@open-mercato/core 0.6.6-develop.6204.1.30b1f58642 → 0.6.6-develop.6227.1.2695efff30

package/src/modules/currencies/components/CurrencyFetchingConfig.tsx

@@ -3,7 +3,8 @@
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
-import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { Switch } from '@open-mercato/ui/primitives/switch'
@@ -31,16 +32,35 @@ export default function CurrencyFetchingConfig() {
   // Available providers that should be configured
   const availableProviders = useMemo(() => ['NBP', 'Raiffeisen Bank Polska'], [])
 
+  const mutationContextId = 'currencies-fetch-configs:mutation'
+  const { runMutation, retryLastMutation } = useGuardedMutation<{
+    formId: string
+    resourceKind: string
+    resourceId?: string
+    retryLastMutation: () => Promise<boolean>
+  }>({
+    contextId: mutationContextId,
+    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),
+  })
+
   const createProviderConfig = useCallback(async (provider: string) => {
     try {
-      await apiCall('/api/currencies/fetch-configs', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          provider,
-          isEnabled: false,
-          syncTime: '09:00',
+      await runMutation({
+        operation: () => apiCall('/api/currencies/fetch-configs', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            provider,
+            isEnabled: false,
+            syncTime: '09:00',
+          }),
         }),
+        context: {
+          formId: mutationContextId,
+          resourceKind: 'currencies.fetch_config',
+          retryLastMutation,
+        },
+        mutationPayload: { provider, isEnabled: false, syncTime: '09:00' },
       })
     } catch (err: any) {
       // Ignore errors for duplicate providers
@@ -48,7 +68,7 @@ export default function CurrencyFetchingConfig() {
         throw err
       }
     }
-  }, [])
+  }, [mutationContextId, retryLastMutation, runMutation])
 
   const initializeMissingProviders = useCallback(async (providers: string[]) => {
     setInitializing(true)
@@ -96,19 +116,38 @@ export default function CurrencyFetchingConfig() {
 
   const toggleEnabled = useCallback(async (configId: string, currentValue: boolean, updatedAt?: string | null) => {
     try {
-      const { result } = await withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(updatedAt),
-        () =>
-          apiCall('/api/currencies/fetch-configs', {
-            method: 'PUT',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-              id: configId,
-              isEnabled: !currentValue,
-            }),
-          }),
-      )
+      const call = await runMutation({
+        operation: async () => {
+          const response = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(updatedAt),
+            () =>
+              apiCall('/api/currencies/fetch-configs', {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                  id: configId,
+                  isEnabled: !currentValue,
+                }),
+              }),
+          )
+          if (!response.ok) {
+            throw Object.assign(new Error('[internal] currencies.fetchConfig.toggle failed'), {
+              status: response.status,
+              ...((response.result as Record<string, unknown> | null) ?? {}),
+            })
+          }
+          return response
+        },
+        context: {
+          formId: mutationContextId,
+          resourceKind: 'currencies.fetch_config',
+          resourceId: configId,
+          retryLastMutation,
+        },
+        mutationPayload: { id: configId, isEnabled: !currentValue },
+      })
 
+      const result = call.result as { config?: FetchConfig } | null
       if (result?.config) {
         setConfigs((prev) =>
           prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))
@@ -121,47 +160,77 @@ export default function CurrencyFetchingConfig() {
         )
       }
     } catch (err: any) {
+      if (extractOptimisticLockConflict(err)) return
       flash(err.message || t('currencies.fetch.error_update_config'), 'error')
     }
-  }, [t])
+  }, [mutationContextId, retryLastMutation, runMutation, t])
 
   const updateSyncTime = useCallback(async (configId: string, syncTime: string, updatedAt?: string | null) => {
     try {
-      const { result } = await withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(updatedAt),
-        () =>
-          apiCall('/api/currencies/fetch-configs', {
-            method: 'PUT',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-              id: configId,
-              syncTime: syncTime || null,
-            }),
-          }),
-      )
+      const call = await runMutation({
+        operation: async () => {
+          const response = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(updatedAt),
+            () =>
+              apiCall('/api/currencies/fetch-configs', {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                  id: configId,
+                  syncTime: syncTime || null,
+                }),
+              }),
+          )
+          if (!response.ok) {
+            throw Object.assign(new Error('[internal] currencies.fetchConfig.updateSyncTime failed'), {
+              status: response.status,
+              ...((response.result as Record<string, unknown> | null) ?? {}),
+            })
+          }
+          return response
+        },
+        context: {
+          formId: mutationContextId,
+          resourceKind: 'currencies.fetch_config',
+          resourceId: configId,
+          retryLastMutation,
+        },
+        mutationPayload: { id: configId, syncTime: syncTime || null },
+      })
 
