@open-mercato/core 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/modules/dashboards/cli.ts

@@ -6,6 +6,7 @@ import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { seedAnalyticsData } from './seed/analytics'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 type Args = Record<string, string>
 
@@ -108,10 +109,7 @@ const seedDefaults: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to seed.')
@@ -125,7 +123,7 @@ const seedDefaults: ModuleCli = {
       tenantId,
       organizationId,
       roleNames,
-      widgetIds: widgetCsv ? widgetCsv.split(',').map((id) => id.trim()).filter(Boolean) : undefined,
+      widgetIds: widgetCsv ? parseCommaSeparatedList(widgetCsv) : undefined,
       logger: (message) => console.log(message),
     })
   },
@@ -143,10 +141,7 @@ const enableAnalyticsWidgets: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to update.')

package/src/modules/dashboards/lib/widgetAssignmentScope.ts

@@ -8,6 +8,24 @@ export type ResolvedAssignmentScope = {
   organizationId: string | null
 }
 
+export type WidgetAssignmentTarget = {
+  tenantId?: string | null
+}
+
+export type WidgetAssignmentTargetAccess = 'allowed' | 'forbidden' | 'not-found'
+
+export function resolveWidgetAssignmentTargetAccess(params: {
+  isSuperAdmin: boolean
+  scopeTenantId: string | null
+  target: WidgetAssignmentTarget | null | undefined
+}): WidgetAssignmentTargetAccess {
+  const { isSuperAdmin, scopeTenantId, target } = params
+  if (!isSuperAdmin && !scopeTenantId) return 'forbidden'
+  if (!target) return 'not-found'
+  if (scopeTenantId && (target.tenantId ?? null) !== scopeTenantId) return 'not-found'
+  return 'allowed'
+}
+
 export function resolveWidgetAssignmentReadScope(params: {
   auth: AuthScopeInput
   isSuperAdmin: boolean

package/src/modules/dictionaries/commands/entries.ts

@@ -4,22 +4,13 @@ import {
   dictionaryEntryCommandCreateSchema,
   dictionaryEntryCommandUpdateSchema,
 } from '@open-mercato/core/modules/dictionaries/data/validators'
-import { registerDictionaryEntryCommands } from '@open-mercato/core/modules/dictionaries/commands/factory'
-import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import {
+  ensureDictionaryEntryScope,
+  registerDictionaryEntryCommands,
+} from '@open-mercato/core/modules/dictionaries/commands/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
-function ensureScope(ctx: CommandRuntimeContext, scope: { tenantId: string; organizationId: string }): void {
-  const tenantId = ctx.auth?.tenantId ?? null
-  if (tenantId && tenantId !== scope.tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
-  if (organizationId && organizationId !== scope.organizationId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
 async function ensureDictionary(em: EntityManager, id: string): Promise<Dictionary> {
   const dictionary = await em.findOne(Dictionary, {
     id,
@@ -37,12 +28,12 @@ registerDictionaryEntryCommands({
   translationKeyPrefix: 'dictionaries.entries',
   createSchema: dictionaryEntryCommandCreateSchema,
   updateSchema: dictionaryEntryCommandUpdateSchema,
-  ensureScope,
+  ensureScope: ensureDictionaryEntryScope,
   duplicateError: 'An entry with this value already exists.',
   resolveDictionaryForCreate: async ({ em, ctx, parsed }) => {
     const dictionary = await ensureDictionary(em, parsed.dictionaryId)
     const scope = { tenantId: dictionary.tenantId, organizationId: dictionary.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     return { dictionary, scope }
   },
   resolveEntry: async ({ em, ctx, id }) => {
@@ -54,7 +45,7 @@ registerDictionaryEntryCommands({
       throw new CrudHttpError(404, { error: 'Dictionary not found' })
     }
     const scope = { tenantId: entry.tenantId, organizationId: entry.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     return { entry, dictionary: entry.dictionary, scope }
   },
   ensureDictionaryForUndo: async ({ em, snapshot }) => {

package/src/modules/dictionaries/commands/entry-operations.ts

@@ -6,7 +6,8 @@ import {
   type ReorderDictionaryEntriesCommandInput,
   type SetDefaultDictionaryEntryCommandInput,
 } from '@open-mercato/core/modules/dictionaries/data/validators'
-import { registerCommand, type CommandHandler, type CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { ensureDictionaryEntryScope } from '@open-mercato/core/modules/dictionaries/commands/factory'
+import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { emitCrudSideEffects, emitCrudUndoSideEffects } from '@open-mercato/shared/lib/commands/helpers'
@@ -36,17 +37,6 @@ const dictionaryCrudEvents: CrudEventsConfig = {
   }),
 }
 
