@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7749.1.ea3edf75e3

package/src/modules/attachments/api/library/[id]/route.ts

@@ -1,3 +1,11 @@
+import { LockMode } from '@mikro-orm/core'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { prepareAttachmentMutation } from '../../../lib/access-mutation'
+import { throwAttachmentAccessError } from '../../../lib/access-errors'
+import { createAttachmentAccessContext } from '../../../lib/access-runner'
+import { assertAttachmentOwnerAccess } from '../../../lib/access-query'
+import { withAttachmentAccessErrors } from '../../../lib/access-errors'
 import { NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -12,7 +20,7 @@ import {
   readAttachmentMetadata,
 } from '../../../lib/metadata'
 import type { StorageDriverFactory } from '../../../lib/drivers'
-import { removeAttachmentRecord } from '../../../lib/storageReferences'
+import { lockAttachmentStorageReferences, resolveAttachmentStorageRelease } from '../../../lib/storageReferences'
 import { splitCustomFieldPayload, loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'
 import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
@@ -26,9 +34,6 @@ import {
   attachmentDetailResponseSchema,
   attachmentErrorSchema,
 } from '../../openapi'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-
-const logger = createLogger('attachments').child({ component: 'library' })
 
 const updateSchema = z.object({
   tags: z.array(z.string()).optional(),
@@ -66,7 +71,7 @@ async function resolveAttachmentId(ctx: RouteContext): Promise<string | null> {
   }
 }
 
-export async function GET(req: NextRequest, ctx: RouteContext) {
+async function getAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -75,7 +80,8 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   let queryEngine: QueryEngine | null = null
   try {
@@ -94,6 +100,7 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
   if (!record) {
     return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   }
+  await assertAttachmentOwnerAccess({ em, context: createAttachmentAccessContext(container), auth, attachment: record, action: 'metadata' })
   const metadata = readAttachmentMetadata(record.storageMetadata)
   const partition = record.partitionCode
     ? await em.findOne(AttachmentPartition, { code: record.partitionCode })
@@ -127,10 +134,12 @@ export async function GET(req: NextRequest, ctx: RouteContext) {
       content: record.content && record.content.trim() ? record.content : null,
       customFields,
     },
-  })
+  }, { headers: { 'Cache-Control': 'private, no-store' } })
 }
 
-export async function PATCH(req: NextRequest, ctx: RouteContext) {
+export const GET = withAttachmentAccessErrors(getAttachment)
+
+async function updateAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -139,13 +148,14 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const rawBody = await req.json().catch(() => null)
+  const rawBody = await readJsonSafe(req, null)
   const { base, custom } = splitCustomFieldPayload(rawBody)
   const parsed = updateSchema.safeParse(base)
   if (!parsed.success) {
     return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   let queryEngine: QueryEngine | null = null
   try {
@@ -159,34 +169,38 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   }
-  const record = await em.findOne(Attachment, patchFilter)
-  if (!record) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  const patch: Record<string, unknown> = {}
-  if (parsed.data.tags) patch.tags = normalizeAttachmentTags(parsed.data.tags)
-  if (parsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(parsed.data.assignments)
-  record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)
-  // Commit the metadata mutation and the custom-field write atomically so a
-  // custom-field failure cannot leave the attachment metadata partially updated.
-  try {
-    await em.transactional(async (tx) => {
-      await tx.flush()
-      if (dataEngine && custom && Object.keys(custom).length) {
-        await setCustomFieldsIfAny({
-          dataEngine,
-          entityId: E.attachments.attachment,
-          recordId: record.id,
-          tenantId: record.tenantId ?? auth.tenantId ?? null,
-          organizationId: record.organizationId ?? auth.orgId ?? null,
-          values: custom,
-        })
-      }
+  const accessContext = createAttachmentAccessContext(container)
+  const outcome = await em.transactional(async (tx) => {
+    const record = await findOneWithDecryption(tx, Attachment, patchFilter, {
+      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId })
+    if (!record) return throwAttachmentAccessError(404)
+    const guard = await prepareAttachmentMutation({
+      container, req, auth, recordId: record.id, operation: 'update',
+      payload: { ...parsed.data, customFields: custom },
     })
-  } catch (error) {
-    logger.error('Failed to persist custom attributes', { err: error })
-    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
-  }
+    const effective = splitCustomFieldPayload(guard.modifiedPayload ?? { ...parsed.data, customFields: custom })
+    const effectiveParsed = updateSchema.safeParse(effective.base)
+    if (!effectiveParsed.success) return throwAttachmentAccessError(403)
+    const patch: Record<string, unknown> = {}
+    if (effectiveParsed.data.tags) patch.tags = normalizeAttachmentTags(effectiveParsed.data.tags)
+    if (effectiveParsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(effectiveParsed.data.assignments)
+    const nextMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: 'reassign', persistProtection: true })
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, storageMetadata: nextMetadata }, action: 'reassign' })
+    await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, storageMetadata: nextMetadata }, action: 'metadata' })
+    record.storageMetadata = nextMetadata
+    await tx.flush()
+    if (dataEngine && Object.keys(effective.custom).length) {
+      await setCustomFieldsIfAny({ dataEngine, entityId: E.attachments.attachment, recordId: record.id,
+        tenantId: record.tenantId ?? auth.tenantId, organizationId: record.organizationId ?? auth.orgId,
+        values: effective.custom,
+      })
+    }
+    return { record, custom: effective.custom, guard }
+  })
+  const { record } = outcome
+  await outcome.guard.runAfterSuccess()
 
