@open-mercato/core 0.6.6 → 0.6.7-develop.6552.1.5208a19369

package/src/modules/customers/components/detail/DetailTabsLayout.tsx

@@ -3,6 +3,7 @@
 import * as React from 'react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { cn } from '@open-mercato/shared/lib/utils'
 import { Plus } from 'lucide-react'
 
@@ -46,31 +47,19 @@ export function DetailTabsLayout<TId extends string = string>({
   return (
     <div className={cn('space-y-4', className)}>
       <div className={cn('flex flex-wrap items-center justify-between gap-3', headerClassName)}>
-        <nav
-          className={cn('flex flex-wrap items-center gap-3 text-sm', navClassName)}
-          role="tablist"
-          aria-label={navAriaLabel}
+        <Tabs
+          value={activeTab}
+          onValueChange={(value) => handleTabChange(value as TId)}
+          variant="underline"
         >
-          {tabs.map((tab) => (
-            <Button
-              key={tab.id}
-              type="button"
-              variant="ghost"
-              size="sm"
-              role="tab"
-              aria-selected={activeTab === tab.id}
-              onClick={() => handleTabChange(tab.id)}
-              className={cn(
-                'h-auto rounded-none border-b-2 px-0 py-1',
-                activeTab === tab.id
-                  ? 'border-accent-indigo text-foreground hover:bg-transparent'
-                  : 'border-transparent text-muted-foreground hover:text-foreground hover:bg-transparent'
-              )}
-            >
-              {tab.label}
-            </Button>
-          ))}
-        </nav>
+          <TabsList className={cn('h-auto flex-wrap border-b-0', navClassName)} aria-label={navAriaLabel}>
+            {tabs.map((tab) => (
+              <TabsTrigger key={tab.id} value={tab.id}>
+                {tab.label}
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
         {sectionAction ? (
           <Button
             type="button"

package/src/modules/customers/components/detail/MobilePersonDetail.tsx

@@ -3,8 +3,7 @@
 import * as React from 'react'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { cn } from '@open-mercato/shared/lib/utils'
-import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 export type MobilePersonZone = 'details' | 'activity'
 
@@ -80,35 +79,30 @@ export function MobilePersonDetail({
 
   return (
     <div className="space-y-4">
-      <div
-        role="tablist"
-        aria-label={t(
-          'customers.people.mobile.zoneSwitcher.ariaLabel',
-          'Zone selector',
-        )}
-        className="grid grid-cols-2 gap-1 rounded-lg border border-border/70 bg-muted/20 p-1"
-        onKeyDown={handleKeyDown}
-      >
-        {ZONES.map((entry) => {
-          const isActive = zone === entry.id
-          return (
-            <Button
-              key={entry.id}
-              type="button"
-              role="tab"
-              aria-selected={isActive}
-              aria-controls={`mobile-person-zone-${entry.id}`}
-              variant={isActive ? 'default' : 'ghost'}
-              className={cn(
-                'h-11 rounded-lg text-sm font-semibold',
-                isActive ? '' : 'text-muted-foreground',
-              )}
-              onClick={() => handleZoneChange(entry.id)}
-            >
-              {t(entry.labelKey, entry.fallback)}
-            </Button>
-          )
-        })}
+      <div onKeyDown={handleKeyDown}>
+        <Tabs
+          value={zone}
+          onValueChange={(value) => handleZoneChange(value as MobilePersonZone)}
+          variant="underline"
+        >
+          <TabsList
+            aria-label={t(
+              'customers.people.mobile.zoneSwitcher.ariaLabel',
+              'Zone selector',
+            )}
+            className="w-full"
+          >
+            {ZONES.map((entry) => (
+              <TabsTrigger
+                key={entry.id}
+                value={entry.id}
+                className="flex-1 justify-center"
+              >
+                {t(entry.labelKey, entry.fallback)}
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
       </div>
       <div
         id={`mobile-person-zone-${zone}`}

package/src/modules/customers/components/detail/PersonDetailTabs.tsx

@@ -1,9 +1,9 @@
 "use client"
 
