@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/attachments/migrations/Migration20260709234741_attachments.ts

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260709234741_attachments extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`create table "attachment_quota_reservations" ("id" uuid not null, "tenant_id" uuid not null, "organization_id" uuid not null, "reserved_bytes" bigint not null, "actual_bytes" bigint null, "status" text not null default 'reserved', "source" text not null, "storage_driver" text not null, "partition_code" text null, "storage_path" text not null, "lease_token" uuid not null, "upload_token_hash" text null, "expires_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "attachment_quota_reservations_expires_idx" on "attachment_quota_reservations" ("expires_at");`);
+    this.addSql(`create index "attachment_quota_reservations_tenant_status_idx" on "attachment_quota_reservations" ("tenant_id", "status");`);
+    this.addSql(`alter table "attachment_quota_reservations" add constraint "attachment_quota_reservations_scope_path_unique" unique ("tenant_id", "storage_driver", "storage_path");`);
+  }
+
+}

package/src/modules/attachments/workers/quota-recovery.ts

@@ -0,0 +1,68 @@
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AttachmentQuotaService } from '../lib/quota-service'
+import type { StorageDriverFactory } from '../lib/drivers'
+import { scheduleAttachmentQuotaRecovery, type AttachmentQuotaRecoveryJob } from '../lib/quota-recovery-queue'
+
+export const metadata: WorkerMeta = {
+  queue: 'attachments-quota-recovery',
+  id: 'attachments:quota-recovery',
+  concurrency: 2,
+}
+
+type HandlerContext = JobContext & { resolve: <T = unknown>(name: string) => T }
+
+type AttachmentLookupDatabase = {
+  attachments: {
+    id: string
+    tenant_id: string
+    storage_driver: string
+    storage_path: string
+  }
+}
+
+export default async function handle(
+  job: QueuedJob<AttachmentQuotaRecoveryJob>,
+  ctx: HandlerContext,
+): Promise<void> {
+  const quotaService = ctx.resolve<AttachmentQuotaService>('attachmentQuotaService')
+  const scope = {
+    tenantId: job.payload.tenantId,
+    organizationId: job.payload.organizationId,
+  }
+  const record = await quotaService.getReservation(job.payload.reservationId, scope)
+  if (!record || record.status === 'committed') return
+  if (record.expiresAt && record.expiresAt.getTime() > Date.now()) {
+    await scheduleAttachmentQuotaRecovery(job.payload, record.expiresAt.getTime() - Date.now())
+    return
+  }
+
+  const claimed = await quotaService.claimExpired(record.id, scope)
+  if (!claimed) return
+  try {
+    const em = ctx.resolve<EntityManager>('em')
+    const existingAttachment = await em.getKysely<AttachmentLookupDatabase>()
+      .selectFrom('attachments')
+      .select('id')
+      .where('tenant_id', '=', claimed.tenantId)
+      .where('storage_driver', '=', claimed.storageDriver)
+      .where('storage_path', '=', claimed.storagePath)
+      .executeTakeFirst()
+    if (!existingAttachment) {
+      if (!claimed.partitionCode) throw new Error('Attachment quota recovery is missing its partition code.')
+      const factory = ctx.resolve<StorageDriverFactory>('storageDriverFactory')
+      const driver = await factory.resolveForPartition(claimed.partitionCode, {
+        tenantId: claimed.tenantId,
+        organizationId: claimed.organizationId,
+      })
+      await (driver.deleteStrict?.(claimed.partitionCode, claimed.storagePath)
+        ?? driver.delete(claimed.partitionCode, claimed.storagePath))
+    }
+    await quotaService.release(claimed.id, claimed.leaseToken)
+  } catch (error) {
+    if (claimed.expiresAt) {
+      await scheduleAttachmentQuotaRecovery(job.payload, claimed.expiresAt.getTime() - Date.now())
+    }
+    throw error
+  }
+}

package/src/modules/audit_logs/api/audit-logs/access/route.ts

@@ -6,6 +6,7 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { AccessLogService } from '@open-mercato/core/modules/audit_logs/services/accessLogService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { loadAuditLogDisplayMaps } from '../display'
+import { requireResolvedTenantScope } from '../readScope'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
@@ -74,6 +75,9 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const tenantScopeGuard = requireResolvedTenantScope(auth)
+  if (tenantScopeGuard) return tenantScopeGuard
+
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
 
