@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/dist/modules/auth/services/authService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/authService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  private async findUnconsumedPasswordReset(token: string): Promise<PasswordReset | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row) return null\n    if (row.usedAt && row.usedAt <= now) return null\n    if (row.expiresAt <= now) return null\n    return row\n  }\n\n  async isPasswordResetTokenValid(token: string): Promise<boolean> {\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return false\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    return user != null\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
-  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAc,4BAA4B,OAA8C;AACtF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,UAAU,IAAI,UAAU,IAAK,QAAO;AAC5C,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,OAAiC;AAC/D,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AAGjB,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
+  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,OAAQ,IAAI,UAAU,IAAI,UAAU,OAAQ,IAAI,aAAa,IAAK,QAAO;AAG9E,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/auth/services/rbacService.js

@@ -8,7 +8,6 @@ import {
   resolveEffectiveFeatures
 } from "@open-mercato/shared/security/featurePolicy";
 import { filterGrantsByEnabledModules } from "@open-mercato/shared/security/enabledModulesRegistry";
-import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from "./roleOrganizationScope.js";
 function isAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -20,13 +19,9 @@ function isAclData(value) {
   }
   return true;
 }
-function isRestrictedRoleAcl(acl) {
-  return Array.isArray(acl.organizationsJson) && acl.organizationsJson.length > 0 && !acl.organizationsJson.includes("__all__");
-}
 class RbacService {
-  constructor(em, cache, organizationHierarchyService) {
+  constructor(em, cache) {
     this.em = em;
-    this.organizationHierarchyService = organizationHierarchyService;
     this.cacheTtlMs = 5 * 60 * 1e3;
     // 5 minutes default
     this.cache = null;
@@ -44,6 +39,12 @@ class RbacService {
   hasAllFeatures(required, granted) {
     return authorizeFeatures(required, { grantedFeatures: granted });
   }
+  roleAclAllowsOrganization(acl, organizationId) {
+    if (!organizationId) return true;
+    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null;
+    if (!organizations || !organizations.length || organizations.includes("__all__")) return true;
+    return organizations.includes(organizationId);
+  }
   getCacheKey(userId, scope) {
     return `rbac:${userId}:${scope.tenantId || "null"}:${scope.organizationId || "null"}`;
   }
@@ -70,7 +71,6 @@ class RbacService {
     ];
     if (scope.tenantId) {
       tags.push(this.getTenantTag(scope.tenantId));
-      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId));
     }
     if (scope.organizationId) {
       tags.push(this.getOrganizationTag(scope.organizationId));
@@ -167,8 +167,8 @@ class RbacService {
       this.globalSuperAdminCache.set(userId, false);
       return false;
     }
-    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
-    const result = roleSupers.some((roleAcl) => !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl));
+    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds } });
+    const result = !!(roleSuper && roleSuper.isSuperAdmin);
     this.globalSuperAdminCache.set(userId, result);
     return result;
   }
@@ -215,55 +215,28 @@ class RbacService {
       }
       const tenantId2 = scope.tenantId || key.tenantId || null;
       const roleIds2 = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : [];
-      const keyOrganizationId = typeof key.organizationId === "string" && key.organizationId.trim().length > 0 ? key.organizationId.trim() : null;
-      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId;
       let isSuper2 = false;
       const features2 = [];
-      let roleOrganizations = [];
-      let hasApplicableRestrictedRole2 = false;
+      let organizations2 = key.organizationId ? [key.organizationId] : null;
       if (tenantId2 && roleIds2.length) {
-        const roleOrganizationScope = await resolveRoleOrganizationScope(
-          this.organizationHierarchyService,
-          tenantId2,
-          evaluatedOrganizationId
-        );
         const racls = await em2.find(RoleAcl, { tenantId: tenantId2, role: { $in: roleIds2 } });
         for (const acl of racls) {
-          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {
-            isSuper2 = isSuper2 || !!acl.isSuperAdmin;
-            if (Array.isArray(acl.featuresJson)) {
-              for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
-            }
-            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole2 = true;
+          isSuper2 = isSuper2 || !!acl.isSuperAdmin;
+          if (Array.isArray(acl.featuresJson)) {
+            for (const f of acl.featuresJson) if (!features2.includes(f)) features2.push(f);
           }
-          if (roleOrganizations !== null) {
-            if (acl.organizationsJson == null || Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0) {
-              roleOrganizations = null;
+          if (organizations2 !== null) {
+            if (acl.organizationsJson == null) {
+              organizations2 = null;
             } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes("__all__")) {
-              roleOrganizations = null;
+              organizations2 = null;
             } else {
-              roleOrganizations = Array.from(/* @__PURE__ */ new Set([
-                ...roleOrganizations,
-                ...Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []
-              ]));
+              organizations2 = Array.from(/* @__PURE__ */ new Set([...organizations2 || [], ...acl.organizationsJson]));
             }
           }
         }
-        if (roleOrganizations !== null && evaluatedOrganizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole2 && !roleOrganizations.includes(evaluatedOrganizationId)) {
-          roleOrganizations.push(evaluatedOrganizationId);
-        }
       }
-      let organizations2 = roleOrganizations;
-      if (keyOrganizationId) {
-        const keyOrganizationScope = await resolveRoleOrganizationScope(
-          this.organizationHierarchyService,
-          tenantId2,
-          keyOrganizationId
-        );
-        organizations2 = roleOrganizations === null || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId)) ? [keyOrganizationId] : [];
-      }
-      if (isSuper2 && organizations2 !== null && !features2.includes("*")) features2.push("*");
-      const result2 = { isSuperAdmin: isSuper2 && organizations2 === null, features: features2, organizations: organizations2 };
+      const result2 = { isSuperAdmin: isSuper2, features: features2, organizations: organizations2 };
       await this.setCache(cacheKey, result2, userId, scope);
       return result2;
     }
@@ -303,22 +276,13 @@ class RbacService {
     let isSuper = false;
     const features = [];
     let organizations = [];
-    let hasApplicableRestrictedRole = false;
     if (roleIds.length) {
-      const roleOrganizationScope = await resolveRoleOrganizationScope(
-        this.organizationHierarchyService,
-        tenantId,
-        scope.organizationId
-      );
       const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds } }, {});
       const roleAcls = Array.isArray(racls) ? racls : [];
       for (const r of roleAcls) {
-        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {
-          isSuper = isSuper || !!r.isSuperAdmin;
-          if (Array.isArray(r.featuresJson)) {
-            for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
-          }
-          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true;
+        isSuper = isSuper || !!r.isSuperAdmin;
+        if (Array.isArray(r.featuresJson)) {
+          for (const f of r.featuresJson) if (!features.includes(f)) features.push(f);
         }
         if (organizations !== null) {
           if (r.organizationsJson == null) organizations = null;
@@ -326,9 +290,6 @@ class RbacService {
           else organizations = Array.from(/* @__PURE__ */ new Set([...organizations || [], ...r.organizationsJson]));
         }
       }
-      if (organizations !== null && scope.organizationId && roleOrganizationScope !== null && roleOrganizationScope.size > 0 && hasApplicableRestrictedRole && !organizations.includes(scope.organizationId)) {
-        organizations.push(scope.organizationId);
-      }
     }
