@open-mercato/core 0.6.6-develop.6135.1.95b98004bd → 0.6.6-develop.6141.1.630752a1ca

package/src/modules/dashboards/api/layout/[itemId]/route.ts

@@ -5,6 +5,10 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'
 import { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { hasFeature } from '@open-mercato/shared/security/features'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   dashboardsTag,
@@ -14,6 +18,7 @@ import {
 } from '../../openapi'
 
 const DEFAULT_SIZE = 'md'
+const RESOURCE_KIND = 'dashboards.layout'
 
 export const metadata = {
   PATCH: { requireAuth: true, requireFeatures: ['dashboards.configure'] },
@@ -39,7 +44,8 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })
   }
 
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
 
@@ -54,6 +60,21 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: scope.tenantId ?? '',
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: RESOURCE_KIND,
+    resourceId: layoutItemId,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { id: layoutItemId, size: parsed.data.size, settings: parsed.data.settings },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   const layout = await em.findOne(DashboardLayout, {
     userId: scope.userId,
     tenantId: scope.tenantId,
@@ -77,6 +98,20 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
   }
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: scope.tenantId ?? '',
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: layoutItemId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ ok: true })
 }
 

package/src/modules/dashboards/api/layout/route.ts

@@ -9,6 +9,10 @@ import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/l
 import { hasFeature } from '@open-mercato/shared/security/features'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   dashboardsTag,
@@ -18,6 +22,7 @@ import {
 } from '../openapi'
 
 const DEFAULT_SIZE = 'md'
+const RESOURCE_KIND = 'dashboards.layout'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['dashboards.view'] },
@@ -206,7 +211,8 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Invalid layout payload', issues: parsed.error.issues }, { status: 400 })
   }
 
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })
   const rbac = resolve('rbacService') as any
 
@@ -221,6 +227,21 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: scope.tenantId ?? '',
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: RESOURCE_KIND,
+    resourceId: scope.userId,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { items: parsed.data.items },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   const widgets = await loadAllWidgets()
   const allowedIds = await resolveAllowedWidgetIds(
     em,
@@ -266,6 +287,20 @@ export async function PUT(req: Request) {
   }
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: scope.tenantId ?? '',
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: scope.userId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ ok: true })
 }
 

package/src/modules/dashboards/api/roles/widgets/route.ts

@@ -8,6 +8,10 @@ import { roleWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   dashboardsTag,
@@ -17,6 +21,7 @@ import {
 } from '../../openapi'
 
 const FEATURE = 'dashboards.admin.assign-widgets'
+const RESOURCE_KIND = 'dashboards.roleWidgets'
 
 function pickBestRecord(records: DashboardRoleWidgets[], tenantId: string | null, organizationId: string | null): DashboardRoleWidgets | null {
   let best: DashboardRoleWidgets | null = null
@@ -99,7 +104,8 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })
   }
 
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
@@ -119,6 +125,21 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Role not found' }, { status: 404 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: tenantId ?? '',
+    organizationId,
+    userId: String(auth.sub),
+    resourceKind: RESOURCE_KIND,
+    resourceId: parsed.data.roleId,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { roleId: parsed.data.roleId, widgetIds },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   let record = await em.findOne(DashboardRoleWidgets, {
     roleId: parsed.data.roleId,
     tenantId,
@@ -130,6 +151,19 @@ export async function PUT(req: Request) {
     if (record) {
       await em.remove(record).flush()
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: tenantId ?? '',
+        organizationId,
+        userId: String(auth.sub),
+        resourceKind: RESOURCE_KIND,
+        resourceId: parsed.data.roleId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return NextResponse.json({ ok: true, widgetIds: [] })
   }
 
@@ -146,6 +180,20 @@ export async function PUT(req: Request) {
   }
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: tenantId ?? '',
+      organizationId,
+      userId: String(auth.sub),
+      resourceKind: RESOURCE_KIND,
+      resourceId: parsed.data.roleId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ ok: true, widgetIds })
 }
 

package/src/modules/dashboards/api/users/widgets/route.ts

@@ -9,6 +9,10 @@ import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widget
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
 import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   dashboardsTag,
@@ -18,6 +22,7 @@ import {
 } from '../../openapi'
 
 const FEATURE = 'dashboards.admin.assign-widgets'
+const RESOURCE_KIND = 'dashboards.userWidgets'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: [FEATURE] },
@@ -99,7 +104,8 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })
   }
 
