@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/auth/commands/roles.js

@@ -7,7 +7,7 @@ import {
   buildChanges,
   requireId
 } from "@open-mercato/shared/lib/commands/helpers";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, forbidden } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { z } from "zod";
@@ -20,7 +20,32 @@ import {
 } from "@open-mercato/shared/lib/commands/customFieldSnapshots";
 import { extractUndoPayload } from "@open-mercato/shared/lib/commands/undo";
 import { resolveRedoSnapshot } from "@open-mercato/shared/lib/commands/redo";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
 import { resolveIsSuperAdmin, normalizeTenantId } from "@open-mercato/core/modules/auth/lib/tenantAccess";
+import {
+  assertActorCanAccessRoleTarget,
+  assertActorCanGrantAcl,
+  assertActorCanModifySuperAdminRoleTarget
+} from "@open-mercato/core/modules/auth/lib/grantChecks";
+import {
+  assertReplaySnapshotMatches,
+  extractStoredReplayInput,
+  lockReplayAuthorizationState,
+  rerunReplayTransactionGuardAfterLocks,
+  requireCurrentReplayFeature,
+  requireCurrentReplaySuperAdmin,
+  requireTransactionalReplayEntityManager
+} from "@open-mercato/core/modules/auth/lib/commandReplay";
+import { lockRoleWriterAuthorizationState } from "@open-mercato/core/modules/auth/lib/authorizationStateLocks";
+const ROLE_REDO_LOG = /* @__PURE__ */ Symbol("auth.roles.redoLog");
+function withRoleRedoLog(ctx, logEntry) {
+  return { ...ctx, [ROLE_REDO_LOG]: logEntry };
+}
+function resolveCommandEm(ctx, forkWhenUnbound = false) {
+  if (ctx.transactionalEm) return ctx.transactionalEm;
+  const em = ctx.container.resolve("em");
+  return forkWhenUnbound ? em.fork() : em;
+}
 function resolveActorTenantScope(ctx) {
   if (ctx.systemActor === true) return null;
   const auth = ctx.auth;
@@ -92,6 +117,9 @@ const roleCrudIndexer = {
 };
 const createRoleCommand = {
   id: "auth.roles.create",
+  atomicReplay: true,
+  stabilizeReplay: stabilizeRoleReplay,
+  authorizeReplay: (params) => authorizeRoleReplay("create", params),
   async execute(rawInput, ctx) {
     const rawBody = rawInput && typeof rawInput === "object" ? rawInput : {};
     if ("tenantId" in rawBody && rawBody.tenantId === null) {
@@ -139,7 +167,7 @@ const createRoleCommand = {
     return role;
   },
   captureAfter: async (_input, result, ctx) => {
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
       recordId: String(result.id),
@@ -149,7 +177,7 @@ const createRoleCommand = {
   },
   buildLog: async ({ result, ctx }) => {
     const { translate } = await resolveTranslations();
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
       recordId: String(result.id),
@@ -169,68 +197,87 @@ const createRoleCommand = {
       }
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const undo = extractUndoPayload(logEntry)?.after;
     if (!undo) return;
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
-    await em.nativeDelete(RoleAcl, { role: undo.id });
-    if (undo.custom && Object.keys(undo.custom).length) {
-      const reset = buildCustomFieldResetMap(void 0, undo.custom);
-      if (Object.keys(reset).length) {
-        await setCustomFieldsIfAny({
-          dataEngine: de,
-          entityId: E.auth.role,
-          recordId: undo.id,
-          organizationId: null,
-          tenantId: undo.tenantId ?? null,
-          values: reset,
-          notify: false
-        });
+    await withAtomicFlush(em, [async () => {
+      await authorizeRoleReplayAtMutation("create", {
+        operation: "undo",
+        input,
+        ctx,
+        logEntry
+      });
+      await lockRoleWriterAuthorizationState(em, [undo.id]);
+      await em.nativeDelete(RoleAcl, { role: undo.id });
+      if (undo.custom && Object.keys(undo.custom).length) {
+        const reset = buildCustomFieldResetMap(void 0, undo.custom);
