@open-mercato/core 0.6.7-develop.6726.1.983ae8a07e → 0.6.7-develop.6749.1.6b54c56dfe

package/src/modules/dictionaries/api/[dictionaryId]/entries/route.ts

@@ -3,7 +3,11 @@ import { z } from 'zod'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { Dictionary, DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
 import { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'
-import { createDictionaryEntrySchema } from '@open-mercato/core/modules/dictionaries/data/validators'
+import {
+  createDictionaryEntrySchema,
+  listDictionaryEntriesQuerySchema,
+  DICTIONARY_ENTRIES_MAX_LIMIT,
+} from '@open-mercato/core/modules/dictionaries/data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import {
   runCrudMutationGuardAfterSuccess,
@@ -14,6 +18,7 @@ import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/op
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import {
   createDictionaryEntrySchema as createEntryDocSchema,
+  dictionaryEntriesQuerySchema,
   dictionaryEntryListResponseSchema,
   dictionaryEntryResponseSchema,
   dictionaryIdParamsSchema,
@@ -45,8 +50,10 @@ function buildEntriesCacheKey(params: {
   dictionaryId: string
   organizationId: string | null
   sortMode: string
+  limit: number
+  offset: number
 }): string {
-  return `dictionaries:entries:${params.dictionaryId}:org=${params.organizationId ?? 'null'}:sort=${params.sortMode}`
+  return `dictionaries:entries:${params.dictionaryId}:org=${params.organizationId ?? 'null'}:sort=${params.sortMode}:limit=${params.limit}:offset=${params.offset}`
 }
 
 async function loadDictionary(
@@ -93,6 +100,11 @@ export async function GET(req: Request, ctx: { params?: { dictionaryId?: string
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
     const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })
+    const requestUrl = new URL(req.url)
+    const { limit, offset } = listDictionaryEntriesQuerySchema.parse({
+      limit: requestUrl.searchParams.get('limit') ?? undefined,
+      offset: requestUrl.searchParams.get('offset') ?? undefined,
+    })
     const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })
     const dictionaryTenantId = dictionary.tenantId
     const dictionaryOrgId = dictionary.organizationId ?? null
@@ -102,9 +114,12 @@ export async function GET(req: Request, ctx: { params?: { dictionaryId?: string
     // decrypted+sorted options payload. The entry writes flow through the
     // command bus (resourceKind dictionaries.entry), which already flushes the
     // matching collection tag post-commit — no new invalidation wiring needed.
-    const cache = isCrudCacheEnabled() ? resolveCrudCache(context.container) : null
+    // Only the default page is cached: keying the cache on caller-supplied
+    // pagination would let any reader mint unbounded distinct cache entries.
+    const isDefaultPage = limit === DICTIONARY_ENTRIES_MAX_LIMIT && offset === 0
+    const cache = isCrudCacheEnabled() && isDefaultPage ? resolveCrudCache(context.container) : null
     const cacheKey = cache
-      ? buildEntriesCacheKey({ dictionaryId, organizationId: dictionaryOrgId, sortMode })
+      ? buildEntriesCacheKey({ dictionaryId, organizationId: dictionaryOrgId, sortMode, limit, offset })
       : null
 
     if (cache && cacheKey) {
@@ -114,15 +129,19 @@ export async function GET(req: Request, ctx: { params?: { dictionaryId?: string
       }
     }
 
