@open-mercato/core 0.6.6-develop.6345.2.b236ea3d4b → 0.6.6-develop.6351.1.c140d703c9

package/src/modules/entities/api/definitions.ts

@@ -24,6 +24,15 @@ import {
   beginEntitiesMutationGuard,
   FIELD_DEFINITION_RESOURCE_KIND,
 } from './definitions.mutation-guard'
+import {
+  createExactDefinitionWhere,
+  createScopedDefinitionTombstone,
+  createVisibleDefinitionWhere,
+  markDefinitionTombstoned,
+  resolveDefinitionScopeFromOrganizationScope,
+  resolveDefinitionMutationScope,
+  selectVisibleDefinitionWinner,
+} from '../lib/definition-scope'
 
 /**
  * Validate defaultValue against the field kind. Returns an error message string
@@ -188,6 +197,19 @@ function normalizeFieldGroup(raw: unknown): { code: string; title?: string; hint
   return group
 }
 
+function definitionMatchesReadScope(
+  definition: { tenantId?: string | null; organizationId?: string | null },
+  scope: { tenantId: string | null; organizationId: string | null },
+) {
+  const definitionTenantId = definition.tenantId ?? null
+  const definitionOrganizationId = definition.organizationId ?? null
+  const tenantMatches = definitionTenantId === null || definitionTenantId === scope.tenantId
+  const organizationMatches =
+    definitionOrganizationId === null ||
+    (scope.organizationId !== null && definitionOrganizationId === scope.organizationId)
+  return tenantMatches && organizationMatches
+}
+
 export async function GET(req: Request) {
   const url = new URL(req.url)
   const requestedEntityIds = parseEntityIds(url)
@@ -207,11 +229,12 @@ export async function GET(req: Request) {
 
   const container = await createRequestContainer()
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const tenantId = scope.tenantId ?? auth.tenantId ?? null
+  const definitionScope = resolveDefinitionScopeFromOrganizationScope(auth, scope)
+  const tenantId = definitionScope.tenantId
   if (!tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
-  const organizationId = scope.selectedId ?? auth.orgId ?? null
+  const organizationId = definitionScope.organizationId
   const { resolve } = container
   const em = resolve('em') as any
   let cache: CacheStrategy | undefined
@@ -273,22 +296,29 @@ export async function GET(req: Request) {
     mode: 'public',
   })
 
-  // Tenant-only scoping: allow global (null) or exact tenant match; do not scope by organization here
+  const tenantCandidates = [{ tenantId }, { tenantId: null as string | null }]
+  const organizationCandidates = [{ organizationId: null as string | null }]
+  if (organizationId) organizationCandidates.unshift({ organizationId })
+  const readScope = { tenantId, organizationId }
+
   const whereActive = {
     entityId: { $in: entityIds as any },
     deletedAt: null,
     $and: [
-      { $or: [ { tenantId: tenantId ?? undefined as any }, { tenantId: null } ] },
+      { $or: tenantCandidates },
+      { $or: organizationCandidates },
     ],
   } as any
-  const defs = await em.find(CustomFieldDef, whereActive as any)
-  const tombstones = await em.find(CustomFieldDef, {
+  const defs = (await em.find(CustomFieldDef, whereActive as any))
+    .filter((definition: any) => definitionMatchesReadScope(definition, readScope))
+  const tombstones = (await em.find(CustomFieldDef, {
     entityId: { $in: entityIds as any },
     deletedAt: { $ne: null } as any,
     $and: [
-      { $or: [ { tenantId: tenantId ?? undefined as any }, { tenantId: null } ] },
+      { $or: tenantCandidates },
+      { $or: organizationCandidates },
     ],
-  } as any)
+  } as any)).filter((definition: any) => definitionMatchesReadScope(definition, readScope))
 
   const tombstonedByEntity = new Map<string, Set<string>>()
   for (const entry of tombstones as any[]) {
@@ -468,6 +498,7 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
+  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })
   const { resolve } = container
   const em = resolve('em') as any
   let cache: CacheStrategy | undefined
@@ -475,7 +506,7 @@ export async function POST(req: Request) {
     cache = resolve('cache') as CacheStrategy
   } catch {}
 
