@open-mercato/core 0.6.8-develop.6924.1.a8d208fcdc → 0.6.8-develop.6925.1.cefa200fa4

package/src/modules/auth/commands/users.ts

@@ -13,7 +13,7 @@ import type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/l
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
-import { UniqueConstraintViolationException } from '@mikro-orm/core'
+import { UniqueConstraintViolationException, LockMode } from '@mikro-orm/core'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { User, UserRole, Role, UserAcl, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
@@ -122,6 +122,7 @@ const updateSchema = z.object({
   password: passwordSchema.optional(),
   organizationId: z.string().uuid().optional(),
   roles: z.array(z.string()).optional(),
+  isConfirmed: z.boolean().optional(),
 })
 
 export const userCrudEvents: CrudEventsConfig = {
@@ -329,9 +330,22 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
     const em = (ctx.container.resolve('em') as EntityManager)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
 
+    // Evaluate the floor against the user's CURRENT tenant, not the one recorded at
+    // creation. A user moved to another tenant after being created would otherwise be
+    // checked against the origin tenant — where they no longer hold anything — and the
+    // undo would hard-delete the destination tenant's last administrator unchecked.
+    // The create snapshot is only a fallback for a row that is already gone.
     let removed: User | null = null
     await withAtomicFlush(em, [
       async () => {
+        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+        const floorTenantId = current?.tenantId ? String(current.tenantId) : (snapshot?.tenantId ?? null)
+
+        // Undoing a create hard-deletes the user, so it can strip a tenant's last active
+        // admin exactly like `auth.users.delete` can — promote a second admin, delete the
+        // first, then undo the promotion's create. Same guard applies.
+        await enforceProtectedRoleFloor(em, floorTenantId, userId, { deleting: true }, ctx)
+
         await em.nativeDelete(UserAcl, { user: userId })
         await em.nativeDelete(UserRole, { user: userId })
         await em.nativeDelete(Session, { user: userId })
@@ -357,7 +371,7 @@ const createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResul
           soft: false,
         })
       },
-    ], { transaction: true })
+    ], { transaction: true, label: 'auth.users.create.undo' })
 
     await emitCrudUndoSideEffects({
       dataEngine: de,
@@ -522,14 +536,17 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
+    const actorTenantScope = resolveActorTenantScope(ctx)
+    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })
+    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {
+      throw new CrudHttpError(404, { error: 'User not found' })
+    }
+
     const rolesBefore = Array.isArray(parsed.roles)
       ? await loadUserRoleNames(em, parsed.id)
       : null
 
-    // Resolve the tenant the user will belong to after this update first, so the email
-    // duplicate check below can be scoped to it. Email is unique per-tenant, not globally
-    // (see Migration20260610120000: users_tenant_email_hash_uniq) — a matching email in another
-    // tenant must not block the update or leak cross-tenant account existence (#2934).
     let tenantId: string | null | undefined
     if (parsed.organizationId !== undefined) {
       const organization = await findOneWithDecryption(
@@ -543,25 +560,11 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       tenantId = organization.tenant?.id ? String(organization.tenant.id) : null
     }
 
-    if (parsed.email !== undefined) {
-      const targetTenantId = tenantId !== undefined
-        ? tenantId
-        : await resolveUserTenantId(em, parsed.id)
-      const duplicate = await findOneWithDecryption(
-        em,
-        User,
-        {
-          $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
-          deletedAt: null,
-          tenantId: targetTenantId,
-          id: { $ne: parsed.id } as any,
-        } as FilterQuery<User>,
-        {},
-        { tenantId: null, organizationId: null },
-      )
-      if (duplicate) await throwDuplicateEmailError()
-    }
+    const userTenantId = existing.tenantId ? String(existing.tenantId) : null
+    const targetTenantId = tenantId !== undefined ? tenantId : userTenantId
+    const isTenantChanging = targetTenantId !== userTenantId
 