   if (dataEngine) {
     await emitCrudSideEffects({
@@ -218,12 +232,12 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
       id: record.id,
       tags: metadata.tags ?? [],
       assignments: enrichedAssignments,
-      customFields: normalizeCustomFieldResponse(custom ?? null),
+      customFields: normalizeCustomFieldResponse(outcome.custom ?? null),
     },
   })
 }
 
-export async function DELETE(req: NextRequest, ctx: RouteContext) {
+async function deleteAttachment(req: NextRequest, ctx: RouteContext) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -232,7 +246,8 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
   if (!attachmentId) {
     return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
   }
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   const dataEngine = resolve('dataEngine') as DataEngine
   const storageDriverFactory = resolve('storageDriverFactory') as StorageDriverFactory
@@ -241,25 +256,30 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   }
-  const record = await em.findOne(Attachment, deleteFilter)
-  if (!record) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  const deleteDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
-    tenantId: record.tenantId ?? auth.tenantId,
-    organizationId: record.organizationId ?? auth.orgId,
+  const outcome = await em.transactional(async (tx) => {
+    const candidate = await findOneWithDecryption(tx, Attachment, deleteFilter, undefined, {
+      tenantId: auth.tenantId, organizationId: auth.orgId,
+    })
+    if (!candidate) return throwAttachmentAccessError(404)
+    const referenceIds = await lockAttachmentStorageReferences(tx, candidate)
+    const removal = resolveAttachmentStorageRelease(referenceIds, candidate.id)
+    if (!removal.removed) return throwAttachmentAccessError(404)
+    const record = await findOneWithDecryption(tx, Attachment, deleteFilter, {
+      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId })
+    if (!record) return throwAttachmentAccessError(404)
+    const guard = await prepareAttachmentMutation({ container, req, auth, recordId: record.id, operation: 'delete' })
+    await assertAttachmentOwnerAccess({ em: tx, context: createAttachmentAccessContext(container), auth, attachment: record, action: 'delete' })
+    const driver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
+      tenantId: record.tenantId ?? auth.tenantId!, organizationId: record.organizationId ?? auth.orgId!,
+    })
+    tx.remove(record)
+    await tx.flush()
+    return { record, driver, guard, releaseStorage: removal.releaseStorage }
   })
-  // Commit the DB row removal before deleting the irreversible storage file so a
-  // failed commit cannot leave a dangling record whose backing file is already gone.
-  const recordPartitionCode = record.partitionCode
-  const recordStoragePath = record.storagePath
-  const removal = await removeAttachmentRecord(em, record)
-  if (!removal.removed) {
-    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  }
-  if (removal.releaseStorage) {
-    await deleteDriver.delete(recordPartitionCode, recordStoragePath)
-  }
+  const { record } = outcome
+  if (outcome.releaseStorage) await outcome.driver.delete(record.partitionCode, record.storagePath)
+  await outcome.guard.runAfterSuccess()
 
   if (dataEngine) {
     await emitCrudSideEffects({
@@ -280,6 +300,9 @@ export async function DELETE(req: NextRequest, ctx: RouteContext) {
   return NextResponse.json({ ok: true })
 }
 
