@open-mercato/core 0.6.8-develop.7096.1.97319f09f6 → 0.6.8-develop.7100.1.fbf66fca35

package/src/modules/auth/api/users/route.ts

@@ -26,6 +26,7 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
+import { MAX_USER_LOOKUP_IDS, resolveUserIdFilter } from '@open-mercato/core/modules/auth/lib/userIdFilter'
 import { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
 import {
@@ -38,6 +39,7 @@ const logger = createLogger('auth').child({ component: 'users' })
 
 const querySchema = z.object({
   id: z.string().uuid().optional(),
+  ids: z.string().optional().describe('Comma-separated user identifiers, at most 100'),
   page: z.coerce.number().min(1).default(1),
   pageSize: z.coerce.number().min(1).max(100).default(50),
   search: z.string().optional(),
@@ -204,10 +206,17 @@ export async function GET(req: Request) {
   if (!auth) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
   const url = new URL(req.url)
   const rawRoleIds = url.searchParams.getAll('roleId').filter((id): id is string => typeof id === 'string' && id.trim().length > 0)
+  // Accept both the repeated (`?ids=a&ids=b`) and comma-joined (`?ids=a,b`) spellings.
+  const rawIds = url.searchParams.getAll('ids').join(',') || undefined
+  const userIdFilter = resolveUserIdFilter(rawIds, url.searchParams.get('id'))
   const parsed = querySchema.safeParse({
     id: url.searchParams.get('id') || undefined,
+    ids: rawIds,
     page: url.searchParams.get('page') || undefined,
-    pageSize: url.searchParams.get('pageSize') || undefined,
+    // A caller resolving a batch of ids wants all of them; without this the default page of 50
+    // would silently truncate a 100-id lookup.
+    pageSize: url.searchParams.get('pageSize')
+      || (rawIds && userIdFilter.kind === 'ids' ? String(Math.min(userIdFilter.ids.length, MAX_USER_LOOKUP_IDS)) : undefined),
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
@@ -228,6 +237,9 @@ export async function GET(req: Request) {
     logger.error('Failed to resolve rbac', { err })
   }
   const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
+  if (userIdFilter.kind === 'none') {
+    return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
+  }
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -293,7 +305,8 @@ export async function GET(req: Request) {
     }
     filters.push(displayNameFilters.length > 1 ? { $or: displayNameFilters } : displayNameFilters[0])
   }
-  let idFilter: Set<string> | null = id ? new Set([id]) : null
+  // `?id=` and `?ids=` are already intersected by resolveUserIdFilter.
+  let idFilter: Set<string> | null = userIdFilter.kind === 'ids' ? new Set(userIdFilter.ids) : null
   if (Array.isArray(roleIds) && roleIds.length > 0) {
     const uniqueRoleIds = Array.from(new Set(roleIds))
     const linksForRoles = await em.find(
@@ -387,10 +400,10 @@ export async function GET(req: Request) {
 
     filters.push(searchFilters.length > 1 ? { $or: searchFilters } : searchFilters[0])
   }
+  // `?id=` has no separate path: resolveUserIdFilter folds it into `idFilter`, and a `kind: 'none'`
+  // outcome already returned above, so `idFilter` is null only when neither param was supplied.
   if (idFilter && idFilter.size) {
     filters.push({ id: { $in: Array.from(idFilter) as any } })
-  } else if (id) {
-    filters.push({ id })
   }
   const where = filters.length > 1 ? { $and: filters } : filters[0]
   const [rows, count] = await em.findAndCount(User, where, { limit: pageSize, offset: (page - 1) * pageSize })
@@ -713,7 +726,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record). Pass ids=<uuid>,<uuid> (max 100) to resolve a known set of users in one request, for example to label a list of foreign keys; it intersects with id and roleId, and a supplied ids value that contains no valid identifier matches nothing.',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/lib/userIdFilter.ts

@@ -0,0 +1,31 @@
+import { isIdsParamProvided, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'
+
+// Batch id lookup shares the list's page cap, so `?ids=` can never pull more rows than `?pageSize=`.
