@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
@@ -12,6 +13,12 @@ import type { AwilixContainer } from 'awilix'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { authorizeAuditReplayWithEntityManager } from '@open-mercato/core/modules/audit_logs/lib/replayAuthorization'
+import {
+  actionLogBelongsToAuth,
+  resolveCanonicalAuthSubject,
+  resolveActionLogActorSubject,
+} from '@open-mercato/core/modules/audit_logs/lib/actorSubject'
 
 const logger = createLogger('audit_logs').child({ component: 'undo' })
 
@@ -39,6 +46,8 @@ const errorSchema = z.object({
 export async function POST(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  const authSubject = resolveCanonicalAuthSubject(auth)
+  if (!authSubject) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
   const body = (await req.json().catch(() => null)) as UndoRequestBody | null
   const undoToken = body?.undoToken?.trim()
@@ -54,7 +63,14 @@ export async function POST(req: Request) {
     rbac = null
   }
 
-  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })
+  const { organizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
+  let singleOrganizationId: string | null
+  try {
+    singleOrganizationId = organizationId ?? resolveSingleOrganizationIdOrDeny(scope, auth)
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    throw err
+  }
 
   const canUndoTenant = rbac
     ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.undo_tenant'], {
@@ -67,7 +83,14 @@ export async function POST(req: Request) {
   if (!target || target.executionState !== 'done') {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
-  if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {
+  const targetActorSubject = resolveActionLogActorSubject(target)
+  const isLegacyApiKeyOwner = target.actorUserId === authSubject.storageId
+    && authSubject.kind === 'api_key'
+    && target.contextJson?.actorSubject === undefined
+  if (target.actorUserId && !targetActorSubject && !isLegacyApiKeyOwner) {
+    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
+  }
+  if (target.actorUserId && !actionLogBelongsToAuth(target, auth) && !canUndoTenant) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
   // Fail closed on tenant scope: `audit_logs.undo_tenant` only widens scope WITHIN a
@@ -77,7 +100,7 @@ export async function POST(req: Request) {
   if (target.tenantId && target.tenantId !== (auth.tenantId ?? null)) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
-  const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null
+  const scopedOrgId = canUndoTenant ? organizationId ?? null : singleOrganizationId
   // Tenant-level undoers may undo across organizations within the tenant, so an
   // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.
   // Every other caller must resolve to the target's own organization — a null caller
@@ -89,7 +112,9 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
 
-  const lookupActorId = canUndoTenant ? (target.actorUserId ?? auth.sub) : auth.sub
+  const lookupActorId = canUndoTenant
+    ? (targetActorSubject ?? (isLegacyApiKeyOwner ? authSubject.subject : auth.sub))
+    : authSubject.subject
   // Scope the latest-undoable re-lookup to the target row's own organization, not
   // the caller's currently-resolved org. The actor/tenant/org guards above already
   // authorized the caller for this row; reusing the caller's scope here breaks undo
@@ -116,9 +141,19 @@ export async function POST(req: Request) {
   if (!latest || latest.id !== target.id) {
     return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
   }
+  if (!rbac) return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })
+  const replayRbac = rbac
 
   try {
     const ctx = await createRuntimeContext(container, auth, req)
+    ctx.replayTransactionGuard = ({ logEntry, transactionalEm }) =>
+      authorizeAuditReplayWithEntityManager(transactionalEm, replayRbac, logEntry, {
+        auth,
+        organizationId,
+        selfFeature: 'audit_logs.undo_self',
+        tenantFeature: 'audit_logs.undo_tenant',
+        unavailableMessage: 'Undo token not available',
+      })
     await commandBus.undo(undoToken, ctx)
     return NextResponse.json({ ok: true, logId: target.id })
   } catch (err) {

