@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/audit_logs/lib/display-helpers.tsx

@@ -33,9 +33,9 @@ export function renderValue(value: unknown, fallback: string) {
   if (typeof value === 'boolean') return <span>{value ? 'true' : 'false'}</span>
   if (typeof value === 'number' || typeof value === 'bigint') return <span>{String(value)}</span>
   if (value instanceof Date) return <span>{value.toISOString()}</span>
-  if (typeof value === 'string') return <span className="break-words">{value}</span>
+  if (typeof value === 'string') return <span className="wrap-anywhere">{value}</span>
   return (
-    <pre className="max-h-40 overflow-y-auto whitespace-pre-wrap break-words rounded-md bg-muted/50 px-2 py-1 text-xs leading-5 text-muted-foreground">
+    <pre className="max-h-40 overflow-y-auto whitespace-pre-wrap wrap-anywhere rounded-md bg-muted/50 px-2 py-1 text-xs leading-5 text-muted-foreground">
       {safeStringify(value)}
     </pre>
   )
@@ -76,43 +76,53 @@ export type ChangedFieldsTableProps = {
 }
 
 export function ChangedFieldsTable({ changeRows, noneLabel, t, beforeLabel, afterLabel }: ChangedFieldsTableProps) {
+  const beforeHeading = beforeLabel ?? t('audit_logs.actions.details.before')
+  const afterHeading = afterLabel ?? t('audit_logs.actions.details.after')
   return (
     <section>
       <h3 className="text-sm font-semibold">
         {t('audit_logs.actions.details.changed_fields')}
       </h3>
       {changeRows.length ? (
-        <div className="mt-2 overflow-x-auto rounded-lg border">
-          <table className="min-w-full divide-y text-sm">
-            <thead className="bg-muted/50">
-              <tr>
-                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                  {t('audit_logs.actions.details.field')}
-                </th>
-                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                  {beforeLabel ?? t('audit_logs.actions.details.before')}
-                </th>
-                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                  {afterLabel ?? t('audit_logs.actions.details.after')}
-                </th>
-              </tr>
-            </thead>
-            <tbody className="divide-y">
-              {changeRows.map((row) => (
-                <tr key={row.field} className="align-top">
-                  <td className="px-4 py-2 align-top font-medium">
-                    {humanizeField(normalizeChangeField(row.field))}
-                  </td>
-                  <td className="px-4 py-2">
-                    {renderValue(row.from, noneLabel)}
-                  </td>
-                  <td className="px-4 py-2">
-                    {renderValue(row.to, noneLabel)}
-                  </td>
+        <div className="@container/changes mt-2">
+          <div className="overflow-x-auto rounded-lg border">
+            <table className="block w-full divide-y text-sm @lg/changes:table @lg/changes:min-w-full">
+              <thead className="hidden bg-muted/50 @lg/changes:table-header-group">
+                <tr>
+                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                    {t('audit_logs.actions.details.field')}
+                  </th>
+                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                    {beforeHeading}
+                  </th>
+                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                    {afterHeading}
+                  </th>
                 </tr>
-              ))}
-            </tbody>
-          </table>
+              </thead>
+              <tbody className="block divide-y @lg/changes:table-row-group">
+                {changeRows.map((row) => (
+                  <tr key={row.field} className="block px-4 py-3 align-top @lg/changes:table-row @lg/changes:p-0">
+                    <td className="block font-medium @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2 @lg/changes:align-top">
+                      {humanizeField(normalizeChangeField(row.field))}
+                    </td>
+                    <td className="mt-2 block @lg/changes:mt-0 @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2">
+                      <span className="mb-0.5 block text-xs font-medium uppercase tracking-wide text-muted-foreground @lg/changes:hidden">
+                        {beforeHeading}
+                      </span>
+                      {renderValue(row.from, noneLabel)}
+                    </td>
+                    <td className="mt-2 block @lg/changes:mt-0 @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2">
+                      <span className="mb-0.5 block text-xs font-medium uppercase tracking-wide text-muted-foreground @lg/changes:hidden">
+                        {afterHeading}
+                      </span>
+                      {renderValue(row.to, noneLabel)}
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
         </div>
       ) : (
         <p className="mt-2 text-sm text-muted-foreground">