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
@@ -119,6 +125,21 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'User not found' }, { status: 404 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: tenantId ?? '',
+    organizationId,
+    userId: String(auth.sub),
+    resourceKind: RESOURCE_KIND,
+    resourceId: parsed.data.userId,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { userId: parsed.data.userId, mode: parsed.data.mode, widgetIds },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   let record = await em.findOne(DashboardUserWidgets, {
     userId: parsed.data.userId,
     tenantId,
@@ -130,6 +151,19 @@ export async function PUT(req: Request) {
     if (record) {
       await em.remove(record).flush()
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: tenantId ?? '',
+        organizationId,
+        userId: String(auth.sub),
+        resourceKind: RESOURCE_KIND,
+        resourceId: parsed.data.userId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return NextResponse.json({ ok: true, mode: 'inherit', widgetIds: [] })
   }
 
@@ -148,6 +182,20 @@ export async function PUT(req: Request) {
   }
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: tenantId ?? '',
+      organizationId,
+      userId: String(auth.sub),
+      resourceKind: RESOURCE_KIND,
+      resourceId: parsed.data.userId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ ok: true, mode: 'override', widgetIds })
 }
 

package/src/modules/directory/api/tenants/route.ts

@@ -6,6 +6,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import { tenantCreateSchema, tenantUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'
 import { loadCustomFieldValues, buildCustomFieldFiltersFromQuery } from '@open-mercato/shared/lib/crud/custom-fields'
+import { resolveRecordIdsForCustomFieldFilters } from './tenant-cf-filter'
 import { E } from '#generated/entities.ids.generated'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import type { EntityManager } from '@mikro-orm/postgresql'
@@ -87,11 +88,6 @@ const toRow = (tenant: Tenant, cf: Record<string, unknown>): TenantRow => ({
   ...cf,
 })
 
-const matchesValue = (current: unknown, expected: unknown): boolean => {
-  if (Array.isArray(current)) return current.some((item) => item === expected)
-  return current === expected
-}
-
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -180,28 +176,31 @@ export async function GET(req: Request) {
   let cfValues: Record<string, Record<string, unknown>>
 
   if (cfFilterEntries.length) {
-    // Custom-field filters are matched in JS against separately-loaded values,
-    // so the full result set must be fetched before filtering and paging.
-    const all = await em.find(Tenant, where, { orderBy })
-    cfValues = await loadCfValues(all)
-    const filtered = all.filter((tenant) => {
-      const rid = String(tenant.id)
-      const payload = cfValues[rid] ?? {}
-      return cfFilterEntries.every(([key, expected]) => {
-        const value = payload[`cf_${key}`]
-        if (expected && typeof expected === 'object' && !Array.isArray(expected)) {
-          const maybeIn = (expected as { $in?: unknown[] }).$in
-          if (Array.isArray(maybeIn)) {
-            if (value === undefined || value === null) return false
-            if (Array.isArray(value)) return value.some((val) => maybeIn.includes(val))
-            return maybeIn.includes(value)
-          }
-        }
-        return matchesValue(value, expected)
-      })
+    // Custom-field values live in a separate store, so first resolve the bounded
+    // set of matching tenant ids from that store, then push pagination to the
+    // database via findAndCount instead of loading the whole tenant table.
+    const matchedIds = await resolveRecordIdsForCustomFieldFilters({
+      em,
+      entityId: E.directory.tenant,
+      tenantId: auth.tenantId ?? null,
+      filters: cfFilterEntries,
     })
-    total = filtered.length
-    pageTenants = filtered.slice(start, start + pageSize)
+    const existingId = where.id
+    const idFilter = typeof existingId === 'string'
+      ? (matchedIds.has(existingId) ? [existingId] : [])
+      : Array.from(matchedIds)
+
+    if (!idFilter.length) {
+      total = 0
+      pageTenants = []
+      cfValues = {}
+    } else {
+      where.id = { $in: idFilter }
+      const [rows, count] = await em.findAndCount(Tenant, where, { orderBy, limit: pageSize, offset: start })
+      total = count
+      pageTenants = rows
+      cfValues = await loadCfValues(rows)
+    }
   } else {
     // No JS-side filtering applies, so pagination is pushed to the database
     // instead of fetching the whole table and slicing in memory.

