@open-mercato/core 0.6.6-develop.6330.1.a261878aa8 → 0.6.6-develop.6331.1.a33b8e99b7

package/src/modules/staff/commands/job-histories.ts

@@ -21,7 +21,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import {
-  enforceCommandOptimisticLock,
+  enforceCommandOptimisticLockWithGuards,
   enforceRecordGoneIsConflict,
 } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
@@ -218,7 +218,7 @@ const updateJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryUpdateInp
     }
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
-    enforceCommandOptimisticLock({
+    await enforceCommandOptimisticLockWithGuards(ctx.container, {
       resourceKind: JOB_HISTORY_LOCK_RESOURCE_KIND,
       resourceId: record.id,
       current: record.updatedAt ?? null,
@@ -366,7 +366,7 @@ const deleteJobHistoryCommand: CommandHandler<{ id?: string; updatedAt?: string;
       }
       ensureTenantScope(ctx, record.tenantId)
       ensureOrganizationScope(ctx, record.organizationId)
-      enforceCommandOptimisticLock({
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
         resourceKind: JOB_HISTORY_LOCK_RESOURCE_KIND,
         resourceId: record.id,
         current: record.updatedAt ?? null,

package/src/modules/staff/components/detail/addressesAdapter.ts

@@ -1,6 +1,7 @@
 "use client"
 
-import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import type { AddressDataAdapter } from '@open-mercato/ui/backend/detail'
 import type { AddressTypesAdapter } from '@open-mercato/ui/backend/detail'
 import { loadStaffDictionaryEntries, createStaffDictionaryEntry } from './dictionaries'
@@ -77,6 +78,12 @@ export function createStaffAddressAdapter(translator: Translator): AddressDataAd
                 : typeof record.isPrimary === 'boolean'
                   ? record.isPrimary
                   : false,
+            updatedAt:
+              typeof record.updated_at === 'string'
+                ? record.updated_at
+                : typeof record.updatedAt === 'string'
+                  ? record.updatedAt
+                  : null,
           }
         })
         .filter((value): value is NonNullable<typeof value> => value !== null)
@@ -85,6 +92,7 @@ export function createStaffAddressAdapter(translator: Translator): AddressDataAd
       const response = await apiCallOrThrow<Record<string, unknown>>(
         '/api/staff/addresses',
         {
+          // optimistic-lock-exempt: address create-only (no prior version to compare)
           method: 'POST',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({
@@ -97,30 +105,39 @@ export function createStaffAddressAdapter(translator: Translator): AddressDataAd
       )
       return response.result ?? {}
     },
-    update: async ({ id, payload }) => {
-      await apiCallOrThrow(
-        '/api/staff/addresses',
-        {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({
-            id,
-            ...payload,
-            country: payload.country ? payload.country.toUpperCase() : undefined,
-          }),
-        },
-        { errorMessage: translator('staff.teamMembers.detail.addresses.error', 'Failed to save address.') },
+    update: async ({ id, payload, updatedAt }) => {
+      // Send the optimistic-lock header (address's loaded updatedAt) so a stale
+      // edit fails with a 409; the shared AddressesSection host surfaces it through
+      // surfaceRecordConflict instead of silently overwriting.
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt ?? null),
+        () => apiCallOrThrow(
+          '/api/staff/addresses',
+          {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+              id,
+              ...payload,
+              country: payload.country ? payload.country.toUpperCase() : undefined,
+            }),
+          },
+          { errorMessage: translator('staff.teamMembers.detail.addresses.error', 'Failed to save address.') },
+        ),
       )
     },
-    delete: async ({ id }) => {
-      await apiCallOrThrow(
-        '/api/staff/addresses',
-        {
-          method: 'DELETE',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ id }),
-        },
-        { errorMessage: translator('staff.teamMembers.detail.addresses.error', 'Failed to delete address.') },
+    delete: async ({ id, updatedAt }) => {
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt ?? null),
+        () => apiCallOrThrow(
+          '/api/staff/addresses',
+          {
+            method: 'DELETE',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ id }),
+          },
+          { errorMessage: translator('staff.teamMembers.detail.addresses.error', 'Failed to delete address.') },
+        ),
       )
     },
   }

package/src/modules/staff/components/detail/notesAdapter.ts

@@ -1,6 +1,7 @@
 "use client"
 