-function ensureScope(ctx: CommandRuntimeContext, scope: DictionaryScope): void {
-  const tenantId = ctx.auth?.tenantId ?? null
-  if (tenantId && tenantId !== scope.tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
-  if (organizationId && organizationId !== scope.organizationId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
 async function requireDictionary(
   em: EntityManager,
   id: string,
@@ -84,7 +74,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
   async prepare(rawInput, ctx) {
     const parsed = reorderDictionaryEntriesCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const ids = parsed.entries.map((e) => e.id)
     const existing = await findWithDecryption(
@@ -108,7 +98,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = reorderDictionaryEntriesCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
@@ -201,7 +191,7 @@ const reorderDictionaryEntriesCommand: CommandHandler<
     const undo = extractUndoPayload<ReorderUndoPayload>(logEntry)
     const before = undo?.before ?? (logEntry?.snapshotBefore as ReorderSnapshot | null | undefined) ?? null
     if (!before) return
-    ensureScope(ctx, before.scope)
+    ensureDictionaryEntryScope(ctx, before.scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const ids = before.positions.map((p) => p.id)
@@ -265,7 +255,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
   async prepare(rawInput, ctx) {
     const parsed = setDefaultDictionaryEntryCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
     const previousDefaults = await findWithDecryption(
@@ -291,7 +281,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = setDefaultDictionaryEntryCommandSchema.parse(rawInput)
     const scope: DictionaryScope = { tenantId: parsed.tenantId, organizationId: parsed.organizationId }
-    ensureScope(ctx, scope)
+    ensureDictionaryEntryScope(ctx, scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, parsed.dictionaryId, scope)
@@ -399,7 +389,7 @@ const setDefaultDictionaryEntryCommand: CommandHandler<
     const undo = extractUndoPayload<DefaultUndoPayload>(logEntry)
     const before = undo?.before ?? (logEntry?.snapshotBefore as DefaultSnapshot | null | undefined) ?? null
     if (!before) return
-    ensureScope(ctx, before.scope)
+    ensureDictionaryEntryScope(ctx, before.scope)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const dictionary = await requireDictionary(em, before.dictionaryId, before.scope)

package/src/modules/dictionaries/commands/factory.ts

@@ -12,6 +12,7 @@ import {
 } from '@open-mercato/shared/lib/commands'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { buildChanges, requireId } from '@open-mercato/shared/lib/commands/helpers'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { z } from 'zod'
@@ -22,6 +23,11 @@ type DictionaryScope = {
   organizationId: string
 }
 
+export function ensureDictionaryEntryScope(ctx: CommandRuntimeContext, scope: DictionaryScope): void {
+  ensureTenantScope(ctx, scope.tenantId)
+  ensureOrganizationScope(ctx, scope.organizationId)
+}
+
 export type DictionaryEntrySnapshot = {
   id: string
   dictionaryId: string
@@ -87,8 +93,8 @@ export type DictionaryEntryCommandConfig<TCreate, TUpdate> = {
   labels?: DictionaryEntryCommandLabels
 }
 
