@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/modules/auth/api/users/acl/route.ts

@@ -1,13 +1,14 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
-import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
 import {
   assertActorCanAccessUserTarget,
   assertActorCanGrantAcl,
@@ -15,25 +16,15 @@ import {
   normalizeGrantFeatureList,
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import {
-  AUTH_USER_ACL_UPDATE_COMMAND_ID,
-  type AclUpdateResult,
-  type UserAclUpdateInput,
-} from '@open-mercato/core/modules/auth/commands/acl'
 
-const getSchema = z.object({
-  userId: z.string().uuid(),
-  tenantId: z.string().uuid().optional(),
-})
+const getSchema = z.object({ userId: z.string().uuid() })
 const putSchema = z.object({
   userId: z.string().uuid(),
   isSuperAdmin: z.boolean().optional(),
   features: z.array(z.string()).optional(),
   organizations: z.array(z.string()).nullable().optional(),
-  tenantId: z.string().uuid().optional(),
 })
 
 export const metadata = {
@@ -56,95 +47,25 @@ const userAclUpdateResponseSchema = z.object({
 
 const userAclErrorSchema = z.object({ error: z.string() })
 
-type TenantResolution = { tenantId: string | null } | { error: NextResponse }
-
-/**
- * The single tenant scope both handlers work in. GET and PUT MUST resolve it the
- * same way: the admin user form PUTs the ACL panel's state on every save, so a
- * GET that reads a narrower scope than the PUT writes hands the operator an
- * empty form and turns the next name-only edit into a silent revocation, with no
- * `updatedAt` to arm the optimistic lock against it.
- *
- * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a
- * global account legitimately signs in with `auth.tenantId === null` and the
- * scope has to come from the target user instead. That fallback is reserved for
- * a super admin: for anyone else it would let the target pick the scope its own
- * access is then checked against, and it decrypts a possibly foreign user ahead
- * of every guard. A tenant-less non-super-admin therefore resolves to `null`,
- * which reads as "no override" and refuses to write — the behaviour that held
- * before this route resolved a scope at all. The read is also skipped whenever a
- * tenant is already known.
- *
- * An explicit `tenantId` wins, mirroring the role ACL route (additive there and
- * here; no caller sends it yet) — but only for a super admin or for the actor's
- * own tenant, so it cannot widen anyone's reach. The result is that for a
- * non-super-admin the resolved scope is always the actor's own.
- */
-async function resolveAclTenantId(args: {
-  em: EntityManager
-  auth: NonNullable<AuthContext>
-  actorIsSuperAdmin: boolean
-  userId: string
-  requestedTenantId?: string
-}): Promise<TenantResolution> {
-  const authTenantId = args.auth.tenantId ?? null
-  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {
-    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }
-  }
-  const known = args.requestedTenantId ?? authTenantId
-  if (known) return { tenantId: known }
-  if (!args.actorIsSuperAdmin) return { tenantId: null }
-  const targetUser = await findOneWithDecryption(
-    args.em,
-    User,
-    { id: args.userId } as FilterQuery<User>,
-    {},
-    { tenantId: null, organizationId: args.auth.orgId ?? null },
-  )
-  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }
-}
-
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   const url = new URL(req.url)
-  const parsed = getSchema.safeParse({
-    userId: url.searchParams.get('userId'),
-    tenantId: url.searchParams.get('tenantId') || undefined,
-  })
+  const parsed = getSchema.safeParse({ userId: url.searchParams.get('userId') })
   if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })
   const container = await createRequestContainer()
   const em = container.resolve('em') as any
   const rbacService = container.resolve('rbacService') as any
-  // Every grant check is answered in the actor's own scope, never in the scope
-  // resolved for the record: passing the resolved one would ask a foreign tenant
-  // whether this caller may act there, and for a tenant-less actor — whose scope
-  // comes from the target — it would compare the target against itself.
-  const actorTenantId = auth.tenantId ?? null
   const actorAcl = auth.sub
-    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
     : null
-  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
-
-  const resolution = await resolveAclTenantId({
-    em: em as EntityManager,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId,
-  })
-  if ('error' in resolution) return resolution.error
-  // An unresolvable scope reads as "no override", which is what PUT then refuses
-  // to write (`Tenant required`) — so the pair still cannot destroy a row.
-  const tenantId = resolution.tenantId
-
-  if (!actorIsSuperAdmin && auth.sub) {
+  if (!actorAcl?.isSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -153,7 +74,7 @@ export async function GET(req: Request) {
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -161,7 +82,7 @@ export async function GET(req: Request) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId,
+          tenantId: auth.tenantId ?? null,
         }),
       })
     } catch (err) {
@@ -169,9 +90,7 @@ export async function GET(req: Request) {
       throw err
     }
   }
-  const acl = tenantId
-    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
-    : null
+  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   const response = acl
     ? {
         hasCustomAcl: true,
@@ -190,8 +109,8 @@ export async function GET(req: Request) {
     idField: 'id',
     resourceKind: 'auth.user_acl',
     organizationId: auth.orgId ?? null,
-    tenantId,
-    query: { userId: parsed.data.userId, tenantId },
+    tenantId: auth.tenantId ?? null,
+    query: { userId: parsed.data.userId },
     accessType: 'read:item',
   })
 