 import * as React from 'react'
-import { cn } from '@open-mercato/shared/lib/utils'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import {
   SquareCheckBig,
   Mail,
@@ -32,7 +32,7 @@ type TabDef = {
   id: PersonTabId
   label: string
   icon?: React.ReactNode
-  badge?: React.ReactNode
+  count?: React.ReactNode
 }
 
 type PersonDetailTabsProps = {
@@ -56,21 +56,9 @@ export function resolveLegacyTab(tab: string | null | undefined): PersonTabId {
   return SUPPORTED_TAB_IDS.has(tab as PersonTabId) ? (tab as PersonTabId) : 'activities'
 }
 
-function CountBadge({ count }: { count: number }) {
-  if (count <= 0) return null
-  return (
-    <span className="ml-1 rounded-full bg-muted px-1.5 py-0.5 text-xs font-medium leading-none text-muted-foreground">
-      {count > 999 ? '999+' : count}
-    </span>
-  )
-}
-
-function NewBadge() {
-  return (
-    <span className="ml-1.5 rounded bg-foreground px-1.5 py-0.5 text-overline font-semibold leading-none text-background">
-      NEW
-    </span>
-  )
+function formatTabCount(count: number): string | number | undefined {
+  if (count <= 0) return undefined
+  return count > 999 ? '999+' : count
 }
 
 export function PersonDetailTabs({
@@ -94,7 +82,7 @@ export function PersonDetailTabs({
         id: 'activities',
         label: t('customers.people.detail.tabs.activities', 'Activities'),
         icon: <SquareCheckBig className="size-4" />,
-        badge: <CountBadge count={activitiesCount} />,
+        count: formatTabCount(activitiesCount),
       },
       {
         id: 'emails',
@@ -105,37 +93,37 @@ export function PersonDetailTabs({
         id: 'deals',
         label: t('customers.people.detail.tabs.deals', 'Deals'),
         icon: <Briefcase className="size-4" />,
-        badge: <CountBadge count={dealsCount} />,
+        count: formatTabCount(dealsCount),
       },
       {
         id: 'companies',
         label: t('customers.people.detail.tabs.companies', 'Companies'),
         icon: <Building2 className="size-4" />,
-        badge: <CountBadge count={companiesCount} />,
+        count: formatTabCount(companiesCount),
       },
       {
         id: 'addresses',
         label: t('customers.people.detail.tabs.addresses', 'Addresses'),
         icon: <MapPin className="size-4" />,
-        badge: <CountBadge count={addressesCount} />,
+        count: formatTabCount(addressesCount),
       },
       {
         id: 'tasks',
         label: t('customers.people.detail.tabs.tasks', 'Tasks'),
         icon: <Check className="size-4" />,
-        badge: <CountBadge count={tasksCount} />,
+        count: formatTabCount(tasksCount),
       },
       {
         id: 'changelog',
         label: t('customers.people.detail.tabs.changelog', 'Change log'),
         icon: <History className="size-4" />,
-        badge: <NewBadge />,
+        count: 'NEW',
       },
       {
         id: 'files',
         label: t('customers.people.detail.tabs.files', 'Files'),
         icon: <Paperclip className="size-4" />,
-        badge: <CountBadge count={filesCount} />,
+        count: formatTabCount(filesCount),
       },
     ],
     [t, activitiesCount, dealsCount, companiesCount, addressesCount, tasksCount, filesCount],
@@ -155,33 +143,24 @@ export function PersonDetailTabs({
   return (
     <div>
       {/* Tab navigation — full width above both zones */}
-      <div className="flex items-end justify-between gap-2 border-b" role="tablist" aria-label={t('customers.people.detail.tabs.label', 'Person detail sections')}>
-        <nav className="-mb-px flex flex-1 gap-1 overflow-x-auto px-1">
-          {allTabs.map((tab) => {
-            const isActive = activeTab === tab.id
-            return (
-              <Button
-                key={tab.id}
-                type="button"
-                variant="ghost"
-                size="sm"
-                role="tab"
-                aria-selected={isActive}
-                onClick={() => onTabChange(tab.id)}
-                className={cn(
-                  'h-auto shrink-0 rounded-none border-b-2 px-3 py-2.5 hover:bg-transparent',
-                  isActive
-                    ? 'border-foreground text-foreground font-semibold'
-                    : 'border-transparent text-muted-foreground hover:text-foreground',
-                )}
-              >
-                {tab.icon && <span className="mr-1.5">{tab.icon}</span>}
+      <div className="flex items-end justify-between gap-2 border-b">
+        <Tabs
+          value={activeTab}
+          onValueChange={(value) => onTabChange(value as PersonTabId)}
+          variant="underline"
+          className="min-w-0 flex-1"
+        >
+          <TabsList
+            aria-label={t('customers.people.detail.tabs.label', 'Person detail sections')}
+            className="-mb-px w-full overflow-x-auto border-b-0 px-1"
+          >
+            {allTabs.map((tab) => (
+              <TabsTrigger key={tab.id} value={tab.id} leading={tab.icon} count={tab.count}>
                 {tab.label}
-                {tab.badge}
-              </Button>
-            )
-          })}
-        </nav>
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
         {sectionAction ? (
           <Button
             type="button"

