@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/entities/api/entity-settings.ts

@@ -3,6 +3,10 @@ import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { beginEntitiesMutationGuard } from './definitions.mutation-guard'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { ModuleConfigService } from '../../configs/lib/module-config-service'
 
 // Tenant-scoped policy: when true, new custom entities are created with
 // `access_restricted = true` unless the create request explicitly sets the flag.
@@ -14,24 +18,10 @@ export const metadata = {
   PUT: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },
 }
 
-type ModuleConfigServiceLike = {
-  getValue: (
-    moduleId: string,
-    name: string,
-    options?: { defaultValue?: unknown; scope?: { tenantId?: string | null } },
-  ) => Promise<unknown>
-  setValue: (
-    moduleId: string,
-    name: string,
-    value: unknown,
-    scope?: { tenantId?: string | null },
-  ) => Promise<unknown>
-}
-
 async function readPolicy(tenantId: string | null): Promise<boolean> {
   try {
     const { resolve } = await createRequestContainer()
-    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike
+    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
     const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
       defaultValue: false,
       scope: { tenantId },
@@ -45,12 +35,20 @@ async function readPolicy(tenantId: string | null): Promise<boolean> {
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null)
-  return NextResponse.json({ newEntitiesRestrictedByDefault })
+  const { resolve } = await createRequestContainer()
+  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
+  const record = await moduleConfigService.getRecord(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
+    tenantId: auth.tenantId ?? null,
+  })
+  return NextResponse.json({
+    newEntitiesRestrictedByDefault: record ? record.value === true : false,
+    updatedAt: record ? record.updatedAt : null,
+  })
 }
 
 const putBodySchema = z.object({
   newEntitiesRestrictedByDefault: z.boolean(),
+  expectedUpdatedAt: z.string().optional(),
 })
 
 export async function PUT(req: Request) {
@@ -62,19 +60,64 @@ export async function PUT(req: Request) {
   if (!parsed.success) {
     return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
-  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike
-  await moduleConfigService.setValue(
+  const container = await createRequestContainer()
+  const { resolve } = container
+  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService
+
+  const currentRecord = await moduleConfigService.getRecord(
+    CONFIG_MODULE,
+    NEW_ENTITIES_RESTRICTED_KEY,
+    { tenantId: auth.tenantId ?? null },
+  )
+
+  const guard = await beginEntitiesMutationGuard({
+    container,
+    auth,
+    req,
+    resourceKind: 'entities.settings',
+    resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+    operation: currentRecord ? 'update' : 'create',
+    mutationPayload: parsed.data as unknown as Record<string, unknown>,
+  })
+  if (guard.blockedResponse) return guard.blockedResponse
+
+  const ifMatchHeader = req.headers.get('If-Match') || req.headers.get('x-om-ext-optimistic-lock-expected-updated-at')
+  const expectedUpdatedAt = ifMatchHeader || parsed.data.expectedUpdatedAt
+
+  try {
+    await enforceCommandOptimisticLockWithGuards(container, {
+      resourceKind: 'entities.settings',
+      resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+      current: currentRecord ? currentRecord.updatedAt : null,
+      expected: expectedUpdatedAt,
+      request: req,
+    })
+  } catch (lockError) {
+    if (isCrudHttpError(lockError)) {
+      return NextResponse.json(lockError.body, { status: lockError.status })
+    }
+    throw lockError
+  }
+
+  const updatedRecord = await moduleConfigService.setValue(
     CONFIG_MODULE,
     NEW_ENTITIES_RESTRICTED_KEY,
     parsed.data.newEntitiesRestrictedByDefault,
     { tenantId: auth.tenantId ?? null },
   )
-  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault })
+
+  await guard.runAfterSuccess()
+
+  return NextResponse.json({
+    ok: true,
+    newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault,
+    updatedAt: updatedRecord ? updatedRecord.updatedAt : null,
+  })
 }
 
 const settingsResponseSchema = z.object({
   newEntitiesRestrictedByDefault: z.boolean(),
+  updatedAt: z.string().nullable().optional(),
 })
 
