@critical-path/core 0.24.0 → 0.26.0

package/dist/engine/index.js

@@ -7,7 +7,7 @@ import { DomainEventBus } from '../domain/events.js';
 import { validateAttachmentUrl } from '../domain/entities.js';
 import { validateCustomFieldValues } from '../domain/custom-fields.js';
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
-import { ValidationError, NotFoundError } from '../domain/errors.js';
+import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
 import { calculateCPM } from '../domain/cpm.js';
 import { buildTimelineLadder, aggregateConcreteEvidenceForTask } from '../domain/ladder.js';
 import { calculateTaskMetrics, reconstructTaskProgressHistory } from '../domain/metrics.js';
@@ -21,6 +21,8 @@ export class CriticalPathEngine {
     ready = Promise.resolve();
     /** The identity mutations are attributed to. Set only on views returned by `withActor`. */
     actor;
+    /** Set on internal views that keep the actor for attribution but skip authorization. */
+    authorizationBypassed;
     constructor(config = {}) {
         this.config = config;
         this.store = typeof config.store === 'object' && config.store !== null
@@ -53,6 +55,102 @@ export class CriticalPathEngine {
     actorIdOr(fallback) {
         return this.actor?.userId ?? fallback;
     }
+    // --- Authorization (applies only to withActor views; the base engine is trusted) ---
+    /**
+     * True when calls must be checked: on a withActor view (not an internal elevated view) with a
+     * policy or a tenant to enforce. Otherwise there is nothing to check, so lookups are skipped.
+     */
+    get enforcing() {
+        return !!this.actor && !this.authorizationBypassed && (!!this.config.authorize || !!this.actor.tenantId);
+    }
+    /** A view that keeps the actor for attribution but skips checks, for cascades already authorized. */
+    elevated() {
+        if (!this.enforcing)
+            return this;
+        const view = Object.create(this);
+        Object.defineProperty(view, 'authorizationBypassed', { value: true });
+        return view;
+    }
+    inActorTenant(entity) {
+        const tenant = this.actor?.tenantId;
+        return !tenant || entity?.tenantId === tenant;
+    }
+    async isAllowed(action, project, resource) {
+        if (!this.enforcing)
+            return true;
+        if (project && !this.inActorTenant(project))
+            return false;
+        const policy = this.config.authorize;
+        return policy ? await policy({ actor: this.actor, action, project, resource }) : true;
+    }
+    /** The project if the actor may read it, otherwise null (callers report "not found"). */
+    async readableProject(projectId) {
+        if (!projectId)
+            return null;
+        const project = await this.store.getProject(projectId);
+        if (!project)
+            return null;
+        return (await this.isAllowed('project.read', project)) ? project : null;
+    }
+    async canReadProject(projectId) {
+        if (!this.enforcing)
+            return true;
+        return (await this.readableProject(projectId)) !== null;
+    }
+    /**
+     * Ensures the actor may perform `action` in `projectId`. Projects the actor cannot read (or
+     * that belong to another tenant) are reported as not found so their existence is not revealed.