@@ -177,6 +181,7 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filters supplied', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
+        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/api/audit-logs/actions/export/route.ts

@@ -16,6 +16,7 @@ import {
 } from '@open-mercato/core/modules/audit_logs/lib/projections'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import { loadAuditLogDisplayMaps } from '../../display'
+import { requireResolvedTenantScope } from '../../readScope'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },
@@ -112,6 +113,9 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const tenantScopeGuard = requireResolvedTenantScope(auth)
+  if (tenantScopeGuard) return tenantScopeGuard
+
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
   const rbac = container.resolve('rbacService') as RbacService
@@ -262,6 +266,7 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filter values', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
+        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/api/audit-logs/actions/route.ts

@@ -6,6 +6,7 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { loadAuditLogDisplayMaps } from '../display'
+import { requireResolvedTenantScope } from '../readScope'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
@@ -151,6 +152,9 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
+  const tenantScopeGuard = requireResolvedTenantScope(auth)
+  if (tenantScopeGuard) return tenantScopeGuard
+
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
 
@@ -291,6 +295,7 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filter values', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
+        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/api/audit-logs/readScope.ts

@@ -0,0 +1,28 @@
+import { NextResponse } from 'next/server'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+
+type ResolvedAuth = NonNullable<AuthContext>
+
+// `isSuperAdmin` is not part of the declared `AuthContext` shape — it reaches callers
+// through the type's index signature — so read it exactly the way
+// `shared/lib/auth/server.ts` does instead of widening the shared contract here.
+function isSuperAdmin(auth: ResolvedAuth): boolean {
+  return (auth as Record<string, unknown>).isSuperAdmin === true
+}
+
+/**
+ * Fail closed on tenant scope for audit-log reads.
+ *
+ * `audit_logs.view_tenant` only widens visibility WITHIN a tenant, so cross-tenant reads
+ * must be gated on `isSuperAdmin`, never on the caller's tenant being empty: a tenant-less
+ * principal (unscoped API key or global account) holding `view_tenant` otherwise drops the
+ * tenant, organization and actor predicates at once and reads decrypted action-log rows for
+ * every tenant in the instance (issues #3817, #3818).
+ *
+ * Plain truthiness is deliberate — it matches the `if (parsed.tenantId)` predicate guard in
+ * ActionLogService/AccessLogService, so every value that would skip it is rejected here.
+ */
+export function requireResolvedTenantScope(auth: ResolvedAuth): NextResponse | null {
+  if (auth.tenantId || isSuperAdmin(auth)) return null
+  return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+}

package/src/modules/audit_logs/components/AccessLogsTable.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/audit_logs/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -74,7 +75,7 @@ export function AccessLogsTable({ items, isLoading, actions, pagination }: { ite
       title={t('audit_logs.access.title')}
       data={accessItems}
       columns={columns}
-      perspective={{ tableId: 'audit_logs.access.list' }}
+      perspective={{ tableId: extensionPoints.hosts.accessLogsTable.tableId }}
       isLoading={Boolean(isLoading)}
       actions={actions}
       pagination={pagination}

package/src/modules/audit_logs/components/AuditLogsActions.tsx

@@ -1,6 +1,7 @@
 'use client'
 
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/audit_logs/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'
 import { Button } from '@open-mercato/ui/primitives/button'
@@ -234,7 +235,7 @@ export function AuditLogsActions({
   return (
     <>
       {showSelfOnlyHint ? (
-        <Alert variant="info" className="mb-4">
+        <Alert status="information" className="mb-4">
           <AlertDescription>
             {t('audit_logs.hint.view_self_only', 'Showing only your own changes. Contact an administrator for broader access.')}
           </AlertDescription>
@@ -245,7 +246,7 @@ export function AuditLogsActions({
         data={actionItems}
         columns={columns}
         actions={combinedActions}
-        perspective={{ tableId: 'audit_logs.actions.list' }}
+        perspective={{ tableId: extensionPoints.hosts.actionsTable.tableId }}
         isLoading={Boolean(isLoading) || Boolean(undoingToken) || Boolean(redoingId)}
         onRowClick={(item) => setSelected(item)}
         pagination={pagination}

