@open-mercato/core 0.10.1-develop.7836.1.0ef0f453c6 → 0.10.1-develop.7841.1.af87ac614d

package/src/modules/customers/lib/dictionaryLabels.ts

@@ -0,0 +1,73 @@
+import type { AwilixContainer } from 'awilix'
+import type { Locale } from '@open-mercato/shared/lib/i18n/config'
+import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
+import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { getTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { CUSTOMER_DICTIONARY_DEFAULTS } from './dictionaryDefaults'
+
+const logger = createLogger('customers').child({ component: 'dictionary-labels' })
+
+type DictionaryLabelEntry = {
+  id: string
+  value: string
+  label: string
+  organizationId: string
+}
+
+export function customerDictionaryLabelKey(kind: string, value: string): string {
+  const token = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_|_$/g, '')
+  return `customers.dictionaries.defaults.${kind}.${token}`
+}
+
+export async function localizeCustomerDictionaryEntries<T extends DictionaryLabelEntry>(
+  entries: T[],
+  options: { kind: string; locale: string; tenantId: string; container: AwilixContainer },
+): Promise<T[]> {
+  if (!entries.length) return []
+  const dictionaryLocale = options.locale.toLowerCase().split('-')[0] as Locale
+  const translate = createFallbackTranslator(await loadDictionary(dictionaryLocale))
+  const defaults = Object.prototype.hasOwnProperty.call(CUSTOMER_DICTIONARY_DEFAULTS, options.kind)
+    ? CUSTOMER_DICTIONARY_DEFAULTS[options.kind]
+    : []
+  const localized = entries.map((entry) => {
+    const seeded = defaults.find((candidate) => candidate.value === entry.value && candidate.label === entry.label)
+    const renewalQuarter = options.kind === 'renewal_quarter' ? /^(\d{4})_q([1-4])$/.exec(entry.value) : null
+    const label = renewalQuarter && entry.label === `Q${renewalQuarter[2]} ${renewalQuarter[1]}`
+      ? translate('customers.dictionaries.defaults.renewal_quarter.label', entry.label, {
+          year: renewalQuarter[1], quarter: renewalQuarter[2],
+        })
+      : seeded ? translate(customerDictionaryLabelKey(options.kind, seeded.value), entry.label) : entry.label
+    return {
+      ...entry,
+      label,
+    }
+  })
+  const { overlay } = getTranslationOverlayPlugin()
+  if (!overlay) return localized
+
+  const organizationIds = new Set(localized.map((entry) => entry.organizationId))
+  const labelsById = new Map<string, string>()
+  for (const organizationId of organizationIds) {
+    const items = localized.filter((entry) => entry.organizationId === organizationId)
+    try {
+      const translated = await overlay(items.map(({ id, label }) => ({ id, label })), {
+        entityType: 'customers:customer_dictionary_entry',
+        locale: options.locale,
+        tenantId: options.tenantId,
+        organizationId,
+        container: options.container,
+      })
+      for (const item of translated) {
+        if (typeof item.id === 'string' && typeof item.label === 'string' && item.label.trim()) {
+          labelsById.set(item.id, item.label)
+        }
+      }
+    } catch (error) {
+      getTelemetryRuntime()?.reportError(error, { module: 'customers', code: 'customers.dictionary_translation_failed' })
+      logger.warn('Translation overlay failed', { error })
+    }
+  }
+  return localized.map((entry) => ({ ...entry, label: labelsById.get(entry.id) ?? entry.label }))
+}

package/src/modules/customers/lib/interactionCompatibility.ts

@@ -63,6 +63,7 @@ export function mapInteractionRecordToTodoSummary(interaction: InteractionRecord
     todoId: interaction.id,
     todoSource: CUSTOMER_INTERACTION_TASK_SOURCE,
     createdAt: interaction.createdAt,
+    updatedAt: interaction.updatedAt,
     title: interaction.title ?? null,
     isDone: interaction.status === 'done',
     status: interaction.status,

package/src/modules/customers/translations.ts

@@ -0,0 +1,5 @@
+export const translatableFields: Record<string, string[]> = {
+  'customers:customer_dictionary_entry': ['label'],
+}
+
+export default translatableFields

