@open-mercato/core 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4559.1.839e136509

package/src/modules/planner/components/AvailabilitySchedule.tsx

@@ -12,6 +12,8 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
 import { GanttChart } from 'lucide-react'
 
@@ -27,6 +29,8 @@ export type AvailabilityRule = {
   kind?: 'availability' | 'unavailability'
   note?: string | null
   createdAt?: string | null
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export type AvailabilityScheduleItemBuilder = (params: {
@@ -368,9 +372,12 @@ export function AvailabilitySchedule({
       exdates: normalizeExdatesInput(values.exdates),
     }
     if (editingRule) {
-      await updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
-        errorMessage: availabilityLabels.updateError,
-      })
+      const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+      await withScopedApiRequestHeaders(headers, () => (
+        updateCrud('planner/availability', { id: editingRule.id, ...payload }, {
+          errorMessage: availabilityLabels.updateError,
+        })
+      ))
       flash(availabilityLabels.updatedFlash, 'success')
     } else {
       await createCrud('planner/availability', payload, {
@@ -386,10 +393,17 @@ export function AvailabilitySchedule({
 
   const handleAvailabilityDelete = React.useCallback(async () => {
     if (!editingRule) return
-    await deleteCrud('planner/availability', editingRule.id, {
-      errorMessage: availabilityLabels.deleteError,
-    })
-    flash(availabilityLabels.deletedFlash, 'success')
+    const headers = buildOptimisticLockHeader(editingRule.updatedAt ?? editingRule.updated_at ?? null)
+    await withScopedApiRequestHeaders(headers, () => (
+      deleteCrud('planner/availability', editingRule.id, {
+        errorMessage: availabilityLabels.deleteError,
+      })
+    ))
+    // Success/conflict UX is owned by the host CrudForm (it flashes delete success
+    // and surfaces an optimistic-lock 409 on the conflict bar). Do NOT flash success
+    // here: deleteCrud throws on a 409 so this line only ran on a real delete, but the
+    // extra toast duplicated CrudForm's and read as a misleading success (#2409). The
+    // side effects below still run only after a successful delete.
     setDialogOpen(false)
     setEditingRule(null)
     setSlotSeed(null)
@@ -477,6 +491,7 @@ export function AvailabilitySchedule({
             embedded
             fields={availabilityFields}
             initialValues={availabilityInitialValues}
+            optimisticLockUpdatedAt={editingRule?.updatedAt ?? editingRule?.updated_at ?? null}
             submitLabel={editingRule ? availabilityLabels.submitSave : availabilityLabels.submitCreate}
             onSubmit={handleAvailabilitySubmit}
             onDelete={editingRule ? handleAvailabilityDelete : undefined}

package/src/modules/query_index/lib/engine.ts

@@ -113,6 +113,7 @@ export class HybridQueryEngine implements QueryEngine {
   private customFieldKeysCache = new Map<string, { expiresAt: number; value: string[] }>()
   private customFieldKeysTtlMs: number
   private columnCache = new Map<string, boolean>()
+  private customEntityCache = new Map<string, boolean>()
   private debugVerbosity: boolean | null = null
   private sqlDebugEnabled: boolean | null = null
   private forcePartialIndexEnabled: boolean | null = null
@@ -973,6 +974,9 @@ export class HybridQueryEngine implements QueryEngine {
   }
 
   private async isCustomEntity(entity: string): Promise<boolean> {
+    const cached = this.customEntityCache.get(entity)
+    if (cached !== undefined) return cached
+    let result = false
     try {
       const db = this.getDb() as any
       const row = await db
@@ -981,6 +985,36 @@ export class HybridQueryEngine implements QueryEngine {
         .where('entity_id', '=', entity)
         .where('is_active', '=', true)
         .executeTakeFirst()
+      if (row) {
+        result = true
+      } else {
+        // Read/write symmetry. Records written through the entities data engine
+        // (`de.createCustomEntityRecord`) always land in `custom_entities_storage`,
+        // even for module-declared custom entities whose id is also a frozen system
+        // id — those are NEVER registered in `custom_entities` (install treats a
+        // system id as non-registrable). Without this fallback the query routes to
+        // the empty ORM/index path and those records are write-only (created with
+        // 200 but unreadable on the edit form). A real ORM entity never writes rows
+        // to `custom_entities_storage`, so this can only ever re-classify genuine
+        // doc-storage entities — it cannot misroute table-backed entities.
+        result = await this.hasCustomEntityStorageRows(entity)
+      }
+    } catch {
+      result = false
+    }
+    this.customEntityCache.set(entity, result)
+    return result
+  }
+
+  private async hasCustomEntityStorageRows(entity: string): Promise<boolean> {
+    try {
+      const db = this.getDb() as any
+      const row = await db
+        .selectFrom('custom_entities_storage')
+        .select(sql<number>`1`.as('one'))
+        .where('entity_type', '=', entity)
+        .limit(1)
+        .executeTakeFirst()
       return !!row
     } catch {
       return false

package/src/modules/resources/backend/resources/resource-types/[id]/edit/page.tsx

