@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/auth/api/roles/route.ts

@@ -14,7 +14,11 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { roleCrudEvents, roleCrudIndexer } from '@open-mercato/core/modules/auth/commands/roles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import { assertActorCanModifySuperAdminRoleTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import {
+  assertActorCanAccessRoleTarget,
+  assertActorCanModifySuperAdminRoleTarget,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { enforceTenantSelection } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const querySchema = z.object({
@@ -43,6 +47,7 @@ const roleListItemSchema = z.object({
   tenantId: z.string().uuid().nullable(),
   tenantIds: z.array(z.string().uuid()).optional(),
   tenantName: z.string().nullable(),
+  updatedAt: z.string().nullable().optional(),
 })
 
 const roleListResponseSchema = z.object({
@@ -83,7 +88,18 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     create: {
       commandId: 'auth.roles.create',
       schema: rawBodySchema,
-      mapInput: ({ parsed }) => parsed,
+      mapInput: async ({ parsed, ctx }) => {
+        // Preserve an explicit null so the create command rejects it (400 — global
+        // roles are unsupported); only resolve string/omitted tenantId against the actor.
+        if (parsed.tenantId === null) return parsed
+        const requestedTenantId = typeof parsed.tenantId === 'string' ? parsed.tenantId : undefined
+        const resolvedTenantId = await enforceTenantSelection(
+          { auth: ctx.auth, container: ctx.container },
+          requestedTenantId,
+        )
+        if (resolvedTenantId) parsed.tenantId = resolvedTenantId
+        return parsed
+      },
       response: ({ result }) => ({ id: String(result.id) }),
       status: 201,
     },
@@ -93,6 +109,7 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request && typeof parsed.id === 'string' && parsed.id.length) {
           await assertCanModifySuperAdminRole(ctx.request, parsed.id)
+          await assertCanAccessRoleTarget(ctx.request, parsed.id)
         }
         return parsed
       },
@@ -100,6 +117,14 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     },
     delete: {
       commandId: 'auth.roles.delete',
+      mapInput: async ({ parsed, raw, ctx }) => {
+        const targetId = resolveDeleteTargetId(parsed, raw)
+        if (ctx.request && targetId) {
+          await assertCanModifySuperAdminRole(ctx.request, targetId)
+          await assertCanAccessRoleTarget(ctx.request, targetId)
+        }
+        return parsed
+      },
       response: () => ({ ok: true }),
     },
   },
@@ -223,6 +248,7 @@ export async function GET(req: Request) {
       tenantId: tenantId ?? null,
       tenantIds: exposeTenant && tenantId ? [tenantId] : [],
       tenantName: exposeTenant ? tenantName : null,
+      updatedAt: r.updatedAt instanceof Date ? r.updatedAt.toISOString() : null,
       ...(cfByRole[idStr] || {}),
     }
   })
@@ -249,6 +275,7 @@ export const DELETE = async (req: Request) => {
   if (targetId) {
     try {
       await assertCanModifySuperAdminRole(req, targetId)
+      await assertCanAccessRoleTarget(req, targetId)
     } catch (err) {
       if (err instanceof CrudHttpError) {
         return NextResponse.json(err.body, { status: err.status })
@@ -274,6 +301,33 @@ async function assertCanModifySuperAdminRole(req: Request, targetRoleId: string)
   })
 }
 
+async function assertCanAccessRoleTarget(req: Request, targetRoleId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanAccessRoleTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetRoleId,
+  })
+}
+
+function resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {
+  const fromParsed = readId(parsed as Record<string, unknown> | null | undefined)
+  if (fromParsed) return fromParsed
+  const rawRecord = raw as { body?: Record<string, unknown>; query?: Record<string, unknown> } | null | undefined
+  return readId(rawRecord?.query) ?? readId(rawRecord?.body)
+}
+
+function readId(record: Record<string, unknown> | null | undefined): string | null {
+  const value = record?.id
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
 export const openApi: OpenApiRouteDoc = {
   tag: 'Authentication & Accounts',
   summary: 'Role management',