+     */
+    async requireProjectAccess(action, projectId, resource) {
+        if (!this.enforcing)
+            return;
+        const project = await this.readableProject(projectId);
+        if (!project)
+            throw new NotFoundError(`Project "${projectId}" not found.`);
+        if (action !== 'project.read' && !(await this.isAllowed(action, project, resource))) {
+            throw new ForbiddenError(`Not allowed to ${action} in project "${projectId}".`);
+        }
+    }
+    async requireWorkspaceAccess(action) {
+        if (!(await this.isAllowed(action)))
+            throw new ForbiddenError(`Not allowed to ${action}.`);
+    }
+    /** Keeps only items in projects the actor may read. Items with no project are hidden on views. */
+    async filterReadable(items, projectIdOf) {
+        if (!this.enforcing)
+            return items;
+        const readable = new Map();
+        const result = [];
+        for (const item of items) {
+            const projectId = await projectIdOf(item);
+            if (!projectId)
+                continue;
+            if (!readable.has(projectId))
+                readable.set(projectId, await this.canReadProject(projectId));
+            if (readable.get(projectId))
+                result.push(item);
+        }
+        return result;
+    }
+    async projectIdOfTask(taskId) {
+        return taskId ? (await this.store.getTask(taskId))?.projectId : undefined;
+    }
+    async projectIdOfComment(commentId) {
+        if (!commentId)
+            return undefined;
+        const comment = await this.store.getComment(commentId);
+        return this.projectIdOfTask(comment?.taskId);
+    }
+    async projectIdOfAttachment(a) {
+        return a.projectId ?? (await this.projectIdOfTask(a.taskId)) ?? (await this.projectIdOfComment(a.commentId));
+    }
+    /** Strips fields only the engine may set (tenancy) from updates made through a view. */
+    withoutTenant(updates) {
+        if (!this.actor || !('tenantId' in updates))
+            return updates;
+        const { tenantId: _ignored, ...rest } = updates;
+        return rest;
+    }
     async seedInitialData(data) {
         if (data.workflows) {
             for (const wf of data.workflows) {
@@ -92,13 +190,16 @@ export class CriticalPathEngine {
     }
     // --- Workflows ---
     async getWorkflows() {
-        return this.store.getWorkflows();
+        const workflows = await this.store.getWorkflows();
+        return workflows.filter((w) => this.inActorTenant(w));
     }
     async getWorkflow(id) {
-        return this.store.getWorkflow(id);
+        const workflow = await this.store.getWorkflow(id);
+        return workflow && this.inActorTenant(workflow) ? workflow : null;
     }
     async createWorkflow(workflow) {
-        const created = await this.store.createWorkflow(workflow);
+        await this.requireWorkspaceAccess('workspace.manage');
+        const created = await this.store.createWorkflow({ ...workflow, tenantId: this.actor ? this.actor.tenantId : workflow.tenantId });
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -118,9 +219,11 @@ export class CriticalPathEngine {
         return created;
     }
     async updateWorkflow(id, updates) {
-        const existing = await this.store.getWorkflow(id);
+        const existing = await this.getWorkflow(id);
         if (!existing)
             return null;
+        await this.requireWorkspaceAccess('workspace.manage');
+        updates = this.withoutTenant(updates);
         const updated = await this.store.updateWorkflow(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -143,9 +246,10 @@ export class CriticalPathEngine {
         return updated;
     }
     async deleteWorkflow(id) {
-        const existing = await this.store.getWorkflow(id);
+        const existing = await this.getWorkflow(id);
         if (!existing)
             return false;
+        await this.requireWorkspaceAccess('workspace.manage');
         const deleted = await this.store.deleteWorkflow(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -176,7 +280,8 @@ export class CriticalPathEngine {
             if (wf)
                 return wf;
         }
-        const workflows = await this.store.getWorkflows();
+        // Only fall back to workflows from the project's own tenant.
+        const workflows = (await this.store.getWorkflows()).filter((w) => w.tenantId === project?.tenantId);
         const defaultWf = workflows.find((w) => w.isDefault);
         if (defaultWf)
             return defaultWf;
@@ -185,21 +290,21 @@ export class CriticalPathEngine {
         return DEFAULT_SOFTWARE_WORKFLOW;
     }
     async getAllowedTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
         return getAllowedTransitions(workflow || undefined, task.status);
     }
     async getAllowedNextTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
         return getAllowedNextStatuses(workflow || undefined, task.status);
     }
     async getAllowedPreviousTaskTransitions(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return [];
         const workflow = await this.resolveProjectWorkflow(task.projectId);
@@ -207,13 +312,23 @@ export class CriticalPathEngine {
     }
     // --- Projects ---
     async getProjects() {
-        return this.store.getProjects();
+        const projects = await this.store.getProjects();
+        return this.filterReadable(projects, (p) => p.id);
     }
     async getProject(id) {
-        return this.store.getProject(id);
+        if (!this.enforcing)
+            return this.store.getProject(id);
+        return this.readableProject(id);
     }
     async createProject(project) {
-        const created = await this.store.createProject(project);
+        await this.requireWorkspaceAccess('project.create');
+        // Views always use the actor's tenant (possibly none); only trusted base-engine calls may set it.
