@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/src/modules/devices/backend/devices/[id]/page.tsx

@@ -0,0 +1,164 @@
+"use client"
+import * as React from 'react'
+import Link from 'next/link'
+import { useRouter } from 'next/navigation'
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'
+import { updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { LoadingMessage, ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+
+type DeviceDetail = {
+  id: string
+  user_id: string
+  device_id: string
+  platform: string
+  client_app_version: string | null
+  os_version: string | null
+  push_provider: string | null
+  updated_at: string | null
+}
+
+type FormValues = {
+  clientAppVersion: string
+  osVersion: string
+  pushProvider: string
+}
+
+export default function DeviceAdminEditPage({ params }: { params?: { id?: string } }) {
+  const router = useRouter()
+  const t = useT()
+  const id = typeof params?.id === 'string' ? params.id : ''
+  const [device, setDevice] = React.useState<DeviceDetail | null>(null)
+  const [isLoading, setIsLoading] = React.useState(true)
+  const [error, setError] = React.useState<string | null>(null)
+  const [notFound, setNotFound] = React.useState(false)
+  const [userLabel, setUserLabel] = React.useState<string | null>(null)
+
+  React.useEffect(() => {
+    let cancelled = false
+    async function load() {
+      setIsLoading(true)
+      setError(null)
+      setNotFound(false)
+      const call = await apiCall<{ item?: DeviceDetail }>(
+        `/api/devices/admin/devices/${encodeURIComponent(id)}`,
+        undefined,
+        { fallback: null },
+      )
+      if (cancelled) return
+      if (call.ok && call.result?.item) {
+        setDevice(call.result.item)
+      } else if (call.status === 404 || (call.ok && !call.result?.item)) {
+        setNotFound(true)
+      } else {
+        setError(t('devices.form.error.loadFailed'))
+      }
+      setIsLoading(false)
+    }
+    if (id) load()
+    return () => { cancelled = true }
+  }, [id, t])
+
+  // Resolve the owner's display name for a link to their profile. Devices admins may not hold
+  // auth.users.list, so fall back to the raw id (rendered without a link) instead of redirecting.
+  React.useEffect(() => {
+    const userId = device?.user_id
+    if (!userId) return
+    let cancelled = false
+    void (async () => {
+      const call = await apiCall<{ items?: { id: string; name?: string | null; email?: string | null }[] }>(
+        `/api/auth/users?id=${encodeURIComponent(userId)}`,
+        { headers: { 'x-om-forbidden-redirect': '0' } },
+        { fallback: null },
+      ).catch(() => null)
+      if (cancelled || !call || !call.ok) return
+      const found = call.result?.items?.find((u) => u.id === userId)
+      const label = found?.name?.trim() || found?.email?.trim() || null
+      if (label) setUserLabel(label)
+    })()
+    return () => { cancelled = true }
+  }, [device?.user_id])
+
+  const fields = React.useMemo<CrudField[]>(() => [
+    { id: 'clientAppVersion', label: t('devices.form.appVersion'), type: 'text' },
+    { id: 'osVersion', label: t('devices.form.osVersion'), type: 'text' },
+    { id: 'pushProvider', label: t('devices.form.pushProvider'), type: 'text' },
+  ], [t])
+
+  const groups = React.useMemo<CrudFormGroup[]>(() => ([
+    { id: 'details', title: t('devices.form.details'), column: 1, fields: ['clientAppVersion', 'osVersion', 'pushProvider'] },
+  ]), [t])
+
+  if (isLoading) {
+    return <Page><PageBody><LoadingMessage label={t('common.loading')} /></PageBody></Page>
+  }
+  if (notFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('devices.errors.not_found')}
+            backHref="/backend/devices"
+            backLabel={t('devices.list.title')}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+  if (error || !device) {
+    return <Page><PageBody><ErrorMessage label={error ?? t('devices.form.error.loadFailed')} /></PageBody></Page>
+  }
+
+  return (
+    <Page>
+      <PageBody>
+        <CrudForm<FormValues>
+          title={t('devices.form.editTitle')}
+          backHref="/backend/devices"
+          contentHeader={(
+            <dl className="grid grid-cols-1 gap-3 rounded-md border bg-muted p-4 text-sm sm:grid-cols-3">
+              <div>
+                <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.deviceId')}</dt>
+                <dd className="mt-1"><code className="text-xs">{device.device_id}</code></dd>
+              </div>
+              <div>
+                <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.platform')}</dt>
+                <dd className="mt-1">{device.platform}</dd>
+              </div>
+              <div>
+                <dt className="text-xs font-medium text-muted-foreground">{t('devices.form.userId')}</dt>
+                <dd className="mt-1">{userLabel ? (
+                  <Link href={`/backend/users/${encodeURIComponent(device.user_id)}/edit`} className="text-primary hover:underline">{userLabel}</Link>
+                ) : (
+                  <code className="text-xs">{device.user_id}</code>
+                )}</dd>
+              </div>
+            </dl>
+          )}
+          fields={fields}
+          groups={groups}
+          optimisticLockUpdatedAt={device.updated_at}
+          initialValues={{
+            clientAppVersion: device.client_app_version ?? '',
+            osVersion: device.os_version ?? '',
+            pushProvider: device.push_provider ?? '',
+          }}
+          submitLabel={t('common.save')}
+          cancelHref="/backend/devices"
+          onSubmit={async (values) => {
+            await updateCrud(`devices/admin/devices/${encodeURIComponent(id)}`, {
+              clientAppVersion: values.clientAppVersion.trim() || null,
+              osVersion: values.osVersion.trim() || null,
+              pushProvider: values.pushProvider.trim() || null,
+            })
+            flash(t('devices.form.success.updated'), 'success')
+            router.push('/backend/devices')
+          }}
+        />
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/devices/backend/devices/create/page.meta.ts