     if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes("__all__")) {
     }
@@ -345,15 +306,11 @@ class RbacService {
   async tenantHasFeature(tenantId, feature, opts) {
     if (!tenantId || !feature) return false;
     const em = this.em.fork();
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      tenantId,
-      opts?.organizationId
-    );
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null }, {});
     const list = Array.isArray(roleAcls) ? roleAcls : [];
+    const organizationId = opts?.organizationId ?? null;
     for (const acl of list) {
-      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue;
+      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue;
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
       if (authorizeFeatures([feature], {
         grantedFeatures: grants,

package/dist/modules/auth/services/rbacService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/rbacService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\nimport { resolveRoleOrganizationScope, roleAclAllowsOrganization } from './roleOrganizationScope'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nfunction isRestrictedRoleAcl(acl: Pick<RoleAcl, 'organizationsJson'>): boolean {\n  return Array.isArray(acl.organizationsJson)\n    && acl.organizationsJson.length > 0\n    && !acl.organizationsJson.includes('__all__')\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(\n    private em: EntityManager,\n    cache?: CacheStrategy,\n    private readonly organizationHierarchyService?: OrganizationHierarchyService,\n  ) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n      // Scoped role projections depend on the selected organization's ancestor\n      // chain, so Directory hierarchy changes must evict them as well as the\n      // separately cached OrganizationScope entries.\n      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = roleSupers.some((roleAcl) => (\n      !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl)\n    ))\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    // Direct user-level super-admin grants and unrestricted role-level\n    // super-admin grants are global. Organization-restricted role grants are\n    // deliberately excluded by isGlobalSuperAdmin and continue through the\n    // scoped ACL projection below.\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0\n        ? key.organizationId.trim()\n        : null\n      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId\n      let isSuper = false\n      const features: string[] = []\n      let roleOrganizations: string[] | null = []\n      let hasApplicableRestrictedRole = false\n      if (tenantId && roleIds.length) {\n        const roleOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          evaluatedOrganizationId,\n        )\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {\n            isSuper = isSuper || !!acl.isSuperAdmin\n            if (Array.isArray(acl.featuresJson)) {\n              for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n            }\n            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole = true\n          }\n          if (roleOrganizations !== null) {\n            if (acl.organizationsJson == null || (Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0)) {\n              roleOrganizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              roleOrganizations = null\n            } else {\n              roleOrganizations = Array.from(new Set([\n                ...roleOrganizations,\n                ...(Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []),\n              ]))\n            }\n          }\n        }\n        if (\n          roleOrganizations !== null\n          && evaluatedOrganizationId\n          && roleOrganizationScope !== null\n          && roleOrganizationScope.size > 0\n          && hasApplicableRestrictedRole\n          && !roleOrganizations.includes(evaluatedOrganizationId)\n        ) {\n          roleOrganizations.push(evaluatedOrganizationId)\n        }\n      }\n      let organizations = roleOrganizations\n      if (keyOrganizationId) {\n        const keyOrganizationScope = await resolveRoleOrganizationScope(\n          this.organizationHierarchyService,\n          tenantId,\n          keyOrganizationId,\n        )\n        organizations = roleOrganizations === null\n          || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId))\n          ? [keyOrganizationId]\n          : []\n      }\n      // A role-level super-admin grant still respects the API key's effective\n      // organization allowlist. Represent it as a wildcard feature whenever\n      // the key is restricted so downstream super-admin shortcuts cannot\n      // bypass the key or role organization bounds.\n      if (isSuper && organizations !== null && !features.includes('*')) features.push('*')\n      const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    let hasApplicableRestrictedRole = false\n    if (roleIds.length) {\n      const roleOrganizationScope = await resolveRoleOrganizationScope(\n        this.organizationHierarchyService,\n        tenantId,\n        scope.organizationId,\n      )\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {\n          isSuper = isSuper || !!r.isSuperAdmin\n          if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true\n        }\n        if (organizations !== null) {\n          // For a user principal an empty allowlist is a deny-all scope (#4033), not\n          // \"unrestricted\": it must merge to an empty set so scoped reads and deletes\n          // fail closed. Only an absent allowlist or an explicit '__all__' widens to\n          // every organization. (The API-key branch above deliberately differs \u2014 an\n          // empty role list there means the key inherits the key's own scope.)\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n      if (\n        organizations !== null\n        && scope.organizationId\n        && roleOrganizationScope !== null\n        && roleOrganizationScope.size > 0\n        && hasApplicableRestrictedRole\n        && !organizations.includes(scope.organizationId)\n      ) {\n        organizations.push(scope.organizationId)\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleOrganizationScope = await resolveRoleOrganizationScope(\n      this.organizationHierarchyService,\n      tenantId,\n      opts?.organizationId,\n    )\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n\n    for (const acl of list) {\n      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AAEnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B,iCAAiC;AAQxE,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,KAAkD;AAC7E,SAAO,MAAM,QAAQ,IAAI,iBAAiB,KACrC,IAAI,kBAAkB,SAAS,KAC/B,CAAC,IAAI,kBAAkB,SAAS,SAAS;AAChD;AAEO,MAAM,YAAY;AAAA,EAKvB,YACU,IACR,OACiB,8BACjB;AAHQ;AAES;AAPnB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAOvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAI3C,WAAK,KAAK,4BAA4B,MAAM,QAAQ,CAAC;AAAA,IACvD;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,aAAa,MAAM,GAAG,KAAK,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACtG,UAAM,SAAS,WAAW,KAAK,CAAC,YAC9B,CAAC,CAAC,QAAQ,gBAAgB,CAAC,oBAAoB,OAAO,CACvD;AACD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAMnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,YAAM,oBAAoB,OAAO,IAAI,mBAAmB,YAAY,IAAI,eAAe,KAAK,EAAE,SAAS,IACnG,IAAI,eAAe,KAAK,IACxB;AACJ,YAAM,0BAA0B,MAAM,kBAAkB;AACxD,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAI,oBAAqC,CAAC;AAC1C,UAAIC,+BAA8B;AAClC,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,wBAAwB,MAAM;AAAA,UAClC,KAAK;AAAA,UACLD;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAAQ,MAAMD,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,cAAI,0BAA0B,KAAK,qBAAqB,GAAG;AACzD,YAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,gBAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,yBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,YAC9E;AACA,gBAAI,oBAAoB,GAAG,EAAG,CAAAC,+BAA8B;AAAA,UAC9D;AACA,cAAI,sBAAsB,MAAM;AAC9B,gBAAI,IAAI,qBAAqB,QAAS,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,WAAW,GAAI;AACjH,kCAAoB;AAAA,YACtB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,kCAAoB;AAAA,YACtB,OAAO;AACL,kCAAoB,MAAM,KAAK,oBAAI,IAAI;AAAA,gBACrC,GAAG;AAAA,gBACH,GAAI,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB,CAAC;AAAA,cACtE,CAAC,CAAC;AAAA,YACJ;AAAA,UACF;AAAA,QACF;AACA,YACE,sBAAsB,QACnB,2BACA,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7BA,gCACA,CAAC,kBAAkB,SAAS,uBAAuB,GACtD;AACA,4BAAkB,KAAK,uBAAuB;AAAA,QAChD;AAAA,MACF;AACA,UAAIC,iBAAgB;AACpB,UAAI,mBAAmB;AACrB,cAAM,uBAAuB,MAAM;AAAA,UACjC,KAAK;AAAA,UACLL;AAAA,UACA;AAAA,QACF;AACA,QAAAK,iBAAgB,sBAAsB,QACjC,kBAAkB,KAAK,CAAC,mBAAmB,sBAAsB,IAAI,cAAc,CAAC,IACrF,CAAC,iBAAiB,IAClB,CAAC;AAAA,MACP;AAKA,UAAIH,YAAWG,mBAAkB,QAAQ,CAACF,UAAS,SAAS,GAAG,EAAG,CAAAA,UAAS,KAAK,GAAG;AACnF,YAAML,UAAS,EAAE,cAAcI,YAAWG,mBAAkB,MAAM,UAAAF,WAAU,eAAAE,eAAc;AAC1F,YAAM,KAAK,SAAS,UAAUP,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,8BAA8B;AAClC,QAAI,QAAQ,QAAQ;AAClB,YAAM,wBAAwB,MAAM;AAAA,QAClC,KAAK;AAAA,QACL;AAAA,QACA,MAAM;AAAA,MACR;AACA,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,YAAI,0BAA0B,GAAG,qBAAqB,GAAG;AACvD,oBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,cAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,uBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,cAAI,oBAAoB,CAAC,EAAG,+BAA8B;AAAA,QAC5D;AACA,YAAI,kBAAkB,MAAM;AAM1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,UACE,kBAAkB,QACf,MAAM,kBACN,0BAA0B,QAC1B,sBAAsB,OAAO,KAC7B,+BACA,CAAC,cAAc,SAAS,MAAM,cAAc,GAC/C;AACA,sBAAc,KAAK,MAAM,cAAc;AAAA,MACzC;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,wBAAwB,MAAM;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AAEnD,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,0BAA0B,KAAK,qBAAqB,EAAG;AAC5D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
