@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/dist/modules/auth/api/users/acl/route.js

@@ -5,28 +5,22 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { logCrudAccess } from "@open-mercato/shared/lib/crud/factory";
 import { forbidden, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
-import { User, UserAcl } from "@open-mercato/core/modules/auth/data/entities";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
+import { UserAcl } from "@open-mercato/core/modules/auth/data/entities";
 import {
   assertActorCanAccessUserTarget,
   assertActorCanGrantAcl,
   assertActorCanModifySuperAdminUserTarget,
   normalizeGrantFeatureList
 } from "@open-mercato/core/modules/auth/lib/grantChecks";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import {
-  AUTH_USER_ACL_UPDATE_COMMAND_ID
-} from "@open-mercato/core/modules/auth/commands/acl";
-const getSchema = z.object({
-  userId: z.string().uuid(),
-  tenantId: z.string().uuid().optional()
-});
+const getSchema = z.object({ userId: z.string().uuid() });
 const putSchema = z.object({
   userId: z.string().uuid(),
   isSuperAdmin: z.boolean().optional(),
   features: z.array(z.string()).optional(),
-  organizations: z.array(z.string()).nullable().optional(),
-  tenantId: z.string().uuid().optional()
+  organizations: z.array(z.string()).nullable().optional()
 });
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["auth.acl.manage"] },
@@ -44,54 +38,23 @@ const userAclUpdateResponseSchema = z.object({
   sanitized: z.boolean()
 });
 const userAclErrorSchema = z.object({ error: z.string() });
-async function resolveAclTenantId(args) {
-  const authTenantId = args.auth.tenantId ?? null;
-  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {
-    return { error: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
-  }
-  const known = args.requestedTenantId ?? authTenantId;
-  if (known) return { tenantId: known };
-  if (!args.actorIsSuperAdmin) return { tenantId: null };
-  const targetUser = await findOneWithDecryption(
-    args.em,
-    User,
-    { id: args.userId },
-    {},
-    { tenantId: null, organizationId: args.auth.orgId ?? null }
-  );
-  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null };
-}
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const url = new URL(req.url);
-  const parsed = getSchema.safeParse({
-    userId: url.searchParams.get("userId"),
-    tenantId: url.searchParams.get("tenantId") || void 0
-  });
+  const parsed = getSchema.safeParse({ userId: url.searchParams.get("userId") });
   if (!parsed.success) return NextResponse.json({ error: "Invalid input" }, { status: 400 });
   const container = await createRequestContainer();
   const em = container.resolve("em");
   const rbacService = container.resolve("rbacService");
-  const actorTenantId = auth.tenantId ?? null;
-  const actorAcl = auth.sub ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null }) : null;
-  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin;
-  const resolution = await resolveAclTenantId({
-    em,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId
-  });
-  if ("error" in resolution) return resolution.error;
-  const tenantId = resolution.tenantId;
-  if (!actorIsSuperAdmin && auth.sub) {
+  const actorAcl = auth.sub ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null }) : null;
+  if (!actorAcl?.isSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em,
         rbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false
@@ -100,7 +63,7 @@ async function GET(req) {
         em,
         rbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -108,7 +71,7 @@ async function GET(req) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId
+          tenantId: auth.tenantId ?? null
         })
       });
     } catch (err) {
@@ -116,7 +79,7 @@ async function GET(req) {
       throw err;
     }
   }
-  const acl = tenantId ? await em.findOne(UserAcl, { user: parsed.data.userId, tenantId }) : null;
+  const acl = await em.findOne(UserAcl, { user: parsed.data.userId, tenantId: auth.tenantId });
   const response = acl ? {
     hasCustomAcl: true,
     isSuperAdmin: !!acl.isSuperAdmin,
@@ -132,8 +95,8 @@ async function GET(req) {
     idField: "id",
     resourceKind: "auth.user_acl",
     organizationId: auth.orgId ?? null,
-    tenantId,
-    query: { userId: parsed.data.userId, tenantId },
+    tenantId: auth.tenantId ?? null,
+    query: { userId: parsed.data.userId },
     accessType: "read:item"
   });
   return NextResponse.json(response);
@@ -147,26 +110,15 @@ async function PUT(req) {
   const container = await createRequestContainer();
   const em = container.resolve("em");
   const rbacService = container.resolve("rbacService");
-  const actorTenantId = auth.tenantId ?? null;
-  const actorAcl = auth.sub ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null }) : null;
+  const actorAcl = auth.sub ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null }) : null;
   const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin;
-  const resolution = await resolveAclTenantId({
-    em,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId
-  });
-  if ("error" in resolution) return resolution.error;
-  const tenantId = resolution.tenantId;
-  if (!tenantId) return NextResponse.json({ error: "Tenant required" }, { status: 400 });
   if (!actorIsSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em,
         rbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false
@@ -175,7 +127,7 @@ async function PUT(req) {
         em,
         rbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -183,7 +135,7 @@ async function PUT(req) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId
+          tenantId: auth.tenantId ?? null
         })
       });
     } catch (err) {
@@ -191,9 +143,7 @@ async function PUT(req) {
       throw err;
     }
   }
-  const requestedFeatures = normalizeGrantFeatureList(parsed.data.features);
-  const organizations = normalizeOrganizations(parsed.data.organizations);
-  const acl = await em.findOne(UserAcl, { user: parsed.data.userId, tenantId });
+  let acl = await em.findOne(UserAcl, { user: parsed.data.userId, tenantId: auth.tenantId });
   if (acl) {
     try {
       await enforceCommandOptimisticLockWithGuards(container, {
@@ -209,23 +159,27 @@ async function PUT(req) {
   }
   const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false;
   const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : [];
-  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false;
+  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null;
+  const featuresWereProvided = parsed.data.features !== void 0;
+  const requestedFeatures = featuresWereProvided ? normalizeGrantFeatureList(parsed.data.features) : existingFeatures;
+  const requestedOrganizations = parsed.data.organizations === void 0 ? existingOrganizations : normalizeOrganizations(parsed.data.organizations);
+  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin;
   try {
     await assertActorCanGrantAcl({
       em,
       rbacService,
       actorUserId: auth.sub,
-      tenantId: actorTenantId,
+      tenantId: auth.tenantId ?? null,
       organizationId: auth.orgId ?? null,
       isSuperAdmin: requestedIsSuperAdmin,
       features: requestedFeatures,
-      organizations
+      organizations: requestedOrganizations
     });
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
     throw err;
   }
-  const effectiveFeatures = actorIsSuperAdmin ? requestedFeatures : sanitizeTenantFeatures(requestedFeatures);
+  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided ? requestedFeatures : sanitizeTenantFeatures(requestedFeatures);
   let effectiveIsSuperAdmin = requestedIsSuperAdmin;
   if (!actorIsSuperAdmin) {
     if (requestedIsSuperAdmin && !existingIsSuperAdmin) {
@@ -237,31 +191,45 @@ async function PUT(req) {
       effectiveIsSuperAdmin = existingIsSuperAdmin;
     }
   }
+  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({
+      error: translate(
+        "auth.acl.organizationWarning",
+        "Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving."