+        const input = { ...project, tenantId: this.actor ? this.actor.tenantId : project.tenantId };
+        // The creator administers the project they create.
+        if (this.actor && this.actor.userId !== 'anonymous' && !input.members?.some((m) => m.userId === this.actor.userId)) {
+            input.members = [...(input.members ?? []), { userId: this.actor.userId, role: 'admin' }];
+        }
+        const created = await this.store.createProject(input);
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -234,9 +349,13 @@ export class CriticalPathEngine {
         return created;
     }
     async updateProject(id, updates) {
-        const existing = await this.store.getProject(id);
+        const existing = await this.getProject(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('project.update', id);
+        if ('members' in updates)
+            await this.requireProjectAccess('project.manage_members', id);
+        updates = this.withoutTenant(updates);
         const updated = await this.store.updateProject(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -264,13 +383,16 @@ export class CriticalPathEngine {
      * hooks run and `task.deleted` events fire before `project.deleted` is published.
      */
     async deleteProject(id) {
-        const existing = await this.store.getProject(id);
+        const existing = await this.getProject(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('project.delete', id);
+        // Deleting the project implies deleting its tasks; skip per-task checks for the cascade.
+        const cascade = this.elevated();
         const tasks = await this.store.getTasks(id);
         const deletedTaskIds = [];
         for (const task of tasks) {
-            if (await this.deleteTask(task.id)) {
+            if (await cascade.deleteTask(task.id)) {
                 deletedTaskIds.push(task.id);
             }
         }
@@ -298,12 +420,19 @@ export class CriticalPathEngine {
     }
     // --- Tasks ---
     async getTasks(projectId) {
-        return this.store.getTasks(projectId);
+        if (projectId && !(await this.canReadProject(projectId)))
+            return [];
+        const tasks = await this.store.getTasks(projectId);
+        return projectId ? tasks : this.filterReadable(tasks, (t) => t.projectId);
     }
     async getTask(id) {
-        return this.store.getTask(id);
+        const task = await this.store.getTask(id);
+        if (!task)
+            return null;
+        return (await this.canReadProject(task.projectId)) ? task : null;
     }
     async createTask(taskInput) {
+        await this.requireProjectAccess('task.create', taskInput.projectId);
         if (this.actor && !taskInput.reporterId) {
             taskInput = { ...taskInput, reporterId: this.actor.userId };
         }
@@ -389,34 +518,17 @@ export class CriticalPathEngine {
         return created;
     }
     async updateTask(id, updates, options) {
-        const existing = await this.store.getTask(id);
+        const existing = await this.getTask(id);
         if (!existing)
             return null;
-        // On a withActor view, the scoped actor replaces any identity claimed in the payload.
-        // Explicit options from trusted server-side code still take precedence.
+        await this.requireProjectAccess('task.update', existing.projectId);
+        // Identity comes from trusted options or the withActor view, never from the update payload.
