@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/src/modules/api_keys/services/apiKeyService.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto'
+import { randomBytes, createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { hash, compare } from 'bcryptjs'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
@@ -227,6 +227,17 @@ export function generateSessionToken(): string {
   return `sess_${randomBytes(16).toString('hex')}`
 }
 
+/**
+ * Hash a session token for storage/lookup (#2254). The session token is a bearer credential —
+ * it unlocks the decrypted API key secret and the user's ACL on the MCP server — so, mirroring
+ * `customer_accounts`' `hashToken`, only its hash is ever persisted. 128 bits of entropy from
+ * `generateSessionToken` is sufficient for a plain SHA-256 (no bcrypt cost needed, and a slow
+ * hash would just add latency to every MCP tool call that resolves a session).
+ */
+export function hashSessionToken(sessionToken: string): string {
+  return createHash('sha256').update(sessionToken).digest('hex')
+}
+
 /**
  * Create an ephemeral API key scoped to a chat session.
  * The key inherits the user's roles and expires after ttlMinutes (default 30).
@@ -244,12 +255,16 @@ export async function createSessionApiKey(
   // Encrypt the secret for later retrieval (used by MCP server for API calls)
   const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)
 
+  // Hash before storage (#2254) — the row (and its `name` column, previously embedding the raw
+  // token for operator visibility) must never carry the live bearer credential in the clear.
+  const sessionTokenHash = hashSessionToken(input.sessionToken)
+
   const roleIds = Array.from(new Set(input.userRoles.filter(Boolean))).sort((left, right) => left.localeCompare(right))
   let record!: ApiKey
   await withAtomicFlush(em, [async () => {
     await lockRoleWriterAuthorizationState(em, roleIds)
     record = em.create(ApiKey, {
-      name: `__session_${input.sessionToken}__`,
+      name: `__session_${sessionTokenHash.slice(0, 12)}__`,
       description: 'Ephemeral session API key for AI chat',
       tenantId: input.tenantId ?? null,
       organizationId: input.organizationId ?? null,
@@ -257,7 +272,7 @@ export async function createSessionApiKey(
       keyPrefix: prefix,
       rolesJson: roleIds,
       createdBy: input.userId,
-      sessionToken: input.sessionToken,
+      sessionTokenHash,
       sessionUserId: input.userId,
       sessionSecretEncrypted: encryptedSecret,
       expiresAt,
@@ -283,10 +298,26 @@ export async function findApiKeyBySessionToken(
 ): Promise<ApiKey | null> {
   if (!sessionToken) return null
 
-  const record = await em.findOne(ApiKey, {
-    sessionToken,
-    deletedAt: null,
-  })
+  // Looked up by hash, never by the raw token (#2254).
+  const sessionTokenHash = hashSessionToken(sessionToken)
+  let record = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })
+
+  if (!record) {
+    // Version-skew fallback (#7304): during a rolling deploy/rollback window the app and the
+    // separate MCP process can briefly run different code versions. A row minted by
+    // pre-#2254 code in that window carries only the plaintext token (sessionTokenHash is
+    // still null) — fall back to it so the session still resolves instead of answering a
+    // false SESSION_EXPIRED, then self-heal the row onto the hash immediately so this is the
+    // only lookup that ever sees the plaintext, and the window closes as soon as each
+    // outstanding legacy row is touched once.
+    const legacyRecord = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+    if (legacyRecord) {
+      legacyRecord.sessionTokenHash = sessionTokenHash
+      legacyRecord.sessionToken = null
+      await em.persist(legacyRecord).flush()
+      record = legacyRecord
+    }
+  }
 
   if (!record) return null
   if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null
@@ -392,14 +423,29 @@ export async function deleteSessionApiKey(
   em: EntityManager,
   sessionToken: string
 ): Promise<void> {
-  const candidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+  // Looked up and re-checked by hash, never by the raw token (#2254). Deliberately does not
+  // call findApiKeyBySessionToken: that helper also drops already-expired rows, but deleting
+  // an expired-but-not-yet-cleaned-up row must still work here.
+  const sessionTokenHash = hashSessionToken(sessionToken)
+  let candidate = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })
+  if (!candidate) {
+    // Version-skew fallback (#7304): see findApiKeyBySessionToken for the full rationale — a
+    // row minted by pre-#2254 code during a deploy window is plaintext-only until touched.
+    const legacyCandidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+    if (legacyCandidate) {
+      legacyCandidate.sessionTokenHash = sessionTokenHash
+      legacyCandidate.sessionToken = null
+      await em.persist(legacyCandidate).flush()
+      candidate = legacyCandidate
+    }
+  }
   if (!candidate) return
   let deletedId: string | null = null
   await withAtomicFlush(em, [async () => {
     const records = await lockAuthorizationApiKeyRows(em, [String(candidate.id)])
     const record = records.find((entry) => (
       String(entry.id) === String(candidate.id)
-      && entry.sessionToken === sessionToken
+      && entry.sessionTokenHash === sessionTokenHash
       && !entry.deletedAt
     ))
     if (!record) return