package/src/modules/eudr/index.ts

@@ -7,6 +7,19 @@ export const metadata: ModuleInfo = {
   description: 'EU Deforestation Regulation compliance: product commodity mappings, supplier origin evidence, due diligence statements.',
   author: 'Open Mercato Team',
   license: 'MIT',
+  /**
+   * `catalog` is a HARD dependency, and saying so is the fix.
+   *
+   * `data/enrichers.ts` reads `E.catalog.catalog_product` at module scope, so with `catalog` disabled
+   * `E.catalog` is undefined and the read throws while the enricher registry is being imported — which takes
+   * `/api/auth/login` with it. An installation shaped as a CRM rather than a shop could not reach its own login
+   * screen, and the error named a property rather than a module.
+   *
+   * Declared rather than defended with optional chaining. This module exists to map PRODUCTS to deforestation
+   * compliance evidence, so without a catalogue it has nothing to work on at all — the honest answer is that it
+   * cannot be enabled, which the generator now says before anybody starts the app rather than after.
+   */
+  requires: ['catalog'],
   ejectable: true,
 }
 

package/src/modules/staff/api/timesheets/access-requests/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -74,7 +75,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   if (!requesterUserId) {
     throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
   }
-  if (!auth.orgId) {
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  if (!scope.tenantId || !scope.selectedId || scope.selectionRejected === true) {
     throw new CrudHttpError(400, {
       error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),
     })
@@ -82,8 +84,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   return {
     container,
     em: (container.resolve('em') as EntityManager).fork(),
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
     requesterUserId,
     requesterEmail: typeof auth.email === 'string' && auth.email.trim().length > 0 ? auth.email : null,
     translate,
@@ -155,17 +157,14 @@ async function resolveRequesterName(context: AccessRequestContext): Promise<stri
 async function POST(req: Request) {
   try {
     const context = await resolveAccessRequestContext(req)
-    // The grant list the interceptors and the mutation-guard registry gate on
-    // comes from the module's single RBAC authority, so it is always an array:
-    // the nullable read it replaces could not say whether an empty answer meant
-    // "no grants" or "could not ask". Authorization itself stays with the
-    // declarative `requireFeatures` guard in `metadata`.
-    const grantedFeatures = (
-      await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
-        tenantId: context.tenantId,
-        organizationId: context.organizationId,
-      })
-    ).grantedFeatures
+    const featureAccess = await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+    })
+    if (!featureAccess.allowed) {
+      throw new CrudHttpError(403, { error: context.translate('staff.errors.forbidden', 'Forbidden') })
+    }
+    const grantedFeatures = featureAccess.grantedFeatures
 
     const interceptors = await runTimesheetInterceptors({
       request: req,

package/src/modules/staff/api/timesheets/time-projects/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { staffTimeProjectCrudEvents } from '../../../lib/crud'
+import { PROJECT_SCOPE_TENANT_HEADER, PROJECT_SCOPE_ORGANIZATION_HEADER, type ResolvedProjectAccessScope } from '../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -500,24 +501,28 @@ async function buildAccessDenialResponse(): Promise<Response> {
  * `reason` discriminator carries only "you are not a member of this project",
  * never the project or customer it is refusing to describe.
  */
-async function resolveProjectAccessDenial(req: Request): Promise<Response | null> {
+async function resolveProjectAccessDenial(req: Request): Promise<{ denial: Response | null; scope: ResolvedProjectAccessScope | null }> {
+  const unresolved = { denial: null, scope: null }
   const url = new URL(req.url)
   const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')
-  if (!isIdsParamProvided(rawIds)) return null
+  if (!isIdsParamProvided(rawIds)) return unresolved
   const requestedIds = parseIdsParam(rawIds)
   // Malformed ids match nothing on their own; the factory answers an empty list.
-  if (requestedIds.length === 0) return null
+  if (requestedIds.length === 0) return unresolved
 
   try {
     const container = await createRequestContainer()
     const auth = await getAuthFromRequest(req)
     // Unauthenticated and unscoped requests are the factory's to reject.
-    if (!auth) return null
+    if (!auth) return unresolved
     const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
     const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null
     const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth) ?? null
-    if (!tenantId || !organizationId) return null
+    if (!tenantId || !organizationId) return unresolved
 