package/src/modules/directory/api/tenants/tenant-cf-filter.ts

@@ -0,0 +1,97 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityId } from '@open-mercato/shared/modules/entities'
+import { CustomFieldDef, CustomFieldValue } from '@open-mercato/core/modules/entities/data/entities'
+
+export type CustomFieldFilterEntry = readonly [string, unknown]
+
+type ValueColumn = 'valueText' | 'valueMultiline' | 'valueInt' | 'valueFloat' | 'valueBool'
+
+const valueColumnForKind = (kind: string | null | undefined): ValueColumn => {
+  switch (kind) {
+    case 'integer':
+      return 'valueInt'
+    case 'float':
+      return 'valueFloat'
+    case 'boolean':
+      return 'valueBool'
+    case 'multiline':
+      return 'valueMultiline'
+    default:
+      return 'valueText'
+  }
+}
+
+const expectedValuesFor = (condition: unknown): unknown[] => {
+  if (condition && typeof condition === 'object' && !Array.isArray(condition)) {
+    const maybeIn = (condition as { $in?: unknown[] }).$in
+    if (Array.isArray(maybeIn)) return maybeIn
+  }
+  return [condition]
+}
+
+const intersect = (current: Set<string> | null, next: Set<string>): Set<string> => {
+  if (current === null) return next
+  const result = new Set<string>()
+  for (const id of next) {
+    if (current.has(id)) result.add(id)
+  }
+  return result
+}
+
+/**
+ * Resolve the bounded set of record ids that satisfy the given custom-field
+ * filters by querying the custom-field value store directly, instead of loading
+ * every entity row and matching the values in memory. Filters are combined with
+ * AND semantics. Returns an empty set when any filter matches nothing.
+ */
+export async function resolveRecordIdsForCustomFieldFilters(opts: {
+  em: EntityManager
+  entityId: EntityId
+  tenantId: string | null
+  filters: CustomFieldFilterEntry[]
+}): Promise<Set<string>> {
+  const { em, entityId, tenantId, filters } = opts
+  if (!filters.length) return new Set<string>()
+
+  const keys = Array.from(new Set(filters.map(([key]) => key)))
+  const tenantScope: Record<string, unknown> = tenantId
+    ? { tenantId: { $in: [tenantId, null] } }
+    : { tenantId: null }
+
+  const defs = await em.find(CustomFieldDef, {
+    entityId: String(entityId),
+    key: { $in: keys },
+    isActive: true,
+    deletedAt: null,
+    ...tenantScope,
+  } as FilterQuery<CustomFieldDef>)
+  const kindByKey = new Map<string, string>()
+  for (const def of defs) {
+    if (!kindByKey.has(def.key)) kindByKey.set(def.key, def.kind)
+  }
+
+  let matched: Set<string> | null = null
+  for (const [key, condition] of filters) {
+    const column = valueColumnForKind(kindByKey.get(key))
+    const expectedValues = expectedValuesFor(condition).filter((value) => value !== undefined && value !== null)
+    if (!expectedValues.length) return new Set<string>()
+
+    const rows = await em.find(
+      CustomFieldValue,
+      {
+        entityId: String(entityId),
+        fieldKey: key,
+        deletedAt: null,
+        [column]: { $in: expectedValues },
+        ...tenantScope,
+      } as FilterQuery<CustomFieldValue>,
+      { fields: ['recordId'] },
+    )
+    const ids = new Set<string>(rows.map((row) => String(row.recordId)))
+    matched = intersect(matched, ids)
+    if (matched.size === 0) return matched
+  }
+
+  return matched ?? new Set<string>()
+}

package/src/modules/feature_toggles/components/FeatureToggleDetailsCard.tsx

@@ -7,30 +7,32 @@ type FeatureToggleDetailsCardProps = {
 }
 
 function DefaultValueDisplay({ featureToggleItem }: { featureToggleItem?: FeatureToggle }) {
+  const t = useT()
 