+    const entriesFilter = {
+      dictionary,
+      organizationId: dictionary.organizationId,
+      tenantId: dictionary.tenantId,
+    }
+    const total = await context.em.count(DictionaryEntry, entriesFilter)
+    // Bound the decrypt+sort work per request: page membership is decided by a
+    // stable database ordering, and the dictionary's sort mode orders the page.
     const entries = await findWithDecryption(
       context.em,
       DictionaryEntry,
-      {
-        dictionary,
-        organizationId: dictionary.organizationId,
-        tenantId: dictionary.tenantId,
-      },
-      {},
+      entriesFilter,
+      { orderBy: { position: 'asc', id: 'asc' }, limit, offset },
       { tenantId: dictionary.tenantId, organizationId: dictionary.organizationId },
     )
     const sortedEntries = sortDictionaryEntries(entries, sortMode)
@@ -139,6 +158,14 @@ export async function GET(req: Request, ctx: { params?: { dictionaryId?: string
         createdAt: entry.createdAt,
         updatedAt: entry.updatedAt,
       })),
+      total,
+      limit,
+      offset,
+      hasMore: offset + sortedEntries.length < total,
+      // Page membership comes from the database ordering, while the page itself
+      // is ordered in memory. A client assembling several pages has to re-apply
+      // the same comparator, so it needs the mode that produced this ordering.
+      sortMode,
     }
 
     if (cache && cacheKey) {
@@ -265,8 +292,9 @@ export async function POST(req: Request, ctx: { params?: { dictionaryId?: string
 
 const dictionaryEntriesGetDoc: OpenApiMethodDoc = {
   summary: 'List dictionary entries',
-  description: 'Returns entries for the specified dictionary ordered by its configured entry sort mode.',
+  description: `Returns entries for the specified dictionary ordered by its configured entry sort mode. The number of entries returned per request is capped at ${DICTIONARY_ENTRIES_MAX_LIMIT}; use \`limit\` and \`offset\` with the \`total\`/\`hasMore\` response fields to page through larger dictionaries.`,
   tags: [dictionariesTag],
+  query: dictionaryEntriesQuerySchema,
   responses: [
     { status: 200, description: 'Dictionary entries.', schema: dictionaryEntryListResponseSchema },
   ],

package/src/modules/dictionaries/api/openapi.ts

@@ -5,6 +5,7 @@ import {
   updateDictionaryEntrySchema,
   reorderDictionaryEntriesSchema,
   setDefaultDictionaryEntrySchema,
+  DICTIONARY_ENTRIES_MAX_LIMIT,
 } from '@open-mercato/core/modules/dictionaries/data/validators'
 import { dictionaryEntrySortModeSchema } from '@open-mercato/core/modules/dictionaries/lib/entrySort'
 
@@ -57,6 +58,24 @@ export const dictionaryEntrySchema = z.object({
 
 export const dictionaryEntryListResponseSchema = z.object({
   items: z.array(dictionaryEntrySchema),
+  total: z.number().int(),
+  limit: z.number().int(),
+  offset: z.number().int(),
+  hasMore: z.boolean(),
+  sortMode: dictionaryEntrySortModeSchema.describe(
+    'Sort mode that ordered this page. Clients assembling multiple pages must re-apply it across the combined set.',
+  ),
+})
+
+export const dictionaryEntriesQuerySchema = z.object({
+  limit: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(DICTIONARY_ENTRIES_MAX_LIMIT)
+    .optional()
+    .describe(`Maximum entries to return. Defaults to and is capped at ${DICTIONARY_ENTRIES_MAX_LIMIT}.`),
+  offset: z.coerce.number().int().min(0).optional().describe('Number of entries to skip. Defaults to 0.'),
 })
 
 export const dictionaryEntryResponseSchema = dictionaryEntrySchema

package/src/modules/dictionaries/components/hooks/useDictionaryEntries.ts

@@ -1,6 +1,5 @@
 "use client"
 
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useQuery, type QueryClient, type UseQueryResult } from '@tanstack/react-query'
 import {
   createDictionaryMap,
@@ -8,6 +7,7 @@ import {
   type DictionaryDisplayEntry,
   type DictionaryMap,
 } from '../dictionaryAppearance'
+import { fetchAllDictionaryEntries } from '../../lib/fetchAllEntries'
 
 export type DictionaryEntryRecord = DictionaryDisplayEntry & {
   id: string
@@ -28,47 +28,46 @@ const BASE_DICTIONARY_ENTRIES_KEY = ['dictionaries', 'entries'] as const
 export const dictionaryEntriesQueryKey = (dictionaryId: string, scopeVersion = 0) =>
   [...BASE_DICTIONARY_ENTRIES_KEY, dictionaryId, `scope:${scopeVersion}`] as const
 