package/src/modules/customers/components/detail/useDealsAccess.ts

@@ -0,0 +1,19 @@
+"use client"
+
+import * as React from 'react'
+import { useBackendChrome } from '@open-mercato/ui/backend/BackendChromeProvider'
+import { hasFeature } from '@open-mercato/shared/security/features'
+
+export type DealsAccess = {
+  canViewDeals: boolean
+  isReady: boolean
+}
+
+export function useDealsAccess(): DealsAccess {
+  const { payload, isReady } = useBackendChrome()
+  const canViewDeals = React.useMemo(
+    () => hasFeature(payload?.grantedFeatures ?? [], 'customers.deals.view'),
+    [payload?.grantedFeatures],
+  )
+  return { canViewDeals, isReady }
+}

package/src/modules/dashboards/api/roles/widgets/route.ts

@@ -6,7 +6,10 @@ import { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { roleWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
-import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
+import {
+  resolveWidgetAssignmentReadScope,
+  resolveWidgetAssignmentTargetAccess,
+} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
@@ -70,7 +73,15 @@ export async function GET(req: Request) {
   })
 
   const role = await em.findOne(Role, { id: roleId, deletedAt: null })
-  if (!role || (tenantId && role.tenantId !== tenantId)) {
+  const access = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: role,
+  })
+  if (access === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (access === 'not-found') {
     return NextResponse.json({ error: 'Role not found' }, { status: 404 })
   }
 
@@ -121,7 +132,15 @@ export async function PUT(req: Request) {
   const organizationId = auth.orgId ?? null
 
   const role = await em.findOne(Role, { id: parsed.data.roleId, deletedAt: null })
-  if (!role || (tenantId && role.tenantId !== tenantId)) {
+  const access = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: role,
+  })
+  if (access === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (access === 'not-found') {
     return NextResponse.json({ error: 'Role not found' }, { status: 404 })
   }
 

package/src/modules/dashboards/api/users/widgets/route.ts

@@ -7,7 +7,10 @@ import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { userWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
-import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
+import {
+  resolveWidgetAssignmentReadScope,
+  resolveWidgetAssignmentTargetAccess,
+} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
@@ -53,7 +56,15 @@ export async function GET(req: Request) {
   })
 
   const targetUserForRead = await em.findOne(User, { id: userId, deletedAt: null })
-  if (!targetUserForRead || (tenantId && (targetUserForRead.tenantId ?? null) !== tenantId)) {
+  const readAccess = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: targetUserForRead,
+  })
+  if (readAccess === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (readAccess === 'not-found') {
     return NextResponse.json({ error: 'User not found' }, { status: 404 })
   }
 