package/src/modules/attachments/api/file/[id]/route.ts

@@ -1,3 +1,5 @@
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../lib/access-runner'
+import { attachmentAccessErrorResponse } from '../../../lib/access-errors'
 import { NextRequest, NextResponse } from "next/server";
 import type { OpenApiRouteDoc } from "@open-mercato/shared/lib/openapi";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
@@ -69,11 +71,14 @@ export async function GET(
     );
   }
 
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
-  if (!access.ok) {
-    const message = access.status === 401 ? "Unauthorized" : "Forbidden";
-    return NextResponse.json({ error: message }, { status: access.status });
-  }
+  const url = new URL(req.url);
+  const forceDownload = url.searchParams.get("download") === "1";
+  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
+  const access = await evaluateAttachmentAccess({
+    auth: scopedAuth, attachment, partition, action: renderInline ? 'render' : 'read',
+    context: createAttachmentAccessContext(container),
+  });
+  if (!access.ok) return attachmentAccessErrorResponse(access);
 
   const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
     tenantId: attachment.tenantId ?? '',
@@ -87,11 +92,8 @@ export async function GET(
     return NextResponse.json({ error: "File not available" }, { status: 404 });
   }
 
-  const url = new URL(req.url);
-  const forceDownload = url.searchParams.get("download") === "1";
-  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
   const headers: Record<string, string> = {
-    "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok
+    "Cache-Control": access.protected ? "private, no-store" : checkAttachmentAccess(null, attachment, partition).ok
       ? "public, max-age=86400"
       : "private, max-age=60",
     "Content-Security-Policy": "default-src 'none'; sandbox",
@@ -155,6 +157,7 @@ export const openApi: OpenApiRouteDoc = {
           description: "Partition misconfigured",
           schema: attachmentErrorSchema,
         },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -1,3 +1,5 @@
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../../lib/access-runner'
+import { attachmentAccessErrorResponse } from '../../../../lib/access-errors'
 import { NextRequest, NextResponse } from 'next/server'
 import sharp, { type ResizeOptions } from 'sharp'
 import { z } from 'zod'
@@ -71,17 +73,16 @@ export async function GET(
   if (!attachment) {
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }
-  if (!canRenderInlineAttachment(attachment.mimeType)) {
-    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })
-  }
   const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition)
-  if (!access.ok) {
-    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'
-    return NextResponse.json({ error: message }, { status: access.status })
+  const access = await evaluateAttachmentAccess({
+    auth: scopedAuth, attachment, partition, action: 'render', context: createAttachmentAccessContext(container),
+  })
+  if (!access.ok) return attachmentAccessErrorResponse(access)
+  if (!canRenderInlineAttachment(attachment.mimeType)) {
+    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })
   }
 
   const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
@@ -136,7 +137,7 @@ export async function GET(
     return new NextResponse(responseBody, {
       headers: {
         'Content-Type': attachment.mimeType || 'image/jpeg',
-        'Cache-Control': checkAttachmentAccess(null, attachment, partition).ok ? 'public, max-age=3600' : 'private, max-age=60',
+        'Cache-Control': access.protected ? 'private, no-store' : checkAttachmentAccess(null, attachment, partition).ok ? 'public, max-age=3600' : 'private, max-age=60',
         'X-Content-Type-Options': 'nosniff',
       },
     })
@@ -166,6 +167,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },
         { status: 404, description: 'Image not found', schema: attachmentErrorSchema },
         { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/library/[id]/route.ts