-  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "hasApplicableRestrictedRole", "organizations"]
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'\nimport { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\nimport { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'\n\ninterface AclData {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\nfunction isAclData(value: unknown): value is AclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<AclData>\n  if (typeof record.isSuperAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((feature) => typeof feature !== 'string')) return false\n  if (record.organizations !== null && record.organizations !== undefined) {\n    if (!Array.isArray(record.organizations)) return false\n    if (record.organizations.some((org) => typeof org !== 'string')) return false\n  }\n  return true\n}\n\nexport class RbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default\n  private cache: CacheStrategy | null = null\n  private globalSuperAdminCache = new Map<string, boolean>()\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  /**\n   * Set cache TTL in milliseconds\n   * @param ttlMs - Time to live in milliseconds\n   */\n  setCacheTtl(ttlMs: number) {\n    this.cacheTtlMs = ttlMs\n  }\n\n  /** Compatibility wrapper for callers that already have both feature lists. */\n  public hasAllFeatures(required: string[], granted: string[]): boolean {\n    return authorizeFeatures(required, { grantedFeatures: granted })\n  }\n\n  private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {\n    if (!organizationId) return true\n    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null\n    if (!organizations || !organizations.length || organizations.includes('__all__')) return true\n    return organizations.includes(organizationId)\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {\n    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `rbac:tenant:${tenantId}`\n  }\n\n  private getOrganizationTag(organizationId: string): string {\n    return `rbac:org:${organizationId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<AclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isAclData(cached) ? cached : null\n  }\n\n  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {\n    if (!this.cache) return\n\n    const tags = [\n      this.getUserTag(userId),\n      'rbac:all'\n    ]\n\n    if (scope.tenantId) {\n      tags.push(this.getTenantTag(scope.tenantId))\n    }\n\n    if (scope.organizationId) {\n      tags.push(this.getOrganizationTag(scope.organizationId))\n    }\n\n    await this.cache.set(cacheKey, data, {\n      ttl: this.cacheTtlMs,\n      tags\n    })\n  }\n\n  /**\n   * Invalidates cached ACL data for a specific user across all tenants and organizations.\n   * Call this when a user's roles or user-specific ACL is modified.\n   * \n   * @param userId - The ID of the user whose cache should be invalidated\n   */\n  async invalidateUserCache(userId: string): Promise<void> {\n    this.globalSuperAdminCache.delete(userId)\n    // Also drop the directory OrganizationScope cache for this user. That scope's\n    // accessible-org set is derived from this user's ACL/role grants, so any\n    // permission change that invalidates the RBAC cache must invalidate the\n    // resolved scope too. This is the missing `org-scope:user:*` caller required\n    // before the cross-request scope TTL can be safely enabled (issue #2259).\n    await this.deleteCacheByTags([this.getUserTag(userId), buildOrgScopeUserCacheTag(userId)])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific tenant.\n   * Call this when a role's ACL is modified, since roles are tenant-scoped\n   * and affect all users in that tenant who have that role.\n   * \n   * @param tenantId - The ID of the tenant whose cache should be invalidated\n   */\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    // Role ACL changes invalidate every user in the tenant; the resolved\n    // OrganizationScope for those users derives from the same grants, so drop\n    // the tenant-tagged scope entries alongside the RBAC ones (issue #2259).\n    await this.deleteCacheByTags([this.getTenantTag(tenantId), buildOrgScopeTenantCacheTag(tenantId)], [tenantId])\n  }\n\n  /**\n   * Invalidates cached ACL data for all users within a specific organization.\n   * Call this when organization-level permissions or visibility changes.\n   * \n   * @param organizationId - The ID of the organization whose cache should be invalidated\n   */\n  async invalidateOrganizationCache(organizationId: string): Promise<void> {\n    await this.deleteCacheByTags([this.getOrganizationTag(organizationId)])\n  }\n\n  /**\n   * Clears all cached ACL data.\n   * Use this for bulk operations or system-wide ACL changes.\n   */\n  async invalidateAllCache(): Promise<void> {\n    this.globalSuperAdminCache.clear()\n    await this.deleteCacheByTags(['rbac:all'])\n  }\n\n  private async deleteCacheByTags(tags: string[], tenantHints?: Array<string | null>): Promise<void> {\n    if (!this.cache) return\n    const contexts = new Set<string | null>()\n    const current = getCurrentCacheTenant()\n    contexts.add(current ?? null)\n    contexts.add(null)\n    if (Array.isArray(tenantHints)) {\n      for (const hint of tenantHints) {\n        contexts.add(hint ?? null)\n      }\n    }\n    for (const ctx of contexts) {\n      if (ctx === current) {\n        await this.cache.deleteByTags(tags)\n      } else {\n        await runWithCacheTenant(ctx, async () => {\n          await this.cache!.deleteByTags(tags)\n        })\n      }\n    }\n  }\n\n  private async isGlobalSuperAdmin(userId: string): Promise<boolean> {\n    if (this.globalSuperAdminCache.has(userId)) return this.globalSuperAdminCache.get(userId)!\n    const em = this.em.fork()\n    const userSuper = await em.findOne(UserAcl, { user: userId as any, isSuperAdmin: true })\n    if (userSuper && (userSuper as any).isSuperAdmin) {\n      this.globalSuperAdminCache.set(userId, true)\n      return true\n    }\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any },\n      { populate: ['role'] },\n      { tenantId: null, organizationId: null },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    if (!linkList.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleIds = Array.from(new Set(linkList.map((link) => {\n      const role = link.role as any\n      return role?.id ? String(role.id) : null\n    }).filter((id): id is string => typeof id === 'string' && id.length > 0)))\n    if (!roleIds.length) {\n      this.globalSuperAdminCache.set(userId, false)\n      return false\n    }\n    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)\n    const result = !!(roleSuper && (roleSuper as any).isSuperAdmin)\n    this.globalSuperAdminCache.set(userId, result)\n    return result\n  }\n\n  /**\n   * Loads the Access Control List (ACL) for a user within a given scope.\n   * \n   * The ACL resolution follows this priority:\n   * 1. Per-user ACL (UserAcl) - if exists, use it exclusively\n   * 2. Aggregated role ACLs (RoleAcl) - combine permissions from all user's roles\n   * \n   * Results are cached for performance (default 5 minutes TTL).\n   * Cache is automatically invalidated when ACL-related data changes.\n   * \n   * @param userId - The ID of the user\n   * @param scope - The tenant and organization context for ACL evaluation\n   * @returns An object containing:\n   *   - isSuperAdmin: If true, user has unrestricted access to all features\n   *   - features: Array of feature strings (may include wildcards like 'entities.