@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/auth/commands/users.js

@@ -32,6 +32,10 @@ import {
 import { extractUndoPayload } from "@open-mercato/shared/lib/commands/undo";
 import { resolveRedoSnapshot } from "@open-mercato/shared/lib/commands/redo";
 import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
+import {
+  getTransactionLifetime,
+  onTransactionLifetimeComplete
+} from "@open-mercato/shared/lib/commands/transaction-lifetime";
 import { normalizeTenantId } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import { computeEmailHash, emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -49,10 +53,35 @@ import { normalizeDisplayNameInput } from "@open-mercato/core/modules/auth/lib/d
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import {
   assertActorCanAssignUserDestination,
+  assertActorCanAccessUserTarget,
+  assertActorCanGrantAcl,
+  assertActorCanGrantRoleTokens,
+  assertActorCanModifySuperAdminUserTarget,
   resolveUserDestinationRoles,
   throwUserDestinationOrganizationNotFound
 } from "@open-mercato/core/modules/auth/lib/grantChecks";
+import {
+  assertReplaySnapshotMatches,
+  denyCredentialReplay,
+  extractStoredReplayInput,
+  hasStoredPasswordInput,
+  lockReplayAuthorizationState,
+  rerunReplayTransactionGuardAfterLocks,
+  requireCurrentReplayFeature,
+  requireTransactionalReplayEntityManager
+} from "@open-mercato/core/modules/auth/lib/commandReplay";
+import { lockUserRoleWriterAuthorizationState } from "@open-mercato/core/modules/auth/lib/authorizationStateLocks";
 const logger = createLogger("auth").child({ component: "users-commands" });
+const USER_REDO_LOG = /* @__PURE__ */ Symbol("auth.users.redoLog");
+const replayProtectedRoleIdsByTenant = /* @__PURE__ */ new WeakMap();
+function withUserRedoLog(ctx, logEntry) {
+  return { ...ctx, [USER_REDO_LOG]: logEntry };
+}
+function resolveCommandEm(ctx, forkWhenUnbound = false) {
+  if (ctx.transactionalEm) return ctx.transactionalEm;
+  const em = ctx.container.resolve("em");
+  return forkWhenUnbound ? em.fork() : em;
+}
 function resolveActorTenantScope(ctx) {
   if (ctx.systemActor === true) return null;
   const auth = ctx.auth;
@@ -122,7 +151,7 @@ async function notifyRoleChanges(ctx, user, assignedRoles, revokedRoles) {
   const tenantId = user.tenantId ? String(user.tenantId) : null;
   if (!tenantId) return;
   const organizationId = user.organizationId ? String(user.organizationId) : null;
-  try {
+  const createNotifications = async () => {
     const notificationService = resolveNotificationService(ctx.container);
     if (assignedRoles.length) {
       const assignedType = notificationTypes.find((type) => type.type === "auth.role.assigned");
@@ -146,15 +175,31 @@ async function notifyRoleChanges(ctx, user, assignedRoles, revokedRoles) {
         await notificationService.create(notificationInput, { tenantId, organizationId });
       }
     }
-  } catch (err) {
-    logger.error("Failed to create notification", { err });
+  };
+  const safelyCreateNotifications = async () => {
+    try {
+      await createNotifications();
+    } catch (err) {
+      logger.error("Failed to create notification", { err });
+    }
+  };
+  const transactionalEm = ctx.transactionalEm;
+  if (transactionalEm && getTransactionLifetime(transactionalEm)) {
+    onTransactionLifetimeComplete(transactionalEm, async (outcome) => {
+      if (outcome === "committed") await safelyCreateNotifications();
+    });
+    return;
   }
+  await safelyCreateNotifications();
 }
 const createUserCommand = {
   id: "auth.users.create",
+  atomicReplay: true,
+  stabilizeReplay: (params) => stabilizeUserReplay("create", params),
+  authorizeReplay: (params) => authorizeUserReplay("create", params),
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(createSchema, rawInput);
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const organization = await findOneWithDecryption(
       em,
       Organization,
@@ -194,7 +239,9 @@ const createUserCommand = {
     }
     let assignedRoles = [];
     if (Array.isArray(parsed.roles) && parsed.roles.length) {
-      await syncUserRoles(em, user, parsed.roles, tenantId);
+      await withAtomicFlush(em, [
+        async () => syncUserRoles(em, user, parsed.roles ?? [], tenantId)
+      ], { transaction: true, label: "auth.users.create.roles" });
       assignedRoles = await loadUserRoleNames(em, String(user.id));
     }
     await setCustomFieldsIfAny({
@@ -229,7 +276,7 @@ const createUserCommand = {
     return { user, warning };
   },
   captureAfter: async (_input, { user }, ctx) => {
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const roles = await loadUserRoleNames(em, String(user.id));
     const custom = await loadUserCustomSnapshot(