@@ -54,8 +54,13 @@ export default function ResourcesResourceTypeEditPage({ params }: { params?: { i
                 ? item.appearanceColor
                 : typeof item.appearance_color === 'string'
                   ? item.appearance_color
-                  : null,
+                : null,
             },
+            updatedAt: typeof item.updatedAt === 'string'
+              ? item.updatedAt
+              : typeof item.updated_at === 'string'
+                ? item.updated_at
+                : null,
             ...customValues,
           })
           setResourceCount(typeof item.resourceCount === 'number'
@@ -104,6 +109,7 @@ export default function ResourcesResourceTypeEditPage({ params }: { params?: { i
         {error ? (
           <ErrorMessage label={error} />
         ) : null}
+        {/* optimistic-lock: ResourceTypeCrudForm forwards optimisticLockUpdatedAt from initialValues.updatedAt (auto-derives the header on save + delete). */}
         <ResourceTypeCrudForm
           mode="edit"
           initialValues={initialValues ?? { id: resourceTypeId, name: '', description: '', appearance: { icon: null, color: null } }}

package/src/modules/resources/backend/resources/resource-types/page.tsx

@@ -10,8 +10,9 @@ import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/Dat
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { renderDictionaryColor, renderDictionaryIcon } from '@open-mercato/core/modules/dictionaries/components/dictionaryAppearance'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { Package } from 'lucide-react'
@@ -228,7 +229,10 @@ export default function ResourcesResourceTypesPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('resources/resource-types', entry.id, { errorMessage: translations.errors.delete })
+      const headers = buildOptimisticLockHeader(entry.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('resources/resource-types', entry.id, { errorMessage: translations.errors.delete })
+      ))
       flash(translations.messages.deleted, 'success')
       handleRefresh()
     } catch (error) {
@@ -314,4 +318,3 @@ function mapApiResourceType(item: Record<string, unknown>): ResourceTypeRow {
       : 0
   return withDataTableNamespaces({ id, name, description, appearanceIcon, appearanceColor, updatedAt, resourceCount }, item)
 }
-

package/src/modules/resources/backend/resources/resources/[id]/page.tsx

@@ -5,7 +5,8 @@ import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
@@ -446,6 +447,12 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
             capacityUnitValue: resource.capacityUnitValue ?? '',
             appearance: { icon: resource.appearanceIcon ?? null, color: resource.appearanceColor ?? null },
             isActive: resource.isActive ?? true,
+            updatedAt:
+              typeof resource.updatedAt === 'string'
+                ? resource.updatedAt
+                : typeof resource.updated_at === 'string'
+                  ? resource.updated_at
+                  : null,
             customFieldsetCode: resource.resourceTypeId
               ? resolveFieldsetCode(resource.resourceTypeId)
               : RESOURCES_RESOURCE_FIELDSET_DEFAULT,
@@ -472,12 +479,20 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
 
   const handleRulesetChange = React.useCallback(async (nextId: string | null) => {
     if (!resourceId) return
-    await updateCrud('resources/resources', { id: resourceId, availabilityRuleSetId: nextId }, {
+    const updateSchedule = () => updateCrud('resources/resources', { id: resourceId, availabilityRuleSetId: nextId }, {
       errorMessage: t('resources.resources.availability.ruleset.updateError', 'Failed to update schedule.'),
     })
+    const resourceOptimisticLockHeader = buildOptimisticLockHeader(
+      typeof initialValues?.updatedAt === 'string' ? initialValues.updatedAt : null,
+    )
+    if (Object.keys(resourceOptimisticLockHeader).length > 0) {
+      await withScopedApiRequestHeaders(resourceOptimisticLockHeader, updateSchedule)
+    } else {
+      await updateSchedule()
+    }
     setAvailabilityRuleSetId(nextId)
     flash(t('resources.resources.availability.ruleset.updateSuccess', 'Schedule updated.'), 'success')
-  }, [resourceId, t])
+  }, [initialValues?.updatedAt, resourceId, t])
 
