@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/attachments/lib/attachment-service.ts

@@ -0,0 +1,468 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { Attachment, AttachmentPartition } from '../data/entities'
+import { assertAttachmentScopeInvariant, checkAttachmentAccess } from './access'
+import type { StorageDriverFactory } from './drivers'
+import { buildAttachmentFileUrl } from './imageUrls'
+import {
+  isScopedAttachmentUploadError,
+  type ScopedAttachmentUploadErrorCode,
+  type ScopedAttachmentUploadService,
+} from './scoped-upload-service'
+import { readAttachmentMetadata, type AttachmentAssignment } from './metadata'
+import {
+  buildAttachmentContentDisposition,
+  canRenderInlineAttachment,
+  hasDangerousExecutableExtension,
+} from './security'
+import {
+  isMultipartRequestWithinUploadLimit,
+  resolveAttachmentMaxBytes,
+  resolveAttachmentMultipartMaxBytes,
+} from './upload-limits'
+
+const logger = createLogger('attachments').child({ component: 'attachment-service' })
+
+type AttachmentErrorMessage = {
+  key: string
+  fallback: string
+}
+
+/**
+ * The scoped upload service reports failures as machine codes. Each maps to the
+ * translation key the public attachment route uses for the same condition, and
+ * the key is resolved server-side before it reaches the response body — clients
+ * render the `error` field verbatim, so handing them a raw key would surface
+ * `attachments.errors.quotaExceeded` as the user-facing message.
+ */
+const SCOPED_UPLOAD_ERROR_MESSAGES: Record<ScopedAttachmentUploadErrorCode, AttachmentErrorMessage> = {
+  dangerous_executable: {
+    key: 'attachments.errors.dangerousExecutable',
+    fallback: 'Executable file types are not allowed as attachments.',
+  },
+  max_upload_size: {
+    key: 'attachments.errors.maxUploadSize',
+    fallback: 'Attachment exceeds the maximum upload size.',
+  },
+  active_content: {
+    key: 'attachments.errors.activeContentBlocked',
+    fallback: 'Active content uploads are not allowed.',
+  },
+  partition_unavailable: {
+    key: 'attachments.errors.partitionUnavailable',
+    fallback: 'Attachment partition is not available for this scope.',
+  },
+  quota_exceeded: {
+    key: 'attachments.errors.quotaExceeded',
+    fallback: 'Attachment storage quota exceeded for this tenant.',
+  },
+  quota_target_exists: {
+    key: 'attachments.errors.storagePathExists',
+    fallback: 'The target storage path already exists.',
+  },
+  quota_unavailable: {
+    key: 'attachments.errors.quotaUnavailable',
+    fallback: 'Storage quota accounting is unavailable.',
+  },
+  quota_recovery_unsupported: {
+    key: 'attachments.errors.quotaRecoveryUnsupported',
+    fallback: 'Storage driver cannot participate in quota recovery.',
+  },
+  storage_failed: {
+    key: 'attachments.errors.storageFailed',
+    fallback: 'Failed to store the attachment file.',
+  },
+  persistence_failed: {
+    key: 'attachments.errors.persistenceFailed',
+    fallback: 'Failed to persist attachment.',
+  },
+}
+
+const UPLOAD_FAILED_MESSAGE: AttachmentErrorMessage = {
+  key: 'attachments.errors.uploadFailed',
+  fallback: 'Attachment upload failed.',
+}
+
+const UPLOAD_SERVICE_UNAVAILABLE_MESSAGE: AttachmentErrorMessage = {
+  key: 'attachments.errors.uploadServiceUnavailable',
+  fallback: 'The attachment upload service is not available.',
+}
+
+async function translateAttachmentError(message: AttachmentErrorMessage): Promise<string> {
+  const { t } = await resolveTranslations()
+  return t(message.key, message.fallback)
+}
+
+export type AttachmentOwner = {
+  entityId: string
+  recordId: string
+}
+
+export type CreateScopedAttachmentInput = AttachmentOwner & {
+  tenantId: string
+  organizationId: string
+  partitionCode: string
+  fileName: string
+  declaredMimeType?: string | null
+  buffer: Buffer
+  assignments?: AttachmentAssignment[]
+  /**
+   * Persists a module-owned link inside the same transaction as the Attachment
+   * row. The callback receives only the generated id, never an Attachment
+   * entity or storage implementation.
+   */
+  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void
+}
+
+export type CreatedScopedAttachment = {
+  id: string
+  url: string
+  fileName: string
+  mimeType: string
+  fileSize: number
+}
+
+export type ReadScopedAttachmentInput = {
+  attachmentId: string
+  auth: NonNullable<AuthContext>
+  expectedOwner: AttachmentOwner
+  expectedAssignment?: AttachmentAssignment
+  expectedPartitionCode?: string
+  requirePrivatePartition?: boolean
+  forceDownload?: boolean
+}
+
+export type ReadScopedAttachmentResult = {
+  buffer: Buffer
+  contentType: string
+  contentDisposition: string
+  fileName: string
+  mimeType: string
+}
+
+export type ReleaseScopedAttachmentInput = {
+  attachmentId: string
+  tenantId: string
+  organizationId: string
+  expectedOwner: AttachmentOwner
+  /**
+   * Required: releasing an attachment deletes the row *and* the provider bytes,
+   * so the caller must name the one assignment it owns. The release only
+   * proceeds when that assignment is the attachment's sole reference.
+   */
+  expectedAssignment: AttachmentAssignment
+  expectedPartitionCode?: string
+}
+
+export type AttachmentProviderCleanup = () => Promise<void>
+
+export interface AttachmentService {
+  validateUpload(input: {
+    contentLength?: string | null
+    fileName?: string
+    fileSize?: number
+  }): void
+  readUploadForm?(request: Request): Promise<FormData>
+  createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment>
+  readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult>
+  releaseScoped?(
+    input: ReleaseScopedAttachmentInput,
+    options?: { em?: EntityManager; flush?: boolean },