+      const result = call.result as { config?: FetchConfig } | null
       if (result?.config) {
         setConfigs((prev) =>
           prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))
         )
       }
     } catch (err: any) {
+      if (extractOptimisticLockConflict(err)) return
       flash(err.message || t('currencies.fetch.error_update_sync_time'), 'error')
     }
-  }, [t])
+  }, [mutationContextId, retryLastMutation, runMutation, t])
 
   const fetchNow = useCallback(async (provider: string) => {
     setFetching(provider)
 
     try {
-      const { result } = await apiCall('/api/currencies/fetch-rates', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          providers: [provider],
+      const call = await runMutation({
+        operation: () => apiCall('/api/currencies/fetch-rates', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            providers: [provider],
+          }),
         }),
+        context: {
+          formId: mutationContextId,
+          resourceKind: 'currencies.fetch_rates',
+          retryLastMutation,
+        },
+        mutationPayload: { providers: [provider] },
       })
 
+      const result = call.result as { byProvider?: Record<string, { count: number; errors?: string[] }> } | null
       if (result) {
         const byProvider = result.byProvider as Record<string, { count: number; errors?: string[] }>
         const count = byProvider?.[provider]?.count || 0
@@ -178,7 +247,7 @@ export default function CurrencyFetchingConfig() {
     } finally {
       setFetching(null)
     }
-  }, [t, loadConfigs])
+  }, [mutationContextId, retryLastMutation, runMutation, t, loadConfigs])
 
   useEffect(() => {
     loadConfigs()

package/src/modules/customer_accounts/api/admin/roles/[id]/acl.ts

@@ -7,18 +7,27 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 export const metadata = {}
 
+const ROLE_RESOURCE_KIND = 'customer_accounts.role'
+
 export async function PUT(req: Request, { params }: { params: { id: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth) {
+  if (!auth || !auth.tenantId) {
     return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })
   }
+  const tenantId = auth.tenantId
 
   const container = await createRequestContainer()
   const rbacService = container.resolve('rbacService') as RbacService
-  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })
+  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })
   if (!hasAccess) {
     return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })
   }
@@ -39,16 +48,48 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
 
   const role = await em.findOne(CustomerRole, {
     id: params.id,
-    tenantId: auth.tenantId,
+    tenantId,
     deletedAt: null,
   })
   if (!role) {
     return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })
   }
 
+  // The ACL is part of the role aggregate: the role-edit screen loads and saves
+  // the role and its permissions together. Guard the write against the parent
+  // role's `updatedAt` so two admins editing the same role cannot silently
+  // overwrite each other's permission changes (#3194). Strictly additive — when
+  // the client sends no expected-version header the helper is a no-op.
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: ROLE_RESOURCE_KIND,
+      resourceId: role.id,
+      current: role.updatedAt ?? null,
+      request: req,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    throw err
+  }
+
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId,
+    organizationId: auth.orgId,
+    userId: auth.sub,
+    resourceKind: ROLE_RESOURCE_KIND,
+    resourceId: role.id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   const acl = await em.findOne(CustomerRoleAcl, {
     role: role.id as any,
-    tenantId: auth.tenantId,
+    tenantId,
   })
 
   if (acl) {
@@ -59,7 +100,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   } else {
     const newAcl = em.create(CustomerRoleAcl, {
       role,
-      tenantId: auth.tenantId,
+      tenantId,
       featuresJson: parsed.data.features,
       isPortalAdmin: parsed.data.isPortalAdmin ?? false,
       createdAt: new Date(),
@@ -68,13 +109,33 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     await em.flush()
   }
 
+  // Bump the aggregate version so a stale role-edit screen (which holds the role's
+  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`
+  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.
+  const nextUpdatedAt = new Date()
+  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })
+
   const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService
   await customerRbacService.invalidateRoleCache(role.id)
 
-  return NextResponse.json({ ok: true })
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub,
+      resourceKind: ROLE_RESOURCE_KIND,
+      resourceId: role.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
+  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })
 }
 
-const successSchema = z.object({ ok: z.literal(true) })
+const successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })
 const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
 
 const methodDoc: OpenApiMethodDoc = {
@@ -88,6 +149,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
     { status: 404, description: 'Role not found', schema: errorSchema },
+    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.tsx