+export const MAX_USER_LOOKUP_IDS = 100
+
+export type UserIdFilter =
+  /** Neither `?id=` nor `?ids=` was supplied — the list is filtered by the other params only. */
+  | { kind: 'unfiltered' }
+  /** Restrict the list to these ids. */
+  | { kind: 'ids'; ids: string[] }
+  /**
+   * `?ids=` was supplied but nothing usable survived — either no value was a UUID, or the
+   * intersection with `?id=` is empty. Match nothing rather than dropping the filter and returning
+   * the full first page, which would turn a malformed request into a record-count side channel
+   * (the same rule `mergeIdFilter` enforces for CRUD list routes, #4143 Finding 3).
+   */
+  | { kind: 'none' }
+
+export function resolveUserIdFilter(
+  rawIds: unknown,
+  id?: string | null,
+  maxIds: number = MAX_USER_LOOKUP_IDS,
+): UserIdFilter {
+  const single = typeof id === 'string' && id.trim() ? id.trim() : null
+  if (!isIdsParamProvided(rawIds)) {
+    return single ? { kind: 'ids', ids: [single] } : { kind: 'unfiltered' }
+  }
+  const parsed = parseIdsParam(rawIds, maxIds)
+  const ids = single ? parsed.filter((value) => value === single) : parsed
+  return ids.length ? { kind: 'ids', ids } : { kind: 'none' }
+}

package/src/modules/devices/AGENTS.md

@@ -97,9 +97,20 @@ write busts both caches (see cache-tag note above).
 ## ACL
 
 `devices.view`, `devices.manage` (self-serve), `devices.admin` (cross-user). Defaults in `setup.ts`:
-`superadmin`/`admin` get `devices.*`; `employee` gets `view` + `manage`. Run
+`superadmin`/`admin` get `devices.*` **plus `auth.users.list`**; `employee` gets `view` + `manage`. Run
 `yarn mercato auth sync-role-acls` after changing `acl.ts`/`setup.ts` to backfill existing tenants.
 
+`devices.admin` declares `dependsOn: ['auth.users.list']`: the admin screens name owners by person,
+and the register form's owner picker rejects values that do not resolve to a directory entry, so a
+role holding `devices.admin` without the dependency cannot complete that form. `dependsOn` only
+surfaces the gap in the ACL editor — it does not grant. Run the sync command above after deploying
+an ACL change here.
+
+The picker is `allowCustomValues: false`. That rejects free text and an id belonging to nobody; it
+does **not** reject a raw id that is already a known option, because `ComboboxInput` matches on
+`option.value` and `CrudForm` keeps the unfiltered first page as suggestions for the form's
+lifetime. Either way the submitted value is a real user in the caller's scope.
+
 ## Validation Commands
 
 ```bash

package/src/modules/devices/acl.ts

@@ -1,7 +1,15 @@
 export const features = [
   { id: 'devices.view', title: 'View own devices', module: 'devices' },
   { id: 'devices.manage', title: 'Manage own devices', module: 'devices' },
-  { id: 'devices.admin', title: 'Manage devices across users', module: 'devices' },
+  {
+    id: 'devices.admin',
+    title: 'Manage devices across users',
+    module: 'devices',
+    // Managing devices across users means naming the owner, and the admin screens name them by
+    // person rather than by UUID: the register form's owner picker and the owner column on both
+    // list and detail resolve through `GET /api/auth/users`, which `auth.users.list` gates.
+    dependsOn: ['auth.users.list'],
+  },
 ]
 
 export default features

package/src/modules/devices/backend/devices/[id]/page.tsx

@@ -9,6 +9,7 @@ import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { LoadingMessage, ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { useDeviceUserLabels } from '../useDeviceUserLabels'
 
 type DeviceDetail = {
   id: string
@@ -35,7 +36,6 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
   const [isLoading, setIsLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
   const [notFound, setNotFound] = React.useState(false)
-  const [userLabel, setUserLabel] = React.useState<string | null>(null)
 
   React.useEffect(() => {
     let cancelled = false
@@ -63,24 +63,10 @@ export default function DeviceAdminEditPage({ params }: { params?: { id?: string
   }, [id, t])
 
   // Resolve the owner's display name for a link to their profile. Devices admins may not hold
-  // auth.users.list, so fall back to the raw id (rendered without a link) instead of redirecting.