@@ -208,40 +127,18 @@ export async function PUT(req: Request) {
   const em = container.resolve('em') as any
   const rbacService = container.resolve('rbacService') as any
 
-  // Every grant check is answered in the actor's own scope, never in the scope
-  // resolved for the record: passing the resolved one would ask a foreign tenant
-  // whether this caller may act there, and for a tenant-less actor — whose scope
-  // comes from the target — it would compare the target against itself.
-  const actorTenantId = auth.tenantId ?? null
   const actorAcl = auth.sub
-    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
     : null
   const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
 
-  // The scope the row is read and written in. `auth.tenantId` is `string | null`
-  // — never `undefined`, since every producer normalizes with `?? null` — so the
-  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched
-  // no row, leaving create/update to fail the NOT NULL constraint and clear to
-  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500
-  // into a working, correctly scoped write.
-  const resolution = await resolveAclTenantId({
-    em: em as EntityManager,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId,
-  })
-  if ('error' in resolution) return resolution.error
-  const tenantId = resolution.tenantId
-  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })
-
   if (!actorIsSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -250,7 +147,7 @@ export async function PUT(req: Request) {
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -258,7 +155,7 @@ export async function PUT(req: Request) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId,
+          tenantId: auth.tenantId ?? null,
         }),
       })
     } catch (err) {
@@ -267,10 +164,7 @@ export async function PUT(req: Request) {
     }
   }
 
-  const requestedFeatures = normalizeGrantFeatureList(parsed.data.features)
-  const organizations = normalizeOrganizations(parsed.data.organizations)
-
-  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
+  let acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits
   // cannot silently clobber each other (#2055). Strictly additive — a no-op when
   // the client sends no expected-version header; skipped when no ACL row exists.
@@ -289,26 +183,42 @@ export async function PUT(req: Request) {
   }
   const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false
   const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []
-
-  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false
+  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null
+
+  // A per-user ACL is an absolute override, so an omitted dimension must keep
+  // its stored value. Normalizing an omitted `features` to `[]` or an omitted
+  // `organizations` to `null` turned a single-dimension edit into a silent
+  // clear, deleting the row and widening the user back to their full role.
+  const featuresWereProvided = parsed.data.features !== undefined
+  const requestedFeatures = featuresWereProvided
+    ? normalizeGrantFeatureList(parsed.data.features)
+    : existingFeatures
+  const requestedOrganizations = parsed.data.organizations === undefined
+    ? existingOrganizations
+    : normalizeOrganizations(parsed.data.organizations)
+
+  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin
 
   try {
     await assertActorCanGrantAcl({
       em: em as EntityManager,
       rbacService: rbacService as RbacService,
       actorUserId: auth.sub,
-      tenantId: actorTenantId,
+      tenantId: auth.tenantId ?? null,
       organizationId: auth.orgId ?? null,
       isSuperAdmin: requestedIsSuperAdmin,
       features: requestedFeatures,
-      organizations,
+      organizations: requestedOrganizations,
     })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
     throw err
   }
 
-  const effectiveFeatures = actorIsSuperAdmin
+  // An omitted feature list is already stored and in effect. Re-sanitizing it
+  // during an unrelated organization edit would silently revoke grants the
+  // actor did not touch, so only an explicitly submitted list is sanitized.
+  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided
     ? requestedFeatures
     : sanitizeTenantFeatures(requestedFeatures)
 