+function parseDictionaryEntryItems(items: unknown[]): DictionaryEntryRecord[] {
+  const parsed: DictionaryEntryRecord[] = []
+  for (const item of items) {
+    if (!item || typeof item !== 'object') continue
+    const data = item as Record<string, unknown>
+    const id = typeof data.id === 'string' ? data.id : ''
+    const value = typeof data.value === 'string' ? data.value.trim() : ''
+    if (!id || !value) continue
+    const label =
+      typeof data.label === 'string' && data.label.trim().length ? data.label.trim() : value
+    const color =
+      typeof data.color === 'string' && /^#([0-9a-fA-F]{6})$/.test(data.color)
+        ? `#${data.color.slice(1).toLowerCase()}`
+        : null
+    const icon = typeof data.icon === 'string' && data.icon.trim().length ? data.icon.trim() : null
+    const createdAt = typeof data.createdAt === 'string' ? data.createdAt : null
+    const updatedAt = typeof data.updatedAt === 'string' ? data.updatedAt : null
+    parsed.push({
+      id,
+      value,
+      label,
+      color,
+      icon,
+      createdAt,
+      updatedAt,
+    })
+  }
+  return parsed
+}
+
 export const dictionaryEntriesQueryOptions = (dictionaryId: string, scopeVersion = 0) => ({
   queryKey: dictionaryEntriesQueryKey(dictionaryId, scopeVersion),
   staleTime: DICTIONARY_ENTRIES_STALE_TIME,
   gcTime: DICTIONARY_ENTRIES_STALE_TIME,
   queryFn: async (): Promise<DictionaryEntriesQueryData> => {
-    const call = await apiCall<Record<string, unknown>>(`/api/dictionaries/${dictionaryId}/entries`)
-    const payload = call.result ?? {}
-    if (!call.ok) {
-      const message =
-        typeof payload.error === 'string'
-          ? payload.error
-          : 'Failed to load dictionary entries.'
-      throw new Error(message)
-    }
-    const items = Array.isArray(payload.items) ? payload.items : []
-    const parsed: DictionaryEntryRecord[] = []
-    for (const item of items) {
-      if (!item || typeof item !== 'object') continue
-      const data = item as Record<string, unknown>
-      const id = typeof data.id === 'string' ? data.id : ''
-      const value = typeof data.value === 'string' ? data.value.trim() : ''
-      if (!id || !value) continue
-      const label =
-        typeof data.label === 'string' && data.label.trim().length ? data.label.trim() : value
-      const color =
-        typeof data.color === 'string' && /^#([0-9a-fA-F]{6})$/.test(data.color)
-          ? `#${data.color.slice(1).toLowerCase()}`
-          : null
-      const icon = typeof data.icon === 'string' && data.icon.trim().length ? data.icon.trim() : null
-      const createdAt = typeof data.createdAt === 'string' ? data.createdAt : null
-      const updatedAt = typeof data.updatedAt === 'string' ? data.updatedAt : null
-      parsed.push({
-        id,
-        value,
-        label,
-        color,
-        icon,
-        createdAt,
-        updatedAt,
-      })
+    const pages = await fetchAllDictionaryEntries(dictionaryId)
+    if (!pages.ok) {
+      throw new Error(pages.errorMessage ?? 'Failed to load dictionary entries.')
     }
+    const parsed = parseDictionaryEntryItems(pages.items)
     const normalized = normalizeDictionaryEntries(
       parsed.map(({ value, label, color, icon }) => ({ value, label, color, icon })),
       { sort: false },