 export const openApi: OpenApiRouteDoc = {
@@ -94,9 +137,10 @@ export const openApi: OpenApiRouteDoc = {
       description: 'Sets the tenant-scoped default-restricted policy for new custom entities.',
       requestBody: { schema: putBodySchema },
       responses: [
-        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },
+        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean(), updatedAt: z.string().nullable().optional() }) },
         { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },
+        { status: 409, description: 'Optimistic lock conflict', schema: z.object({ code: z.string(), error: z.string() }) },
       ],
     },
   },

package/src/modules/entities/api/records.ts

@@ -14,35 +14,11 @@ import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { getModules } from '@open-mercato/shared/lib/i18n/server'
-import { assertEntityAclForRequest } from '../lib/entityAcl'
+import { assertEntityAclForRequest, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('entities').child({ component: 'records' })
 
-let declaredCustomEntityRestricted: Map<string, boolean> | null = null
-function loadDeclaredCustomEntities(): Map<string, boolean> {
-  if (declaredCustomEntityRestricted === null) {
-    try {
-      const mods = getModules() as Array<{ customEntities?: Array<{ id?: string; accessRestricted?: boolean }> }>
-      const map = new Map<string, boolean>()
-      for (const mod of mods ?? []) {
-        for (const spec of mod?.customEntities ?? []) {
-          if (spec?.id) map.set(spec.id, spec.accessRestricted === true)
-        }
-      }
-      // Cache even when empty so we don't rebuild on every request (and fall back
-      // to the DB lookup unnecessarily). Only a thrown getModules() leaves it null
-      // so a genuinely-uninitialized registry is retried.
-      declaredCustomEntityRestricted = map
-    } catch {}
-  }
-  return declaredCustomEntityRestricted ?? new Map<string, boolean>()
-}
-function isDeclaredCustomEntity(entityId: string): boolean {
-  return loadDeclaredCustomEntities().has(entityId)
-}
-
 type RecordsEntityScope = { tenantId: string | null; organizationId: string | null }
 
 // Resolve the CustomEntity registration that applies to THIS caller, most-specific
@@ -86,8 +62,8 @@ type RecordsEntityClassification = { kind: RecordsEntityKind; restricted: boolea
 // or an active `custom_entities` registration is authoritative.
 async function classifyRecordsEntity(em: any, entityId: string, scope: RecordsEntityScope): Promise<RecordsEntityClassification> {
   if (isOrmBackedSystemEntityId(em, entityId)) return { kind: 'system', restricted: false }
-  const declared = loadDeclaredCustomEntities()
-  if (declared.has(entityId)) return { kind: 'custom', restricted: declared.get(entityId) === true }
+  const declaredRestriction = getDeclaredCustomEntityRestriction(entityId)
+  if (declaredRestriction !== undefined) return { kind: 'custom', restricted: declaredRestriction }
   try {
     const { CustomEntity } = await import('../data/entities')
     // Restriction is decided from the row that applies to THIS caller's scope so
@@ -144,6 +120,7 @@ export const metadata = {
 }
 
 const DEFAULT_EXPORT_PAGE_SIZE = 1000
+const EXPORT_MAX_PAGES = 1000
 
 const listRecordsQuerySchema = z
   .object({
@@ -354,10 +331,14 @@ export async function GET(req: Request) {
     }
 
     if (requestedExport) {
-      let exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]
-      if (total > exportItems.length) {
+      const exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]
+      // Short-page termination: `total` is a display value, not a loop bound — it can
+      // under-report (capped counts) or drift while rows are inserted/deleted mid-export.
+      // Keep fetching while pages come back full; fail closed at the page ceiling rather
+      // than serializing a partial export.
+      if (rawItems.length >= pageSize) {
         let nextPage = 2
-        while (exportItems.length < total) {
+        for (;;) {
           const nextRes = await qe.query(entityId as any, {
             ...qopts,
             page: { page: nextPage, pageSize },
@@ -368,7 +349,10 @@ export async function GET(req: Request) {
           const nextFullItems = nextRawItems.map(mapFullRow)
           const nextBatch = exportFullRequested ? nextFullItems : nextViewItems
           exportItems.push(...nextBatch)
-          if (nextBatch.length < pageSize) break
+          if (nextRawItems.length < pageSize) break
+          if (nextPage >= EXPORT_MAX_PAGES) {
+            throw new Error(`[internal] export exceeded ${EXPORT_MAX_PAGES} pages; refusing to return a partial export`)
+          }
           nextPage += 1
         }
       }