+    const scope = orgScope?.tenantId && orgScope.selectedId && orgScope.selectionRejected !== true
+      ? { tenantId: orgScope.tenantId, organizationId: orgScope.selectedId }
+      : null
     const access = await resolveRequestProjectAccess(req, () =>
       loadProjectAccess(
         container,
@@ -526,20 +531,24 @@ async function resolveProjectAccessDenial(req: Request): Promise<Response | null
         organizationId,
       ),
     )
-    if (access.canManageAll) return null
-    if (requestedIds.some((id) => access.projectIds.includes(id))) return null
-    return await buildAccessDenialResponse()
+    if (access.canManageAll) return { denial: null, scope }
+    if (requestedIds.some((id) => access.projectIds.includes(id))) return { denial: null, scope }
+    return { denial: await buildAccessDenialResponse(), scope }
   } catch (err) {
     // Fail closed: an access decision that could not be made is a denial.
     logger.error('staff.timesheets.time-projects denial probe failed', { err })
-    return await buildAccessDenialResponse()
+    return { denial: await buildAccessDenialResponse(), scope: null }
   }
 }
 
 export async function GET(req: Request): Promise<Response> {
-  const denial = await resolveProjectAccessDenial(req)
-  if (denial) return denial
-  return crud.GET(req)
+  const { denial, scope } = await resolveProjectAccessDenial(req)
+  const response = denial ?? await crud.GET(req)
+  if (scope) {
+    response.headers.set(PROJECT_SCOPE_TENANT_HEADER, scope.tenantId)
+    response.headers.set(PROJECT_SCOPE_ORGANIZATION_HEADER, scope.organizationId)
+  }
+  return response
 }
 
 export const POST = crud.POST
@@ -611,7 +620,7 @@ export const openApi = {
       ? {
           GET: {
             ...baseOpenApi.methods.GET,
-            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
+            description: `${baseOpenApi.methods.GET.description ?? ''} Project-specific reads include optional x-om-project-scope-tenant-id and x-om-project-scope-organization-id response headers when the server resolves a scope. These identify the request scope for client hydration; a missing header provides no scope identity. Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
             responses: [
               ...(baseOpenApi.methods.GET.responses ?? []),
               {

package/src/modules/staff/backend/staff/time-tracking/projects/[id]/edit/page.tsx

@@ -15,6 +15,8 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { DEFAULT_BUDGET_WARN_AT_PERCENT, type ProjectBudgetKind } from '../../../../../../lib/time-tracking-ui/ProjectFormSections'
 import { NoProjectAccess } from '../../../../../../lib/time-tracking-ui/NoProjectAccess'
+import { useProjectAccessScope } from '../../../../../../lib/time-tracking-ui/projectAccessScope'
+import { readResolvedProjectAccessScope, type ResolvedProjectAccessScope } from '../../../../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import {
   buildProjectPayload,
   createProjectFormFields,
@@ -36,7 +38,7 @@ const NO_PROJECT_ACCESS_REASON = 'no_project_access'
 
 /** Thrown by the loader so the caller can branch on the guard state. */
 class ProjectAccessDeniedError extends Error {
-  constructor() {
+  constructor(readonly resolvedScope: ResolvedProjectAccessScope | null) {
     super('[internal] no project access')
     this.name = 'ProjectAccessDeniedError'
   }
@@ -106,25 +108,28 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   const t = useT()
   const router = useRouter()
   const scopeVersion = useOrganizationScopeVersion()
+  const { scopeKey: projectAccessScopeKey, resolvedScope, resolveScope } = useProjectAccessScope(projectId)
 
   const [initialValues, setInitialValues] = React.useState<ProjectFormValues | null>(null)
   const [loading, setLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
-  const [accessDenied, setAccessDenied] = React.useState(false)
+  const [accessDeniedScopeKey, setAccessDeniedScopeKey] = React.useState<string | null>(null)
+  const [loadedScopeKey, setLoadedScopeKey] = React.useState<string | null>(null)
+  const accessDenied = accessDeniedScopeKey === projectAccessScopeKey
 