       em,
@@ -239,9 +286,9 @@ const createUserCommand = {
     );
     return serializeUser(user, roles, custom);
   },
-  buildLog: async ({ result: { user }, ctx }) => {
+  buildLog: async ({ input, result: { user }, ctx }) => {
     const { translate } = await resolveTranslations();
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const roles = await loadUserRoleNames(em, String(user.id));
     const custom = await loadUserCustomSnapshot(
       em,
@@ -250,7 +297,9 @@ const createUserCommand = {
       user.organizationId ? String(user.organizationId) : null
     );
     const snapshot = captureUserSnapshots(user, roles, void 0, custom);
+    const { password: _plaintextPassword, ...redoInput } = input;
     return {
+      redoInput,
       actionLabel: translate("auth.audit.users.create", "Create user"),
       resourceKind: "auth.user",
       resourceId: String(user.id),
@@ -259,23 +308,37 @@ const createUserCommand = {
       snapshotAfter: snapshot.view,
       payload: {
         undo: {
-          after: snapshot.undo
+          after: withoutPasswordHash(snapshot.undo)
         }
       }
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const userId = typeof logEntry?.resourceId === "string" ? logEntry.resourceId : null;
     if (!userId) return;
     const snapshot = logEntry?.snapshotAfter;
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
     let removed = null;
     await withAtomicFlush(em, [
       async () => {
+        await authorizeUserReplayAtMutation("create", {
+          operation: "undo",
+          input,
+          ctx,
+          logEntry
+        });
         const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null });
         const floorTenantId = current?.tenantId ? String(current.tenantId) : snapshot?.tenantId ?? null;
-        await enforceProtectedRoleFloor(em, floorTenantId, userId, { deleting: true }, ctx);
+        await enforceProtectedRoleFloor(
+          em,
+          floorTenantId,
+          userId,
+          { deleting: true },
+          ctx,
+          requireReplayProtectedRoleIds(em, floorTenantId)
+        );
+        await lockUserRoleWriterAuthorizationState(em, { userIds: [userId], roleIds: [] });
         await em.nativeDelete(UserAcl, { user: userId });
         await em.nativeDelete(UserRole, { user: userId });
         await em.nativeDelete(Session, { user: userId });
@@ -317,25 +380,33 @@ const createUserCommand = {
     });
     await invalidateUserCache(ctx, userId);
   },
-  // The create-undo hard-deletes the user, but the after-snapshot persists the
-  // original passwordHash (see captureUserSnapshots), so redo restores the row
-  // with the SAME id and the SAME hash — never fabricating credentials (#2506).
-  redo: async ({ logEntry, ctx }) => {
+  // Restores the original stable id (#2506). The after-snapshot deliberately
+  // carries no `passwordHash` (see buildLog), so a redone account comes back
+  // without a credential and needs a password reset — redo never fabricates one
+  // and never resurrects a hash from the audit log.
+  redo: async ({ input, logEntry, ctx }) => {
     const after = resolveRedoSnapshot(logEntry);
     if (!after) throw new CrudHttpError(400, { error: "[internal] redo snapshot unavailable for user create" });
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
     const emailHash = computeEmailHash(after.email);
-    let user = await findOneWithDecryption(em, User, { id: after.id }, {}, { tenantId: null, organizationId: null });
+    let user = null;
     await withAtomicFlush(em, [
       async () => {
+        await authorizeUserReplayAtMutation("create", {
+          operation: "redo",
+          input,
+          ctx,
+          logEntry
+        });
+        user = await findOneWithDecryption(em, User, { id: after.id }, {}, { tenantId: null, organizationId: null });
         if (user) {
           user.deletedAt = null;
           user.email = after.email;
           user.emailHash = emailHash;
           user.organizationId = after.organizationId ?? null;
           user.tenantId = after.tenantId ?? null;
-          user.passwordHash = after.passwordHash ?? null;
+          if ("passwordHash" in after) user.passwordHash = after.passwordHash ?? null;
           user.name = after.name ?? null;
           user.isConfirmed = after.isConfirmed;
           await em.flush();
@@ -355,6 +426,7 @@ const createUserCommand = {
           });
         }
         if (!user) return;
+        await lockUserRoleWriterAuthorizationState(em, { userIds: [after.id], roleIds: [] });
         await em.nativeDelete(UserRole, { user: after.id });
         await syncUserRoles(em, user, after.roles, after.tenantId);