+  ): Promise<AttachmentProviderCleanup | void>
+}
+
+async function readRequestBodyWithinLimit(request: Request, maxBytes: number): Promise<Uint8Array> {
+  const reader = request.body?.getReader()
+  if (!reader) throw new CrudHttpError(400, { error: 'File is required' })
+  const chunks: Uint8Array[] = []
+  let totalBytes = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      totalBytes += value.byteLength
+      if (totalBytes > maxBytes) {
+        await reader.cancel()
+        throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
+      }
+      chunks.push(value)
+    }
+  } finally {
+    reader.releaseLock()
+  }
+  const body = new Uint8Array(totalBytes)
+  let offset = 0
+  for (const chunk of chunks) {
+    body.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return body
+}
+
+
+function assignmentMatches(candidate: AttachmentAssignment, expected: AttachmentAssignment): boolean {
+  return candidate.type === expected.type && candidate.id === expected.id
+}
+
+function partitionMatchesScope(
+  partition: AttachmentPartition,
+  tenantId: string | null | undefined,
+  organizationId: string | null | undefined,
+): boolean {
+  const partitionTenantId = partition.tenantId ?? null
+  const partitionOrganizationId = partition.organizationId ?? null
+  if (partitionTenantId === null && partitionOrganizationId === null) return true
+  if (partitionTenantId === null || partitionOrganizationId === null) return false
+  return partitionTenantId === tenantId && partitionOrganizationId === organizationId
+}
+
+export class DefaultAttachmentService implements AttachmentService {
+  /**
+   * The scoped upload service is supplied as a *resolver*, not an instance:
+   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)
+   * into every container that merely constructs an `attachmentService`, even
+   * one that never uploads. `createScoped` requires it — module uploads must
+   * share the one reservation ledger rather than run a parallel quota
+   * mechanism — so its absence surfaces there, at the call that needs it.
+   */
+  constructor(
+    private readonly em: EntityManager,
+    private readonly storageDriverFactory: StorageDriverFactory,
+    private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,
+  ) {}
+
+  validateUpload(input: {
+    contentLength?: string | null
+    fileName?: string
+    fileSize?: number
+  }): void {
+    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {
+      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
+    }
+    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {
+      throw new CrudHttpError(400, { error: 'Executable file types are not allowed as attachments.' })
+    }
+    if (typeof input.fileSize === 'number' && input.fileSize > resolveAttachmentMaxBytes(null)) {
+      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
+    }
+  }
+
+  async readUploadForm(request: Request): Promise<FormData> {
+    this.validateUpload({ contentLength: request.headers.get('content-length') })
+    const contentType = request.headers.get('content-type') ?? ''
+    if (!contentType.toLowerCase().includes('multipart/form-data')) {
+      throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })
+    }
+    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes())
+    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer
+    try {
+      return await new Response(responseBody, { headers: { 'content-type': contentType } }).formData()
+    } catch {
+      throw new CrudHttpError(400, { error: 'Invalid multipart/form-data' })
+    }
+  }
+
+  async createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment> {
+    assertAttachmentScopeInvariant(input)
+    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length })
+
+    // Delegate to the platform's scoped upload service rather than repeating its
+    // work. It owns the fenced quota lease (reserve → storing → stored →
+    // complete) that the recovery worker reconciles, writes to the provider
+    // outside the database transaction, and emits the attachment CRUD side
+    // effects. The previous implementation here ran a *second*, independent
+    // quota mechanism on a different advisory-lock key that counted only
+    // committed rows, so it could not see an in-flight reservation from the
+    // public attachment route and the two paths could jointly exceed a tenant's
+    // quota — and it wrote to storage inside the transaction, so a crash before
+    // commit left bytes nothing accounted for.
+    let uploadService: ScopedAttachmentUploadService | null = null
+    try {
+      uploadService = this.resolveScopedUploadService?.() ?? null
+    } catch (error) {
+      logger.error('Scoped attachment upload service could not be resolved', { err: error })
+    }
+    if (!uploadService) {
+      throw new CrudHttpError(500, {
+        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE),
+      })
+    }
+
+    let attachment: Attachment
+    try {
+      attachment = await uploadService.upload({
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+        entityId: input.entityId,
+        recordId: input.recordId,
+        fileName: input.fileName,
+        buffer: input.buffer,
+        declaredMimeType: input.declaredMimeType ?? null,
+        assignments: input.assignments,
+        partitionCode: input.partitionCode,
+        requirePrivatePartition: true,
+        persistLink: input.persistLink,
+      })
+    } catch (error) {
+      if (isScopedAttachmentUploadError(error)) {
+        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE
+        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) })
+      }
+      throw error
+    }
+
+    return {
+      id: attachment.id,