+      )
+    }, { status: 400 });
+  }
   const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0;
-  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature));
-  const commandBus = container.resolve("commandBus");
-  const isForeignTenant = tenantId !== (auth.tenantId ?? null);
-  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null;
-  const commandCtx = {
-    container,
-    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
-    organizationScope: null,
-    selectedOrganizationId: actorOrgId,
-    organizationIds: actorOrgId ? [actorOrgId] : null,
-    request: req
-  };
-  await commandBus.execute(AUTH_USER_ACL_UPDATE_COMMAND_ID, {
-    input: {
-      userId: parsed.data.userId,
-      tenantId,
-      isSuperAdmin: effectiveIsSuperAdmin,
-      features: effectiveFeatures,
-      organizations,
-      clear: !hasCustomAcl,
-      requested: strippedFeatures.length ? { features: requestedFeatures } : null
-    },
-    ctx: commandCtx
-  });
+  if (!hasCustomAcl) {
+    if (acl) {
+      const aclToRemove = acl;
+      await withAtomicFlush(em, [() => em.remove(aclToRemove)], { transaction: true });
+    }
+  } else {
+    if (!acl) {
+      acl = em.create(UserAcl, { user: parsed.data.userId, tenantId: auth.tenantId });
+    }
+    const aclRecord = acl;
+    await withAtomicFlush(
+      em,
+      [
+        () => {
+          aclRecord.isSuperAdmin = effectiveIsSuperAdmin;
+          aclRecord.featuresJson = effectiveFeatures;
+          aclRecord.organizationsJson = requestedOrganizations;
+          em.persist(aclRecord);
+        }
+      ],
+      { transaction: true }
+    );
+  }
+  await rbacService.invalidateUserCache(parsed.data.userId);
+  try {
+    const cache = container.resolve("cache");
+    if (cache) await cache.deleteByTags([`rbac:user:${parsed.data.userId}`]);
+  } catch {
+  }
   return NextResponse.json({
     ok: true,
     sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin)
@@ -271,6 +239,10 @@ function normalizeOrganizations(organizations) {
   if (!Array.isArray(organizations)) return null;
   return normalizeGrantFeatureList(organizations);
 }
+function hasOrganizationRestriction(organizations) {
+  if (!organizations || organizations.length === 0) return false;
+  return !organizations.includes("__all__");
+}
 function sanitizeTenantFeatures(features) {
   return features.filter((feature) => !isTenantRestrictedFeature(feature));
 }
@@ -301,25 +273,24 @@ const openApi = {
   methods: {
     GET: {
       summary: "Fetch user ACL",
-      description: "Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.",
+      description: "Returns custom ACL overrides for a user within the current tenant, if any.",
       query: getSchema,
       responses: [
         { status: 200, description: "User ACL entry", schema: userAclResponseSchema },
         { status: 400, description: "Invalid user id", schema: userAclErrorSchema },
-        { status: 401, description: "Unauthorized", schema: userAclErrorSchema },
-        { status: 403, description: "Insufficient privileges for the requested tenant scope", schema: userAclErrorSchema }
+        { status: 401, description: "Unauthorized", schema: userAclErrorSchema }
       ]
     },
     PUT: {
       summary: "Update user ACL",
-      description: "Configures per-user ACL overrides, including super admin access, feature list, and organization scope.",
+      description: "Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.",
       requestBody: {
         contentType: "application/json",
         schema: putSchema
       },
       responses: [
         { status: 200, description: "User ACL updated", schema: userAclUpdateResponseSchema },
-        { status: 400, description: "Invalid payload or unresolved tenant scope", schema: userAclErrorSchema },
+        { status: 400, description: "Invalid payload", schema: userAclErrorSchema },
         { status: 401, description: "Unauthorized", schema: userAclErrorSchema },
         { status: 403, description: "Insufficient privileges to modify ACL", schema: userAclErrorSchema }
       ]

package/dist/modules/auth/api/users/acl/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/api/users/acl/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  AUTH_USER_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type UserAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\ntype TenantResolution = { tenantId: string | null } | { error: NextResponse }\n\n/**\n * The single tenant scope both handlers work in. GET and PUT MUST resolve it the\n * same way: the admin user form PUTs the ACL panel's state on every save, so a\n * GET that reads a narrower scope than the PUT writes hands the operator an\n * empty form and turns the next name-only edit into a silent revocation, with no\n * `updatedAt` to arm the optimistic lock against it.\n *\n * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a\n * global account legitimately signs in with `auth.tenantId === null` and the\n * scope has to come from the target user instead. That fallback is reserved for\n * a super admin: for anyone else it would let the target pick the scope its own\n * access is then checked against, and it decrypts a possibly foreign user ahead\n * of every guard. A tenant-less non-super-admin therefore resolves to `null`,\n * which reads as \"no override\" and refuses to write \u2014 the behaviour that held\n * before this route resolved a scope at all. The read is also skipped whenever a\n * tenant is already known.\n *\n * An explicit `tenantId` wins, mirroring the role ACL route (additive there and\n * here; no caller sends it yet) \u2014 but only for a super admin or for the actor's\n * own tenant, so it cannot widen anyone's reach. The result is that for a\n * non-super-admin the resolved scope is always the actor's own.\n */\nasync function resolveAclTenantId(args: {\n  em: EntityManager\n  auth: NonNullable<AuthContext>\n  actorIsSuperAdmin: boolean\n  userId: string\n  requestedTenantId?: string\n}): Promise<TenantResolution> {\n  const authTenantId = args.auth.tenantId ?? null\n  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {\n    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }\n  }\n  const known = args.requestedTenantId ?? authTenantId\n  if (known) return { tenantId: known }\n  if (!args.actorIsSuperAdmin) return { tenantId: null }\n  const targetUser = await findOneWithDecryption(\n    args.em,\n    User,\n    { id: args.userId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: args.auth.orgId ?? null },\n  )\n  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    userId: url.searchParams.get('userId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  // An unresolvable scope reads as \"no override\", which is what PUT then refuses\n  // to write (`Tenant required`) \u2014 so the pair still cannot destroy a row.