         await restoreUserAcls(em, user, after.acls);
@@ -434,9 +506,12 @@ function isUniqueViolation(error) {
 }
 const updateUserCommand = {
   id: "auth.users.update",
+  atomicReplay: true,
+  stabilizeReplay: (params) => stabilizeUserReplay("update", params),
+  authorizeReplay: (params) => authorizeUserReplay("update", params),
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(updateSchema, rawInput);
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
     if (!existing) throw new CrudHttpError(404, { error: "User not found" });
     assertTargetTenantInScope(resolveActorTenantScope(ctx), existing.tenantId, "User not found");
@@ -452,7 +527,7 @@ const updateUserCommand = {
   },
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput);
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const actorTenantScope = resolveActorTenantScope(ctx);
     const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
     if (!existing) throw new CrudHttpError(404, { error: "User not found" });
@@ -531,10 +606,36 @@ const updateUserCommand = {
     let user;
     await withAtomicFlush(em, [
       async () => {
-        await enforceProtectedRoleFloor(em, userTenantId, parsed.id, {
+        const redoLogEntry = ctx[USER_REDO_LOG];
+        if (redoLogEntry) {
+          await authorizeUserReplayAtMutation("update", {
+            operation: "redo",
+            input: rawInput,
+            ctx,
+            logEntry: redoLogEntry
+          });
+        }
+        const destinationRoles = parsed.roles ? await Promise.all(parsed.roles.map((role) => resolveRole(em, role, targetTenantId))) : [];
+        const floorOptions = {
           deactivating: parsed.isConfirmed === false || isTenantChanging,
           newRoles: parsed.roles
-        }, ctx);
+        };
+        const protectedRoleIds = redoLogEntry ? requireReplayProtectedRoleIds(em, userTenantId) : await discoverProtectedRoleIds(em, userTenantId, floorOptions, ctx);
+        await lockUserRoleWriterAuthorizationState(em, {
+          userIds: [parsed.id],
+          roleIds: [
+            ...destinationRoles.filter((role) => role !== null).map((role) => String(role.id)),
+            ...protectedRoleIds
+          ]
+        });
+        await enforceProtectedRoleFloor(
+          em,
+          userTenantId,
+          parsed.id,
+          floorOptions,
+          ctx,
+          protectedRoleIds
+        );
         if (parsed.email !== void 0) {
           const duplicate = await findOneWithDecryption(
             em,
@@ -582,7 +683,13 @@ const updateUserCommand = {
           await em.nativeDelete(Session, { user: parsed.id });
         }
         if (Array.isArray(parsed.roles)) {
-          await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null);
+          await syncUserRoles(
+            em,
+            user,
+            parsed.roles,
+            user.tenantId ? String(user.tenantId) : tenantId ?? null,
+            { authorizationStateLocked: true }
+          );
         }
         await setCustomFieldsIfAny({
           dataEngine: de,
@@ -630,7 +737,7 @@ const updateUserCommand = {
     return user;
   },
   captureAfter: async (_input, result, ctx) => {
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const roles = await loadUserRoleNames(em, String(result.id));
     const custom = await loadUserCustomSnapshot(
       em,
@@ -640,12 +747,12 @@ const updateUserCommand = {
     );
     return serializeUser(result, roles, custom);
   },
-  buildLog: async ({ result, snapshots, ctx }) => {
+  buildLog: async ({ input, result, snapshots, ctx }) => {
     const { translate } = await resolveTranslations();
     const beforeSnapshots = snapshots.before;
     const before = beforeSnapshots?.view;
     const beforeUndo = beforeSnapshots?.undo ?? null;
-    const em = ctx.container.resolve("em").fork();
+    const em = resolveCommandEm(ctx, true);
     const afterRoles = await loadUserRoleNames(em, String(result.id));
     const afterCustom = await loadUserCustomSnapshot(
       em,
@@ -663,7 +770,9 @@ const updateUserCommand = {
     for (const [key, diff] of Object.entries(customDiff)) {
       changes[`cf_${key}`] = diff;
     }
+    const replayable = typeof input.password !== "string" || input.password.length === 0;
     return {
+      replayable,
       actionLabel: translate("auth.audit.users.update", "Update user"),
       resourceKind: "auth.user",
       resourceId: String(result.id),
@@ -672,61 +781,77 @@ const updateUserCommand = {
       changes,
       snapshotBefore: before ?? null,
       snapshotAfter: after,
-      payload: {
+      payload: replayable ? {
         undo: {
-          before: beforeUndo,
-          after: afterSnapshots.undo
+          before: withoutPasswordHash(beforeUndo),
