@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/auth/commands/users.ts

@@ -25,9 +25,10 @@ import {
   diffCustomFieldChanges,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
-import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'
 import { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'
@@ -75,6 +76,23 @@ type UserSnapshots = {
   undo: UserUndoSnapshot
 }
 
+function resolveActorTenantScope(ctx: CommandRuntimeContext): string | null {
+  if (ctx.systemActor === true) return null
+  const auth = ctx.auth
+  if (!auth) return null
+  if ((auth as { isSuperAdmin?: boolean }).isSuperAdmin === true) return null
+  const actorTenantId = normalizeTenantId(auth.tenantId ?? null) ?? null
+  return actorTenantId
+}
+
+function assertTargetTenantInScope(actorTenantScope: string | null, targetTenantId: unknown, notFoundError: string): void {
+  if (!actorTenantScope) return
+  const targetTenant = normalizeTenantId(targetTenantId) ?? null
+  if (!targetTenant || targetTenant !== actorTenantScope) {
+    throw new CrudHttpError(404, { error: notFoundError })
+  }
+}
+
 const passwordSchema = buildPasswordSchema()
 
 const displayNameSchema = z.preprocess(
@@ -188,7 +206,7 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
     if (!organization) throw new CrudHttpError(400, { error: 'Organization not found' })
 
     const emailHash = computeEmailHash(parsed.email)
-    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash }], deletedAt: null } as any, {}, { tenantId: null, organizationId: null })
+    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }], deletedAt: null } as any, {}, { tenantId: null, organizationId: null })
     if (duplicate) await throwDuplicateEmailError()
 
     let passwordHash: string | null = null
@@ -348,6 +366,87 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
 
     await invalidateUserCache(ctx, userId)
   },
+  // The create-undo hard-deletes the user, but the after-snapshot persists the
+  // original passwordHash (see captureUserSnapshots), so redo restores the row
+  // with the SAME id and the SAME hash — never fabricating credentials (#2506).
+  redo: async ({ logEntry, ctx }) => {
+    const after = resolveRedoSnapshot<UserUndoSnapshot>(logEntry)
+    if (!after) throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for user create' })
+    const em = (ctx.container.resolve('em') as EntityManager)
+    const de = (ctx.container.resolve('dataEngine') as DataEngine)
+    const emailHash = computeEmailHash(after.email)
+
+    let user = await findOneWithDecryption(em, User, { id: after.id }, {}, { tenantId: null, organizationId: null })
+    await withAtomicFlush(em, [
+      async () => {
+        if (user) {
+          user.deletedAt = null
+          user.email = after.email
+          user.emailHash = emailHash
+          user.organizationId = after.organizationId ?? null
+          user.tenantId = after.tenantId ?? null
+          user.passwordHash = after.passwordHash ?? null
+          user.name = after.name ?? null
+          user.isConfirmed = after.isConfirmed
+          await em.flush()
+        } else {
+          user = await de.createOrmEntity({
+            entity: User,
+            data: {
+              id: after.id,
+              email: after.email,
+              emailHash,
+              organizationId: after.organizationId ?? null,
+              tenantId: after.tenantId ?? null,
+              passwordHash: after.passwordHash ?? null,
+              name: after.name ?? null,
+              isConfirmed: after.isConfirmed,
+            },
+          })
+        }
+
+        if (!user) return
+
+        await em.nativeDelete(UserRole, { user: after.id })
+        await syncUserRoles(em, user, after.roles, after.tenantId)
+        await restoreUserAcls(em, user, after.acls)
+
+        if (after.custom && Object.keys(after.custom).length) {
+          const reset = buildCustomFieldResetMap(after.custom, undefined)
+          if (Object.keys(reset).length) {
+            await setCustomFieldsIfAny({
+              dataEngine: de,
+              entityId: E.auth.user,
+              recordId: after.id,
+              organizationId: after.organizationId ?? null,
+              tenantId: after.tenantId ?? null,
+              values: reset,
+              notify: false,
+            })
+          }
+        }
+      },
+    ], { transaction: true })
+
+    if (!user) throw new CrudHttpError(400, { error: '[internal] redo failed to restore user row' })
+
+    await emitCrudSideEffects({
+      dataEngine: de,
+      action: 'created',
+      entity: user,
+      identifiers: {
+        id: after.id,
+        organizationId: after.organizationId ?? null,
+        tenantId: after.tenantId ?? null,
+      },
+      events: userCrudEvents,
+      indexer: userCrudIndexer,
+    })
+
+    await invalidateUserCache(ctx, after.id)
+
+    return { user }
+  },
 }
 