-  if (!featureToggleItem?.defaultValue) {
+  const defaultValue = featureToggleItem?.defaultValue
+  if (defaultValue === null || defaultValue === undefined) {
     return <p className="text-base text-muted-foreground">-</p>
   }
 
-  switch (featureToggleItem.type) {
+  switch (featureToggleItem?.type) {
     case 'boolean':
       return (
         <p className="text-base font-semibold text-foreground">
-          {featureToggleItem.defaultValue ? useT()('feature_toggles.values.true', 'True') : useT()('feature_toggles.values.false', 'False')}
+          {defaultValue ? t('feature_toggles.values.true', 'True') : t('feature_toggles.values.false', 'False')}
         </p>
       )
 
     case 'string':
       return (
         <p className="text-base font-semibold text-foreground">
-          {featureToggleItem.defaultValue}
+          {defaultValue}
         </p>
       )
 
     case 'number':
       return (
         <p className="text-base font-semibold text-foreground">
-          {featureToggleItem.defaultValue}
+          {defaultValue}
         </p>
       )
 
@@ -38,9 +40,9 @@ function DefaultValueDisplay({ featureToggleItem }: { featureToggleItem?: Featur
       return (
         <div className="text-base font-semibold text-foreground">
           <pre className="bg-muted/30 p-2 rounded text-sm font-mono overflow-x-auto whitespace-pre-wrap">
-            {typeof featureToggleItem.defaultValue === 'object'
-              ? JSON.stringify(featureToggleItem.defaultValue, null, 2)
-              : featureToggleItem.defaultValue}
+            {typeof defaultValue === 'object'
+              ? JSON.stringify(defaultValue, null, 2)
+              : defaultValue}
           </pre>
         </div>
       )

package/src/modules/integrations/api/[id]/health/route.ts

@@ -4,6 +4,11 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getIntegration } from '@open-mercato/shared/modules/integrations/types'
 import type { IntegrationHealthService } from '../../../lib/health-service'
+import {
+  resolveUserFeatures,
+  runIntegrationMutationGuardAfterSuccess,
+  runIntegrationMutationGuards,
+} from '../../guards'
 
 const idParamsSchema = z.object({ id: z.string().min(1) })
 
@@ -37,6 +42,25 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
   }
 
   const container = await createRequestContainer()
+  const guardResult = await runIntegrationMutationGuards(
+    container,
+    {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub ?? '',
+      resourceKind: 'integrations.integration',
+      resourceId: integration.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: { integrationId: integration.id },
+    },
+    resolveUserFeatures(auth),
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })
+  }
+
   const healthService = container.resolve('integrationHealthService') as IntegrationHealthService
 
   const result = await healthService.runHealthCheck(
@@ -44,6 +68,17 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
     { organizationId: auth.orgId as string, tenantId: auth.tenantId },
   )
 
+  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    userId: auth.sub ?? '',
+    resourceKind: 'integrations.integration',
+    resourceId: integration.id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+  })
+
   return NextResponse.json({
     status: result.status,
     message: result.message ?? null,

package/src/modules/perspectives/api/[tableId]/route.ts

@@ -75,9 +75,10 @@ export async function GET(_req: Request, ctx: { params: { tableId: string } }) {
   const assignedRoleNames = Array.isArray(auth.roles)
     ? Array.from(new Set(auth.roles.filter((role): role is string => typeof role === 'string' && role.trim().length > 0)))
     : []
-  const assignedRoles = assignedRoleNames.length
+  const assignedRoles = assignedRoleNames.length && auth.tenantId
     ? await em.find(Role, {
         name: { $in: assignedRoleNames as any },
+        tenantId: auth.tenantId,
         deletedAt: null,
       } as any, { orderBy: { name: 'asc' } })
     : []