+          after: withoutPasswordHash(afterSnapshots.undo)
         }
-      }
+      } : void 0
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const payload = extractUndoPayload(logEntry);
     const before = payload?.before;
     const after = payload?.after;
     if (!before) return;
     const userId = before.id;
-    const em = ctx.container.resolve("em");
+    const storedReplayInput = extractStoredReplayInput(logEntry.commandPayload, logEntry);
+    const replayInput = Object.keys(storedReplayInput).length ? storedReplayInput : deriveUserUpdateReplayInput(before, after ?? null);
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
     const restoredTenantId = before.tenantId ? String(before.tenantId) : null;
     let updated = null;
     await withAtomicFlush(em, [
       async () => {
+        await authorizeUserReplayAtMutation("update", {
+          operation: "undo",
+          input,
+          ctx,
+          logEntry
+        });
         const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null });
         const currentTenantId = current?.tenantId ? String(current.tenantId) : null;
-        await enforceProtectedRoleFloor(em, currentTenantId, userId, {
-          deactivating: before.isConfirmed === false || restoredTenantId !== currentTenantId,
-          newRoles: before.roles
-        }, ctx);
+        await enforceProtectedRoleFloor(
+          em,
+          currentTenantId,
+          userId,
+          {
+            deactivating: "isConfirmed" in replayInput && before.isConfirmed === false || "organizationId" in replayInput && restoredTenantId !== currentTenantId,
+            newRoles: Array.isArray(replayInput.roles) ? before.roles : void 0
+          },
+          ctx,
+          requireReplayProtectedRoleIds(em, currentTenantId)
+        );
         updated = await de.updateOrmEntity({
           entity: User,
           where: { id: userId, deletedAt: null },
           apply: (entity) => {
-            entity.email = before.email;
-            entity.organizationId = before.organizationId ?? null;
-            entity.tenantId = before.tenantId ?? null;
-            entity.passwordHash = before.passwordHash ?? null;
-            entity.name = before.name ?? null;
-            entity.isConfirmed = before.isConfirmed;
+            if ("email" in replayInput) entity.email = before.email;
+            if ("organizationId" in replayInput) {
+              entity.organizationId = before.organizationId ?? null;
+              entity.tenantId = before.tenantId ?? null;
+            }
+            if ("name" in replayInput) entity.name = before.name ?? null;
+            if ("isConfirmed" in replayInput) entity.isConfirmed = before.isConfirmed;
           }
         });
-        if (updated) {
+        if (updated && Array.isArray(replayInput.roles)) {
           await syncUserRoles(em, updated, before.roles, before.tenantId);
         }
+        const reset = buildCustomFieldResetMap(before.custom, after?.custom);
+        if (Object.keys(reset).length) {
+          await setCustomFieldsIfAny({
+            dataEngine: de,
+            entityId: E.auth.user,
+            recordId: before.id,
+            organizationId: before.organizationId ?? null,
+            tenantId: before.tenantId ?? null,
+            values: reset,
+            notify: false
+          });
+        }
       }
     ], { transaction: true, label: "auth.users.update.undo" });
-    const reset = buildCustomFieldResetMap(before.custom, after?.custom);
-    if (Object.keys(reset).length) {
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.user,
-        recordId: before.id,
-        organizationId: before.organizationId ?? null,
-        tenantId: before.tenantId ?? null,
-        values: reset,
-        notify: false
-      });
-    }
     await emitCrudUndoSideEffects({
       dataEngine: de,
       action: "updated",
@@ -740,13 +865,20 @@ const updateUserCommand = {
       indexer: userCrudIndexer
     });
     await invalidateUserCache(ctx, userId);
-  }
+  },
+  redo: ({ input, ctx, logEntry }) => updateUserCommand.execute(
+    input,
+    withUserRedoLog(ctx, logEntry)
+  )
 };
 const deleteUserCommand = {
   id: "auth.users.delete",
+  atomicReplay: true,
+  stabilizeReplay: (params) => stabilizeUserReplay("delete", params),
+  authorizeReplay: (params) => authorizeUserReplay("delete", params),
   async prepare(input, ctx) {
     const id = requireId(input, "User id required");
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
     if (!existing) return {};
     const actorTenantScope = resolveActorTenantScope(ctx);
@@ -766,7 +898,7 @@ const deleteUserCommand = {
   },
   async execute(input, ctx) {