-  React.useEffect(() => {
-    const userId = device?.userId
-    if (!userId) return
-    let cancelled = false
-    void (async () => {
-      const call = await apiCall<{ items?: { id: string; name?: string | null; email?: string | null }[] }>(
-        `/api/auth/users?id=${encodeURIComponent(userId)}`,
-        { headers: { 'x-om-forbidden-redirect': '0' } },
-        { fallback: null },
-      ).catch(() => null)
-      if (cancelled || !call || !call.ok) return
-      const found = call.result?.items?.find((u) => u.id === userId)
-      const label = found?.name?.trim() || found?.email?.trim() || null
-      if (label) setUserLabel(label)
-    })()
-    return () => { cancelled = true }
-  }, [device?.userId])
+  // auth.users.list, so this falls back to the raw id (rendered without a link) instead of redirecting.
+  const ownerIds = React.useMemo(() => [device?.userId], [device?.userId])
+  const userLabels = useDeviceUserLabels(ownerIds)
+  const userLabel = device?.userId ? userLabels[device.userId] ?? null : null
 
   const fields = React.useMemo<CrudField[]>(() => [
     { id: 'clientAppVersion', label: t('devices.form.appVersion'), type: 'text' },

package/src/modules/devices/backend/devices/create/page.tsx

@@ -6,6 +6,7 @@ import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/b
 import { createCrud } from '@open-mercato/ui/backend/utils/crud'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { loadDeviceUserOptions } from '../userOptions'
 
 type FormValues = {
   userId: string
@@ -27,7 +28,22 @@ export default function DeviceAdminCreatePage() {
   const t = useT()
 
   const fields = React.useMemo<CrudField[]>(() => [
-    { id: 'userId', label: t('devices.form.userId'), type: 'text', required: true, description: t('devices.form.userIdHint') },
+    {
+      id: 'userId',
+      label: t('devices.form.userId'),
+      type: 'combobox',
+      required: true,
+      description: t('devices.form.userIdHint'),
+      placeholder: t('devices.form.userIdPlaceholder'),
+      loadOptions: loadDeviceUserOptions,
+      // The owner must resolve to a real directory entry: `ComboboxInput` reverts anything that is
+      // not a known option on blur, so free text and an id belonging to nobody never reach submit.
+      // (A raw id that IS a known option still resolves — `findOptionForInput` matches on value, and
+      // `CrudForm` keeps the unfiltered first page as suggestions — which is a real user either way.)
+      // `devices.admin` declares `dependsOn: ['auth.users.list']` in `acl.ts`, so a role that can
+      // reach this form can also search the directory that fills the picker.
+      allowCustomValues: false,
+    },
     { id: 'deviceId', label: t('devices.form.deviceId'), type: 'text', required: true },
     {
       id: 'platform',

package/src/modules/devices/backend/devices/page.tsx

@@ -12,6 +12,8 @@ import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/u
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
+import { loadDeviceUserOptions, type DeviceUserOption } from './userOptions'
+import { useDeviceUserLabels } from './useDeviceUserLabels'
 
 type Row = {
   id: string
@@ -58,43 +60,37 @@ export default function DevicesAdminListPage() {
   const t = useT()
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const [filterValues, setFilterValues] = React.useState<FilterValues>({})
-  const [userOptions, setUserOptions] = React.useState<{ value: string; label: string; description?: string | null }[]>([])
+  const [userOptions, setUserOptions] = React.useState<DeviceUserOption[]>([])
 
-  // Devices admins may not hold auth.users.list; degrade gracefully (no options) instead of redirecting.
-  const loadUserOptions = React.useCallback(async (query?: string) => {
-    const params = new URLSearchParams()
-    params.set('page', '1')
-    params.set('pageSize', '20')
-    if (query && query.trim().length > 0) params.set('search', query.trim())
-    const call = await apiCall<{ items?: { id: string; name?: string | null; email?: string | null }[] }>(
-      `/api/auth/users?${params.toString()}`,
-      { headers: { 'x-om-forbidden-redirect': '0' } },
-      { fallback: null },
-    ).catch(() => null)
-    if (!call || !call.ok) return []
-    const next = (call.result?.items ?? []).flatMap((item) => {
-      if (!item || typeof item.id !== 'string' || !item.id.trim()) return []
-      const name = typeof item.name === 'string' && item.name.trim() ? item.name.trim() : null
-      const email = typeof item.email === 'string' && item.email.trim() ? item.email.trim() : null
-      const label = name ?? email ?? item.id
-      return [{ value: item.id, label, description: email && email !== label ? email : null }]
-    })
+  const mergeUserOptions = React.useCallback((next: DeviceUserOption[]) => {
+    if (next.length === 0) return
     setUserOptions((prev) => {
       const map = new Map(prev.map((opt) => [opt.value, opt]))
       for (const opt of next) map.set(opt.value, opt)
       return Array.from(map.values())
     })
-    return next
   }, [])
 
+  // Devices admins may not hold auth.users.list; the helper degrades to no options instead of
+  // redirecting the whole page to /login.