\n  const tenantId = resolution.tenantId\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = tenantId\n    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n    : null\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId,\n    query: { userId: parsed.data.userId, tenantId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  // Every grant check is answered in the actor's own scope, never in the scope\n  // resolved for the record: passing the resolved one would ask a foreign tenant\n  // whether this caller may act there, and for a tenant-less actor \u2014 whose scope\n  // comes from the target \u2014 it would compare the target against itself.\n  const actorTenantId = auth.tenantId ?? null\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  // The scope the row is read and written in. `auth.tenantId` is `string | null`\n  // \u2014 never `undefined`, since every producer normalizes with `?? null` \u2014 so the\n  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched\n  // no row, leaving create/update to fail the NOT NULL constraint and clear to\n  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500\n  // into a working, correctly scoped write.\n  const resolution = await resolveAclTenantId({\n    em: em as EntityManager,\n    auth,\n    actorIsSuperAdmin,\n    userId: parsed.data.userId,\n    requestedTenantId: parsed.data.tenantId,\n  })\n  if ('error' in resolution) return resolution.error\n  const tenantId = resolution.tenantId\n  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: actorTenantId,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: actorTenantId,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const requestedFeatures = normalizeGrantFeatureList(parsed.data.features)\n  const organizations = normalizeOrganizations(parsed.data.organizations)\n\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: actorTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const effectiveFeatures = actorIsSuperAdmin\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // What the caller asked for, handed to the command only when it exceeds what\n  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant\n  // escalations; what reaches the strip is quieter \u2014 a restricted grant the\n  // actor does hold \u2014 and it leaves before/after identical, so the audit entry\n  // would otherwise be indistinguishable from a no-op and skipped as one.\n  //\n  // Features are the only axis that can be trimmed. A super-admin request is\n  // either honoured or refused outright above, never silently downgraded, so\n  // comparing the two flags here would be dead weight.\n  //\n  // Deliberately independent of the `sanitized` response flag below:\n  // `hasRestrictedChanges` stays false when the trimmed result equals the\n  // existing ACL, to avoid nagging the user about a save that changed nothing \u2014\n  // but that is precisely an attempt the trail must keep.\n  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write (or removal) and\n  // the RBAC cache invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A tenant-less actor edits an override in the target user's tenant, so their\n  // organization belongs to a tenant the entry is not about. The bus resolves\n  // the log row's organization as `metadata.organizationId ??\n  // ctx.selectedOrganizationId ?? ctx.auth.orgId` \u2014 a `??` chain, so the\n  // handler's `resolveOrganizationId` cannot express \"explicitly no\n  // organization\" and the actor's would be restored. Strip it from the context\n  // instead, exactly as the roles route does: otherwise the entry carries a\n  // (target tenant, foreign organization) pair that `ActionLogService` \u2014 which\n  // filters organization with strict equality \u2014 can never surface for anyone.\n  const isForeignTenant = tenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      userId: parsed.data.userId,\n      tenantId,\n      isSuperAdmin: effectiveIsSuperAdmin,\n      features: effectiveFeatures,\n      organizations,\n      clear: !hasCustomAcl,\n      requested: strippedFeatures.length ? { features: requestedFeatures } : null,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Configures per-user ACL overrides, including super admin access, feature list, and organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8CAA8C;AAEvD,SAAS,MAAM,eAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,6BAA6B;AAEtC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,OAGK;AAEP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AA0BzD,eAAe,mBAAmB,MAMJ;AAC5B,QAAM,eAAe,KAAK,KAAK,YAAY;AAC3C,MAAI,KAAK,qBAAqB,KAAK,sBAAsB,gBAAgB,CAAC,KAAK,mBAAmB;AAChG,WAAO,EAAE,OAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC7E;AACA,QAAM,QAAQ,KAAK,qBAAqB;AACxC,MAAI,MAAO,QAAO,EAAE,UAAU,MAAM;AACpC,MAAI,CAAC,KAAK,kBAAmB,QAAO,EAAE,UAAU,KAAK;AACrD,QAAM,aAAa,MAAM;AAAA,IACvB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,IAAI,KAAK,OAAO;AAAA,IAClB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK,KAAK,SAAS,KAAK;AAAA,EAC5D;AACA,SAAO,EAAE,UAAU,YAAY,WAAW,OAAO,WAAW,QAAQ,IAAI,KAAK;AAC/E;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAKnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAG7C,QAAM,WAAW,WAAW;AAE5B,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MAAM,WACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC,IACvE;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc;AAAA,IACd,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAEnG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,SAAS;AAAA,IAC9C,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAMnD,QAAM,gBAAgB,KAAK,YAAY;AACvC,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,eAAe,gBAAgB,KAAK,SAAS,KAAK,CAAC,IACnG;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAQtC,QAAM,aAAa,MAAM,mBAAmB;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,KAAK;AAAA,IACpB,mBAAmB,OAAO,KAAK;AAAA,EACjC,CAAC;AACD,MAAI,WAAW,WAAY,QAAO,WAAW;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAErF,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,oBAAoB,0BAA0B,OAAO,KAAK,QAAQ;AACxE,QAAM,gBAAgB,uBAAuB,OAAO,KAAK,aAAa;AAEtE,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,SAAS,CAAC;AAInF,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,CAAC,CAAC,IAAI,eAAe;AACxD,QAAM,mBAAmB,MAAM,0BAA0B,IAAI,YAAY,IAAI,CAAC;AAE9E,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAE1D,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,oBAAoB,oBACtB,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,yDAAyD;AAAA,IAC3E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,eAAe,yBAAyB,kBAAkB,SAAS;AAgBzE,QAAM,mBAAmB,kBAAkB,OAAO,CAAC,YAAY,CAAC,kBAAkB,SAAS,OAAO,CAAC;AAKnG,QAAM,aAAa,UAAU,QAAQ,YAAY;AAUjD,QAAM,kBAAkB,cAAc,KAAK,YAAY;AACvD,QAAM,aAAa,kBAAkB,OAAO,KAAK,SAAS;AAC1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA,MAAM,kBAAkB,EAAE,GAAG,MAAM,OAAO,KAAK,IAAI;AAAA,IACnD,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,aAAa,CAAC,UAAU,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACA,QAAM,WAAW,QAA6C,iCAAiC;AAAA,IAC7F,OAAO;AAAA,MACL,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV;AAAA,MACA,OAAO,CAAC;AAAA,MACR,WAAW,iBAAiB,SAAS,EAAE,UAAU,kBAAkB,IAAI;AAAA,IACzE;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,qBAAqB,mBAAmB,mBAAmB,gBAAgB,KAAK,0BAA0B;AAAA,EAC9I,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAqB,WAAqB,UAA6B;AACnG,MAAI,UAAU,WAAW,UAAU,OAAQ,QAAO;AAClD,QAAM,eAAe,IAAI,IAAI,SAAS;AACtC,QAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,MAAI,aAAa,SAAS,YAAY,MAAM;AAC1C,QAAI,YAAY;AAChB,eAAW,SAAS,cAAc;AAChC,UAAI,CAAC,YAAY,IAAI,KAAK,GAAG;AAC3B,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,mBAAmB;AAAA,MACnH;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mBAAmB;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { UserAcl } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  assertActorCanAccessUserTarget,\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminUserTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\nconst getSchema = z.object({ userId: z.string().uuid() })\nconst putSchema = z.object({\n  userId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst userAclResponseSchema = z.object({\n  hasCustomAcl: z.boolean(),\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst userAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst userAclErrorSchema = z.object({ error: z.string() })\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({ userId: url.searchParams.get('userId') })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n    : null\n  if (!actorAcl?.isSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: auth.tenantId ?? null,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })\n  const response = acl\n    ? {\n        hasCustomAcl: true,\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { hasCustomAcl: false, isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.userId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.user_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId: auth.tenantId ?? null,\n    query: { userId: parsed.data.userId },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbacService = container.resolve('rbacService') as any\n\n  const actorAcl = auth.sub\n    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n    : null\n  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin\n\n  if (!actorIsSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n      })\n      await assertActorCanAccessUserTarget({\n        em: em as EntityManager,\n        rbacService: rbacService as RbacService,\n        actorUserId: auth.sub,\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        targetUserId: parsed.data.userId,\n        actorIsSuperAdmin: false,\n        organizationScope: await resolveOrganizationScopeForRequest({\n          container,\n          auth,\n          request: req,\n          tenantId: auth.tenantId ?? null,\n        }),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  let acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })\n  // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits\n  // cannot silently clobber each other (#2055). Strictly additive \u2014 a no-op when\n  // the client sends no expected-version header; skipped when no ACL row exists.\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.user_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n  const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false\n  const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []\n  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null\n\n  // A per-user ACL is an absolute override, so an omitted dimension must keep\n  // its stored value. Normalizing an omitted `features` to `[]` or an omitted\n  // `organizations` to `null` turned a single-dimension edit into a silent\n  // clear, deleting the row and widening the user back to their full role.\n  const featuresWereProvided = parsed.data.features !== undefined\n  const requestedFeatures = featuresWereProvided\n    ? normalizeGrantFeatureList(parsed.data.features)\n    : existingFeatures\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n\n  try {\n    await assertActorCanGrantAcl({\n      em: em as EntityManager,\n      rbacService: rbacService as RbacService,\n      actorUserId: auth.sub,\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // An omitted feature list is already stored and in effect. Re-sanitizing it\n  // during an unrelated organization edit would silently revoke grants the\n  // actor did not touch, so only an explicitly submitted list is sanitized.\n  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided\n    ? requestedFeatures\n    : sanitizeTenantFeatures(requestedFeatures)\n\n  let effectiveIsSuperAdmin = requestedIsSuperAdmin\n\n  if (!actorIsSuperAdmin) {\n    if (requestedIsSuperAdmin && !existingIsSuperAdmin) {\n      throw forbidden('Only super administrators can grant super admin access.')\n    }\n    if (existingIsSuperAdmin && requestedIsSuperAdmin === false) {\n      effectiveIsSuperAdmin = false\n    } else {\n      effectiveIsSuperAdmin = existingIsSuperAdmin\n    }\n  }\n\n  // Retaining an organization-only override with no features would revoke every\n  // role-granted feature instead of narrowing the role. Refuse that state rather\n  // than persisting it or silently dropping the organization scope.\n  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate(\n        'auth.acl.organizationWarning',\n        'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.',\n      ),\n    }, { status: 400 })\n  }\n\n  // An unrestricted organization list carries no override on its own, and the guard\n  // above already refused the restricted-but-featureless case, so the override is\n  // custom exactly when it grants super admin or at least one feature.\n  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0\n\n  // Persist the ACL mutation inside a transaction so the per-user permission\n  // write (or removal) commits atomically (proper ACL-edit transaction handling).