package/src/modules/audit_logs/data/validators.ts

@@ -36,6 +36,7 @@ export const actionLogCreateSchema = baseScopeSchema.extend({
 export const actionLogListSchema = z.object({
   tenantId: uuid.optional(),
   organizationId: uuid.optional(),
+  actorSubject: z.union([uuid, z.string().regex(/^api_key:[0-9a-fA-F-]{36}$/)]).optional(),
   actorUserId: uuid.optional(),
   actorUserIds: z.array(uuid).optional(),
   undoableOnly: z.boolean().optional(),

package/src/modules/audit_logs/lib/actorSubject.ts

@@ -0,0 +1,82 @@
+import type { CommandUndoLogEntry } from '@open-mercato/shared/lib/commands'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+
+export const ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY = 'actorSubject'
+export const API_KEY_ACTOR_PREFIX = 'api_key:'
+
+const UUID_PATTERN = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/
+
+export type CanonicalActorSubject = {
+  kind: 'api_key' | 'user'
+  storageId: string
+  subject: string
+}
+
+export function canonicalizeActorSubject(value: unknown): CanonicalActorSubject | null {
+  if (typeof value !== 'string') return null
+  const candidate = value.trim()
+  if (!candidate) return null
+  if (candidate.startsWith(API_KEY_ACTOR_PREFIX)) {
+    const storageId = candidate.slice(API_KEY_ACTOR_PREFIX.length)
+    if (!UUID_PATTERN.test(storageId)) return null
+    return { kind: 'api_key', storageId, subject: `${API_KEY_ACTOR_PREFIX}${storageId}` }
+  }
+  if (!UUID_PATTERN.test(candidate)) return null
+  return { kind: 'user', storageId: candidate, subject: candidate }
+}
+
+export function resolveActionLogActorSubject(
+  log: Pick<CommandUndoLogEntry, 'actorUserId' | 'contextJson'>,
+): string | null {
+  const storedActor = canonicalizeActorSubject(log.actorUserId)
+  const storedSubject = storedActor?.kind === 'user'
+    ? storedActor.subject
+    : typeof log.actorUserId === 'string' && log.actorUserId.length > 0 && !log.actorUserId.startsWith(API_KEY_ACTOR_PREFIX)
+      ? log.actorUserId
+      : null
+  if (!storedSubject) return null
+  const contextSubject = log.contextJson?.[ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY]
+  if (contextSubject === undefined) return storedSubject
+  const canonicalContextSubject = canonicalizeActorSubject(contextSubject)
+  if (!canonicalContextSubject || canonicalContextSubject.storageId !== storedSubject) return null
+  return canonicalContextSubject.subject
+}
+
+export function actionLogBelongsToSubject(
+  log: Pick<CommandUndoLogEntry, 'actorUserId' | 'contextJson'>,
+  subject: unknown,
+): boolean {
+  const canonicalSubject = canonicalizeActorSubject(subject)
+  return Boolean(canonicalSubject && resolveActionLogActorSubject(log) === canonicalSubject.subject)
+}
+
+export function resolveCanonicalAuthSubject(auth: NonNullable<AuthContext>): CanonicalActorSubject | null {
+  const subject = canonicalizeActorSubject(auth.sub)
+  if (typeof auth.sub !== 'string' || auth.sub.length === 0) return null
+  if (auth.sub.startsWith(API_KEY_ACTOR_PREFIX)) {
+    if (!subject || subject.kind !== 'api_key') return null
+    const key = canonicalizeActorSubject(
+      typeof auth.keyId === 'string' ? `${API_KEY_ACTOR_PREFIX}${auth.keyId}` : null,
+    )
+    if (auth.isApiKey !== true || !key || key.subject !== subject.subject) return null
+    return subject
+  }
+  if (auth.isApiKey === true || auth.keyId !== undefined) return null
+  return subject ?? { kind: 'user', storageId: auth.sub, subject: auth.sub }
+}
+
+export function actionLogBelongsToAuth(
+  log: Pick<CommandUndoLogEntry, 'actorUserId' | 'contextJson'>,
+  auth: NonNullable<AuthContext>,
+): boolean {
+  const authSubject = resolveCanonicalAuthSubject(auth)
+  if (!authSubject) return false
+  const contextSubject = log.contextJson?.[ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY]
+  if (contextSubject !== undefined) {
+    return actionLogBelongsToSubject(log, authSubject.subject)
+  }
+  if (authSubject.kind === 'api_key') {
+    return log.actorUserId === authSubject.storageId
+  }
+  return log.actorUserId === authSubject.subject
+}