 async function sendInviteToUser(
@@ -401,6 +500,7 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!existing) throw new CrudHttpError(404, { error: 'User not found' })
+    assertTargetTenantInScope(resolveActorTenantScope(ctx), existing.tenantId, 'User not found')
     const roles = await loadUserRoleNames(em, parsed.id)
     const acls = await loadUserAclSnapshots(em, parsed.id)
     const custom = await loadUserCustomSnapshot(
@@ -419,12 +519,11 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       : null
 
     if (parsed.email !== undefined) {
-      const emailHash = computeEmailHash(parsed.email)
       const duplicate = await findOneWithDecryption(
         em,
         User,
         {
-          $or: [{ email: parsed.email }, { emailHash }],
+          $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
           deletedAt: null,
           id: { $ne: parsed.id } as any,
         } as FilterQuery<User>,
@@ -457,12 +556,16 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       tenantId = organization.tenant?.id ? String(organization.tenant.id) : null
     }
 
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }
+    if (actorTenantScope) updateWhere.tenantId = actorTenantScope
+
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     let user: User | null
     try {
       user = await de.updateOrmEntity({
         entity: User,
-        where: { id: parsed.id, deletedAt: null } as FilterQuery<User>,
+        where: updateWhere as FilterQuery<User>,
         apply: (entity) => {
           if (parsed.email !== undefined) {
             entity.email = parsed.email
@@ -642,6 +745,11 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const em = (ctx.container.resolve('em') as EntityManager)
     const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
     if (!existing) return {}
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    if (actorTenantScope) {
+      const targetTenant = normalizeTenantId(existing.tenantId) ?? null
+      if (!targetTenant || targetTenant !== actorTenantScope) return {}
+    }
     const roles = await loadUserRoleNames(em, id)
     const acls = await loadUserAclSnapshots(em, id)
     const custom = await loadUserCustomSnapshot(
@@ -656,6 +764,9 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const id = requireId(input, 'User id required')
     const em = (ctx.container.resolve('em') as EntityManager)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    const deleteWhere: Record<string, unknown> = { id, deletedAt: null }
+    if (actorTenantScope) deleteWhere.tenantId = actorTenantScope
 
     let user!: User
     await withAtomicFlush(em, [
@@ -666,7 +777,7 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
         await em.nativeDelete(PasswordReset, { user: id })
         const removed = await de.deleteOrmEntity({
           entity: User,
-          where: { id, deletedAt: null } as FilterQuery<User>,
+          where: deleteWhere as FilterQuery<User>,
           soft: false,
         })
         if (!removed) throw new CrudHttpError(404, { error: 'User not found' })

package/src/modules/auth/components/AclEditor.tsx

@@ -68,6 +68,7 @@ type AclPayload = {
   isSuperAdmin?: boolean
   features?: unknown
   organizations?: unknown
+  updatedAt?: string | null
 }
 type OrganizationListResponse = { items?: Array<{ id?: string; name?: string }> }
 
@@ -99,6 +100,7 @@ export function AclEditor({
   canEditOrganizations,
   value,
   onChange,
+  onVersionChange,
   userRoles,
   currentUserIsSuperAdmin,
   tenantId,
@@ -109,6 +111,12 @@ export function AclEditor({
   canEditOrganizations: boolean
   value?: AclData
   onChange?: (data: AclData) => void
+  /**
+   * Reports the loaded ACL row's `updatedAt` (or null when none exists) so the
+   * parent can send the optimistic-lock header on save and reject stale ACL
+   * overwrites (#2055).
+   */
+  onVersionChange?: (updatedAt: string | null) => void
   userRoles?: string[]
   currentUserIsSuperAdmin?: boolean
   tenantId?: string | null
@@ -168,8 +176,9 @@ export function AclEditor({
       setIsSuperAdmin(!!aclJson.isSuperAdmin)
       setGranted(actorSanitizeFeatures(aclJson.features))
       setOrganizations(aclJson.organizations == null ? null : Array.isArray(aclJson.organizations) ? aclJson.organizations : [])
+      onVersionChange?.(typeof aclJson.updatedAt === 'string' ? aclJson.updatedAt : null)
     } catch {}
-  }, [kind, targetId, actorSanitizeFeatures])
+  }, [kind, targetId, actorSanitizeFeatures, onVersionChange])
 