package/src/modules/audit_logs/services/actionLogService.ts

@@ -5,6 +5,7 @@ import { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
 import {
   actionLogCreateSchema,
   actionLogListSchema,
+  uuid,
   type ActionLogCreateInput,
   type ActionLogListQuery,
 } from '@open-mercato/core/modules/audit_logs/data/validators'
@@ -34,6 +35,55 @@ const SORT_FIELDS = {
   createdAt: 'action_logs.created_at',
 } as const
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
+// Mirrors what `uuid` (`data/validators.ts`) accepts — versions 1-8 plus the nil and
+// max UUIDs — and is used only when the zod runtime is unavailable, so the actor
+// sanitizer can never reject a value `actionLogCreateSchema` would have accepted.
+export const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/
+const API_KEY_ACTOR_PREFIX = 'api_key:'
+const SYSTEM_ACTOR_PREFIX = 'system:'
+// `context.systemActor` names the automated principal behind an entry; `context.source`
+// (read by `deriveActionLogSource`) names the channel it arrived through. They are
+// siblings on purpose and never contradict each other: an entry carrying `systemActor`
+// has a null actor column, which already derives the `system` source.
+const SYSTEM_ACTOR_CONTEXT_KEY = 'systemActor'
+const SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255
+
+function toNullableUuid(value: unknown): string | null {
+  return typeof value === 'string' && UUID_REGEX.test(value) ? value : null
+}
+
+function isSchemaUuid(value: string): boolean {
+  if (runtimeValidationAvailable === false) return SCHEMA_UUID_REGEX.test(value)
+
+  try {
+    return uuid.safeParse(value).success
+  } catch (err) {
+    if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
+    return SCHEMA_UUID_REGEX.test(value)
+  }
+}
+
+function readActorCandidate(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : null
+}
+
+function normalizeActorUserId(value: unknown): string | null {
+  const candidate = readActorCandidate(value)
+  if (!candidate) return null
+  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX)
+    ? candidate.slice(API_KEY_ACTOR_PREFIX.length)
+    : candidate
+
+  return isSchemaUuid(unwrapped) ? unwrapped : null
+}
+
+function toSystemActorReference(candidate: string): string | null {
+  if (!candidate.startsWith(SYSTEM_ACTOR_PREFIX)) return null
+  if (candidate.length === SYSTEM_ACTOR_PREFIX.length) return null
+  return candidate.slice(0, SYSTEM_ACTOR_REFERENCE_MAX_LENGTH)
+}
 
 type ActionLogProjectionBackfillOptions = {
   batchSize?: number
@@ -202,6 +252,7 @@ export class ActionLogService {
   }
 
   private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {
+    const sanitized = this.sanitizeActor(input)
     let data: ActionLogCreateInput
     const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }
     const canValidate = Boolean(schema && typeof schema.parse === 'function')
@@ -209,7 +260,7 @@ export class ActionLogService {
 
     if (shouldValidate) {
       try {
-        data = schema.parse(input)
+        data = schema.parse(sanitized)
         runtimeValidationAvailable = true
       } catch (err) {
         if (!isZodRuntimeMissing(err) && !validationWarningLogged) {
@@ -217,15 +268,34 @@ export class ActionLogService {
           logger.warn('Falling back to permissive action log payload parser', { err })
         }
         if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
-        data = this.normalizeInput(input)
+        data = this.normalizeInput(sanitized)
       }
     } else {
-      data = this.normalizeInput(input)
+      data = this.normalizeInput(sanitized)
     }
 
     return data
   }
 
+  private sanitizeActor(input: ActionLogCreateInput): ActionLogCreateInput {
+    if (!input) return input
+    const candidate = readActorCandidate(input.actorUserId)
+    const actorUserId = normalizeActorUserId(candidate)
+    const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null
+
+    if (!systemActorReference) {
+      if (actorUserId === (input.actorUserId ?? null)) return input
+      return { ...input, actorUserId }
+    }
+
+    const context = isRecord(input.context) ? { ...input.context } : {}
+    if (context[SYSTEM_ACTOR_CONTEXT_KEY] === undefined) {
+      context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference
+    }
+
+    return { ...input, actorUserId, context }
+  }
+
   private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {
     const projection = deriveActionLogProjection({
       actorUserId: data.actorUserId ?? null,
@@ -286,13 +356,6 @@ export class ActionLogService {
       }
     }
 
