@open-mercato/core 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/modules/customers/components/detail/CompanyDetailTabs.tsx

@@ -1,10 +1,9 @@
 "use client"
 
 import * as React from 'react'
-import { cn } from '@open-mercato/shared/lib/utils'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Badge } from '@open-mercato/ui/primitives/badge'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import {
   Users,
   Handshake,
@@ -14,6 +13,7 @@ import {
   Plus,
 } from 'lucide-react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
+import { useDealsAccess } from './useDealsAccess'
 
 export type CompanyTabId =
   | 'people'
@@ -27,7 +27,7 @@ type TabDef = {
   id: CompanyTabId
   label: string
   icon?: React.ReactNode
-  badge?: React.ReactNode
+  count?: React.ReactNode
 }
 
 type CompanyDetailTabsProps = {
@@ -58,21 +58,9 @@ export function resolveLegacyTab(tab: string | null | undefined): CompanyTabId {
   return tab as CompanyTabId
 }
 
-function NewBadge() {
-  return (
-    <span className="ml-1.5 rounded bg-foreground px-1.5 py-0.5 text-overline font-semibold leading-none text-background">
-      NEW
-    </span>
-  )
-}
-
-function CountBadge({ count }: { count: number }) {
-  if (count <= 0) return null
-  return (
-    <span className="ml-1.5 rounded-full bg-muted px-1.5 py-0.5 text-xs font-medium leading-none text-muted-foreground">
-      {count > 999 ? '999+' : count}
-    </span>
-  )
+function formatTabCount(count: number): string | number | undefined {
+  if (count <= 0) return undefined
+  return count > 999 ? '999+' : count
 }
 
 export function CompanyDetailTabs({
@@ -87,6 +75,7 @@ export function CompanyDetailTabs({
   children,
 }: CompanyDetailTabsProps) {
   const t = useT()
+  const { canViewDeals } = useDealsAccess()
 
   const builtInTabs: TabDef[] = React.useMemo(
     () => [
@@ -94,34 +83,38 @@ export function CompanyDetailTabs({
         id: 'people',
         label: t('customers.companies.detail.tabs.people', 'People'),
         icon: <Users className="size-4" />,
-        badge: <CountBadge count={peopleCount} />,
-      },
-      {
-        id: 'deals',
-        label: t('customers.companies.detail.tabs.deals', 'Deals'),
-        icon: <Handshake className="size-4" />,
-        badge: <CountBadge count={dealsCount} />,
+        count: formatTabCount(peopleCount),
       },
+      ...(canViewDeals
+        ? [
+            {
+              id: 'deals' as CompanyTabId,
+              label: t('customers.companies.detail.tabs.deals', 'Deals'),
+              icon: <Handshake className="size-4" />,
+              count: formatTabCount(dealsCount),
+            },
+          ]
+        : []),
       {
         id: 'activity-log',
         label: t('customers.companies.detail.tabs.activityLog', 'Activity log'),
         icon: <Clock className="size-4" />,
-        badge: <CountBadge count={activitiesCount} />,
+        count: formatTabCount(activitiesCount),
       },
       {
         id: 'changelog',
         label: t('customers.companies.detail.tabs.changelog', 'Changelog'),
         icon: <History className="size-4" />,
-        badge: <NewBadge />,
+        count: 'NEW',
       },
       {
         id: 'files',
         label: t('customers.companies.detail.tabs.files', 'Files'),
         icon: <Paperclip className="size-4" />,
-        badge: <CountBadge count={filesCount} />,
+        count: formatTabCount(filesCount),
       },
     ],
-    [t, peopleCount, dealsCount, activitiesCount, filesCount],
+    [t, canViewDeals, peopleCount, dealsCount, activitiesCount, filesCount],
   )
 