   const resourceTitle =
     typeof initialValues?.name === 'string' && initialValues.name.trim().length > 0
@@ -647,6 +662,11 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
                   successRedirect="/backend/resources/resources"
                   formConfig={formConfig}
                   initialValues={initialValues ?? undefined}
+                  optimisticLockUpdatedAt={
+                    typeof initialValues?.updatedAt === 'string'
+                      ? initialValues.updatedAt
+                      : null
+                  }
                   onSubmit={handleSubmit}
                   onDelete={handleDelete}
                   isLoading={!initialValues}

package/src/modules/resources/backend/resources/resources/page.tsx

@@ -9,8 +9,9 @@ import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/Dat
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import type { FilterDef, FilterOption, FilterValues } from '@open-mercato/ui/backend/FilterOverlay'
 import type { TagOption } from '@open-mercato/ui/backend/detail'
@@ -31,6 +32,7 @@ type ResourceRow = {
   isActive: boolean
   appearanceIcon?: string | null
   appearanceColor?: string | null
+  updatedAt?: string | null
 }
 
 type ResourceTypeRow = {
@@ -349,9 +351,12 @@ export default function ResourcesResourcesPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('resources/resources', row.id, {
-        errorMessage: t('resources.resources.list.error.delete', 'Failed to delete resource.'),
-      })
+      const headers = buildOptimisticLockHeader(row.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('resources/resources', row.id, {
+          errorMessage: t('resources.resources.list.error.delete', 'Failed to delete resource.'),
+        })
+      ))
       flash(t('resources.resources.list.flash.deleted', 'Resource deleted.'), 'success')
       setPage(1)
       router.refresh()
@@ -536,6 +541,11 @@ function mapApiResource(item: Record<string, unknown>): ResourceRow {
       ? item.appearance_color
       : null
   const tags = Array.isArray(item.tags) ? item.tags as TagOption[] : []
+  const updatedAt = typeof item.updatedAt === 'string'
+    ? item.updatedAt
+    : typeof item.updated_at === 'string'
+      ? item.updated_at
+      : null
   return withDataTableNamespaces({
     id,
     name,
@@ -545,5 +555,6 @@ function mapApiResource(item: Record<string, unknown>): ResourceRow {
     isActive,
     appearanceIcon,
     appearanceColor,
+    updatedAt,
   }, item)
 }

package/src/modules/resources/components/ResourceCrudForm.tsx

@@ -316,6 +316,7 @@ export type ResourcesResourceFormProps = {
   embedded?: boolean
   successRedirect?: string
   initialValues?: Record<string, unknown>
+  optimisticLockUpdatedAt?: string | null
   onSubmit: (values: Record<string, unknown>) => Promise<void>
   onDelete?: () => Promise<void>
   isLoading?: boolean
@@ -332,6 +333,7 @@ export function ResourcesResourceForm(props: ResourcesResourceFormProps) {
     embedded = false,
     successRedirect,
     initialValues,
+    optimisticLockUpdatedAt,
     onSubmit,
     onDelete,
     isLoading,
@@ -368,6 +370,7 @@ export function ResourcesResourceForm(props: ResourcesResourceFormProps) {
       fields={formConfig.fields}
       groups={groups}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={optimisticLockUpdatedAt}
       entityId={E.resources.resources_resource}
       customFieldsetBindings={{ [E.resources.resources_resource]: { valueKey: 'customFieldsetCode' } }}
       onSubmit={onSubmit}

package/src/modules/resources/components/ResourceTypeCrudForm.tsx

@@ -13,6 +13,7 @@ export type ResourceTypeFormValues = {
   name: string
   description?: string
   appearance?: { icon?: string | null; color?: string | null }
+  updatedAt?: string | null
 } & Record<string, unknown>
 
 type ResourceTypeCrudFormProps = {
@@ -118,6 +119,7 @@ export function ResourceTypeCrudForm({
       groups={groups}
       entityId={E.resources.resources_resource_type}
       initialValues={initialValues}
+      optimisticLockUpdatedAt={mode === 'edit' ? initialValues.updatedAt : undefined}
       isLoading={isLoading}
       onSubmit={onSubmit}
       onDelete={mode === 'edit' ? onDelete : undefined}

package/src/modules/sales/api/documents/factory.ts

@@ -202,6 +202,12 @@ const mapUpdateResponse = (entity: any) => {
     paymentMethodId: entity?.paymentMethodId ?? null,
     paymentMethodCode: entity?.paymentMethodCode ?? null,
     paymentMethodSnapshot: normalizeJsonRecord(entity?.paymentMethodSnapshot),
+    // Return the fresh version so the client can refresh its optimistic-lock
+    // token after a successful inline save — otherwise a second save on the same
+    // page sends the now-stale updatedAt and falsely 409s (#2055 QA).
+    updatedAt: entity?.updatedAt
+      ? (entity.updatedAt instanceof Date ? entity.updatedAt.toISOString() : entity.updatedAt)
+      : null,
   }
 }
 