-    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
-    const toNullableUuid = (value: unknown) => {
-      if (typeof value !== 'string' || value.length === 0) return null
-      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value
-      return UUID_REGEX.test(candidate) ? candidate : null
-    }
-
     const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {
       if (value === null) return null
       if (Array.isArray(value)) return value
@@ -309,7 +372,7 @@ export class ActionLogService {
     return {
       tenantId: toNullableUuid(input.tenantId),
       organizationId: toNullableUuid(input.organizationId),
-      actorUserId: toNullableUuid(input.actorUserId),
+      actorUserId: normalizeActorUserId(input.actorUserId),
       commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',
       actionLabel: toOptionalString(input.actionLabel) ?? undefined,
       resourceKind: toOptionalString(input.resourceKind) ?? undefined,

package/src/modules/auth/acl.ts

@@ -1,14 +1,38 @@
 // Module-level features declaration for RBAC
 export const features = [
   { id: 'auth.users.list', title: 'List users', module: 'auth' },
-  { id: 'auth.users.create', title: 'Create users', module: 'auth' },
-  { id: 'auth.users.edit', title: 'Edit users', module: 'auth' },
-  { id: 'auth.users.delete', title: 'Delete users', module: 'auth' },
+  {
+    id: 'auth.users.create',
+    title: 'Create users',
+    module: 'auth',
+    dependsOn: ['auth.users.list', 'auth.roles.list', 'directory.organizations.view'],
+  },
+  {
+    id: 'auth.users.edit',
+    title: 'Edit users',
+    module: 'auth',
+    dependsOn: ['auth.users.list', 'auth.roles.list'],
+  },
+  {
+    id: 'auth.users.delete',
+    title: 'Delete users',
+    module: 'auth',
+    dependsOn: ['auth.users.list'],
+  },
   { id: 'auth.roles.list', title: 'List roles', module: 'auth' },
-  { id: 'auth.roles.manage', title: 'Manage roles', module: 'auth' },
-  { id: 'auth.acl.manage', title: 'Manage ACLs', module: 'auth' },
+  {
+    id: 'auth.roles.manage',
+    title: 'Manage roles',
+    module: 'auth',
+    dependsOn: ['auth.roles.list'],
+  },
+  {
+    id: 'auth.acl.manage',
+    title: 'Manage ACLs',
+    module: 'auth',
+    dependsOn: ['auth.users.list', 'auth.roles.list'],
+  },
   { id: 'auth.sidebar.manage', title: 'Manage sidebar presets', module: 'auth' },
 ]
 
 export default features
-

package/src/modules/auth/api/feature-check.ts

@@ -3,6 +3,8 @@ import { z } from 'zod'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { featureCheckRequestSchema } from '../data/validators'
 
 export const metadata = {
@@ -37,8 +39,13 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
-  const rbac = (container.resolve('rbacService') as any)
-  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId })
+  const rbac = container.resolve<RbacService>('rbacService')
+  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })
+  const featureScope = {
+    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,
+    organizationId: featureContext.organizationId,
+  }
+  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope)
   if (ok) {
     return NextResponse.json({ ok: true, granted: features, userId: auth.sub })
   }
@@ -46,7 +53,7 @@ export async function POST(req: Request) {
   // Check individually to see which features are granted
   const granted: string[] = []
   for (const f of features) {
-    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId })
+    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope)
     if (hasFeature) granted.push(f)
   }
 

package/src/modules/auth/api/login.ts

@@ -238,13 +238,21 @@ async function handleLoginRequest(req: Request) {
     ? interceptedBody.refreshToken
     : undefined
 