package/src/modules/dictionaries/data/validators.ts

@@ -26,6 +26,20 @@ export const upsertDictionarySchema = z.object({
 
 export type UpsertDictionaryInput = z.infer<typeof upsertDictionarySchema>
 
+export const DICTIONARY_ENTRIES_MAX_LIMIT = 500
+
+export const listDictionaryEntriesQuerySchema = z.object({
+  limit: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(DICTIONARY_ENTRIES_MAX_LIMIT)
+    .catch(DICTIONARY_ENTRIES_MAX_LIMIT),
+  offset: z.coerce.number().int().min(0).catch(0),
+})
+
+export type ListDictionaryEntriesQuery = z.infer<typeof listDictionaryEntriesQuerySchema>
+
 export const createDictionaryEntrySchema = z.object({
   value: z.string().trim().min(1).max(150),
   label: z.string().trim().min(1).max(150).optional(),

package/src/modules/dictionaries/lib/clientEntries.ts

@@ -1,6 +1,7 @@
 "use client"
 
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { fetchAllDictionaryEntries } from './fetchAllEntries'
 
 type DictionarySummary = {
   id: string
@@ -59,8 +60,8 @@ export async function loadDictionaryEntriesByKey(key: string): Promise<Dictionar
   const dictionary = normalizeDictionaryList(dictionariesCall.result?.items).find((item) => item.key === key)
   if (!dictionary) return []
 
-  const entriesCall = await apiCall<{ items?: unknown[] }>(`/api/dictionaries/${dictionary.id}/entries`)
-  if (!entriesCall.ok) return []
+  const entries = await fetchAllDictionaryEntries(dictionary.id)
+  if (!entries.ok) return []
 
-  return normalizeDictionaryEntries(entriesCall.result?.items)
+  return normalizeDictionaryEntries(entries.items)
 }

package/src/modules/dictionaries/lib/fetchAllEntries.ts

@@ -0,0 +1,72 @@
+"use client"
+
+import { fetchAllOffsetPages } from '@open-mercato/ui/backend/utils/fetchAllPages'
+import {
+  resolveDictionaryEntrySortMode,
+  sortDictionaryEntries,
+  type DictionaryEntrySortItem,
+} from './entrySort'
+
+export type DictionaryEntryItem = Record<string, unknown>
+
+export type DictionaryEntriesResult = {
+  ok: boolean
+  items: DictionaryEntryItem[]
+  pageCount: number
+  errorMessage: string | null
+}
+
+type DictionaryEntrySortView = DictionaryEntrySortItem & { entry: DictionaryEntryItem }
+
+function toRecords(items: unknown[]): DictionaryEntryItem[] {
+  return items.filter((item): item is DictionaryEntryItem => !!item && typeof item === 'object')
+}
+
+function toSortView(entry: DictionaryEntryItem): DictionaryEntrySortView {
+  const value = typeof entry.value === 'string' ? entry.value.trim() : ''
+  const label = typeof entry.label === 'string' ? entry.label.trim() : ''
+  return {
+    entry,
+    id: typeof entry.id === 'string' ? entry.id : null,
+    value: value.length ? value : null,
+    label: label.length ? label : null,
+    createdAt: typeof entry.createdAt === 'string' ? entry.createdAt : null,
+  }
+}
+
+/**
+ * Load every entry of a dictionary, walking the entries route's page cap.
+ *
+ * The route bounds each response, so any consumer that needs the full option
+ * list must page — reading `items` from a single request silently drops
+ * everything past the ceiling and makes those values unselectable.
+ */
+export async function fetchAllDictionaryEntries(
+  dictionaryId: string,
+): Promise<DictionaryEntriesResult> {
+  const pages = await fetchAllOffsetPages(`/api/dictionaries/${dictionaryId}/entries`)
+  const records = toRecords(pages.items)
+
+  if (!pages.ok) {
+    const error = pages.errorPayload?.error
+    return {
+      ok: false,
+      items: records,
+      pageCount: pages.pageCount,
+      errorMessage: typeof error === 'string' ? error : null,
+    }
+  }
+
+  // The route bounds each response and orders it in memory, so entries
+  // assembled from several pages are only sorted within each page. Re-apply the
+  // mode that produced them across the whole set. A single-page dictionary —
+  // every dictionary at or below the route ceiling — keeps the server ordering
+  // byte-for-byte.
+  if (pages.pageCount <= 1) {
+    return { ok: true, items: records, pageCount: pages.pageCount, errorMessage: null }
+  }
+
+  const sortMode = resolveDictionaryEntrySortMode(pages.firstPayload.sortMode)
+  const sorted = sortDictionaryEntries(records.map(toSortView), sortMode).map((view) => view.entry)
+  return { ok: true, items: sorted, pageCount: pages.pageCount, errorMessage: null }
+}