-import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { mapCommentSummary, type NotesDataAdapter } from '@open-mercato/ui/backend/detail/NotesSection'
 
 type Translator = (key: string, fallback?: string, params?: Record<string, string | number>) => string
@@ -35,29 +36,38 @@ export function createStaffNotesAdapter(translator: Translator): NotesDataAdapte
       )
       return response.result ?? {}
     },
-    update: async ({ id, patch }) => {
+    update: async ({ id, patch, updatedAt }) => {
       const payload: Record<string, unknown> = { id }
       if (patch.body !== undefined) payload.body = patch.body
       if (patch.appearanceIcon !== undefined) payload.appearanceIcon = patch.appearanceIcon
       if (patch.appearanceColor !== undefined) payload.appearanceColor = patch.appearanceColor
-      await apiCallOrThrow(
-        '/api/staff/comments',
-        {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(payload),
-        },
-        { errorMessage: translator('staff.teamMembers.detail.notes.updateError', 'Failed to update note.') },
+      // Send the optimistic-lock header (note's loaded updatedAt) so a stale edit
+      // fails with a 409; the shared NotesSection host surfaces it through
+      // surfaceRecordConflict instead of silently overwriting.
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt ?? null),
+        () => apiCallOrThrow(
+          '/api/staff/comments',
+          {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+          },
+          { errorMessage: translator('staff.teamMembers.detail.notes.updateError', 'Failed to update note.') },
+        ),
       )
     },
-    delete: async ({ id }) => {
-      await apiCallOrThrow(
-        `/api/staff/comments?id=${encodeURIComponent(id)}`,
-        {
-          method: 'DELETE',
-          headers: { 'content-type': 'application/json' },
-        },
-        { errorMessage: translator('staff.teamMembers.detail.notes.deleteError', 'Failed to delete note') },
+    delete: async ({ id, updatedAt }) => {
+      await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt ?? null),
+        () => apiCallOrThrow(
+          `/api/staff/comments?id=${encodeURIComponent(id)}`,
+          {
+            method: 'DELETE',
+            headers: { 'content-type': 'application/json' },
+          },
+          { errorMessage: translator('staff.teamMembers.detail.notes.deleteError', 'Failed to delete note') },
+        ),
       )
     },
   }

package/src/modules/translations/api/[entityType]/[entityId]/route.ts

@@ -10,8 +10,44 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
+const TRANSLATION_RESOURCE_KIND = 'translations.translation'
+
+/**
+ * Load the existing translation row's primary key + `updated_at` (the row's own
+ * version), scoped to tenant/org. Returns `null` when no row exists yet.
+ *
+ * Optimistic locking enforces against the TRANSLATION ROW'S OWN version, not the
+ * host entity's: the host's EAV `entityType` (`module:entity`) cannot be cleanly
+ * mapped to a registered optimistic-lock reader key (those are derived from the
+ * host module's ORM entity name / events config, e.g. `CatalogProduct` →
+ * `catalog.product`, which does not equal `canonicalizeResourceTag('catalog:catalog_product')`),
+ * so there is no reliable server-side path to resolve the host's current version
+ * for an arbitrary `entityType`. Guarding the translation row's own `updated_at`
+ * closes the no-lock hole with real server-side enforcement and no cross-module
+ * coupling (mirrors the hand-written `auth.role_acl` route).
+ */
+async function loadTranslationRowVersion(
+  db: any,
+  entityType: string,
+  entityId: string,
+  tenantId: string,
+  organizationId: string | null,
+): Promise<{ id: string; updatedAt: Date | string | null } | null> {
+  const row = await db
+    .selectFrom('entity_translations')
+    .select(['id', 'updated_at'])
+    .where('entity_type', '=', entityType)
+    .where('entity_id', '=', entityId)
+    .where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)
+    .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)
+    .executeTakeFirst() as { id: string; updated_at: Date | string | null } | undefined
+  if (!row) return null
+  return { id: row.id, updatedAt: row.updated_at ?? null }
+}
+
 const paramsSchema = z.object({
   entityType: entityTypeParamSchema,
   entityId: entityIdParamSchema,
@@ -100,6 +136,26 @@ export async function PUT(req: Request, ctx: { params?: { entityType?: string; e
       return NextResponse.json(guardResult.body, { status: guardResult.status })
     }
 