package/src/modules/auth/api/sidebar/preferences/route.ts

@@ -9,13 +9,17 @@ import {
   sidebarPreferencesScopeSchema,
 } from '../../../data/validators'
 import {
+  loadRoleSidebarPreferenceUpdatedAt,
   loadRoleSidebarPreferences,
   loadSidebarPreference,
+  loadSidebarPreferenceUpdatedAt,
   saveRoleSidebarPreference,
   saveSidebarPreference,
 } from '../../../services/sidebarPreferencesService'
 import { SIDEBAR_PREFERENCES_VERSION } from '@open-mercato/shared/modules/navigation/sidebarPreferences'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { Role, RoleSidebarPreference } from '../../../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { z } from 'zod'
@@ -47,6 +51,7 @@ const sidebarPreferencesResponseSchema = z.object({
   canApplyToRoles: z.boolean(),
   roles: z.array(sidebarRoleEntrySchema),
   scope: sidebarPreferencesScopeSchema,
+  updatedAt: z.string().datetime().nullable(),
 })
 
 const sidebarPreferencesUpdateResponseSchema = sidebarPreferencesResponseSchema.extend({
@@ -116,16 +121,23 @@ async function findRoleInScope(
   em: EntityManager,
   options: { roleId: string; tenantId: string | null },
 ): Promise<Role | null> {
+  // Scope the DB query so MikroORM only fetches in-scope rows: a role belongs to either
+  // the auth tenant or the global (null tenant) pool. Mirrors loadRolesPayload()'s scoping
+  // so cross-tenant role rows are never loaded or decrypted into memory in the first place.
+  const roleScope: FilterQuery<Role> = options.tenantId
+    ? { id: options.roleId, $or: [{ tenantId: options.tenantId }, { tenantId: null }] }
+    : { id: options.roleId, tenantId: null }
   const role = await findOneWithDecryption(
     em,
     Role,
-    { id: options.roleId },
+    roleScope,
     undefined,
     { tenantId: options.tenantId, organizationId: null },
   )
   if (!role) return null
-  // Cross-tenant guard: a role belongs to either the auth tenant or the global (null tenant) pool.
-  // Reject the lookup otherwise so a multi-tenant deployment can't leak across tenants.
+  // Cross-tenant guard (defense-in-depth): a role belongs to either the auth tenant or the
+  // global (null tenant) pool. Reject the lookup otherwise so a multi-tenant deployment can't
+  // leak across tenants even if the query above is later changed.
   if (role.tenantId && options.tenantId && role.tenantId !== options.tenantId) return null
   if (role.tenantId && !options.tenantId) return null
   return role
@@ -165,6 +177,11 @@ export async function GET(req: Request) {
     })
     const pref = rolePrefs.get(role.id) ?? null
     const rolesPayload = await loadRolesPayload(em, { tenantId: auth.tenantId ?? null, locale })
+    const roleVersion = await loadRoleSidebarPreferenceUpdatedAt(em, {
+      roleId: role.id,
+      tenantId: auth.tenantId ?? null,
+      locale,
+    })
     return NextResponse.json({
       locale,
       settings: pref
@@ -180,6 +197,7 @@ export async function GET(req: Request) {
       canApplyToRoles,
       roles: rolesPayload,
       scope: { type: 'role', roleId: role.id },
+      updatedAt: roleVersion?.updatedAt ? roleVersion.updatedAt.toISOString() : null,
     })
   }
 
@@ -198,6 +216,15 @@ export async function GET(req: Request) {
     ? await loadRolesPayload(em, { tenantId: auth.tenantId ?? null, locale })
     : []
 
+  const userVersion = effectiveUserId
+    ? await loadSidebarPreferenceUpdatedAt(em, {
+        userId: effectiveUserId,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        locale,
+      })
+    : null
+
   return NextResponse.json({
     locale,
     settings: {
@@ -211,6 +238,7 @@ export async function GET(req: Request) {
     canApplyToRoles,
     roles: rolesPayload,
     scope: { type: 'user' },
+    updatedAt: userVersion?.updatedAt ? userVersion.updatedAt.toISOString() : null,
   })
 }
 