-function toScopeEnsurer(fn: EnsureScopeFn | undefined): EnsureScopeFn {
-  return typeof fn === 'function' ? fn : () => {}
+export function toScopeEnsurer(fn: EnsureScopeFn | undefined): EnsureScopeFn {
+  return typeof fn === 'function' ? fn : ensureDictionaryEntryScope
 }
 
 async function loadSnapshot(em: EntityManager, id: string): Promise<DictionaryEntrySnapshot | null> {

package/src/modules/dictionaries/fields/dictionary.tsx

@@ -90,9 +90,12 @@ function DictionaryFieldDefEditor({ def, onChange }: { def: { configJson?: Dicti
   const [error, setError] = React.useState<string | null>(null)
   const multiId = React.useId()
   const inlineCreateId = React.useId()
+  const inlineCreateHintId = React.useId()
+  const defaultValueHintId = React.useId()
   const selectedId = typeof def?.configJson?.dictionaryId === 'string' ? def?.configJson?.dictionaryId : ''
   const inlineCreate = def?.configJson?.dictionaryInlineCreate !== false
   const isMulti = def?.configJson?.multi === true
+  const inlineCreateDisabled = !selectedId || isMulti
   const errorLoadLabel = t('dictionaries.customFields.errorLoad', 'Failed to load dictionaries.')
 
   React.useEffect(() => {
@@ -181,45 +184,65 @@ function DictionaryFieldDefEditor({ def, onChange }: { def: { configJson?: Dicti
           </a>
         </div>
       ) : null}
-      <div className="inline-flex items-center gap-2 text-xs">
-        <Checkbox
-          id={multiId}
-          checked={isMulti}
-          onCheckedChange={(checked) => {
-            const enabled = checked === true
-            onChange({ multi: enabled, defaultValue: enabled ? undefined : def?.configJson?.defaultValue })
-          }}
-          disabled={!selectedId}
-        />
-        <label
-          htmlFor={multiId}
-          className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}
-        >
-          {t('dictionaries.customFields.allowMultiple', 'Allow selecting multiple entries')}
-        </label>
-      </div>
-      {!isMulti ? (
-        <div className="inline-flex items-center gap-2 text-xs">
-          <Checkbox
-            id={inlineCreateId}
-            checked={inlineCreate}
-            onCheckedChange={(checked) => onChange({ dictionaryInlineCreate: checked === true })}
-            disabled={!selectedId}
-          />
-          <label
-            htmlFor={inlineCreateId}
-            className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}
-          >
-            {t('dictionaries.customFields.allowInlineCreate', 'Allow inline creation inside forms')}
-          </label>
+      <div className="space-y-2">
+        <div className="flex flex-col gap-2 sm:flex-row sm:flex-wrap sm:items-center sm:gap-x-4">
+          <div className="inline-flex items-center gap-2 text-xs">
+            <Checkbox
+              id={multiId}
+              checked={isMulti}
+              onCheckedChange={(checked) => {
+                const enabled = checked === true
+                onChange({ multi: enabled, defaultValue: enabled ? undefined : def?.configJson?.defaultValue })
+              }}
+              disabled={!selectedId}
+            />
+            <label
+              htmlFor={multiId}
+              className={selectedId ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}
+            >
+              {t('dictionaries.customFields.allowMultiple', 'Allow selecting multiple entries')}
+            </label>
+          </div>
+          <div className="inline-flex items-center gap-2 text-xs">
+            <Checkbox
+              id={inlineCreateId}
+              checked={!isMulti && inlineCreate}
+              onCheckedChange={(checked) => onChange({ dictionaryInlineCreate: checked === true })}
+              disabled={inlineCreateDisabled}
+              aria-describedby={isMulti ? inlineCreateHintId : undefined}
+            />
+            <label
+              htmlFor={inlineCreateId}
+              className={!inlineCreateDisabled ? 'cursor-pointer select-none' : 'cursor-not-allowed opacity-60'}
+            >
+              {t('dictionaries.customFields.allowInlineCreate', 'Allow inline creation inside forms')}
+            </label>
+          </div>
         </div>
-      ) : null}
+        {isMulti ? (
+          <p id={inlineCreateHintId} className="text-xs text-muted-foreground">
+            {t(
+              'dictionaries.customFields.inlineCreateSingleOnly',
+              'Inline creation is available for single-entry dictionary fields only.',
+            )}
+          </p>
+        ) : null}
+      </div>
       {selectedId && !isMulti ? (
         <DictionaryDefaultSelector
           dictionaryId={selectedId}
           defaultValue={typeof def?.configJson?.defaultValue === 'string' ? def.configJson.defaultValue : ''}
           onChange={(value) => onChange({ defaultValue: value || undefined })}
         />
+      ) : selectedId && isMulti ? (
+        <div className="inline-flex items-center gap-2 text-xs">
+          <p id={defaultValueHintId} className="text-xs text-muted-foreground">
+            {t(
+              'dictionaries.customFields.defaultValueMultiUnavailable',
+              'Default values are not available for multi-select dictionary fields.',
+            )}
+          </p>
+        </div>
       ) : null}
     </div>
   )