\n  if (!hasCustomAcl) {\n    if (acl) {\n      const aclToRemove = acl\n      await withAtomicFlush(em, [() => em.remove(aclToRemove)], { transaction: true })\n    }\n  } else {\n    if (!acl) {\n      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })\n    }\n    const aclRecord = acl as any\n    await withAtomicFlush(\n      em,\n      [\n        () => {\n          aclRecord.isSuperAdmin = effectiveIsSuperAdmin\n          aclRecord.featuresJson = effectiveFeatures\n          aclRecord.organizationsJson = requestedOrganizations\n          em.persist(aclRecord)\n        },\n      ],\n      { transaction: true },\n    )\n  }\n\n  // Invalidate cache for this user\n  await rbacService.invalidateUserCache(parsed.data.userId)\n  try {\n    const cache = container.resolve('cache') as any\n    if (cache) await cache.deleteByTags([`rbac:user:${parsed.data.userId}`])\n  } catch {}\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: !actorIsSuperAdmin && (hasRestrictedChanges(requestedFeatures, effectiveFeatures, existingFeatures) || requestedIsSuperAdmin !== effectiveIsSuperAdmin),\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\n// Whether the caller expressed an intentional narrowing. `null` and `__all__`\n// are the two documented ways to say \"every organization\"; an empty list is the\n// editor's \"no organization picked\" state (\"Empty = all organizations\"), which\n// is not a restriction an administrator chose. Only a concrete list narrows, so\n// only a concrete list has to justify itself against the feature grant below.\nfunction hasOrganizationRestriction(organizations: string[] | null): boolean {\n  if (!organizations || organizations.length === 0) return false\n  return !organizations.includes('__all__')\n}\n\nfunction sanitizeTenantFeatures(features: string[]): string[] {\n  return features.filter((feature) => !isTenantRestrictedFeature(feature))\n}\n\nfunction isTenantRestrictedFeature(feature: string): boolean {\n  if (feature === '*' || feature === 'directory.*') return true\n  if (feature.startsWith('directory.tenants')) return true\n  return false\n}\n\nfunction hasRestrictedChanges(requested: string[], effective: string[], existing: string[]): boolean {\n  if (requested.length === effective.length) return false\n  const effectiveSet = new Set(effective)\n  const existingSet = new Set(existing)\n  // If the effective set matches existing, we only trimmed restricted duplicates and should not report\n  if (effectiveSet.size === existingSet.size) {\n    let identical = true\n    for (const value of effectiveSet) {\n      if (!existingSet.has(value)) {\n        identical = false\n        break\n      }\n    }\n    if (identical) return false\n  }\n  return true\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'User ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch user ACL',\n      description: 'Returns custom ACL overrides for a user within the current tenant, if any.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },\n        { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update user ACL',\n      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: userAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,WAAW,uBAAuB;AAC3C,SAAS,8CAA8C;AACvD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,0CAA0C;AAEnD,MAAM,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AACzD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEzD,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU,EAAE,QAAQ,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;AAC7E,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC,IAC3G;AACJ,MAAI,CAAC,UAAU,gBAAgB,KAAK,KAAK;AACvC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU,KAAK,YAAY;AAAA,QAC7B,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,UAAU,KAAK,SAAgB,CAAC;AACzG,QAAM,WAAW,MACb;AAAA,IACE,cAAc;AAAA,IACd,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAEnG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B,UAAU,KAAK,YAAY;AAAA,IAC3B,OAAO,EAAE,QAAQ,OAAO,KAAK,OAAO;AAAA,IACpC,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAc,UAAU,QAAQ,aAAa;AAEnD,QAAM,WAAW,KAAK,MAClB,MAAM,YAAY,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC,IAC3G;AACJ,QAAM,oBAAoB,CAAC,CAAC,UAAU;AAEtC,MAAI,CAAC,qBAAqB,KAAK,KAAK;AAClC,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AACD,YAAM,+BAA+B;AAAA,QACnC;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,QACnB,mBAAmB,MAAM,mCAAmC;AAAA,UAC1D;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU,KAAK,YAAY;AAAA,QAC7B,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,UAAU,KAAK,SAAgB,CAAC;AAIvG,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,uBAAuB,MAAM,CAAC,CAAC,IAAI,eAAe;AACxD,QAAM,mBAAmB,MAAM,0BAA0B,IAAI,YAAY,IAAI,CAAC;AAC9E,QAAM,wBAAwB,MAAM,uBAAuB,IAAI,iBAAiB,IAAI;AAMpF,QAAM,uBAAuB,OAAO,KAAK,aAAa;AACtD,QAAM,oBAAoB,uBACtB,0BAA0B,OAAO,KAAK,QAAQ,IAC9C;AACJ,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAE1D,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAKA,QAAM,oBAAoB,qBAAqB,CAAC,uBAC5C,oBACA,uBAAuB,iBAAiB;AAE5C,MAAI,wBAAwB;AAE5B,MAAI,CAAC,mBAAmB;AACtB,QAAI,yBAAyB,CAAC,sBAAsB;AAClD,YAAM,UAAU,yDAAyD;AAAA,IAC3E;AACA,QAAI,wBAAwB,0BAA0B,OAAO;AAC3D,8BAAwB;AAAA,IAC1B,OAAO;AACL,8BAAwB;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,CAAC,yBAAyB,kBAAkB,WAAW,KAAK,2BAA2B,sBAAsB,GAAG;AAClH,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAKA,QAAM,eAAe,yBAAyB,kBAAkB,SAAS;AAIzE,MAAI,CAAC,cAAc;AACjB,QAAI,KAAK;AACP,YAAM,cAAc;AACpB,YAAM,gBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,WAAW,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC;AAAA,IACjF;AAAA,EACF,OAAO;AACL,QAAI,CAAC,KAAK;AACR,YAAM,GAAG,OAAO,SAAS,EAAE,MAAM,OAAO,KAAK,QAAe,UAAU,KAAK,SAAgB,CAAC;AAAA,IAC9F;AACA,UAAM,YAAY;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AACJ,oBAAU,eAAe;AACzB,oBAAU,eAAe;AACzB,oBAAU,oBAAoB;AAC9B,aAAG,QAAQ,SAAS;AAAA,QACtB;AAAA,MACF;AAAA,MACA,EAAE,aAAa,KAAK;AAAA,IACtB;AAAA,EACF;AAGA,QAAM,YAAY,oBAAoB,OAAO,KAAK,MAAM;AACxD,MAAI;AACF,UAAM,QAAQ,UAAU,QAAQ,OAAO;AACvC,QAAI,MAAO,OAAM,MAAM,aAAa,CAAC,aAAa,OAAO,KAAK,MAAM,EAAE,CAAC;AAAA,EACzE,QAAQ;AAAA,EAAC;AAET,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW,CAAC,sBAAsB,qBAAqB,mBAAmB,mBAAmB,gBAAgB,KAAK,0BAA0B;AAAA,EAC9I,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAOA,SAAS,2BAA2B,eAAyC;AAC3E,MAAI,CAAC,iBAAiB,cAAc,WAAW,EAAG,QAAO;AACzD,SAAO,CAAC,cAAc,SAAS,SAAS;AAC1C;AAEA,SAAS,uBAAuB,UAA8B;AAC5D,SAAO,SAAS,OAAO,CAAC,YAAY,CAAC,0BAA0B,OAAO,CAAC;AACzE;AAEA,SAAS,0BAA0B,SAA0B;AAC3D,MAAI,YAAY,OAAO,YAAY,cAAe,QAAO;AACzD,MAAI,QAAQ,WAAW,mBAAmB,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,qBAAqB,WAAqB,WAAqB,UAA6B;AACnG,MAAI,UAAU,WAAW,UAAU,OAAQ,QAAO;AAClD,QAAM,eAAe,IAAI,IAAI,SAAS;AACtC,QAAM,cAAc,IAAI,IAAI,QAAQ;AAEpC,MAAI,aAAa,SAAS,YAAY,MAAM;AAC1C,QAAI,YAAY;AAChB,eAAW,SAAS,cAAc;AAChC,UAAI,CAAC,YAAY,IAAI,KAAK,GAAG;AAC3B,oBAAY;AACZ;AAAA,MACF;AAAA,IACF;AACA,QAAI,UAAW,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,MACzE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/backend/roles/[id]/edit/page.meta.js

@@ -2,11 +2,7 @@ const metadata = {
   requireAuth: true,