     const id = requireId(input, "User id required");
-    const em = ctx.container.resolve("em");
+    const em = resolveCommandEm(ctx);
     const de = ctx.container.resolve("dataEngine");
     const actorTenantScope = resolveActorTenantScope(ctx);
     const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
@@ -779,8 +911,30 @@ const deleteUserCommand = {
     let user;
     await withAtomicFlush(em, [
       async () => {
+        const redoLogEntry = ctx[USER_REDO_LOG];
+        if (redoLogEntry) {
+          await authorizeUserReplayAtMutation("delete", {
+            operation: "redo",
+            input,
+            ctx,
+            logEntry: redoLogEntry
+          });
+        }
         const userTenantId = existing.tenantId ? String(existing.tenantId) : null;
-        await enforceProtectedRoleFloor(em, userTenantId, id, { deleting: true }, ctx);
+        const floorOptions = { deleting: true };
+        const protectedRoleIds = redoLogEntry ? requireReplayProtectedRoleIds(em, userTenantId) : await discoverProtectedRoleIds(em, userTenantId, floorOptions, ctx);
+        await lockUserRoleWriterAuthorizationState(em, {
+          userIds: [id],
+          roleIds: protectedRoleIds
+        });
+        await enforceProtectedRoleFloor(
+          em,
+          userTenantId,
+          id,
+          floorOptions,
+          ctx,
+          protectedRoleIds
+        );
         await em.nativeDelete(UserAcl, { user: id });
         await em.nativeDelete(UserRole, { user: id });
         await em.nativeDelete(Session, { user: id });
@@ -831,15 +985,22 @@ const deleteUserCommand = {
       }
     };
   },
-  undo: async ({ logEntry, ctx }) => {
+  undo: async ({ input, logEntry, ctx }) => {
     const payload = extractUndoPayload(logEntry);
     const before = payload?.before;
     if (!before) return;
-    const em = ctx.container.resolve("em");
-    let user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null });
+    const em = resolveCommandEm(ctx);
+    let user = null;
     const de = ctx.container.resolve("dataEngine");
     await withAtomicFlush(em, [
       async () => {
+        await authorizeUserReplayAtMutation("delete", {
+          operation: "undo",
+          input,
+          ctx,
+          logEntry
+        });
+        user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null });
         if (user) {
           if (user.deletedAt) {
             user.deletedAt = null;
@@ -866,6 +1027,7 @@ const deleteUserCommand = {
           });
         }
         if (!user) return;
+        await lockUserRoleWriterAuthorizationState(em, { userIds: [before.id], roleIds: [] });
         await em.nativeDelete(UserRole, { user: before.id });
         await syncUserRoles(em, user, before.roles, before.tenantId);
         await restoreUserAcls(em, user, before.acls);
@@ -884,8 +1046,269 @@ const deleteUserCommand = {
       }
     ], { transaction: true });
     await invalidateUserCache(ctx, before.id);
-  }
+  },
+  redo: ({ input, ctx, logEntry }) => deleteUserCommand.execute(
+    input,
+    withUserRedoLog(ctx, logEntry)
+  )
 };
+function withoutPasswordHash(snapshot) {
+  if (!snapshot) return null;
+  const safeSnapshot = { ...snapshot };
+  delete safeSnapshot.passwordHash;
+  return safeSnapshot;
+}
+function normalizeUserAclSnapshots(acls) {
+  return acls.map((acl) => ({
+    ...acl,
+    features: acl.features ? [...acl.features].sort((left, right) => left.localeCompare(right)) : null,
+    organizations: acl.organizations ? [...acl.organizations].sort((left, right) => left.localeCompare(right)) : null
+  })).sort((left, right) => left.tenantId.localeCompare(right.tenantId));
+}
+function normalizeUserReplaySnapshot(snapshot) {
+  return withoutPasswordHash({
+    ...snapshot,
+    roles: [...snapshot.roles].sort((left, right) => left.localeCompare(right)),
+    acls: normalizeUserAclSnapshots(snapshot.acls)
+  });
+}
+function toUserUpdateReplayState(snapshot) {
+  return {
+    email: snapshot.email,
+    organizationId: snapshot.organizationId,
+    tenantId: snapshot.tenantId,
+    roles: [...snapshot.roles].sort((left, right) => left.localeCompare(right)),
+    name: snapshot.name,
+    isConfirmed: snapshot.isConfirmed,
+    ...snapshot.custom && Object.keys(snapshot.custom).length ? { custom: snapshot.custom } : {}
+  };
+}
+function deriveUserUpdateReplayInput(before, after) {
+  if (!before) return {};
+  if (!after) {
+    return {
+      id: before.id,
+      email: before.email,
+      organizationId: before.organizationId,
+      name: before.name,
+      isConfirmed: before.isConfirmed,
+      roles: before.roles
+    };
+  }
+  const input = { id: after.id };
+  if (before.email !== after.email) input.email = after.email;