package/src/modules/dictionaries/i18n/de.json

@@ -82,6 +82,7 @@
   "dictionaries.customFields.allowInlineCreate": "Inline-Erstellung in Formularen erlauben",
   "dictionaries.customFields.allowMultiple": "Mehrere Einträge auswählen erlauben",
   "dictionaries.customFields.defaultValue": "Standardwert",
+  "dictionaries.customFields.defaultValueMultiUnavailable": "Standardwerte sind für Wörterbuchfelder mit Mehrfachauswahl nicht verfügbar.",
   "dictionaries.customFields.defaultValueNone": "Kein Standardwert",
   "dictionaries.customFields.defaultValueStale": "Standardeintrag nicht gefunden — er wurde möglicherweise gelöscht oder umbenannt.",
   "dictionaries.customFields.dictionaryLabel": "Quelle des Wörterbuchs",
@@ -89,6 +90,7 @@
   "dictionaries.customFields.empty": "Noch keine Wörterbücher verfügbar. Erstellen Sie zuerst eines.",
   "dictionaries.customFields.errorLoad": "Wörterbücher konnten nicht geladen werden.",
   "dictionaries.customFields.inactive": "inaktiv",
+  "dictionaries.customFields.inlineCreateSingleOnly": "Inline-Erstellung ist nur für Wörterbuchfelder mit Einzelauswahl verfügbar.",
   "dictionaries.customFields.loading": "Wörterbücher werden geladen…",
   "dictionaries.customFields.manageLink": "Wörterbücher verwalten",
   "dictionaries.customFields.selectedHint": "Einträge aus diesem Wörterbuch füllen das Feld.",

package/src/modules/dictionaries/i18n/en.json

@@ -82,6 +82,7 @@
   "dictionaries.customFields.allowInlineCreate": "Allow inline creation inside forms",
   "dictionaries.customFields.allowMultiple": "Allow selecting multiple entries",
   "dictionaries.customFields.defaultValue": "Default value",
+  "dictionaries.customFields.defaultValueMultiUnavailable": "Default values are not available for multi-select dictionary fields.",
   "dictionaries.customFields.defaultValueNone": "No default",
   "dictionaries.customFields.defaultValueStale": "Default entry not found — it may have been deleted or renamed.",
   "dictionaries.customFields.dictionaryLabel": "Dictionary source",
@@ -89,6 +90,7 @@
   "dictionaries.customFields.empty": "No dictionaries available yet. Create one first.",
   "dictionaries.customFields.errorLoad": "Failed to load dictionaries.",
   "dictionaries.customFields.inactive": "inactive",
+  "dictionaries.customFields.inlineCreateSingleOnly": "Inline creation is available for single-entry dictionary fields only.",
   "dictionaries.customFields.loading": "Loading dictionaries…",
   "dictionaries.customFields.manageLink": "Manage dictionaries",
   "dictionaries.customFields.selectedHint": "Entries from this dictionary populate the field.",

package/src/modules/dictionaries/i18n/es.json

@@ -82,6 +82,7 @@
   "dictionaries.customFields.allowInlineCreate": "Permitir creación en línea dentro de los formularios",
   "dictionaries.customFields.allowMultiple": "Permitir seleccionar varias entradas",
   "dictionaries.customFields.defaultValue": "Valor predeterminado",
+  "dictionaries.customFields.defaultValueMultiUnavailable": "Los valores predeterminados no están disponibles para campos de diccionario con selección múltiple.",
   "dictionaries.customFields.defaultValueNone": "Sin valor predeterminado",
   "dictionaries.customFields.defaultValueStale": "No se encontró la entrada predeterminada; puede haber sido eliminada o renombrada.",
   "dictionaries.customFields.dictionaryLabel": "Fuente del diccionario",
@@ -89,6 +90,7 @@
   "dictionaries.customFields.empty": "Aún no hay diccionarios disponibles. Crea uno primero.",
   "dictionaries.customFields.errorLoad": "No se pudieron cargar los diccionarios.",
   "dictionaries.customFields.inactive": "inactivo",
+  "dictionaries.customFields.inlineCreateSingleOnly": "La creación en línea solo está disponible para campos de diccionario de una sola entrada.",
   "dictionaries.customFields.loading": "Cargando diccionarios…",
   "dictionaries.customFields.manageLink": "Administrar diccionarios",
   "dictionaries.customFields.selectedHint": "Las entradas de este diccionario rellenarán el campo.",