-  const where: any = { entityId: input.entityId, key: input.key, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }
+  const where: any = createExactDefinitionWhere(input.entityId, input.key, scope)
   let def = await em.findOne(CustomFieldDef, where)
 
   const guard = await beginEntitiesMutationGuard({
@@ -512,7 +543,7 @@ export async function POST(req: Request) {
   if (cfg.defaultValue !== undefined && cfg.defaultValue !== null) {
     const validationError = await validateDefaultValueByKind(
       cfg.defaultValue, input.kind, cfg, em,
-      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
     )
     if (validationError) {
       return NextResponse.json({ error: validationError }, { status: 400 })
@@ -521,13 +552,14 @@ export async function POST(req: Request) {
   }
   def.configJson = cfg
   def.isActive = input.isActive ?? true
+  def.deletedAt = def.isActive === false ? (def.deletedAt ?? new Date()) : null
   def.updatedAt = new Date()
   em.persist(def)
   await em.flush()
   await guard.runAfterSuccess()
   await invalidateDefinitionsCache(cache, {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
     entityIds: [input.entityId],
   })
   // Changing field definitions may impact forms but not sidebar items; no nav cache touch
@@ -543,36 +575,48 @@ export async function DELETE(req: Request) {
   if (!entityId || !key) return NextResponse.json({ error: 'entityId and key are required' }, { status: 400 })
 
   const container = await createRequestContainer()
+  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })
   const { resolve } = container
   const em = resolve('em') as any
   let cache: CacheStrategy | undefined
   try {
     cache = resolve('cache') as CacheStrategy
   } catch {}
-  const where: any = { entityId, key, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }
-  const def = await em.findOne(CustomFieldDef, where)
-  if (!def) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  const where: any = createExactDefinitionWhere(entityId, key, scope)
+  let def = await em.findOne(CustomFieldDef, where)
+  let inherited: any | null = null
+  if (!def) {
+    inherited = selectVisibleDefinitionWinner(await em.find(CustomFieldDef, createVisibleDefinitionWhere(
+      entityId,
+      key,
+      scope,
+      { deletedAt: null, isActive: true },
+    )))
+    if (!inherited) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
 
   const guard = await beginEntitiesMutationGuard({
     container,
     auth,
     req,
     resourceKind: FIELD_DEFINITION_RESOURCE_KIND,
-    resourceId: def.id,
+    resourceId: def?.id ?? inherited?.id ?? `${entityId}:${key}`,
     operation: 'delete',
     mutationPayload: { entityId, key },
   })
   if (guard.blockedResponse) return guard.blockedResponse
 
-  def.isActive = false
-  def.updatedAt = new Date()
-  def.deletedAt = def.deletedAt ?? new Date()
+  if (!def) {
+    def = createScopedDefinitionTombstone(em, inherited, scope)
+  } else {
+    markDefinitionTombstoned(def)
+  }
   em.persist(def)
   await em.flush()
   await guard.runAfterSuccess()
   await invalidateDefinitionsCache(cache, {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
     entityIds: [entityId],
   })
   // Changing field definitions may impact forms but not sidebar items; no nav cache touch

package/src/modules/entities/backend/entities/user/[entityId]/page.tsx

@@ -27,6 +27,7 @@ import { normalizeCustomFieldOptions } from '@open-mercato/shared/modules/entiti
 import { TranslationManager } from '@open-mercato/core/modules/translations/components/TranslationManager'
 
 type Def = FieldDefinition
+export type EntitySource = 'code' | 'custom'
 type EntitiesListResponse = { items?: Array<Record<string, unknown>> }
 type FieldsetGroup = { code: string; title?: string; hint?: string }
 type FieldsetDefinition = { code: string; label: string; icon?: string; description?: string; groups?: FieldsetGroup[] }
@@ -43,7 +44,7 @@ export default function EditDefinitionsPage({ params }: { params?: { entityId?:
   const queryClient = useQueryClient()
   const entityId = useMemo(() => decodeURIComponent((params?.entityId as any) || ''), [params])
   const [label, setLabel] = useState('')
-  const [entitySource, setEntitySource] = useState<'code'|'custom'>('custom')
+  const [entitySource, setEntitySource] = useState<EntitySource>('custom')
   const [entityFormLoading, setEntityFormLoading] = useState(true)
   const [entityInitial, setEntityInitial] = useState<{ label?: string; description?: string; labelField?: string; defaultEditor?: string; showInSidebar?: boolean; updatedAt?: string }>({})
   const [defs, setDefs] = useState<Def[]>([])
@@ -391,13 +392,15 @@ export default function EditDefinitionsPage({ params }: { params?: { entityId?:
       showInSidebar: z.boolean().optional(),
     }) as z.ZodType<Record<string, unknown>>
 