@@ -318,11 +346,34 @@ export async function PUT(req: Request) {
     if (!role) {
       return NextResponse.json({ error: 'Role not found' }, { status: 404 })
     }
+    const existingRolePref = await loadRoleSidebarPreferenceUpdatedAt(em, {
+      roleId: role.id,
+      tenantId: auth.tenantId ?? null,
+      locale,
+    })
+    if (existingRolePref) {
+      try {
+        enforceCommandOptimisticLock({
+          resourceKind: 'auth.role_sidebar_preference',
+          resourceId: existingRolePref.id,
+          current: existingRolePref.updatedAt ?? null,
+          request: req,
+        })
+      } catch (err) {
+        if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+        throw err
+      }
+    }
     const saved = await saveRoleSidebarPreference(em, {
       roleId: role.id,
       tenantId: auth.tenantId ?? null,
       locale,
     }, payload)
+    const savedRoleVersion = await loadRoleSidebarPreferenceUpdatedAt(em, {
+      roleId: role.id,
+      tenantId: auth.tenantId ?? null,
+      locale,
+    })
     if (cache?.deleteByTags) {
       try {
         await cache.deleteByTags([`nav:sidebar:role:${role.id}`])
@@ -342,6 +393,7 @@ export async function PUT(req: Request) {
       canApplyToRoles,
       roles: rolesPayload,
       scope: { type: 'role', roleId: role.id },
+      updatedAt: savedRoleVersion?.updatedAt ? savedRoleVersion.updatedAt.toISOString() : null,
       appliedRoles: [],
       clearedRoles: [],
     })
@@ -356,6 +408,26 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Forbidden', requiredFeatures: [FEATURE_MANAGE] }, { status: 403 })
   }
 
+  const existingUserPref = await loadSidebarPreferenceUpdatedAt(em, {
+    userId: effectiveUserId,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    locale,
+  })
+  if (existingUserPref) {
+    try {
+      enforceCommandOptimisticLock({
+        resourceKind: 'auth.sidebar_preference',
+        resourceId: existingUserPref.id,
+        current: existingUserPref.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const settings = await saveSidebarPreference(em, {
     userId: effectiveUserId,
     tenantId: auth.tenantId ?? null,
@@ -444,12 +516,20 @@ export async function PUT(req: Request) {
     }))
   }
 
+  const savedUserVersion = await loadSidebarPreferenceUpdatedAt(em, {
+    userId: effectiveUserId,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    locale,
+  })
+
   return NextResponse.json({
     locale,
     settings,
     canApplyToRoles,
     roles: rolesPayload,
     scope: { type: 'user' },
+    updatedAt: savedUserVersion?.updatedAt ? savedUserVersion.updatedAt.toISOString() : null,
     appliedRoles: updatedRoleIds,
     clearedRoles: filteredClearRoleIds,
   })

package/src/modules/auth/api/users/acl/route.ts

@@ -5,9 +5,15 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
-import { assertActorCanModifySuperAdminUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import {
+  assertActorCanAccessUserTarget,
+  assertActorCanGrantAcl,
+  assertActorCanModifySuperAdminUserTarget,
+  normalizeGrantFeatureList,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 
@@ -29,6 +35,7 @@ const userAclResponseSchema = z.object({
   isSuperAdmin: z.boolean(),
   features: z.array(z.string()),
   organizations: z.array(z.string()).nullable(),
+  updatedAt: z.string().nullable(),
 })
 
 const userAclUpdateResponseSchema = z.object({
@@ -61,6 +68,15 @@ export async function GET(req: Request) {
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
       })
+      await assertActorCanAccessUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
       throw err
@@ -73,8 +89,9 @@ export async function GET(req: Request) {
         isSuperAdmin: !!acl.isSuperAdmin,
         features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],
         organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,
+        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,
       }
-    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null }
+    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }
 
   await logCrudAccess({
     container,
@@ -118,24 +135,66 @@ export async function PUT(req: Request) {
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
       })
+      await assertActorCanAccessUserTarget({
+        em: em as EntityManager,
+        rbacService: rbacService as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.userId,
+        actorIsSuperAdmin: false,
+      })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
       throw err
     }
   }
 