@@ -121,7 +132,15 @@ export async function PUT(req: Request) {
   const organizationId = auth.orgId ?? null
 
   const targetUser = await em.findOne(User, { id: parsed.data.userId, deletedAt: null })
-  if (!targetUser || (tenantId && (targetUser.tenantId ?? null) !== tenantId)) {
+  const writeAccess = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: targetUser,
+  })
+  if (writeAccess === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (writeAccess === 'not-found') {
     return NextResponse.json({ error: 'User not found' }, { status: 404 })
   }
 

package/src/modules/dashboards/cli.ts

@@ -6,6 +6,7 @@ import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { seedAnalyticsData } from './seed/analytics'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 type Args = Record<string, string>
 
@@ -108,10 +109,7 @@ const seedDefaults: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to seed.')
@@ -125,7 +123,7 @@ const seedDefaults: ModuleCli = {
       tenantId,
       organizationId,
       roleNames,
-      widgetIds: widgetCsv ? widgetCsv.split(',').map((id) => id.trim()).filter(Boolean) : undefined,
+      widgetIds: widgetCsv ? parseCommaSeparatedList(widgetCsv) : undefined,
       logger: (message) => console.log(message),
     })
   },
@@ -143,10 +141,7 @@ const enableAnalyticsWidgets: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to update.')

package/src/modules/dashboards/lib/widgetAssignmentScope.ts

@@ -8,6 +8,24 @@ export type ResolvedAssignmentScope = {
   organizationId: string | null
 }
 
+export type WidgetAssignmentTarget = {
+  tenantId?: string | null
+}
+
+export type WidgetAssignmentTargetAccess = 'allowed' | 'forbidden' | 'not-found'
+
+export function resolveWidgetAssignmentTargetAccess(params: {
+  isSuperAdmin: boolean
+  scopeTenantId: string | null
+  target: WidgetAssignmentTarget | null | undefined
+}): WidgetAssignmentTargetAccess {
+  const { isSuperAdmin, scopeTenantId, target } = params
+  if (!isSuperAdmin && !scopeTenantId) return 'forbidden'
+  if (!target) return 'not-found'
+  if (scopeTenantId && (target.tenantId ?? null) !== scopeTenantId) return 'not-found'
+  return 'allowed'
+}
+
 export function resolveWidgetAssignmentReadScope(params: {
   auth: AuthScopeInput
   isSuperAdmin: boolean

package/src/modules/dictionaries/commands/entries.ts

@@ -4,22 +4,13 @@ import {
   dictionaryEntryCommandCreateSchema,
   dictionaryEntryCommandUpdateSchema,
 } from '@open-mercato/core/modules/dictionaries/data/validators'
-import { registerDictionaryEntryCommands } from '@open-mercato/core/modules/dictionaries/commands/factory'
-import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import {
+  ensureDictionaryEntryScope,
+  registerDictionaryEntryCommands,
+} from '@open-mercato/core/modules/dictionaries/commands/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
-function ensureScope(ctx: CommandRuntimeContext, scope: { tenantId: string; organizationId: string }): void {
-  const tenantId = ctx.auth?.tenantId ?? null
-  if (tenantId && tenantId !== scope.tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
-  if (organizationId && organizationId !== scope.organizationId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
 async function ensureDictionary(em: EntityManager, id: string): Promise<Dictionary> {
   const dictionary = await em.findOne(Dictionary, {
     id,
@@ -37,12 +28,12 @@ registerDictionaryEntryCommands({
   translationKeyPrefix: 'dictionaries.entries',
   createSchema: dictionaryEntryCommandCreateSchema,
   updateSchema: dictionaryEntryCommandUpdateSchema,
-  ensureScope,
+  ensureScope: ensureDictionaryEntryScope,
   duplicateError: 'An entry with this value already exists.',
   resolveDictionaryForCreate: async ({ em, ctx, parsed }) => {
     const dictionary = await ensureDictionary(em, parsed.dictionaryId)
     const scope = { tenantId: dictionary.tenantId, organizationId: dictionary.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     return { dictionary, scope }
   },
   resolveEntry: async ({ em, ctx, id }) => {
@@ -54,7 +45,7 @@ registerDictionaryEntryCommands({
       throw new CrudHttpError(404, { error: 'Dictionary not found' })
     }
     const scope = { tenantId: entry.tenantId, organizationId: entry.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     return { entry, dictionary: entry.dictionary, scope }
   },
   ensureDictionaryForUndo: async ({ em, snapshot }) => {