-  const fetchProject = React.useCallback(async (): Promise<ProjectRecord | null> => {
+  const fetchProject = React.useCallback(async (): Promise<{ record: ProjectRecord | null; scope: ResolvedProjectAccessScope | null }> => {
     const call = await apiCall<{ items?: ProjectRecord[]; reason?: unknown }>(
       `/api/staff/timesheets/time-projects?ids=${projectId}&pageSize=1`,
     )
     if (call.status === 404 && call.result?.reason === NO_PROJECT_ACCESS_REASON) {
-      throw new ProjectAccessDeniedError()
+      throw new ProjectAccessDeniedError(readResolvedProjectAccessScope(call.response))
     }
     if (!call.ok) {
       throw new Error(t('staff.timesheets.projects.errors.load', 'Failed to load project.'))
     }
     const record = Array.isArray(call.result?.items) ? call.result.items[0] : null
-    return record ?? null
+    return { record: record ?? null, scope: readResolvedProjectAccessScope(call.response) }
   }, [projectId, t])
 
   /**
@@ -137,7 +142,7 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   const handleCurrencyChanged = React.useCallback(() => {
     if (!projectId) return
     void fetchProject()
-      .then((record) => { if (record) setInitialValues(toValues(record)) })
+      .then(({ record }) => { if (record) setInitialValues(toValues(record)) })
       .catch(() => {
         // Best effort: the optimistic-lock conflict bar remains the backstop.
       })
@@ -159,25 +164,30 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   // it was loaded for. The decision looks at the load this one replaces,
   // settled or not: a version-0 load cancelled by a quick second switch must
   // not let that switch through.
-  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number } | null>(null)
+  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number; scopeKey: string } | null>(null)
   React.useEffect(() => {
     if (!projectId) return
     let cancelled = false
     const replaced = lastLoadRef.current
-    lastLoadRef.current = { projectId, scopeVersion }
-    const keepScreen = replaced !== null && replaced.projectId === projectId && replaced.scopeVersion === 0
+    lastLoadRef.current = { projectId, scopeVersion, scopeKey: projectAccessScopeKey }
+    const keepScreen = replaced !== null
+      && replaced.projectId === projectId
+      && replaced.scopeVersion === 0
+      && replaced.scopeKey === projectAccessScopeKey
     async function load() {
       if (!keepScreen) setLoading(true)
       const settle = (outcome: { values?: ProjectFormValues; accessDenied?: boolean; isNotFound?: boolean; error?: string }) => {
         if (cancelled) return
-        setAccessDenied(outcome.accessDenied === true)
+        setAccessDeniedScopeKey(outcome.accessDenied === true ? projectAccessScopeKey : null)
         setIsNotFound(outcome.isNotFound === true)
         setError(outcome.error ?? null)
         if (outcome.values) setInitialValues(outcome.values)
+        setLoadedScopeKey(projectAccessScopeKey)
         setLoading(false)
       }
       try {
-        const record = await fetchProject()
+        const { record, scope } = await fetchProject()
+        if (!cancelled) resolveScope(scope)
         if (!record) {
           settle({ isNotFound: true })
           return
@@ -185,6 +195,7 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
         settle({ values: toValues(record) })
       } catch (err) {
         if (err instanceof ProjectAccessDeniedError) {
+          if (!cancelled) resolveScope(err.resolvedScope)
           settle({ accessDenied: true })
           return
         }
@@ -197,16 +208,16 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
     }
     load()
     return () => { cancelled = true }
-  }, [projectId, fetchProject, scopeVersion, t])
+  }, [projectId, fetchProject, scopeVersion, t, projectAccessScopeKey, resolveScope])
 
-  if (loading) {
+  if (!accessDenied && (loading || loadedScopeKey !== projectAccessScopeKey)) {
     return <Page><PageBody><LoadingMessage label={t('staff.timesheets.projects.loading', 'Loading project...')} /></PageBody></Page>
   }
 
   // Screen 17 — the caller may not open this project. Same guard state the
   // detail page renders; it names neither the customer nor the project.
   if (accessDenied) {
-    return <NoProjectAccess timeProjectId={projectId} />
+    return <NoProjectAccess timeProjectId={projectId} resolvedScope={resolvedScope} />
   }
 