+  if (before.organizationId !== after.organizationId || before.tenantId !== after.tenantId) {
+    input.organizationId = after.organizationId;
+  }
+  if (before.name !== after.name) input.name = after.name;
+  if (before.isConfirmed !== after.isConfirmed) input.isConfirmed = after.isConfirmed;
+  if (!arrayEquals(before.roles, after.roles)) input.roles = after.roles;
+  return input;
+}
+function isSelfProfileReplay(input, ctx, userId) {
+  if (!ctx.auth?.sub || ctx.auth.sub !== userId) return false;
+  const allowedKeys = /* @__PURE__ */ new Set(["id", "email", "password"]);
+  return Object.keys(input).every((key) => allowedKeys.has(key) || input[key] === void 0);
+}
+async function authorizeUserReplay(commandKind, params) {
+  const { operation, ctx, logEntry } = params;
+  const undoPayload = extractUndoPayload(logEntry);
+  const before = undoPayload?.before ?? null;
+  const after = undoPayload?.after ?? null;
+  const passwordHashChanged = Boolean(
+    commandKind === "update" && before && after && "passwordHash" in before && "passwordHash" in after && before.passwordHash !== after.passwordHash
+  );
+  const createdWithPassword = commandKind === "create" && Boolean(
+    hasStoredPasswordInput(params.input, logEntry) || after && typeof after.passwordHash === "string" && after.passwordHash.length > 0
+  );
+  if (createdWithPassword || commandKind === "update" && (hasStoredPasswordInput(params.input, logEntry) || passwordHashChanged)) {
+    await denyCredentialReplay();
+  }
+  const userId = logEntry.resourceId ?? before?.id ?? after?.id ?? null;
+  if (!userId) {
+    await assertReplaySnapshotMatches(null, { required: "user replay snapshot" });
+    return;
+  }
+  const storedReplayInput = extractStoredReplayInput(params.input, logEntry);
+  const replayInput = Object.keys(storedReplayInput).length ? storedReplayInput : deriveUserUpdateReplayInput(before, after);
+  const requiredFeature = commandKind === "create" ? operation === "undo" ? "auth.users.delete" : "auth.users.create" : commandKind === "delete" ? operation === "undo" ? "auth.users.create" : "auth.users.delete" : "auth.users.edit";
+  const em = requireTransactionalReplayEntityManager(ctx);
+  if (commandKind !== "update" || !isSelfProfileReplay(replayInput, ctx, userId)) {
+    await requireCurrentReplayFeature(ctx, requiredFeature);
+  }
+  const currentUser = await findOneWithDecryption(
+    em,
+    User,
+    { id: userId, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null }
+  );
+  const rbacService = ctx.systemActor === true ? null : ctx.container.resolve("rbacService");
+  if (rbacService && currentUser) {
+    const allowedIds = ctx.organizationScope?.allowedIds ?? ctx.organizationIds ?? (ctx.auth?.orgId ? [ctx.auth.orgId] : null);
+    await assertActorCanAccessUserTarget({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null,
+      organizationScope: { allowedIds },
+      targetUserId: userId
+    });
+    await assertActorCanModifySuperAdminUserTarget({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null,
+      targetUserId: userId
+    });
+  }
+  let currentSnapshot = null;
+  if (currentUser) {
+    const currentTenantId = currentUser.tenantId ? String(currentUser.tenantId) : null;
+    const currentOrganizationId = currentUser.organizationId ? String(currentUser.organizationId) : null;
+    const [roles, acls, custom] = await Promise.all([
+      loadUserRoleNames(em, userId),
+      loadUserAclSnapshots(em, userId),
+      loadUserCustomSnapshot(em, userId, currentTenantId, currentOrganizationId)
+    ]);
+    currentSnapshot = captureUserSnapshots(currentUser, roles, acls, custom).undo;
+  }
+  const expectedCurrent = operation === "undo" ? commandKind === "create" ? after : commandKind === "update" ? after : null : commandKind === "create" ? null : before;
+  if (commandKind === "update") {
+    if (!currentSnapshot || !expectedCurrent) {
+      await assertReplaySnapshotMatches(currentSnapshot, expectedCurrent);
+    } else {
+      await assertReplaySnapshotMatches(
+        toUserUpdateReplayState(currentSnapshot),
+        toUserUpdateReplayState(expectedCurrent)
+      );
+    }
+  } else {
+    await assertReplaySnapshotMatches(
+      currentSnapshot ? normalizeUserReplaySnapshot(currentSnapshot) : null,
+      expectedCurrent ? normalizeUserReplaySnapshot(expectedCurrent) : null
+    );
+  }
+  const desiredState = operation === "undo" ? commandKind === "create" ? null : before : commandKind === "delete" ? null : after;
+  if (!desiredState || !rbacService) return;
+  const restoresMembership = commandKind !== "update" || Array.isArray(replayInput.roles) || "organizationId" in replayInput;
+  if (restoresMembership) {