package/src/modules/entities/api/definitions.ts

@@ -14,6 +14,7 @@ import {
 } from './definitions.cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { filterSelectableSystemEntityIds, isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/system-entities'
+import { isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { loadEntityFieldsetConfigs, CustomFieldsetDefinition } from '../lib/fieldsets'
 import { installCustomEntitiesFromModules } from '../lib/install-from-ce'
@@ -24,6 +25,12 @@ import {
   beginEntitiesMutationGuard,
   FIELD_DEFINITION_RESOURCE_KIND,
 } from './definitions.mutation-guard'
+import {
+  canReadAllEntityMetadata,
+  canReadEntityMetadata,
+  getDeclaredCustomEntityRestriction,
+  resolveEntityAclRequirement,
+} from '../lib/entityAcl'
 import {
   createExactDefinitionWhere,
   createScopedDefinitionTombstone,
@@ -226,8 +233,8 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const entityIds = filterSelectableSystemEntityIds(requestedEntityIds)
-  if (!entityIds.length) {
+  const selectableEntityIds = filterSelectableSystemEntityIds(requestedEntityIds)
+  if (!selectableEntityIds.length) {
     return NextResponse.json({ items: [] })
   }
 
@@ -241,6 +248,48 @@ export async function GET(req: Request) {
   const organizationId = definitionScope.organizationId
   const { resolve } = container
   const em = resolve('em') as any
+  const rbac = resolve('rbacService') as RbacService
+  const acl = await rbac.loadAcl(auth.sub ?? '', {
+    tenantId,
+    organizationId,
+  })
+  const designerCanRead = canReadAllEntityMetadata(acl)
+  const customEntityRestrictions = new Map<string, boolean>()
+  for (const entityId of selectableEntityIds) {
+    if (isOrmBackedSystemEntityId(em, entityId)) continue
+    const declaredRestriction = getDeclaredCustomEntityRestriction(entityId)
+    if (declaredRestriction !== undefined) customEntityRestrictions.set(entityId, declaredRestriction)
+  }
+  if (!designerCanRead) {
+    const unresolvedEntityIds = selectableEntityIds.filter(
+      (entityId) => !resolveEntityAclRequirement(entityId) && !customEntityRestrictions.has(entityId),
+    )
+    if (unresolvedEntityIds.length) {
+      const registrations = await em.find(CustomEntity as any, {
+        entityId: { $in: unresolvedEntityIds },
+        isActive: true,
+        $and: [
+          { $or: [{ tenantId }, { tenantId: null }] },
+          { $or: [{ organizationId }, { organizationId: null }] },
+        ],
+      } as any)
+      for (const registration of registrations as any[]) {
+        const entityId = String(registration.entityId)
+        if (!isOrmBackedSystemEntityId(em, entityId)) {
+          customEntityRestrictions.set(entityId, registration.accessRestricted === true)
+        }
+      }
+    }
+  }
+  const entityIds = selectableEntityIds.filter((entityId) => canReadEntityMetadata({
+    entityId,
+    isCustomEntity: customEntityRestrictions.has(entityId),
+    isRestricted: customEntityRestrictions.get(entityId) === true,
+    acl,
+  }))
+  if (!entityIds.length) {
+    return NextResponse.json({ items: [], fieldsetsByEntity: {}, entitySettings: {} })
+  }
   let cache: CacheStrategy | undefined
   try {
     cache = resolve('cache') as CacheStrategy
@@ -249,7 +298,6 @@ export async function GET(req: Request) {
   let canManageDefinitions = false
   if (typeof auth.sub === 'string' && auth.sub.length > 0) {
     try {
-      const rbac = resolve('rbacService') as RbacService
       canManageDefinitions = await rbac.userHasAllFeatures(auth.sub, ['entities.definitions.manage'], {
         tenantId,
         organizationId,