*')\n   *   - organizations: Array of organization IDs user can access, or null for all organizations\n   * \n   * @example\n   * const acl = await rbacService.loadAcl('user-123', { tenantId: 'tenant-1', organizationId: 'org-1' })\n   * // Returns: { isSuperAdmin: false, features: ['users.view', 'entities.*'], organizations: ['org-1', 'org-2'] }\n   */\n  async loadAcl(userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{\n    isSuperAdmin: boolean\n    features: string[]\n    organizations: string[] | null\n  }> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    if (!userId.startsWith('api_key:')) {\n      if (await this.isGlobalSuperAdmin(userId)) {\n        const result = { isSuperAdmin: true, features: ['*'], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n    }\n\n    if (userId.startsWith('api_key:')) {\n      const apiKeyId = userId.slice('api_key:'.length)\n      const em = this.em.fork()\n      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })\n      if (!key || (key.expiresAt && key.expiresAt.getTime() < Date.now())) {\n        const result = { isSuperAdmin: false, features: [], organizations: null }\n        await this.setCache(cacheKey, result, userId, scope)\n        return result\n      }\n      const tenantId = scope.tenantId || key.tenantId || null\n      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []\n      let isSuper = false\n      const features: string[] = []\n      let organizations: string[] | null = key.organizationId ? [key.organizationId] : null\n      if (tenantId && roleIds.length) {\n        const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)\n        for (const acl of racls) {\n          isSuper = isSuper || !!acl.isSuperAdmin\n          if (Array.isArray(acl.featuresJson)) {\n            for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)\n          }\n          if (organizations !== null) {\n            if (acl.organizationsJson == null) {\n              organizations = null\n            } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {\n              organizations = null\n            } else {\n              organizations = Array.from(new Set([...(organizations || []), ...acl.organizationsJson]))\n            }\n          }\n        }\n      }\n      const result = { isSuperAdmin: isSuper, features, organizations }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Use a forked EntityManager to avoid inheriting an aborted transaction from callers\n    const em = this.em.fork()\n    const user = await em.findOne(User, { id: userId })\n    if (!user) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n    const tenantId = scope.tenantId || user.tenantId || null\n    const orgId = scope.organizationId || user.organizationId || null\n\n    if (!tenantId) {\n      const result = { isSuperAdmin: false, features: [], organizations: null }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Per-user ACL first\n    const uacl = await em.findOne(UserAcl, { user: userId as any, tenantId })\n    if (uacl) {\n      const result = {\n        isSuperAdmin: !!uacl.isSuperAdmin,\n        features: Array.isArray(uacl.featuresJson) ? (uacl.featuresJson as string[]) : [],\n        organizations: Array.isArray(uacl.organizationsJson) ? (uacl.organizationsJson as string[]) : null,\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { user: userId as any, role: { tenantId } } as any,\n      { populate: ['role'] },\n      { tenantId, organizationId: orgId },\n    )\n    const linkList = Array.isArray(links) ? links : []\n    const roleIds = linkList.map((l) => (l.role as any)?.id).filter(Boolean)\n    let isSuper = false\n    const features: string[] = []\n    let organizations: string[] | null = []\n    if (roleIds.length) {\n      const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})\n      const roleAcls = Array.isArray(racls) ? racls : []\n      for (const r of roleAcls) {\n        isSuper = isSuper || !!r.isSuperAdmin\n        if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)\n        if (organizations !== null) {\n          if (r.organizationsJson == null) organizations = null\n          else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null\n          else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))\n        }\n      }\n    }\n    if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {\n      // Out-of-scope org; caller will enforce\n    }\n    const result = { isSuperAdmin: isSuper, features, organizations }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  /**\n   * Checks whether any tenant role grants a feature.\n   *\n   * This supports non-user runtimes such as scheduler workers that execute with\n   * tenant scope but without an authenticated user.\n   */\n  async tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean> {\n    if (!tenantId || !feature) return false\n\n    const em = this.em.fork()\n    const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})\n    const list = Array.isArray(roleAcls) ? roleAcls : []\n    const organizationId = opts?.organizationId ?? null\n\n    for (const acl of list) {\n      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue\n      const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n      if (authorizeFeatures([feature], {\n        grantedFeatures: grants,\n        unrestricted: acl.isSuperAdmin,\n      })) {\n        return true\n      }\n    }\n\n    return false\n  }\n\n  /**\n   * Checks if a user has all required features within a given scope.\n   *\n   * This is the primary authorization check method used throughout the application.\n   * It combines feature checking with organization visibility validation.\n   *\n   * Authorization logic:\n   * 1. No features required \u2192 always returns true\n   * 2. User is super admin \u2192 always returns true\n   * 3. Organization restriction check: If the user's ACL has a restricted organization list\n   *    and the requested organization is not in that list \u2192 returns false\n   * 4. Feature matching: User must have all required features (supports wildcards)\n   *\n   * @param userId - The ID of the user\n   * @param required - Array of feature strings to check (e.g., ['users.view', 'users.edit'])\n   * @param scope - The tenant and organization context for authorization\n   * @returns true if the user has all required features and organization access, false otherwise\n   *\n   * @example\n   * // Check if user can view and edit users\n   * const canManageUsers = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['users.view', 'users.edit'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   *\n   * @example\n   * // Check with wildcard features\n   * const canAccessEntities = await rbacService.userHasAllFeatures(\n   *   'user-123',\n   *   ['entities.records.view'],\n   *   { tenantId: 'tenant-1', organizationId: 'org-1' }\n   * )\n   * // Returns true if user has 'entities.*', '*', or 'entities.records.view'\n   */\n  async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isSuperAdmin,\n      scopeAllowed: organizationAllowed,\n    })\n  }\n\n  /**\n   * Returns the user's infrastructure grant list, filtered to enabled modules.\n   * The result may contain wildcards; authoritative checks must still go through\n   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.\n   */\n  async getGrantedFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isSuperAdmin) return filterGrantsByEnabledModules(['*'])\n    if (\n      acl.organizations &&\n      scope.organizationId &&\n      !acl.organizations.includes(scope.organizationId) &&\n      !acl.organizations.includes('__all__')\n    ) {\n      return []\n    }\n    return filterGrantsByEnabledModules(acl.features)\n  }\n\n  /** Returns concrete active feature IDs for browser capability payloads. */\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    const organizationAllowed = acl.isSuperAdmin\n      || !acl.organizations\n      || !scope.organizationId\n      || acl.organizations.includes(scope.organizationId)\n      || acl.organizations.includes('__all__')\n    if (!organizationAllowed) return []\n    