+export const PATCH = withAttachmentAccessErrors(updateAttachment)
+export const DELETE = withAttachmentAccessErrors(deleteAttachment)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: 'Attachment detail management',
@@ -294,6 +317,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
     PATCH: {
@@ -311,6 +336,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
         { status: 500, description: 'Failed to save attributes', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
     DELETE: {
@@ -323,6 +350,8 @@ export const openApi: OpenApiRouteDoc = {
         { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/library/route.ts

@@ -1,3 +1,6 @@
+import { createAttachmentAccessContext } from '../../lib/access-runner'
+import { requiresAttachmentAccessScan, scanAuthorizedAttachments } from '../../lib/access-query'
+import { withAttachmentAccessErrors } from '../../lib/access-errors'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -55,7 +58,7 @@ function formatDateValue(value: unknown): string {
   return toDate().toISOString()
 }
 
-export async function GET(req: Request) {
+async function listAttachments(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -69,7 +72,8 @@ export async function GET(req: Request) {
   const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data
   const tagList = buildTagFilter(tags)
   const offset = (page - 1) * pageSize
-  const { resolve } = await createRequestContainer()
+  const container = await createRequestContainer()
+  const { resolve } = container
   const em = resolve('em') as EntityManager
   await ensureDefaultPartitions(em)
   let queryEngine: QueryEngine | null = null
@@ -100,15 +104,32 @@ export async function GET(req: Request) {
     createdAt: 'a.created_at',
   }
   const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'
-  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })
+  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc', 'a.id': 'asc' })
   qb.limit(pageSize).offset(offset)
 
-  const partitionsPromise = em.find(
-    AttachmentPartition,
-    {},
-    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },
-  )
-  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])
+  const partitions = await em.find(AttachmentPartition, {}, { orderBy: { title: 'asc' } })
+  const protectedScan = requiresAttachmentAccessScan(partitions)
+  const accessContext = createAttachmentAccessContext(container)
+  const deadline = Date.now() + 15_000
+  let records: Attachment[]
+  let total: number
+  let authorizedTags: string[] | null = null
+  if (protectedScan) {
+    const scanned = await scanAuthorizedAttachments({
+      auth, context: accessContext, partitions, offset, limit: pageSize, deadline,
+      loadBatch: (batchOffset, limit) => qb.clone().limit(limit).offset(batchOffset).getResultList(),
+    })
+    records = scanned.records
+    total = scanned.total
+    const facetQuery = em.createQueryBuilder(Attachment, 'a').where(baseFilter).orderBy({ 'a.id': 'asc' })
+    const facets = await scanAuthorizedAttachments({
+      auth, context: accessContext, partitions, limit: 0, collectTags: true, deadline,
+      loadBatch: (batchOffset, limit) => facetQuery.clone().limit(limit).offset(batchOffset).getResultList(),
+    })
+    authorizedTags = facets.tags
+  } else {
+    ;[records, total] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true)])
+  }
   const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {
     if (entry.code) acc[entry.code] = entry.title ?? entry.code
     return acc
@@ -154,6 +175,8 @@ export async function GET(req: Request) {
     : items
 
   const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))
+  let availableTags = authorizedTags ?? []
+  if (!protectedScan) {
   const db = em.getKysely<any>() as any
   let tagQuery = db
     .selectFrom('attachments')
@@ -163,9 +186,10 @@ export async function GET(req: Request) {
     tagQuery = tagQuery.where('organization_id', '=', auth.orgId)
   }
   const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>
-  const availableTags = tagRows
+  availableTags = tagRows
     .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))
     .filter((tag) => tag.length > 0)
+  }
 
   return NextResponse.json({
     items: enrichedItems,
@@ -180,9 +204,11 @@ export async function GET(req: Request) {
       description: entry.description ?? null,
       isPublic: entry.isPublic ?? false,
     })),
-  })
+  }, { headers: protectedScan ? { 'Cache-Control': 'private, no-store' } : undefined })
 }
 