@@ -1,3 +1,11 @@
+import { LockMode } from '@mikro-orm/core'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { prepareAttachmentMutation } from '../../../lib/access-mutation'
+import { throwAttachmentAccessError } from '../../../lib/access-errors'
+import { createAttachmentAccessContext } from '../../../lib/access-runner'
+import { assertAttachmentOwnerAccess } from '../../../lib/access-query'
+import { withAttachmentAccessErrors } from '../../../lib/access-errors'
 import { NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -12,7 +20,7 @@ import {
   readAttachmentMetadata,
 } from '../../../lib/metadata'
 import type { StorageDriverFactory } from '../../../lib/drivers'
-import { removeAttachmentRecord } from '../../../lib/storageReferences'
+import { lockAttachmentStorageReferences, resolveAttachmentStorageRelease } from '../../../lib/storageReferences'
 import { splitCustomFieldPayload, loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'
 import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
@@ -26,9 +34,6 @@ import {
   attachmentDetailResponseSchema,
   attachmentErrorSchema,
 } from '../../openapi'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-
-const logger = createLogger('attachments').child({ component: 'library' })
 
 const updateSchema = z.object({
   tags: z.array(z.string()).optional(),
@@ -66,7 +71,7 @@ async function resolveAttachmentId(ctx: RouteContext): Promise<string | null> {
   }
 }
 
-export async function GET(req: NextRequest, ctx: RouteContext) {
+async function getAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -75,7 +80,8 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   let queryEngine: QueryEngine | null = null
   try {
@@ -94,6 +100,7 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
   if (!record) {
     return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   }
+  await assertAttachmentOwnerAccess({ em, context: createAttachmentAccessContext(container), auth, attachment: record, action: 'metadata' })
   const metadata = readAttachmentMetadata(record.storageMetadata)
   const partition = record.partitionCode
     ? await em.findOne(AttachmentPartition, { code: record.partitionCode })
@@ -127,10 +134,12 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
       content: record.content && record.content.trim() ? record.content : null,
       customFields,
     },
-  })
+  }, { headers: { 'Cache-Control': 'private, no-store' } })
 }
 
-export async function PATCH(req: NextRequest, ctx: RouteContext) {
+export const GET = withAttachmentAccessErrors(getAttachment)
+
+async function updateAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -139,13 +148,14 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const rawBody = await req.json().catch(() => null)
+  const rawBody = await readJsonSafe(req, null)
   const { base, custom } = splitCustomFieldPayload(rawBody)
   const parsed = updateSchema.safeParse(base)
   if (!parsed.success) {
     return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   let queryEngine: QueryEngine | null = null
   try {
@@ -159,34 +169,38 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   }
-  const record = await em.findOne(Attachment, patchFilter)
-  if (!record) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  const patch: Record<string, unknown> = {}
-  if (parsed.data.tags) patch.tags = normalizeAttachmentTags(parsed.data.tags)
-  if (parsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(parsed.data.assignments)
-  record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)
-  // Commit the metadata mutation and the custom-field write atomically so a
-  // custom-field failure cannot leave the attachment metadata partially updated.
-  try {
-    await em.transactional(async (tx) => {
-      await tx.flush()
-      if (dataEngine && custom && Object.keys(custom).length) {
-        await setCustomFieldsIfAny({
-          dataEngine,
-          entityId: E.attachments.attachment,
-          recordId: record.id,
-          tenantId: record.tenantId ?? auth.tenantId ?? null,
-          organizationId: record.organizationId ?? auth.orgId ?? null,
-          values: custom,
-        })
-      }
+  const accessContext = createAttachmentAccessContext(container)
+  const outcome = await em.transactional(async (tx) => {
+    const record = await findOneWithDecryption(tx, Attachment, patchFilter, {
+      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId })
+    if (!record) return throwAttachmentAccessError(404)
+    const guard = await prepareAttachmentMutation({
+      container, req, auth, recordId: record.id, operation: 'update',
+      payload: { ...parsed.data, customFields: custom },
     })
-  } catch (error) {
-    logger.error('Failed to persist custom attributes', { err: error })
-    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
-  }
+    const effective = splitCustomFieldPayload(guard.modifiedPayload ?? { ...parsed.data, customFields: custom })
+    const effectiveParsed = updateSchema.safeParse(effective.base)
+    if (!effectiveParsed.success) return throwAttachmentAccessError(403)
+    const patch: Record<string, unknown> = {}
+    if (effectiveParsed.data.tags) patch.tags = normalizeAttachmentTags(effectiveParsed.data.tags)
+    if (effectiveParsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(effectiveParsed.data.assignments)
+    const nextMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: 'reassign', persistProtection: true })
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, storageMetadata: nextMetadata }, action: 'reassign' })
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, storageMetadata: nextMetadata }, action: 'metadata' })
+    record.storageMetadata = nextMetadata
+    await tx.flush()
+    if (dataEngine && Object.keys(effective.custom).length) {
+      await setCustomFieldsIfAny({ dataEngine, entityId: E.attachments.attachment, recordId: record.id,
+        tenantId: record.tenantId ?? auth.tenantId, organizationId: record.organizationId ?? auth.orgId,
+        values: effective.custom,
+      })
+    }
+    return { record, custom: effective.custom, guard }
+  })
+  const { record } = outcome
+  await outcome.guard.runAfterSuccess()
 