   if (isNotFound) {

package/src/modules/staff/backend/staff/time-tracking/projects/[id]/page.tsx

@@ -33,6 +33,8 @@ import { formatCurrency } from '@open-mercato/ui/utils/format'
 import { KpiCard, Sparkline } from '@open-mercato/ui/backend/charts'
 import { ProjectTeamDrawer } from '../../../../../lib/time-tracking-ui/ProjectTeamDrawer'
 import { NoProjectAccess } from '../../../../../lib/time-tracking-ui/NoProjectAccess'
+import { useProjectAccessScope } from '../../../../../lib/time-tracking-ui/projectAccessScope'
+import { readResolvedProjectAccessScope } from '../../../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import { ProjectBudgetCell } from '../../../../../lib/timesheets-projects-ui/ProjectBudgetCell'
 import { computeBudgetBurn } from '../../../../../lib/timesheets-projects/budgetBurn'
 import { resolveProjectColorHex } from '../../../../../lib/timesheets-ui/colors'
@@ -177,6 +179,7 @@ export default function TimesheetProjectDetailPage({ params }: { params?: { id?:
   const translateRef = React.useRef(t)
   React.useEffect(() => { translateRef.current = t }, [t])
   const scopeVersion = useOrganizationScopeVersion()
+  const { scopeKey: projectAccessScopeKey, resolvedScope, resolveScope } = useProjectAccessScope(projectId)
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const router = useRouter()
   const pathname = usePathname()
@@ -186,13 +189,9 @@ export default function TimesheetProjectDetailPage({ params }: { params?: { id?:
   const [loading, setLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
-  // Keyed by project id so a route change to another project never shows the
-  // previous project's guard (with a live request button) while the new one loads.
-  const [accessDeniedProjectId, setAccessDeniedProjectId] = React.useState<string | null>(null)
-  const accessDenied = accessDeniedProjectId !== null && accessDeniedProjectId === projectId
-  // The id the last finished load was for. Until it matches the route, the page
-  // is still loading — never the previous project's error or empty state.
-  const [settledProjectId, setSettledProjectId] = React.useState<string | null>(null)
+  const [accessDeniedScopeKey, setAccessDeniedScopeKey] = React.useState<string | null>(null)
+  const [loadedScopeKey, setLoadedScopeKey] = React.useState<string | null>(null)
+  const accessDenied = accessDeniedScopeKey === projectAccessScopeKey
 
   const [employees, setEmployees] = React.useState<EmployeeAssignment[]>([])
   const [employeesLoading, setEmployeesLoading] = React.useState(false)
@@ -407,13 +406,14 @@ export default function TimesheetProjectDetailPage({ params }: { params?: { id?:
         const call = await apiCall<ProjectResponse>(
           `/api/staff/timesheets/time-projects?${queryParams.toString()}`,
         )
+        if (!cancelled) resolveScope(readResolvedProjectAccessScope(call.response))
         // Screen 17: the route answers 404 with this discriminator for a project
         // the caller is not a member of, without naming it.
         if (call.status === 404 && readDenialReason(call.result) === NO_PROJECT_ACCESS_REASON) {
-          if (!cancelled) setAccessDeniedProjectId(projectId ?? null)
+          if (!cancelled) setAccessDeniedScopeKey(projectAccessScopeKey)
           return
         }
-        if (!cancelled) setAccessDeniedProjectId(null)
+        if (!cancelled) setAccessDeniedScopeKey(null)
         if (!call.ok) {
           throw new Error(translateRef.current('staff.timesheets.projects.errors.load', 'Failed to load project.'))
         }
@@ -426,18 +426,19 @@ export default function TimesheetProjectDetailPage({ params }: { params?: { id?:
         if (!cancelled) setProject(record)
       } catch (loadError) {
         if (!cancelled) {
+          setAccessDeniedScopeKey(null)
           setError(loadError instanceof Error ? loadError.message : translateRef.current('staff.timesheets.projects.errors.load', 'Failed to load project.'))
         }
       } finally {
         if (!cancelled) {
+          setLoadedScopeKey(projectAccessScopeKey)
           setLoading(false)
-          setSettledProjectId(projectId ?? null)
         }
       }
     }
     loadProject()
     return () => { cancelled = true }
-  }, [projectId, scopeVersion])
+  }, [projectId, scopeVersion, projectAccessScopeKey, resolveScope])
 
   // --- Load employees with name resolution ---
   const loadEmployees = React.useCallback(async () => {
@@ -709,10 +710,10 @@ export default function TimesheetProjectDetailPage({ params }: { params?: { id?:
   // resolving late) keeps the guard mounted instead of resetting a request the
   // user has just sent.
   if (accessDenied) {
-    return <NoProjectAccess timeProjectId={projectId} />
+    return <NoProjectAccess timeProjectId={projectId} resolvedScope={resolvedScope} />
   }
 