+  const loadUserOptions = React.useCallback(async (query?: string) => {
+    const next = await loadDeviceUserOptions(query)
+    mergeUserOptions(next)
+    return next
+  }, [mergeUserOptions])
+
   React.useEffect(() => { void loadUserOptions() }, [loadUserOptions, scopeVersion])
 
-  // Reuse the picker cache to label the User column; rows whose owner isn't cached still link by id.
   const userLabelById = React.useMemo(
     () => new Map(userOptions.map((opt) => [opt.value, opt.label])),
     [userOptions],
   )
 
+  // The picker only ever caches the users it happened to prefetch, so resolve the owners of the rows
+  // actually on this page. Without it most rows render a bare UUID.
+  const rowUserIds = React.useMemo(() => rows.map((row) => row.userId), [rows])
+  const resolvedUserLabels = useDeviceUserLabels(rowUserIds)
+
   const filters = React.useMemo<FilterDef[]>(() => [
     {
       id: 'platform',
@@ -194,7 +190,7 @@ export default function DevicesAdminListPage() {
       header: t('devices.list.columns.user'),
       cell: ({ row }) => {
         const userId = row.original.userId
-        const label = userLabelById.get(userId)
+        const label = resolvedUserLabels[userId] ?? userLabelById.get(userId)
         return (
           // Stop the click bubbling to the row, whose default action navigates to the device edit page.
           <Link
@@ -227,7 +223,7 @@ export default function DevicesAdminListPage() {
       header: t('devices.list.columns.lastSeen'),
       cell: ({ row }) => formatDate(row.original.lastSeenAt, t),
     },
-  ], [t, userLabelById])
+  ], [t, userLabelById, resolvedUserLabels])
 
   return (
     <Page>

package/src/modules/devices/backend/devices/useDeviceUserLabels.ts

@@ -0,0 +1,45 @@
+'use client'
+
+import * as React from 'react'
+import { resolveDeviceUserOptions } from './userOptions'
+
+// Resolves owner ids that are on screen into display labels. Modelled on
+// warranty_claims/backend/components/useUserDisplayNames, but every failure degrades to an empty
+// map instead of throwing: a devices admin without `auth.users.list` must still see the page.
+export function useDeviceUserLabels(userIds: readonly (string | null | undefined)[]): Record<string, string> {
+  const [labels, setLabels] = React.useState<Record<string, string>>({})
+  const resolvedIdsRef = React.useRef<Set<string>>(new Set())
+
+  const idsKey = React.useMemo(() => {
+    const normalized = new Set<string>()
+    for (const userId of userIds) {
+      if (typeof userId === 'string' && userId.trim()) normalized.add(userId.trim())
+    }
+    return Array.from(normalized)
+      .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0))
+      .join(',')
+  }, [userIds])
+
+  React.useEffect(() => {
+    if (!idsKey) return
+    const unresolved = idsKey.split(',').filter((userId) => !resolvedIdsRef.current.has(userId))
+    if (unresolved.length === 0) return
+
+    const controller = new AbortController()
+    void resolveDeviceUserOptions(unresolved, controller.signal)
+      .then(({ options, resolvedIds }) => {
+        if (controller.signal.aborted) return
+        // Only ids the server actually answered for are remembered. Marking an id whose request
+        // failed would keep its row showing a bare UUID for the life of the component, even though
+        // the next attempt would have worked.
+        for (const userId of resolvedIds) resolvedIdsRef.current.add(userId)
+        const next: Record<string, string> = {}
+        for (const option of options) next[option.value] = option.label
+        if (Object.keys(next).length) setLabels((current) => ({ ...current, ...next }))
+      })
+      .catch(() => {})
+    return () => controller.abort()
+  }, [idsKey])
+
+  return labels
+}

package/src/modules/devices/backend/devices/userOptions.ts

@@ -0,0 +1,99 @@
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { MAX_USER_LOOKUP_IDS } from '@open-mercato/core/modules/auth/lib/userIdFilter'
+
+export type DeviceUserOption = {
+  value: string
+  label: string
+}
+
+type AuthUserItem = {
+  id?: unknown
+  name?: unknown
+  email?: unknown
+}
+
+const SEARCH_PAGE_SIZE = 20
+// Imported rather than restated: `parseIdsParam` slices past the route's cap without complaining,
+// so a client batch larger than the server accepts loses the overflow ids silently.