   requireFeatures: ["auth.roles.manage"],
   pageTitle: "Edit Role",
-  pageTitleKey: "auth.roles.form.title.edit",
-  breadcrumb: [
-    { label: "Roles", labelKey: "auth.nav.roles", href: "/backend/roles" },
-    { label: "Edit", labelKey: "common.edit" }
-  ]
+  breadcrumb: [{ label: "Roles", href: "/backend/roles" }, { label: "Edit" }]
 };
 export {
   metadata

package/dist/modules/auth/backend/roles/[id]/edit/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/auth/backend/roles/%5Bid%5D/edit/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['auth.roles.manage'],\n  pageTitle: 'Edit Role',\n  pageTitleKey: 'auth.roles.form.title.edit',\n  breadcrumb: [\n    { label: 'Roles', labelKey: 'auth.nav.roles', href: '/backend/roles' },\n    { label: 'Edit', labelKey: 'common.edit' },\n  ],\n}\n\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,mBAAmB;AAAA,EACrC,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,IACV,EAAE,OAAO,SAAS,UAAU,kBAAkB,MAAM,iBAAiB;AAAA,IACrE,EAAE,OAAO,QAAQ,UAAU,cAAc;AAAA,EAC3C;AACF;",
+  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['auth.roles.manage'],\n  pageTitle: 'Edit Role',\n  breadcrumb: [ { label: 'Roles', href: '/backend/roles' }, { label: 'Edit' } ],\n}\n\n\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,mBAAmB;AAAA,EACrC,WAAW;AAAA,EACX,YAAY,CAAE,EAAE,OAAO,SAAS,MAAM,iBAAiB,GAAG,EAAE,OAAO,OAAO,CAAE;AAC9E;",
   "names": []
 }

package/dist/modules/auth/backend/roles/page.js

@@ -21,7 +21,6 @@ function RolesListPage() {
   const [page, setPage] = React.useState(1);
   const [total, setTotal] = React.useState(0);
   const [totalPages, setTotalPages] = React.useState(1);
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false);
   const [search, setSearch] = React.useState("");
   const [rows, setRows] = React.useState([]);
   const [isLoading, setIsLoading] = React.useState(true);
@@ -48,7 +47,6 @@ function RolesListPage() {
           setRows(j.items || []);
           setTotal(j.total || 0);
           setTotalPages(j.totalPages || 1);
-          setTotalIsCapped(j?.totalIsCapped === true);
           setIsSuperAdmin(!!j.isSuperAdmin);
         }
       } finally {
@@ -138,7 +136,7 @@ function RolesListPage() {
             createLabel: t("auth.roles.list.actions.create", "Create")
           }
         ),
-        pagination: { page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage },
+        pagination: { page, pageSize: 50, total, totalPages, onPageChange: setPage },
         isLoading
       }
     ) }),

package/dist/modules/auth/backend/roles/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/backend/roles/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport type { SortingState } from '@tanstack/react-table'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\n\ntype Row = {\n  id: string\n  name: string\n  usersCount: number\n  tenantId?: string | null\n  tenantIds?: string[]\n  tenantName?: string | null\n  updatedAt?: string | null\n}\n\nexport default function RolesListPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'name', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [totalIsCapped, setTotalIsCapped] = React.useState(false)\n  const [search, setSearch] = React.useState('')\n  const [rows, setRows] = React.useState<Row[]>([])\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(false)\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('page', String(page))\n        params.set('pageSize', '50')\n        if (search) params.set('search', search)\n        const fallback = { items: [], total: 0, totalPages: 1, isSuperAdmin: false }\n        const j = await readApiResultOrThrow<{\n          items?: Row[]\n          total?: number\n          totalPages?: number\n          isSuperAdmin?: boolean; totalIsCapped?: boolean\n        }>(\n          `/api/auth/roles?${params.toString()}`,\n          undefined,\n          { errorMessage: t('auth.roles.list.error.load', 'Failed to load roles'), fallback },\n        )\n        if (!cancelled) {\n          setRows(j.items || [])\n          setTotal(j.total || 0)\n          setTotalPages(j.totalPages || 1)\n          setTotalIsCapped(j?.totalIsCapped === true)\n          setIsSuperAdmin(!!j.isSuperAdmin)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [page, search, reloadToken, scopeVersion, t])\n\n  const formatRoleName = React.useCallback(\n    (name: string) => t(`auth.roles.${name}`, name),\n    [t],\n  )\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('auth.roles.list.confirmDelete', 'Delete role \"{{name}}\"?').replace('{{name}}', formatRoleName(row.name)),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall(\n          `/api/auth/roles?id=${encodeURIComponent(row.id)}`,\n          { method: 'DELETE' },\n        ),\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, t('auth.roles.list.error.delete', 'Failed to delete role'))\n      }\n      flash(t('auth.roles.list.success.delete', 'Role deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : t('auth.roles.list.error.delete', 'Failed to delete role')\n      flash(message, 'error')\n    }\n  }, [confirm, formatRoleName, t])\n\n  const showTenantColumn = React.useMemo(\n    () => isSuperAdmin && rows.some((row) => row.tenantName),\n    [isSuperAdmin, rows],\n  )\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => {\n    const base: ColumnDef<Row>[] = [\n      {\n        accessorKey: 'name',\n        header: t('auth.roles.list.columns.role', 'Role'),\n        cell: ({ row }) => formatRoleName(row.original.name),\n      },\n      { accessorKey: 'usersCount', header: t('auth.roles.list.columns.users', 'Users') },\n    ]\n    if (showTenantColumn) {\n      base.splice(1, 0, { accessorKey: 'tenantName', header: t('auth.roles.list.columns.tenant', 'Tenant') })\n    }\n    return base\n  }, [formatRoleName, showTenantColumn, t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('auth.roles.list.title', 'Roles')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/roles/create\">{t('auth.roles.list.actions.create', 'Create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(v) => { setSearch(v); setPage(1) }}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/roles/${row.id}/edit` },\n              { id: 'show-users', label: t('auth.roles.list.actions.showUsers', 'Show users'), href: `/backend/users?roleId=${encodeURIComponent(row.id)}` },\n              { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('auth.roles.list.title', 'Roles')}\n              createHref=\"/backend/roles/create\"\n              createLabel={t('auth.roles.list.actions.create', 'Create')}\n            />\n          )}\n          