@@ -325,59 +235,56 @@ export async function PUT(req: Request) {
     }
   }
 
-  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
+  // Retaining an organization-only override with no features would revoke every
+  // role-granted feature instead of narrowing the role. Refuse that state rather
+  // than persisting it or silently dropping the organization scope.
+  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({
+      error: translate(
+        'auth.acl.organizationWarning',
+        'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.',
+      ),
+    }, { status: 400 })
+  }
 
-  // What the caller asked for, handed to the command only when it exceeds what
-  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant
-  // escalations; what reaches the strip is quieter — a restricted grant the
-  // actor does hold — and it leaves before/after identical, so the audit entry
-  // would otherwise be indistinguishable from a no-op and skipped as one.
-  //
-  // Features are the only axis that can be trimmed. A super-admin request is
-  // either honoured or refused outright above, never silently downgraded, so
-  // comparing the two flags here would be dead weight.
-  //
-  // Deliberately independent of the `sanitized` response flag below:
-  // `hasRestrictedChanges` stays false when the trimmed result equals the
-  // existing ACL, to avoid nagging the user about a save that changed nothing —
-  // but that is precisely an attempt the trail must keep.
-  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))
+  // An unrestricted organization list carries no override on its own, and the guard
+  // above already refused the restricted-but-featureless case, so the override is
+  // custom exactly when it grants super admin or at least one feature.
+  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
 
-  // Route the write through the command bus so the permission change lands in
-  // the action log. The command owns the transactional write (or removal) and
-  // the RBAC cache invalidation that used to live here.
-  const commandBus = container.resolve('commandBus') as CommandBus
-  // A tenant-less actor edits an override in the target user's tenant, so their
-  // organization belongs to a tenant the entry is not about. The bus resolves
-  // the log row's organization as `metadata.organizationId ??
-  // ctx.selectedOrganizationId ?? ctx.auth.orgId` — a `??` chain, so the
-  // handler's `resolveOrganizationId` cannot express "explicitly no
-  // organization" and the actor's would be restored. Strip it from the context
-  // instead, exactly as the roles route does: otherwise the entry carries a
-  // (target tenant, foreign organization) pair that `ActionLogService` — which
-  // filters organization with strict equality — can never surface for anyone.
-  const isForeignTenant = tenantId !== (auth.tenantId ?? null)
-  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null
-  const commandCtx: CommandRuntimeContext = {
-    container,
-    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
-    organizationScope: null,
-    selectedOrganizationId: actorOrgId,
-    organizationIds: actorOrgId ? [actorOrgId] : null,
-    request: req,
+  // Persist the ACL mutation inside a transaction so the per-user permission
+  // write (or removal) commits atomically (proper ACL-edit transaction handling).
+  if (!hasCustomAcl) {
+    if (acl) {
+      const aclToRemove = acl
+      await withAtomicFlush(em, [() => em.remove(aclToRemove)], { transaction: true })
+    }
+  } else {
+    if (!acl) {
+      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+    }
+    const aclRecord = acl as any
+    await withAtomicFlush(
+      em,
+      [
+        () => {
+          aclRecord.isSuperAdmin = effectiveIsSuperAdmin
+          aclRecord.featuresJson = effectiveFeatures
+          aclRecord.organizationsJson = requestedOrganizations
+          em.persist(aclRecord)
+        },
+      ],
+      { transaction: true },
+    )
   }
-  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {
-    input: {
-      userId: parsed.data.userId,
-      tenantId,
-      isSuperAdmin: effectiveIsSuperAdmin,
-      features: effectiveFeatures,
-      organizations,
-      clear: !hasCustomAcl,
-      requested: strippedFeatures.length ? { features: requestedFeatures } : null,
-    },
-    ctx: commandCtx,
-  })
+
+  // Invalidate cache for this user
+  await rbacService.invalidateUserCache(parsed.data.userId)
+  try {
+    const cache = container.resolve('cache') as any
+    if (cache) await cache.deleteByTags([`rbac:user:${parsed.data.userId}`])
+  } catch {}
 
   return NextResponse.json({
     ok: true,
@@ -390,6 +297,16 @@ function normalizeOrganizations(organizations: unknown): string[] | null {
   return normalizeGrantFeatureList(organizations)
 }
 