+        if (Object.keys(reset).length) {
+          await setCustomFieldsIfAny({
+            dataEngine: de,
+            entityId: E.auth.role,
+            recordId: undo.id,
+            organizationId: null,
+            tenantId: undo.tenantId ?? null,
+            values: reset,
+            notify: false
+          });
+        }
       }
-    }
-    await de.deleteOrmEntity({
-      entity: Role,
-      where: { id: undo.id, deletedAt: null },
-      soft: false
-    });
+      await de.deleteOrmEntity({
+        entity: Role,
+        where: { id: undo.id, deletedAt: null },
+        soft: false
+      });
+    }], { transaction: true, label: "auth.roles.create.undo" });
   },
-  redo: async ({ logEntry, ctx }) => {
+  redo: async ({ input, logEntry, ctx }) => {
     const after = resolveRedoSnapshot(logEntry);
     if (!after) throw new CrudHttpError(400, { error: "[internal] redo snapshot unavailable for role create" });
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
-    let role = await findOneWithDecryption(em, Role, { id: after.id }, {}, { tenantId: null, organizationId: null });
-    if (role) {
-      role.deletedAt = null;
-      role.name = after.name;
-      role.tenantId = after.tenantId;
-      await em.flush();
-    } else {
-      role = await de.createOrmEntity({
-        entity: Role,
-        data: {
-          id: after.id,
-          name: after.name,
-          tenantId: after.tenantId
-        }
+    let role = null;
+    await withAtomicFlush(em, [async () => {
+      await authorizeRoleReplayAtMutation("create", {
+        operation: "redo",
+        input,
+        ctx,
+        logEntry
       });
-    }
-    await restoreRoleAcls(em, after.id, after.acls);
-    if (after.custom && Object.keys(after.custom).length) {
-      const reset = buildCustomFieldResetMap(after.custom, void 0);
-      if (Object.keys(reset).length) {
-        await setCustomFieldsIfAny({
-          dataEngine: de,
-          entityId: E.auth.role,
-          recordId: after.id,
-          organizationId: null,
-          tenantId: after.tenantId ?? null,
-          values: reset,
-          notify: false
+      role = await findOneWithDecryption(em, Role, { id: after.id }, {}, { tenantId: null, organizationId: null });
+      if (role) {
+        role.deletedAt = null;
+        role.name = after.name;
+        role.tenantId = after.tenantId;
+        await em.flush();
+      } else {
+        role = await de.createOrmEntity({
+          entity: Role,
+          data: {
+            id: after.id,
+            name: after.name,
+            tenantId: after.tenantId
+          }
         });
       }
-    }
+      await restoreRoleAcls(em, after.id, after.acls);
+      if (after.custom && Object.keys(after.custom).length) {
+        const reset = buildCustomFieldResetMap(after.custom, void 0);
+        if (Object.keys(reset).length) {
+          await setCustomFieldsIfAny({
+            dataEngine: de,
+            entityId: E.auth.role,
+            recordId: after.id,
+            organizationId: null,
+            tenantId: after.tenantId ?? null,
+            values: reset,
+            notify: false
+          });
+        }
+      }
+    }], { transaction: true, label: "auth.roles.create.redo" });
+    if (!role) throw new CrudHttpError(400, { error: "[internal] redo failed to restore role row" });
     await emitCrudSideEffects({
       dataEngine: de,
       action: "created",
@@ -248,9 +295,12 @@ const createRoleCommand = {
 };
 const updateRoleCommand = {
   id: "auth.roles.update",
+  atomicReplay: true,
+  stabilizeReplay: stabilizeRoleReplay,
+  authorizeReplay: (params) => authorizeRoleReplay("update", params),
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(updateSchema, rawInput);