   const allTabs: TabDef[] = React.useMemo(
@@ -138,33 +131,24 @@ export function CompanyDetailTabs({
   return (
     <div>
       {/* Tab navigation */}
-      <div className="flex items-end justify-between gap-2 border-b" role="tablist" aria-label={t('customers.companies.detail.tabs.label', 'Company detail sections')}>
-        <nav className="-mb-px flex flex-1 gap-1 overflow-x-auto px-1">
-          {allTabs.map((tab) => {
-            const isActive = activeTab === tab.id
-            return (
-              <Button
-                key={tab.id}
-                type="button"
-                variant="ghost"
-                size="sm"
-                role="tab"
-                aria-selected={isActive}
-                onClick={() => onTabChange(tab.id)}
-                className={cn(
-                  'h-auto shrink-0 rounded-none border-b-2 px-3 py-2.5 hover:bg-transparent',
-                  isActive
-                    ? 'border-foreground text-foreground font-semibold'
-                    : 'border-transparent text-muted-foreground hover:text-foreground',
-                )}
-              >
-                {tab.icon && <span className="mr-1.5">{tab.icon}</span>}
+      <div className="flex items-end justify-between gap-2 border-b">
+        <Tabs
+          value={activeTab}
+          onValueChange={(value) => onTabChange(value as CompanyTabId)}
+          variant="underline"
+          className="min-w-0 flex-1"
+        >
+          <TabsList
+            aria-label={t('customers.companies.detail.tabs.label', 'Company detail sections')}
+            className="-mb-px w-full overflow-x-auto border-b-0 px-1"
+          >
+            {allTabs.map((tab) => (
+              <TabsTrigger key={tab.id} value={tab.id} leading={tab.icon} count={tab.count}>
                 {tab.label}
-                {tab.badge}
-              </Button>
-            )
-          })}
-        </nav>
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
         {sectionAction ? (
           <Button
             type="button"

package/src/modules/customers/components/detail/DealDetailTabs.tsx

@@ -2,9 +2,8 @@
 
 import * as React from 'react'
 import { Activity, Building2, History, NotebookPen, Paperclip, Users } from 'lucide-react'
-import { cn } from '@open-mercato/shared/lib/utils'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 export type DealTabId =
   | 'activities'
@@ -19,7 +18,7 @@ type TabDef = {
   id: DealTabId
   label: string
   icon?: React.ReactNode
-  badge?: React.ReactNode
+  count?: React.ReactNode
 }
 
 type DealDetailTabsProps = {
@@ -38,21 +37,9 @@ export function resolveLegacyTab(tab: string | null | undefined): DealTabId {
   return SUPPORTED_TAB_IDS.has(tab as DealTabId) ? (tab as DealTabId) : 'activities'
 }
 
-function CountBadge({ count }: { count: number }) {
-  if (count <= 0) return null
-  return (
-    <span className="ml-1.5 rounded-sm bg-muted px-1.5 py-px text-xs font-semibold leading-none text-muted-foreground">
-      {count > 999 ? '999+' : count}
-    </span>
-  )
-}
-
-function NewBadge() {
-  return (
-    <span className="ml-1.5 rounded-sm bg-muted px-1.5 py-px text-xs font-semibold leading-none text-muted-foreground">
-      NEW
-    </span>
-  )
+function formatTabCount(count: number): string | number | undefined {
+  if (count <= 0) return undefined
+  return count > 999 ? '999+' : count
 }
 
 export function DealDetailTabs({
@@ -76,13 +63,13 @@ export function DealDetailTabs({
         id: 'people',
         label: t('customers.deals.detail.tabs.people', 'People'),
         icon: <Users className="size-4" />,
-        badge: <CountBadge count={peopleCount} />,
+        count: formatTabCount(peopleCount),
       },
       {
         id: 'companies',
         label: t('customers.deals.detail.tabs.companies', 'Companies'),
         icon: <Building2 className="size-4" />,
-        badge: <CountBadge count={companiesCount} />,
+        count: formatTabCount(companiesCount),
       },
       {
         id: 'notes',
@@ -98,7 +85,7 @@ export function DealDetailTabs({
         id: 'changelog',
         label: t('customers.deals.detail.tabs.changelog', 'Changelog'),
         icon: <History className="size-4" />,
-        badge: <NewBadge />,
+        count: 'NEW',
       },
     ],
     [companiesCount, peopleCount, t],
@@ -117,34 +104,22 @@ export function DealDetailTabs({
 
   return (
     <div>
-      <div className="border-b border-border" role="tablist" aria-label={t('customers.deals.detail.tabs.label', 'Deal detail sections')}>
-        <nav className="-mb-px flex gap-7 overflow-x-auto" role="presentation">
-          {allTabs.map((tab) => {
-            const isActive = activeTab === tab.id
-            return (
-              <Button
-                key={tab.id}
-                type="button"
-                variant="ghost"
-                size="sm"
-                role="tab"
-                aria-selected={isActive}
-                onClick={() => onTabChange(tab.id)}
-                className={cn(
-                  'h-auto shrink-0 rounded-none border-b-2 px-3 py-2.5 hover:bg-transparent',
-                  isActive
-                    ? 'border-foreground text-foreground font-semibold'
-                    : 'border-transparent text-muted-foreground hover:text-foreground',
-                )}
-              >
-                {tab.icon ? <span className="mr-1.5">{tab.icon}</span> : null}
-                {tab.label}
-                {tab.badge}
-              </Button>
-            )
-          })}
-        </nav>
-      </div>
+      <Tabs
+        value={activeTab}
+        onValueChange={(value) => onTabChange(value as DealTabId)}
+        variant="underline"
+      >
+        <TabsList
+          aria-label={t('customers.deals.detail.tabs.label', 'Deal detail sections')}
+          className="w-full overflow-x-auto"
+        >
+          {allTabs.map((tab) => (
+            <TabsTrigger key={tab.id} value={tab.id} leading={tab.icon} count={tab.count}>
+              {tab.label}
+            </TabsTrigger>
+          ))}
+        </TabsList>
+      </Tabs>
 