package/src/modules/audit_logs/extension-points.ts

@@ -0,0 +1,11 @@
+import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'
+
+export const extensionPoints = defineModuleExtensionPoints({
+  moduleId: 'audit_logs',
+  hosts: {
+    accessLogsTable: dataTableExtensionHost({ tableId: 'audit_logs.access.list', source: 'components/AccessLogsTable.tsx' }),
+    actionsTable: dataTableExtensionHost({ tableId: 'audit_logs.actions.list', source: 'components/AuditLogsActions.tsx' }),
+  },
+})
+
+export default extensionPoints

package/src/modules/audit_logs/i18n/ko.json

@@ -0,0 +1,66 @@
+{
+  "audit_logs.access.columns.access": "접근",
+  "audit_logs.access.columns.fields": "필드",
+  "audit_logs.access.columns.organization": "조직",
+  "audit_logs.access.columns.resource": "리소스",
+  "audit_logs.access.columns.tenant": "테넌트",
+  "audit_logs.access.columns.user": "사용자",
+  "audit_logs.access.columns.when": "시간",
+  "audit_logs.access.title": "접근 로그",
+  "audit_logs.actions.columns.action": "작업",
+  "audit_logs.actions.columns.controls": "제어",
+  "audit_logs.actions.columns.organization": "조직",
+  "audit_logs.actions.columns.resource": "리소스",
+  "audit_logs.actions.columns.status": "상태",
+  "audit_logs.actions.columns.tenant": "테넌트",
+  "audit_logs.actions.columns.user": "사용자",
+  "audit_logs.actions.columns.when": "시간",
+  "audit_logs.actions.details.after": "이후",
+  "audit_logs.actions.details.before": "이전",
+  "audit_logs.actions.details.changed_fields": "변경된 필드",
+  "audit_logs.actions.details.close": "상세 정보 닫기",
+  "audit_logs.actions.details.context": "컨텍스트",
+  "audit_logs.actions.details.field": "필드",
+  "audit_logs.actions.details.no_changes": "추적된 필드 변경 사항 없음",
+  "audit_logs.actions.details.snapshot_after": "변경 후 스냅샷",
+  "audit_logs.actions.details.snapshot_before": "변경 전 스냅샷",
+  "audit_logs.actions.details.title": "작업 상세 정보",
+  "audit_logs.actions.redo": "마지막 작업 다시 실행",
+  "audit_logs.actions.title": "작업 로그",
+  "audit_logs.actions.undo": "마지막 작업 실행 취소",
+  "audit_logs.actions.undoing": "실행 취소 중…",
+  "audit_logs.banner.last_operation": "마지막 작업:",
+  "audit_logs.banner.undo": "실행 취소",
+  "audit_logs.banner.undo_error": "실행 취소 실패",
+  "audit_logs.banner.undo_success": "작업이 실행 취소되었습니다",
+  "audit_logs.common.loading": "불러오는 중…",
+  "audit_logs.common.none": "—",
+  "audit_logs.common.refresh": "새로고침",
+  "audit_logs.common.refreshing": "새로고침 중…",
+  "audit_logs.error.load": "감사 로그를 불러오지 못했습니다",
+  "audit_logs.error.redo": "작업을 다시 실행할 수 없습니다",
+  "audit_logs.error.undo": "작업을 실행 취소할 수 없습니다",
+  "audit_logs.filters.undoable_only": "실행 취소 가능한 항목만",
+  "audit_logs.hint.view_self_only": "본인의 변경 사항만 표시됩니다. 더 넓은 범위의 접근이 필요하면 관리자에게 문의하세요.",
+  "audit_logs.nav.title": "감사 로그",
+  "audit_logs.tabs.label": "감사 로그 보기",
+  "audit_logs.version_history.action.redo": "{action} 다시 실행",
+  "audit_logs.version_history.action.undo": "{action} 실행 취소",
+  "audit_logs.version_history.close": "닫기",
+  "audit_logs.version_history.detail.action": "작업",
+  "audit_logs.version_history.detail.actor": "변경한 사람",
+  "audit_logs.version_history.detail.back": "뒤로",
+  "audit_logs.version_history.detail.date": "날짜",
+  "audit_logs.version_history.detail.status": "상태",
+  "audit_logs.version_history.detail.title": "변경 상세 정보",
+  "audit_logs.version_history.empty": "기록된 변경 사항 없음",
+  "audit_logs.version_history.error": "버전 기록을 불러오지 못했습니다",
+  "audit_logs.version_history.load_more": "더 보기",
+  "audit_logs.version_history.loading": "기록을 불러오는 중…",
+  "audit_logs.version_history.show_related": "관련 변경 사항 표시",
+  "audit_logs.version_history.status.done": "완료",
+  "audit_logs.version_history.status.failed": "실패",
+  "audit_logs.version_history.status.redone": "다시 실행됨",
+  "audit_logs.version_history.status.undone": "실행 취소됨",
+  "audit_logs.version_history.title": "버전 기록"
+}