         options = options ?? (this.actor ? { actor: this.actor } : undefined);
-        const claimed = this.actor ? undefined : updates;
-        const actorId = options?.actorId ||
-            claimed?.actorId ||
-            options?.actor?.userId ||
-            claimed?.actor?.userId ||
-            'system';
-        const actorName = options?.actorName ||
-            claimed?.actorName ||
-            options?.actor?.username ||
-            claimed?.actor?.username ||
-            (actorId === 'system' ? 'System' : undefined);
-        const actorType = options?.actorType ||
-            claimed?.actorType ||
-            options?.actor?.actorType ||
-            claimed?.actor?.actorType ||
-            (actorId === 'system' ? 'system' : 'user');
-        const actorObj = options?.actor || claimed?.actor || {
-            userId: actorId,
-            username: actorName,
-            actorType
-        };
-        const { actorId: _aId, actorName: _aName, actorType: _aType, actor: _aObj, ...taskUpdates } = updates;
+        const actorId = options?.actorId || options?.actor?.userId || 'system';
+        const actorName = options?.actorName || options?.actor?.username || (actorId === 'system' ? 'System' : undefined);
+        const actorType = options?.actorType || options?.actor?.actorType || (actorId === 'system' ? 'system' : 'user');
+        const actorObj = options?.actor || { userId: actorId, username: actorName, actorType };
+        const taskUpdates = updates;
         const project = await this.store.getProject(existing.projectId);
         const workflow = await this.resolveProjectWorkflow(existing.projectId);
         // Validate workflow transition invariant
@@ -766,9 +878,10 @@ export class CriticalPathEngine {
         }
     }
     async deleteTask(id) {
-        const existing = await this.store.getTask(id);
+        const existing = await this.getTask(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('task.delete', existing.projectId);
         await this.plugins.runBeforeTaskDelete(id);
         const deleted = await this.store.deleteTask(id);
         if (deleted) {
@@ -800,6 +913,14 @@ export class CriticalPathEngine {
     }
     // --- Task Dependencies & Graph ---
     async addDependency(dep) {
+        if (this.enforcing) {
+            const [task, upstream] = await Promise.all([this.getTask(dep.taskId), this.getTask(dep.dependsOnTaskId)]);
+            if (!task)
+                throw new NotFoundError(`Task "${dep.taskId}" not found.`);
+            if (!upstream)
+                throw new NotFoundError(`Task "${dep.dependsOnTaskId}" not found.`);
+            await this.requireProjectAccess('task.update', task.projectId);
+        }
         // Enforce Directed Acyclic Graph (DAG) Invariant
         const reachableDeps = await this.collectUpstreamDependencies(dep.dependsOnTaskId);
         const cycleCheck = detectDependencyCycle(reachableDeps, dep);
@@ -848,6 +969,9 @@ export class CriticalPathEngine {
         return Array.from(edges.values());
     }
     async getTaskDependencyGraph(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId))) {
+            return { taskId, upstreamTasks: [], downstreamTasks: [], dependencies: [] };
+        }
         const dependencies = await this.store.getDependencies(taskId);
         const upstreamTaskIds = new Set();
         const downstreamTaskIds = new Set();
@@ -859,8 +983,8 @@ export class CriticalPathEngine {
                 downstreamTaskIds.add(dep.taskId);
             }
         }
-        const upstreamTasks = (await Promise.all(Array.from(upstreamTaskIds).map((id) => this.store.getTask(id)))).filter((t) => t !== null);
-        const downstreamTasks = (await Promise.all(Array.from(downstreamTaskIds).map((id) => this.store.getTask(id)))).filter((t) => t !== null);
+        const upstreamTasks = (await Promise.all(Array.from(upstreamTaskIds).map((id) => this.getTask(id)))).filter((t) => t !== null);
+        const downstreamTasks = (await Promise.all(Array.from(downstreamTaskIds).map((id) => this.getTask(id)))).filter((t) => t !== null);
         return {
             taskId,
             upstreamTasks,
@@ -889,7 +1013,12 @@ export class CriticalPathEngine {
         if (!Number.isFinite(entry.hours) || entry.hours <= 0) {
             throw new ValidationError('Logged hours must be a positive number.');