-  const requestedFeatures = normalizeFeatureList(parsed.data.features)
-  const organizations = Array.isArray(parsed.data.organizations) ? parsed.data.organizations : null
+  const requestedFeatures = normalizeGrantFeatureList(parsed.data.features)
+  const organizations = normalizeOrganizations(parsed.data.organizations)
 
   let acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits
+  // cannot silently clobber each other (#2055). Strictly additive — a no-op when
+  // the client sends no expected-version header; skipped when no ACL row exists.
+  if (acl) {
+    try {
+      enforceCommandOptimisticLock({
+        resourceKind: 'auth.user_acl',
+        resourceId: acl.id,
+        current: acl.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
   const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false
-  const existingFeatures = acl && Array.isArray(acl.featuresJson) ? normalizeFeatureList(acl.featuresJson) : []
+  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []
+
+  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false
+
+  try {
+    await assertActorCanGrantAcl({
+      em: em as EntityManager,
+      rbacService: rbacService as RbacService,
+      actorUserId: auth.sub,
+      tenantId: auth.tenantId ?? null,
+      organizationId: auth.orgId ?? null,
+      isSuperAdmin: requestedIsSuperAdmin,
+      features: requestedFeatures,
+      organizations,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    throw err
+  }
 
   const effectiveFeatures = actorIsSuperAdmin
     ? requestedFeatures
     : sanitizeTenantFeatures(requestedFeatures)
 
-  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false
   let effectiveIsSuperAdmin = requestedIsSuperAdmin
 
   if (!actorIsSuperAdmin) {
@@ -151,22 +210,31 @@ export async function PUT(req: Request) {
 
   const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
 
-  await withAtomicFlush(em, [
-    () => {
-      if (!hasCustomAcl) {
-        if (acl) em.remove(acl)
-      } else {
-        if (!acl) {
-          acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
-        }
-        const aclRecord = acl as any
-        aclRecord.isSuperAdmin = effectiveIsSuperAdmin
-        aclRecord.featuresJson = effectiveFeatures
-        aclRecord.organizationsJson = organizations
-        em.persist(acl)
-      }
-    },
-  ], { transaction: true })
+  // Persist the ACL mutation inside a transaction so the per-user permission
+  // write (or removal) commits atomically (proper ACL-edit transaction handling).
+  if (!hasCustomAcl) {
+    if (acl) {
+      const aclToRemove = acl
+      await withAtomicFlush(em, [() => em.remove(aclToRemove)], { transaction: true })
+    }
+  } else {
+    if (!acl) {
+      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+    }
+    const aclRecord = acl as any
+    await withAtomicFlush(
+      em,
+      [
+        () => {
+          aclRecord.isSuperAdmin = effectiveIsSuperAdmin
+          aclRecord.featuresJson = effectiveFeatures
+          aclRecord.organizationsJson = organizations
+          em.persist(aclRecord)
+        },
+      ],
+      { transaction: true },
+    )
+  }
 
   // Invalidate cache for this user
   await rbacService.invalidateUserCache(parsed.data.userId)
@@ -181,16 +249,9 @@ export async function PUT(req: Request) {
   })
 }
 
-function normalizeFeatureList(features: unknown): string[] {
-  if (!Array.isArray(features)) return []
-  const dedup = new Set<string>()
-  for (const value of features) {
-    if (typeof value !== 'string') continue
-    const trimmed = value.trim()
-    if (!trimmed) continue
-    dedup.add(trimmed)
-  }
-  return Array.from(dedup)
+function normalizeOrganizations(organizations: unknown): string[] | null {
+  if (!Array.isArray(organizations)) return null
+  return normalizeGrantFeatureList(organizations)
 }
 
 function sanitizeTenantFeatures(features: string[]): string[] {

package/src/modules/auth/api/users/consents/route.ts

@@ -5,6 +5,9 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { UserConsent } from '@open-mercato/core/modules/auth/data/entities'
 import { verifyConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'
+import { assertActorCanAccessUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { ConsentItem } from '@open-mercato/core/modules/auth/lib/consentTypes'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -37,6 +40,23 @@ export async function GET(req: Request) {
   const em = container.resolve('em') as EntityManager
   const tenantId = auth.tenantId ?? null
   const organizationId = auth.orgId ?? null
+
+  if (auth.sub) {
+    try {
+      await assertActorCanAccessUserTarget({
+        em,
+        rbacService: container.resolve('rbacService') as RbacService,
+        actorUserId: auth.sub,
+        tenantId,
+        organizationId,
+        targetUserId: parsed.data.userId,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const consents = await findWithDecryption(
     em,
     UserConsent,

package/src/modules/auth/api/users/resend-invite/route.ts

@@ -15,6 +15,9 @@ import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@op
 import { INVITE_TOKEN_TTL_MS } from '@open-mercato/core/modules/auth/lib/inviteToken'
 import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
+import { assertActorCanAccessUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { EntityManager } from '@mikro-orm/postgresql'
 
 const resendInviteRateLimitConfig = readEndpointRateLimitConfig('RESEND_INVITE', {
@@ -80,6 +83,23 @@ export async function POST(req: Request) {
     console.error('[auth.users.resend-invite] Failed to resolve rbac:', err)
   }
 