package/src/modules/audit_logs/lib/replayAuthorization.ts

@@ -0,0 +1,61 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { CommandUndoLogEntry } from '@open-mercato/shared/lib/commands'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import {
+  actionLogBelongsToAuth,
+  resolveCanonicalAuthSubject,
+} from '@open-mercato/core/modules/audit_logs/lib/actorSubject'
+
+type ReplayAuthorizationInput = {
+  auth: NonNullable<AuthContext>
+  organizationId: string | null
+  selfFeature: string
+  tenantFeature: string
+  unavailableMessage: string
+}
+
+export async function authorizeAuditReplayWithEntityManager(
+  em: EntityManager,
+  rbac: RbacService,
+  log: CommandUndoLogEntry,
+  input: ReplayAuthorizationInput,
+): Promise<void> {
+  if (!resolveCanonicalAuthSubject(input.auth)) {
+    throw new CrudHttpError(400, { error: input.unavailableMessage })
+  }
+  const scope = {
+    tenantId: input.auth.tenantId ?? null,
+    organizationId: input.organizationId,
+  }
+  const canReplaySelf = await rbac.userHasAllFeaturesWithEntityManager(
+    em,
+    input.auth.sub,
+    [input.selfFeature],
+    scope,
+  )
+  const canReplayTenant = await rbac.userHasAllFeaturesWithEntityManager(
+    em,
+    input.auth.sub,
+    [input.tenantFeature],
+    scope,
+  )
+  const unavailable = () => new CrudHttpError(400, { error: input.unavailableMessage })
+
+  if (!canReplaySelf) throw unavailable()
+  if (log.actorUserId && !actionLogBelongsToAuth(log, input.auth) && !canReplayTenant) {
+    throw unavailable()
+  }
+  if (log.tenantId && log.tenantId !== (input.auth.tenantId ?? null)) {
+    throw unavailable()
+  }
+
+  const scopedOrganizationId = canReplayTenant
+    ? input.organizationId
+    : input.organizationId ?? input.auth.orgId ?? null
+  const organizationMismatch = canReplayTenant
+    ? Boolean(log.organizationId && scopedOrganizationId && log.organizationId !== scopedOrganizationId)
+    : Boolean(log.organizationId && log.organizationId !== scopedOrganizationId)
+  if (organizationMismatch) throw unavailable()
+}

package/src/modules/audit_logs/services/actionLogService.ts

@@ -1,4 +1,4 @@
-import type { FilterQuery } from '@mikro-orm/core'
+import { raw, type FilterQuery } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { sql } from 'kysely'
 import { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
@@ -22,6 +22,11 @@ import {
 } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { toOptionalString } from '@open-mercato/shared/lib/string/coerce'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY,
+  actionLogBelongsToSubject,
+  canonicalizeActorSubject,
+} from '@open-mercato/core/modules/audit_logs/lib/actorSubject'
 
 const logger = createLogger('audit_logs').child({ component: 'action-log-service' })
 
@@ -39,7 +44,6 @@ const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][
 // max UUIDs — and is used only when the zod runtime is unavailable, so the actor
 // sanitizer can never reject a value `actionLogCreateSchema` would have accepted.
 export const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/
-const API_KEY_ACTOR_PREFIX = 'api_key:'
 const SYSTEM_ACTOR_PREFIX = 'system:'
 // `context.systemActor` names the automated principal behind an entry; `context.source`
 // (read by `deriveActionLogSource`) names the channel it arrived through. They are
@@ -47,6 +51,10 @@ const SYSTEM_ACTOR_PREFIX = 'system:'
 // has a null actor column, which already derives the `system` source.
 const SYSTEM_ACTOR_CONTEXT_KEY = 'systemActor'
 const SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255
+const REPLAY_QUERY_BATCH_SIZE = 100
+export const REPLAY_ENCRYPTED_SCAN_MAX_PAGES = 10
+
+type ApiKeyReplayEntryKind = 'canonical' | 'legacy' | 'invalid'
 