         }
-        const task = await this.store.getTask(entry.taskId);
+        const task = await this.getTask(entry.taskId);
+        if (this.enforcing) {
+            if (!task)
+                throw new NotFoundError(`Task "${entry.taskId}" not found.`);
+            await this.requireProjectAccess('time.log', task.projectId);
+        }
         if (task) {
             const newLoggedHours = (task.loggedHours || 0) + entry.hours;
             const newActualHours = (task.actualHours || 0) + entry.hours;
@@ -920,15 +1049,35 @@ export class CriticalPathEngine {
     }
     // --- Comments ---
     async getComments(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId)))
+            return [];
         return this.store.getComments(taskId);
     }
     async getComment(id) {
-        return this.store.getComment(id);
+        const comment = await this.store.getComment(id);
+        if (!comment)
+            return null;
+        return (await this.canReadProject(await this.projectIdOfTask(comment.taskId))) ? comment : null;
     }
-    async addComment(comment) {
-        if (this.actor) {
-            comment = { ...comment, authorId: this.actor.userId, authorType: this.actor.actorType ?? 'user' };
-        }
+    async getActivities(filter) {
+        const activities = await this.store.getActivities(filter);
+        return this.filterReadable(activities, (a) => a.projectId ?? this.projectIdOfTask(a.taskId));
+    }
+    async getTimeEntries(taskId) {
+        if (this.enforcing && !(await this.getTask(taskId)))
+            return [];
+        return this.store.getTimeEntries(taskId);
+    }
+    async addComment(input) {
+        if (this.enforcing) {
+            const task = await this.getTask(input.taskId);
+            if (!task)
+                throw new NotFoundError(`Task "${input.taskId}" not found.`);
+            await this.requireProjectAccess('comment.create', task.projectId);
+        }
+        const comment = this.actor
+            ? { ...input, authorId: this.actor.userId, authorType: this.actor.actorType ?? 'user' }
+            : { ...input, authorId: input.authorId ?? 'system' };
         const mentions = comment.mentions ?? extractMentions(comment.content);
         const created = await this.store.addComment({ ...comment, mentions });
         const now = new Date().toISOString();
@@ -945,9 +1094,13 @@ export class CriticalPathEngine {
         return created;
     }
     async updateComment(id, updates) {
-        const existing = await this.store.getComment(id);
+        const existing = await this.getComment(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.moderate', await this.projectIdOfTask(existing.taskId), {
+            type: 'comment',
+            ownerId: existing.authorId
+        });
         const mentions = updates.mentions ?? (updates.content ? extractMentions(updates.content) : undefined);
         const toUpdate = mentions !== undefined ? { ...updates, mentions } : updates;
         const updated = await this.store.updateComment(id, toUpdate);
@@ -967,9 +1120,13 @@ export class CriticalPathEngine {
         return updated;
     }
     async deleteComment(id) {
-        const existing = await this.store.getComment(id);
+        const existing = await this.getComment(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('comment.moderate', await this.projectIdOfTask(existing.taskId), {
+            type: 'comment',
+            ownerId: existing.authorId
+        });
         const deleted = await this.store.deleteComment(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -986,12 +1143,12 @@ export class CriticalPathEngine {
         }
         return deleted;
     }
-    async addCommentReaction(commentId, reaction) {
-        if (this.actor)
-            reaction = { ...reaction, userId: this.actor.userId };
-        const existing = await this.store.getComment(commentId);
+    async addCommentReaction(commentId, input) {
+        const reaction = { emoji: input.emoji, userId: this.actor?.userId ?? input.userId ?? 'system' };
+        const existing = await this.getComment(commentId);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.create', await this.projectIdOfTask(existing.taskId));
         let updated;
         if (this.store.addReaction) {
             updated = await this.store.addReaction(commentId, reaction);