+    // Optimistic lock: refuse a stale standalone PUT so a translation save that
+    // started from an out-of-date view cannot silently clobber a concurrent edit.
+    // Strictly additive — no expected-version header → no-op. Skipped when no row
+    // exists yet (first save has no prior version to conflict with).
+    const existingVersion = await loadTranslationRowVersion(
+      context.db as any,
+      entityType,
+      entityId,
+      context.tenantId,
+      context.organizationId,
+    )
+    if (existingVersion) {
+      await enforceCommandOptimisticLockWithGuards(context.container, {
+        resourceKind: TRANSLATION_RESOURCE_KIND,
+        resourceId: existingVersion.id,
+        current: existingVersion.updatedAt,
+        request: req,
+      })
+    }
+
     const commandBus = context.container.resolve('commandBus') as CommandBus
     const { result, logEntry } = await commandBus.execute<
       { entityType: string; entityId: string; translations: typeof translations; organizationId: string | null; tenantId: string },
@@ -200,6 +256,24 @@ export async function DELETE(req: Request, ctx: { params?: { entityType?: string
       return NextResponse.json(guardResult.body, { status: guardResult.status })
     }
 
+    // Optimistic lock: refuse a stale standalone DELETE (same hole as PUT).
+    // Additive — no header → no-op; skipped when no row exists.
+    const existingVersion = await loadTranslationRowVersion(
+      context.db as any,
+      entityType,
+      entityId,
+      context.tenantId,
+      context.organizationId,
+    )
+    if (existingVersion) {
+      await enforceCommandOptimisticLockWithGuards(context.container, {
+        resourceKind: TRANSLATION_RESOURCE_KIND,
+        resourceId: existingVersion.id,
+        current: existingVersion.updatedAt,
+        request: req,
+      })
+    }
+
     const commandBus = context.container.resolve('commandBus') as CommandBus
     const { logEntry } = await commandBus.execute<
       { entityType: string; entityId: string; organizationId: string | null; tenantId: string },

package/src/modules/translations/components/TranslationManager.tsx

@@ -11,6 +11,7 @@ import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'
 import { Save, Plus, X } from 'lucide-react'
@@ -194,6 +195,17 @@ export function TranslationManager({
     },
   })
 
+  // Optimistic lock keys off the TRANSLATION ROW'S OWN version (`updatedAt` from
+  // the GET response), not the host entity's: the host's EAV `entityType`
+  // (`module:entity`) has no reliable server-side mapping to a registered
+  // optimistic-lock reader, so the route enforces against the translation row's
+  // own `updated_at`. `null` for a brand-new translation (no existing row → the
+  // header is omitted and the route enforces nothing on insert).
+  const translationRowUpdatedAt = React.useMemo(() => {
+    const value = translationData?.updatedAt
+    return typeof value === 'string' && value.trim().length > 0 ? value : null
+  }, [translationData])
+
   const translationSignature = React.useMemo(() => JSON.stringify(translationData ?? null), [translationData])
   const lastTranslationSignatureRef = React.useRef<string | null>(null)
 
@@ -258,7 +270,7 @@ export function TranslationManager({
       return runMutation({
         operation: async () => {
           const res = await withScopedApiRequestHeaders(
-            buildOptimisticLockHeader(translationData?.updatedAt),
+            buildOptimisticLockHeader(translationRowUpdatedAt),
             () => apiCall(
               `/api/translations/${encodeURIComponent(entityType)}/${encodeURIComponent(recordId)}`,
               {
@@ -292,6 +304,7 @@ export function TranslationManager({
       void refetchTranslation()
     },
     onError: (err: unknown) => {
+      if (surfaceRecordConflict(err, t)) return
       const message = err instanceof Error ? err.message : t('translations.manager.errors.save', 'Failed to save translations')
       flash(message, 'error')
     },

package/src/modules/workflows/api/definitions/[id]/route.ts

@@ -24,7 +24,7 @@ import { getCodeWorkflow } from '../../../lib/code-registry'
 import { createGenericOptimisticLockReader } from '@open-mercato/shared/lib/crud/optimistic-lock'
 import { registerOptimisticLockReaderIfAbsent } from '@open-mercato/shared/lib/crud/optimistic-lock-store'
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
-import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 registerOptimisticLockReaderIfAbsent({
@@ -201,7 +201,7 @@ export async function PUT(
       let savedOverride: WorkflowDefinition
       if (existingOverride) {
         try {
-          enforceCommandOptimisticLock({
+          await enforceCommandOptimisticLockWithGuards(container, {
             resourceKind: 'workflows.definition',
             resourceId: existingOverride.id,
             current: existingOverride.updatedAt ?? null,
@@ -308,7 +308,7 @@ export async function PUT(
     }
 
     try {
-      enforceCommandOptimisticLock({
+      await enforceCommandOptimisticLockWithGuards(container, {
         resourceKind: 'workflows.definition',
         resourceId: definition.id,
         current: definition.updatedAt ?? null,