+  const metadataFieldsReadOnly = entitySource === 'code'
   const fields: CrudField[] = [
-    { id: 'label', label: 'Label', type: 'text', required: true },
-    { id: 'description', label: 'Description', type: 'textarea' },
+    { id: 'label', label: 'Label', type: 'text', required: true, readOnly: metadataFieldsReadOnly },
+    { id: 'description', label: 'Description', type: 'textarea', readOnly: metadataFieldsReadOnly },
     {
       id: 'defaultEditor',
       label: 'Default Editor (multiline)',
       type: 'select',
+      readOnly: metadataFieldsReadOnly,
       options: [
         { value: '', label: 'Default (Markdown)' },
         { value: 'markdown', label: 'Markdown (UIW)' },
@@ -493,17 +496,12 @@ export default function EditDefinitionsPage({ params }: { params?: { entityId?:
       }
       try { window.dispatchEvent(new Event('om:refresh-sidebar')) } catch {}
     }
-    const defsPayload = {
+    const defsPayload = buildDefinitionsBatchPayload({
       entityId,
-      definitions: defs.filter((d) => !!d.key).map((d) => ({
-        key: d.key,
-        kind: d.kind,
-        configJson: d.configJson,
-        isActive: d.isActive !== false,
-      })),
+      defs,
       fieldsets: buildFieldsetPayload(),
       singleFieldsetPerRecord,
-    }
+    })
     const callDefs = await apiCall('/api/entities/definitions.batch', {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -607,12 +605,31 @@ export default function EditDefinitionsPage({ params }: { params?: { entityId?:
   )
 }
 
-export function shouldRegisterEntityMetadata(entitySource: 'code' | 'custom'): boolean {
+export function shouldRegisterEntityMetadata(entitySource: EntitySource): boolean {
   return entitySource === 'custom'
 }
 
+export function buildDefinitionsBatchPayload(options: {
+  entityId: string
+  defs: Array<Pick<Def, 'key' | 'kind' | 'configJson' | 'isActive'>>
+  fieldsets: FieldsetDefinition[]
+  singleFieldsetPerRecord: boolean
+}) {
+  return {
+    entityId: options.entityId,
+    definitions: options.defs.filter((d) => !!d.key).map((d) => ({
+      key: d.key,
+      kind: d.kind,
+      configJson: d.configJson,
+      isActive: d.isActive !== false,
+    })),
+    fieldsets: options.fieldsets,
+    singleFieldsetPerRecord: options.singleFieldsetPerRecord,
+  }
+}
+
 export function buildEntityMetadataPayload(
-  entitySource: 'code' | 'custom',
+  entitySource: EntitySource,
   vals: Record<string, unknown>,
 ): Record<string, unknown> | null {
   const partial = entitySource === 'custom'