@@ -492,7 +498,13 @@ export function buildDocumentCrudOptions(binding: DocumentBinding) {
           const organizationId =
             typeof item?.organizationId === 'string' ? item.organizationId : ctx?.selectedOrganizationId ?? ctx?.auth?.orgId ?? null
           if (orderId && tenantId && organizationId) {
-            const em = ctx?.container?.resolve?.('em') as import('@mikro-orm/postgresql').EntityManager | undefined
+            const requestEm = ctx?.container?.resolve?.('em') as import('@mikro-orm/postgresql').EntityManager | undefined
+            // Display-only totals recalculation: run on a forked EntityManager so
+            // the order/line/adjustment entities loaded here never enter the
+            // request's Unit of Work. This guarantees a GET can never flush an
+            // UPDATE (and thus never advance `updated_at`), which would otherwise
+            // surface as a spurious optimistic-lock 409 in another tab.
+            const em = requestEm?.fork()
             if (em) {
               const totals = await recalculateOrderTotalsForDisplay(
                 em,

package/src/modules/sales/backend/sales/channels/[channelId]/edit/page.tsx

@@ -181,6 +181,7 @@ export default function EditChannelPage({ params }: { params?: { channelId?: str
               { id: 'custom', title: t('entities.customFields.title', 'Custom Attributes'), column: 2, kind: 'customFields' },
             ]}
             initialValues={initialValues ?? undefined}
+            optimisticLockUpdatedAt={typeof initialValues?.updatedAt === 'string' ? initialValues.updatedAt : null}
             isLoading={loading}
             loadingMessage={t('sales.channels.form.loading', 'Loading channel…')}
             submitLabel={t('sales.channels.form.updateSubmit', 'Save changes')}
@@ -225,6 +226,11 @@ function mapChannelToFormValues(item: Record<string, unknown>): ChannelFormValue
         ? item.status_entry_id
         : null,
     isActive: item.isActive === true || item.is_active === true,
+    updatedAt: typeof item.updatedAt === 'string'
+      ? item.updatedAt
+      : typeof item.updated_at === 'string'
+        ? item.updated_at
+        : null,
   }
   return { ...values, ...extractCustomFieldEntries(item) }
 }

package/src/modules/sales/backend/sales/channels/offers/page.tsx

@@ -10,7 +10,9 @@ import { DataTable } from '@open-mercato/ui/backend/DataTable'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -280,12 +282,16 @@ export default function SalesChannelOffersListPage() {
 
   const handleDelete = React.useCallback(async (row: OfferRow) => {
     try {
-      await deleteCrud('catalog/offers', row.id, {
-        errorMessage: t('sales.channels.offers.errors.delete', 'Failed to delete offer.'),
-      })
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => deleteCrud('catalog/offers', row.id, {
+          errorMessage: t('sales.channels.offers.errors.delete', 'Failed to delete offer.'),
+        }),
+      )
       flash(t('sales.channels.offers.messages.deleted', 'Offer deleted.'), 'success')
       handleRefresh()
     } catch (err) {
+      if (surfaceRecordConflict(err, t)) { handleRefresh(); return }
       console.error('sales.channels.offers.delete', err)
     }
   }, [handleRefresh, t])

package/src/modules/sales/backend/sales/channels/page.tsx

@@ -10,8 +10,9 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 
@@ -138,12 +139,26 @@ export default function SalesChannelsPage() {
 
   const handleDelete = React.useCallback(async (row: ChannelRow) => {
     try {
-      await deleteCrud('sales/channels', row.id, {
-        errorMessage: t('sales.channels.table.errors.delete', 'Failed to delete channel.'),
-      })
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(row.updatedAt),
+        () => deleteCrud('sales/channels', row.id, {
+          errorMessage: t('sales.channels.table.errors.delete', 'Failed to delete channel.'),
+        }),
+      )
       flash(t('sales.channels.table.messages.deleted', 'Channel deleted.'), 'success')
       handleRefresh()
     } catch (err) {
+      if (extractOptimisticLockConflict(err)) {
+        // Someone edited the channel after this list loaded — refuse the
+        // stale delete, surface the conflict, and reload so the row reflects
+        // the latest server state (QA #2055 channel edit/delete broken state).
+        flash(
+          t('ui.forms.flash.recordModified', 'This record was modified by someone else. Refresh and try again.'),
+          'error',
+        )
+        handleRefresh()
+        return
+      }
       console.error('sales.channels.delete', err)
     }
   }, [handleRefresh, t])