 function toNullableUuid(value: unknown): string | null {
   return typeof value === 'string' && UUID_REGEX.test(value) ? value : null
@@ -70,13 +78,8 @@ function readActorCandidate(value: unknown): string | null {
 }
 
 function normalizeActorUserId(value: unknown): string | null {
-  const candidate = readActorCandidate(value)
-  if (!candidate) return null
-  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX)
-    ? candidate.slice(API_KEY_ACTOR_PREFIX.length)
-    : candidate
-
-  return isSchemaUuid(unwrapped) ? unwrapped : null
+  const canonical = canonicalizeActorSubject(value)
+  return canonical && isSchemaUuid(canonical.storageId) ? canonical.storageId : null
 }
 
 function toSystemActorReference(candidate: string): string | null {
@@ -197,6 +200,7 @@ export class ActionLogService {
         entry,
         tenantId,
         organizationId,
+        { em: this.em },
       )
 
       const merged = {
@@ -242,11 +246,17 @@ export class ActionLogService {
     }
   }
 
-  async log(input: ActionLogCreateInput): Promise<ActionLog | null> {
+  private async decryptDetachedEntry(entry: ActionLog): Promise<ActionLog> {
+    const detached = { ...(entry as unknown as Record<string, unknown>) }
+    return await this.decryptEntryPayload(detached) as unknown as ActionLog
+  }
+
+  async log(input: ActionLogCreateInput, transactionalEm?: EntityManager): Promise<ActionLog | null> {
     const data = this.parseCreateInput(input)
-    const fork = this.em.fork()
-    const log = this.createLogEntity(fork, data)
-    await fork.persist(log).flush()
+    const operationEm = transactionalEm ?? this.em.fork()
+    const log = this.createLogEntity(operationEm, data)
+    await operationEm.persist(log).flush()
+    if (transactionalEm) return this.decryptDetachedEntry(log)
     await this.decryptEntries(log)
     return log
   }
@@ -280,14 +290,18 @@ export class ActionLogService {
   private sanitizeActor(input: ActionLogCreateInput): ActionLogCreateInput {
     if (!input) return input
     const candidate = readActorCandidate(input.actorUserId)
-    const actorUserId = normalizeActorUserId(candidate)
+    const actor = canonicalizeActorSubject(candidate)
+    const actorUserId = actor?.storageId ?? null
     const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null
 
-    if (!systemActorReference) {
-      if (actorUserId === (input.actorUserId ?? null)) return input
-      return { ...input, actorUserId }
+    if (actor) {
+      const context = isRecord(input.context) ? { ...input.context } : {}
+      context[ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY] = actor.subject
+      return { ...input, actorUserId, context }
     }
 
+    if (!systemActorReference) return { ...input, actorUserId: null }
+
     const context = isRecord(input.context) ? { ...input.context } : {}
     if (context[SYSTEM_ACTOR_CONTEXT_KEY] === undefined) {
       context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference
@@ -456,9 +470,14 @@ export class ActionLogService {
     await this.decryptEntries(results)
 
     const byId = new Map(results.map((entry: any) => [entry.id, entry]))
-    return ids
+    const entries = ids
       .map((id: any) => byId.get(id))
       .filter((entry: any): entry is ActionLog => Boolean(entry))
+    const apiKeyActor = parsed.actorSubject ? canonicalizeActorSubject(parsed.actorSubject) : null
+    if (apiKeyActor?.kind !== 'api_key') return entries
+    return entries.filter((entry: ActionLog) => (
+      this.classifyApiKeyReplayEntry(entry, apiKeyActor.subject) !== 'invalid'
+    ))
   }
 
   private buildListQuery(parsed: ActionLogListQuery): any {
@@ -470,6 +489,25 @@ export class ActionLogService {
     if (parsed.tenantId) query = query.where('action_logs.tenant_id', '=', parsed.tenantId)
     if (parsed.organizationId) query = query.where('action_logs.organization_id', '=', parsed.organizationId)
 