package/src/modules/entities/api/entities.ts

@@ -10,6 +10,8 @@ import { isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/syst
 import { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 import {
   beginEntitiesMutationGuard,
   ENTITY_DEFINITION_RESOURCE_KIND,
@@ -29,6 +31,11 @@ export async function GET(req: Request) {
 
   const { resolve } = await createRequestContainer()
   const em = resolve('em') as any
+  const rbac = resolve('rbacService') as RbacService
+  const acl = await rbac.loadAcl(auth.sub ?? '', {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+  })
 
   // Generated entities from code
   const AllEntities = getEntityIds()
@@ -79,8 +86,27 @@ export async function GET(req: Request) {
     byId.set(cu.entityId, { ...existing, ...cu, source: existing?.source ?? cu.source })
   }
 
+  const visibleEntityIds = new Set(
+    Array.from(byId.values())
+      .filter((item: any) => {
+        const isOrmBacked = isOrmBackedSystemEntityId(em, item.entityId)
+        const declaredRestriction = isOrmBacked
+          ? undefined
+          : getDeclaredCustomEntityRestriction(item.entityId)
+        return canReadEntityMetadata({
+          entityId: item.entityId,
+          isCustomEntity: !isOrmBacked
+            && (item.source === 'custom' || declaredRestriction !== undefined),
+          isRestricted: declaredRestriction ?? item.accessRestricted === true,
+          acl,
+        })
+      })
+      .map((item: any) => item.entityId),
+  )
+  if (!visibleEntityIds.size) return NextResponse.json({ items: [] })
+
   // Count field definitions scoped to current tenant/org (same scoping as custom entities)
-  const defsWhere: any = { isActive: true }
+  const defsWhere: any = { isActive: true, entityId: { $in: Array.from(visibleEntityIds) } }
   defsWhere.$and = [
     //{ $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant
     { tenantId: auth.tenantId ?? undefined as any },
@@ -99,7 +125,9 @@ export async function GET(req: Request) {
   const counts: Record<string, number> = {}
   for (const [eid, set] of keySets.entries()) counts[eid] = set.size
 
-  const items = Array.from(byId.values()).map((it: any) => ({ ...it, count: counts[it.entityId] || 0 }))
+  const items = Array.from(byId.values())
+    .filter((item: any) => visibleEntityIds.has(item.entityId))
+    .map((item: any) => ({ ...item, count: counts[item.entityId] || 0 }))
   return NextResponse.json({ items })
 }
 

package/src/modules/entities/api/records.ts

@@ -14,35 +14,11 @@ import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { getModules } from '@open-mercato/shared/lib/i18n/server'
-import { assertEntityAclForRequest } from '../lib/entityAcl'
+import { assertEntityAclForRequest, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('entities').child({ component: 'records' })
 
