@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/auth/api/users/acl/route.ts

@@ -1,13 +1,14 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
-import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import { User, UserAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { UserAcl } from '@open-mercato/core/modules/auth/data/entities'
 import {
   assertActorCanAccessUserTarget,
   assertActorCanGrantAcl,
@@ -15,25 +16,15 @@ import {
   normalizeGrantFeatureList,
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import {
-  AUTH_USER_ACL_UPDATE_COMMAND_ID,
-  type AclUpdateResult,
-  type UserAclUpdateInput,
-} from '@open-mercato/core/modules/auth/commands/acl'
 
-const getSchema = z.object({
-  userId: z.string().uuid(),
-  tenantId: z.string().uuid().optional(),
-})
+const getSchema = z.object({ userId: z.string().uuid() })
 const putSchema = z.object({
   userId: z.string().uuid(),
   isSuperAdmin: z.boolean().optional(),
   features: z.array(z.string()).optional(),
   organizations: z.array(z.string()).nullable().optional(),
-  tenantId: z.string().uuid().optional(),
 })
 
 export const metadata = {
@@ -56,95 +47,25 @@ const userAclUpdateResponseSchema = z.object({
 
 const userAclErrorSchema = z.object({ error: z.string() })
 
-type TenantResolution = { tenantId: string | null } | { error: NextResponse }
-
-/**
- * The single tenant scope both handlers work in. GET and PUT MUST resolve it the
- * same way: the admin user form PUTs the ACL panel's state on every save, so a
- * GET that reads a narrower scope than the PUT writes hands the operator an
- * empty form and turns the next name-only edit into a silent revocation, with no
- * `updatedAt` to arm the optimistic lock against it.
- *
- * `user_acls.tenant_id` is NOT NULL while `users.tenant_id` is nullable, so a
- * global account legitimately signs in with `auth.tenantId === null` and the
- * scope has to come from the target user instead. That fallback is reserved for
- * a super admin: for anyone else it would let the target pick the scope its own
- * access is then checked against, and it decrypts a possibly foreign user ahead
- * of every guard. A tenant-less non-super-admin therefore resolves to `null`,
- * which reads as "no override" and refuses to write — the behaviour that held
- * before this route resolved a scope at all. The read is also skipped whenever a
- * tenant is already known.
- *
- * An explicit `tenantId` wins, mirroring the role ACL route (additive there and
- * here; no caller sends it yet) — but only for a super admin or for the actor's
- * own tenant, so it cannot widen anyone's reach. The result is that for a
- * non-super-admin the resolved scope is always the actor's own.
- */
-async function resolveAclTenantId(args: {
-  em: EntityManager
-  auth: NonNullable<AuthContext>
-  actorIsSuperAdmin: boolean
-  userId: string
-  requestedTenantId?: string
-}): Promise<TenantResolution> {
-  const authTenantId = args.auth.tenantId ?? null
-  if (args.requestedTenantId && args.requestedTenantId !== authTenantId && !args.actorIsSuperAdmin) {
-    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) }
-  }
-  const known = args.requestedTenantId ?? authTenantId
-  if (known) return { tenantId: known }
-  if (!args.actorIsSuperAdmin) return { tenantId: null }
-  const targetUser = await findOneWithDecryption(
-    args.em,
-    User,
-    { id: args.userId } as FilterQuery<User>,
-    {},
-    { tenantId: null, organizationId: args.auth.orgId ?? null },
-  )
-  return { tenantId: targetUser?.tenantId ? String(targetUser.tenantId) : null }
-}
-
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   const url = new URL(req.url)
-  const parsed = getSchema.safeParse({
-    userId: url.searchParams.get('userId'),
-    tenantId: url.searchParams.get('tenantId') || undefined,
-  })
+  const parsed = getSchema.safeParse({ userId: url.searchParams.get('userId') })
   if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })
   const container = await createRequestContainer()
   const em = container.resolve('em') as any
   const rbacService = container.resolve('rbacService') as any
-  // Every grant check is answered in the actor's own scope, never in the scope
-  // resolved for the record: passing the resolved one would ask a foreign tenant
-  // whether this caller may act there, and for a tenant-less actor — whose scope
-  // comes from the target — it would compare the target against itself.
-  const actorTenantId = auth.tenantId ?? null
   const actorAcl = auth.sub
-    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
     : null
-  const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
-
-  const resolution = await resolveAclTenantId({
-    em: em as EntityManager,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId,
-  })
-  if ('error' in resolution) return resolution.error
-  // An unresolvable scope reads as "no override", which is what PUT then refuses
-  // to write (`Tenant required`) — so the pair still cannot destroy a row.
-  const tenantId = resolution.tenantId
-
-  if (!actorIsSuperAdmin && auth.sub) {
+  if (!actorAcl?.isSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -153,7 +74,7 @@ export async function GET(req: Request) {
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -161,7 +82,7 @@ export async function GET(req: Request) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId,
+          tenantId: auth.tenantId ?? null,
         }),
       })
     } catch (err) {
@@ -169,9 +90,7 @@ export async function GET(req: Request) {
       throw err
     }
   }
-  const acl = tenantId
-    ? await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
-    : null
+  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   const response = acl
     ? {
         hasCustomAcl: true,
@@ -190,8 +109,8 @@ export async function GET(req: Request) {
     idField: 'id',
     resourceKind: 'auth.user_acl',
     organizationId: auth.orgId ?? null,
-    tenantId,
-    query: { userId: parsed.data.userId, tenantId },
+    tenantId: auth.tenantId ?? null,
+    query: { userId: parsed.data.userId },
     accessType: 'read:item',
   })
 