package/src/modules/entities/api/sidebar-entities.ts

@@ -5,9 +5,11 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { EntityManager } from '@mikro-orm/core'
 import { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 
 export const metadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
 }
 
 export async function GET(req: Request) {
@@ -17,6 +19,11 @@ export async function GET(req: Request) {
   const { resolve } = await createRequestContainer()
   const em = resolve('em') as EntityManager
   const cache = resolve('cache') as any
+  const rbac = resolve('rbacService') as RbacService
+  const acl = await rbac.loadAcl(auth.sub ?? '', {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+  })
 
   const where: any = { 
     isActive: true,
@@ -27,27 +34,49 @@ export async function GET(req: Request) {
     { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },
   ]
   
-  // Try cache first to avoid repeated queries on focus refreshes
-  const cacheKey = `entities:sidebar:${auth.tenantId || 'null'}`
+  const cacheKey = `entities:sidebar:v2:${auth.tenantId || 'null'}`
+  let candidates: Array<{
+    entityId: string
+    label: string
+    href: string
+    accessRestricted: boolean
+  }> | null = null
   try {
     if (cache) {
       const cached = await cache.get(cacheKey)
-      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached)
+      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates
     }
   } catch {}
 
-  const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
-  
-  const items = (entities as any[]).map((e) => ({
-    entityId: e.entityId,
-    label: e.label,
-    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`
-  }))
+  if (!candidates) {
+    const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
+    candidates = (entities as any[]).map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,
+      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId)
+        ?? entity.accessRestricted === true,
+    }))
+    try {
+      if (cache) {
+        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
+      }
+    } catch {}
+  }
 
+  const items = candidates
+    .filter((entity) => canReadEntityMetadata({
+      entityId: entity.entityId,
+      isCustomEntity: true,
+      isRestricted: entity.accessRestricted,
+      acl,
+    }))
+    .map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: entity.href,
+    }))
   const payload = { items }
-  try {
-    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
-  } catch {}
   return NextResponse.json(payload)
 }
 

package/src/modules/entities/backend/config/settings/page.meta.ts

@@ -0,0 +1,34 @@
+import React from 'react'
+
+const settingsIcon = React.createElement(
+  'svg',
+  {
+    width: 16,
+    height: 16,
+    viewBox: '0 0 24 24',
+    fill: 'none',
+    stroke: 'currentColor',
+    strokeWidth: 2,
+    strokeLinecap: 'round',
+    strokeLinejoin: 'round',
+  },
+  React.createElement('circle', { cx: 12, cy: 12, r: 3 }),
+  React.createElement('path', {
+    d: 'M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z'
+  })
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['entities.definitions.manage'],
+  pageTitle: 'Custom Entities',
+  pageTitleKey: 'entities.settings.title',
+  pageGroup: 'Module Configs',
+  pageGroupKey: 'settings.sections.moduleConfigs',
+  pageOrder: 5,
+  icon: settingsIcon,
+  pageContext: 'settings' as const,
+  breadcrumb: [
+    { label: 'Custom Entities', labelKey: 'entities.settings.title' },
+  ],
+} as const

package/src/modules/entities/backend/config/settings/page.tsx

@@ -0,0 +1,12 @@
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { EntitySettingsManager } from '../../../components/EntitySettingsManager'
+
+export default function EntitySettingsPage() {
+  return (
+    <Page>
+      <PageBody className="space-y-8">
+        <EntitySettingsManager />
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/entities/backend/entities/user/[entityId]/page.tsx

@@ -574,7 +574,7 @@ export default function EditDefinitionsPage({ params }: { params?: { entityId?:
       <Page>
         <PageBody>
           <div className="p-6">
-            <Alert variant="destructive">
+            <Alert status="error">
               <AlertTitle>{t('entities.userEntities.edit.errors.invalidEntityTitle', 'Invalid entity')}</AlertTitle>
               <AlertDescription>{t('entities.userEntities.edit.errors.invalidEntityDescription', 'The requested entity ID is missing or invalid.')}</AlertDescription>
             </Alert>