   React.useEffect(() => {
     const cancelled = { current: false }

package/src/modules/auth/data/entities.ts

@@ -33,7 +33,10 @@ export class User {
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 
-@Property({ name: 'deleted_at', type: Date, nullable: true })
+  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })
+  updatedAt?: Date | null
+
+  @Property({ name: 'deleted_at', type: Date, nullable: true })
   deletedAt?: Date | null
 }
 
@@ -52,6 +55,9 @@ export class Role {
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 
+  @Property({ name: 'updated_at', type: Date, onCreate: () => new Date(), onUpdate: () => new Date(), nullable: true })
+  updatedAt?: Date | null
+
   @Property({ name: 'deleted_at', type: Date, nullable: true })
   deletedAt?: Date | null
 }

package/src/modules/auth/frontend/reset/[token]/page.tsx

@@ -3,7 +3,7 @@ import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open
 import { Button } from '@open-mercato/ui/primitives/button'
 import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import { useRouter } from 'next/navigation'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -14,12 +14,17 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
   const t = useT()
   const [error, setError] = useState<string | null>(null)
   const [submitting, setSubmitting] = useState(false)
+  const [clientReady, setClientReady] = useState(false)
   const passwordPolicy = getPasswordPolicy()
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)
   const passwordDescription = passwordRequirements
     ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })
     : ''
 
+  useEffect(() => {
+    setClientReady(true)
+  }, [])
+
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault()
     setError(null)
@@ -65,7 +70,7 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
           <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>
         </CardHeader>
         <CardContent>
-          <form className="grid gap-3" onSubmit={onSubmit}>
+          <form className="grid gap-3" onSubmit={onSubmit} data-auth-ready={clientReady ? '1' : '0'}>
             {error && <div className="text-sm text-status-error-text">{error}</div>}
             <div className="grid gap-1">
               <Label htmlFor="password">{t('auth.reset.form.password', 'New password')}</Label>

package/src/modules/auth/lib/consentIntegrity.ts

@@ -10,12 +10,28 @@ type ConsentHashInput = {
   source: string | null | undefined
 }
 
+const DEV_ONLY_SECRET = 'om-consent-integrity-dev-only-secret'
+let missingSecretWarned = false
+
 function getSecret(): string {
   const secret = process.env.CONSENT_INTEGRITY_SECRET || process.env.NEXTAUTH_SECRET
   if (!secret) {
-    console.warn('[consentIntegrity] CONSENT_INTEGRITY_SECRET and NEXTAUTH_SECRET are not set — integrity hashes are insecure')
+    if (process.env.NODE_ENV === 'production') {
+      throw new Error(
+        '[consentIntegrity] No CONSENT_INTEGRITY_SECRET/NEXTAUTH_SECRET set. ' +
+        'Refusing to compute or verify consent integrity hashes in production without a real secret.',
+      )
+    }
+    if (!missingSecretWarned) {
+      missingSecretWarned = true
+      console.warn(
+        '[consentIntegrity] No CONSENT_INTEGRITY_SECRET/NEXTAUTH_SECRET set — ' +
+        'using insecure dev-only default. Set a secret before deploying to production.',
+      )
+    }
+    return DEV_ONLY_SECRET
   }
-  return secret || 'om-consent-integrity-default-key'
+  return secret
 }
 
 function normalizeDate(date: Date | string | null | undefined): string {

package/src/modules/auth/lib/emailHash.ts

@@ -1,5 +1,9 @@
-import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 
 export function computeEmailHash(email: string): string {
   return hashForLookup(email)
 }
+
+export function emailHashLookupValues(email: string): string[] {
+  return lookupHashCandidates(email)
+}

package/src/modules/auth/lib/grantChecks.ts

@@ -2,7 +2,7 @@ import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Role, RoleAcl, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 type ActorAcl = {
@@ -127,6 +127,60 @@ export async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdmin
   }
 }
 