@@ -208,40 +127,18 @@ export async function PUT(req: Request) {
   const em = container.resolve('em') as any
   const rbacService = container.resolve('rbacService') as any
 
-  // Every grant check is answered in the actor's own scope, never in the scope
-  // resolved for the record: passing the resolved one would ask a foreign tenant
-  // whether this caller may act there, and for a tenant-less actor — whose scope
-  // comes from the target — it would compare the target against itself.
-  const actorTenantId = auth.tenantId ?? null
   const actorAcl = auth.sub
-    ? await rbacService.loadAcl(auth.sub, { tenantId: actorTenantId, organizationId: auth.orgId ?? null })
+    ? await rbacService.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
     : null
   const actorIsSuperAdmin = !!actorAcl?.isSuperAdmin
 
-  // The scope the row is read and written in. `auth.tenantId` is `string | null`
-  // — never `undefined`, since every producer normalizes with `?? null` — so the
-  // pre-fix lookup ran `tenant_id IS NULL` against a NOT NULL column: it matched
-  // no row, leaving create/update to fail the NOT NULL constraint and clear to
-  // no-op silently. Nothing cross-tenant was ever matched; the fix turns a 500
-  // into a working, correctly scoped write.
-  const resolution = await resolveAclTenantId({
-    em: em as EntityManager,
-    auth,
-    actorIsSuperAdmin,
-    userId: parsed.data.userId,
-    requestedTenantId: parsed.data.tenantId,
-  })
-  if ('error' in resolution) return resolution.error
-  const tenantId = resolution.tenantId
-  if (!tenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })
-
   if (!actorIsSuperAdmin && auth.sub) {
     try {
       await assertActorCanModifySuperAdminUserTarget({
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -250,7 +147,7 @@ export async function PUT(req: Request) {
         em: em as EntityManager,
         rbacService: rbacService as RbacService,
         actorUserId: auth.sub,
-        tenantId: actorTenantId,
+        tenantId: auth.tenantId ?? null,
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
@@ -258,7 +155,7 @@ export async function PUT(req: Request) {
           container,
           auth,
           request: req,
-          tenantId: actorTenantId,
+          tenantId: auth.tenantId ?? null,
         }),
       })
     } catch (err) {
@@ -267,10 +164,7 @@ export async function PUT(req: Request) {
     }
   }
 