       <div className="pt-5" role="tabpanel">
         {children}

package/src/modules/customers/components/detail/DetailTabsLayout.tsx

@@ -3,6 +3,7 @@
 import * as React from 'react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { cn } from '@open-mercato/shared/lib/utils'
 import { Plus } from 'lucide-react'
 
@@ -46,31 +47,19 @@ export function DetailTabsLayout<TId extends string = string>({
   return (
     <div className={cn('space-y-4', className)}>
       <div className={cn('flex flex-wrap items-center justify-between gap-3', headerClassName)}>
-        <nav
-          className={cn('flex flex-wrap items-center gap-3 text-sm', navClassName)}
-          role="tablist"
-          aria-label={navAriaLabel}
+        <Tabs
+          value={activeTab}
+          onValueChange={(value) => handleTabChange(value as TId)}
+          variant="underline"
         >
-          {tabs.map((tab) => (
-            <Button
-              key={tab.id}
-              type="button"
-              variant="ghost"
-              size="sm"
-              role="tab"
-              aria-selected={activeTab === tab.id}
-              onClick={() => handleTabChange(tab.id)}
-              className={cn(
-                'h-auto rounded-none border-b-2 px-0 py-1',
-                activeTab === tab.id
-                  ? 'border-accent-indigo text-foreground hover:bg-transparent'
-                  : 'border-transparent text-muted-foreground hover:text-foreground hover:bg-transparent'
-              )}
-            >
-              {tab.label}
-            </Button>
-          ))}
-        </nav>
+          <TabsList className={cn('h-auto flex-wrap border-b-0', navClassName)} aria-label={navAriaLabel}>
+            {tabs.map((tab) => (
+              <TabsTrigger key={tab.id} value={tab.id}>
+                {tab.label}
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
         {sectionAction ? (
           <Button
             type="button"

package/src/modules/customers/components/detail/MobilePersonDetail.tsx

@@ -3,8 +3,7 @@
 import * as React from 'react'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { cn } from '@open-mercato/shared/lib/utils'
-import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 export type MobilePersonZone = 'details' | 'activity'
 
@@ -80,35 +79,30 @@ export function MobilePersonDetail({
 
   return (
     <div className="space-y-4">
-      <div
-        role="tablist"
-        aria-label={t(
-          'customers.people.mobile.zoneSwitcher.ariaLabel',
-          'Zone selector',
-        )}
-        className="grid grid-cols-2 gap-1 rounded-lg border border-border/70 bg-muted/20 p-1"
-        onKeyDown={handleKeyDown}
-      >
-        {ZONES.map((entry) => {
-          const isActive = zone === entry.id
-          return (
-            <Button
-              key={entry.id}
-              type="button"
-              role="tab"
-              aria-selected={isActive}
-              aria-controls={`mobile-person-zone-${entry.id}`}
-              variant={isActive ? 'default' : 'ghost'}
-              className={cn(
-                'h-11 rounded-lg text-sm font-semibold',
-                isActive ? '' : 'text-muted-foreground',
-              )}
-              onClick={() => handleZoneChange(entry.id)}
-            >
-              {t(entry.labelKey, entry.fallback)}
-            </Button>
-          )
-        })}
+      <div onKeyDown={handleKeyDown}>
+        <Tabs
+          value={zone}
+          onValueChange={(value) => handleZoneChange(value as MobilePersonZone)}
+          variant="underline"
+        >
+          <TabsList
+            aria-label={t(
+              'customers.people.mobile.zoneSwitcher.ariaLabel',
+              'Zone selector',
+            )}
+            className="w-full"
+          >
+            {ZONES.map((entry) => (
+              <TabsTrigger
+                key={entry.id}
+                value={entry.id}
+                className="flex-1 justify-center"
+              >
+                {t(entry.labelKey, entry.fallback)}
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
       </div>
       <div
         id={`mobile-person-zone-${zone}`}