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -1,8 +1,10 @@
 "use client"
 import * as React from 'react'
+import { resolveExtensionPointPattern } from '@open-mercato/shared/modules/widgets/extension-points'
+import { extensionPoints } from '@open-mercato/core/modules/entities/extension-points'
 import { useSearchParams } from 'next/navigation'
 import type { ColumnDef, SortingState } from '@tanstack/react-table'
-import { filterCustomFieldDefs, useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'
+import { filterCustomFieldDefs, useCustomFieldDefs, type CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'
 import type { PreparedExport } from '@open-mercato/shared/lib/crud/exporters'
@@ -21,6 +23,11 @@ import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuarde
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { ErrorMessage, LoadingMessage } from '@open-mercato/ui/backend/detail'
 import { useRecordsEntityGuard } from '@open-mercato/core/modules/entities/components/useRecordsEntityGuard'
+import {
+  RelationCell,
+  RelationDisplaysProvider,
+  useRecordListRelationDisplays,
+} from '@open-mercato/core/modules/entities/components/RecordListRelationCell'
 
 type RecordsResponse = {
   items: any[]
@@ -96,6 +103,13 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
     enabled: Boolean(entityId),
     keyExtras: [scopeVersion],
   })
+  const relationDefinitions = React.useMemo(
+    () => filterCustomFieldDefs(cfDefs, 'list').filter(
+      (definition): definition is CustomFieldDefDto => definition.kind === 'relation',
+    ),
+    [cfDefs],
+  )
+  const relationDisplaysByField = useRecordListRelationDisplays(relationDefinitions, rawData)
 