-  const requestedFeatures = normalizeGrantFeatureList(parsed.data.features)
-  const organizations = normalizeOrganizations(parsed.data.organizations)
-
-  const acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId })
+  let acl = await em.findOne(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
   // Optimistic lock: refuse a stale per-user ACL overwrite so concurrent edits
   // cannot silently clobber each other (#2055). Strictly additive — a no-op when
   // the client sends no expected-version header; skipped when no ACL row exists.
@@ -289,26 +183,42 @@ export async function PUT(req: Request) {
   }
   const existingIsSuperAdmin = acl ? !!acl.isSuperAdmin : false
   const existingFeatures = acl ? normalizeGrantFeatureList(acl.featuresJson) : []
-
-  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? false
+  const existingOrganizations = acl ? normalizeOrganizations(acl.organizationsJson) : null
+
+  // A per-user ACL is an absolute override, so an omitted dimension must keep
+  // its stored value. Normalizing an omitted `features` to `[]` or an omitted
+  // `organizations` to `null` turned a single-dimension edit into a silent
+  // clear, deleting the row and widening the user back to their full role.
+  const featuresWereProvided = parsed.data.features !== undefined
+  const requestedFeatures = featuresWereProvided
+    ? normalizeGrantFeatureList(parsed.data.features)
+    : existingFeatures
+  const requestedOrganizations = parsed.data.organizations === undefined
+    ? existingOrganizations
+    : normalizeOrganizations(parsed.data.organizations)
+
+  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin
 
   try {
     await assertActorCanGrantAcl({
       em: em as EntityManager,
       rbacService: rbacService as RbacService,
       actorUserId: auth.sub,
-      tenantId: actorTenantId,
+      tenantId: auth.tenantId ?? null,
       organizationId: auth.orgId ?? null,
       isSuperAdmin: requestedIsSuperAdmin,
       features: requestedFeatures,
-      organizations,
+      organizations: requestedOrganizations,
     })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
     throw err
   }
 
-  const effectiveFeatures = actorIsSuperAdmin
+  // An omitted feature list is already stored and in effect. Re-sanitizing it
+  // during an unrelated organization edit would silently revoke grants the
+  // actor did not touch, so only an explicitly submitted list is sanitized.
+  const effectiveFeatures = actorIsSuperAdmin || !featuresWereProvided
     ? requestedFeatures
     : sanitizeTenantFeatures(requestedFeatures)
 
@@ -325,59 +235,56 @@ export async function PUT(req: Request) {
     }
   }
 
-  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
+  // Retaining an organization-only override with no features would revoke every
+  // role-granted feature instead of narrowing the role. Refuse that state rather
+  // than persisting it or silently dropping the organization scope.
+  if (!effectiveIsSuperAdmin && effectiveFeatures.length === 0 && hasOrganizationRestriction(requestedOrganizations)) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({
+      error: translate(
+        'auth.acl.organizationWarning',
+        'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.',
+      ),
+    }, { status: 400 })
+  }
 
-  // What the caller asked for, handed to the command only when it exceeds what
-  // is about to be written. `assertActorCanGrantAcl` above refuses the blatant
-  // escalations; what reaches the strip is quieter — a restricted grant the
-  // actor does hold — and it leaves before/after identical, so the audit entry
-  // would otherwise be indistinguishable from a no-op and skipped as one.
-  //
-  // Features are the only axis that can be trimmed. A super-admin request is
-  // either honoured or refused outright above, never silently downgraded, so
-  // comparing the two flags here would be dead weight.
-  //
-  // Deliberately independent of the `sanitized` response flag below:
-  // `hasRestrictedChanges` stays false when the trimmed result equals the
-  // existing ACL, to avoid nagging the user about a save that changed nothing —
-  // but that is precisely an attempt the trail must keep.
-  const strippedFeatures = requestedFeatures.filter((feature) => !effectiveFeatures.includes(feature))
+  // An unrestricted organization list carries no override on its own, and the guard
+  // above already refused the restricted-but-featureless case, so the override is
+  // custom exactly when it grants super admin or at least one feature.
+  const hasCustomAcl = effectiveIsSuperAdmin || effectiveFeatures.length > 0
 