+// Whether the caller expressed an intentional narrowing. `null` and `__all__`
+// are the two documented ways to say "every organization"; an empty list is the
+// editor's "no organization picked" state ("Empty = all organizations"), which
+// is not a restriction an administrator chose. Only a concrete list narrows, so
+// only a concrete list has to justify itself against the feature grant below.
+function hasOrganizationRestriction(organizations: string[] | null): boolean {
+  if (!organizations || organizations.length === 0) return false
+  return !organizations.includes('__all__')
+}
+
 function sanitizeTenantFeatures(features: string[]): string[] {
   return features.filter((feature) => !isTenantRestrictedFeature(feature))
 }
@@ -424,25 +341,24 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Fetch user ACL',
-      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',
+      description: 'Returns custom ACL overrides for a user within the current tenant, if any.',
       query: getSchema,
       responses: [
         { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },
         { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },
         { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },
-        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },
       ],
     },
     PUT: {
       summary: 'Update user ACL',
-      description: 'Configures per-user ACL overrides, including super admin access, feature list, and organization scope.',
+      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.',
       requestBody: {
         contentType: 'application/json',
         schema: putSchema,
       },
       responses: [
         { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },
-        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },
+        { status: 400, description: 'Invalid payload', schema: userAclErrorSchema },
         { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },
         { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },
       ],

package/src/modules/auth/backend/roles/[id]/edit/page.meta.ts

@@ -2,10 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['auth.roles.manage'],
   pageTitle: 'Edit Role',
-  pageTitleKey: 'auth.roles.form.title.edit',
-  breadcrumb: [
-    { label: 'Roles', labelKey: 'auth.nav.roles', href: '/backend/roles' },
-    { label: 'Edit', labelKey: 'common.edit' },
-  ],
+  breadcrumb: [ { label: 'Roles', href: '/backend/roles' }, { label: 'Edit' } ],
 }
 
+

package/src/modules/auth/backend/roles/page.tsx

@@ -33,7 +33,6 @@ export default function RolesListPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [rows, setRows] = React.useState<Row[]>([])
   const [isLoading, setIsLoading] = React.useState(true)
@@ -56,7 +55,7 @@ export default function RolesListPage() {
           items?: Row[]
           total?: number
           totalPages?: number
-          isSuperAdmin?: boolean; totalIsCapped?: boolean
+          isSuperAdmin?: boolean
         }>(
           `/api/auth/roles?${params.toString()}`,
           undefined,
@@ -66,7 +65,6 @@ export default function RolesListPage() {
           setRows(j.items || [])
           setTotal(j.total || 0)
           setTotalPages(j.totalPages || 1)
-          setTotalIsCapped(j?.totalIsCapped === true)
           setIsSuperAdmin(!!j.isSuperAdmin)
         }
       } finally {
@@ -158,7 +156,7 @@ export default function RolesListPage() {
               createLabel={t('auth.roles.list.actions.create', 'Create')}
             />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>

package/src/modules/auth/backend/users/[id]/edit/page.meta.ts

@@ -2,10 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['auth.users.edit'],
   pageTitle: 'Edit User',
-  pageTitleKey: 'auth.users.form.title.edit',
-  breadcrumb: [
-    { label: 'Users', labelKey: 'auth.nav.users', href: '/backend/users' },
-    { label: 'Edit', labelKey: 'common.edit' },
-  ],
+  breadcrumb: [ { label: 'Users', href: '/backend/users' }, { label: 'Edit' } ],
 }
 
+

package/src/modules/auth/backend/users/page.tsx

@@ -351,7 +351,7 @@ export default function UsersListPage() {
   const { data: usersData, isLoading } = useQuery({
     queryKey: ['users', params, scopeVersion],
     queryFn: async () => {
-      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; totalIsCapped?: boolean; isSuperAdmin?: boolean }>(
+      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; isSuperAdmin?: boolean }>(
         `/api/auth/users?${params}`,
       )
       if (!call.ok) {
@@ -364,7 +364,6 @@ export default function UsersListPage() {
   const rows = usersData?.items || []
   const total = usersData?.total || 0
   const totalPages = usersData?.totalPages || 1
-  const totalIsCapped = usersData?.totalIsCapped === true
   const isSuperAdmin = !!usersData?.isSuperAdmin
   const rowsWithOrgNames: Row[] = React.useMemo(() => rows.map(row => ({
     ...row,
@@ -457,7 +456,7 @@ export default function UsersListPage() {
               { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
             ]} />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>