+    if (parsed.actorSubject) {
+      const actor = canonicalizeActorSubject(parsed.actorSubject)
+      if (!actor) return query.where(sql<boolean>`false`)
+      query = query.where('action_logs.actor_user_id', '=', actor.storageId)
+      if (actor.kind === 'api_key') {
+        query = query.where(sql<boolean>`(
+          action_logs.context_json is null
+          or jsonb_typeof(action_logs.context_json) = 'string'
+          or (
+            jsonb_typeof(action_logs.context_json) = 'object'
+            and (
+              not jsonb_exists(action_logs.context_json, ${ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY})
+              or action_logs.context_json ->> ${ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY} = ${actor.subject}
+            )
+          )
+        )`)
+      }
+    }
+
     const actorUserIds = this.resolveActorUserIds(parsed)
     if (actorUserIds.length === 1) query = query.where('action_logs.actor_user_id', '=', actorUserIds[0])
     if (actorUserIds.length > 1) query = query.where('action_logs.actor_user_id', 'in', actorUserIds)
@@ -562,23 +600,116 @@ export class ActionLogService {
     return { items, total, page, pageSize, totalPages }
   }
 
+  private classifyApiKeyReplayEntry(entry: ActionLog, actorSubject: string): ApiKeyReplayEntryKind {
+    if (entry.contextJson === null || entry.contextJson === undefined) return 'legacy'
+    if (!isRecord(entry.contextJson)) return 'invalid'
+    if (!Object.prototype.hasOwnProperty.call(entry.contextJson, ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY)) {
+      return 'legacy'
+    }
+    return actionLogBelongsToSubject(entry, actorSubject) ? 'canonical' : 'invalid'
+  }
+
+  private async findLatestReplayEntry(
+    actorUserId: string,
+    filter: Record<string, unknown>,
+    orderField: 'createdAt' | 'updatedAt',
+  ): Promise<ActionLog | null> {
+    const actor = canonicalizeActorSubject(actorUserId)
+    if (!actor) return null
+    const where: Record<string, unknown> = {
+      actorUserId: actor.storageId,
+      ...filter,
+    }
+    const orderBy = orderField === 'createdAt'
+      ? { createdAt: 'desc' as const, id: 'desc' as const }
+      : { updatedAt: 'desc' as const, id: 'desc' as const }
+
+    if (actor.kind === 'user') {
+      const entry = await this.em.findOne(ActionLog, where as FilterQuery<ActionLog>, { orderBy })
+      await this.decryptEntries(entry)
+      return entry
+    }
+
+    if (this.tenantEncryptionService?.isEnabled()) {
+      let legacyEntry: ActionLog | null = null
+      let cursor: { id: string; orderedAt: Date } | null = null
+      for (let pageIndex = 0; ; pageIndex += 1) {
+        if (pageIndex >= REPLAY_ENCRYPTED_SCAN_MAX_PAGES) {
+          logger.warn('Stopped encrypted API-key replay scan at the page limit', {
+            maxRows: REPLAY_ENCRYPTED_SCAN_MAX_PAGES * REPLAY_QUERY_BATCH_SIZE,
+            hasLegacyFallback: legacyEntry !== null,
+          })
+          return legacyEntry
+        }
+        const pageWhere: Record<string, unknown> = cursor
+          ? {
+              $and: [
+                where,
+                {
+                  $or: [
+                    { [orderField]: { $lt: cursor.orderedAt } },
+                    { [orderField]: cursor.orderedAt, id: { $lt: cursor.id } },
+                  ],
+                },
+              ],
+            }
+          : where
+        const entries: ActionLog[] = await this.em.find(ActionLog, pageWhere as FilterQuery<ActionLog>, {
+          limit: REPLAY_QUERY_BATCH_SIZE,
+          orderBy,
+        })
+        await this.decryptEntries(entries)
+        for (const entry of entries) {
+          const entryKind = this.classifyApiKeyReplayEntry(entry, actor.subject)
+          if (entryKind === 'canonical') return entry
+          if (entryKind === 'legacy' && !legacyEntry) legacyEntry = entry
+        }
+        if (entries.length < REPLAY_QUERY_BATCH_SIZE) return legacyEntry
+        const lastEntry: ActionLog | undefined = entries.at(-1)
+        if (!lastEntry) return legacyEntry
+        cursor = {
+          id: String(lastEntry.id),
+          orderedAt: orderField === 'createdAt' ? lastEntry.createdAt : lastEntry.updatedAt,
+        }
+      }
+    }
+
+    const canonicalEntry = await this.em.findOne(ActionLog, {
+      ...where,
+      [raw(`"context_json" ->> '${ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY}'`)]: actor.subject,
+    } as FilterQuery<ActionLog>, { orderBy })
+    if (canonicalEntry) {
+      await this.decryptEntries(canonicalEntry)
+      return this.classifyApiKeyReplayEntry(canonicalEntry, actor.subject) === 'canonical'
+        ? canonicalEntry
+        : null
+    }
+
+    const legacyEntry = await this.em.findOne(ActionLog, {
+      ...where,
+      [raw(`("context_json" is null or (jsonb_typeof("context_json") = 'object' and not jsonb_exists("context_json", '${ACTION_LOG_ACTOR_SUBJECT_CONTEXT_KEY}')))`)]: true,
+    } as FilterQuery<ActionLog>, { orderBy })
+    await this.decryptEntries(legacyEntry)
+    return legacyEntry && this.classifyApiKeyReplayEntry(legacyEntry, actor.subject) === 'legacy'
+      ? legacyEntry
+      : null
+  }
+
   async latestUndoableForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {
-    const where: FilterQuery<ActionLog> = {
-      actorUserId,
-      undoToken: { $ne: null } as any,
+    const where: Record<string, unknown> = {
+      undoToken: { $ne: null },
       executionState: 'done',
       deletedAt: null,
     }
     if (scope.tenantId) where.tenantId = scope.tenantId
     if (scope.organizationId) where.organizationId = scope.organizationId
 
