@open-mercato/core 0.6.6-develop.6094.1.28b081ea16 → 0.6.6-develop.6126.1.0b9392fdae

package/src/modules/customers/lib/calendar/range.ts

@@ -0,0 +1,45 @@
+import { addDays } from 'date-fns/addDays'
+import { addMonths } from 'date-fns/addMonths'
+import { addWeeks } from 'date-fns/addWeeks'
+import { endOfDay } from 'date-fns/endOfDay'
+import { endOfMonth } from 'date-fns/endOfMonth'
+import { endOfWeek } from 'date-fns/endOfWeek'
+import { startOfDay } from 'date-fns/startOfDay'
+import { startOfMonth } from 'date-fns/startOfMonth'
+import { startOfWeek } from 'date-fns/startOfWeek'
+import type { CalendarRange, CalendarView } from '../../components/calendar/types'
+
+const MONDAY_WEEK = { weekStartsOn: 1 as const }
+
+export function getVisibleRange(view: CalendarView, anchor: Date, agendaHorizonDays: number): CalendarRange {
+  switch (view) {
+    case 'day':
+      return { from: startOfDay(anchor), to: endOfDay(anchor) }
+    case 'week':
+      return { from: startOfWeek(anchor, MONDAY_WEEK), to: endOfWeek(anchor, MONDAY_WEEK) }
+    case 'month':
+      return {
+        from: startOfWeek(startOfMonth(anchor), MONDAY_WEEK),
+        to: endOfWeek(endOfMonth(anchor), MONDAY_WEEK),
+      }
+    case 'agenda':
+      return { from: startOfDay(anchor), to: endOfDay(addDays(anchor, agendaHorizonDays)) }
+  }
+}
+
+export function getFetchWindow(range: CalendarRange): CalendarRange {
+  return { from: addDays(range.from, -1), to: range.to }
+}
+
+export function shiftAnchor(view: CalendarView, anchor: Date, direction: 1 | -1): Date {
+  switch (view) {
+    case 'day':
+      return addDays(anchor, direction)
+    case 'week':
+      return addWeeks(anchor, direction)
+    case 'month':
+      return addMonths(anchor, direction)
+    case 'agenda':
+      return addDays(anchor, direction * 7)
+  }
+}