+export const GET = withAttachmentAccessErrors(listAttachments)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: 'Attachment library management',
@@ -197,6 +223,9 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },
+        { status: 404, description: 'Attachment or owner is unavailable', schema: attachmentErrorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },
       ],
     },
   },

package/src/modules/attachments/api/partitions/route.ts

@@ -7,6 +7,7 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { Attachment, AttachmentPartition } from '../../data/entities'
 import { ensureDefaultPartitions, DEFAULT_ATTACHMENT_PARTITIONS, sanitizePartitionCode, isPartitionSettingsLocked } from '../../lib/partitions'
 import { resolvePartitionEnvKey } from '../../lib/partitionEnv'
+import { getDeclaredAttachmentAccessRequirements } from '../../lib/access-protection'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveDefaultAttachmentOcrEnabled } from '../../lib/ocrConfig'
 import {
@@ -127,6 +128,7 @@ export async function POST(req: Request) {
   }
   const entry = em.create(AttachmentPartition, {
     code,
+    accessResolverRequirements: getDeclaredAttachmentAccessRequirements(code),
     title: parsed.data.title.trim(),
     description: parsed.data.description?.trim() ?? null,
     storageDriver: parsed.data.storageDriver ?? 'local',

package/src/modules/attachments/api/route.ts

@@ -1,3 +1,10 @@
+import { LockMode } from '@mikro-orm/core'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { prepareAttachmentMutation } from '../lib/access-mutation'
+import { throwAttachmentAccessError } from '../lib/access-errors'
+import { createAttachmentAccessContext } from '../lib/access-runner'
+import { assertAttachmentOwnerAccess, requiresAttachmentAccessScan, scanAuthorizedAttachments } from '../lib/access-query'
+import { withAttachmentAccessErrors } from '../lib/access-errors'
 import { NextResponse } from 'next/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
@@ -5,6 +12,7 @@ import { z } from 'zod'
 import { sql } from 'kysely'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'
+import { ensureAttachmentPartitionProtection } from '../lib/access-protection'
 import { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'
 import { Attachment, AttachmentPartition } from '../data/entities'
 import { extractAttachmentContent } from '../lib/textExtraction'
@@ -12,7 +20,7 @@ import { requestOcrProcessing } from '../lib/ocrQueue'
 import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
-import { removeAttachmentRecord } from '../lib/storageReferences'
+import { lockAttachmentStorageReferences, resolveAttachmentStorageRelease } from '../lib/storageReferences'
 import { assertAttachmentScopeInvariant } from '../lib/access'
 import { resolveAttachmentRequestScope } from '../lib/requestScope'
 import {
@@ -193,7 +201,7 @@ function parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssig
   }
 }
 
-export async function GET(req: Request) {
+async function listRecordAttachments(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   const url = new URL(req.url)
@@ -217,29 +225,29 @@ export async function GET(req: Request) {
   if (orgId) filter.organizationId = orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC', id: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
-  const total = usePaging ? await em.count(Attachment, filter) : null
   const currentPage = usePaging ? Math.max(1, page) : null
   const currentPageSize = usePaging ? pageSize : null
-  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null
   const pageOffset = usePaging ? (currentPage! - 1) * currentPageSize! : undefined
-  const items = await findWithDecryption(
-    em,
-    Attachment,
-    filter,
-    {
-      orderBy,
-      ...(usePaging
-        ? {
-            limit: currentPageSize!,
-            offset: pageOffset,
-          }
-        : { limit: ATTACHMENT_LIST_MAX_PAGE_SIZE }),
-    },
-    {
-      tenantId: auth.tenantId ?? null,
-      organizationId: orgId ?? null,
-    },
-  )
+  const partitions = await em.find(AttachmentPartition, {})
+  const protectedScan = requiresAttachmentAccessScan(partitions)
+  const scope = { tenantId: auth.tenantId ?? null, organizationId: orgId ?? null }
+  let items: Attachment[]
+  let total: number | null
+  if (protectedScan) {
+    const scanned = await scanAuthorizedAttachments({
+      auth: { ...auth, orgId }, context: createAttachmentAccessContext(container), partitions,
+      offset: pageOffset, limit: currentPageSize ?? ATTACHMENT_LIST_MAX_PAGE_SIZE,
+      loadBatch: (offset, limit) => findWithDecryption(em, Attachment, filter, { orderBy, offset, limit }, scope),
+    })
+    items = scanned.records
+    total = usePaging ? scanned.total : null
+  } else {
+    total = usePaging ? await em.count(Attachment, filter) : null
+    items = await findWithDecryption(em, Attachment, filter, {
+      orderBy, ...(usePaging ? { limit: currentPageSize!, offset: pageOffset } : { limit: ATTACHMENT_LIST_MAX_PAGE_SIZE }),
+    }, scope)
+  }
+  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null
   return NextResponse.json({
     items: items.map((a: any) => {
       const metadata = readAttachmentMetadata(a.storageMetadata)
@@ -269,9 +277,11 @@ export async function GET(req: Request) {
           totalPages,
         }
       : {}),
-  })
+  }, { headers: protectedScan ? { 'Cache-Control': 'private, no-store' } : undefined })
 }
 