-  if (loading || settledProjectId !== (projectId ?? null)) {
+  if (loading || loadedScopeKey !== projectAccessScopeKey) {
     return (
       <Page>
         <PageBody>

package/src/modules/staff/lib/time-tracking-ui/NoProjectAccess.tsx

@@ -10,6 +10,8 @@ import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { useProjectAccessScope } from './projectAccessScope'
+import type { ResolvedProjectAccessScope } from './projectAccessScopeHeaders'
 
 export const MY_WORK_HREF = '/backend/staff/time-tracking'
 export const ACCESS_REQUEST_ENDPOINT = '/api/staff/timesheets/access-requests'
@@ -22,36 +24,52 @@ export type AccessRequestButtonProps = {
    * project exists to a user who has no right to it.
    */
   timeProjectId?: string | null
+  resolvedScope?: ResolvedProjectAccessScope | null
   label: string
   sentLabel: string
   variant?: 'default' | 'outline'
 }
 
-export function AccessRequestButton({
+export function AccessRequestButton(props: AccessRequestButtonProps) {
+  const { scopeKey, isCurrentScope } = useProjectAccessScope(props.timeProjectId, props.resolvedScope)
+  return <ScopedAccessRequestButton key={scopeKey} {...props} isCurrentScope={isCurrentScope} />
+}
+
+function ScopedAccessRequestButton({
   timeProjectId,
   label,
   sentLabel,
   variant = 'outline',
-}: AccessRequestButtonProps) {
+  isCurrentScope,
+}: AccessRequestButtonProps & { isCurrentScope: () => boolean }) {
   const t = useT()
   const [submitting, setSubmitting] = React.useState(false)
   const [sent, setSent] = React.useState(false)
+  const mounted = React.useRef(true)
+  React.useEffect(() => {
+    mounted.current = true
+    return () => { mounted.current = false }
+  }, [])
   const { runMutation, retryLastMutation } = useGuardedMutation<Record<string, unknown>>({
     contextId: ACCESS_REQUEST_CONTEXT_ID,
     blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),
   })
 
   const requestAccess = React.useCallback(async () => {
+    const isCurrent = () => mounted.current && isCurrentScope()
+    if (!isCurrent()) return
     const payload = timeProjectId ? { timeProjectId } : {}
     setSubmitting(true)
     try {
       await runMutation({
-        operation: () =>
-          apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {
+        operation: () => {
+          if (!isCurrent()) throw new Error('[internal] Access request scope changed')
+          return apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify(payload),
-          }),
+          })
+        },
         context: {
           formId: ACCESS_REQUEST_CONTEXT_ID,
           resourceKind: 'staff.timesheets.access_request',
@@ -59,6 +77,7 @@ export function AccessRequestButton({
         },
         mutationPayload: payload,
       })
+      if (!isCurrent()) return
       setSent(true)
       flash(
         t(
@@ -68,14 +87,15 @@ export function AccessRequestButton({
         'success',
       )
     } catch {
+      if (!isCurrent()) return
       flash(
         t('staff.time_tracking.access.request.error', 'Could not send the access request.'),
         'error',
       )
     } finally {
-      setSubmitting(false)
+      if (isCurrent()) setSubmitting(false)
     }
-  }, [retryLastMutation, runMutation, t, timeProjectId])
+  }, [isCurrentScope, retryLastMutation, runMutation, t, timeProjectId])
 
   return (
     <Button type="button" variant={variant} onClick={requestAccess} disabled={submitting || sent}>
@@ -87,6 +107,7 @@ export function AccessRequestButton({
 
 export type NoProjectAccessProps = {
   timeProjectId?: string | null
+  resolvedScope?: ResolvedProjectAccessScope | null
   /** Where the "Back to My work" action returns to. */
   myWorkHref?: string
 }
@@ -97,7 +118,7 @@ export type NoProjectAccessProps = {
  * access" and "access was revoked" (note 2); navigation stays untouched because
  * the caller still has other projects (note 3).
  */
-export function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {
+export function NoProjectAccess({ timeProjectId, resolvedScope, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {
   const t = useT()
   return (
     <Page>
@@ -121,6 +142,7 @@ export function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }: No
               </Button>
               <AccessRequestButton
                 timeProjectId={timeProjectId}
+                resolvedScope={resolvedScope}
                 label={t('staff.time_tracking.access.denied.request', 'Request access')}
                 sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}
               />