-  // Route the write through the command bus so the permission change lands in
-  // the action log. The command owns the transactional write (or removal) and
-  // the RBAC cache invalidation that used to live here.
-  const commandBus = container.resolve('commandBus') as CommandBus
-  // A tenant-less actor edits an override in the target user's tenant, so their
-  // organization belongs to a tenant the entry is not about. The bus resolves
-  // the log row's organization as `metadata.organizationId ??
-  // ctx.selectedOrganizationId ?? ctx.auth.orgId` — a `??` chain, so the
-  // handler's `resolveOrganizationId` cannot express "explicitly no
-  // organization" and the actor's would be restored. Strip it from the context
-  // instead, exactly as the roles route does: otherwise the entry carries a
-  // (target tenant, foreign organization) pair that `ActionLogService` — which
-  // filters organization with strict equality — can never surface for anyone.
-  const isForeignTenant = tenantId !== (auth.tenantId ?? null)
-  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null
-  const commandCtx: CommandRuntimeContext = {
-    container,
-    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
-    organizationScope: null,
-    selectedOrganizationId: actorOrgId,
-    organizationIds: actorOrgId ? [actorOrgId] : null,
-    request: req,
+  // Persist the ACL mutation inside a transaction so the per-user permission
+  // write (or removal) commits atomically (proper ACL-edit transaction handling).
+  if (!hasCustomAcl) {
+    if (acl) {
+      const aclToRemove = acl
+      await withAtomicFlush(em, [() => em.remove(aclToRemove)], { transaction: true })
+    }
+  } else {
+    if (!acl) {
+      acl = em.create(UserAcl, { user: parsed.data.userId as any, tenantId: auth.tenantId as any })
+    }
+    const aclRecord = acl as any
+    await withAtomicFlush(
+      em,
+      [
+        () => {
+          aclRecord.isSuperAdmin = effectiveIsSuperAdmin
+          aclRecord.featuresJson = effectiveFeatures
+          aclRecord.organizationsJson = requestedOrganizations
+          em.persist(aclRecord)
+        },
+      ],
+      { transaction: true },
+    )
   }
-  await commandBus.execute<UserAclUpdateInput, AclUpdateResult>(AUTH_USER_ACL_UPDATE_COMMAND_ID, {
-    input: {
-      userId: parsed.data.userId,
-      tenantId,
-      isSuperAdmin: effectiveIsSuperAdmin,
-      features: effectiveFeatures,
-      organizations,
-      clear: !hasCustomAcl,
-      requested: strippedFeatures.length ? { features: requestedFeatures } : null,
-    },
-    ctx: commandCtx,
-  })
+
+  // Invalidate cache for this user
+  await rbacService.invalidateUserCache(parsed.data.userId)
+  try {
+    const cache = container.resolve('cache') as any
+    if (cache) await cache.deleteByTags([`rbac:user:${parsed.data.userId}`])
+  } catch {}
 
   return NextResponse.json({
     ok: true,
@@ -390,6 +297,16 @@ function normalizeOrganizations(organizations: unknown): string[] | null {
   return normalizeGrantFeatureList(organizations)
 }
 