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAiII,SAMU,KANV;AAhIJ,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAG1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB;AAYhB,SAAR,gBAAiC;AACtC,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,QAAQ,MAAM,MAAM,CAAC,CAAC;AACxF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,eAAe,gBAAgB,IAAI,MAAM,SAAS,KAAK;AAC9D,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAgB,CAAC,CAAC;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAC5D,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,SAAS,IAAI,gBAAgB;AACnC,eAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,eAAO,IAAI,YAAY,IAAI;AAC3B,YAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,cAAM,WAAW,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,cAAc,MAAM;AAC3E,cAAM,IAAI,MAAM;AAAA,UAMd,mBAAmB,OAAO,SAAS,CAAC;AAAA,UACpC;AAAA,UACA,EAAE,cAAc,EAAE,8BAA8B,sBAAsB,GAAG,SAAS;AAAA,QACpF;AACA,YAAI,CAAC,WAAW;AACd,kBAAQ,EAAE,SAAS,CAAC,CAAC;AACrB,mBAAS,EAAE,SAAS,CAAC;AACrB,wBAAc,EAAE,cAAc,CAAC;AAC/B,2BAAiB,GAAG,kBAAkB,IAAI;AAC1C,0BAAgB,CAAC,CAAC,EAAE,YAAY;AAAA,QAClC;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,QAAQ,aAAa,cAAc,CAAC,CAAC;AAE/C,QAAM,iBAAiB,MAAM;AAAA,IAC3B,CAAC,SAAiB,EAAE,cAAc,IAAI,IAAI,IAAI;AAAA,IAC9C,CAAC,CAAC;AAAA,EACJ;AAEA,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,iCAAiC,yBAAyB,EAAE,QAAQ,YAAY,eAAe,IAAI,IAAI,CAAC;AAAA,MACjH,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM;AAAA,UACJ,sBAAsB,mBAAmB,IAAI,EAAE,CAAC;AAAA,UAChD,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,EAAE,gCAAgC,uBAAuB,CAAC;AAAA,MAChG;AACA,YAAM,EAAE,kCAAkC,cAAc,GAAG,SAAS;AACpE,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,gCAAgC,uBAAuB;AAClH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,gBAAgB,CAAC,CAAC;AAE/B,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM,gBAAgB,KAAK,KAAK,CAAC,QAAQ,IAAI,UAAU;AAAA,IACvD,CAAC,cAAc,IAAI;AAAA,EACrB;AACA,QAAM,UAAU,MAAM,QAA0B,MAAM;AACpD,UAAM,OAAyB;AAAA,MAC7B;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,gCAAgC,MAAM;AAAA,QAChD,MAAM,CAAC,EAAE,IAAI,MAAM,eAAe,IAAI,SAAS,IAAI;AAAA,MACrD;AAAA,MACA,EAAE,aAAa,cAAc,QAAQ,EAAE,iCAAiC,OAAO,EAAE;AAAA,IACnF;AACA,QAAI,kBAAkB;AACpB,WAAK,OAAO,GAAG,GAAG,EAAE,aAAa,cAAc,QAAQ,EAAE,kCAAkC,QAAQ,EAAE,CAAC;AAAA,IACxG;AACA,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,CAAC;AAExC,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,yBAAyB,OAAO;AAAA,QACzC,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,yBAAyB,YAAE,kCAAkC,QAAQ,GAAE,GACpF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,MAAM;AAAE,oBAAU,CAAC;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAClD,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,MAAM,kBAAkB,IAAI,EAAE,QAAQ;AAAA,UACrF,EAAE,IAAI,cAAc,OAAO,EAAE,qCAAqC,YAAY,GAAG,MAAM,yBAAyB,mBAAmB,IAAI,EAAE,CAAC,GAAG;AAAA,UAC7I,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QACrH,GAAG;AAAA,QAEL,UAAQ;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,QACjB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,yBAAyB,OAAO;AAAA,YAC9C,YAAW;AAAA,YACX,aAAa,EAAE,kCAAkC,QAAQ;AAAA;AAAA,QAC3D;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,eAAe,cAAc,QAAQ;AAAA,QAC1F;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'\nimport Link from 'next/link'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport type { SortingState } from '@tanstack/react-table'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\n\ntype Row = {\n  id: string\n  name: string\n  usersCount: number\n  tenantId?: string | null\n  tenantIds?: string[]\n  tenantName?: string | null\n  updatedAt?: string | null\n}\n\nexport default function RolesListPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const [sorting, setSorting] = React.useState<SortingState>([{ id: 'name', desc: false }])\n  const [page, setPage] = React.useState(1)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [rows, setRows] = React.useState<Row[]>([])\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n  const [isSuperAdmin, setIsSuperAdmin] = React.useState(false)\n  const scopeVersion = useOrganizationScopeVersion()\n  const t = useT()\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const params = new URLSearchParams()\n        params.set('page', String(page))\n        params.set('pageSize', '50')\n        if (search) params.set('search', search)\n        const fallback = { items: [], total: 0, totalPages: 1, isSuperAdmin: false }\n        const j = await readApiResultOrThrow<{\n          items?: Row[]\n          total?: number\n          totalPages?: number\n          isSuperAdmin?: boolean\n        }>(\n          `/api/auth/roles?${params.toString()}`,\n          undefined,\n          { errorMessage: t('auth.roles.list.error.load', 'Failed to load roles'), fallback },\n        )\n        if (!cancelled) {\n          setRows(j.items || [])\n          setTotal(j.total || 0)\n          setTotalPages(j.totalPages || 1)\n          setIsSuperAdmin(!!j.isSuperAdmin)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [page, search, reloadToken, scopeVersion, t])\n\n  const formatRoleName = React.useCallback(\n    (name: string) => t(`auth.roles.${name}`, name),\n    [t],\n  )\n\n  const handleDelete = React.useCallback(async (row: Row) => {\n    const confirmed = await confirm({\n      title: t('auth.roles.list.confirmDelete', 'Delete role \"{{name}}\"?').replace('{{name}}', formatRoleName(row.name)),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(row.updatedAt),\n        () => apiCall(\n          `/api/auth/roles?id=${encodeURIComponent(row.id)}`,\n          { method: 'DELETE' },\n        ),\n      )\n      if (!call.ok) {\n        await raiseCrudError(call.response, t('auth.roles.list.error.delete', 'Failed to delete role'))\n      }\n      flash(t('auth.roles.list.success.delete', 'Role deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : t('auth.roles.list.error.delete', 'Failed to delete role')\n      flash(message, 'error')\n    }\n  }, [confirm, formatRoleName, t])\n\n  const showTenantColumn = React.useMemo(\n    () => isSuperAdmin && rows.some((row) => row.tenantName),\n    [isSuperAdmin, rows],\n  )\n  const columns = React.useMemo<ColumnDef<Row>[]>(() => {\n    const base: ColumnDef<Row>[] = [\n      {\n        accessorKey: 'name',\n        header: t('auth.roles.list.columns.role', 'Role'),\n        cell: ({ row }) => formatRoleName(row.original.name),\n      },\n      { accessorKey: 'usersCount', header: t('auth.roles.list.columns.users', 'Users') },\n    ]\n    if (showTenantColumn) {\n      base.splice(1, 0, { accessorKey: 'tenantName', header: t('auth.roles.list.columns.tenant', 'Tenant') })\n    }\n    return base\n  }, [formatRoleName, showTenantColumn, t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable\n          title={t('auth.roles.list.title', 'Roles')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/roles/create\">{t('auth.roles.list.actions.create', 