+    const roles = await assertActorCanGrantRoleTokens({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: desiredState.tenantId,
+      organizationId: desiredState.organizationId,
+      roleTokens: desiredState.roles
+    });
+    await assertActorCanAssignUserDestination({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: ctx.auth?.tenantId ?? null,
+      organizationId: ctx.auth?.orgId ?? null,
+      allowedOrganizationIds: ctx.organizationScope?.allowedIds ?? ctx.organizationIds,
+      destinationTenantId: desiredState.tenantId,
+      destinationOrganizationId: desiredState.organizationId,
+      roles
+    });
+  }
+  const restoresAcls = commandKind !== "update" && desiredState.acls.length > 0;
+  if (!restoresAcls) return;
+  await requireCurrentReplayFeature(ctx, "auth.acl.manage");
+  for (const acl of desiredState.acls) {
+    await assertActorCanGrantAcl({
+      em,
+      rbacService,
+      requireBoundRbac: true,
+      actorUserId: ctx.auth?.sub,
+      tenantId: acl.tenantId,
+      organizationId: desiredState.organizationId,
+      features: acl.features,
+      isSuperAdmin: acl.isSuperAdmin,
+      organizations: acl.organizations
+    });
+  }
+}
+async function authorizeUserReplayAtMutation(commandKind, params) {
+  const em = params.ctx.transactionalEm ?? params.ctx.container.resolve("em");
+  const boundParams = params.ctx.transactionalEm ? params : { ...params, ctx: { ...params.ctx, transactionalEm: em } };
+  await stabilizeUserReplay(commandKind, boundParams);
+  await rerunReplayTransactionGuardAfterLocks(boundParams, em);
+  await authorizeUserReplay(commandKind, boundParams);
+}
+async function stabilizeUserReplay(commandKind, params) {
+  const undoPayload = extractUndoPayload(params.logEntry);
+  const before = undoPayload?.before ?? null;
+  const after = undoPayload?.after ?? null;
+  const passwordHashChanged = Boolean(
+    commandKind === "update" && before && after && "passwordHash" in before && "passwordHash" in after && before.passwordHash !== after.passwordHash
+  );
+  const createdWithPassword = commandKind === "create" && Boolean(
+    hasStoredPasswordInput(params.input, params.logEntry) || after && typeof after.passwordHash === "string" && after.passwordHash.length > 0
+  );
+  if (createdWithPassword || commandKind === "update" && (hasStoredPasswordInput(params.input, params.logEntry) || passwordHashChanged)) {
+    await denyCredentialReplay();
+  }
+  const targetUserId = params.logEntry.resourceId ?? before?.id ?? after?.id ?? null;
+  const em = requireTransactionalReplayEntityManager(params.ctx);
+  const transactionLifetime = getTransactionLifetime(em);
+  if (!transactionLifetime) {
+    throw new Error("[internal] Replay protected-role locks require an explicit transaction lifetime");
+  }
+  const existingProtectedRoleIdsByTenant = replayProtectedRoleIdsByTenant.get(transactionLifetime);
+  const currentTarget = targetUserId ? await findOneWithDecryption(
+    em,
+    User,
+    { id: targetUserId },
+    {},
+    { tenantId: null, organizationId: null }
+  ) : null;
+  const currentTargetTenantId = normalizeTenantId(currentTarget?.tenantId) ?? null;
+  const relevantTenantIds = existingProtectedRoleIdsByTenant ? Array.from(existingProtectedRoleIdsByTenant.keys()).sort((left, right) => left.localeCompare(right)) : Array.from(new Set([
+    normalizeTenantId(params.ctx.auth?.tenantId) ?? null,
+    normalizeTenantId(before?.tenantId) ?? null,
+    normalizeTenantId(after?.tenantId) ?? null,
+    normalizeTenantId(params.logEntry.tenantId) ?? null,
+    currentTargetTenantId
+  ].filter((tenantId) => tenantId !== null))).sort((left, right) => left.localeCompare(right));
+  const protectedRoleIdsByTenant = new Map(existingProtectedRoleIdsByTenant ?? []);
+  if (!existingProtectedRoleIdsByTenant) {
+    for (const tenantId of relevantTenantIds) {
+      protectedRoleIdsByTenant.set(
+        tenantId,
+        await discoverProtectedRoleIds(em, tenantId, { deleting: true }, params.ctx)
+      );
+    }
+  }
+  const roleIds = [];
+  const seenRoleTokens = /* @__PURE__ */ new Set();
+  for (const snapshot of [before, after]) {
+    if (!snapshot?.tenantId) continue;
+    for (const token of snapshot.roles) {
+      const key = `${snapshot.tenantId}:${token}`;
+      if (seenRoleTokens.has(key)) continue;
+      seenRoleTokens.add(key);
+      const role = await resolveRole(em, token, snapshot.tenantId);
+      if (role?.id) roleIds.push(String(role.id));
+    }
+  }
+  await lockReplayAuthorizationState(em, params.ctx, {
+    targetUserIds: targetUserId ? [targetUserId] : [],
+    targetRoleIds: [
+      ...roleIds,
+      ...Array.from(protectedRoleIdsByTenant.values()).flat()
+    ],