package/src/modules/auth/AGENTS.md

@@ -6,7 +6,7 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
 
 1. Hash passwords with `bcryptjs` using cost >= 10.
 2. Use `findWithDecryption` / `findOneWithDecryption` for user queries.
-3. Prefer `requireFeatures` in page/API metadata for access control.
+3. Use declarative `requireFeatures` in page/API metadata for access control; never add role-name guards such as `requireRoles: ['admin']`.
 4. Declare every module feature in `acl.ts` and seed role grants through `setup.ts`.
 5. Use wildcard-aware helpers such as `matchFeature`, `hasFeature`, and `hasAllFeatures` when inspecting raw granted features.
 
@@ -20,6 +20,7 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
 - Never log credentials, password reset tokens, session tokens, or decrypted user secrets.
 - Never reveal whether an email exists through auth error messages.
 - Never check raw ACL arrays with `includes(...)`, `Set.has(...)`, or ad hoc wildcard logic.
+- Never authorize a new page or API by mutable role name; declare a stable feature and gate with `requireFeatures`.
 
 ## Validation Commands
 
@@ -68,26 +69,29 @@ Features are string-based permissions: `<module>.<action>` (e.g., `users.view`,
 - Features are assigned to roles and users through ACLs
 - Pages/APIs use `requireFeatures` in metadata for access control
 - Server-side check: `rbacService.userHasAllFeatures(userId, features, { tenantId, organizationId })`
-- Wildcards are first-class ACL grants: `module.*` and `*` must satisfy matching concrete features in every runtime check, not only in page/API guards.
-- When code inspects raw granted feature arrays instead of calling `rbacService`, MUST use shared helpers such as `matchFeature` / `hasFeature` / `hasAllFeatures` rather than `includes(...)`.
+- Wildcards are first-class stored grants, but server decisions MUST flow through `rbacService.userHasAllFeatures` or shared `authorizeFeatures`.
+- Nulled ACL overrides, disabled modules, and organization scope are evaluated before the super-admin bypass.
+- Use `rbacService.getEffectiveFeatures` for chrome/capability payloads; it expands wildcards to concrete active IDs.
+- Keep `matchFeature` / `hasFeature` / `hasAllFeatures` for browser checks over effective projections and isolated matching utilities, not server authorization.
 
 ### Special Flags
 
-- `isSuperAdmin` — bypasses all feature checks (all features granted)
+- `isSuperAdmin` — bypasses stored-grant matching, but not invalid scope, disabled modules, or nulled ACL features
 - Organization visibility list — restricts which organizations a user can access
 
 ### Declarative Guards
 
-Prefer declarative guards in page/API metadata:
+Use declarative feature guards in page/API metadata. API metadata is per HTTP method:
 
 ```typescript
 export const metadata = {
-  requireAuth: true,
-  requireRoles: ['admin'],
-  requireFeatures: ['users.manage'],
+  GET: { requireAuth: true, requireFeatures: ['auth.users.list'] },
+  POST: { requireAuth: true, requireFeatures: ['auth.users.create'] },
 }
 ```
 
+For `page.meta.ts`, export the same `requireAuth: true` and `requireFeatures: [...]` fields at the page metadata top level. `requireRoles` remains a deprecated compatibility field for old registrations; never use it for new authorization.
+
 ## Key Directories
 
 | Directory | Purpose |

package/src/modules/auth/api/admin/nav.ts

@@ -5,6 +5,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'
+import { getModuleSurfaceFingerprint } from '@open-mercato/shared/lib/modules/surfaceFingerprint'
 import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'
 