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,SAAS,SAAS,MAAM,gBAAgB;AACjD,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,mCAAmC;AACvE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAQ7C,SAAS,UAAU,OAAkC;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,iBAAiB,UAAW,QAAO;AACrD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,YAAY,OAAO,YAAY,QAAQ,EAAG,QAAO;AAC9G,MAAI,OAAO,kBAAkB,QAAQ,OAAO,kBAAkB,QAAW;AACvE,QAAI,CAAC,MAAM,QAAQ,OAAO,aAAa,EAAG,QAAO;AACjD,QAAI,OAAO,cAAc,KAAK,CAAC,QAAQ,OAAO,QAAQ,QAAQ,EAAG,QAAO;AAAA,EAC1E;AACA,SAAO;AACT;AAEO,MAAM,YAAY;AAAA,EAKvB,YAAoB,IAAmB,OAAuB;AAA1C;AAJpB,SAAQ,aAAqB,IAAI,KAAK;AACtC;AAAA,SAAQ,QAA8B;AACtC,SAAQ,wBAAwB,oBAAI,IAAqB;AAGvD,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,OAAe;AACzB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGO,eAAe,UAAoB,SAA4B;AACpE,WAAO,kBAAkB,UAAU,EAAE,iBAAiB,QAAQ,CAAC;AAAA,EACjE;AAAA,EAEQ,0BAA0B,KAAc,gBAAoD;AAClG,QAAI,CAAC,eAAgB,QAAO;AAC5B,UAAM,gBAAgB,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AACrF,QAAI,CAAC,iBAAiB,CAAC,cAAc,UAAU,cAAc,SAAS,SAAS,EAAG,QAAO;AACzF,WAAO,cAAc,SAAS,cAAc;AAAA,EAC9C;AAAA,EAEQ,YAAY,QAAgB,OAA2E;AAC7G,WAAO,QAAQ,MAAM,IAAI,MAAM,YAAY,MAAM,IAAI,MAAM,kBAAkB,MAAM;AAAA,EACrF;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,aAAa,MAAM;AAAA,EAC5B;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEQ,mBAAmB,gBAAgC;AACzD,WAAO,YAAY,cAAc;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,UAA2C;AACpE,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,UAAU,MAAM,IAAI,SAAS;AAAA,EACtC;AAAA,EAEA,MAAc,SAAS,UAAkB,MAAe,QAAgB,OAAkF;AACxJ,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,MAAM,UAAU;AAClB,WAAK,KAAK,KAAK,aAAa,MAAM,QAAQ,CAAC;AAAA,IAC7C;AAEA,QAAI,MAAM,gBAAgB;AACxB,WAAK,KAAK,KAAK,mBAAmB,MAAM,cAAc,CAAC;AAAA,IACzD;AAEA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM;AAAA,MACnC,KAAK,KAAK;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,QAA+B;AACvD,SAAK,sBAAsB,OAAO,MAAM;AAMxC,UAAM,KAAK,kBAAkB,CAAC,KAAK,WAAW,MAAM,GAAG,0BAA0B,MAAM,CAAC,CAAC;AAAA,EAC3F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,sBAAsB,UAAiC;AAC3D,SAAK,sBAAsB,MAAM;AAIjC,UAAM,KAAK,kBAAkB,CAAC,KAAK,aAAa,QAAQ,GAAG,4BAA4B,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,4BAA4B,gBAAuC;AACvE,UAAM,KAAK,kBAAkB,CAAC,KAAK,mBAAmB,cAAc,CAAC,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAoC;AACxC,SAAK,sBAAsB,MAAM;AACjC,UAAM,KAAK,kBAAkB,CAAC,UAAU,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAc,kBAAkB,MAAgB,aAAmD;AACjG,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,WAAW,oBAAI,IAAmB;AACxC,UAAM,UAAU,sBAAsB;AACtC,aAAS,IAAI,WAAW,IAAI;AAC5B,aAAS,IAAI,IAAI;AACjB,QAAI,MAAM,QAAQ,WAAW,GAAG;AAC9B,iBAAW,QAAQ,aAAa;AAC9B,iBAAS,IAAI,QAAQ,IAAI;AAAA,MAC3B;AAAA,IACF;AACA,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,SAAS;AACnB,cAAM,KAAK,MAAM,aAAa,IAAI;AAAA,MACpC,OAAO;AACL,cAAM,mBAAmB,KAAK,YAAY;AACxC,gBAAM,KAAK,MAAO,aAAa,IAAI;AAAA,QACrC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,mBAAmB,QAAkC;AACjE,QAAI,KAAK,sBAAsB,IAAI,MAAM,EAAG,QAAO,KAAK,sBAAsB,IAAI,MAAM;AACxF,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,cAAc,KAAK,CAAC;AACvF,QAAI,aAAc,UAAkB,cAAc;AAChD,WAAK,sBAAsB,IAAI,QAAQ,IAAI;AAC3C,aAAO;AAAA,IACT;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,OAAc;AAAA,MACtB,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,QAAI,CAAC,SAAS,QAAQ;AACpB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,SAAS;AACxD,YAAM,OAAO,KAAK;AAClB,aAAO,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,IACtC,CAAC,EAAE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AACzE,QAAI,CAAC,QAAQ,QAAQ;AACnB,WAAK,sBAAsB,IAAI,QAAQ,KAAK;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,YAAY,MAAM,GAAG,QAAQ,SAAS,EAAE,cAAc,MAAM,MAAM,EAAE,KAAK,QAAe,EAAE,CAAQ;AACxG,UAAM,SAAS,CAAC,EAAE,aAAc,UAAkB;AAClD,SAAK,sBAAsB,IAAI,QAAQ,MAAM;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,MAAM,QAAQ,QAAgB,OAI3B;AACD,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,QAAI,CAAC,OAAO,WAAW,UAAU,GAAG;AAClC,UAAI,MAAM,KAAK,mBAAmB,MAAM,GAAG;AACzC,cAAMA,UAAS,EAAE,cAAc,MAAM,UAAU,CAAC,GAAG,GAAG,eAAe,KAAK;AAC1E,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,UAAU,GAAG;AACjC,YAAM,WAAW,OAAO,MAAM,WAAW,MAAM;AAC/C,YAAMC,MAAK,KAAK,GAAG,KAAK;AACxB,YAAM,MAAM,MAAMA,IAAG,QAAQ,QAAQ,EAAE,IAAI,UAAU,WAAW,KAAK,CAAC;AACtE,UAAI,CAAC,OAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAI;AACnE,cAAMD,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,cAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,eAAOA;AAAA,MACT;AACA,YAAME,YAAW,MAAM,YAAY,IAAI,YAAY;AACnD,YAAMC,WAAU,MAAM,QAAQ,IAAI,SAAS,IAAI,IAAI,UAAU,OAAO,OAAO,IAAI,CAAC;AAChF,UAAIC,WAAU;AACd,YAAMC,YAAqB,CAAC;AAC5B,UAAIC,iBAAiC,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AACjF,UAAIJ,aAAYC,SAAQ,QAAQ;AAC9B,cAAM,QAAQ,MAAMF,IAAG,KAAK,SAAS,EAAE,UAAAC,WAAU,MAAM,EAAE,KAAKC,SAAe,EAAE,CAAQ;AACvF,mBAAW,OAAO,OAAO;AACvB,UAAAC,WAAUA,YAAW,CAAC,CAAC,IAAI;AAC3B,cAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,uBAAW,KAAK,IAAI,aAAc,KAAI,CAACC,UAAS,SAAS,CAAC,EAAG,CAAAA,UAAS,KAAK,CAAC;AAAA,UAC9E;AACA,cAAIC,mBAAkB,MAAM;AAC1B,gBAAI,IAAI,qBAAqB,MAAM;AACjC,cAAAA,iBAAgB;AAAA,YAClB,WAAW,MAAM,QAAQ,IAAI,iBAAiB,KAAK,IAAI,kBAAkB,SAAS,SAAS,GAAG;AAC5F,cAAAA,iBAAgB;AAAA,YAClB,OAAO;AACL,cAAAA,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAIA,kBAAiB,CAAC,GAAI,GAAG,IAAI,iBAAiB,CAAC,CAAC;AAAA,YAC1F;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,YAAMN,UAAS,EAAE,cAAcI,UAAS,UAAAC,WAAU,eAAAC,eAAc;AAChE,YAAM,KAAK,SAAS,UAAUN,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,CAAC;AAClD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AACA,UAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,UAAM,QAAQ,MAAM,kBAAkB,KAAK,kBAAkB;AAE7D,QAAI,CAAC,UAAU;AACb,YAAMA,UAAS,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,KAAK;AACxE,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,OAAO,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,QAAe,SAAS,CAAC;AACxE,QAAI,MAAM;AACR,YAAMA,UAAS;AAAA,QACb,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,UAAU,MAAM,QAAQ,KAAK,YAAY,IAAK,KAAK,eAA4B,CAAC;AAAA,QAChF,eAAe,MAAM,QAAQ,KAAK,iBAAiB,IAAK,KAAK,oBAAiC;AAAA,MAChG;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,MAAM,EAAE,SAAS,EAAE;AAAA,MAC1C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,gBAAgB,MAAM;AAAA,IACpC;AACA,UAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,UAAM,UAAU,SAAS,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AACvE,QAAI,UAAU;AACd,UAAM,WAAqB,CAAC;AAC5B,QAAI,gBAAiC,CAAC;AACtC,QAAI,QAAQ,QAAQ;AAClB,YAAM,QAAQ,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,MAAM,EAAE,KAAK,QAAe,EAAE,GAAU,CAAC,CAAC;AAC3F,YAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACjD,iBAAW,KAAK,UAAU;AACxB,kBAAU,WAAW,CAAC,CAAC,EAAE;AACzB,YAAI,MAAM,QAAQ,EAAE,YAAY;AAAG,qBAAW,KAAK,EAAE,aAAc,KAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA;AAC7G,YAAI,kBAAkB,MAAM;AAC1B,cAAI,EAAE,qBAAqB,KAAM,iBAAgB;AAAA,mBACxC,MAAM,QAAQ,EAAE,iBAAiB,KAAK,EAAE,kBAAkB,SAAS,SAAS,EAAG,iBAAgB;AAAA,cACnG,iBAAgB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,iBAAiB,CAAC,GAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAAA,QAC7F;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,SAAS,CAAC,cAAc,SAAS,KAAK,KAAK,CAAC,cAAc,SAAS,SAAS,GAAG;AAAA,IAEpG;AACA,UAAM,SAAS,EAAE,cAAc,SAAS,UAAU,cAAc;AAChE,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBACJ,UACA,SACA,MACkB;AAClB,QAAI,CAAC,YAAY,CAAC,QAAS,QAAO;AAElC,UAAM,KAAK,KAAK,GAAG,KAAK;AACxB,UAAM,WAAW,MAAM,GAAG,KAAK,SAAS,EAAE,UAAU,WAAW,KAAK,GAAU,CAAC,CAAC;AAChF,UAAM,OAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC;AACnD,UAAM,iBAAiB,MAAM,kBAAkB;AAE/C,eAAW,OAAO,MAAM;AACtB,UAAI,CAAC,KAAK,0BAA0B,KAAK,cAAc,EAAG;AAC1D,YAAM,SAAS,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AACrE,UAAI,kBAAkB,CAAC,OAAO,GAAG;AAAA,QAC/B,iBAAiB;AAAA,QACjB,cAAc,IAAI;AAAA,MACpB,CAAC,GAAG;AACF,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqCA,MAAM,mBAAmB,QAAgB,UAAoB,OAAqF;AAChJ,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,MAClB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,aAAc,QAAO,6BAA6B,CAAC,GAAG,CAAC;AAC/D,QACE,IAAI,iBACJ,MAAM,kBACN,CAAC,IAAI,cAAc,SAAS,MAAM,cAAc,KAChD,CAAC,IAAI,cAAc,SAAS,SAAS,GACrC;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO,6BAA6B,IAAI,QAAQ;AAAA,EAClD;AAAA;AAAA,EAGA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,UAAM,sBAAsB,IAAI,gBAC3B,CAAC,IAAI,iBACL,CAAC,MAAM,kBACP,IAAI,cAAc,SAAS,MAAM,cAAc,KAC/C,IAAI,cAAc,SAAS,SAAS;AACzC,QAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,WAAO,yBAAyB,IAAI,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ;AAAA,EACzE;AACF;",
+  "names": ["result", "em", "tenantId", "roleIds", "isSuper", "features", "organizations"]
 }

package/dist/modules/business_rules/backend/logs/page.js

@@ -12,7 +12,6 @@ function ExecutionLogsPage() {
   const [pageSize] = React.useState(50);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const t = useT();
   const [filterValues, setFilterValues] = React.useState({});
   const { data, isLoading, error } = useQuery({
@@ -39,7 +38,6 @@ function ExecutionLogsPage() {
       if (response) {
         setTotal(response.total || 0);
         setTotalPages(response.totalPages || 1);
-        setTotalIsCapped(response?.totalIsCapped === true);
       }
       return response?.items || [];
     }