@@ -1031,12 +1188,12 @@ export class CriticalPathEngine {
         this.dispatchWebhook('comment.reaction.added', { comment: updated, reaction });
         return updated;
     }
-    async removeCommentReaction(commentId, reaction) {
-        if (this.actor)
-            reaction = { ...reaction, userId: this.actor.userId };
-        const existing = await this.store.getComment(commentId);
+    async removeCommentReaction(commentId, input) {
+        const reaction = { emoji: input.emoji, userId: this.actor?.userId ?? input.userId ?? 'system' };
+        const existing = await this.getComment(commentId);
         if (!existing)
             return null;
+        await this.requireProjectAccess('comment.create', await this.projectIdOfTask(existing.taskId));
         let updated;
         if (this.store.removeReaction) {
             updated = await this.store.removeReaction(commentId, reaction);
@@ -1062,19 +1219,31 @@ export class CriticalPathEngine {
     }
     // --- Attachments ---
     async getAttachments(filter) {
-        const attachments = await this.store.getAttachments(filter);
+        const attachments = await this.filterReadable(await this.store.getAttachments(filter), (a) => this.projectIdOfAttachment(a));
         if (filter?.artifactType) {
             return attachments.filter(a => a.artifactType === filter.artifactType);
         }
         return attachments;
     }
     async getAttachment(id) {
-        return this.store.getAttachment(id);
-    }
-    async createAttachment(attachment) {
-        if (this.actor) {
-            attachment = { ...attachment, uploaderId: this.actor.userId, uploaderType: this.actor.actorType ?? 'user' };
-        }
+        const attachment = await this.store.getAttachment(id);
+        if (!attachment)
+            return null;
+        return (await this.canReadProject(await this.projectIdOfAttachment(attachment))) ? attachment : null;
+    }
+    async requireAttachmentCreate(link) {
+        if (!this.enforcing)
+            return;
+        const projectId = await this.projectIdOfAttachment(link);
+        if (!projectId)
+            throw new ValidationError('Attachments must reference a project, task or comment.');
+        await this.requireProjectAccess('attachment.create', projectId);
+    }
+    async createAttachment(input) {
+        await this.requireAttachmentCreate(input);
+        const attachment = this.actor
+            ? { ...input, uploaderId: this.actor.userId, uploaderType: this.actor.actorType ?? 'user' }
+            : { ...input, uploaderId: input.uploaderId ?? 'system' };
         validateAttachmentUrl(attachment.url);
         const created = await this.store.createAttachment(attachment);
         const now = new Date().toISOString();
@@ -1091,9 +1260,13 @@ export class CriticalPathEngine {
         return created;
     }
     async deleteAttachment(id) {
-        const existing = await this.store.getAttachment(id);
+        const existing = await this.getAttachment(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('attachment.delete', await this.projectIdOfAttachment(existing), {
+            type: 'attachment',
+            ownerId: existing.uploaderId
+        });
         if (existing.storageKey && this.fileStorage) {
             try {
                 await this.fileStorage.delete(existing.storageKey);
@@ -1122,6 +1295,8 @@ export class CriticalPathEngine {
         if (!this.fileStorage) {
             throw new Error('No FileStorageAdapter configured in CriticalPathEngine. Pass "fileStorage" in config to enable direct file uploads.');
         }
+        // Check before uploading so denied requests do not leave orphaned files behind.
+        await this.requireAttachmentCreate(input);
         const uploadResult = await this.fileStorage.upload({
             filename: input.filename,
             data: input.data,
@@ -1175,17 +1350,33 @@ export class CriticalPathEngine {
         if (!this.fileStorage || !this.fileStorage.getPresignedUploadUrl) {
             throw new Error('Presigned uploads are not supported by the configured FileStorageAdapter.');
         }
-        return this.fileStorage.getPresignedUploadUrl(options);
+        const { projectId, ...presign } = options;
+        if (this.enforcing) {
+            // Scoped callers may only write under their project's prefix.