+    // Hash password BEFORE transaction begins to avoid holding locks during CPU-heavy tasks
     let hashed: string | null = null
     let emailHash: string | null = null
     if (parsed.password) {
@@ -572,53 +575,87 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       emailHash = computeEmailHash(parsed.email)
     }
 
-    const actorTenantScope = resolveActorTenantScope(ctx)
     const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }
     if (actorTenantScope) updateWhere.tenantId = actorTenantScope
 
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    let user: User | null
-    try {
-      user = await de.updateOrmEntity({
-        entity: User,
-        where: updateWhere as FilterQuery<User>,
-        apply: (entity) => {
-          if (parsed.email !== undefined) {
-            entity.email = parsed.email
-            entity.emailHash = emailHash
-          }
-          if (parsed.name !== undefined) {
-            entity.name = parsed.name
-          }
-          if (parsed.organizationId !== undefined) {
-            entity.organizationId = parsed.organizationId
-            entity.tenantId = tenantId ?? null
-          }
-          if (hashed) entity.passwordHash = hashed
-        },
-      })
-    } catch (error) {
-      if (isUniqueViolation(error)) await throwDuplicateEmailError()
-      throw error
-    }
-    if (!user) throw new CrudHttpError(404, { error: 'User not found' })
+    let user!: User
 
-    if (hashed) {
-      await em.nativeDelete(Session, { user: parsed.id })
-    }
+    await withAtomicFlush(em, [
+      async () => {
+        // Floor check must run inside the transaction so that LockMode.PESSIMISTIC_WRITE locks Role rows properly
+        await enforceProtectedRoleFloor(em, userTenantId, parsed.id, {
+          deactivating: parsed.isConfirmed === false || isTenantChanging,
+          newRoles: parsed.roles,
+        }, ctx)
+
+        // Email is unique per-tenant, not globally (see Migration20260610120000:
+        // users_tenant_email_hash_uniq) — a matching email in another tenant must not block
+        // the update or leak cross-tenant account existence (#2934). `targetTenantId` is the
+        // tenant the user will belong to after this update, so the check follows a move.
+        if (parsed.email !== undefined) {
+          const duplicate = await findOneWithDecryption(
+            em,
+            User,
+            {
+              $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
+              deletedAt: null,
+              tenantId: targetTenantId,
+              id: { $ne: parsed.id } as any,
+            } as FilterQuery<User>,
+            {},
+            { tenantId: null, organizationId: null },
+          )
+          if (duplicate) await throwDuplicateEmailError()
+        }
 
-    if (Array.isArray(parsed.roles)) {
-      await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null)
-    }
+        try {
+          const updated = await de.updateOrmEntity({
+            entity: User,
+            where: updateWhere as FilterQuery<User>,
+            apply: (entity) => {
+              if (parsed.email !== undefined) {
+                entity.email = parsed.email
+                entity.emailHash = emailHash
+              }
+              if (parsed.name !== undefined) {
+                entity.name = parsed.name
+              }
+              if (parsed.organizationId !== undefined) {
+                entity.organizationId = parsed.organizationId
+                entity.tenantId = tenantId ?? null
+              }
+              if (parsed.isConfirmed !== undefined) {
+                entity.isConfirmed = parsed.isConfirmed
+              }
+              if (hashed) entity.passwordHash = hashed
+            },
+          })
+          if (updated) user = updated
+        } catch (error) {
+          if (isUniqueViolation(error)) await throwDuplicateEmailError()
+          throw error
+        }
+        if (!user) throw new CrudHttpError(404, { error: 'User not found' })
 