@@ -181,7 +179,7 @@ function ExecutionLogsPage() {
       onFiltersClear: handleFiltersClear,
       isLoading,
       error: error ? t("business_rules.logs.messages.loadFailed") : void 0,
-      pagination: { page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }
+      pagination: { page, pageSize, total, totalPages, onPageChange: setPage }
     }
   ) }) });
 }

package/dist/modules/business_rules/backend/logs/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/business_rules/backend/logs/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useQuery } from '@tanstack/react-query'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype RuleExecutionLog = {\n  id: string\n  ruleId: string\n  rule?: {\n    id: string\n    ruleId: string\n    ruleName: string\n    ruleType: string\n  } | null\n  entityType: string\n  entityId: string | null\n  eventType: string | null\n  executedAt: string\n  executionTimeMs: number\n  executionResult: 'SUCCESS' | 'FAILURE' | 'ERROR'\n  resultValue: any | null\n  errorMessage: string | null\n  inputContext: any | null\n  outputContext: any | null\n  executedBy: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype LogsResponse = {\n  items: RuleExecutionLog[]\n  total: number\n  totalPages: number\n  totalIsCapped?: boolean\n}\n\nexport default function ExecutionLogsPage() {\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const t = useT()\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n\n  const { data, isLoading, error } = useQuery({\n    queryKey: ['business-rules', 'logs', filterValues, page],\n    queryFn: async () => {\n      const params = new URLSearchParams()\n      params.set('page', page.toString())\n      params.set('pageSize', pageSize.toString())\n      params.set('sortField', 'executedAt')\n      params.set('sortDir', 'desc')\n\n      if (filterValues.ruleId) params.set('ruleId', filterValues.ruleId as string)\n      if (filterValues.entityType) params.set('entityType', filterValues.entityType as string)\n      if (filterValues.executionResult) params.set('executionResult', filterValues.executionResult as string)\n      if (filterValues.executedBy) params.set('executedBy', filterValues.executedBy as string)\n      if (filterValues.executedAtFrom) params.set('executedAtFrom', filterValues.executedAtFrom as string)\n      if (filterValues.executedAtTo) params.set('executedAtTo', filterValues.executedAtTo as string)\n\n      const result = await apiCall<LogsResponse>(\n        `/api/business_rules/logs?${params.toString()}`\n      )\n\n      if (!result.ok) {\n        throw new Error('Failed to fetch execution logs')\n      }\n\n      const response = result.result\n      if (response) {\n        setTotal(response.total || 0)\n        setTotalPages(response.totalPages || 1)\n        setTotalIsCapped(response?.totalIsCapped === true)\n      }\n\n      return response?.items || []\n    },\n  })\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    Object.entries(values).forEach(([key, value]) => {\n      if (value !== undefined) next[key] = value\n    })\n    setFilterValues(next)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const filters: FilterDef[] = [\n    {\n      id: 'entityType',\n      type: 'text',\n      label: t('business_rules.logs.filters.entityType'),\n      placeholder: t('business_rules.logs.filters.entityTypePlaceholder'),\n    },\n    {\n      id: 'executionResult',\n      type: 'select',\n      label: t('business_rules.logs.filters.result'),\n      options: [\n        { value: '', label: t('common.all') },\n        { value: 'SUCCESS', label: t('business_rules.logs.result.success') },\n        { value: 'FAILURE', label: t('business_rules.logs.result.failure') },\n        { value: 'ERROR', label: t('business_rules.logs.result.error') },\n      ],\n    },\n    {\n      id: 'executedBy',\n      type: 'text',\n      label: t('business_rules.logs.filters.executedBy'),\n      placeholder: t('business_rules.logs.filters.executedByPlaceholder'),\n    },\n    {\n      id: 'executedAtFrom',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateFrom'),\n    },\n    {\n      id: 'executedAtTo',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateTo'),\n    },\n  ]\n\n  const getResultBadgeClass = (result: string) => {\n    switch (result) {\n      case 'SUCCESS':\n        return 'bg-green-100 text-green-800'\n      case 'FAILURE':\n        return 'bg-yellow-100 text-yellow-800'\n      case 'ERROR':\n        return 'bg-red-100 text-red-800'\n      default:\n        return 'bg-muted text-foreground'\n    }\n  }\n\n  const columns: ColumnDef<RuleExecutionLog>[] = [\n    {\n      id: 'executedAt',\n      header: t('business_rules.logs.fields.executedAt'),\n      accessorKey: 'executedAt',\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          {new Date(row.original.executedAt).toLocaleString()}\n        </div>\n      ),\n    },\n    {\n      id: 'rule',\n      header: t('business_rules.logs.fields.rule'),\n      cell: ({ row }) => (\n        <div>\n          {row.original.rule ? (\n            <Link\n              href={`/backend/rules/${row.original.rule.id}`}\n              className=\"text-blue-600 hover:text-blue-800 hover:underline font-medium\"\n            >\n              {row.original.rule.ruleName}\n            </Link>\n          ) : (\n            <span className=\"text-muted-foreground text-sm\">\n              {t('business_rules.logs.ruleDeleted')}\n            </span>\n          )}\n          {row.original.rule && (\n            <div className=\"text-xs text-muted-foreground mt-0.5\">\n              {row.original.rule.ruleType}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'entity',\n      header: t('business_rules.logs.fields.entity'),\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          <div className=\"font-medium\">{row.original.entityType}</div>\n          {row.original.entityId && (\n            <div className=\"text-xs text-muted-foreground truncate max-w-[200px]\" title={row.original.entityId}>\n              {row.original.entityId}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'result',\n      header: t('business_rules.logs.fields.result'),\n      accessorKey: 'executionResult',\n      cell: ({ row }) => (\n        <span\n          className={`inline-flex items-center px-2 py-1 rounded text-xs font-medium ${getResultBadgeClass(\n            row.original.executionResult\n          )}`}\n        >\n          {t(`business_rules.logs.result.${row.original.executionResult.toLowerCase()}`)}\n        </span>\n      ),\n    },\n    {\n      id: 'executionTime',\n      header: t('business_rules.logs.fields.executionTime'),\n      accessorKey: 'executionTimeMs',\n      cell: ({ row }) => (\n        <div className=\"text-sm text-muted-foreground\">\n          {row.original.executionTimeMs}ms\n        </div>\n      ),\n    },\n    {\n      id: 'actions',\n      header: '',\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/logs/${row.original.id}`}\n          className=\"text-sm text-blue-600 hover:text-blue-800 hover:underline\"\n        >\n          {t('common.details')}\n        </Link>\n      ),\n    },\n  ]\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('business_rules.logs.list.title')}\n          columns={columns}\n          data={data || []}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          isLoading={isLoading}\n          error={error ? t('business_rules.logs.messages.loadFailed') : undefined}\n          pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AA4JQ,cASA,YATA;AA1JR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAkCN,SAAR,oBAAqC;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,IAC1C,UAAU,CAAC,kBAAkB,QAAQ,cAAc,IAAI;AAAA,IACvD,SAAS,YAAY;AACnB,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,QAAQ,KAAK,SAAS,CAAC;AAClC,aAAO,IAAI,YAAY,SAAS,SAAS,CAAC;AAC1C,aAAO,IAAI,aAAa,YAAY;AACpC,aAAO,IAAI,WAAW,MAAM;AAE5B,UAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAgB;AAC3E,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,gBAAiB,QAAO,IAAI,mBAAmB,aAAa,eAAyB;AACtG,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,eAAgB,QAAO,IAAI,kBAAkB,aAAa,cAAwB;AACnG,UAAI,aAAa,aAAc,QAAO,IAAI,gBAAgB,aAAa,YAAsB;AAE7F,YAAM,SAAS,MAAM;AAAA,QACnB,4BAA4B,OAAO,SAAS,CAAC;AAAA,MAC/C;AAEA,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AAEA,YAAM,WAAW,OAAO;AACxB,UAAI,UAAU;AACZ,iBAAS,SAAS,SAAS,CAAC;AAC5B,sBAAc,SAAS,cAAc,CAAC;AACtC,yBAAiB,UAAU,kBAAkB,IAAI;AAAA,MACnD;AAEA,aAAO,UAAU,SAAS,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AAED,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,WAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,IACvC,CAAC;AACD,oBAAgB,IAAI;AACpB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAuB;AAAA,IAC3B;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,MAC7C,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,YAAY,EAAE;AAAA,QACpC,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,SAAS,OAAO,EAAE,kCAAkC,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,sCAAsC;AAAA,IACjD;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,sBAAsB,CAAC,WAAmB;AAC9C,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAyC;AAAA,IAC7C;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,uCAAuC;AAAA,MACjD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,SAAI,WAAU,WACZ,cAAI,KAAK,IAAI,SAAS,UAAU,EAAE,eAAe,GACpD;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SACE;AAAA,YAAI,SAAS,OACZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,kBAAkB,IAAI,SAAS,KAAK,EAAE;AAAA,YAC5C,WAAU;AAAA,YAET,cAAI,SAAS,KAAK;AAAA;AAAA,QACrB,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,iCAAiC,GACtC;AAAA,QAED,IAAI,SAAS,QACZ,oBAAC,SAAI,WAAU,wCACZ,cAAI,SAAS,KAAK,UACrB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,WACb;AAAA,4BAAC,SAAI,WAAU,eAAe,cAAI,SAAS,YAAW;AAAA,QACrD,IAAI,SAAS,YACZ,oBAAC,SAAI,WAAU,wDAAuD,OAAO,IAAI,SAAS,UACvF,cAAI,SAAS,UAChB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,WAAW,kEAAkE;AAAA,YAC3E,IAAI,SAAS;AAAA,UACf,CAAC;AAAA,UAEA,YAAE,8BAA8B,IAAI,SAAS,gBAAgB,YAAY,CAAC,EAAE;AAAA;AAAA,MAC/E;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,0CAA0C;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iCACZ;AAAA,YAAI,SAAS;AAAA,QAAgB;AAAA,SAChC;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,iBAAiB,IAAI,SAAS,EAAE;AAAA,UACtC,WAAU;AAAA,UAET,YAAE,gBAAgB;AAAA;AAAA,MACrB;AAAA,IAEJ;AAAA,EACF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC;AAAA,MACzC;AAAA,MACA,MAAM,QAAQ,CAAC;AAAA,MACf;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB;AAAA,MACA,OAAO,QAAQ,EAAE,yCAAyC,IAAI;AAAA,MAC9D,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA;AAAA,EACxF,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useQuery } from '@tanstack/react-query'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'\n\ntype RuleExecutionLog = {\n  id: string\n  ruleId: string\n  rule?: {\n    id: string\n    ruleId: string\n    ruleName: string\n    ruleType: string\n  } | null\n  entityType: string\n  entityId: string | null\n  eventType: string | null\n  executedAt: string\n  executionTimeMs: number\n  executionResult: 'SUCCESS' | 'FAILURE' | 'ERROR'\n  resultValue: any | null\n  errorMessage: string | null\n  inputContext: any | null\n  outputContext: any | null\n  executedBy: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype LogsResponse = {\n  items: RuleExecutionLog[]\n  total: number\n  totalPages: number\n}\n\nexport default function ExecutionLogsPage() {\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const t = useT()\n  const [filterValues, setFilterValues] = React.useState<FilterValues>({})\n\n  const { data, isLoading, error } = useQuery({\n    queryKey: ['business-rules', 'logs', filterValues, page],\n    queryFn: async () => {\n      const params = new URLSearchParams()\n      params.set('page', page.toString())\n      params.set('pageSize', pageSize.toString())\n      params.set('sortField', 'executedAt')\n      params.set('sortDir', 'desc')\n\n      if (filterValues.ruleId) params.set('ruleId', filterValues.ruleId as string)\n      if (filterValues.entityType) params.set('entityType', filterValues.entityType as string)\n      if (filterValues.executionResult) params.set('executionResult', filterValues.executionResult as string)\n      if (filterValues.executedBy) params.set('executedBy', filterValues.executedBy as string)\n      if (filterValues.executedAtFrom) params.set('executedAtFrom', filterValues.executedAtFrom as string)\n      if (filterValues.executedAtTo) params.set('executedAtTo', filterValues.executedAtTo as string)\n\n      const result = await apiCall<LogsResponse>(\n        `/api/business_rules/logs?${params.toString()}`\n      )\n\n      if (!result.ok) {\n        throw new Error('Failed to fetch execution logs')\n      }\n\n      const response = result.result\n      if (response) {\n        setTotal(response.total || 0)\n        setTotalPages(response.totalPages || 1)\n      }\n\n      return response?.items || []\n    },\n  })\n\n  const handleFiltersApply = React.useCallback((values: FilterValues) => {\n    const next: FilterValues = {}\n    Object.entries(values).forEach(([key, value]) => {\n      if (value !== undefined) next[key] = value\n    })\n    setFilterValues(next)\n    setPage(1)\n  }, [])\n\n  const handleFiltersClear = React.useCallback(() => {\n    setFilterValues({})\n    setPage(1)\n  }, [])\n\n  const filters: FilterDef[] = [\n    {\n      id: 'entityType',\n      type: 'text',\n      label: t('business_rules.logs.filters.entityType'),\n      placeholder: t('business_rules.logs.filters.entityTypePlaceholder'),\n    },\n    {\n      id: 'executionResult',\n      type: 'select',\n      label: t('business_rules.logs.filters.result'),\n      options: [\n        { value: '', label: t('common.all') },\n        { value: 'SUCCESS', label: t('business_rules.logs.result.success') },\n        { value: 'FAILURE', label: t('business_rules.logs.result.failure') },\n        { value: 'ERROR', label: t('business_rules.logs.result.error') },\n      ],\n    },\n    {\n      id: 'executedBy',\n      type: 'text',\n      label: t('business_rules.logs.filters.executedBy'),\n      placeholder: t('business_rules.logs.filters.executedByPlaceholder'),\n    },\n    {\n      id: 'executedAtFrom',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateFrom'),\n    },\n    {\n      id: 'executedAtTo',\n      type: 'dateRange',\n      label: t('business_rules.logs.filters.dateTo'),\n    },\n  ]\n\n  const getResultBadgeClass = (result: string) => {\n    switch (result) {\n      case 'SUCCESS':\n        return 'bg-green-100 text-green-800'\n      case 'FAILURE':\n        return 'bg-yellow-100 text-yellow-800'\n      case 'ERROR':\n        return 'bg-red-100 text-red-800'\n      default:\n        return 'bg-muted text-foreground'\n    }\n  }\n\n  const columns: ColumnDef<RuleExecutionLog>[] = [\n    {\n      id: 'executedAt',\n      header: t('business_rules.logs.fields.executedAt'),\n      accessorKey: 'executedAt',\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          {new Date(row.original.executedAt).toLocaleString()}\n        </div>\n      ),\n    },\n    {\n      id: 'rule',\n      header: t('business_rules.logs.fields.rule'),\n      cell: ({ row }) => (\n        <div>\n          {row.original.rule ? (\n            <Link\n              href={`/backend/rules/${row.original.rule.id}`}\n              className=\"text-blue-600 hover:text-blue-800 hover:underline font-medium\"\n            >\n              {row.original.rule.ruleName}\n            </Link>\n          ) : (\n            <span className=\"text-muted-foreground text-sm\">\n              {t('business_rules.logs.ruleDeleted')}\n            </span>\n          )}\n          {row.original.rule && (\n            <div className=\"text-xs text-muted-foreground mt-0.5\">\n              {row.original.rule.ruleType}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'entity',\n      header: t('business_rules.logs.fields.entity'),\n      cell: ({ row }) => (\n        <div className=\"text-sm\">\n          <div className=\"font-medium\">{row.original.entityType}</div>\n          {row.original.entityId && (\n            <div className=\"text-xs text-muted-foreground truncate max-w-[200px]\" title={row.original.entityId}>\n              {row.original.entityId}\n            </div>\n          )}\n        </div>\n      ),\n    },\n    {\n      id: 'result',\n      header: t('business_rules.logs.fields.result'),\n      accessorKey: 'executionResult',\n      cell: ({ row }) => (\n        <span\n          className={`inline-flex items-center px-2 py-1 rounded text-xs font-medium ${getResultBadgeClass(\n            row.original.executionResult\n          )}`}\n        >\n          {t(`business_rules.logs.result.