+    targetTenantIds: relevantTenantIds
+  });
+  replayProtectedRoleIdsByTenant.set(transactionLifetime, protectedRoleIdsByTenant);
+}
 registerCommand(createUserCommand);
 registerCommand(updateUserCommand);
 registerCommand(deleteUserCommand);
@@ -900,7 +1323,8 @@ async function resolveRole(em, value, normalizedTenantId) {
   }
   return findOneWithDecryption(em, Role, { name: value, tenantId: normalizedTenantId }, {}, { tenantId: normalizedTenantId, organizationId: null });
 }
-async function syncUserRoles(em, user, desiredRoles, tenantId) {
+async function syncUserRoles(em, user, desiredRoles, tenantId, options = {}) {
+  const userId = String(user.id);
   const unique = Array.from(new Set(desiredRoles.map((role) => role.trim()).filter(Boolean)));
   const normalizedTenantId = normalizeTenantId(tenantId ?? null) ?? null;
   const resolvedRoles = [];
@@ -917,8 +1341,28 @@ async function syncUserRoles(em, user, desiredRoles, tenantId) {
     const labels = missingRoles.map((n) => `"${n}"`).join(", ");
     throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` });
   }
-  const desiredIds = new Set(resolvedRoles.map((r) => String(r.id)));
-  const currentLinks = await findWithDecryption(em, UserRole, { user }, {}, { tenantId: null, organizationId: null });
+  const discoveredLinks = await findWithDecryption(
+    em,
+    UserRole,
+    { user },
+    { orderBy: { id: "ASC" } },
+    { tenantId: null, organizationId: null }
+  );
+  const discoveredRoleIds = discoveredLinks.map((link) => String(link.role?.id ?? link.role ?? "")).filter(Boolean);
+  const desiredIds = new Set(resolvedRoles.map((role) => String(role.id)));
+  if (!options.authorizationStateLocked) {
+    await lockUserRoleWriterAuthorizationState(em, {
+      userIds: [userId],
+      roleIds: [...desiredIds, ...discoveredRoleIds]
+    });
+  }
+  const currentLinks = await findWithDecryption(
+    em,
+    UserRole,
+    { user },
+    { lockMode: LockMode.PESSIMISTIC_WRITE, orderBy: { id: "ASC" }, refresh: true },
+    { tenantId: null, organizationId: null }
+  );
   const currentRoleIds = new Map(
     currentLinks.map((link) => {
       const roleId = String(link.role?.id ?? link.role ?? "");
@@ -987,6 +1431,7 @@ async function loadUserAclSnapshots(em, userId) {
   }));
 }
 async function restoreUserAcls(em, user, acls) {
+  await lockUserRoleWriterAuthorizationState(em, { userIds: [String(user.id)], roleIds: [] });
   await em.nativeDelete(UserAcl, { user: String(user.id) });
   for (const acl of acls) {
     const entity = em.create(UserAcl, {
@@ -1045,12 +1490,41 @@ async function throwDuplicateEmailError() {
 function couldReduceActiveHolders(options) {
   return options.deleting === true || options.deactivating === true || options.newRoles !== void 0;
 }
-async function enforceProtectedRoleFloor(em, tenantId, userId, options, ctx) {
+async function discoverProtectedRoleIds(em, tenantId, options, ctx) {
+  if (ctx?.systemActor === true || !couldReduceActiveHolders(options)) return [];
+  const normalizedTenantId = normalizeTenantId(tenantId) ?? null;
+  if (!normalizedTenantId) return [];
+  const roles = await findWithDecryption(em, Role, {
+    tenantId: normalizedTenantId,
+    minActiveHolders: { $gt: 0 },
+    deletedAt: null
+  }, { orderBy: { id: "ASC" } }, { tenantId: normalizedTenantId, organizationId: null });
+  return roles.map((role) => String(role.id));
+}
+function requireReplayProtectedRoleIds(em, tenantId) {
+  const normalizedTenantId = normalizeTenantId(tenantId) ?? null;
+  if (!normalizedTenantId) return [];
+  const transactionLifetime = getTransactionLifetime(em);
+  const roleIds = transactionLifetime ? replayProtectedRoleIdsByTenant.get(transactionLifetime)?.get(normalizedTenantId) : void 0;
+  if (!roleIds) {
+    throw new Error(`[internal] Replay protected-role lock footprint is missing tenant ${normalizedTenantId}`);
+  }
+  return roleIds;
+}
+async function enforceProtectedRoleFloor(em, tenantId, userId, options, ctx, lockedProtectedRoleIds) {
   if (ctx?.systemActor === true) return;
   if (!couldReduceActiveHolders(options)) return;
   const normalizedTenantId = normalizeTenantId(tenantId) ?? null;
   if (!normalizedTenantId) return;
-  const protectedRoles = await findWithDecryption(em, Role, {
+  const protectedRoles = lockedProtectedRoleIds ? await findWithDecryption(em, Role, {
+    id: { $in: [...lockedProtectedRoleIds] },
+    tenantId: normalizedTenantId,
+    minActiveHolders: { $gt: 0 },
+    deletedAt: null
+  }, {
+    orderBy: { id: "ASC" },
+    refresh: true
+  }, { tenantId: normalizedTenantId, organizationId: null }) : await findWithDecryption(em, Role, {
     tenantId: normalizedTenantId,
     minActiveHolders: { $gt: 0 },
     deletedAt: null