-    await setCustomFieldsIfAny({
-      dataEngine: de,
-      entityId: E.auth.user,
-      recordId: String(user.id),
-      organizationId: user.organizationId ? String(user.organizationId) : null,
-      tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,
-      values: custom,
-    })
+        if (hashed || parsed.isConfirmed === false) {
+          await em.nativeDelete(Session, { user: parsed.id })
+        }
+
+        if (Array.isArray(parsed.roles)) {
+          await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null)
+        }
+
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.user,
+          recordId: String(user.id),
+          organizationId: user.organizationId ? String(user.organizationId) : null,
+          tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,
+          values: custom,
+        })
+      }
+    ], { transaction: true })
 
     const identifiers = {
       id: String(user.id),
@@ -706,23 +743,42 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
     const userId = before.id
     const em = (ctx.container.resolve('em') as EntityManager)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
-    const updated = await de.updateOrmEntity({
-      entity: User,
-      where: { id: userId, deletedAt: null } as FilterQuery<User>,
-      apply: (entity) => {
-        entity.email = before.email
-        entity.organizationId = before.organizationId ?? null
-        entity.tenantId = before.tenantId ?? null
-        entity.passwordHash = before.passwordHash ?? null
-        entity.name = before.name ?? null
-        entity.isConfirmed = before.isConfirmed
-      },
-    })
 
-    if (updated) {
-      await syncUserRoles(em, updated, before.roles, before.tenantId)
-      await em.flush()
-    }
+    // Reverting an update can drop the tenant below a protected role's floor just as the
+    // forward path can — restoring an empty `before.roles` on what is now the last admin,
+    // or restoring `isConfirmed: false`. Undo is reachable from the audit-log UI, so the
+    // guard has to run here too, inside a transaction so the row lock is valid.
+    const restoredTenantId = before.tenantId ? String(before.tenantId) : null
+
+    let updated: User | null = null
+    await withAtomicFlush(em, [
+      async () => {
+        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+        const currentTenantId = current?.tenantId ? String(current.tenantId) : null
+
+        await enforceProtectedRoleFloor(em, currentTenantId, userId, {
+          deactivating: before.isConfirmed === false || restoredTenantId !== currentTenantId,
+          newRoles: before.roles,
+        }, ctx)
+
+        updated = await de.updateOrmEntity({
+          entity: User,
+          where: { id: userId, deletedAt: null } as FilterQuery<User>,
+          apply: (entity) => {
+            entity.email = before.email
+            entity.organizationId = before.organizationId ?? null
+            entity.tenantId = before.tenantId ?? null
+            entity.passwordHash = before.passwordHash ?? null
+            entity.name = before.name ?? null
+            entity.isConfirmed = before.isConfirmed
+          },
+        })
+
+        if (updated) {
+          await syncUserRoles(em, updated, before.roles, before.tenantId)
+        }
+      },
+    ], { transaction: true, label: 'auth.users.update.undo' })
 
     const reset = buildCustomFieldResetMap(before.custom, after?.custom)
     if (Object.keys(reset).length) {
@@ -781,12 +837,22 @@ const deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const em = (ctx.container.resolve('em') as EntityManager)
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const actorTenantScope = resolveActorTenantScope(ctx)
+
+    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })
+    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {
+      throw new CrudHttpError(404, { error: 'User not found' })
+    }
+
     const deleteWhere: Record<string, unknown> = { id, deletedAt: null }
     if (actorTenantScope) deleteWhere.tenantId = actorTenantScope
 
     let user!: User
     await withAtomicFlush(em, [
       async () => {
+        const userTenantId = existing.tenantId ? String(existing.tenantId) : null
+        await enforceProtectedRoleFloor(em, userTenantId, id, { deleting: true }, ctx)
+
         await em.nativeDelete(UserAcl, { user: id })
         await em.nativeDelete(UserRole, { user: id })
         await em.nativeDelete(Session, { user: id })
@@ -1085,11 +1151,6 @@ function arrayEquals(left: string[] | undefined, right: string[]): boolean {
   return left.every((value, idx) => value === right[idx])
 }
 