+      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),
+      fileName: attachment.fileName,
+      mimeType: attachment.mimeType,
+      fileSize: attachment.fileSize,
+    }
+  }
+
+  async readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult> {
+    // Scope the lookup at the database boundary so a foreign-tenant row is
+    // never materialized, then keep checkAttachmentAccess below as defense in
+    // depth. This service only ever stores fully scoped rows, so global rows
+    // and super-admin status deliberately do not widen the requested scope —
+    // a super admin reads another tenant's attachment by switching scope, not
+    // by bypassing the filter.
+    const attachment = await findOneWithDecryption(
+      this.em,
+      Attachment,
+      {
+        id: input.attachmentId,
+        tenantId: input.auth.tenantId ?? null,
+        organizationId: input.auth.orgId ?? null,
+      },
+      undefined,
+      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },
+    )
+    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })
+    const partition = await findOneWithDecryption(
+      this.em,
+      AttachmentPartition,
+      { code: attachment.partitionCode },
+      undefined,
+      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },
+    )
+    if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })
+
+    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true })
+    if (!access.ok) {
+      throw new CrudHttpError(access.status, { error: access.status === 401 ? 'Unauthorized' : 'Forbidden' })
+    }
+    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {
+      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })
+    }
+    if (input.requirePrivatePartition && partition.isPublic) {
+      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this resource' })
+    }
+    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {
+      throw new CrudHttpError(404, { error: 'Attachment not found' })
+    }
+    if (
+      attachment.entityId !== input.expectedOwner.entityId ||
+      attachment.recordId !== input.expectedOwner.recordId
+    ) {
+      throw new CrudHttpError(404, { error: 'Attachment not found' })
+    }
+    if (input.expectedAssignment) {
+      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []
+      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment!))) {
+        throw new CrudHttpError(404, { error: 'Attachment not found' })
+      }
+    }
+
+    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {
+      tenantId: attachment.tenantId ?? '',
+      organizationId: attachment.organizationId ?? '',
+    })
+    let result: Awaited<ReturnType<typeof driver.read>>
+    try {
+      result = await driver.read(attachment.partitionCode, attachment.storagePath)
+    } catch {
+      throw new CrudHttpError(404, { error: 'File not available' })
+    }
+
+    const mimeType = attachment.mimeType || 'application/octet-stream'
+    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType)
+    return {
+      buffer: result.buffer,
+      contentType: renderInline ? result.contentType ?? mimeType : 'application/octet-stream',
+      contentDisposition: buildAttachmentContentDisposition(
+        attachment.fileName,
+        renderInline ? 'inline' : 'attachment',
+      ),
+      fileName: attachment.fileName,
+      mimeType,
+    }
+  }
+
+  async releaseScoped(
+    input: ReleaseScopedAttachmentInput,
+    options: { em?: EntityManager; flush?: boolean } = {},
+  ): Promise<AttachmentProviderCleanup | void> {
+    const em = options.em ?? this.em
+    // The type makes `expectedAssignment` mandatory, but this service is handed
+    // out through untyped DI resolution and consumed through structural ports in
+    // other packages, so the shared-reference guard is enforced at runtime too:
+    // without it a caller could destroy an attachment other records still link.
+    const expectedAssignment = input.expectedAssignment
+    if (!expectedAssignment) {
+      throw new CrudHttpError(500, {
+        error: 'Attachment release requires the expected assignment of the releasing record',
+      })
+    }
+    const isInTransaction = (em as { isInTransaction?: () => boolean }).isInTransaction
+    if (
+      options.flush !== false
+      && typeof isInTransaction === 'function'
+      && isInTransaction.call(em)
+    ) {
+      throw new CrudHttpError(500, {
+        error: 'Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup',
+      })
+    }
+    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }
+    const attachment = await findOneWithDecryption(
+      em,
+      Attachment,
+      {
+        id: input.attachmentId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      },
+      undefined,
+      scope,
+    )
+    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })
+    if (
+      attachment.entityId !== input.expectedOwner.entityId
+      || attachment.recordId !== input.expectedOwner.recordId
+      || (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode)
+    ) {
+      throw new CrudHttpError(404, { error: 'Attachment not found' })
+    }
+    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []
+    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {
+      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })
+    }
+    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {
+      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })
+    }
+
+    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope)
+    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath)
+    em.remove(attachment)
+    if (options.flush === false) {
+      return deleteProviderBytes
+    }
+    await em.flush()
+    await deleteProviderBytes()
+  }
+}

