manage'],
+  },
+  'customers:customer_interaction': {
+    view: ['customers.interactions.view'],
+    manage: ['customers.interactions.manage'],
+  },
+  'catalog:catalog_product': {
+    view: ['catalog.products.view'],
+    manage: ['catalog.products.manage'],
+  },
+  'catalog:catalog_product_category': {
+    view: ['catalog.categories.view'],
+    manage: ['catalog.categories.manage'],
+  },
+  'sales:sales_order': {
+    view: ['sales.orders.view'],
+    manage: ['sales.orders.manage'],
+  },
+  'sales:sales_quote': {
+    view: ['sales.quotes.view'],
+    manage: ['sales.quotes.manage'],
+  },
+  'auth:user': {
+    view: ['auth.users.list'],
+    manage: ['auth.users.edit'],
+  },
+  'auth:role': {
+    view: ['auth.roles.list'],
+    manage: ['auth.roles.manage'],
+  },
+}
+
+export function resolveEntityAclRequirement(entityId: string): EntityAclRequirement | null {
+  return ENTITY_ACL_REQUIREMENTS[entityId] ?? null
+}
+
+type EntityAclActor = {
+  sub?: string | null
+  tenantId?: string | null
+  orgId?: string | null
+  isSuperAdmin?: boolean
+}
+
+type AssertEntityAclArgs = {
+  auth: EntityAclActor
+  entityId: string
+  action: 'view' | 'manage'
+  isCustomEntity: boolean
+  rbac: RbacService
+}
+
+function forbiddenEntityAccess(): CrudHttpError {
+  return new CrudHttpError(403, { error: 'Forbidden' })
+}
+
+export async function assertEntityAclForRequest(args: AssertEntityAclArgs): Promise<void> {
+  if (args.isCustomEntity) return
+
+  const requirement = resolveEntityAclRequirement(args.entityId)
+
+  const acl = await args.rbac.loadAcl(args.auth.sub ?? '', {
+    tenantId: args.auth.tenantId ?? null,
+    organizationId: args.auth.orgId ?? null,
+  })
+
+  if (acl?.isSuperAdmin) return
+
+  if (!requirement) throw forbiddenEntityAccess()
+  if (requirement.platformOnly) throw forbiddenEntityAccess()
+
+  if (!hasAllFeatures(acl?.features, requirement[args.action])) {
+    throw forbiddenEntityAccess()
+  }
+}

package/src/modules/entities/lib/helpers.ts

@@ -118,6 +118,30 @@ export async function setRecordCustomFields(
     throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)
   }
 
+  // Run the per-key delete+insert work inside ONE database transaction so a
+  // multi-value replacement is atomic and isolated. The array branch deletes the
+  // existing rows for a key and inserts the replacements; without an enclosing
+  // transaction those can land in separate commit boundaries under MikroORM's
+  // FlushMode.AUTO (a query elsewhere in the unit auto-flushes part of the work),
+  // which intermittently left the field with the delete applied but the inserts
+  // missing — the multi-select EDIT reverted to []. The single commit below makes
+  // it all-or-nothing. We only open our own transaction when the caller has not
+  // already started one (commands fork the request em and may run setCustomFields
+  // outside their own withAtomicFlush tx); join an ambient transaction otherwise.
+  const txEm = em as {
+    begin?: () => Promise<void>
+    commit?: () => Promise<void>
+    rollback?: () => Promise<void>
+    isInTransaction?: () => boolean
+  }
+  const txCapable =
+    typeof txEm.begin === 'function' &&
+    typeof txEm.commit === 'function' &&
+    typeof txEm.rollback === 'function' &&
+    typeof txEm.isInTransaction === 'function'
+  const ownCustomFieldTransaction = txCapable && !txEm.isInTransaction!()
+  if (ownCustomFieldTransaction) await txEm.begin!()
+  try {
   for (const fieldKey of keys) {
     const raw = values[fieldKey]
     if (raw === undefined) continue
@@ -125,12 +149,15 @@ export async function setRecordCustomFields(
     const def = defsByKey?.[fieldKey]
     const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)
     const isArray = Array.isArray(raw)
-    // When array: remove existing values for key and create multiple rows
+    // When array (multi-value): replace all existing rows for the key. Delete
+    // first, then create replacements, all inside the transaction opened above.
+    // Creating rows before a native delete can auto-flush and delete the new
+    // values; mixing em.remove(stale) with new rows for the same EAV scope was
+    // observed to commit an empty set under MikroORM v7. The explicit order keeps
+    // the replacement atomic without letting old-row cleanup target new rows.
     if (isArray) {
       const arr = raw as Primitive[]
-      // Clear existing for this key
-      const existing = await em.find(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
-      if (existing.length) existing.forEach((e) => em.remove(e))
+      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
       for (const val of arr) {
         const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)
         const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })
@@ -186,7 +213,15 @@ export async function setRecordCustomFields(
 
   if (toPersist.length) em.persist(toPersist)
   await em.flush()
-  // Emit hook for indexing if requested (outside CRUD flows)
+    if (ownCustomFieldTransaction) await txEm.commit!()
+  } catch (err) {
+    if (ownCustomFieldTransaction) {
+      try { await txEm.rollback!() } catch { /* surface the original error, not a rollback failure */ }
+    }
+    throw err
+  }
+  // Emit hook for indexing if requested (outside CRUD flows). Runs AFTER the
+  // transaction commits so consumers observe the persisted rows.
   try {
     if (typeof opts.onChanged === 'function') {
       await opts.onChanged({ entityId, recordId, organizationId, tenantId })