-async function resolveUserTenantId(em: EntityManager, id: string): Promise<string | null> {
-  const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
-  return existing?.tenantId ? String(existing.tenantId) : null
-}
-
 async function throwDuplicateEmailError(): Promise<never> {
   const { translate } = await resolveTranslations()
   const message = translate('auth.users.errors.emailExists', 'Email already in use')
@@ -1099,3 +1160,108 @@ async function throwDuplicateEmailError(): Promise<never> {
     details: [{ path: ['email'], message, code: 'duplicate', origin: 'validation' }],
   })
 }
+
+type ProtectedRoleFloorOptions = {
+  deactivating?: boolean
+  newRoles?: string[]
+  deleting?: boolean
+}
+
+/**
+ * True when the requested mutation can lower a role's active holder count. Guards the
+ * floor check so that ordinary edits (display name, password, email) never take the
+ * tenant-wide role lock — `PUT /api/auth/profile` routes every self-service password
+ * change through `auth.users.update`, so an unconditional lock would serialize them.
+ */
+function couldReduceActiveHolders(options: ProtectedRoleFloorOptions): boolean {
+  return options.deleting === true || options.deactivating === true || options.newRoles !== undefined
+}
+
+async function enforceProtectedRoleFloor(
+  em: EntityManager,
+  tenantId: string | null,
+  userId: string,
+  options: ProtectedRoleFloorOptions,
+  ctx?: CommandRuntimeContext,
+): Promise<void> {
+  // Internal automation (CLI, migrations, tenant teardown) must never be blocked by the
+  // floor. Superadmins are deliberately NOT exempt — see the spec's Risks section.
+  if (ctx?.systemActor === true) return
+  if (!couldReduceActiveHolders(options)) return
+
+  const normalizedTenantId = normalizeTenantId(tenantId) ?? null
+  if (!normalizedTenantId) return
+
+  // Find all protected roles in this tenant, acquiring a pessimistic write lock in a deterministic primary key order
+  const protectedRoles = await findWithDecryption(em, Role, {
+    tenantId: normalizedTenantId,
+    minActiveHolders: { $gt: 0 },
+    deletedAt: null
+  }, {
+    lockMode: LockMode.PESSIMISTIC_WRITE,
+    orderBy: { id: 'ASC' }
+  }, { tenantId: normalizedTenantId, organizationId: null })
+
+  if (protectedRoles.length === 0) return
+
+  const { translate } = await resolveTranslations()
+
+  for (const role of protectedRoles) {
+    const minFloor = role.minActiveHolders ?? 0
+    if (minFloor <= 0) continue
+
+    // Active links for this role, scoped to the tenant by the nested user filter so the
+    // database — not a post-filter — enforces isolation. Deliberately NOT populated:
+    // `findWithDecryption` runs `decryptEntityGraph` over loaded relations, which would
+    // decrypt every admin's email and name on each check just to read their ids.
+    const activeLinks = await findWithDecryption(em, UserRole, {
+      role: role.id,
+      deletedAt: null,
+      user: {
+        deletedAt: null,
+        isConfirmed: true,
+        tenantId: normalizedTenantId
+      }
+    }, {}, { tenantId: null, organizationId: null })
+
+    // Count distinct user IDs in the tenant holding this role to prevent overcounting due to duplicate links
+    const activeUserIds = Array.from(
+      new Set(
+        activeLinks
+          .map((link) => {
+            const userRef = link.user as unknown as { id?: string } | string | null | undefined
+            const linkedUserId = typeof userRef === 'string' ? userRef : userRef?.id
+            return linkedUserId ? String(linkedUserId) : null
+          })
+          .filter((id): id is string => !!id)
+      )
+    )
+
+    // Is the target user currently one of the active holders?
+    if (activeUserIds.includes(userId)) {
+      // Determine if they will remain an active holder
+      let willStillBeActiveHolder = true
+
+      if (options.deleting || options.deactivating) {
+        willStillBeActiveHolder = false
+      } else if (options.newRoles !== undefined) {
+        // Checking role list
+        const desiredUnique = Array.from(new Set(options.newRoles.map((r) => r.trim().toLowerCase()).filter(Boolean)))
+        const roleNameLower = role.name.toLowerCase()
+        const hasRoleByName = desiredUnique.includes(roleNameLower) || desiredUnique.includes(String(role.id).toLowerCase())
+        if (!hasRoleByName) {
+          willStillBeActiveHolder = false
+        }
+      }
+
+      if (!willStillBeActiveHolder) {
+        const remaining = activeUserIds.length - 1
+        if (remaining < minFloor) {
+          throw new CrudHttpError(400, {
+            error: translate('auth.users.errors.lastHolderOfCriticalRole', 'Cannot remove the last active holder of role "{roleName}"', { roleName: role.name })
+          })
+        }
+      }
+    }
+  }
+}