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const scope = await resolveActorScope(ctx);
     const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null });
     if (!existing) throw new CrudHttpError(404, { error: "Role not found" });
@@ -265,7 +315,7 @@ const updateRoleCommand = {
   },
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput);
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const scope = await resolveActorScope(ctx);
     const current = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null });
     if (!current) throw new CrudHttpError(404, { error: "Role not found" });
@@ -290,42 +340,62 @@ const updateRoleCommand = {
       if (assignments > 0) {
         throw new CrudHttpError(400, { error: "Role cannot be moved to another tenant while users are assigned" });
       }
-      await em.nativeDelete(RoleAcl, { role: parsed.id });
     }
     const de = ctx.container.resolve("dataEngine");
-    const role = await de.updateOrmEntity({
-      entity: Role,
-      where: buildScopedRoleFilter(parsed.id, scope),
-      apply: (entity) => {
-        if (parsed.name !== void 0) entity.name = parsed.name;
-        if (parsed.tenantId !== void 0 && scope.isSuperAdmin) entity.tenantId = parsed.tenantId;
+    const redoLogEntry = ctx[ROLE_REDO_LOG];
+    let role = null;
+    await withAtomicFlush(em, [async () => {
+      if (redoLogEntry) {
+        await authorizeRoleReplayAtMutation("update", {
+          operation: "redo",
+          input: rawInput,
+          ctx,
+          logEntry: redoLogEntry
+        });
       }
+      await lockRoleWriterAuthorizationState(em, [parsed.id]);
+      if (wantsTenantChange) {
+        await em.nativeDelete(RoleAcl, { role: parsed.id });
+      }
+      role = await de.updateOrmEntity({
+        entity: Role,
+        where: buildScopedRoleFilter(parsed.id, scope),
+        apply: (entity) => {
+          if (parsed.name !== void 0) entity.name = parsed.name;
+          if (parsed.tenantId !== void 0 && scope.isSuperAdmin) entity.tenantId = parsed.tenantId;
+        }
+      });
+      if (!role) throw new CrudHttpError(404, { error: "Role not found" });
+      await setCustomFieldsIfAny({
+        dataEngine: de,
+        entityId: E.auth.role,
+        recordId: String(role.id),
+        organizationId: null,
+        tenantId: role.tenantId ? String(role.tenantId) : null,
+        values: custom
+      });
+    }], {
+      transaction: true,
+      label: redoLogEntry ? "auth.roles.update.redo" : "auth.roles.update"
     });
-    if (!role) throw new CrudHttpError(404, { error: "Role not found" });
-    await setCustomFieldsIfAny({
-      dataEngine: de,
-      entityId: E.auth.role,
-      recordId: String(role.id),
-      organizationId: null,
-      tenantId: role.tenantId ? String(role.tenantId) : null,
-      values: custom
-    });
+    const updatedRole = role;
+    if (!updatedRole) throw new CrudHttpError(404, { error: "Role not found" });
     await emitCrudSideEffects({
       dataEngine: de,
       action: "updated",
-      entity: role,
+      entity: updatedRole,
       identifiers: {
-        id: String(role.id),
+        id: String(updatedRole.id),
         organizationId: null,
-        tenantId: role.tenantId ? String(role.tenantId) : null
+        tenantId: updatedRole.tenantId ? String(updatedRole.tenantId) : null
       },
       events: roleCrudEvents,
       indexer: roleCrudIndexer
     });
-    return role;
+    return updatedRole;
   },
   captureAfter: async (_input, result, ctx) => {
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
       recordId: String(result.id),
@@ -338,7 +408,7 @@ const updateRoleCommand = {
     const beforeSnapshots = snapshots.before;
     const before = beforeSnapshots?.view;
     const beforeUndo = beforeSnapshots?.undo ?? null;