package/src/modules/attachments/lib/scoped-upload-service.ts

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { Attachment, AttachmentPartition } from '../data/entities'
 import { attachmentCrudEvents, attachmentCrudIndexer } from './crud'
@@ -40,7 +41,16 @@ export type ScopedAttachmentUploadErrorCode =
   | 'storage_failed'
   | 'persistence_failed'
 
+// Use Symbol.for so the marker survives module duplication across bundle
+// boundaries. The production build emits this module into several server
+// chunks, so a consumer's `instanceof` compares against a different copy of the
+// class than the DI-resolved service threw from: the check silently fails, the
+// error escapes the caller's catch, and a deliberate 400/413 surfaces as a 500.
+const SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = Symbol.for('@open-mercato/ScopedAttachmentUploadError')
+
 export class ScopedAttachmentUploadError extends Error {
+  readonly [SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] = true
+
   constructor(
     public readonly code: ScopedAttachmentUploadErrorCode,
     public readonly status: number,
@@ -50,6 +60,17 @@ export class ScopedAttachmentUploadError extends Error {
   }
 }
 
+/**
+ * Bundle-safe check for `ScopedAttachmentUploadError`. Prefer this over
+ * `instanceof` at every call site — the class is duplicated across server
+ * chunks, so `instanceof` is only reliable inside this module.
+ */
+export function isScopedAttachmentUploadError(error: unknown): error is ScopedAttachmentUploadError {
+  return Boolean(error)
+    && typeof error === 'object'
+    && (error as Record<symbol, unknown>)[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true
+}
+
 export type ScopedAttachmentUploadInput = {
   tenantId: string
   organizationId: string
@@ -62,6 +83,21 @@ export type ScopedAttachmentUploadInput = {
   assignments?: AttachmentAssignment[]
   partitionCode?: string | null
   maxBytes?: number
+  /**
+   * Reject a partition flagged public, so a module-owned upload (documents,
+   * warranty claims) never lands where an anonymous reader can reach it. The
+   * tenant/organization half of that guarantee is not this flag's job: the
+   * partition lookup below already matches only a global partition or one owned
+   * by this tenant and organization, whether or not the flag is set.
+   */
+  requirePrivatePartition?: boolean
+  /**
+   * Persists a module-owned link row inside the same transaction as the
+   * Attachment, so a link failure cannot leave a committed orphan attachment.
+   * The callback receives only the generated id, never the entity or the
+   * storage implementation.
+   */
+  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void
 }
 