package/src/modules/auth/data/entities.ts

@@ -62,6 +62,9 @@ export class Role {
   @Property({ name: 'tenant_id', type: 'uuid' })
   tenantId!: string
 
+  @Property({ name: 'min_active_holders', type: 'integer', default: 0 })
+  minActiveHolders: number = 0
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 

package/src/modules/auth/i18n/de.json

@@ -162,6 +162,7 @@
   "auth.users.consents.loading": "Einwilligungen werden geladen...",
   "auth.users.consents.withdrawn": "Widerrufen",
   "auth.users.errors.emailExists": "E-Mail-Adresse wird bereits verwendet",
+  "auth.users.errors.lastHolderOfCriticalRole": "Der letzte aktive Inhaber der Rolle \"{roleName}\" kann nicht entfernt werden",
   "auth.users.flash.created": "Benutzer erstellt",
   "auth.users.flash.createdEmailFailed": "Benutzer erstellt, aber die Einladungs-E-Mail konnte nicht gesendet werden. Sie können sie über die Benutzerseite erneut senden.",
   "auth.users.flash.createdWithInvite": "Benutzer erstellt und Einladung gesendet",
@@ -182,6 +183,8 @@
   "auth.users.form.errors.noId": "Keine Benutzer-ID angegeben",
   "auth.users.form.errors.notFound": "Benutzer nicht gefunden",
   "auth.users.form.errors.widgetsAssign": "Dashboard-Widgets konnten dem neuen Benutzer nicht zugewiesen werden",
+  "auth.users.form.field.active": "Aktiv",
+  "auth.users.form.field.activeHint": "Das Entfernen des Hakens deaktiviert das Konto: Die Anmeldung ist nicht mehr möglich und alle aktiven Sitzungen werden beendet.",
   "auth.users.form.field.email": "E-Mail",
   "auth.users.form.field.name": "Anzeigename",
   "auth.users.form.field.newPassword": "Neues Passwort",
@@ -203,10 +206,13 @@
   "auth.users.form.title.create": "Benutzer erstellen",
   "auth.users.form.title.edit": "Benutzer bearbeiten",
   "auth.users.list.columns.name": "Anzeigename",
+  "auth.users.list.columns.status": "Status",
   "auth.users.list.error.delete": "Benutzer konnte nicht gelöscht werden",
   "auth.users.list.error.load": "Benutzer konnten nicht geladen werden",
   "auth.users.list.filters.name": "Anzeigename",
   "auth.users.list.filters.namePlaceholder": "Nach Anzeigename filtern",
+  "auth.users.list.status.active": "Aktiv",
+  "auth.users.list.status.deactivated": "Deaktiviert",
   "auth.users.widgets.errors.load": "Dashboard-Widgets können nicht geladen werden. Sie können sie später auf der Benutzerseite konfigurieren.",
   "auth.users.widgets.loading": "Widgets werden geladen…",
   "auth.users.widgets.mode.hint": "Neue Benutzer erben Widgets von ihren zugewiesenen Rollen. Überschreiben Sie die Auswahl, um eine eigene Zusammenstellung festzulegen.",