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const afterAcls = await loadRoleAclSnapshots(em, String(result.id));
     const custom = await loadCustomFieldSnapshot(em, {
       entityId: E.auth.role,
@@ -368,36 +438,48 @@ const updateRoleCommand = {
       }
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const undo = extractUndoPayload(logEntry);
     const before = undo?.before;
     const after = undo?.after;
     if (!before) return;
-    const em = ctx.container.resolve("em");
+    const storedReplayInput = extractStoredReplayInput(logEntry.commandPayload, logEntry);
+    const replayInput = Object.keys(storedReplayInput).length ? storedReplayInput : deriveRoleUpdateReplayInput(before, after ?? null);
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
-    const updated = await de.updateOrmEntity({
-      entity: Role,
-      where: { id: before.id, deletedAt: null },
-      apply: (entity) => {
-        entity.name = before.name;
-        entity.tenantId = before.tenantId;
-      }
-    });
-    if (updated) {
-      await restoreRoleAcls(em, before.id, before.acls);
-    }
-    const reset = buildCustomFieldResetMap(before.custom, after?.custom);
-    if (Object.keys(reset).length) {
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.role,
-        recordId: before.id,
-        organizationId: null,
-        tenantId: before.tenantId,
-        values: reset,
-        notify: false
+    let updated = null;
+    await withAtomicFlush(em, [async () => {
+      await authorizeRoleReplayAtMutation("update", {
+        operation: "undo",
+        input,
+        ctx,
+        logEntry
       });
-    }
+      updated = await de.updateOrmEntity({
+        entity: Role,
+        where: { id: before.id, deletedAt: null },
+        apply: (entity) => {
+          if ("name" in replayInput) entity.name = before.name;
+          if ("tenantId" in replayInput) entity.tenantId = before.tenantId;
+        }
+      });
+      const restoresAcls = "tenantId" in replayInput && after?.tenantId !== before.tenantId;
+      if (updated && restoresAcls) {
+        await restoreRoleAcls(em, before.id, before.acls);
+      }
+      const reset = buildCustomFieldResetMap(before.custom, after?.custom);
+      if (Object.keys(reset).length) {
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.role,
+          recordId: before.id,
+          organizationId: null,
+          tenantId: before.tenantId,
+          values: reset,
+          notify: false
+        });
+      }
+    }], { transaction: true, label: "auth.roles.update.undo" });
     await emitCrudUndoSideEffects({
       dataEngine: de,
       action: "updated",
@@ -410,13 +492,17 @@ const updateRoleCommand = {
       events: roleCrudEvents,
       indexer: roleCrudIndexer
     });
-  }
+  },
+  redo: ({ input, ctx, logEntry }) => updateRoleCommand.execute(input, withRoleRedoLog(ctx, logEntry))
 };
 const deleteRoleCommand = {
   id: "auth.roles.delete",
+  atomicReplay: true,
+  stabilizeReplay: stabilizeRoleReplay,
+  authorizeReplay: (params) => authorizeRoleReplay("delete", params),
   async prepare(input, ctx) {
     const id = requireId(input, "Role id required");
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const scope = await resolveActorScope(ctx);
     const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null });
     if (!existing) return {};
@@ -435,34 +521,52 @@ const deleteRoleCommand = {
   },
   async execute(input, ctx) {
     const id = requireId(input, "Role id required");
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const scope = await resolveActorScope(ctx);
     const role = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null });
     if (!role) throw new CrudHttpError(404, { error: "Role not found" });
     assertRoleTenantInScope(resolveActorTenantScope(ctx), role.tenantId);