@@ -0,0 +1,12 @@
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['devices.admin'],
+  pageTitle: 'Register device',
+  pageTitleKey: 'devices.form.createTitle',
+  pageContext: 'settings' as const,
+  navHidden: true,
+  breadcrumb: [
+    { label: 'Devices', labelKey: 'devices.nav.devices', href: '/backend/devices' },
+    { label: 'Register device', labelKey: 'devices.form.createTitle' },
+  ],
+}

package/src/modules/devices/backend/devices/create/page.tsx

@@ -0,0 +1,81 @@
+"use client"
+import * as React from 'react'
+import { useRouter } from 'next/navigation'
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'
+import { createCrud } from '@open-mercato/ui/backend/utils/crud'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+
+type FormValues = {
+  userId: string
+  deviceId: string
+  platform: 'ios' | 'android' | 'web'
+  clientAppVersion: string
+  osVersion: string
+  pushToken: string
+  pushProvider: string
+}
+
+function trimmedOrUndefined(value: string): string | undefined {
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : undefined
+}
+
+export default function DeviceAdminCreatePage() {
+  const router = useRouter()
+  const t = useT()
+
+  const fields = React.useMemo<CrudField[]>(() => [
+    { id: 'userId', label: t('devices.form.userId'), type: 'text', required: true, description: t('devices.form.userIdHint') },
+    { id: 'deviceId', label: t('devices.form.deviceId'), type: 'text', required: true },
+    {
+      id: 'platform',
+      label: t('devices.form.platform'),
+      type: 'select',
+      required: true,
+      options: [
+        { value: 'ios', label: 'iOS' },
+        { value: 'android', label: 'Android' },
+        { value: 'web', label: 'Web' },
+      ],
+    },
+    { id: 'clientAppVersion', label: t('devices.form.appVersion'), type: 'text' },
+    { id: 'osVersion', label: t('devices.form.osVersion'), type: 'text' },
+    { id: 'pushToken', label: t('devices.form.pushToken'), type: 'password', description: t('devices.form.pushTokenHint') },
+    { id: 'pushProvider', label: t('devices.form.pushProvider'), type: 'text' },
+  ], [t])
+
+  const groups = React.useMemo<CrudFormGroup[]>(() => ([
+    { id: 'details', title: t('devices.form.details'), column: 1, fields: ['userId', 'deviceId', 'platform', 'clientAppVersion', 'osVersion', 'pushToken', 'pushProvider'] },
+  ]), [t])
+
+  return (
+    <Page>
+      <PageBody>
+        <CrudForm<FormValues>
+          title={t('devices.form.createTitle')}
+          backHref="/backend/devices"
+          fields={fields}
+          groups={groups}
+          initialValues={{ userId: '', deviceId: '', platform: 'ios', clientAppVersion: '', osVersion: '', pushToken: '', pushProvider: '' }}
+          submitLabel={t('common.create')}
+          cancelHref="/backend/devices"
+          onSubmit={async (values) => {
+            await createCrud('devices/admin/devices', {
+              userId: values.userId.trim(),
+              deviceId: values.deviceId.trim(),
+              platform: values.platform,
+              clientAppVersion: trimmedOrUndefined(values.clientAppVersion),
+              osVersion: trimmedOrUndefined(values.osVersion),
+              pushToken: trimmedOrUndefined(values.pushToken),
+              pushProvider: trimmedOrUndefined(values.pushProvider),
+            })
+            flash(t('devices.form.success.created'), 'success')
+            router.push('/backend/devices')
+          }}
+        />
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/devices/backend/devices/page.meta.ts