${row.original.executionResult.toLowerCase()}`)}\n        </span>\n      ),\n    },\n    {\n      id: 'executionTime',\n      header: t('business_rules.logs.fields.executionTime'),\n      accessorKey: 'executionTimeMs',\n      cell: ({ row }) => (\n        <div className=\"text-sm text-muted-foreground\">\n          {row.original.executionTimeMs}ms\n        </div>\n      ),\n    },\n    {\n      id: 'actions',\n      header: '',\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/logs/${row.original.id}`}\n          className=\"text-sm text-blue-600 hover:text-blue-800 hover:underline\"\n        >\n          {t('common.details')}\n        </Link>\n      ),\n    },\n  ]\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('business_rules.logs.list.title')}\n          columns={columns}\n          data={data || []}\n          filters={filters}\n          filterValues={filterValues}\n          onFiltersApply={handleFiltersApply}\n          onFiltersClear={handleFiltersClear}\n          isLoading={isLoading}\n          error={error ? t('business_rules.logs.messages.loadFailed') : undefined}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAyJQ,cASA,YATA;AAvJR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAiCN,SAAR,oBAAqC;AAC1C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAuB,CAAC,CAAC;AAEvE,QAAM,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS;AAAA,IAC1C,UAAU,CAAC,kBAAkB,QAAQ,cAAc,IAAI;AAAA,IACvD,SAAS,YAAY;AACnB,YAAM,SAAS,IAAI,gBAAgB;AACnC,aAAO,IAAI,QAAQ,KAAK,SAAS,CAAC;AAClC,aAAO,IAAI,YAAY,SAAS,SAAS,CAAC;AAC1C,aAAO,IAAI,aAAa,YAAY;AACpC,aAAO,IAAI,WAAW,MAAM;AAE5B,UAAI,aAAa,OAAQ,QAAO,IAAI,UAAU,aAAa,MAAgB;AAC3E,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,gBAAiB,QAAO,IAAI,mBAAmB,aAAa,eAAyB;AACtG,UAAI,aAAa,WAAY,QAAO,IAAI,cAAc,aAAa,UAAoB;AACvF,UAAI,aAAa,eAAgB,QAAO,IAAI,kBAAkB,aAAa,cAAwB;AACnG,UAAI,aAAa,aAAc,QAAO,IAAI,gBAAgB,aAAa,YAAsB;AAE7F,YAAM,SAAS,MAAM;AAAA,QACnB,4BAA4B,OAAO,SAAS,CAAC;AAAA,MAC/C;AAEA,UAAI,CAAC,OAAO,IAAI;AACd,cAAM,IAAI,MAAM,gCAAgC;AAAA,MAClD;AAEA,YAAM,WAAW,OAAO;AACxB,UAAI,UAAU;AACZ,iBAAS,SAAS,SAAS,CAAC;AAC5B,sBAAc,SAAS,cAAc,CAAC;AAAA,MACxC;AAEA,aAAO,UAAU,SAAS,CAAC;AAAA,IAC7B;AAAA,EACF,CAAC;AAED,QAAM,qBAAqB,MAAM,YAAY,CAAC,WAAyB;AACrE,UAAM,OAAqB,CAAC;AAC5B,WAAO,QAAQ,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/C,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,IACvC,CAAC;AACD,oBAAgB,IAAI;AACpB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,qBAAqB,MAAM,YAAY,MAAM;AACjD,oBAAgB,CAAC,CAAC;AAClB,YAAQ,CAAC;AAAA,EACX,GAAG,CAAC,CAAC;AAEL,QAAM,UAAuB;AAAA,IAC3B;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,MAC7C,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,YAAY,EAAE;AAAA,QACpC,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,WAAW,OAAO,EAAE,oCAAoC,EAAE;AAAA,QACnE,EAAE,OAAO,SAAS,OAAO,EAAE,kCAAkC,EAAE;AAAA,MACjE;AAAA,IACF;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,wCAAwC;AAAA,MACjD,aAAa,EAAE,mDAAmD;AAAA,IACpE;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,sCAAsC;AAAA,IACjD;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,OAAO,EAAE,oCAAoC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,sBAAsB,CAAC,WAAmB;AAC9C,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAyC;AAAA,IAC7C;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,uCAAuC;AAAA,MACjD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,SAAI,WAAU,WACZ,cAAI,KAAK,IAAI,SAAS,UAAU,EAAE,eAAe,GACpD;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,iCAAiC;AAAA,MAC3C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SACE;AAAA,YAAI,SAAS,OACZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM,kBAAkB,IAAI,SAAS,KAAK,EAAE;AAAA,YAC5C,WAAU;AAAA,YAET,cAAI,SAAS,KAAK;AAAA;AAAA,QACrB,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,iCAAiC,GACtC;AAAA,QAED,IAAI,SAAS,QACZ,oBAAC,SAAI,WAAU,wCACZ,cAAI,SAAS,KAAK,UACrB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,WACb;AAAA,4BAAC,SAAI,WAAU,eAAe,cAAI,SAAS,YAAW;AAAA,QACrD,IAAI,SAAS,YACZ,oBAAC,SAAI,WAAU,wDAAuD,OAAO,IAAI,SAAS,UACvF,cAAI,SAAS,UAChB;AAAA,SAEJ;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,mCAAmC;AAAA,MAC7C,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,WAAW,kEAAkE;AAAA,YAC3E,IAAI,SAAS;AAAA,UACf,CAAC;AAAA,UAEA,YAAE,8BAA8B,IAAI,SAAS,gBAAgB,YAAY,CAAC,EAAE;AAAA;AAAA,MAC/E;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ,EAAE,0CAA0C;AAAA,MACpD,aAAa;AAAA,MACb,MAAM,CAAC,EAAE,IAAI,MACX,qBAAC,SAAI,WAAU,iCACZ;AAAA,YAAI,SAAS;AAAA,QAAgB;AAAA,SAChC;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,iBAAiB,IAAI,SAAS,EAAE;AAAA,UACtC,WAAU;AAAA,UAET,YAAE,gBAAgB;AAAA;AAAA,MACrB;AAAA,IAEJ;AAAA,EACF;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,gCAAgC;AAAA,MACzC;AAAA,MACA,MAAM,QAAQ,CAAC;AAAA,MACf;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,MAChB;AAAA,MACA,OAAO,QAAQ,EAAE,yCAAyC,IAAI;AAAA,MAC9D,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA;AAAA,EACzE,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/business_rules/backend/rules/[id]/page.meta.js

@@ -1,7 +1,12 @@
 const metadata = {
   pageTitle: "Edit Business Rule",
+  pageTitleKey: "business_rules.rules.edit.title",
   requireAuth: true,
-  requireFeatures: ["business_rules.manage"]
+  requireFeatures: ["business_rules.manage"],
+  breadcrumb: [
+    { label: "Business Rules", labelKey: "rules.nav.rules" },
+    { label: "Edit Business Rule", labelKey: "business_rules.rules.edit.title" }
+  ]
 };
 export {
   metadata

package/dist/modules/business_rules/backend/rules/[id]/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/business_rules/backend/rules/%5Bid%5D/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  pageTitle: 'Edit Business Rule',\n  requireAuth: true,\n  requireFeatures: ['business_rules.manage'],\n}\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,WAAW;AAAA,EACX,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAC3C;",
+  "sourcesContent": ["export const metadata = {\n  pageTitle: 'Edit Business Rule',\n  pageTitleKey: 'business_rules.rules.edit.title',\n  requireAuth: true,\n  requireFeatures: ['business_rules.manage'],\n  breadcrumb: [\n    { label: 'Business Rules', labelKey: 'rules.nav.rules' },\n    { label: 'Edit Business Rule', labelKey: 'business_rules.rules.edit.title' },\n  ],\n}\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,WAAW;AAAA,EACX,cAAc;AAAA,EACd,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAAA,EACzC,YAAY;AAAA,IACV,EAAE,OAAO,kBAAkB,UAAU,kBAAkB;AAAA,IACvD,EAAE,OAAO,sBAAsB,UAAU,kCAAkC;AAAA,EAC7E;AACF;",
   "names": []
 }

package/dist/modules/business_rules/backend/rules/create/page.meta.js

@@ -2,9 +2,13 @@ const metadata = {
   requireAuth: true,
   requireFeatures: ["business_rules.manage"],
   pageTitle: "Create Business Rule",
+  pageTitleKey: "business_rules.rules.create.title",
   pageGroup: "Business Rules",
   pageGroupKey: "rules.nav.group",
-  breadcrumb: [{ label: "Business Rules", labelKey: "rules.nav.rules" }, { label: "Create Business Rule" }]
+  breadcrumb: [
+    { label: "Business Rules", labelKey: "rules.nav.rules" },
+    { label: "Create Business Rule", labelKey: "business_rules.rules.create.title" }
+  ]
 };
 export {
   metadata

package/dist/modules/business_rules/backend/rules/create/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/business_rules/backend/rules/create/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['business_rules.manage'],\n  pageTitle: 'Create Business Rule',\n  pageGroup: 'Business Rules',\n  pageGroupKey: 'rules.nav.group',\n  breadcrumb: [{ label: 'Business Rules', labelKey: 'rules.nav.rules' }, { label: 'Create Business Rule' }],\n}\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAAA,EACzC,WAAW;AAAA,EACX,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY,CAAC,EAAE,OAAO,kBAAkB,UAAU,kBAAkB,GAAG,EAAE,OAAO,uBAAuB,CAAC;AAC1G;",
+  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['business_rules.manage'],\n  pageTitle: 'Create Business Rule',\n  pageTitleKey: 'business_rules.rules.create.title',\n  pageGroup: 'Business Rules',\n  pageGroupKey: 'rules.nav.group',\n  breadcrumb: [\n    { label: 'Business Rules', labelKey: 'rules.nav.rules' },\n    { label: 'Create Business Rule', labelKey: 'business_rules.rules.create.title' },\n  ],\n}\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,uBAAuB;AAAA,EACzC,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,IACV,EAAE,OAAO,kBAAkB,UAAU,kBAAkB;AAAA,IACvD,EAAE,OAAO,wBAAwB,UAAU,oCAAoC;AAAA,EACjF;AACF;",
   "names": []
 }

package/dist/modules/business_rules/backend/rules/page.js

@@ -20,7 +20,6 @@ function RulesListPage() {
   const [pageSize] = React.useState(20);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const t = useT();
   const router = useRouter();
   const queryClient = useQueryClient();
@@ -49,7 +48,6 @@ function RulesListPage() {
       if (response) {
         setTotal(response.total || 0);
         setTotalPages(response.totalPages || 1);
-        setTotalIsCapped(response?.totalIsCapped === true);
       }
       return response?.items || [];
     }
@@ -279,7 +277,7 @@ function RulesListPage() {
             createLabel: t("business_rules.actions.create")
           }
         ),
-        pagination: { page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }
+        pagination: { page, pageSize, total, totalPages, onPageChange: setPage }
       }
     ) }),
     ConfirmDialogElement