package/src/modules/auth/i18n/en.json

@@ -162,6 +162,7 @@
   "auth.users.consents.loading": "Loading consents...",
   "auth.users.consents.withdrawn": "Withdrawn",
   "auth.users.errors.emailExists": "Email already in use",
+  "auth.users.errors.lastHolderOfCriticalRole": "Cannot remove the last active holder of role \"{roleName}\"",
   "auth.users.flash.created": "User created",
   "auth.users.flash.createdEmailFailed": "User created but invitation email could not be sent. You can resend it from the user page.",
   "auth.users.flash.createdWithInvite": "User created and invitation sent",
@@ -182,6 +183,8 @@
   "auth.users.form.errors.noId": "No user ID provided",
   "auth.users.form.errors.notFound": "User not found",
   "auth.users.form.errors.widgetsAssign": "Failed to assign dashboard widgets to the new user",
+  "auth.users.form.field.active": "Active",
+  "auth.users.form.field.activeHint": "Clearing this deactivates the account: the user can no longer sign in and every active session is revoked.",
   "auth.users.form.field.email": "Email",
   "auth.users.form.field.name": "Display name",
   "auth.users.form.field.newPassword": "New Password",
@@ -203,10 +206,13 @@
   "auth.users.form.title.create": "Create User",
   "auth.users.form.title.edit": "Edit User",
   "auth.users.list.columns.name": "Display name",
+  "auth.users.list.columns.status": "Status",
   "auth.users.list.error.delete": "Failed to delete user",
   "auth.users.list.error.load": "Failed to load users",
   "auth.users.list.filters.name": "Display name",
   "auth.users.list.filters.namePlaceholder": "Filter by display name",
+  "auth.users.list.status.active": "Active",
+  "auth.users.list.status.deactivated": "Deactivated",
   "auth.users.widgets.errors.load": "Unable to load dashboard widgets. You can configure them later from the user page.",
   "auth.users.widgets.loading": "Loading widgets…",
   "auth.users.widgets.mode.hint": "New users inherit widgets from their assigned roles. Override to pick a custom set.",

package/src/modules/auth/i18n/es.json

@@ -162,6 +162,7 @@
   "auth.users.consents.loading": "Cargando consentimientos...",
   "auth.users.consents.withdrawn": "Retirado",
   "auth.users.errors.emailExists": "El correo ya está en uso",
+  "auth.users.errors.lastHolderOfCriticalRole": "No se puede eliminar al último titular activo del rol \"{roleName}\"",
   "auth.users.flash.created": "Usuario creado",
   "auth.users.flash.createdEmailFailed": "Usuario creado pero no se pudo enviar el correo de invitación. Puede reenviarlo desde la página del usuario.",
   "auth.users.flash.createdWithInvite": "Usuario creado e invitación enviada",
@@ -182,6 +183,8 @@
   "auth.users.form.errors.noId": "No se proporcionó ID de usuario",
   "auth.users.form.errors.notFound": "Usuario no encontrado",
   "auth.users.form.errors.widgetsAssign": "No se pudieron asignar los widgets del panel al nuevo usuario",
+  "auth.users.form.field.active": "Activo",
+  "auth.users.form.field.activeHint": "Al desmarcarlo se desactiva la cuenta: el usuario ya no puede iniciar sesión y se revocan todas las sesiones activas.",
   "auth.users.form.field.email": "Correo electrónico",
   "auth.users.form.field.name": "Nombre visible",
   "auth.users.form.field.newPassword": "Nueva contraseña",
@@ -203,10 +206,13 @@
   "auth.users.form.title.create": "Crear usuario",
   "auth.users.form.title.edit": "Editar usuario",
   "auth.users.list.columns.name": "Nombre visible",
+  "auth.users.list.columns.status": "Estado",
   "auth.users.list.error.delete": "No se pudo eliminar el usuario",
   "auth.users.list.error.load": "No se pudieron cargar los usuarios",
   "auth.users.list.filters.name": "Nombre visible",
   "auth.users.list.filters.namePlaceholder": "Filtrar por nombre visible",
+  "auth.users.list.status.active": "Activo",
+  "auth.users.list.status.deactivated": "Desactivado",
   "auth.users.widgets.errors.load": "No se pudieron cargar los widgets del panel. Puedes configurarlos más tarde desde la página del usuario.",
   "auth.users.widgets.loading": "Cargando widgets…",
   "auth.users.widgets.mode.hint": "Los nuevos usuarios heredan los widgets de las funciones asignadas. Sobrescribe para elegir un conjunto personalizado.",