@@ -0,0 +1,21 @@
+import React from 'react'
+
+const deviceIcon = React.createElement(
+  'svg',
+  { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 2 },
+  React.createElement('rect', { x: 5, y: 2, width: 14, height: 20, rx: 2, ry: 2 }),
+  React.createElement('path', { d: 'M12 18h.01' }),
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['devices.admin'],
+  pageTitle: 'Devices',
+  pageTitleKey: 'devices.nav.devices',
+  pageGroup: 'Auth',
+  pageGroupKey: 'settings.sections.auth',
+  pageOrder: 4,
+  icon: deviceIcon,
+  pageContext: 'settings' as const,
+  breadcrumb: [{ label: 'Devices', labelKey: 'devices.nav.devices' }],
+}

package/src/modules/devices/backend/devices/page.tsx

@@ -0,0 +1,259 @@
+"use client"
+import * as React from 'react'
+import Link from 'next/link'
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { DataTable } from '@open-mercato/ui/backend/DataTable'
+import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { RowActions } from '@open-mercato/ui/backend/RowActions'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
+
+type Row = {
+  id: string
+  user_id: string
+  device_id: string
+  platform: string
+  client_app_version: string | null
+  os_version: string | null
+  push_provider: string | null
+  push_token_updated_at: string | null
+  last_seen_at: string | null
+  created_at: string | null
+}
+
+type ResponsePayload = {
+  items: Row[]
+  total: number
+  page?: number
+  pageSize?: number
+  totalPages: number
+}
+
+function formatDate(value: string | null, t: (key: string) => string) {
+  if (!value) return t('devices.list.noValue')
+  try {
+    const date = new Date(value)
+    if (Number.isNaN(date.getTime())) return t('devices.list.noValue')
+    return date.toLocaleString()
+  } catch {
+    return t('devices.list.noValue')
+  }
+}
+
+export default function DevicesAdminListPage() {
+  const [rows, setRows] = React.useState<Row[]>([])
+  const [page, setPage] = React.useState(1)
+  const [total, setTotal] = React.useState(0)
+  const [totalPages, setTotalPages] = React.useState(1)
+  const [isLoading, setIsLoading] = React.useState(true)
+  const [reloadToken, setReloadToken] = React.useState(0)
+  const scopeVersion = useOrganizationScopeVersion()
+  const t = useT()
+  const { confirm, ConfirmDialogElement } = useConfirmDialog()
+  const [filterValues, setFilterValues] = React.useState<FilterValues>({})
+  const [userOptions, setUserOptions] = React.useState<{ value: string; label: string; description?: string | null }[]>([])
+
+  // Devices admins may not hold auth.users.list; degrade gracefully (no options) instead of redirecting.
+  const loadUserOptions = React.useCallback(async (query?: string) => {
+    const params = new URLSearchParams()
+    params.set('page', '1')
+    params.set('pageSize', '20')
+    if (query && query.trim().length > 0) params.set('search', query.trim())
+    const call = await apiCall<{ items?: { id: string; name?: string | null; email?: string | null }[] }>(
+      `/api/auth/users?${params.toString()}`,
+      { headers: { 'x-om-forbidden-redirect': '0' } },
+      { fallback: null },
+    ).catch(() => null)
+    if (!call || !call.ok) return []
+    const next = (call.result?.items ?? []).flatMap((item) => {
+      if (!item || typeof item.id !== 'string' || !item.id.trim()) return []
+      const name = typeof item.name === 'string' && item.name.trim() ? item.name.trim() : null