+const MAX_IDS_PER_LOOKUP = MAX_USER_LOOKUP_IDS
+
+/**
+ * Two label styles on purpose. A picker suggestion has to disambiguate two people with the same
+ * display name, and neither `CrudForm`'s combobox nor `FilterBar` renders anything but the label —
+ * so the email has to live in the label there. A resolved column label is read next to a device,
+ * where the email is noise.
+ */
+type LabelStyle = 'search' | 'compact'
+
+function toOption(item: AuthUserItem | null | undefined, style: LabelStyle): DeviceUserOption[] {
+  if (!item || typeof item.id !== 'string' || !item.id.trim()) return []
+  const id = item.id.trim()
+  const name = typeof item.name === 'string' && item.name.trim() ? item.name.trim() : null
+  const email = typeof item.email === 'string' && item.email.trim() ? item.email.trim() : null
+  const label = style === 'search' && name && email ? `${name} — ${email}` : name ?? email ?? id
+  return [{ value: id, label }]
+}
+
+// `devices.admin` declares `dependsOn: ['auth.users.list']`, but dependsOn only diagnoses — a
+// hand-built role can still reach these screens without it until the ACL editor or
+// `sync-role-acls` fixes it. `x-om-forbidden-redirect: 0` keeps that 403 from bouncing the whole
+// page to /login. `null` means the call itself failed, which callers must not
+// confuse with a successful call that matched nobody — a caller caching "already resolved" would
+// otherwise remember a transient network error forever.
+async function fetchUsers(
+  params: URLSearchParams,
+  style: LabelStyle,
+  signal?: AbortSignal,
+): Promise<DeviceUserOption[] | null> {
+  const call = await apiCall<{ items?: AuthUserItem[] }>(
+    `/api/auth/users?${params.toString()}`,
+    { headers: { 'x-om-forbidden-redirect': '0' }, signal },
+    { fallback: null },
+  ).catch(() => null)
+  if (!call || !call.ok) return null
+  return (call.result?.items ?? []).flatMap((item) => toOption(item, style))
+}
+
+export async function loadDeviceUserOptions(query?: string): Promise<DeviceUserOption[]> {
+  const params = new URLSearchParams()
+  params.set('page', '1')
+  params.set('pageSize', String(SEARCH_PAGE_SIZE))
+  const trimmed = query?.trim()
+  if (trimmed) params.set('search', trimmed)
+  // A picker has nothing to cache, so a failed lookup is just an empty suggestion list.
+  return (await fetchUsers(params, 'search')) ?? []
+}
+
+/**
+ * The outcome of a batch lookup. `resolvedIds` lists the ids the server actually answered for —
+ * an id that came back without a row (deleted user) still counts as resolved, an id whose request
+ * failed does not. Callers cache on `resolvedIds`, so a transient failure is retried rather than
+ * remembered as a permanent blank.
+ */
+export type DeviceUserLookup = {
+  options: DeviceUserOption[]
+  resolvedIds: string[]
+}
+
+// Batch id → label resolution for rows already on screen, so a device whose owner never appeared in
+// a search result still renders a name instead of a bare UUID.
+export async function resolveDeviceUserOptions(ids: string[], signal?: AbortSignal): Promise<DeviceUserLookup> {
+  const unique = Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))
+  if (unique.length === 0) return { options: [], resolvedIds: [] }
+  const options: DeviceUserOption[] = []
+  const resolvedIds: string[] = []
+  for (let offset = 0; offset < unique.length; offset += MAX_IDS_PER_LOOKUP) {
+    const batch = unique.slice(offset, offset + MAX_IDS_PER_LOOKUP)
+    const params = new URLSearchParams()
+    params.set('page', '1')
+    params.set('pageSize', String(batch.length))
+    // URLSearchParams encodes on toString(); pre-encoding here would double-escape the commas.
+    params.set('ids', batch.join(','))
+    const batchOptions = await fetchUsers(params, 'compact', signal)
+    // One failed batch must not cost the batches that did answer.