+  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional
+  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the
+  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff
+  // token and skip the outstanding second factor, so it is cleared alongside the swap.
+  const authTokenReplacedByInterceptor = authTokenForCookie !== token
+
   const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })
   res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })
   if (remember && refreshTokenForCookie) {
     const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)
     res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })
-  } else if (!remember && authTokenForCookie === token) {
+  } else if (!remember && !authTokenReplacedByInterceptor) {
     res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })
+  } else if (authTokenReplacedByInterceptor) {
+    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })
   }
   return res
 }

package/src/modules/auth/api/reset/validate.ts

@@ -0,0 +1,57 @@
+import { validatePasswordResetTokenSchema } from '@open-mercato/core/modules/auth/data/validators'
+import { NextResponse } from 'next/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
+import { z } from 'zod'
+import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
+import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
+
+const resetValidateRateLimitConfig = readEndpointRateLimitConfig('RESET_VALIDATE', {
+  points: 10, duration: 300, keyPrefix: 'reset-validate',
+})
+
+export async function POST(req: Request) {
+  const form = await req.formData()
+  const token = String(form.get('token') ?? '')
+  // Rate limit by IP — checked before validation and DB work
+  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig })
+  if (rateLimitError) return rateLimitError
+  const parsed = validatePasswordResetTokenSchema.safeParse({ token })
+  // A malformed token is reported as simply not valid: the caller learns nothing
+  // it could not learn by posting the same token to /api/auth/reset/confirm.
+  if (!parsed.success) return NextResponse.json({ ok: true, valid: false })
+  const container = await createRequestContainer()
+  const auth = container.resolve<AuthService>('authService')
+  const valid = await auth.isPasswordResetTokenValid(parsed.data.token)
+  return NextResponse.json({ ok: true, valid })
+}
+
+export const metadata = { requireAuth: false }
+
+const passwordResetValidateResponseSchema = z.object({
+  ok: z.literal(true),
+  valid: z.boolean(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Authentication & Accounts',
+  summary: 'Check a password reset token',
+  methods: {
+    POST: {
+      summary: 'Check whether a password reset token is still usable',
+      description: 'Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.',
+      requestBody: {
+        contentType: 'application/x-www-form-urlencoded',
+        schema: validatePasswordResetTokenSchema,
+      },
+      responses: [
+        { status: 200, description: 'Token state resolved', schema: passwordResetValidateResponseSchema },
+      ],
+      errors: [
+        { status: 429, description: 'Too many token validation attempts', schema: rateLimitErrorSchema },
+      ],
+    },
+  },
+}

package/src/modules/auth/api/roles/acl/route.ts

@@ -6,7 +6,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
-import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
@@ -16,8 +16,11 @@ import {
   assertActorCanModifySuperAdminRoleTarget,
   normalizeGrantFeatureList,
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
-
-type TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }
+import {
+  AUTH_ROLE_ACL_UPDATE_COMMAND_ID,
+  type AclUpdateResult,
+  type RoleAclUpdateInput,
+} from '@open-mercato/core/modules/auth/commands/acl'
 
 const getSchema = z.object({
   roleId: z.string().uuid(),
@@ -175,7 +178,7 @@ export async function PUT(req: Request) {
     }
   }
 
-  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
+  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
   // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same
   // role's features in parallel cannot silently clobber each other (#2055). The
   // check is strictly additive — when the client sends no expected-version header
@@ -193,18 +196,11 @@ export async function PUT(req: Request) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
       throw err
     }
-  } else {
-    acl = em.create(RoleAcl, {
-      role,
-      tenantId: targetTenantId,
-      createdAt: new Date(),
-      isSuperAdmin: false,
-    })
   }
 
-  const existingIsSuperAdmin = !!acl.isSuperAdmin
-  const existingFeatures = normalizeGrantFeatureList(acl.featuresJson)
-  const existingOrganizations = normalizeOrganizations(acl.organizationsJson)
+  const existingIsSuperAdmin = !!acl?.isSuperAdmin
+  const existingFeatures = normalizeGrantFeatureList(acl?.featuresJson)
+  const existingOrganizations = normalizeOrganizations(acl?.organizationsJson)
   const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin
   const requestedFeatures = parsed.data.features === undefined
     ? existingFeatures
@@ -229,32 +225,39 @@ export async function PUT(req: Request) {
     throw err
   }
 