+      const email = typeof item.email === 'string' && item.email.trim() ? item.email.trim() : null
+      const label = name ?? email ?? item.id
+      return [{ value: item.id, label, description: email && email !== label ? email : null }]
+    })
+    setUserOptions((prev) => {
+      const map = new Map(prev.map((opt) => [opt.value, opt]))
+      for (const opt of next) map.set(opt.value, opt)
+      return Array.from(map.values())
+    })
+    return next
+  }, [])
+
+  React.useEffect(() => { void loadUserOptions() }, [loadUserOptions, scopeVersion])
+
+  // Reuse the picker cache to label the User column; rows whose owner isn't cached still link by id.
+  const userLabelById = React.useMemo(
+    () => new Map(userOptions.map((opt) => [opt.value, opt.label])),
+    [userOptions],
+  )
+
+  const filters = React.useMemo<FilterDef[]>(() => [
+    {
+      id: 'platform',
+      label: t('devices.list.columns.platform'),
+      type: 'select',
+      options: [
+        { value: 'ios', label: 'iOS' },
+        { value: 'android', label: 'Android' },
+        { value: 'web', label: 'Web' },
+      ],
+    },
+    {
+      id: 'userId',
+      label: t('devices.list.columns.user'),
+      type: 'combobox',
+      options: userOptions,
+      loadOptions: loadUserOptions,
+    },
+  ], [t, userOptions, loadUserOptions])
+
+  React.useEffect(() => {
+    let cancelled = false
+    async function load() {
+      setIsLoading(true)
+      try {
+        const params = new URLSearchParams()
+        params.set('page', String(page))
+        params.set('pageSize', '50')
+        const platform = typeof filterValues.platform === 'string' ? filterValues.platform.trim() : ''
+        const userId = typeof filterValues.userId === 'string' ? filterValues.userId.trim() : ''
+        if (platform) params.set('platform', platform)
+        if (userId) params.set('userId', userId)
+        const fallback: ResponsePayload = { items: [], total: 0, page, totalPages: 1 }
+        const call = await apiCall<ResponsePayload>(`/api/devices/admin/devices?${params.toString()}`, undefined, { fallback })
+        if (!call.ok) {
+          const errorPayload = call.result as { error?: string } | undefined
+          const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('devices.list.error.loadFailed')
+          flash(message, 'error')
+          return
+        }
+        const payload = call.result ?? fallback
+        if (!cancelled) {
+          setRows(Array.isArray(payload.items) ? payload.items : [])
+          setTotal(payload.total || 0)
+          setTotalPages(payload.totalPages || 1)
+        }
+      } catch (error) {
+        if (!cancelled) {
+          const message = error instanceof Error ? error.message : t('devices.list.error.loadFailed')
+          flash(message, 'error')
+        }
+      } finally {
+        if (!cancelled) setIsLoading(false)
+      }
+    }
+    load()
+    return () => { cancelled = true }
+  }, [page, reloadToken, scopeVersion, filterValues, t])
+
+  const handleDeactivate = React.useCallback(async (row: Row) => {
+    const confirmed = await confirm({
+      title: t('devices.list.confirmDeactivate'),
+      variant: 'destructive',
+    })
+    if (!confirmed) return
+    try {
+      // optimistic-lock-exempt: device deactivate is an idempotent soft-delete of a registry row, not a concurrent field edit
+      const call = await apiCall<{ error?: string }>(
+        `/api/devices/admin/devices/${encodeURIComponent(row.id)}`,
+        { method: 'DELETE' },