+    if (batchOptions === null) continue
+    options.push(...batchOptions)
+    resolvedIds.push(...batch)
+  }
+  return { options, resolvedIds }
+}

package/src/modules/devices/i18n/de.json

@@ -23,8 +23,9 @@
   "devices.form.pushTokenHint": "Optional. Sicher gespeichert und nie wieder angezeigt.",
   "devices.form.success.created": "Gerät registriert",
   "devices.form.success.updated": "Gerät aktualisiert",
-  "devices.form.userId": "Benutzer-ID",
-  "devices.form.userIdHint": "UUID des Benutzers, dem dieses Gerät gehört.",
+  "devices.form.userId": "Benutzer",
+  "devices.form.userIdHint": "Namen oder E-Mail eingeben und den Besitzer aus der Liste auswählen.",
+  "devices.form.userIdPlaceholder": "Benutzer suchen",
   "devices.list.actions.deactivate": "Deaktivieren",
   "devices.list.actions.edit": "Bearbeiten",
   "devices.list.actions.register": "Gerät registrieren",

package/src/modules/devices/i18n/en.json

@@ -23,8 +23,9 @@
   "devices.form.pushTokenHint": "Optional. Stored securely and never shown again.",
   "devices.form.success.created": "Device registered",
   "devices.form.success.updated": "Device updated",
-  "devices.form.userId": "User ID",
-  "devices.form.userIdHint": "UUID of the user who owns this device.",
+  "devices.form.userId": "User",
+  "devices.form.userIdHint": "Start typing a name or email, then pick the owner from the list.",
+  "devices.form.userIdPlaceholder": "Search users",
   "devices.list.actions.deactivate": "Deactivate",
   "devices.list.actions.edit": "Edit",
   "devices.list.actions.register": "Register device",

package/src/modules/devices/i18n/es.json

@@ -23,8 +23,9 @@
   "devices.form.pushTokenHint": "Opcional. Se almacena de forma segura y no se vuelve a mostrar.",
   "devices.form.success.created": "Dispositivo registrado",
   "devices.form.success.updated": "Dispositivo actualizado",
-  "devices.form.userId": "ID de usuario",
-  "devices.form.userIdHint": "UUID del usuario propietario de este dispositivo.",
+  "devices.form.userId": "Usuario",
+  "devices.form.userIdHint": "Empieza a escribir un nombre o correo electrónico y elige el propietario de la lista.",
+  "devices.form.userIdPlaceholder": "Buscar usuarios",
   "devices.list.actions.deactivate": "Desactivar",
   "devices.list.actions.edit": "Editar",
   "devices.list.actions.register": "Registrar dispositivo",

package/src/modules/devices/i18n/ko.json

@@ -23,8 +23,9 @@
   "devices.form.pushTokenHint": "선택 사항입니다. 안전하게 저장되며 다시 표시되지 않습니다.",
   "devices.form.success.created": "기기가 등록되었습니다",
   "devices.form.success.updated": "기기가 수정되었습니다",
-  "devices.form.userId": "사용자 ID",
-  "devices.form.userIdHint": "이 기기를 소유한 사용자의 UUID입니다.",
+  "devices.form.userId": "사용자",
+  "devices.form.userIdHint": "이름 또는 이메일을 입력한 다음 목록에서 소유자를 선택하세요.",
+  "devices.form.userIdPlaceholder": "사용자 검색",
   "devices.list.actions.deactivate": "비활성화",
   "devices.list.actions.edit": "수정",
   "devices.list.actions.register": "기기 등록",

package/src/modules/devices/i18n/pl.json

@@ -23,8 +23,9 @@
   "devices.form.pushTokenHint": "Opcjonalne. Token jest przechowywany bezpiecznie i nigdy więcej niewyświetlany.",
   "devices.form.success.created": "Urządzenie zarejestrowane",
   "devices.form.success.updated": "Urządzenie zaktualizowane",
-  "devices.form.userId": "ID użytkownika",
-  "devices.form.userIdHint": "UUID użytkownika, do którego należy to urządzenie.",
+  "devices.form.userId": "Użytkownik",
+  "devices.form.userIdHint": "Zacznij wpisywać nazwę lub e-mail, a następnie wybierz właściciela z listy.",
+  "devices.form.userIdPlaceholder": "Szukaj użytkowników",
   "devices.list.actions.deactivate": "Dezaktywuj",
   "devices.list.actions.edit": "Edytuj",
   "devices.list.actions.register": "Zarejestruj urządzenie",

package/src/modules/devices/setup.ts

@@ -2,8 +2,12 @@ import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
 
 export const setup: ModuleSetupConfig = {
   defaultRoleFeatures: {
-    superadmin: ['devices.*'],
-    admin: ['devices.*'],
+    // `auth.users.list` is granted alongside `devices.admin` rather than left to the auth module's
+    // own `admin: ['auth.*']`, so the dependency declared in `acl.ts` holds even where that grant
+    // was narrowed. Without it the owner picker has nothing to offer and the register form cannot
+    // be completed. Existing tenants pick this up via `yarn mercato auth sync-role-acls`.