package/src/modules/customers/lib/calendar/recurrence.ts

@@ -0,0 +1,137 @@
+import { addDays } from 'date-fns/addDays'
+import type { CalendarItem, CalendarRange } from '../../components/calendar/types'
+
+const MAX_OCCURRENCES_PER_WINDOW = 100
+
+const WEEKDAY_TOKENS = ['SU', 'MO', 'TU', 'WE', 'TH', 'FR', 'SA'] as const
+
+const UNTIL_PATTERN = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/
+
+export type ParsedRecurrenceRule = {
+  freq: 'DAILY' | 'WEEKLY'
+  byDay: number[] | null
+  count: number | null
+  until: Date | null
+}
+
+function parseUntil(value: string): Date | null {
+  const match = UNTIL_PATTERN.exec(value)
+  if (!match) return null
+  const [, year, month, day, hours, minutes, seconds] = match
+  const parsed = new Date(
+    Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hours), Number(minutes), Number(seconds)),
+  )
+  return Number.isNaN(parsed.getTime()) ? null : parsed
+}
+
+export function parseRecurrenceRule(rule: string): ParsedRecurrenceRule | null {
+  const parts = rule
+    .split(';')
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0)
+  if (parts.length === 0) return null
+
+  let freq: ParsedRecurrenceRule['freq'] | null = null
+  let byDay: number[] | null = null
+  let count: number | null = null
+  let until: Date | null = null
+
+  for (const part of parts) {
+    const separatorIndex = part.indexOf('=')
+    if (separatorIndex <= 0) return null
+    const key = part.slice(0, separatorIndex).toUpperCase()
+    const value = part.slice(separatorIndex + 1)
+    if (key === 'FREQ') {
+      if (value !== 'DAILY' && value !== 'WEEKLY') return null
+      freq = value
+    } else if (key === 'BYDAY') {
+      const tokens = value
+        .split(',')
+        .map((token) => token.trim().toUpperCase())
+        .filter((token) => token.length > 0)
+      if (tokens.length === 0) return null
+      const weekdays: number[] = []
+      for (const token of tokens) {
+        const weekday = WEEKDAY_TOKENS.indexOf(token as (typeof WEEKDAY_TOKENS)[number])
+        if (weekday === -1) return null
+        weekdays.push(weekday)
+      }
+      byDay = weekdays
+    } else if (key === 'COUNT') {
+      const parsedCount = Number(value)
+      if (!Number.isInteger(parsedCount) || parsedCount < 1) return null
+      count = parsedCount
+    } else if (key === 'UNTIL') {
+      const parsedUntil = parseUntil(value)
+      if (!parsedUntil) return null
+      until = parsedUntil
+    } else {
+      return null
+    }
+  }
+
+  if (!freq) return null
+  return { freq, byDay, count, until }
+}
+
+function parseRecurrenceEndTime(rawRecurrenceEnd: string | null | undefined): number | null {
+  if (typeof rawRecurrenceEnd !== 'string' || rawRecurrenceEnd.length === 0) return null
+  const parsed = new Date(rawRecurrenceEnd)
+  if (Number.isNaN(parsed.getTime())) return null
+  const endOfDayLocal = new Date(
+    parsed.getUTCFullYear(),
+    parsed.getUTCMonth(),
+    parsed.getUTCDate(),
+    23,
+    59,
+    59,
+    999,
+  )
+  return endOfDayLocal.getTime()
+}
+
+function occursOn(date: Date, rule: ParsedRecurrenceRule, seriesStartWeekday: number): boolean {
+  if (rule.freq === 'DAILY') return true
+  const allowedWeekdays = rule.byDay ?? [seriesStartWeekday]
+  return allowedWeekdays.includes(date.getDay())
+}
+
+export function expandOccurrences(item: CalendarItem, range: CalendarRange): CalendarItem[] {
+  const rawRule = item.raw.recurrenceRule
+  if (typeof rawRule !== 'string' || rawRule.trim().length === 0) return [item]
+  const rule = parseRecurrenceRule(rawRule)
+  if (!rule) return [item]
+
+  const durationMs = item.end.getTime() - item.start.getTime()
+  const recurrenceEndTime = parseRecurrenceEndTime(item.raw.recurrenceEnd)
+  const untilTime = rule.until ? rule.until.getTime() : null
+  const seriesStartWeekday = item.start.getDay()
+
+  const occurrences: CalendarItem[] = []
+  let occurrenceIndex = 0
+  let cursor = new Date(item.start)
+
+  while (cursor.getTime() <= range.to.getTime()) {
+    if (untilTime !== null && cursor.getTime() > untilTime) break
+    if (recurrenceEndTime !== null && cursor.getTime() > recurrenceEndTime) break
+    if (occursOn(cursor, rule, seriesStartWeekday)) {
+      if (rule.count !== null && occurrenceIndex >= rule.count) break
+      const occurrenceStart = new Date(cursor)
+      const occurrenceEnd = new Date(occurrenceStart.getTime() + durationMs)
+      if (occurrenceStart.getTime() <= range.to.getTime() && occurrenceEnd.getTime() > range.from.getTime()) {
+        occurrences.push({
+          ...item,
+          id: `${item.id}:${occurrenceIndex}`,
+          start: occurrenceStart,
+          end: occurrenceEnd,
+          isRecurringOccurrence: true,
+        })
+        if (occurrences.length >= MAX_OCCURRENCES_PER_WINDOW) break
+      }
+      occurrenceIndex += 1
+    }
+    cursor = addDays(cursor, 1)
+  }
+
+  return occurrences
+}

package/src/modules/dashboards/services/widgetDataService.ts

@@ -145,12 +145,14 @@ export class WidgetDataService {
       }
     }
 
-    const mainResult = await this.executeQuery(request, dateRangeResolved)
-
-    let comparisonResult: { value: number | null; data: WidgetDataItem[] } | undefined
-    if (comparisonRange && request.dateRange) {
-      comparisonResult = await this.executeQuery(request, comparisonRange)
-    }
+    const shouldFetchComparison = Boolean(comparisonRange && request.dateRange)
+
+    const [mainResult, comparisonResult] = await Promise.all([
+      this.executeQuery(request, dateRangeResolved),
+      shouldFetchComparison && comparisonRange
+        ? this.executeQuery(request, comparisonRange)
+        : Promise.resolve<{ value: number | null; data: WidgetDataItem[] } | undefined>(undefined),
+    ])
 