+        { fallback: null },
+      )
+      if (!call.ok) {
+        const errorPayload = call.result as { error?: string } | undefined
+        const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('devices.list.error.deactivateFailed')
+        flash(message, 'error')
+        return
+      }
+      flash(t('devices.list.success.deactivated'), 'success')
+      setReloadToken((token) => token + 1)
+    } catch (error) {
+      const message = error instanceof Error ? error.message : t('devices.list.error.deactivateFailed')
+      flash(message, 'error')
+    }
+  }, [confirm, t])
+
+  const columns = React.useMemo<ColumnDef<Row>[]>(() => [
+    {
+      accessorKey: 'device_id',
+      header: t('devices.list.columns.device'),
+      cell: ({ row }) => <code className="text-xs">{row.original.device_id}</code>,
+    },
+    { accessorKey: 'platform', header: t('devices.list.columns.platform') },
+    {
+      accessorKey: 'user_id',
+      header: t('devices.list.columns.user'),
+      cell: ({ row }) => {
+        const userId = row.original.user_id
+        const label = userLabelById.get(userId)
+        return (
+          // Stop the click bubbling to the row, whose default action navigates to the device edit page.
+          <Link
+            href={`/backend/users/${encodeURIComponent(userId)}/edit`}
+            className="text-primary hover:underline"
+            onClick={(e) => e.stopPropagation()}
+          >
+            {label ?? <code className="text-xs">{userId}</code>}
+          </Link>
+        )
+      },
+    },
+    {
+      accessorKey: 'client_app_version',
+      header: t('devices.list.columns.appVersion'),
+      cell: ({ row }) => row.original.client_app_version || t('devices.list.noValue'),
+    },
+    {
+      accessorKey: 'os_version',
+      header: t('devices.list.columns.osVersion'),
+      cell: ({ row }) => row.original.os_version || t('devices.list.noValue'),
+    },
+    {
+      accessorKey: 'push_provider',
+      header: t('devices.list.columns.pushProvider'),
+      cell: ({ row }) => row.original.push_provider || t('devices.list.noValue'),
+    },
+    {
+      accessorKey: 'last_seen_at',
+      header: t('devices.list.columns.lastSeen'),
+      cell: ({ row }) => formatDate(row.original.last_seen_at, t),
+    },
+  ], [t, userLabelById])
+
+  return (
+    <Page>
+      <PageBody>
+        <DataTable
+          title={t('devices.list.title')}
+          actions={(
+            <Button asChild>
+              <Link href="/backend/devices/create">{t('devices.list.actions.register')}</Link>
+            </Button>
+          )}
+          columns={columns}
+          data={rows}
+          filters={filters}
+          filterValues={filterValues}
+          onFiltersApply={(values) => { setFilterValues(values); setPage(1) }}
+          onFiltersClear={() => { setFilterValues({}); setPage(1) }}
+          perspective={{ tableId: 'devices.list' }}
+          rowActions={(row) => (
+            <RowActions items={[
+              { id: 'edit', label: t('devices.list.actions.edit'), href: `/backend/devices/${row.id}` },
+              { id: 'deactivate', label: t('devices.list.actions.deactivate'), destructive: true, onSelect: () => { void handleDeactivate(row) } },
+            ]} />
+          )}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
+          isLoading={isLoading}
+        />
+      </PageBody>
+      {ConfirmDialogElement}
+    </Page>
+  )
+}