package/src/modules/workflows/backend/definitions/[id]/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 
 import * as React from 'react'
-import { useRouter, useParams } from 'next/navigation'
+import { useRouter, useParams, usePathname } from 'next/navigation'
 import { useQuery } from '@tanstack/react-query'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
@@ -10,6 +10,7 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
 import { apiFetch, withScopedApiHeaders } from '@open-mercato/ui/backend/utils/api'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { buildRecordInjectionContext, useSetCurrentRecordInjectionContext } from '@open-mercato/ui/backend/injection/recordContext'
 import { ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
 import { readJsonSafe } from '@open-mercato/ui/backend/utils/serverErrors'
 import { formatWorkflowValidationError } from '../../../lib/format-validation-error'
@@ -35,6 +36,7 @@ import type { WorkflowDefinitionTrigger } from '../../../data/entities'
 export default function EditWorkflowDefinitionPage() {
   const router = useRouter()
   const params = useParams()
+  const pathname = usePathname()
   const t = useT()
   const isMobile = useIsMobile()
 
@@ -221,6 +223,21 @@ export default function EditWorkflowDefinitionPage() {
     router.push(`/backend/definitions/visual-editor?id=${definitionId}`)
   }, [router, definitionId])
 
+  // Publish page-load record context to the AppShell-owned `backend:record:current`
+  // mount so the enterprise record_locks widget resolves `workflows.definition` + id
+  // explicitly. The resourceKind mirrors the save-time `useGuardedMutation` context
+  // and server guard so the held lock matches the conflict surface for the same
+  // definition across both the form and visual editors.
+  useSetCurrentRecordInjectionContext(
+    buildRecordInjectionContext({
+      resourceKind: 'workflows.definition',
+      resourceId: definitionId ?? null,
+      updatedAt: typeof definition?.updatedAt === 'string' ? definition.updatedAt : null,
+      data: (definition ?? null) as Record<string, unknown> | null,
+      path: pathname,
+    }),
+  )
+
   if (isLoading) {
     return (
       <Page>

package/src/modules/workflows/backend/definitions/visual-editor/page.tsx

@@ -8,7 +8,7 @@ import { NodeEditDialogCrudForm } from '../../../components/NodeEditDialogCrudFo
 import { EdgeEditDialogCrudForm } from '../../../components/EdgeEditDialogCrudForm'
 import type { Node, Edge, Connection } from '@xyflow/react'
 import { useState, useCallback, useEffect } from 'react'
-import { useRouter, useSearchParams } from 'next/navigation'
+import { useRouter, useSearchParams, usePathname } from 'next/navigation'
 import { graphToDefinition, definitionToGraph, validateWorkflowGraph, generateStepId, generateTransitionId, appendWorkflowEdge, ValidationError } from '../../../lib/graph-utils'
 import { performDeleteEdgeFlow, performDeleteNodeFlow } from '../../../lib/visual-editor-delete-flow'
 import { workflowDefinitionDataSchema } from '../../../data/validators'
@@ -35,6 +35,7 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
+import { buildRecordInjectionContext, useSetCurrentRecordInjectionContext } from '@open-mercato/ui/backend/injection/recordContext'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { CircleQuestionMark, PanelTopClose, PanelTopOpen, Play, Save, Trash2 } from 'lucide-react'
 import { NODE_TYPE_ICONS, NODE_TYPE_COLORS, NODE_TYPE_LABELS } from '../../../lib/node-type-icons'
@@ -61,6 +62,7 @@ export default function VisualEditorPage() {
   const t = useT()
   const router = useRouter()
   const searchParams = useSearchParams()
+  const pathname = usePathname()
   const definitionId = searchParams.get('id')
   const isMobile = useIsMobile()
 
@@ -617,6 +619,22 @@ export default function VisualEditorPage() {
     flash('Canvas cleared', 'success')
   }, [])
 
+  // Publish page-load record context to the AppShell-owned `backend:record:current`
+  // mount so the enterprise record_locks widget resolves `workflows.definition` + id
+  // explicitly. This is the highest-value record_locks target (long-lived visual
+  // edits): presence holds the lock while the graph is open, and the raw `apiCall`
+  // save already routes its 409 through `surfaceRecordConflict`. Cleared on create
+  // (no `definitionId`) and on unmount. Mirrors the form edit page's resourceKind so
+  // a lock held in either editor surfaces in the other.
+  useSetCurrentRecordInjectionContext(
+    buildRecordInjectionContext({
+      resourceKind: 'workflows.definition',
+      resourceId: definitionId,
+      updatedAt,
+      path: pathname,
+    }),
+  )
+
   // Show loading spinner while loading definition
   if (isLoading) {
     return (