-    const activeAssignments = await em.count(UserRole, { role, deletedAt: null });
-    if (activeAssignments > 0) throw new CrudHttpError(400, { error: "Role has assigned users" });
-    await em.nativeDelete(RoleAcl, { role: id });
     const de = ctx.container.resolve("dataEngine");
-    const deleted = await de.deleteOrmEntity({
-      entity: Role,
-      where: buildScopedRoleFilter(id, scope),
-      soft: false
+    const redoLogEntry = ctx[ROLE_REDO_LOG];
+    let deleted = null;
+    await withAtomicFlush(em, [async () => {
+      if (redoLogEntry) {
+        await authorizeRoleReplayAtMutation("delete", {
+          operation: "redo",
+          input,
+          ctx,
+          logEntry: redoLogEntry
+        });
+      }
+      await lockRoleWriterAuthorizationState(em, [id]);
+      const activeAssignments = await em.count(UserRole, { role, deletedAt: null });
+      if (activeAssignments > 0) throw new CrudHttpError(400, { error: "Role has assigned users" });
+      await em.nativeDelete(RoleAcl, { role: id });
+      deleted = await de.deleteOrmEntity({
+        entity: Role,
+        where: buildScopedRoleFilter(id, scope),
+        soft: false
+      });
+      if (!deleted) throw new CrudHttpError(404, { error: "Role not found" });
+    }], {
+      transaction: true,
+      label: redoLogEntry ? "auth.roles.delete.redo" : "auth.roles.delete"
     });
-    if (!deleted) throw new CrudHttpError(404, { error: "Role not found" });
+    const deletedRole = deleted;
+    if (!deletedRole) throw new CrudHttpError(404, { error: "Role not found" });
     await emitCrudSideEffects({
       dataEngine: de,
       action: "deleted",
-      entity: deleted,
+      entity: deletedRole,
       identifiers: {
         id,
         organizationId: null,
-        tenantId: deleted.tenantId ? String(deleted.tenantId) : null
+        tenantId: deletedRole.tenantId ? String(deletedRole.tenantId) : null
       },
       events: roleCrudEvents,
       indexer: roleCrudIndexer
     });
-    return deleted;
+    return deletedRole;
   },
   buildLog: async ({ snapshots, input }) => {
     const { translate } = await resolveTranslations();
@@ -483,40 +587,50 @@ const deleteRoleCommand = {
       }
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const before = extractUndoPayload(logEntry)?.before;
     if (!before) return;
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
-    let role = await findOneWithDecryption(em, Role, { id: before.id }, {}, { tenantId: null, organizationId: null });
-    if (role) {
-      role.deletedAt = null;
-      role.name = before.name;
-      role.tenantId = before.tenantId;
-      await em.flush();
-    } else {
-      role = await de.createOrmEntity({
-        entity: Role,
-        data: {
-          id: before.id,
-          name: before.name,
-          tenantId: before.tenantId
-        }
+    let role = null;
+    await withAtomicFlush(em, [async () => {
+      await authorizeRoleReplayAtMutation("delete", {
+        operation: "undo",
+        input,
+        ctx,
+        logEntry
       });
-    }
-    await restoreRoleAcls(em, before.id, before.acls);
-    const reset = buildCustomFieldResetMap(before.custom, void 0);
-    if (Object.keys(reset).length) {
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.role,
-        recordId: before.id,
-        organizationId: null,
-        tenantId: before.tenantId ?? null,
-        values: reset,
-        notify: false
-      });
-    }
+      role = await findOneWithDecryption(em, Role, { id: before.id }, {}, { tenantId: null, organizationId: null });
+      if (role) {
+        role.deletedAt = null;
+        role.name = before.name;
+        role.tenantId = before.tenantId;
+        await em.flush();
+      } else {
+        role = await de.createOrmEntity({
+          entity: Role,