package/src/modules/auth/i18n/ko.json

@@ -162,6 +162,7 @@
   "auth.users.consents.loading": "동의 정보를 불러오는 중...",
   "auth.users.consents.withdrawn": "철회함",
   "auth.users.errors.emailExists": "이미 사용 중인 이메일입니다",
+  "auth.users.errors.lastHolderOfCriticalRole": "\"{roleName}\" 역할의 마지막 활성 보유자는 제거할 수 없습니다",
   "auth.users.flash.created": "사용자가 생성되었습니다",
   "auth.users.flash.createdEmailFailed": "사용자가 생성되었지만 초대 이메일을 보낼 수 없었습니다. 사용자 페이지에서 다시 보낼 수 있습니다.",
   "auth.users.flash.createdWithInvite": "사용자가 생성되고 초대가 전송되었습니다",
@@ -182,6 +183,8 @@
   "auth.users.form.errors.noId": "제공된 사용자 ID가 없습니다",
   "auth.users.form.errors.notFound": "사용자를 찾을 수 없습니다",
   "auth.users.form.errors.widgetsAssign": "새 사용자에게 대시보드 위젯을 할당하지 못했습니다",
+  "auth.users.form.field.active": "활성",
+  "auth.users.form.field.activeHint": "선택을 해제하면 계정이 비활성화됩니다. 사용자는 로그인할 수 없으며 활성 세션이 모두 취소됩니다.",
   "auth.users.form.field.email": "이메일",
   "auth.users.form.field.name": "표시 이름",
   "auth.users.form.field.newPassword": "새 비밀번호",
@@ -203,10 +206,13 @@
   "auth.users.form.title.create": "사용자 생성",
   "auth.users.form.title.edit": "사용자 편집",
   "auth.users.list.columns.name": "표시 이름",
+  "auth.users.list.columns.status": "상태",
   "auth.users.list.error.delete": "사용자 삭제에 실패했습니다",
   "auth.users.list.error.load": "사용자를 불러오지 못했습니다",
   "auth.users.list.filters.name": "표시 이름",
   "auth.users.list.filters.namePlaceholder": "표시 이름으로 필터링",
+  "auth.users.list.status.active": "활성",
+  "auth.users.list.status.deactivated": "비활성",
   "auth.users.widgets.errors.load": "대시보드 위젯을 불러올 수 없습니다. 나중에 사용자 페이지에서 구성할 수 있습니다.",
   "auth.users.widgets.loading": "위젯을 불러오는 중…",
   "auth.users.widgets.mode.hint": "새 사용자는 할당된 역할에서 위젯을 상속받습니다. 커스텀 세트를 선택하려면 재정의하세요.",