   if (dataEngine) {
     await emitCrudSideEffects({
@@ -218,12 +232,12 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
       id: record.id,
       tags: metadata.tags ?? [],
       assignments: enrichedAssignments,
-      customFields: normalizeCustomFieldResponse(custom ?? null),
+      customFields: normalizeCustomFieldResponse(outcome.custom ?? null),
     },
   })
 }
 
-export async function DELETE(req: NextRequest, ctx: RouteContext) {
+async function deleteAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -232,7 +246,8 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   const dataEngine = resolve('dataEngine') as DataEngine
   const storageDriverFactory = resolve('storageDriverFactory') as StorageDriverFactory
@@ -241,25 +256,30 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   }
-  const record = await em.findOne(Attachment, deleteFilter)
-  if (!record) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  const deleteDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
-    tenantId: record.tenantId ?? auth.tenantId,
-    organizationId: record.organizationId ?? auth.orgId,
+  const outcome = await em.transactional(async (tx) => {
+    const candidate = await findOneWithDecryption(tx, Attachment, deleteFilter, undefined, {
+      tenantId: auth.tenantId, organizationId: auth.orgId,
+    })
+    if (!candidate) return throwAttachmentAccessError(404)
+    const referenceIds = await lockAttachmentStorageReferences(tx, candidate)
+    const removal = resolveAttachmentStorageRelease(referenceIds, candidate.id)
+    if (!removal.removed) return throwAttachmentAccessError(404)
+    const record = await findOneWithDecryption(tx, Attachment, deleteFilter, {
+      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId })
+    if (!record) return throwAttachmentAccessError(404)
+    const guard = await prepareAttachmentMutation({ container, req, auth, recordId: record.id, operation: 'delete' })
+    await assertAttachmentOwnerAccess({ em: tx, context: createAttachmentAccessContext(container), auth, attachment: record, action: 'delete' })
+    const driver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
+      tenantId: record.tenantId ?? auth.tenantId!, organizationId: record.organizationId ?? auth.orgId!,
+    })
+    tx.remove(record)
+    await tx.flush()
+    return { record, driver, guard, releaseStorage: removal.releaseStorage }
   })
-  // Commit the DB row removal before deleting the irreversible storage file so a
-  // failed commit cannot leave a dangling record whose backing file is already gone.
-  const recordPartitionCode = record.partitionCode
-  const recordStoragePath = record.storagePath
-  const removal = await removeAttachmentRecord(em, record)
-  if (!removal.removed) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  if (removal.releaseStorage) {
-    await deleteDriver.delete(recordPartitionCode, recordStoragePath)
-  }
+  const { record } = outcome
+  if (outcome.releaseStorage) await outcome.driver.delete(record.partitionCode, record.storagePath)
+  await outcome.guard.runAfterSuccess()
 
   if (dataEngine) {
     await emitCrudSideEffects({
@@ -280,6 +300,9 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
   return NextResponse.json({ ok: true })
 }
 
+export const PATCH = withAttachmentAccessErrors(updateAttachment)
+export const DELETE = withAttachmentAccessErrors(deleteAttachment)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: 'Attachment detail management',
@@ -294,6 +317,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
     PATCH: {
@@ -311,6 +336,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
         { status: 500, description: 'Failed to save attributes', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
     DELETE: {
@@ -323,6 +350,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/library/route.ts