'Create')}</Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(v) => { setSearch(v); setPage(1) }}\n          rowActions={(row) => (\n            <RowActions items={[\n              { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/roles/${row.id}/edit` },\n              { id: 'show-users', label: t('auth.roles.list.actions.showUsers', 'Show users'), href: `/backend/users?roleId=${encodeURIComponent(row.id)}` },\n              { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },\n            ]} />\n          )}\n          sortable\n          sorting={sorting}\n          onSortingChange={setSorting}\n          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('auth.roles.list.title', 'Roles')}\n              createHref=\"/backend/roles/create\"\n              createLabel={t('auth.roles.list.actions.create', 'Create')}\n            />\n          )}\n          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA+HI,SAMU,KANV;AA9HJ,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,OAAO,UAAU;AACjB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAG1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB;AAYhB,SAAR,gBAAiC;AACtC,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAuB,CAAC,EAAE,IAAI,QAAQ,MAAM,MAAM,CAAC,CAAC;AACxF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAgB,CAAC,CAAC;AAChD,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AACtD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAC5D,QAAM,eAAe,4BAA4B;AACjD,QAAM,IAAI,KAAK;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,SAAS,IAAI,gBAAgB;AACnC,eAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,eAAO,IAAI,YAAY,IAAI;AAC3B,YAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,cAAM,WAAW,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,GAAG,cAAc,MAAM;AAC3E,cAAM,IAAI,MAAM;AAAA,UAMd,mBAAmB,OAAO,SAAS,CAAC;AAAA,UACpC;AAAA,UACA,EAAE,cAAc,EAAE,8BAA8B,sBAAsB,GAAG,SAAS;AAAA,QACpF;AACA,YAAI,CAAC,WAAW;AACd,kBAAQ,EAAE,SAAS,CAAC,CAAC;AACrB,mBAAS,EAAE,SAAS,CAAC;AACrB,wBAAc,EAAE,cAAc,CAAC;AAC/B,0BAAgB,CAAC,CAAC,EAAE,YAAY;AAAA,QAClC;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,MAAM,QAAQ,aAAa,cAAc,CAAC,CAAC;AAE/C,QAAM,iBAAiB,MAAM;AAAA,IAC3B,CAAC,SAAiB,EAAE,cAAc,IAAI,IAAI,IAAI;AAAA,IAC9C,CAAC,CAAC;AAAA,EACJ;AAEA,QAAM,eAAe,MAAM,YAAY,OAAO,QAAa;AACzD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,iCAAiC,yBAAyB,EAAE,QAAQ,YAAY,eAAe,IAAI,IAAI,CAAC;AAAA,MACjH,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,IAAI,SAAS;AAAA,QACvC,MAAM;AAAA,UACJ,sBAAsB,mBAAmB,IAAI,EAAE,CAAC;AAAA,UAChD,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,eAAe,KAAK,UAAU,EAAE,gCAAgC,uBAAuB,CAAC;AAAA,MAChG;AACA,YAAM,EAAE,kCAAkC,cAAc,GAAG,SAAS;AACpE,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,EAAE,gCAAgC,uBAAuB;AAClH,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,gBAAgB,CAAC,CAAC;AAE/B,QAAM,mBAAmB,MAAM;AAAA,IAC7B,MAAM,gBAAgB,KAAK,KAAK,CAAC,QAAQ,IAAI,UAAU;AAAA,IACvD,CAAC,cAAc,IAAI;AAAA,EACrB;AACA,QAAM,UAAU,MAAM,QAA0B,MAAM;AACpD,UAAM,OAAyB;AAAA,MAC7B;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,gCAAgC,MAAM;AAAA,QAChD,MAAM,CAAC,EAAE,IAAI,MAAM,eAAe,IAAI,SAAS,IAAI;AAAA,MACrD;AAAA,MACA,EAAE,aAAa,cAAc,QAAQ,EAAE,iCAAiC,OAAO,EAAE;AAAA,IACnF;AACA,QAAI,kBAAkB;AACpB,WAAK,OAAO,GAAG,GAAG,EAAE,aAAa,cAAc,QAAQ,EAAE,kCAAkC,QAAQ,EAAE,CAAC;AAAA,IACxG;AACA,WAAO;AAAA,EACT,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,CAAC;AAExC,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,yBAAyB,OAAO;AAAA,QACzC,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,yBAAyB,YAAE,kCAAkC,QAAQ,GAAE,GACpF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,MAAM;AAAE,oBAAU,CAAC;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAClD,YAAY,CAAC,QACX,oBAAC,cAAW,OAAO;AAAA,UACjB,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,MAAM,kBAAkB,IAAI,EAAE,QAAQ;AAAA,UACrF,EAAE,IAAI,cAAc,OAAO,EAAE,qCAAqC,YAAY,GAAG,MAAM,yBAAyB,mBAAmB,IAAI,EAAE,CAAC,GAAG;AAAA,UAC7I,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM;AAAE,iBAAK,aAAa,GAAG;AAAA,UAAE,EAAE;AAAA,QACrH,GAAG;AAAA,QAEL,UAAQ;AAAA,QACR;AAAA,QACA,iBAAiB;AAAA,QACjB,aAAa,EAAE,SAAS,gBAAgB,MAAM,WAAW,QAAQ;AAAA,QACjE,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,yBAAyB,OAAO;AAAA,YAC9C,YAAW;AAAA,YACX,aAAa,EAAE,kCAAkC,QAAQ;AAAA;AAAA,QAC3D;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,IAAI,OAAO,YAAY,cAAc,QAAQ;AAAA,QAC3E;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": []
 }

package/dist/modules/auth/backend/users/[id]/edit/page.meta.js

@@ -2,11 +2,7 @@ const metadata = {
   requireAuth: true,
   requireFeatures: ["auth.users.edit"],
   pageTitle: "Edit User",
-  pageTitleKey: "auth.users.form.title.edit",
-  breadcrumb: [
-    { label: "Users", labelKey: "auth.nav.users", href: "/backend/users" },
-    { label: "Edit", labelKey: "common.edit" }
-  ]
+  breadcrumb: [{ label: "Users", href: "/backend/users" }, { label: "Edit" }]
 };
 export {
   metadata

package/dist/modules/auth/backend/users/[id]/edit/page.meta.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/auth/backend/users/%5Bid%5D/edit/page.meta.ts"],
-  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['auth.users.edit'],\n  pageTitle: 'Edit User',\n  pageTitleKey: 'auth.users.form.title.edit',\n  breadcrumb: [\n    { label: 'Users', labelKey: 'auth.nav.users', href: '/backend/users' },\n    { label: 'Edit', labelKey: 'common.edit' },\n  ],\n}\n\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,iBAAiB;AAAA,EACnC,WAAW;AAAA,EACX,cAAc;AAAA,EACd,YAAY;AAAA,IACV,EAAE,OAAO,SAAS,UAAU,kBAAkB,MAAM,iBAAiB;AAAA,IACrE,EAAE,OAAO,QAAQ,UAAU,cAAc;AAAA,EAC3C;AACF;",
+  "sourcesContent": ["export const metadata = {\n  requireAuth: true,\n  requireFeatures: ['auth.users.edit'],\n  pageTitle: 'Edit User',\n  breadcrumb: [ { label: 'Users', href: '/backend/users' }, { label: 'Edit' } ],\n}\n\n\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,iBAAiB;AAAA,EACnC,WAAW;AAAA,EACX,YAAY,CAAE,EAAE,OAAO,SAAS,MAAM,iBAAiB,GAAG,EAAE,OAAO,OAAO,CAAE;AAC9E;",
   "names": []
 }

package/dist/modules/auth/backend/users/page.js

@@ -323,7 +323,6 @@ function UsersListPage() {
   const rows = usersData?.items || [];
   const total = usersData?.total || 0;
   const totalPages = usersData?.totalPages || 1;
-  const totalIsCapped = usersData?.totalIsCapped === true;
   const isSuperAdmin = !!usersData?.isSuperAdmin;
   const rowsWithOrgNames = React.useMemo(() => rows.map((row) => ({
     ...row,
@@ -407,7 +406,7 @@ function UsersListPage() {
             void handleDelete(row);
           } }
         ] }),
-        pagination: { page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage },
+        pagination: { page, pageSize: 50, total, totalPages, onPageChange: setPage },
         isLoading
       }
     ) }),