package/src/modules/entities/lib/definition-scope.ts

@@ -0,0 +1,172 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'
+
+type AuthScope = {
+  tenantId?: string | null
+  orgId?: string | null
+}
+
+export type DefinitionMutationScope = {
+  tenantId: string | null
+  organizationId: string | null
+}
+
+type OrganizationScopeLike = {
+  tenantId?: string | null
+  selectedId?: string | null
+}
+
+type DefinitionKeySelector = string | { $in: string[] }
+
+type DefinitionVisibilityOptions = {
+  deletedAt?: null | { $ne: null }
+  isActive?: boolean
+}
+
+type DefinitionScopeRecord = {
+  tenantId?: string | null
+  organizationId?: string | null
+  updatedAt?: Date | string | number | null
+  createdAt?: Date | string | number | null
+}
+
+type MutableDefinitionScopeRecord = DefinitionScopeRecord & {
+  isActive?: boolean
+  deletedAt?: Date | string | number | null
+}
+
+export function resolveDefinitionScopeFromOrganizationScope(
+  auth: AuthScope,
+  scope: OrganizationScopeLike,
+): DefinitionMutationScope {
+  const authTenantId = auth.tenantId ?? null
+  const scopeTenantId = scope.tenantId ?? null
+  const tenantMismatch = Boolean(authTenantId && scopeTenantId && authTenantId !== scopeTenantId)
+
+  return {
+    tenantId: tenantMismatch ? authTenantId : (scopeTenantId ?? authTenantId),
+    organizationId: tenantMismatch
+      ? (auth.orgId ?? null)
+      : (scope.selectedId ?? auth.orgId ?? null),
+  }
+}
+
+export async function resolveDefinitionMutationScope({
+  auth,
+  container,
+  request,
+}: {
+  auth: AuthScope
+  container: unknown
+  request: Request
+}): Promise<DefinitionMutationScope> {
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request } as any)
+  return resolveDefinitionScopeFromOrganizationScope(auth, scope)
+}
+
+export function createExactDefinitionWhere(
+  entityId: string,
+  key: DefinitionKeySelector,
+  scope: DefinitionMutationScope,
+) {
+  return {
+    entityId,
+    key,
+    organizationId: scope.organizationId,
+    tenantId: scope.tenantId,
+  }
+}
+
+export function createVisibleDefinitionWhere(
+  entityId: string,
+  key: DefinitionKeySelector,
+  scope: DefinitionMutationScope,
+  options: DefinitionVisibilityOptions = {},
+) {
+  const organizationCandidates = [{ organizationId: null as string | null }]
+  if (scope.organizationId) organizationCandidates.unshift({ organizationId: scope.organizationId })
+
+  const tenantCandidates = [{ tenantId: null as string | null }]
+  if (scope.tenantId) tenantCandidates.unshift({ tenantId: scope.tenantId })
+
+  return {
+    entityId,
+    key,
+    ...options,
+    $and: [
+      { $or: organizationCandidates },
+      { $or: tenantCandidates },
+    ],
+  }
+}
+
+function definitionTimestamp(def: DefinitionScopeRecord) {
+  const updatedAt = def?.updatedAt instanceof Date
+    ? def.updatedAt.getTime()
+    : (def?.updatedAt ? new Date(def.updatedAt).getTime() : 0)
+  if (updatedAt) return updatedAt
+  return def?.createdAt instanceof Date
+    ? def.createdAt.getTime()
+    : (def?.createdAt ? new Date(def.createdAt).getTime() : 0)
+}
+
+function definitionScopeScore(def: DefinitionScopeRecord) {
+  return (def?.tenantId ? 2 : 0) + (def?.organizationId ? 1 : 0)
+}
+
+export function selectVisibleDefinitionWinner<T extends DefinitionScopeRecord>(definitions: T[]) {
+  let winner: T | null = null
+  for (const definition of definitions) {
+    if (!winner) {
+      winner = definition
+      continue
+    }
+    const nextScore = definitionScopeScore(definition)
+    const winnerScore = definitionScopeScore(winner)
+    if (nextScore > winnerScore) {
+      winner = definition
+      continue
+    }
+    if (nextScore < winnerScore) continue
+    if (definitionTimestamp(definition) >= definitionTimestamp(winner)) winner = definition
+  }
+  return winner
+}
+
+export function markDefinitionTombstoned<T extends MutableDefinitionScopeRecord>(definition: T, now = new Date()) {
+  definition.isActive = false
+  definition.deletedAt = definition.deletedAt ?? now
+  definition.updatedAt = now
+  return definition
+}
+
+function cloneConfigJson(configJson: unknown) {
+  if (configJson == null) return configJson
+  return JSON.parse(JSON.stringify(configJson))
+}
+
+export function createScopedDefinitionTombstone(
+  em: Pick<EntityManager, 'create'>,
+  source: {
+    entityId: string
+    key: string
+    kind: string
+    configJson?: unknown
+  },
+  scope: DefinitionMutationScope,
+  now = new Date(),
+) {
+  return em.create(CustomFieldDef, {
+    entityId: source.entityId,
+    key: source.key,
+    kind: source.kind,
+    configJson: cloneConfigJson(source.configJson) ?? {},
+    organizationId: scope.organizationId,
+    tenantId: scope.tenantId,
+    isActive: false,
+    createdAt: now,
+    updatedAt: now,
+    deletedAt: now,
+  })
+}