package/src/modules/dictionaries/commands/entry-operations.ts

@@ -6,7 +6,8 @@ import {
   type ReorderDictionaryEntriesCommandInput,
   type SetDefaultDictionaryEntryCommandInput,
 } from '@open-mercato/core/modules/dictionaries/data/validators'
-import { registerCommand, type CommandHandler, type CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { ensureDictionaryEntryScope } from '@open-mercato/core/modules/dictionaries/commands/factory'
+import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { emitCrudSideEffects, emitCrudUndoSideEffects } from '@open-mercato/shared/lib/commands/helpers'
@@ -36,17 +37,6 @@ const dictionaryCrudEvents: CrudEventsConfig = {
   }),
 }
 
-function ensureScope(ctx: CommandRuntimeContext, scope: DictionaryScope): void {
-  const tenantId = ctx.auth?.tenantId ?? null
-  if (tenantId && tenantId !== scope.tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
-  if (organizationId && organizationId !== scope.organizationId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
 async function requireDictionary(
   em: EntityManager,
   id: string,
@@ -84,7 +74,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
   async prepare(rawInput, ctx) {
     const parsed = reorderDictionaryEntriesCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const ids = parsed.entries.map((e) => e.id)
     const existing = await findWithDecryption(
@@ -108,7 +98,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = reorderDictionaryEntriesCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
@@ -201,7 +191,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
     const undo = extractUndoPayload<ReorderUndoPayload>(logEntry)
     const before = undo?.before ?? (logEntry?.snapshotBefore as ReorderSnapshot | null | undefined) ?? null
     if (!before) return
-    ensureScope(ctx, before.scope)
+    ensureDictionaryEntryScope(ctx, before.scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const ids = before.positions.map((p) => p.id)
@@ -265,7 +255,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
   async prepare(rawInput, ctx) {
     const parsed = setDefaultDictionaryEntryCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
     const previousDefaults = await findWithDecryption(
@@ -291,7 +281,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = setDefaultDictionaryEntryCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
@@ -399,7 +389,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
     const undo = extractUndoPayload<DefaultUndoPayload>(logEntry)
     const before = undo?.before ?? (logEntry?.snapshotBefore as DefaultSnapshot | null | undefined) ?? null
     if (!before) return
-    ensureScope(ctx, before.scope)
+    ensureDictionaryEntryScope(ctx, before.scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, before.dictionaryId, before.scope)

package/src/modules/dictionaries/commands/factory.ts

@@ -12,6 +12,7 @@ import {
 } from '@open-mercato/shared/lib/commands'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { buildChanges, requireId } from '@open-mercato/shared/lib/commands/helpers'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { z } from 'zod'
@@ -22,6 +23,11 @@ type DictionaryScope = {
   organizationId: string
 }
 
+export function ensureDictionaryEntryScope(ctx: CommandRuntimeContext, scope: DictionaryScope): void {
+  ensureTenantScope(ctx, scope.tenantId)
+  ensureOrganizationScope(ctx, scope.organizationId)
+}
+
 export type DictionaryEntrySnapshot = {
   id: string
   dictionaryId: string
@@ -87,8 +93,8 @@ export type DictionaryEntryCommandConfig<TCreate, TUpdate> = {
   labels?: DictionaryEntryCommandLabels
 }
 
-function toScopeEnsurer(fn: EnsureScopeFn | undefined): EnsureScopeFn {
-  return typeof fn === 'function' ? fn : () => {}
+export function toScopeEnsurer(fn: EnsureScopeFn | undefined): EnsureScopeFn {
+  return typeof fn === 'function' ? fn : ensureDictionaryEntryScope
 }
 
 async function loadSnapshot(em: EntityManager, id: string): Promise<DictionaryEntrySnapshot | null> {