+// Whether the caller expressed an intentional narrowing. `null` and `__all__`
+// are the two documented ways to say "every organization"; an empty list is the
+// editor's "no organization picked" state ("Empty = all organizations"), which
+// is not a restriction an administrator chose. Only a concrete list narrows, so
+// only a concrete list has to justify itself against the feature grant below.
+function hasOrganizationRestriction(organizations: string[] | null): boolean {
+  if (!organizations || organizations.length === 0) return false
+  return !organizations.includes('__all__')
+}
+
 function sanitizeTenantFeatures(features: string[]): string[] {
   return features.filter((feature) => !isTenantRestrictedFeature(feature))
 }
@@ -424,25 +341,24 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Fetch user ACL',
-      description: 'Returns custom ACL overrides for a user, scoped to the requested tenant when supplied and to the actor or target user tenant otherwise.',
+      description: 'Returns custom ACL overrides for a user within the current tenant, if any.',
       query: getSchema,
       responses: [
         { status: 200, description: 'User ACL entry', schema: userAclResponseSchema },
         { status: 400, description: 'Invalid user id', schema: userAclErrorSchema },
         { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },
-        { status: 403, description: 'Insufficient privileges for the requested tenant scope', schema: userAclErrorSchema },
       ],
     },
     PUT: {
       summary: 'Update user ACL',
-      description: 'Configures per-user ACL overrides, including super admin access, feature list, and organization scope.',
+      description: 'Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant.',
       requestBody: {
         contentType: 'application/json',
         schema: putSchema,
       },
       responses: [
         { status: 200, description: 'User ACL updated', schema: userAclUpdateResponseSchema },
-        { status: 400, description: 'Invalid payload or unresolved tenant scope', schema: userAclErrorSchema },
+        { status: 400, description: 'Invalid payload', schema: userAclErrorSchema },
         { status: 401, description: 'Unauthorized', schema: userAclErrorSchema },
         { status: 403, description: 'Insufficient privileges to modify ACL', schema: userAclErrorSchema },
       ],

package/src/modules/auth/api/users/route.ts

@@ -26,7 +26,6 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
-import { MAX_USER_LOOKUP_IDS, resolveUserIdFilter } from '@open-mercato/core/modules/auth/lib/userIdFilter'
 import { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
 import {
@@ -39,7 +38,6 @@ const logger = createLogger('auth').child({ component: 'users' })
 
 const querySchema = z.object({
   id: z.string().uuid().optional(),
-  ids: z.string().optional().describe('Comma-separated user identifiers, at most 100'),
   page: z.coerce.number().min(1).default(1),
   pageSize: z.coerce.number().min(1).max(100).default(50),
   search: z.string().optional(),
@@ -206,17 +204,10 @@ export async function GET(req: Request) {
   if (!auth) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
   const url = new URL(req.url)
   const rawRoleIds = url.searchParams.getAll('roleId').filter((id): id is string => typeof id === 'string' && id.trim().length > 0)
-  // Accept both the repeated (`?ids=a&ids=b`) and comma-joined (`?ids=a,b`) spellings.
-  const rawIds = url.searchParams.getAll('ids').join(',') || undefined
-  const userIdFilter = resolveUserIdFilter(rawIds, url.searchParams.get('id'))
   const parsed = querySchema.safeParse({
     id: url.searchParams.get('id') || undefined,
-    ids: rawIds,
     page: url.searchParams.get('page') || undefined,
-    // A caller resolving a batch of ids wants all of them; without this the default page of 50
-    // would silently truncate a 100-id lookup.
-    pageSize: url.searchParams.get('pageSize')
-      || (rawIds && userIdFilter.kind === 'ids' ? String(Math.min(userIdFilter.ids.length, MAX_USER_LOOKUP_IDS)) : undefined),
+    pageSize: url.searchParams.get('pageSize') || undefined,
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
@@ -237,9 +228,6 @@ export async function GET(req: Request) {
     logger.error('Failed to resolve rbac', { err })
   }
   const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
-  if (userIdFilter.kind === 'none') {
-    return NextResponse.json({ items: [], total: 0, totalPages: 1, isSuperAdmin })
-  }
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -305,8 +293,7 @@ export async function GET(req: Request) {
     }
     filters.push(displayNameFilters.length > 1 ? { $or: displayNameFilters } : displayNameFilters[0])
   }
-  // `?id=` and `?ids=` are already intersected by resolveUserIdFilter.
-  let idFilter: Set<string> | null = userIdFilter.kind === 'ids' ? new Set(userIdFilter.ids) : null
+  let idFilter: Set<string> | null = id ? new Set([id]) : null
   if (Array.isArray(roleIds) && roleIds.length > 0) {
     const uniqueRoleIds = Array.from(new Set(roleIds))
     const linksForRoles = await em.find(
@@ -400,10 +387,10 @@ export async function GET(req: Request) {
 