+export async function assertActorCanAccessUserTarget(input: SuperAdminUserTargetInput): Promise<void> {
+  const isSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (isSuperAdmin) return
+
+  const target = await findOneWithDecryption(
+    input.em,
+    User,
+    { id: input.targetUserId } as FilterQuery<User>,
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  // Not found (incl. soft-deleted, which MikroORM's soft-delete filter hides):
+  // delegate to the caller. Every wired call site is itself tenant-scoped — the
+  // ACL/consents reads filter by auth.tenantId and the user commands re-load by
+  // id within tenant — so a missing target yields a safe empty/404 there. The
+  // guard's job is to block a foreign *existing* target, below.
+  if (!target) return
+
+  const actorTenantId = normalizeNullableString(input.tenantId)
+  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)
+  if (!targetTenantId || targetTenantId !== actorTenantId) {
+    throw new CrudHttpError(404, { error: 'User not found' })
+  }
+
+  const actorAcl = await loadActorAcl(input)
+  if (actorAcl.organizations !== null && !actorAcl.organizations.includes('__all__')) {
+    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)
+    if (!targetOrganizationId || !actorAcl.organizations.includes(targetOrganizationId)) {
+      throw forbidden('Not authorized to access this user.')
+    }
+  }
+}
+
+export async function assertActorCanAccessRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {
+  const isSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (isSuperAdmin) return
+
+  const target = await findOneWithDecryption(
+    input.em,
+    Role,
+    { id: input.targetRoleId } as FilterQuery<Role>,
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  // Not found (incl. soft-deleted): delegate (see assertActorCanAccessUserTarget).
+  if (!target) return
+
+  const actorTenantId = normalizeNullableString(input.tenantId)
+  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)
+  if (!targetTenantId || targetTenantId !== actorTenantId) {
+    throw new CrudHttpError(404, { error: 'Role not found' })
+  }
+}
+
 async function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {
   if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin
   const acl = await loadActorAcl(input)

package/src/modules/auth/lib/sessionIntegrity.ts

@@ -69,8 +69,14 @@ export async function resolveCanonicalStaffAuthContext(
   // round-trips into one. The `em` here is a fresh request-scoped EntityManager
   // (resolved per request, never inside an explicit transaction), so concurrent
   // reads on it are safe.
+  //
+  // The session lookup is bound to the token subject (`user: subjectId`) so the
+  // referenced session must actually belong to the JWT's subject. Without this
+  // binding, a forged-but-otherwise-valid token could pair `sub` for one user with
+  // a still-live `sid` belonging to another, evading per-user session revocation
+  // (logout / deleteAllUserSessions / password reset).
   const sessionPromise = sessionId !== null
-    ? findOneWithDecryption(em, Session, { id: sessionId, deletedAt: null })
+    ? findOneWithDecryption(em, Session, { id: sessionId, user: subjectId, deletedAt: null })
     : Promise.resolve(null)
   const userPromise = findOneWithDecryption(
     em,
@@ -83,6 +89,7 @@ export async function resolveCanonicalStaffAuthContext(
 
   if (sessionId !== null) {
     if (!session) return null
+    if (resolveSessionUserId(session) !== subjectId) return null
     if (session.expiresAt.getTime() < Date.now()) return null
   }
 
@@ -143,6 +150,16 @@ export async function resolveCanonicalStaffAuthContext(
   }
 }
 
+function resolveSessionUserId(session: Session): string | null {
+  const owner = (session as { user?: unknown }).user
+  if (typeof owner === 'string') return owner
+  if (owner && typeof owner === 'object') {
+    const ownerId = (owner as { id?: unknown }).id
+    if (typeof ownerId === 'string') return ownerId
+  }
+  return null
+}
+
 async function userAclGrantsSuperAdmin(
   em: EntityManager,
   userId: string,

package/src/modules/auth/services/authService.ts

@@ -1,7 +1,7 @@
 import { EntityManager } from '@mikro-orm/postgresql'
 import { compare, hash } from 'bcryptjs'
 import { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'
-import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
@@ -9,29 +9,29 @@ export class AuthService {
   constructor(private em: EntityManager) {}
 
   async findUserByEmail(email: string) {
-    const emailHash = computeEmailHash(email)
+    const emailHashes = emailHashLookupValues(email)
     return findOneWithDecryption(this.em, User, {
       deletedAt: null,
       $or: [
         { email },
-        { emailHash },
+        { emailHash: { $in: emailHashes } },
       ],
     } as any)
   }
 
   async findUsersByEmail(email: string) {
-    const emailHash = computeEmailHash(email)
+    const emailHashes = emailHashLookupValues(email)
     return findWithDecryption(this.em, User, {
       deletedAt: null,
       $or: [
         { email },
-        { emailHash },
+        { emailHash: { $in: emailHashes } },
       ],
     } as any)
   }
 
   async findUserByEmailAndTenant(email: string, tenantId: string) {
-    const emailHash = computeEmailHash(email)
+    const emailHashes = emailHashLookupValues(email)
     return findOneWithDecryption(
       this.em,
       User,
@@ -40,7 +40,7 @@ export class AuthService {
         deletedAt: null,
         $or: [
           { email },
-          { emailHash },
+          { emailHash: { $in: emailHashes } },
         ],
       } as any,
       undefined,
@@ -84,10 +84,7 @@ export class AuthService {
 