@@ -1,3 +1,6 @@
+import { createAttachmentAccessContext } from '../../lib/access-runner'
+import { requiresAttachmentAccessScan, scanAuthorizedAttachments } from '../../lib/access-query'
+import { withAttachmentAccessErrors } from '../../lib/access-errors'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -55,7 +58,7 @@ function formatDateValue(value: unknown): string {
   return toDate().toISOString()
 }
 
-export async function GET(req: Request) {
+async function listAttachments(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -69,7 +72,8 @@ export async function GET(req: Request) {
   const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data
   const tagList = buildTagFilter(tags)
   const offset = (page - 1) * pageSize
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   await ensureDefaultPartitions(em)
   let queryEngine: QueryEngine | null = null
@@ -100,15 +104,32 @@ export async function GET(req: Request) {
     createdAt: 'a.created_at',
   }
   const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'
-  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })
+  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc', 'a.id': 'asc' })
   qb.limit(pageSize).offset(offset)
 
-  const partitionsPromise = em.find(
-    AttachmentPartition,
-    {},
-    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },
-  )
-  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])
+  const partitions = await em.find(AttachmentPartition, {}, { orderBy: { title: 'asc' } })
+  const protectedScan = requiresAttachmentAccessScan(partitions)
+  const accessContext = createAttachmentAccessContext(container)
+  const deadline = Date.now() + 15_000
+  let records: Attachment[]
+  let total: number
+  let authorizedTags: string[] | null = null
+  if (protectedScan) {
+    const scanned = await scanAuthorizedAttachments({
+      auth, context: accessContext, partitions, offset, limit: pageSize, deadline,
+      loadBatch: (batchOffset, limit) => qb.clone().limit(limit).offset(batchOffset).getResultList(),
+    })
+    records = scanned.records
+    total = scanned.total
+    const facetQuery = em.createQueryBuilder(Attachment, 'a').where(baseFilter).orderBy({ 'a.id': 'asc' })
+    const facets = await scanAuthorizedAttachments({
+      auth, context: accessContext, partitions, limit: 0, collectTags: true, deadline,
+      loadBatch: (batchOffset, limit) => facetQuery.clone().limit(limit).offset(batchOffset).getResultList(),
+    })
+    authorizedTags = facets.tags
+  } else {
+    ;[records, total] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true)])
+  }
   const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {
     if (entry.code) acc[entry.code] = entry.title ?? entry.code
     return acc
@@ -154,6 +175,8 @@ export async function GET(req: Request) {
     : items
 
   const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))
+  let availableTags = authorizedTags ?? []
+  if (!protectedScan) {
   const db = em.getKysely<any>() as any
   let tagQuery = db
     .selectFrom('attachments')
@@ -163,9 +186,10 @@ export async function GET(req: Request) {
     tagQuery = tagQuery.where('organization_id', '=', auth.orgId)
   }
   const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>
-  const availableTags = tagRows
+  availableTags = tagRows
     .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))
     .filter((tag) => tag.length > 0)
+  }
 
   return NextResponse.json({
     items: enrichedItems,
@@ -180,9 +204,11 @@ export async function GET(req: Request) {
       description: entry.description ?? null,
       isPublic: entry.isPublic ?? false,
     })),
-  })
+  }, { headers: protectedScan ? { 'Cache-Control': 'private, no-store' } : undefined })
 }
 
+export const GET = withAttachmentAccessErrors(listAttachments)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: 'Attachment library management',
@@ -197,6 +223,9 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 404, description: 'Attachment or owner is unavailable', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/partitions/route.ts

@@ -7,6 +7,7 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { Attachment, AttachmentPartition } from '../../data/entities'
 import { ensureDefaultPartitions, DEFAULT_ATTACHMENT_PARTITIONS, sanitizePartitionCode, isPartitionSettingsLocked } from '../../lib/partitions'
 import { resolvePartitionEnvKey } from '../../lib/partitionEnv'
+import { getDeclaredAttachmentAccessRequirements } from '../../lib/access-protection'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveDefaultAttachmentOcrEnabled } from '../../lib/ocrConfig'
 import {
@@ -127,6 +128,7 @@ export async function POST(req: Request) {
   }
   const entry = em.create(AttachmentPartition, {
     code,
+    accessResolverRequirements: getDeclaredAttachmentAccessRequirements(code),
     title: parsed.data.title.trim(),
     description: parsed.data.description?.trim() ?? null,
     storageDriver: parsed.data.storageDriver ?? 'local',