@@ -273,15 +273,23 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
       return
     }
     const features = Array.isArray(values.features) ? values.features : []
-    const aclCall = await apiCall(
-      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,
-      {
-        method: 'PUT',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ features }),
-      },
-    )
+    // The role PUT just bumped the aggregate's `updatedAt`; the ACL write guards
+    // the SAME role aggregate, so send its NEW version (not the stale pre-edit one)
+    // to avoid a false 409 while still blocking a concurrent overwrite (#3194).
+    const roleResult = (roleCall.result ?? null) as { updatedAt?: string | null } | null
+    const aclHeaders = buildOptimisticLockHeader(roleResult?.updatedAt ?? data?.updatedAt ?? data?.updated_at ?? null)
+    const aclCall = await withScopedApiRequestHeaders(aclHeaders, () => (
+      apiCall(
+        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,
+        {
+          method: 'PUT',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ features }),
+        },
+      )
+    ))
     if (!aclCall.ok) {
+      if (surfaceRecordConflict({ status: aclCall.status, body: aclCall.result }, t)) return
       flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')
       return
     }

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -14,6 +14,7 @@ import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimi
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 
 type RoleRow = {
@@ -47,6 +48,21 @@ export default function CustomerRolesPage() {
   const [isLoading, setIsLoading] = React.useState(true)
   const [reloadToken, setReloadToken] = React.useState(0)
 
+  const { runMutation } = useGuardedMutation<{ entityType: string }>({
+    contextId: 'customer_accounts:roles-list',
+  })
+
+  const runMutationWithContext = React.useCallback(
+    async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {
+      return runMutation({
+        operation,
+        mutationPayload,
+        context: { entityType: 'customer_accounts:role' },
+      })
+    },
+    [runMutation],
+  )
+
   const queryParams = React.useMemo(() => {
     const params = new URLSearchParams()
     params.set('page', String(page))
@@ -95,24 +111,26 @@ export default function CustomerRolesPage() {
     })
     if (!confirmed) return
     try {
-      const call = await withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(role.updatedAt),
-        () => apiCall(
-          `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
-          { method: 'DELETE' },
-        ),
-      )
-      if (!call.ok) {
-        flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')
-        return
-      }
-      flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')
-      setReloadToken((token) => token + 1)
+      await runMutationWithContext(async () => {
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(role.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
+            { method: 'DELETE' },
+          ),
+        )
+        if (!call.ok) {
+          flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')
+          return
+        }
+        flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')
+        setReloadToken((token) => token + 1)
+      }, { id: role.id })
     } catch (err) {
       const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.delete', 'Failed to delete role')
       flash(message, 'error')
     }
-  }, [confirm, t])
+  }, [confirm, runMutationWithContext, t])
 
   const columns = React.useMemo<ColumnDef<RoleRow>[]>(() => [
     {

package/src/modules/customer_accounts/widgets/injection/account-status/widget.client.tsx

@@ -3,6 +3,7 @@
 import React from 'react'
 import { useQuery, useQueryClient } from '@tanstack/react-query'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
@@ -50,6 +51,10 @@ function InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onS
   const [isLoadingRoles, setIsLoadingRoles] = React.useState(true)
   const [isSubmitting, setIsSubmitting] = React.useState(false)
 
+  const { runMutation } = useGuardedMutation<{ entityType: string }>({
+    contextId: 'customer_accounts:account-status-invite',
+  })
+
   React.useEffect(() => {
     let cancelled = false
     async function loadPerson() {
@@ -124,28 +129,35 @@ function InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onS
 
     setIsSubmitting(true)
     try {
-      const call = await apiCall<{ ok: boolean; error?: string }>(
-        '/api/customer_accounts/admin/users-invite',
-        {
-          method: 'POST',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({
-            email: trimmedEmail,
-            roleIds: selectedRoleIds,
-            displayName: displayName.trim() || undefined,
-            customerEntityId: personEntityId,
-          }),
-        },
-      )
+      await runMutation({
+        context: { entityType: 'customer_accounts:user' },
+        mutationPayload: { customerEntityId: personEntityId, roleIds: selectedRoleIds },
+        operation: async () => {
+          // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit
+          const call = await apiCall<{ ok: boolean; error?: string }>(
+            '/api/customer_accounts/admin/users-invite',
+            {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({
+                email: trimmedEmail,
+                roleIds: selectedRoleIds,
+                displayName: displayName.trim() || undefined,
+                customerEntityId: personEntityId,
+              }),
+            },
+          )
 
-      if (!call.ok) {
-        const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined
-        flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')
-        return
-      }
+          if (!call.ok) {
+            const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined
+            flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')
+            return
+          }
 
-      flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')
-      onSuccess()
+          flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')
+          onSuccess()
+        },
+      })
     } catch {
       flash(t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')
     } finally {