package/src/modules/feature_toggles/api/global/[id]/override/route.ts

@@ -8,16 +8,20 @@ import { logCrudAccess } from "@open-mercato/shared/lib/crud/factory"
 import { OpenApiRouteDoc } from "@open-mercato/shared/lib/openapi"
 import { FeatureToggleOverride, FeatureToggle } from '../../../../data/entities'
 import { FeatureToggleOverrideResponse } from '../../../../data/validators'
+import { z } from 'zod'
+
+const paramsSchema = z.object({
+  id: z.string().uuid(),
+})
 
 export async function GET(req: Request, { params }: { params: { id: string } }) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const { scope } = await resolveFeatureCheckContext({ container: await createRequestContainer(), auth, request: req })
-
-  const id = params.id
-  if (!id) return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
-
   const container = await createRequestContainer()
+  const { scope } = await resolveFeatureCheckContext({ container, auth, request: req })
+  const parsed = paramsSchema.safeParse({ id: params.id })
+  if (!parsed.success) return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
+
   const em = container.resolve('em') as EntityManager
 
 
@@ -29,22 +33,23 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   }
 
 
-  const override = await em.findOne(FeatureToggleOverride, {
-    tenantId: tenant.id,
-    toggle: { id: id },
-  })
-
-  const toggle = await em.findOne(FeatureToggle, { id: id })
+  const toggle = await em.findOne(FeatureToggle, { id: parsed.data.id, deletedAt: null })
   if (!toggle) {
     return NextResponse.json({ error: 'Feature toggle not found' }, { status: 404 })
   }
 
+  const override = await em.findOne(FeatureToggleOverride, {
+    tenantId: tenant.id,
+    toggle: { id: parsed.data.id },
+  })
+
   const responseOverride: FeatureToggleOverrideResponse = {
     id: override?.id ?? '',
     value: override ? override.value : toggle.defaultValue,
     tenantName: tenant.name,
     tenantId: tenant.id,
     toggleType: toggle.type,
+    updatedAt: override?.updatedAt instanceof Date ? override.updatedAt.toISOString() : null,
   }
 
   await logCrudAccess({
@@ -54,7 +59,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     items: [responseOverride],
     idField: 'id',
     resourceKind: 'feature_toggles.feature_toggle_override',
-    tenantId: auth.tenantId ?? null,
+    tenantId: tenant.id,
     query: {},
     accessType: 'read:item',
     fields: ['id', 'tenantId', 'value', 'toggle', 'toggleType']
@@ -88,4 +93,4 @@ export const openApi: OpenApiRouteDoc = {
       ],
     },
   },
-}
+}

package/src/modules/feature_toggles/api/global/[id]/route.ts

@@ -29,6 +29,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
 
   const toggle = await em.findOne(FeatureToggle, {
     id: parse.data.id,
+    deletedAt: null,
   })
 
   if (!toggle) {

package/src/modules/feature_toggles/api/overrides/route.ts

@@ -1,12 +1,13 @@
 import { NextResponse } from 'next/server'
-import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import { getOverrides } from '../../lib/queries'
-import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
+import { FeatureToggleOverride } from '../../data/entities'
 import { buildContext } from '../../lib/utils'
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope"
 import { ProcessedChangeOverrideStateInput } from '../../data/validators'
@@ -21,18 +22,17 @@ import {
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 
 export async function GET(req: Request) {
-  const { auth } = await buildContext(req)
+  const { auth, ctx, scope } = await buildContext(req)
 
   const url = new URL(req.url)
   const parsed = overrideListQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))
   if (!parsed.success) {
     return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })
   }
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
+  const em = ctx.container.resolve('em') as EntityManager
 
   const tenant = await em.findOne(Tenant, {
-    id: auth?.tenantId,
+    id: scope.tenantId,
   })
 
   if (!tenant) {
@@ -44,13 +44,13 @@ export async function GET(req: Request) {
   const result = await getOverrides(em, tenant, parsed.data)
 
   await logCrudAccess({
-    container,
+    container: ctx.container,
     auth,
     request: req,
     items: [...result.raw.toggles, ...result.raw.overrides],
     idField: 'id',
     resourceKind: 'feature_toggles.override_list',
-    tenantId: auth.tenantId ?? null,
+    tenantId: scope.tenantId ?? null,
     query: parsed.data,
     accessType: 'read:list',
     fields: ['id', 'toggleId', 'tenantId', 'identifier', 'name', 'category']
@@ -87,6 +87,23 @@ export async function PUT(req: Request) {
       }, { status: 400 })
     }
 
+    // Optimistic lock: refuse a stale override overwrite when two admins edit the
+    // same global toggle override in parallel. Only enforced when an override row
+    // already exists (first set has no prior version). Strictly additive.
+    const em = ctx.container.resolve('em') as EntityManager
+    const existingOverride = await em.findOne(FeatureToggleOverride, {
+      tenantId: scope.tenantId,
+      toggle: { id: parsed.data.toggleId },
+    })
+    if (existingOverride) {
+      enforceCommandOptimisticLock({
+        resourceKind: 'feature_toggles.feature_toggle_override',
+        resourceId: existingOverride.id,
+        current: existingOverride.updatedAt ?? null,
+        request: req,
+      })
+    }
+
     const commandBus = ctx.container.resolve('commandBus') as CommandBus
     const { result, logEntry } = await commandBus.execute<ProcessedChangeOverrideStateInput, { overrideToggleId: string | null }>('feature_toggles.overrides.changeState', {
       input: {
@@ -181,4 +198,4 @@ export const openApi: OpenApiRouteDoc = {
     GET: overrideGetDoc,
     PUT: overridePutDoc,
   },
-}
+}