package/src/modules/devices/commands/deactivate.ts

@@ -0,0 +1,126 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
+import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import { emitCrudSideEffects, emitCrudUndoSideEffects } from '@open-mercato/shared/lib/commands/helpers'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { assertFound } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
+import { UserDevice } from '../data/entities'
+import { deactivateDeviceCommandSchema, type DeactivateDeviceCommandInput } from '../data/validators'
+import { emitDevicesEvent } from '../events'
+import {
+  applySnapshot,
+  deviceEvents,
+  deviceIndexer,
+  serializeDevice,
+  type DeviceSnapshot,
+  type DeviceUndoPayload,
+} from './shared'
+
+const deactivateDeviceCommand: CommandHandler<DeactivateDeviceCommandInput, { id: string }> = {
+  id: 'devices.user_devices.deactivate',
+  async prepare(rawInput, ctx) {
+    const parsed = deactivateDeviceCommandSchema.parse(rawInput)
+    // Enforce tenant scope and constrain the snapshot lookup to the caller's tenant.
+    ensureTenantScope(ctx, parsed.tenantId)
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    // No fallback decryption scope: `UserDevice` always carries its own organization_id, which
+    // `decryptEntitiesWithFallbackScope` resolves first — matching loadExistingDevice in shared.ts.
+    const device = await findOneWithDecryption(
+      em,
+      UserDevice,
+      { id: parsed.id, tenantId: parsed.tenantId, deletedAt: null },
+    )
+    return device ? { before: serializeDevice(device) } : {}
+  },
+  async execute(rawInput, ctx) {
+    const parsed = deactivateDeviceCommandSchema.parse(rawInput)
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    // Scope the load to the caller's tenant (mirroring `prepare`) instead of loading by id alone — a
+    // bare id lookup would let a cross-tenant id resolve a row before the post-load tenant check runs.
+    const device = assertFound(
+      await findOneWithDecryption(em, UserDevice, { id: parsed.id, tenantId: parsed.tenantId, deletedAt: null }),
+      'Device not found',
+    )
+    ensureTenantScope(ctx, device.tenantId)
+    // Enforce the ORGANIZATION scope the caller handed us instead of leaving it unread. Without this the
+    // org context threaded through the push "unregister null-org" path — and any org-scoped admin
+    // dispatch — is silently ignored, so a caller scoped to org A could deactivate an org-B device in
+    // the same tenant. Guard on a non-null org: tenant-scoped devices (org = null) have nothing to
+    // constrain, and the system/worker path passes `selectedOrganizationId = device.organizationId`,
+    // which `ensureOrganizationScope` accepts.
+    if (device.organizationId) ensureOrganizationScope(ctx, device.organizationId)
+
+    await withAtomicFlush(em, [() => { device.deletedAt = new Date() }], { transaction: true })
+
+    const de = ctx.container.resolve('dataEngine') as DataEngine
+    await emitCrudSideEffects({
+      dataEngine: de,
+      action: 'deleted',
+      entity: device,
+      identifiers: {
+        id: device.id,
+        tenantId: device.tenantId,
+        organizationId: device.organizationId ?? null,
+      },
+      indexer: deviceIndexer,
+      events: deviceEvents,
+    })
+    await emitDevicesEvent(
+      'devices.user_device.deactivated',
+      {
+        id: device.id,
+        tenantId: device.tenantId,
+        organizationId: device.organizationId ?? null,
+        userId: device.userId,
+        deviceId: device.deviceId,
+      },
+      { persistent: true },
+    )
+
+    return { id: device.id }
+  },
+  buildLog: async ({ snapshots }) => {
+    const before = (snapshots.before as DeviceSnapshot | undefined) ?? null
+    if (!before) return null
+    return {
+      actionLabel: 'Deactivate device',
+      resourceKind: 'devices.user_device',
+      resourceId: before.id,
+      tenantId: before.tenantId,
+      organizationId: before.organizationId,
+      snapshotBefore: before,
+      payload: {
+        undo: { before } satisfies DeviceUndoPayload,
+      },
+    }
+  },
+  undo: async ({ logEntry, ctx }) => {
+    const payload = extractUndoPayload<DeviceUndoPayload>(logEntry)
+    const before = payload?.before
+    if (!before) return
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const device = await findOneWithDecryption(em, UserDevice, { id: before.id })
+    if (!device) return
+
+    await withAtomicFlush(em, [() => applySnapshot(device, before)], { transaction: true })
+
+    const de = ctx.container.resolve('dataEngine') as DataEngine
+    await emitCrudUndoSideEffects({
+      dataEngine: de,
+      action: 'created',
+      entity: device,
+      identifiers: {
+        id: device.id,
+        tenantId: device.tenantId,
+        organizationId: device.organizationId ?? null,
+      },
+      indexer: deviceIndexer,
+      events: deviceEvents,
+    })
+  },
+}
+
+registerCommand(deactivateDeviceCommand)

package/src/modules/devices/commands/index.ts

@@ -0,0 +1,3 @@
+import './register'
+import './update'
+import './deactivate'