package/src/modules/dictionaries/i18n/pl.json

@@ -82,6 +82,7 @@
   "dictionaries.customFields.allowInlineCreate": "Zezwól na tworzenie w formularzach",
   "dictionaries.customFields.allowMultiple": "Zezwól na wybór wielu wpisów",
   "dictionaries.customFields.defaultValue": "Wartość domyślna",
+  "dictionaries.customFields.defaultValueMultiUnavailable": "Wartości domyślne nie są dostępne dla wielokrotnego wyboru wpisów słownika.",
   "dictionaries.customFields.defaultValueNone": "Brak wartości domyślnej",
   "dictionaries.customFields.defaultValueStale": "Nie znaleziono domyślnego wpisu — mógł zostać usunięty albo przemianowany.",
   "dictionaries.customFields.dictionaryLabel": "Źródło słownika",
@@ -89,6 +90,7 @@
   "dictionaries.customFields.empty": "Brak dostępnych słowników. Najpierw utwórz jeden.",
   "dictionaries.customFields.errorLoad": "Nie udało się wczytać słowników.",
   "dictionaries.customFields.inactive": "nieaktywne",
+  "dictionaries.customFields.inlineCreateSingleOnly": "Tworzenie wpisów w formularzu jest dostępne tylko dla pól z pojedynczym wyborem.",
   "dictionaries.customFields.loading": "Ładowanie słowników…",
   "dictionaries.customFields.manageLink": "Zarządzaj słownikami",
   "dictionaries.customFields.selectedHint": "Wpisy z tego słownika uzupełnią pole.",

package/src/modules/directory/utils/organizationScope.ts

@@ -18,6 +18,13 @@ export type OrganizationScope = {
   filterIds: string[] | null
   allowedIds: string[] | null
   tenantId: string | null
+  // True when the caller explicitly selected a concrete organization (cookie /
+  // selectedId param) that could not be honored — it does not exist for the
+  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
+  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
+  // this so a record never lands under an org the caller did not intend. Absent
+  // (undefined) means the selection — if any — was honored.
+  selectionRejected?: boolean
 }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
@@ -79,7 +86,8 @@ function isValidCachedScope(value: unknown): value is OrganizationScope {
   const record = value as Partial<OrganizationScope>
   const idOk = (v: unknown) => v === null || typeof v === 'string'
   const arrOk = (v: unknown) => v === null || (Array.isArray(v) && v.every((entry) => typeof entry === 'string'))
-  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds)
+  const flagOk = record.selectionRejected === undefined || typeof record.selectionRejected === 'boolean'
+  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds) && flagOk
 }
 