package/src/modules/auth/i18n/pl.json

@@ -162,6 +162,7 @@
   "auth.users.consents.loading": "Ładowanie zgód...",
   "auth.users.consents.withdrawn": "Wycofana",
   "auth.users.errors.emailExists": "Adres e-mail jest już używany",
+  "auth.users.errors.lastHolderOfCriticalRole": "Nie można usunąć ostatniego aktywnego posiadacza roli \"{roleName}\"",
   "auth.users.flash.created": "Użytkownik utworzony",
   "auth.users.flash.createdEmailFailed": "Użytkownik utworzony, ale nie udało się wysłać e-maila z zaproszeniem. Możesz wysłać go ponownie ze strony użytkownika.",
   "auth.users.flash.createdWithInvite": "Użytkownik utworzony i zaproszenie wysłane",
@@ -182,6 +183,8 @@
   "auth.users.form.errors.noId": "Nie podano identyfikatora użytkownika",
   "auth.users.form.errors.notFound": "Nie znaleziono użytkownika",
   "auth.users.form.errors.widgetsAssign": "Nie udało się przypisać widżetów pulpitu do nowego użytkownika",
+  "auth.users.form.field.active": "Aktywny",
+  "auth.users.form.field.activeHint": "Odznaczenie dezaktywuje konto: użytkownik nie może się zalogować, a wszystkie aktywne sesje zostają unieważnione.",
   "auth.users.form.field.email": "Email",
   "auth.users.form.field.name": "Nazwa wyświetlana",
   "auth.users.form.field.newPassword": "Nowe hasło",
@@ -203,10 +206,13 @@
   "auth.users.form.title.create": "Utwórz użytkownika",
   "auth.users.form.title.edit": "Edytuj użytkownika",
   "auth.users.list.columns.name": "Nazwa wyświetlana",
+  "auth.users.list.columns.status": "Status",
   "auth.users.list.error.delete": "Nie udało się usunąć użytkownika",
   "auth.users.list.error.load": "Nie udało się wczytać użytkowników",
   "auth.users.list.filters.name": "Nazwa wyświetlana",
   "auth.users.list.filters.namePlaceholder": "Filtruj po nazwie wyświetlanej",
+  "auth.users.list.status.active": "Aktywny",
+  "auth.users.list.status.deactivated": "Dezaktywowany",
   "auth.users.widgets.errors.load": "Nie udało się załadować widżetów pulpitu. Możesz skonfigurować je później na stronie użytkownika.",
   "auth.users.widgets.loading": "Ładowanie widżetów…",
   "auth.users.widgets.mode.hint": "Nowi użytkownicy dziedziczą widżety z przypisanych ról. Zastąp wybór, aby wskazać własny zestaw.",

package/src/modules/auth/lib/sessionIntegrity.ts

@@ -93,7 +93,7 @@ export async function resolveCanonicalStaffAuthContext(
     if (session.expiresAt.getTime() < Date.now()) return null
   }
 
-  if (!user) return null
+  if (!user || user.isConfirmed === false) return null
 
   const currentTenantId = normalizeScopeId(user.tenantId ?? null)
   const currentOrganizationId = normalizeScopeId(user.organizationId ?? null)

package/src/modules/auth/lib/setup-app.ts

@@ -34,7 +34,7 @@ async function ensureRolesInContext(
   for (const name of roleNames) {
     const existing = await findOneWithDecryption(em, Role, { name, tenantId }, {}, { tenantId, organizationId: null })
     if (existing) continue
-    em.persist(em.create(Role, { name, tenantId, createdAt: new Date() }))
+    em.persist(em.create(Role, { name, tenantId, minActiveHolders: name === 'admin' ? 1 : 0, createdAt: new Date() }))
   }
 }
 

package/src/modules/auth/migrations/.snapshot-open-mercato.json

@@ -56,6 +56,22 @@
           "enumItems": [],
           "mappedType": "uuid"
         },
+        "min_active_holders": {
+          "name": "min_active_holders",
+          "type": "int",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "0",
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "integer"
+        },
         "created_at": {
           "name": "created_at",
           "type": "timestamptz",

package/src/modules/auth/migrations/Migration20260728134212_auth.ts

@@ -0,0 +1,14 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260728134212_auth extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "roles" add "min_active_holders" int not null default 0;`);
+    this.addSql(`update "roles" set "min_active_holders" = 1 where "name" = 'admin' and "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "roles" drop column "min_active_holders";`);
+  }
+
+}