     const response: WidgetDataResponse = {
       value: mainResult.value,

package/src/modules/dictionaries/api/[dictionaryId]/entries/[entryId]/route.ts

@@ -1,10 +1,14 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
-import { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'
 import { updateDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -80,6 +84,21 @@ export async function PATCH(req: Request, ctx: { params?: { dictionaryId?: strin
     })
     const rawBody = await req.json().catch(() => ({}))
     const payload = updateDictionaryEntrySchema.parse(rawBody)
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'dictionaries.entry',
+      resourceId: entry.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     // These nested routes don't use the CRUD factory, so invoke the command bus explicitly.
     const commandBus = (context.container.resolve('commandBus') as CommandBus)
     const input = { ...(payload as Record<string, unknown>), id: entryId }
@@ -92,6 +111,19 @@ export async function PATCH(req: Request, ctx: { params?: { dictionaryId?: strin
     if (!updatedEntryId) {
       throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_update_failed', 'Failed to update dictionary entry') })
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'dictionaries.entry',
+        resourceId: updatedEntryId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const updated = await findOneWithDecryption(
       context.em.fork(),
       DictionaryEntry,
@@ -146,11 +178,39 @@ export async function DELETE(req: Request, ctx: { params?: { dictionaryId?: stri
     })
     const dictionary = await loadDictionary(context, dictionaryId)
     const entry = await loadEntry(context, dictionary, entryId)
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'dictionaries.entry',
+      resourceId: entry.id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     const commandBus = (context.container.resolve('commandBus') as CommandBus)
     const { logEntry } = await commandBus.execute('dictionaries.entries.delete', {
       input: { body: { id: entry.id } },
       ctx: context.ctx,
     })
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'dictionaries.entry',
+        resourceId: entry.id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const response = NextResponse.json({ ok: true })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/dictionaries/api/[dictionaryId]/entries/route.ts

@@ -2,9 +2,13 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
-import { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'
 import { createDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -166,6 +170,21 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
     }
     const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })
     const payload = createDictionaryEntrySchema.parse(await req.json().catch(() => ({})))
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: DICTIONARY_ENTRY_RESOURCE,
+      resourceId: dictionaryId,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     // These nested routes do not use makeCrudRoute, so we invoke the command bus directly.
     const commandBus = (context.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute('dictionaries.entries.create', {
@@ -177,6 +196,19 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
     if (!createdEntryId) {
       throw new CrudHttpError(500, { error: context.translate('dictionaries.errors.entry_create_failed', 'Failed to create dictionary entry') })
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: DICTIONARY_ENTRY_RESOURCE,
+        resourceId: createdEntryId,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     const entry = await findOneWithDecryption(
       context.em.fork(),
       DictionaryEntry,

package/src/modules/dictionaries/api/[dictionaryId]/route.ts

@@ -1,9 +1,13 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'
-import { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   resolveDictionaryEntrySortMode,
@@ -118,6 +122,22 @@ export async function PATCH(req: Request, ctx: { params?: { dictionaryId?: strin
       request: req,
     })
 
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'dictionaries.dictionary',
+      resourceId: dictionary.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     if (isProtectedCurrencyDictionary(dictionary)) {
       if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {
         throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })
@@ -172,6 +192,20 @@ export async function PATCH(req: Request, ctx: { params?: { dictionaryId?: strin
     dictionary.updatedAt = new Date()
     await context.em.flush()
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'dictionaries.dictionary',
+        resourceId: dictionary.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({
       id: dictionary.id,
       key: dictionary.key,
@@ -202,6 +236,22 @@ export async function DELETE(req: Request, ctx: { params?: { dictionaryId?: stri
     const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })
     const dictionary = await loadDictionary(context, dictionaryId)
 
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'dictionaries.dictionary',
+      resourceId: dictionary.id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     if (isProtectedCurrencyDictionary(dictionary)) {
       throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })
     }
@@ -210,6 +260,20 @@ export async function DELETE(req: Request, ctx: { params?: { dictionaryId?: stri
     dictionary.deletedAt = dictionary.deletedAt ?? new Date()
     await context.em.flush()
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'dictionaries.dictionary',
+        resourceId: dictionary.id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({ ok: true })
   } catch (err) {
     if (isCrudHttpError(err)) {

package/src/modules/dictionaries/api/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from 'next/server'
 import { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'
-import { resolveDictionariesRouteContext } from '@open-mercato/core/modules/dictionaries/api/context'
+import { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   DEFAULT_DICTIONARY_ENTRY_SORT_MODE,
@@ -100,9 +104,40 @@ export async function POST(req: Request) {
       createdAt: new Date(),
       updatedAt: new Date(),
     })
+
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'dictionaries.dictionary',
+      resourceId: dictionary.id,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     context.em.persist(dictionary)
     await context.em.flush()
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'dictionaries.dictionary',
+        resourceId: dictionary.id,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({
       id: dictionary.id,
       key: dictionary.key,

package/src/modules/feature_toggles/lib/queries.ts

@@ -1,4 +1,4 @@
-import { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { EntityManager, FilterQuery, QueryOrder } from '@mikro-orm/postgresql'
 import { FeatureToggle, FeatureToggleOverride } from '../data/entities'
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -28,6 +28,8 @@ export type GetOverridesQuery = {
     pageSize?: number
 }
 