+            if (!projectId)
+                throw new ValidationError('projectId is required for presigned uploads.');
+            await this.requireProjectAccess('attachment.create', projectId);
+            const prefix = `projects/${projectId}/`;
+            const key = presign.storageKey.replace(/^\/+/, '');
+            if (key.split('/').some((segment) => segment === '..' || segment === '.')) {
+                throw new ValidationError('storageKey must not contain "." or ".." segments.');
+            }
+            presign.storageKey = key.startsWith(prefix) ? key : prefix + key;
+        }
+        return this.fileStorage.getPresignedUploadUrl(presign);
     }
     // --- Teams ---
     async getTeams() {
-        return this.store.getTeams();
+        const teams = await this.store.getTeams();
+        return teams.filter((t) => this.inActorTenant(t));
     }
     async getTeam(id) {
-        return this.store.getTeam(id);
+        const team = await this.store.getTeam(id);
+        return team && this.inActorTenant(team) ? team : null;
     }
     async createTeam(team) {
-        const created = await this.store.createTeam(team);
+        await this.requireWorkspaceAccess('workspace.manage');
+        const created = await this.store.createTeam({ ...team, tenantId: this.actor ? this.actor.tenantId : team.tenantId });
         const now = new Date().toISOString();
         const event = {
             id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -1200,19 +1391,31 @@ export class CriticalPathEngine {
         return created;
     }
     async updateTeam(id, updates) {
-        return this.store.updateTeam(id, updates);
+        if (!(await this.getTeam(id)))
+            return null;
+        await this.requireWorkspaceAccess('workspace.manage');
+        return this.store.updateTeam(id, this.withoutTenant(updates));
     }
     async deleteTeam(id) {
+        if (!(await this.getTeam(id)))
+            return false;
+        await this.requireWorkspaceAccess('workspace.manage');
         return this.store.deleteTeam(id);
     }
     // --- Containers ---
     async getContainers(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getContainers(projectId);
     }
     async getContainer(id) {
-        return this.store.getContainer(id);
+        const container = await this.store.getContainer(id);
+        if (!container)
+            return null;
+        return (await this.canReadProject(container.projectId)) ? container : null;
     }
     async createContainer(container) {
+        await this.requireProjectAccess('plan.manage', container.projectId);
         const created = await this.store.createContainer(container);
         const now = new Date().toISOString();
         const event = {
@@ -1228,19 +1431,33 @@ export class CriticalPathEngine {
         return created;
     }
     async updateContainer(id, updates) {
+        const existing = await this.getContainer(id);
+        if (!existing)
+            return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.updateContainer(id, updates);
     }
     async deleteContainer(id) {
+        const existing = await this.getContainer(id);
+        if (!existing)
+            return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.deleteContainer(id);
     }
     // --- Deliverables ---
     async getDeliverables(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getDeliverables(projectId);
     }
     async getDeliverable(id) {
-        return this.store.getDeliverable(id);
+        const deliverable = await this.store.getDeliverable(id);
+        if (!deliverable)
+            return null;
+        return (await this.canReadProject(deliverable.projectId)) ? deliverable : null;
     }
     async createDeliverable(input) {
+        await this.requireProjectAccess('plan.manage', input.projectId);
         const project = await this.store.getProject(input.projectId);
         if (project?.customFieldDefinitions && input.customFields) {
             validateCustomFieldValues(project.customFieldDefinitions, input.customFields);
@@ -1271,9 +1488,10 @@ export class CriticalPathEngine {
         return created;
     }
     async updateDeliverable(id, updates) {
-        const existing = await this.store.getDeliverable(id);
+        const existing = await this.getDeliverable(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         if (updates.status && updates.status === 'delivered' && !existing.deliveredAt && !updates.deliveredAt) {
             updates.deliveredAt = new Date().toISOString();
         }
@@ -1320,9 +1538,10 @@ export class CriticalPathEngine {
         return updated;
     }
     async deleteDeliverable(id) {
-        const existing = await this.store.getDeliverable(id);
+        const existing = await this.getDeliverable(id);