 type QuotaRecoveryScheduler = (
@@ -102,6 +138,9 @@ export class ScopedAttachmentUploadService {
       ],
     })
     if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)
+    if (input.requirePrivatePartition && partition.isPublic) {
+      throw new ScopedAttachmentUploadError('partition_unavailable', 403)
+    }
 
     const driver = await storageDriverFactory.resolveForPartition(partition.code, {
       tenantId: input.tenantId,
@@ -210,11 +249,18 @@ export class ScopedAttachmentUploadService {
         })
         assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })
         await tx.persist(attachment).flush()
+        await input.persistLink?.(tx, attachmentId)
         await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)
       })
     } catch (error) {
       await this.compensateStorage(driver, partition.code, storedPath, reservation)
       logger.error('Scoped attachment persistence failed', { err: error })
+      // `persistLink` is where callers run their own authorization (the
+      // documents module re-checks the edit capability inside this
+      // transaction), so a deliberate HTTP error from it must reach the route
+      // with its own status. Flattening it to 500 turns a documented 403 into
+      // an apparent server fault.
+      if (isCrudHttpError(error)) throw error
       throw new ScopedAttachmentUploadError('persistence_failed', 500)
     }
 

package/src/modules/attachments/lib/upload-limits.ts

@@ -39,11 +39,15 @@ export function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | nu
   return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))
 }
 
+export function resolveAttachmentMultipartMaxBytes(): number {
+  return resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES
+}
+
 export function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {
   if (!contentLengthHeader) return true
   const contentLength = Number(contentLengthHeader)
-  if (!Number.isFinite(contentLength) || contentLength <= 0) return true
-  return contentLength <= (resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES)
+  if (!Number.isSafeInteger(contentLength) || contentLength <= 0) return false
+  return contentLength <= resolveAttachmentMultipartMaxBytes()
 }
 
 export class MultipartUploadLimitError extends Error {

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -21,6 +21,7 @@ type ActionLogResponse = {
   pageSize: number
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 type AccessLogResponse = {
@@ -30,6 +31,7 @@ type AccessLogResponse = {
   pageSize: number
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 type TabOption = 'actions' | 'access'
@@ -48,11 +50,13 @@ export default function AuditLogsPage() {
   const [actionsPageSize, setActionsPageSize] = React.useState(DEFAULT_PAGE_SIZE)
   const [actionsTotal, setActionsTotal] = React.useState(0)
   const [actionsTotalPages, setActionsTotalPages] = React.useState(1)
+  const [actionsTotalIsCapped, setActionsTotalIsCapped] = React.useState(false)
   const actionsPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)
   const [accessPage, setAccessPage] = React.useState(1)
   const [accessPageSize, setAccessPageSize] = React.useState(DEFAULT_PAGE_SIZE)
   const [accessTotal, setAccessTotal] = React.useState(0)
   const [accessTotalPages, setAccessTotalPages] = React.useState(1)
+  const [accessTotalIsCapped, setAccessTotalIsCapped] = React.useState(false)
   const accessPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)
 
   const fetchActions = React.useCallback(async (page: number, pageSize: number) => {
@@ -95,6 +99,7 @@ export default function AuditLogsPage() {
     })
     setActionsTotal(actionsRes.total ?? (actionsRes.items?.length ?? 0))
     setActionsTotalPages(actionsRes.totalPages ?? 1)
+    setActionsTotalIsCapped(actionsRes.totalIsCapped === true)
     setAccessLogs(accessRes.items ?? [])
     const resolvedPage = accessRes.page ?? accessPageNum
     const resolvedPageSize = accessRes.pageSize ?? accessPageSizeNum
@@ -111,6 +116,7 @@ export default function AuditLogsPage() {
     })
     setAccessTotal(resolvedTotal)
     setAccessTotalPages(resolvedTotalPages)
+    setAccessTotalIsCapped(accessRes.totalIsCapped === true)
   }, [fetchActions, fetchAccess])
 
   const loadWithState = React.useCallback(async (
@@ -210,6 +216,7 @@ export default function AuditLogsPage() {
               pageSize: actionsPageSize,
               total: actionsTotal,
               totalPages: actionsTotalPages,
+              totalIsCapped: actionsTotalIsCapped,
               onPageChange: handleActionsPageChange,
             }}
           />
@@ -225,6 +232,7 @@ export default function AuditLogsPage() {
               pageSize: accessPageSize,
               total: accessTotal,
               totalPages: accessTotalPages,
+              totalIsCapped: accessTotalIsCapped,
               onPageChange: handleAccessPageChange,
             }}
           />