@@ -12,6 +13,13 @@ export const metadata = {
   GET: { requireAuth: true },
 }
 
+// The fingerprint covers the module set, each module's declared features and
+// the serializable route manifest, so the TTL only has to bound what it cannot
+// see — chiefly a route `icon` swap, which serializes identically. Rebuilding
+// this payload is expensive (a `renderToStaticMarkup` per nav icon plus several
+// scoped queries), so the bound is generous rather than aggressive.
+const NAV_CACHE_TTL_MS = 30 * 60 * 1000
+
 const sidebarNavItemSchema: z.ZodType<{
   id?: string
   href: string
@@ -90,6 +98,13 @@ const adminNavResponseSchema = z.object({
   profilePathPrefixes: z.array(z.string()),
   grantedFeatures: z.array(z.string()),
   roles: z.array(z.string()),
+  // Present when a single organization is in scope; `null` under an all-organizations selection or
+  // when the lookup fails. Declared optional so the response contract stays additive for clients
+  // generated against an older schema.
+  currentOrganization: z.object({
+    id: z.string(),
+    name: z.string(),
+  }).nullable().optional(),
 })
 
 const adminNavErrorSchema = z.object({
@@ -104,7 +119,7 @@ export async function GET(req: Request) {
   const container = await createRequestContainer()
   const cache = container.resolve('cache') as {
     get?: (key: string) => Promise<unknown>
-    set?: (key: string, value: unknown, options?: { tags?: string[] }) => Promise<void>
+    set?: (key: string, value: unknown, options?: { tags?: string[]; ttl?: number }) => Promise<void>
   } | null
   let selectedOrganizationId: string | null | undefined
   let selectedTenantId: string | null | undefined
@@ -121,6 +136,7 @@ export async function GET(req: Request) {
 
   let cacheScopeTenantId = auth.tenantId ?? null
   let cacheScopeOrganizationId = auth.orgId ?? null
+  let cacheScopeSelectedOrganizationId = auth.orgId ?? null
   try {
     const { organizationId, scope } = await resolveFeatureCheckContext({
       container,
@@ -131,15 +147,23 @@ export async function GET(req: Request) {
     })
     cacheScopeOrganizationId = organizationId
     cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null
+    cacheScopeSelectedOrganizationId = scope.selectedId ?? null
   } catch {
     cacheScopeOrganizationId = auth.orgId ?? null
     cacheScopeTenantId = auth.tenantId ?? null
+    cacheScopeSelectedOrganizationId = auth.orgId ?? null
     selectedOrganizationId = auth.orgId ?? null
     selectedTenantId = auth.tenantId ?? null
   }
 
-  const cacheVersion = 'v4'
-  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}`
+  // v6: the payload gained `currentOrganization`, and the payload also embeds the enabled-module set,
+  // its declared features, and the backend route manifest. The selection is part of the key because
+  // the resolved organization cannot distinguish "all organizations" from "my own organization";
+  // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.
+  // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.
+  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`
+  const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'
+  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`
   try {
     if (cache?.get) {
       const cached = await cache.get(cacheKey)
@@ -172,7 +196,7 @@ export async function GET(req: Request) {
         `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,
         ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),
       ].filter(Boolean) as string[]
-      await cache.set(cacheKey, payload, { tags })
+      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS })
     }
   } catch {
     // ignore cache write failures

package/src/modules/auth/api/profile/route.ts

@@ -18,6 +18,7 @@ const logger = createLogger('auth').child({ component: 'profile' })
 
 const profileResponseSchema = z.object({
   email: z.string().email(),
+  name: z.string().nullable().optional(),
   roles: z.array(z.string()),
 })
 
@@ -106,7 +107,12 @@ export async function GET(req: Request) {
     if (!user) {
       return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })
     }
-    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] })
+    const displayName = typeof user.name === 'string' ? user.name.trim() : ''
+    return NextResponse.json({
+      email: String(user.email),
+      name: displayName.length > 0 ? displayName : null,
+      roles: auth.roles ?? [],
+    })
   } catch (err) {
     logger.error('Profile load failed', { err })
     return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })
@@ -207,7 +213,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Get current profile',
-      description: 'Returns the email address for the signed-in user.',
+      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',
       responses: [
         { status: 200, description: 'Profile payload', schema: profileResponseSchema },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },

package/src/modules/auth/api/users/route.ts

@@ -23,9 +23,7 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
-import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
-import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
-import { sql } from 'kysely'
+import { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
 import {
   getSelectedTenantFromRequest,
@@ -504,31 +502,13 @@ async function findUserIdsBySearchTokens(
   tenantScope: string | null | undefined,
   field?: string,
 ): Promise<string[] | null> {
-  const trimmed = search.trim()
-  if (!trimmed) return null
-  const searchConfig = resolveSearchConfig()
-  if (!searchConfig.enabled) return []
-  const { hashes } = tokenizeText(trimmed, searchConfig)
-  if (!hashes.length) return []
-
-  const db = (em as any).getKysely() as any
-  let query = db
-    .selectFrom('search_tokens')
-    .select('entity_id')
-    .where('entity_type', '=', entityType)
-    .where('token_hash', 'in', hashes)
-    .groupBy('entity_id')
-    .having(sql<boolean>`count(distinct token_hash) >= ${hashes.length}`)
-  if (field) {
-    query = query.where('field', '=', field)
-  }
-  if (tenantScope !== undefined) {
-    query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantScope}`)
-  }
-  const rows = (await query.execute()) as Array<{ entity_id?: unknown }>
-  return rows
-    .map((row) => (typeof row.entity_id === 'string' ? row.entity_id : null))
-    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  return findEntityIdsBySearchTokensCompat({
+    db: em.getKysely<SearchTokenDatabase>(),
+    entityType,
+    query: search,
+    fields: field ? [field] : undefined,
+    scope: { tenantId: tenantScope },
+  })
 }
 
 async function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {

package/src/modules/auth/backend/auth/profile/page.tsx

@@ -18,6 +18,7 @@ const logger = createLogger('auth').child({ component: 'profile-page' })
 
 type ProfileResponse = {
   email?: string | null
+  name?: string | null
 }
 
 type ProfileUpdateResponse = {

package/src/modules/auth/backend/profile/change-password/page.tsx

@@ -17,6 +17,7 @@ const logger = createLogger('auth').child({ component: 'change-password-page' })
 
 type ProfileResponse = {
   email?: string | null
+  name?: string | null
 }
 
 type ProfileUpdateResponse = {

package/src/modules/auth/backend/roles/page.tsx

@@ -1,5 +1,6 @@
 "use client"
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'
 import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
@@ -146,7 +147,7 @@ export default function RolesListPage() {
           sortable
           sorting={sorting}
           onSortingChange={setSorting}
-          perspective={{ tableId: 'auth.roles.list' }}
+          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}
           emptyState={(
             <ListEmptyState
               entityName={t('auth.roles.list.title', 'Roles')}

package/src/modules/auth/backend/settings/page.tsx

@@ -1,12 +1,21 @@
 'use client'
-import { useEffect } from 'react'
-import { useRouter } from 'next/navigation'
-import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { Page, PageBody, PageHeader } from '@open-mercato/ui/backend/Page'
 
 export default function SettingsPage() {
-  const router = useRouter()
-  useEffect(() => {
-    router.replace('/backend/config/system-status')
-  }, [router])
-  return <Spinner className="h-4 w-4" />
+  const t = useT()
+
+  return (
+    <Page>
+      <PageHeader
+        title={t('settings.page.title', 'Settings')}
+        description={t('settings.page.description', 'System configuration and administration')}
+      />
+      <PageBody>
+        <p className="text-sm text-muted-foreground">
+          {t('settings.page.selectItem', 'Select an item from the menu to configure system settings.')}
+        </p>
+      </PageBody>
+    </Page>
+  )
 }

package/src/modules/auth/backend/users/page.tsx

@@ -1,5 +1,6 @@
 "use client"
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'
 import Link from 'next/link'
 import { useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -428,7 +429,7 @@ export default function UsersListPage() {
           sortable
           sorting={sorting}
           onSortingChange={setSorting}
-          perspective={{ tableId: 'auth.users.list' }}
+          perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}
           emptyState={(
             <ListEmptyState
               entityName={t('auth.users.list.title', 'Users')}

package/src/modules/auth/cli.ts

@@ -397,7 +397,7 @@ const addOrganization: ModuleCli = {
     // Create tenant implicitly for simplicity
     const tenant = em.create(Tenant, { name: `${name} Tenant` })
     await em.persist(tenant).flush()
-    const org = em.create(Organization, { name, tenant })
+    const org = em.create(Organization, { name, tenant, logoPreserveAspectRatio: false })
     await em.persist(org).flush()
     await rebuildHierarchyForTenant(em, String(tenant.id))
     console.log('Organization created with id', org.id, 'in tenant', tenant.id)