     filters.push(searchFilters.length > 1 ? { $or: searchFilters } : searchFilters[0])
   }
-  // `?id=` has no separate path: resolveUserIdFilter folds it into `idFilter`, and a `kind: 'none'`
-  // outcome already returned above, so `idFilter` is null only when neither param was supplied.
   if (idFilter && idFilter.size) {
     filters.push({ id: { $in: Array.from(idFilter) as any } })
+  } else if (id) {
+    filters.push({ id })
   }
   const where = filters.length > 1 ? { $and: filters } : filters[0]
   const [rows, count] = await em.findAndCount(User, where, { limit: pageSize, offset: (page - 1) * pageSize })
@@ -726,7 +713,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record). Pass ids=<uuid>,<uuid> (max 100) to resolve a known set of users in one request, for example to label a list of foreign keys; it intersects with id and roleId, and a supplied ids value that contains no valid identifier matches nothing.',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/backend/roles/[id]/edit/page.meta.ts

@@ -2,10 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['auth.roles.manage'],
   pageTitle: 'Edit Role',
-  pageTitleKey: 'auth.roles.form.title.edit',
-  breadcrumb: [
-    { label: 'Roles', labelKey: 'auth.nav.roles', href: '/backend/roles' },
-    { label: 'Edit', labelKey: 'common.edit' },
-  ],
+  breadcrumb: [ { label: 'Roles', href: '/backend/roles' }, { label: 'Edit' } ],
 }
 
+

package/src/modules/auth/backend/roles/page.tsx

@@ -33,7 +33,6 @@ export default function RolesListPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [rows, setRows] = React.useState<Row[]>([])
   const [isLoading, setIsLoading] = React.useState(true)
@@ -56,7 +55,7 @@ export default function RolesListPage() {
           items?: Row[]
           total?: number
           totalPages?: number
-          isSuperAdmin?: boolean; totalIsCapped?: boolean
+          isSuperAdmin?: boolean
         }>(
           `/api/auth/roles?${params.toString()}`,
           undefined,
@@ -66,7 +65,6 @@ export default function RolesListPage() {
           setRows(j.items || [])
           setTotal(j.total || 0)
           setTotalPages(j.totalPages || 1)
-          setTotalIsCapped(j?.totalIsCapped === true)
           setIsSuperAdmin(!!j.isSuperAdmin)
         }
       } finally {
@@ -158,7 +156,7 @@ export default function RolesListPage() {
               createLabel={t('auth.roles.list.actions.create', 'Create')}
             />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>

package/src/modules/auth/backend/users/[id]/edit/page.meta.ts

@@ -2,10 +2,7 @@ export const metadata = {
   requireAuth: true,
   requireFeatures: ['auth.users.edit'],
   pageTitle: 'Edit User',
-  pageTitleKey: 'auth.users.form.title.edit',
-  breadcrumb: [
-    { label: 'Users', labelKey: 'auth.nav.users', href: '/backend/users' },
-    { label: 'Edit', labelKey: 'common.edit' },
-  ],
+  breadcrumb: [ { label: 'Users', href: '/backend/users' }, { label: 'Edit' } ],
 }
 
+

package/src/modules/auth/backend/users/page.tsx

@@ -351,7 +351,7 @@ export default function UsersListPage() {
   const { data: usersData, isLoading } = useQuery({
     queryKey: ['users', params, scopeVersion],
     queryFn: async () => {
-      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; totalIsCapped?: boolean; isSuperAdmin?: boolean }>(
+      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; isSuperAdmin?: boolean }>(
         `/api/auth/users?${params}`,
       )
       if (!call.ok) {
@@ -364,7 +364,6 @@ export default function UsersListPage() {
   const rows = usersData?.items || []
   const total = usersData?.total || 0
   const totalPages = usersData?.totalPages || 1
-  const totalIsCapped = usersData?.totalIsCapped === true
   const isSuperAdmin = !!usersData?.isSuperAdmin
   const rowsWithOrgNames: Row[] = React.useMemo(() => rows.map(row => ({
     ...row,
@@ -457,7 +456,7 @@ export default function UsersListPage() {
               { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
             ]} />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>