-    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })
-    await this.decryptEntries(entry)
-    return entry
+    return this.findLatestReplayEntry(actorUserId, where, 'createdAt')
   }
 
-  async claimForUndo(id: string): Promise<boolean> {
-    const affected = await this.em.nativeUpdate(
+  async claimForUndo(id: string, transactionalEm?: EntityManager): Promise<boolean> {
+    const operationEm = transactionalEm ?? this.em
+    const affected = await operationEm.nativeUpdate(
       ActionLog,
       { id, executionState: 'done', deletedAt: null },
       { executionState: 'undoing' },
@@ -586,8 +717,9 @@ export class ActionLogService {
     return affected === 1
   }
 
-  async releaseUndoClaim(id: string): Promise<boolean> {
-    const affected = await this.em.nativeUpdate(
+  async releaseUndoClaim(id: string, transactionalEm?: EntityManager): Promise<boolean> {
+    const operationEm = transactionalEm ?? this.em
+    const affected = await operationEm.nativeUpdate(
       ActionLog,
       { id, executionState: 'undoing', deletedAt: null },
       { executionState: 'done' },
@@ -595,20 +727,21 @@ export class ActionLogService {
     return affected === 1
   }
 
-  async markUndone(id: string, traceInput?: ActionLogCreateInput) {
-    const fork = this.em.fork()
-    const log = await fork.findOne(ActionLog, { id, deletedAt: null })
+  async markUndone(id: string, traceInput?: ActionLogCreateInput, transactionalEm?: EntityManager) {
+    const operationEm = transactionalEm ?? this.em.fork()
+    const log = await operationEm.findOne(ActionLog, { id, deletedAt: null })
     if (!log) return null
 
     log.executionState = 'undone'
     log.undoToken = null
 
-    const traceLog = traceInput ? this.createLogEntity(fork, this.parseCreateInput(traceInput)) : null
+    const traceLog = traceInput ? this.createLogEntity(operationEm, this.parseCreateInput(traceInput)) : null
     if (traceLog) {
-      fork.persist(traceLog)
+      operationEm.persist(traceLog)
     }
 