+export const GET = withAttachmentAccessErrors(listRecordAttachments)
+
 export async function POST(req: Request) {
   const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
@@ -458,6 +468,7 @@ export async function POST(req: Request) {
   if (!partition) {
     return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })
   }
+  await ensureAttachmentPartitionProtection(em, partition)
   const requestedPublicOverride =
     typeof partitionOverride === 'string' &&
     partitionOverride.length > 0 &&
@@ -703,7 +714,7 @@ async function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: strin
   }
 }
 
-export async function DELETE(req: Request) {
+async function deleteAttachment(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   const url = new URL(req.url)
@@ -724,20 +735,34 @@ export async function DELETE(req: Request) {
   const orgId = deleteScope.organizationId
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
   if (orgId) deleteFilter.organizationId = orgId
-  const record = await em.findOne(Attachment, deleteFilter)
-  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
-  const removal = await removeAttachmentRecord(em, record)
-  if (!removal.removed) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
+  const scopedAuth = { ...auth, orgId }
+  const outcome = await em.transactional(async (tx) => {
+    const candidate = await findOneWithDecryption(tx, Attachment, deleteFilter, undefined, {
+      tenantId: auth.tenantId, organizationId: orgId,
+    })
+    if (!candidate) return throwAttachmentAccessError(404)
+    const referenceIds = await lockAttachmentStorageReferences(tx, candidate)
+    const removal = resolveAttachmentStorageRelease(referenceIds, candidate.id)
+    if (!removal.removed) return throwAttachmentAccessError(404)
+    const record = await findOneWithDecryption(tx, Attachment, deleteFilter, {
+      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,
+    }, { tenantId: auth.tenantId, organizationId: orgId })
+    if (!record) return throwAttachmentAccessError(404)
+    const guard = await prepareAttachmentMutation({ container, req, auth: scopedAuth, recordId: record.id, operation: 'delete' })
+    await assertAttachmentOwnerAccess({ em: tx, context: createAttachmentAccessContext(container), auth: scopedAuth, attachment: record, action: 'delete' })
+    const driver = record.storagePath ? await storageDriverFactory.resolveForPartition(record.partitionCode, {
+      tenantId: record.tenantId ?? auth.tenantId!, organizationId: record.organizationId ?? orgId ?? '',
+    }) : null
+    tx.remove(record)
+    await tx.flush()
+    return { record, driver, guard, releaseStorage: removal.releaseStorage }
+  })
+  const { record } = outcome
   await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {
     logger.error('Failed to cleanup cached thumbnails', { err: error })
   })
-  if (record.storagePath && removal.releaseStorage) {
-    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
-      tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? orgId ?? '',
-    })
-    await delDriver.delete(record.partitionCode, record.storagePath)
-  }
+  if (outcome.driver && outcome.releaseStorage) await outcome.driver.delete(record.partitionCode, record.storagePath)
+  await outcome.guard.runAfterSuccess()
   if (dataEngine) {
     await emitCrudSideEffects({
       dataEngine,
@@ -756,6 +781,8 @@ export async function DELETE(req: Request) {
   return NextResponse.json({ ok: true })
 }
 
+export const DELETE = withAttachmentAccessErrors(deleteAttachment)
+
 export const openApi: OpenApiRouteDoc = {
   summary: 'Manage entity attachments',
   description: 'Upload and list attachments associated with module entities and records.',
@@ -770,6 +797,9 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },
         { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: errorSchema },
+        { status: 404, description: 'Attachment or owner is unavailable', schema: errorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: errorSchema },
       ],
     },
     POST: {
@@ -799,6 +829,9 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Missing attachment identifier', schema: errorSchema },
         { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Owner policy denies access', schema: errorSchema },
+        { status: 404, description: 'Attachment or owner is unavailable', schema: errorSchema },
+        { status: 504, description: 'Owner authorization timed out', schema: errorSchema },
       ],
     },
   },