-let declaredCustomEntityRestricted: Map<string, boolean> | null = null
-function loadDeclaredCustomEntities(): Map<string, boolean> {
-  if (declaredCustomEntityRestricted === null) {
-    try {
-      const mods = getModules() as Array<{ customEntities?: Array<{ id?: string; accessRestricted?: boolean }> }>
-      const map = new Map<string, boolean>()
-      for (const mod of mods ?? []) {
-        for (const spec of mod?.customEntities ?? []) {
-          if (spec?.id) map.set(spec.id, spec.accessRestricted === true)
-        }
-      }
-      // Cache even when empty so we don't rebuild on every request (and fall back
-      // to the DB lookup unnecessarily). Only a thrown getModules() leaves it null
-      // so a genuinely-uninitialized registry is retried.
-      declaredCustomEntityRestricted = map
-    } catch {}
-  }
-  return declaredCustomEntityRestricted ?? new Map<string, boolean>()
-}
-function isDeclaredCustomEntity(entityId: string): boolean {
-  return loadDeclaredCustomEntities().has(entityId)
-}
-
 type RecordsEntityScope = { tenantId: string | null; organizationId: string | null }
 
 // Resolve the CustomEntity registration that applies to THIS caller, most-specific
@@ -86,8 +62,8 @@ type RecordsEntityClassification = { kind: RecordsEntityKind; restricted: boolea
 // or an active `custom_entities` registration is authoritative.
 async function classifyRecordsEntity(em: any, entityId: string, scope: RecordsEntityScope): Promise<RecordsEntityClassification> {
   if (isOrmBackedSystemEntityId(em, entityId)) return { kind: 'system', restricted: false }
-  const declared = loadDeclaredCustomEntities()
-  if (declared.has(entityId)) return { kind: 'custom', restricted: declared.get(entityId) === true }
+  const declaredRestriction = getDeclaredCustomEntityRestriction(entityId)
+  if (declaredRestriction !== undefined) return { kind: 'custom', restricted: declaredRestriction }
   try {
     const { CustomEntity } = await import('../data/entities')
     // Restriction is decided from the row that applies to THIS caller's scope so

package/src/modules/entities/api/sidebar-entities.ts

@@ -5,9 +5,11 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { EntityManager } from '@mikro-orm/core'
 import { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 
 export const metadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
 }
 
 export async function GET(req: Request) {
@@ -17,6 +19,11 @@ export async function GET(req: Request) {
   const { resolve } = await createRequestContainer()
   const em = resolve('em') as EntityManager
   const cache = resolve('cache') as any
+  const rbac = resolve('rbacService') as RbacService
+  const acl = await rbac.loadAcl(auth.sub ?? '', {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+  })
 
   const where: any = { 
     isActive: true,
@@ -27,27 +34,49 @@ export async function GET(req: Request) {
     { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },
   ]
   
-  // Try cache first to avoid repeated queries on focus refreshes
-  const cacheKey = `entities:sidebar:${auth.tenantId || 'null'}`
+  const cacheKey = `entities:sidebar:v2:${auth.tenantId || 'null'}`
+  let candidates: Array<{
+    entityId: string
+    label: string
+    href: string
+    accessRestricted: boolean
+  }> | null = null
   try {
     if (cache) {
       const cached = await cache.get(cacheKey)
-      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached)
+      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates
     }
   } catch {}
 
-  const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
-  
-  const items = (entities as any[]).map((e) => ({
-    entityId: e.entityId,
-    label: e.label,
-    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`
-  }))
+  if (!candidates) {
+    const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
+    candidates = (entities as any[]).map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,
+      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId)
+        ?? entity.accessRestricted === true,
+    }))
+    try {
+      if (cache) {
+        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
+      }
+    } catch {}
+  }
 
+  const items = candidates
+    .filter((entity) => canReadEntityMetadata({
+      entityId: entity.entityId,
+      isCustomEntity: true,
+      isRestricted: entity.accessRestricted,
+      acl,
+    }))
+    .map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: entity.href,
+    }))
   const payload = { items }
-  try {
-    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
-  } catch {}
   return NextResponse.json(payload)
 }