+    superadmin: ['devices.*', 'auth.users.list'],
+    admin: ['devices.*', 'auth.users.list'],
     employee: ['devices.view', 'devices.manage'],
   },
 }

package/src/modules/wms/api/warehouseSearch.ts

@@ -0,0 +1,23 @@
+import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { locales } from '@open-mercato/shared/lib/i18n/config'
+import { matchCountryCodes } from '@open-mercato/shared/lib/location/countries'
+
+/**
+ * Warehouse list search matches name/code/city plus both stored country values:
+ * ISO codes (`PL`) and legacy free-text (`Poland`). Localized labels shown in
+ * the table (`Poland` / `Polska`) must resolve back to the stored ISO code.
+ */
+export function buildWarehouseListSearchOr(term: string): Array<Record<string, unknown>> {
+  const like = `%${escapeLikePattern(term)}%`
+  const orFilters: Array<Record<string, unknown>> = [
+    { name: { $ilike: like } },
+    { code: { $ilike: like } },
+    { city: { $ilike: like } },
+    { country: { $ilike: like } },
+  ]
+  const matchedCountryCodes = matchCountryCodes(term, { locales })
+  if (matchedCountryCodes.length > 0) {
+    orFilters.push({ country: { $in: matchedCountryCodes } })
+  }
+  return orFilters
+}

package/src/modules/wms/api/warehouses/route.ts

@@ -2,9 +2,9 @@ import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { parseScopedCommandInput, resolveCrudRecordId } from '@open-mercato/shared/lib/api/scoped'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { E } from '#generated/entities.ids.generated'
+import { buildWarehouseListSearchOr } from '../warehouseSearch'
 import { Warehouse } from '../../data/entities'
 import { warehouseCreateSchema, warehouseUpdateSchema } from '../../data/validators'
 import { createPagedListResponseSchema, createWmsCrudOpenApi, defaultOkResponseSchema } from '../openapi'
@@ -77,6 +77,9 @@ const crud = makeCrudRoute({
       F.created_at,
       F.updated_at,
     ],
+    decorateCustomFields: {
+      entityIds: E.wms.warehouse,
+    },
     sortFieldMap: {
       name: F.name,
       code: F.code,
@@ -94,13 +97,7 @@ const crud = makeCrudRoute({
       if (isActive !== null) filters[F.is_active] = { $eq: isActive }
       const term = query.search?.trim()
       if (term) {
-        const like = `%${escapeLikePattern(term)}%`
-        filters.$or = [
-          { [F.name]: { $ilike: like } },
-          { [F.code]: { $ilike: like } },
-          { [F.city]: { $ilike: like } },
-          { [F.country]: { $ilike: like } },
-        ]
+        filters.$or = buildWarehouseListSearchOr(term)
       }
       return filters
     },
@@ -113,7 +110,10 @@ const crud = makeCrudRoute({
         const { translate } = await resolveTranslations()
         return parseScopedCommandInput(warehouseCreateSchema, raw ?? {}, ctx, translate)
       },
-      response: ({ result }) => ({ id: result?.warehouseId ?? null }),
+      response: ({ result }) => ({
+        id: result?.warehouseId ?? null,
+        updatedAt: result?.updatedAt ?? null,
+      }),
       status: 201,
     },
     update: {
@@ -166,6 +166,10 @@ export const openApi = createWmsCrudOpenApi({
   listResponseSchema: createPagedListResponseSchema(warehouseListItemSchema),
   create: {
     schema: warehouseCreateSchema,
+    responseSchema: z.object({
+      id: z.string().uuid().nullable(),
+      updatedAt: z.string().nullable(),
+    }),
     description: 'Creates a warehouse for inventory operations.',
   },
   update: {