         if (!existing)
             return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         const deleted = await this.store.deleteDeliverable(id);
         if (deleted) {
             const now = new Date().toISOString();
@@ -1346,7 +1565,7 @@ export class CriticalPathEngine {
         return deleted;
     }
     async getDeliverableSummary(deliverableId) {
-        const deliverable = await this.store.getDeliverable(deliverableId);
+        const deliverable = await this.getDeliverable(deliverableId);
         if (!deliverable)
             return null;
         const project = await this.store.getProject(deliverable.projectId);
@@ -1391,12 +1610,18 @@ export class CriticalPathEngine {
     }
     // --- Iterations ---
     async getIterations(projectId) {
+        if (!(await this.canReadProject(projectId)))
+            return [];
         return this.store.getIterations(projectId);
     }
     async getIteration(id) {
-        return this.store.getIteration(id);
+        const iteration = await this.store.getIteration(id);
+        if (!iteration)
+            return null;
+        return (await this.canReadProject(iteration.projectId)) ? iteration : null;
     }
     async createIteration(iteration) {
+        await this.requireProjectAccess('plan.manage', iteration.projectId);
         const created = await this.store.createIteration(iteration);
         if (created.status === 'active') {
             const now = new Date().toISOString();
@@ -1414,9 +1639,10 @@ export class CriticalPathEngine {
         return created;
     }
     async updateIteration(id, updates) {
-        const existing = await this.store.getIteration(id);
+        const existing = await this.getIteration(id);
         if (!existing)
             return null;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         const updated = await this.store.updateIteration(id, updates);
         if (updated) {
             const now = new Date().toISOString();
@@ -1448,10 +1674,15 @@ export class CriticalPathEngine {
         return updated;
     }
     async deleteIteration(id) {
+        const existing = await this.getIteration(id);
+        if (!existing)
+            return false;
+        await this.requireProjectAccess('plan.manage', existing.projectId);
         return this.store.deleteIteration(id);
     }
     // --- Ladder of Abstraction & Critical Path Method ---
     async calculateCriticalPath(projectId, options = {}) {
+        await this.requireProjectAccess('project.read', projectId);
         const project = await this.store.getProject(projectId);
         const tasks = await this.store.getTasks(projectId);
         const allDepArrays = await Promise.all(tasks.map((t) => this.store.getDependencies(t.id)));
@@ -1470,6 +1701,7 @@ export class CriticalPathEngine {
         return calculateCPM(projectId, tasks, dependencies, { schedule, projectStartDate });
     }
     async getTimelineLadder(projectId, options = {}) {
+        await this.requireProjectAccess('project.read', projectId);
         const project = await this.store.getProject(projectId);
         if (!project) {
             throw new NotFoundError(`Project with ID "${projectId}" not found.`);
@@ -1516,7 +1748,7 @@ export class CriticalPathEngine {
         }, options);
     }
     async getTaskLadder(taskId) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const project = await this.store.getProject(task.projectId);
@@ -1538,7 +1770,7 @@ export class CriticalPathEngine {
         };
     }
     async getTaskMetrics(taskId, options) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const [activities, timeEntries, project, workflow] = await Promise.all([
@@ -1554,7 +1786,7 @@ export class CriticalPathEngine {
         });
     }
     async getTaskProgressHistory(taskId, options) {
-        const task = await this.store.getTask(taskId);
+        const task = await this.getTask(taskId);
         if (!task)
             return null;
         const [activities, project, workflow] = await Promise.all([
@@ -1569,8 +1801,10 @@ export class CriticalPathEngine {
         });
     }
     async getWorkloadDistribution(projectId, options = {}) {
-        const tasks = await this.store.getTasks(projectId);
-        const teams = await this.store.getTeams();
+        if (projectId)
+            await this.requireProjectAccess('project.read', projectId);
+        const tasks = await this.getTasks(projectId);
+        const teams = await this.getTeams();
         const project = projectId ? await this.store.getProject(projectId) : undefined;
         const schedule = options.schedule || project?.schedule || this.config.defaultSchedule;
         const timeEntriesNested = await Promise.all(tasks.map((t) => this.store.getTimeEntries(t.id)));