   // Fields searched server-side: every visible column plus the base `id`.
   const searchableFields = React.useMemo(() => {
@@ -180,7 +194,10 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
       meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },
       cell: ({ getValue }: { getValue: () => unknown }) => {
         const v = getValue() as any
-        return <span className="truncate max-w-[24ch] inline-block align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
+        if (d.kind === 'relation') {
+          return <RelationCell fieldKey={d.key} value={v} fallbackText={normalizeCell(v)} />
+        }
+        return <span className="inline-block max-w-60 truncate align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
       },
     }))
     // Ensure hidden 'id' column exists for sorting/state
@@ -376,79 +393,83 @@ export RECORD_ID="<record uuid>"`}</code></pre>
             </div>
           </div>
         </ContextHelp>
-        <DataTable
-          stickyActionsColumn
-          title={`Records: ${entityId}`}
-          entityId={entityId}
-          actions={actions}
-          columns={columns}
-          data={data}
-          perspective={{ tableId: `entities.user.records.${entityId}` }}
-          exporter={exportConfig}
-          filters={baseFilters}
-          filterValues={filterValues}
-          rowActions={(row) => (
-            <RowActions
-              items={[
-                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
-                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
-                  const recordId = String((row as any).id)
-                  try {
-                    const confirmed = await confirm({
-                      title: 'Delete this record?',
-                      variant: 'destructive',
-                    })
-                    if (!confirmed) return
-                    await runDeleteMutation({
-                      operation: async () => {
-                        const deleteCall = await withScopedApiRequestHeaders(
-                          buildOptimisticLockHeader((row as any).updatedAt),
-                          () => apiCall(
-                            `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,
-                            { method: 'DELETE' },
-                          ),
-                        )
-                        if (!deleteCall.ok) {
-                          await raiseCrudError(deleteCall.response, 'Failed to delete record')
-                        }
-                      },
-                      context: {
-                        formId: deleteMutationContextId,
-                        resourceKind: 'entities.record',
-                        resourceId: recordId,
-                        retryLastMutation: retryDeleteMutation,
-                      },
-                    })
-                    const j = await readApiResultOrThrow<RecordsResponse>(
-                      `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,
-                      undefined,
-                      {
-                        errorMessage: 'Failed to reload records',
-                        fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },
-                      },
-                    )
-                    setRawData(j.items || [])
-                    setTotal(j.total || 0)
-                    setTotalPages(j.totalPages || 1)
-                    flash('Record has been removed', 'success')
-                  } catch (error) {
-                    const message = error instanceof Error ? error.message : 'Failed to delete record'
-                    flash(message, 'error')
-                  }
-                } },
-              ]}
-            />
-          )}
-          sortable
-          sorting={sorting}
-          onSortingChange={setSorting}
-          searchValue={search}
-          onSearchChange={(v) => { setSearch(v); setPage(1) }}
-          onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}
-          onFiltersClear={() => { setFilterValues({}); setPage(1) }}
-          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
-          isLoading={loading}
-        />
+        <RelationDisplaysProvider displaysByField={relationDisplaysByField}>
+          <DataTable
+            stickyActionsColumn
+            title={`Records: ${entityId}`}
+            entityId={entityId}
+            actions={actions}
+            columns={columns}
+            data={data}
+            perspective={{
+              tableId: resolveExtensionPointPattern(extensionPoints.hosts.userRecordsTable.pattern, { entityId }),
+            }}
+            exporter={exportConfig}
+            filters={baseFilters}
+            filterValues={filterValues}
+            rowActions={(row) => (
+              <RowActions
+                items={[
+                  { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
+                  { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
+                    const recordId = String((row as any).id)
+                    try {
+                      const confirmed = await confirm({
+                        title: 'Delete this record?',
+                        variant: 'destructive',
+                      })
+                      if (!confirmed) return
+                      await runDeleteMutation({
+                        operation: async () => {
+                          const deleteCall = await withScopedApiRequestHeaders(
+                            buildOptimisticLockHeader((row as any).updatedAt),
+                            () => apiCall(
+                              `/api/entities/records?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,
+                              { method: 'DELETE' },
+                            ),
+                          )
+                          if (!deleteCall.ok) {
+                            await raiseCrudError(deleteCall.response, 'Failed to delete record')
+                          }
+                        },
+                        context: {
+                          formId: deleteMutationContextId,
+                          resourceKind: 'entities.record',
+                          resourceId: recordId,
+                          retryLastMutation: retryDeleteMutation,
+                        },
+                      })
+                      const j = await readApiResultOrThrow<RecordsResponse>(
+                        `/api/entities/records?entityId=${encodeURIComponent(entityId)}&page=${page}&pageSize=${pageSize}`,
+                        undefined,
+                        {
+                          errorMessage: 'Failed to reload records',
+                          fallback: { items: [], total: 0, page, pageSize, totalPages: 1 },
+                        },
+                      )
+                      setRawData(j.items || [])
+                      setTotal(j.total || 0)
+                      setTotalPages(j.totalPages || 1)
+                      flash('Record has been removed', 'success')
+                    } catch (error) {
+                      const message = error instanceof Error ? error.message : 'Failed to delete record'
+                      flash(message, 'error')
+                    }
+                  } },
+                ]}
+              />
+            )}
+            sortable
+            sorting={sorting}
+            onSortingChange={setSorting}
+            searchValue={search}
+            onSearchChange={(v) => { setSearch(v); setPage(1) }}
+            onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}
+            onFiltersClear={() => { setFilterValues({}); setPage(1) }}
+            pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+            isLoading={loading}
+          />
+        </RelationDisplaysProvider>
       </PageBody>
       {ConfirmDialogElement}
     </Page>

package/src/modules/entities/backend/entities/user/create/page.tsx

@@ -10,6 +10,7 @@ import { useRouter } from 'next/navigation'
 import { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { LoadingMessage } from '@open-mercato/ui/backend/detail'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
 
 const schema = upsertCustomEntitySchema
 
@@ -24,15 +25,23 @@ export default function CreateEntityPage() {
   React.useEffect(() => {
     let active = true
     ;(async () => {
-      const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(
-        '/api/entities/entity-settings',
-        undefined,
-        { errorMessage: '[internal] Failed to load entity settings', fallback: { newEntitiesRestrictedByDefault: false } },
-      ).catch(() => ({ newEntitiesRestrictedByDefault: false }))
-      if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)
+      try {
+        const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(
+          '/api/entities/entity-settings',
+          undefined,
+          {
+            errorMessage: t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'),
+            fallback: { newEntitiesRestrictedByDefault: false },
+          },
+        )
+        if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)
+      } catch {
+        flash(t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'), 'warning')
+        if (active) setDefaultRestricted(false)
+      }
     })()
     return () => { active = false }
-  }, [])
+  }, [t])
   const fields = React.useMemo<CrudField[]>(() => ([
     {
       id: 'entityId',