+const SORTABLE_FIELDS = new Set<keyof FeatureToggle>(['identifier', 'name', 'category'])
+
 type GetOverridesResult = {
     items: OverrideListResponse[]
     total: number
@@ -56,76 +58,55 @@ export async function getOverrides(
         filters.identifier = { $ilike: `%${escapeLikePattern(query.identifier)}%` }
     }
 
-    const globalToggles = await em.find(FeatureToggle, filters)
+    const page = query.page ?? 1
+    const pageSize = query.pageSize ?? 25
+    const offset = (page - 1) * pageSize
 
-    const overrides = await em.find(FeatureToggleOverride, {
-        tenantId: tenant.id,
-        toggle: { id: { $in: globalToggles.map((toggle) => toggle.id) } },
-    })
+    const direction = query.sortDir === 'desc' ? QueryOrder.DESC : QueryOrder.ASC
+    const orderBy: Partial<Record<keyof FeatureToggle, QueryOrder>> = {}
+    if (query.sortField && SORTABLE_FIELDS.has(query.sortField as keyof FeatureToggle)) {
+        orderBy[query.sortField as keyof FeatureToggle] = direction
+    }
+    orderBy.id = QueryOrder.ASC
 
-    const response: OverrideListResponse[] = []
+    const totalItems = await em.count(FeatureToggle, filters)
 
-    globalToggles.forEach((toggle) => {
-        const override = overrides.find((o) => o.toggle.id === toggle.id)
-        if (override) {
-            response.push({
-                id: override?.id ?? '',
-                toggleId: toggle.id,
-                tenantName: tenant.name,
-                tenantId: tenant.id,
-                identifier: toggle.identifier,
-                name: toggle.name,
-                category: toggle.category ?? '',
-                isOverride: true,
-            })
-        } else {
-            response.push({
-                id: '',
-                toggleId: toggle.id,
-                tenantName: tenant.name,
-                tenantId: tenant.id,
-                identifier: toggle.identifier,
-                name: toggle.name,
-                category: toggle.category ?? '',
-                isOverride: false,
-            })
-        }
+    const globalToggles = await em.find(FeatureToggle, filters, {
+        orderBy,
+        limit: pageSize,
+        offset,
     })
 
-    if (query.sortField && query.sortDir) {
-        const sortField = query.sortField
-        const sortDir = query.sortDir
-
-        response.sort((a, b) => {
-            let aValue: any = a[sortField as keyof typeof a]
-            let bValue: any = b[sortField as keyof typeof b]
-
-
+    const overrides = globalToggles.length
+        ? await em.find(FeatureToggleOverride, {
+              tenantId: tenant.id,
+              toggle: { id: { $in: globalToggles.map((toggle) => toggle.id) } },
+          })
+        : []
 
-            if (typeof aValue === 'string' && typeof bValue === 'string') {
-                const comparison = aValue.localeCompare(bValue)
-                return sortDir === 'asc' ? comparison : -comparison
-            }
-
-            if (typeof aValue === 'number' && typeof bValue === 'number') {
-                return sortDir === 'asc' ? aValue - bValue : bValue - aValue
-            }
-
-            return 0
-        })
+    const overridesByToggleId = new Map<string, FeatureToggleOverride>()
+    for (const override of overrides) {
+        overridesByToggleId.set(override.toggle.id, override)
     }
 
-    const totalItems = response.length
-    const page = query.page ?? 1
-    const pageSize = query.pageSize ?? 25
-    const totalPages = Math.ceil(totalItems / pageSize)
-    const startIndex = (page - 1) * pageSize
-    const endIndex = startIndex + pageSize
+    const items: OverrideListResponse[] = globalToggles.map((toggle) => {
+        const override = overridesByToggleId.get(toggle.id)
+        return {
+            id: override?.id ?? '',
+            toggleId: toggle.id,
+            tenantName: tenant.name,
+            tenantId: tenant.id,
+            identifier: toggle.identifier,
+            name: toggle.name,
+            category: toggle.category ?? '',
+            isOverride: Boolean(override),
+        }
+    })
 
-    const paginatedItems = response.slice(startIndex, endIndex)
+    const totalPages = Math.ceil(totalItems / pageSize)
 
     return {
-        items: paginatedItems,
+        items,
         total: totalItems,
         totalPages,
         page,