+  if (auth.sub) {
+    try {
+      await assertActorCanAccessUserTarget({
+        em,
+        rbacService: container.resolve('rbacService') as RbacService,
+        actorUserId: auth.sub,
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        targetUserId: parsed.data.id,
+        actorIsSuperAdmin: isSuperAdmin,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+  }
+
   const where: Record<string, unknown> = { id: parsed.data.id, deletedAt: null }
   if (!isSuperAdmin) {
     if (!auth.tenantId) return NextResponse.json({ error: 'User not found' }, { status: 404 })

package/src/modules/auth/api/users/route.ts

@@ -14,6 +14,7 @@ import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fiel
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'
 import {
+  assertActorCanAccessUserTarget,
   assertActorCanGrantRoleTokens,
   assertActorCanModifySuperAdminUserTarget,
   listSuperAdminUserIds,
@@ -80,6 +81,8 @@ const userListItemSchema = z.object({
   tenantName: z.string().nullable(),
   roles: z.array(z.string()),
   roleIds: z.array(z.string().uuid()).optional(),
+  hasPassword: z.boolean().optional(),
+  updatedAt: z.string().nullable().optional(),
 })
 
 const userListResponseSchema = z.object({
@@ -139,6 +142,7 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
         if (ctx.request) {
           if (typeof parsed.id === 'string' && parsed.id.length) {
             await assertCanModifySuperAdminTarget(ctx.request, parsed.id)
+            await assertCanAccessUserTarget(ctx.request, parsed.id)
           }
           await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
         }
@@ -148,6 +152,14 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     },
     delete: {
       commandId: 'auth.users.delete',
+      mapInput: async ({ parsed, raw, ctx }) => {
+        const targetId = resolveDeleteTargetId(parsed, raw)
+        if (ctx.request && targetId) {
+          await assertCanModifySuperAdminTarget(ctx.request, targetId)
+          await assertCanAccessUserTarget(ctx.request, targetId)
+        }
+        return parsed
+      },
       response: () => ({ ok: true }),
     },
   },
@@ -428,7 +440,8 @@ export async function GET(req: Request) {
       tenantName: u.tenantId ? tenantMap[String(u.tenantId)] ?? String(u.tenantId) : null,
       roles: roleMap[uid] || [],
       roleIds: roleIdMap[uid] || [],
-      hasPassword: !!u.passwordHash,
+      ...(id ? { hasPassword: !!u.passwordHash } : {}),
+      updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : null,
       ...(cfByUser[uid] || {}),
     }
   })
@@ -461,6 +474,7 @@ export const DELETE = async (req: Request) => {
   if (targetId) {
     try {
       await assertCanModifySuperAdminTarget(req, targetId)
+      await assertCanAccessUserTarget(req, targetId)
     } catch (err) {
       if (err instanceof CrudHttpError) {
         return NextResponse.json(err.body, { status: err.status })
@@ -520,6 +534,33 @@ async function assertCanModifySuperAdminTarget(req: Request, targetUserId: strin
   })
 }
 
+async function assertCanAccessUserTarget(req: Request, targetUserId: string) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  await assertActorCanAccessUserTarget({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    targetUserId,
+  })
+}
+
+function resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {
+  const fromParsed = readId((parsed as Record<string, unknown> | null | undefined))
+  if (fromParsed) return fromParsed
+  const rawRecord = raw as { body?: Record<string, unknown>; query?: Record<string, unknown> } | null | undefined
+  return readId(rawRecord?.query) ?? readId(rawRecord?.body)
+}
+
+function readId(record: Record<string, unknown> | null | undefined): string | null {
+  const value = record?.id
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
 async function assertCanAssignRoles(req: Request, roles: unknown, payload: Record<string, unknown>) {
   if (!Array.isArray(roles)) return
   const auth = await getAuthFromRequest(req)