+          data: {
+            id: before.id,
+            name: before.name,
+            tenantId: before.tenantId
+          }
+        });
+      }
+      await restoreRoleAcls(em, before.id, before.acls);
+      const reset = buildCustomFieldResetMap(before.custom, void 0);
+      if (Object.keys(reset).length) {
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.role,
+          recordId: before.id,
+          organizationId: null,
+          tenantId: before.tenantId ?? null,
+          values: reset,
+          notify: false
+        });
+      }
+    }], { transaction: true, label: "auth.roles.delete.undo" });
+    if (!role) throw new CrudHttpError(400, { error: "[internal] undo failed to restore role row" });
     await emitCrudUndoSideEffects({
       dataEngine: de,
       action: "updated",
@@ -529,8 +643,167 @@ const deleteRoleCommand = {
       events: roleCrudEvents,
       indexer: roleCrudIndexer
     });
-  }
+  },
+  redo: ({ input, ctx, logEntry }) => deleteRoleCommand.execute(input, withRoleRedoLog(ctx, logEntry))
 };
+function normalizeRoleAclSnapshots(acls) {
+  return acls.map((acl) => ({
+    ...acl,
+    features: acl.features ? [...acl.features].sort((left, right) => left.localeCompare(right)) : null,
+    organizations: acl.organizations ? [...acl.organizations].sort((left, right) => left.localeCompare(right)) : null
+  })).sort((left, right) => {
+    const tenantOrder = left.tenantId.localeCompare(right.tenantId);
+    if (tenantOrder !== 0) return tenantOrder;
+    return (left.id ?? "").localeCompare(right.id ?? "");
+  });
+}
+function normalizeRoleReplaySnapshot(snapshot) {
+  return {
+    ...snapshot,
+    acls: normalizeRoleAclSnapshots(snapshot.acls)
+  };
+}
+function toRoleUpdateReplayState(snapshot) {
+  return {
+    name: snapshot.name,
+    tenantId: snapshot.tenantId,
+    ...snapshot.custom && Object.keys(snapshot.custom).length ? { custom: snapshot.custom } : {}
+  };
+}
+function deriveRoleUpdateReplayInput(before, after) {
+  if (!before) return {};
+  if (!after) return { id: before.id, name: before.name, tenantId: before.tenantId };
+  const input = { id: after.id };
+  if (before.name !== after.name) input.name = after.name;
+  if (before.tenantId !== after.tenantId) input.tenantId = after.tenantId;
+  return input;
+}
+async function authorizeRoleReplay(commandKind, params) {
+  const { operation, ctx, logEntry } = params;
+  const em = requireTransactionalReplayEntityManager(ctx);
+  await requireCurrentReplayFeature(ctx, "auth.roles.manage");
+  const undoPayload = extractUndoPayload(logEntry);
+  const before = undoPayload?.before ?? null;
+  const after = undoPayload?.after ?? null;
+  const roleId = logEntry.resourceId ?? before?.id ?? after?.id ?? null;
+  if (!roleId) {
+    await assertReplaySnapshotMatches(null, { required: "role replay snapshot" });
+    return;
+  }
+  const currentRole = await findOneWithDecryption(
+    em,
+    Role,
+    { id: roleId, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null }
+  );
+  const rbacService = ctx.systemActor === true ? null : ctx.container.resolve("rbacService");
+  if (rbacService && currentRole) {
+    await assertActorCanAccessRoleTarget({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null,
+      targetRoleId: roleId
+    });
+    await assertActorCanModifySuperAdminRoleTarget({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null,
+      targetRoleId: roleId
+    });
+  }
+  let currentSnapshot = null;
+  if (currentRole) {
+    const currentTenantId = currentRole.tenantId ? String(currentRole.tenantId) : null;
+    const [acls, custom] = await Promise.all([
+      loadRoleAclSnapshots(em, roleId),
+      loadCustomFieldSnapshot(em, {
+        entityId: E.auth.role,
+        recordId: roleId,
+        tenantId: currentTenantId
+      })