package/src/modules/customers/components/detail/PersonDetailTabs.tsx

@@ -1,9 +1,9 @@
 "use client"
 
 import * as React from 'react'
-import { cn } from '@open-mercato/shared/lib/utils'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import {
   SquareCheckBig,
   Mail,
@@ -32,7 +32,7 @@ type TabDef = {
   id: PersonTabId
   label: string
   icon?: React.ReactNode
-  badge?: React.ReactNode
+  count?: React.ReactNode
 }
 
 type PersonDetailTabsProps = {
@@ -56,21 +56,9 @@ export function resolveLegacyTab(tab: string | null | undefined): PersonTabId {
   return SUPPORTED_TAB_IDS.has(tab as PersonTabId) ? (tab as PersonTabId) : 'activities'
 }
 
-function CountBadge({ count }: { count: number }) {
-  if (count <= 0) return null
-  return (
-    <span className="ml-1 rounded-full bg-muted px-1.5 py-0.5 text-xs font-medium leading-none text-muted-foreground">
-      {count > 999 ? '999+' : count}
-    </span>
-  )
-}
-
-function NewBadge() {
-  return (
-    <span className="ml-1.5 rounded bg-foreground px-1.5 py-0.5 text-overline font-semibold leading-none text-background">
-      NEW
-    </span>
-  )
+function formatTabCount(count: number): string | number | undefined {
+  if (count <= 0) return undefined
+  return count > 999 ? '999+' : count
 }
 
 export function PersonDetailTabs({
@@ -94,7 +82,7 @@ export function PersonDetailTabs({
         id: 'activities',
         label: t('customers.people.detail.tabs.activities', 'Activities'),
         icon: <SquareCheckBig className="size-4" />,
-        badge: <CountBadge count={activitiesCount} />,
+        count: formatTabCount(activitiesCount),
       },
       {
         id: 'emails',
@@ -105,37 +93,37 @@ export function PersonDetailTabs({
         id: 'deals',
         label: t('customers.people.detail.tabs.deals', 'Deals'),
         icon: <Briefcase className="size-4" />,
-        badge: <CountBadge count={dealsCount} />,
+        count: formatTabCount(dealsCount),
       },
       {
         id: 'companies',
         label: t('customers.people.detail.tabs.companies', 'Companies'),
         icon: <Building2 className="size-4" />,
-        badge: <CountBadge count={companiesCount} />,
+        count: formatTabCount(companiesCount),
       },
       {
         id: 'addresses',
         label: t('customers.people.detail.tabs.addresses', 'Addresses'),
         icon: <MapPin className="size-4" />,
-        badge: <CountBadge count={addressesCount} />,
+        count: formatTabCount(addressesCount),
       },
       {
         id: 'tasks',
         label: t('customers.people.detail.tabs.tasks', 'Tasks'),
         icon: <Check className="size-4" />,
-        badge: <CountBadge count={tasksCount} />,
+        count: formatTabCount(tasksCount),
       },
       {
         id: 'changelog',
         label: t('customers.people.detail.tabs.changelog', 'Change log'),
         icon: <History className="size-4" />,
-        badge: <NewBadge />,
+        count: 'NEW',
       },
       {
         id: 'files',
         label: t('customers.people.detail.tabs.files', 'Files'),
         icon: <Paperclip className="size-4" />,
-        badge: <CountBadge count={filesCount} />,
+        count: formatTabCount(filesCount),
       },
     ],
     [t, activitiesCount, dealsCount, companiesCount, addressesCount, tasksCount, filesCount],
@@ -155,33 +143,24 @@ export function PersonDetailTabs({
   return (
     <div>
       {/* Tab navigation — full width above both zones */}
-      <div className="flex items-end justify-between gap-2 border-b" role="tablist" aria-label={t('customers.people.detail.tabs.label', 'Person detail sections')}>
-        <nav className="-mb-px flex flex-1 gap-1 overflow-x-auto px-1">
-          {allTabs.map((tab) => {
-            const isActive = activeTab === tab.id
-            return (
-              <Button
-                key={tab.id}
-                type="button"
-                variant="ghost"
-                size="sm"
-                role="tab"
-                aria-selected={isActive}
-                onClick={() => onTabChange(tab.id)}
-                className={cn(
-                  'h-auto shrink-0 rounded-none border-b-2 px-3 py-2.5 hover:bg-transparent',
-                  isActive
-                    ? 'border-foreground text-foreground font-semibold'
-                    : 'border-transparent text-muted-foreground hover:text-foreground',
-                )}
-              >
-                {tab.icon && <span className="mr-1.5">{tab.icon}</span>}
+      <div className="flex items-end justify-between gap-2 border-b">
+        <Tabs
+          value={activeTab}
+          onValueChange={(value) => onTabChange(value as PersonTabId)}
+          variant="underline"
+          className="min-w-0 flex-1"
+        >
+          <TabsList
+            aria-label={t('customers.people.detail.tabs.label', 'Person detail sections')}
+            className="-mb-px w-full overflow-x-auto border-b-0 px-1"
+          >
+            {allTabs.map((tab) => (
+              <TabsTrigger key={tab.id} value={tab.id} leading={tab.icon} count={tab.count}>
                 {tab.label}
-                {tab.badge}
-              </Button>
-            )
-          })}
-        </nav>
+              </TabsTrigger>
+            ))}
+          </TabsList>
+        </Tabs>
         {sectionAction ? (
           <Button
             type="button"