-  // Persist the ACL mutation inside a transaction so the role-permission write
-  // commits atomically (proper ACL-edit transaction handling).
-  const aclToPersist = acl
-  await withAtomicFlush(
-    em,
-    [
-      () => {
-        aclToPersist.organizationsJson = requestedOrganizations
-        aclToPersist.isSuperAdmin = requestedIsSuperAdmin
-        aclToPersist.featuresJson = requestedFeatures
-        em.persist(aclToPersist)
-      },
-    ],
-    { transaction: true },
-  )
-
-  // Invalidate cache for all users in this tenant since role ACL changed
-  if (targetTenantId) {
-    await rbacService.invalidateTenantCache(targetTenantId)
-    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches
-    try {
-      const cache = container.resolve('cache') as TaggableCache | undefined
-      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`])
-    } catch {}
+  // Route the write through the command bus so the permission change lands in
+  // the action log. The command owns the transactional write and the RBAC cache
+  // invalidation that used to live here.
+  const commandBus = container.resolve('commandBus') as CommandBus
+  // A super admin may edit a role in another tenant. The actor's organization
+  // belongs to *their* tenant, and the command bus resolves the log row's
+  // organization as `metadata.organizationId ?? ctx.selectedOrganizationId ??
+  // ctx.auth.orgId` — a `??` chain, so a handler cannot express "explicitly no
+  // organization" on its own. Strip the organization from the context instead,
+  // otherwise the entry is stamped (target tenant, actor's foreign organization)
+  // and `ActionLogService` — which filters organization with strict equality —
+  // can never surface it for anyone.
+  const isForeignTenant = targetTenantId !== (auth.tenantId ?? null)
+  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null
+  const commandCtx: CommandRuntimeContext = {
+    container,
+    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
+    organizationScope: null,
+    selectedOrganizationId: actorOrgId,
+    organizationIds: actorOrgId ? [actorOrgId] : null,
+    request: req,
   }
-  
+  await commandBus.execute<RoleAclUpdateInput, AclUpdateResult>(AUTH_ROLE_ACL_UPDATE_COMMAND_ID, {
+    input: {
+      roleId: String(role.id),
+      tenantId: targetTenantId,
+      isSuperAdmin: requestedIsSuperAdmin,
+      features: requestedFeatures,
+      organizations: requestedOrganizations,
+    },
+    ctx: commandCtx,
+  })
+
   return NextResponse.json({
     ok: true,
     sanitized: false,

package/src/modules/auth/api/session/refresh.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
-import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
+import { isMfaPendingJwtPayload, signJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { refreshSessionRequestSchema } from '@open-mercato/core/modules/auth/data/validators'
 import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
@@ -25,6 +25,23 @@ function parseCookie(req: Request, name: string): string | null {
   return m ? decodeURIComponent(m[1]) : null
 }
 
+// Both handlers are `requireAuth: false`, so the dispatcher's MFA-pending gate never inspects
+// this route's caller. Minting a full staff JWT for a browser that is still holding a provisional
+// `mfa_pending` token would hand it the access the outstanding second factor is meant to withhold,
+// so the pending credential is checked here directly. `refreshFromSessionToken` itself has no MFA
+// awareness — it validates only the token hash and expiry.
+function carriesMfaPendingToken(req: Request): boolean {
+  const authHeader = (req.headers.get('authorization') || '').trim()
+  const bearer = authHeader.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null
+  const token = bearer || parseCookie(req, 'auth_token')
+  if (!token) return false
+  try {
+    return isMfaPendingJwtPayload(verifyJwt(token))
+  } catch {
+    return false
+  }
+}
+
 type RefreshedSession = NonNullable<Awaited<ReturnType<AuthService['refreshFromSessionToken']>>>
 
 // Scope claims must stay absent rather than stringified when the user has no tenant/org:
@@ -64,6 +81,11 @@ export async function GET(req: Request) {
   const url = new URL(req.url)
   const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin
   const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/')
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))
+    )
+  }
   const token = parseCookie(req, 'session_token')
   if (!token) {
     return clearStaffAuthCookies(
@@ -106,6 +128,15 @@ export async function POST(req: Request) {
   })
   if (rateLimitError) return rateLimitError
 
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      NextResponse.json({
+        ok: false,
+        error: translate('auth.session.refresh.errors.invalidToken', 'Invalid or expired refresh token'),
+      }, { status: 401 })
+    )
+  }
+
   if (!token) {
     return clearStaffAuthCookies(
       NextResponse.json({