+    ]);
+    currentSnapshot = captureRoleSnapshots(currentRole, acls, custom).undo;
+  }
+  const expectedCurrent = operation === "undo" ? commandKind === "create" ? after : commandKind === "update" ? after : null : commandKind === "create" ? null : before;
+  const storedReplayInput = extractStoredReplayInput(params.input, logEntry);
+  const replayInput = Object.keys(storedReplayInput).length ? storedReplayInput : deriveRoleUpdateReplayInput(before, after);
+  const movesTenant = commandKind === "update" && "tenantId" in replayInput && before?.tenantId !== after?.tenantId;
+  if (movesTenant) {
+    await requireCurrentReplaySuperAdmin(ctx);
+  }
+  if (commandKind === "update" && !movesTenant) {
+    if (!currentSnapshot || !expectedCurrent) {
+      await assertReplaySnapshotMatches(currentSnapshot, expectedCurrent);
+    } else {
+      await assertReplaySnapshotMatches(
+        toRoleUpdateReplayState(currentSnapshot),
+        toRoleUpdateReplayState(expectedCurrent)
+      );
+    }
+  } else {
+    await assertReplaySnapshotMatches(
+      currentSnapshot ? normalizeRoleReplaySnapshot(currentSnapshot) : null,
+      expectedCurrent ? normalizeRoleReplaySnapshot(expectedCurrent) : null
+    );
+  }
+  const desiredState = operation === "undo" ? commandKind === "create" ? null : before : commandKind === "delete" ? null : after;
+  if (desiredState && !currentRole && rbacService) {
+    const actorUserId = ctx.auth?.sub;
+    if (!actorUserId) throw forbidden();
+    const actorAcl = await rbacService.loadAclWithEntityManager(em, actorUserId, {
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null
+    });
+    if (!actorAcl.isSuperAdmin) assertRoleTenantInScope(ctx.auth?.tenantId ?? null, desiredState.tenantId);
+  }
+  const restoresAcls = Boolean(
+    desiredState && desiredState.acls.length > 0 && (commandKind !== "update" || movesTenant)
+  );
+  if (!restoresAcls || !desiredState || !rbacService) return;
+  await requireCurrentReplayFeature(ctx, "auth.acl.manage");
+  for (const acl of desiredState.acls) {
+    await assertActorCanGrantAcl({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: acl.tenantId,
+      organizationId: null,
+      features: acl.features,
+      isSuperAdmin: acl.isSuperAdmin,
+      organizations: acl.organizations
+    });
+  }
+}
+async function authorizeRoleReplayAtMutation(commandKind, params) {
+  const em = params.ctx.transactionalEm ?? params.ctx.container.resolve("em");
+  const boundParams = params.ctx.transactionalEm ? params : { ...params, ctx: { ...params.ctx, transactionalEm: em } };
+  await stabilizeRoleReplay(boundParams);
+  await rerunReplayTransactionGuardAfterLocks(boundParams, em);
+  await authorizeRoleReplay(commandKind, boundParams);
+}
+async function stabilizeRoleReplay(params) {
+  const undoPayload = extractUndoPayload(params.logEntry);
+  const before = undoPayload?.before ?? null;
+  const after = undoPayload?.after ?? null;
+  const targetRoleId = params.logEntry.resourceId ?? before?.id ?? after?.id ?? null;
+  const em = requireTransactionalReplayEntityManager(params.ctx);
+  await lockReplayAuthorizationState(em, params.ctx, {
+    targetRoleIds: targetRoleId ? [targetRoleId] : [],
+    targetTenantIds: [
+      ...before?.tenantId ? [before.tenantId] : [],
+      ...after?.tenantId ? [after.tenantId] : [],
+      ...params.logEntry.tenantId ? [params.logEntry.tenantId] : []
+    ]
+  });
+}
 registerCommand(createRoleCommand);
 registerCommand(updateRoleCommand);
 registerCommand(deleteRoleCommand);
@@ -565,6 +838,7 @@ async function loadRoleAclSnapshots(em, roleId) {
   }));
 }
 async function restoreRoleAcls(em, roleId, acls) {
+  await lockRoleWriterAuthorizationState(em, [roleId]);
   await em.nativeDelete(RoleAcl, { role: roleId });
   if (!acls.length) {
     await em.flush();