package/src/modules/customers/components/detail/useDealsAccess.ts

@@ -0,0 +1,19 @@
+"use client"
+
+import * as React from 'react'
+import { useBackendChrome } from '@open-mercato/ui/backend/BackendChromeProvider'
+import { hasFeature } from '@open-mercato/shared/security/features'
+
+export type DealsAccess = {
+  canViewDeals: boolean
+  isReady: boolean
+}
+
+export function useDealsAccess(): DealsAccess {
+  const { payload, isReady } = useBackendChrome()
+  const canViewDeals = React.useMemo(
+    () => hasFeature(payload?.grantedFeatures ?? [], 'customers.deals.view'),
+    [payload?.grantedFeatures],
+  )
+  return { canViewDeals, isReady }
+}

package/src/modules/dashboards/api/roles/widgets/route.ts

@@ -6,7 +6,10 @@ import { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { roleWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
-import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
+import {
+  resolveWidgetAssignmentReadScope,
+  resolveWidgetAssignmentTargetAccess,
+} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
@@ -70,7 +73,15 @@ export async function GET(req: Request) {
   })
 
   const role = await em.findOne(Role, { id: roleId, deletedAt: null })
-  if (!role || (tenantId && role.tenantId !== tenantId)) {
+  const access = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: role,
+  })
+  if (access === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (access === 'not-found') {
     return NextResponse.json({ error: 'Role not found' }, { status: 404 })
   }
 
@@ -121,7 +132,15 @@ export async function PUT(req: Request) {
   const organizationId = auth.orgId ?? null
 
   const role = await em.findOne(Role, { id: parsed.data.roleId, deletedAt: null })
-  if (!role || (tenantId && role.tenantId !== tenantId)) {
+  const access = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: role,
+  })
+  if (access === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (access === 'not-found') {
     return NextResponse.json({ error: 'Role not found' }, { status: 404 })
   }
 

package/src/modules/dashboards/api/users/widgets/route.ts

@@ -7,7 +7,10 @@ import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { userWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
-import { resolveWidgetAssignmentReadScope } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
+import {
+  resolveWidgetAssignmentReadScope,
+  resolveWidgetAssignmentTargetAccess,
+} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
@@ -53,7 +56,15 @@ export async function GET(req: Request) {
   })
 
   const targetUserForRead = await em.findOne(User, { id: userId, deletedAt: null })
-  if (!targetUserForRead || (tenantId && (targetUserForRead.tenantId ?? null) !== tenantId)) {
+  const readAccess = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: targetUserForRead,
+  })
+  if (readAccess === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (readAccess === 'not-found') {
     return NextResponse.json({ error: 'User not found' }, { status: 404 })
   }
 
@@ -121,7 +132,15 @@ export async function PUT(req: Request) {
   const organizationId = auth.orgId ?? null
 
   const targetUser = await em.findOne(User, { id: parsed.data.userId, deletedAt: null })
-  if (!targetUser || (tenantId && (targetUser.tenantId ?? null) !== tenantId)) {
+  const writeAccess = resolveWidgetAssignmentTargetAccess({
+    isSuperAdmin: !!acl.isSuperAdmin,
+    scopeTenantId: tenantId,
+    target: targetUser,
+  })
+  if (writeAccess === 'forbidden') {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+  if (writeAccess === 'not-found') {
     return NextResponse.json({ error: 'User not found' }, { status: 404 })
   }