   async deleteSessionByToken(token: string) {
     const hashedToken = hashAuthToken(token)
-    const deleted = await this.em.nativeDelete(Session, { token: hashedToken })
-    if (!deleted) {
-      await this.em.nativeDelete(Session, { token })
-    }
+    await this.em.nativeDelete(Session, { token: hashedToken })
   }
 
   async deleteSessionById(sessionId: string) {
@@ -108,10 +105,7 @@ export class AuthService {
   async refreshFromSessionToken(token: string) {
     const now = new Date()
     const hashedToken = hashAuthToken(token)
-    let sess = await this.em.findOne(Session, { token: hashedToken })
-    if (!sess) {
-      sess = await this.em.findOne(Session, { token })
-    }
+    const sess = await this.em.findOne(Session, { token: hashedToken })
     if (!sess || sess.expiresAt <= now) return null
     const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })
     if (!user) return null
@@ -133,10 +127,7 @@ export class AuthService {
   async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
     const now = new Date()
     const hashedToken = hashAuthToken(token)
-    let row = await this.em.findOne(PasswordReset, { token: hashedToken })
-    if (!row) {
-      row = await this.em.findOne(PasswordReset, { token })
-    }
+    const row = await this.em.findOne(PasswordReset, { token: hashedToken })
     if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
 
     // Atomic compare-and-set: only mark used if still unused — prevents token replay under concurrency

package/src/modules/auth/services/sidebarPreferencesService.ts

@@ -54,6 +54,38 @@ export async function loadSidebarPreference(
   return normalizeSidebarSettings(existing?.settingsJson as SidebarPreferencesSettings | undefined)
 }
 
+export async function loadSidebarPreferenceUpdatedAt(
+  em: EntityManager,
+  scope: SidebarPreferenceScope,
+): Promise<{ id: string; updatedAt: Date | null } | null> {
+  const { userId, tenantId, organizationId } = normalizeScope(scope)
+  const existing = await findOneWithDecryption(
+    em,
+    UserSidebarPreference,
+    { user: userId, tenantId, organizationId },
+    undefined,
+    { tenantId, organizationId },
+  )
+  if (!existing) return null
+  return { id: existing.id, updatedAt: existing.updatedAt ?? null }
+}
+
+export async function loadRoleSidebarPreferenceUpdatedAt(
+  em: EntityManager,
+  scope: RoleSidebarPreferenceScope,
+): Promise<{ id: string; updatedAt: Date | null } | null> {
+  const { roleId, tenantId } = normalizeRoleScope(scope)
+  const existing = await findOneWithDecryption(
+    em,
+    RoleSidebarPreference,
+    { role: roleId, tenantId },
+    undefined,
+    { tenantId, organizationId: null },
+  )
+  if (!existing) return null
+  return { id: existing.id, updatedAt: existing.updatedAt ?? null }
+}
+
 export async function saveSidebarPreference(
   em: EntityManager,
   scope: SidebarPreferenceScope,
@@ -389,7 +421,7 @@ export async function updateSidebarVariant(
   if (!variant) return null
   const target = variant
   await withAtomicFlush(em, [
-    async () => {
+    () => {
       if (typeof input.name === 'string' && input.name.trim().length > 0) {
         target.name = input.name.trim()
       }
@@ -400,12 +432,14 @@ export async function updateSidebarVariant(
         })
       }
       if (typeof input.isActive === 'boolean') {
-        if (input.isActive) {
-          await deactivateAllVariants(em, scope, variantId)
-        }
         target.isActive = input.isActive
       }
     },
+    async () => {
+      if (input.isActive === true) {
+        await deactivateAllVariants(em, scope, variantId)
+      }
+    },
   ], { transaction: true })
   return toVariantRecord(target)
 }

package/src/modules/business_rules/api/rules/route.ts

@@ -4,6 +4,8 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { BusinessRule } from '../../data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -277,6 +279,20 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Rule not found' }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'business_rules.rule',
+      resourceId: rule.id,
+      current: rule.updatedAt ?? null,
+      request: req,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
+
   em.assign(rule, parsed.data)
 
   try {
@@ -321,6 +337,20 @@ export async function DELETE(req: Request) {
     return NextResponse.json({ error: 'Rule not found' }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'business_rules.rule',
+      resourceId: rule.id,
+      current: rule.updatedAt ?? null,
+      request: req,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
+
   rule.deletedAt = new Date()
   await em.persist(rule).flush()
   await invalidateBusinessRuleDiscoveryCache(cache, rule.tenantId, rule.organizationId)