-    await fork.flush()
+    await operationEm.flush()
+    if (transactionalEm) return this.decryptDetachedEntry(log)
     await this.decryptEntries(log)
     if (traceLog) await this.decryptEntries(traceLog)
 
@@ -634,9 +767,8 @@ export class ActionLogService {
     resourceKind?: string | null
     resourceId?: string | null
   }) {
-    const where: FilterQuery<ActionLog> = {
-      actorUserId: params.actorUserId,
-      undoToken: { $ne: null } as any,
+    const where: Record<string, unknown> = {
+      undoToken: { $ne: null },
       executionState: 'done',
       deletedAt: null,
     }
@@ -645,35 +777,47 @@ export class ActionLogService {
     if (params.resourceKind) where.resourceKind = params.resourceKind
     if (params.resourceId) where.resourceId = params.resourceId
 
-    const entry = await this.em.findOne(ActionLog, where, { orderBy: { createdAt: 'desc' } })
-    await this.decryptEntries(entry)
-    return entry
+    return this.findLatestReplayEntry(params.actorUserId, where, 'createdAt')
   }
 
   async latestUndoneForActor(actorUserId: string, scope: { tenantId?: string | null; organizationId?: string | null }) {
-    const where: FilterQuery<ActionLog> = {
-      actorUserId,
+    const where: Record<string, unknown> = {
       executionState: 'undone',
       deletedAt: null,
     }
     if (scope.tenantId) where.tenantId = scope.tenantId
     if (scope.organizationId) where.organizationId = scope.organizationId
 
-    const entry = await this.em.findOne(ActionLog, where, { orderBy: { updatedAt: 'desc' } })
-    await this.decryptEntries(entry)
-    return entry
+    return this.findLatestReplayEntry(actorUserId, where, 'updatedAt')
   }
 
   async markRedone(id: string) {
-    const log = await this.em.findOne(ActionLog, { id, deletedAt: null })
+    const operationEm = this.em.fork()
+    const log = await operationEm.findOne(ActionLog, { id, deletedAt: null })
     if (!log) return null
 
     log.executionState = 'redone'
     log.undoToken = null
-    await this.em.flush()
+    await operationEm.flush()
     return log
   }
 
+  /**
+   * Compare-and-set the source of a redo from `undone` to its final `redone`
+   * state. When supplied, `transactionalEm` is the same EntityManager used by
+   * the replayed command and its new action log, so a later failure restores
+   * the source row to `undone` automatically.
+   */
+  async claimForRedo(id: string, transactionalEm?: EntityManager): Promise<boolean> {
+    const operationEm = transactionalEm ?? this.em
+    const affected = await operationEm.nativeUpdate(
+      ActionLog,
+      { id, executionState: 'undone', deletedAt: null },
+      { executionState: 'redone', undoToken: null },
+    )
+    return affected === 1
+  }
+
   async backfillProjections(options: ActionLogProjectionBackfillOptions = {}): Promise<ActionLogProjectionBackfillResult> {
     const batchSize = Math.min(Math.max(Math.trunc(options.batchSize ?? 250), 1), 1000)
     const logger = options.logger ?? (() => {})

package/src/modules/auth/api/features.ts

@@ -70,7 +70,7 @@ export async function GET(req: Request) {
   const moduleInfo = new Map<string, { id: string; title: string }>()
   for (const m of modules) {
     if (m.id) {
-      moduleInfo.set(m.id, { id: m.id, title: (m.info as any)?.title || m.id })
+      moduleInfo.set(m.id, { id: m.id, title: m.info?.title || m.info?.name || m.id })
     }
   }