 function resolveCacheFromContainer(container: AwilixContainer | null | undefined): CacheStrategy | null {
@@ -320,9 +328,18 @@ export async function resolveOrganizationScope({
   const initialSelected =
     normalizedSelectedId
     ?? (widenToAllOrgs ? null : accountOrgId ?? null)
+  // A selection is only honored when it resolves to a real, non-deleted org for
+  // this tenant. `orgDescendants` holds exactly the existing orgs among the
+  // candidate ids, so a stale/dead id (e.g. a selected-org cookie or JWT org
+  // that no longer resolves after a DB reset) has no entry and is dropped here.
+  // Without the existence guard an unrestricted (all-orgs) principal — whose
+  // `allowedSet` is null — would accept the dead id as `effectiveSelected`, and
+  // writes derived from `selectedId` would land under an org the read scope
+  // (`filterIds`) never filters to, silently orphaning the record.
+  const selectionResolvesToOrg = (id: string): boolean => orgDescendants.has(id)
   let effectiveSelected: string | null = null
   if (initialSelected) {
-    if (allowedSet === null || allowedSet.has(initialSelected)) {
+    if ((allowedSet === null || allowedSet.has(initialSelected)) && selectionResolvesToOrg(initialSelected)) {
       effectiveSelected = initialSelected
     }
   }
@@ -336,6 +353,13 @@ export async function resolveOrganizationScope({
     filterSet = null
   } else if (auth.orgId) {
     filterSet = loadFallbackSet()
+    // Keep the write target (`selectedId`) aligned with the read scope
+    // (`filterIds`): when an unrestricted principal's requested selection was
+    // dropped above, fall the selection back to the account org too so a record
+    // created here is always readable back by the same caller.
+    if (!effectiveSelected && fallbackOrgId && filterSet && filterSet.size > 0) {
+      effectiveSelected = fallbackOrgId
+    }
   }
 
   if ((!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {
@@ -348,11 +372,21 @@ export async function resolveOrganizationScope({
     }
   }
 
+  // A concrete organization was explicitly requested (`normalizedSelectedId` is
+  // null for both "no selection" and the "all organizations" token) but the
+  // resolver could not honor it — it was dropped as non-existent/inaccessible
+  // and the effective selection fell back to something else. Surface this so the
+  // write layer can reject the request instead of silently creating the record
+  // under the fallback org. Only set the field when true to keep the scope shape
+  // unchanged for the common (honored) case.
+  const selectionRejected = normalizedSelectedId !== null && effectiveSelected !== normalizedSelectedId
+
   return {
     selectedId: effectiveSelected,
     filterIds: filterSet ? Array.from(filterSet) : null,
     allowedIds: allowedSet ? Array.from(allowedSet) : null,
     tenantId,
+    ...(selectionRejected ? { selectionRejected: true } : {}),
   }
 }
 

package/src/modules/entities/api/records.ts

@@ -8,6 +8,7 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { setRecordCustomFields } from '../lib/helpers'
 import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -151,10 +152,7 @@ export async function GET(req: Request) {
   const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'
   const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)
   const searchTerm = (url.searchParams.get('search') || '').trim()
-  const searchFields = (url.searchParams.get('searchFields') || '')
-    .split(',')
-    .map((field) => field.trim())
-    .filter(Boolean)
+  const searchFields = parseCommaSeparatedList(url.searchParams.get('searchFields'))
 
   const qpEntries: Array<[string, string]> = []
   for (const [key, val] of url.searchParams.entries()) {
@@ -211,11 +209,11 @@ export async function GET(req: Request) {
       if (key.startsWith('cf_')) {
         if (key.endsWith('In')) {
           const base = key.slice(0, -2)
-          const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+          const values = parseCommaSeparatedList(val)
           ;(filtersObj as any)[base] = { $in: values }
         } else {
           if (val.includes(',')) {
-            const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+            const values = parseCommaSeparatedList(val)
             ;(filtersObj as any)[key] = { $in: values }
           } else {
             const parsed = parseBooleanToken(val)
@@ -224,7 +222,7 @@ export async function GET(req: Request) {
         }
       } else if (allowAnyKey) {
         if (val.includes(',')) {
-          const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+          const values = parseCommaSeparatedList(val)
           ;(filtersObj as any)[key] = { $in: values }
         } else {
           const parsed = parseBooleanToken(val)

package/src/modules/entities/backend/entities/system/[entityId]/page.meta.ts

@@ -2,6 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['entities.definitions.manage'],
   pageTitle: 'Edit Definitions',
+  pageTitleKey: 'entities.userEntities.edit.pageTitle',
   pageGroup: 'Data designer',
   navHidden: true,
 }

package/src/modules/entities/backend/entities/user/[entityId]/page.meta.ts

@@ -2,6 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['entities.definitions.manage'],
   pageTitle: 'Edit Definitions',
+  pageTitleKey: 'entities.userEntities.edit.pageTitle',
   pageGroup: 'Data designer',
   navHidden: true,
 }