@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/inbox_ops/api/settings/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { InboxSettings } from '../../data/entities'
 import { updateSettingsSchema } from '../../data/validators'
 import { resolveRequestContext, handleRouteError } from '../routeHelpers'
@@ -49,6 +51,9 @@ export async function GET(req: Request) {
         inboxAddress: settings.inboxAddress,
         isActive: settings.isActive,
         workingLanguage: settings.workingLanguage,
+        // Surface only whether a per-tenant secret exists — never the value.
+        webhookSecretSet: Boolean(settings.webhookSecret),
+        updatedAt: settings.updatedAt instanceof Date ? settings.updatedAt.toISOString() : (settings.updatedAt ?? null),
       } : null,
     }
 
@@ -96,12 +101,30 @@ export async function PATCH(req: Request) {
       return NextResponse.json({ error: 'Settings not found' }, { status: 404 })
     }
 
+    // Optimistic lock: refuse a stale overwrite when two tabs edit the same inbox
+    // settings record. Strictly additive — a no-op without the expected-version header.
+    try {
+      enforceCommandOptimisticLock({
+        resourceKind: 'inbox_ops.settings',
+        resourceId: settings.id,
+        current: settings.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+
     if (parsed.data.workingLanguage !== undefined) {
       settings.workingLanguage = parsed.data.workingLanguage
     }
     if (parsed.data.isActive !== undefined) {
       settings.isActive = parsed.data.isActive
     }
+    if (parsed.data.webhookSecret !== undefined) {
+      // Empty/null clears the per-tenant secret (reverts to the global key).
+      settings.webhookSecret = parsed.data.webhookSecret ? parsed.data.webhookSecret : null
+    }
 
     await ctx.em.flush()
 
@@ -115,6 +138,8 @@ export async function PATCH(req: Request) {
         inboxAddress: settings.inboxAddress,
         isActive: settings.isActive,
         workingLanguage: settings.workingLanguage,
+        webhookSecretSet: Boolean(settings.webhookSecret),
+        updatedAt: settings.updatedAt instanceof Date ? settings.updatedAt.toISOString() : (settings.updatedAt ?? null),
       },
     })
   } catch (err) {

package/src/modules/inbox_ops/api/webhook/inbound.ts

@@ -20,6 +20,13 @@ export const metadata = {
 const MAX_PAYLOAD_SIZE = 2 * 1024 * 1024 // 2MB
 const REPLAY_WINDOW_MS = 5 * 60 * 1000 // 5 minutes
 
+function isTimestampFresh(timestamp: string): boolean {
+  if (!timestamp) return false
+  const timestampMs = parseInt(timestamp, 10) * 1000
+  if (isNaN(timestampMs)) return false
+  return Math.abs(Date.now() - timestampMs) <= REPLAY_WINDOW_MS
+}
+
 function verifyHmacSignature(
   payload: string,
   signature: string,
@@ -28,9 +35,7 @@ function verifyHmacSignature(
 ): boolean {
   if (!signature || !timestamp || !secret) return false
 
-  const timestampMs = parseInt(timestamp, 10) * 1000
-  if (isNaN(timestampMs)) return false
-  if (Math.abs(Date.now() - timestampMs) > REPLAY_WINDOW_MS) return false
+  if (!isTimestampFresh(timestamp)) return false
 
   const expected = createHmac('sha256', secret)
     .update(`${timestamp}.${payload}`)
@@ -50,6 +55,31 @@ function verifyHmacSignature(
   }
 }
 
+// True when the signature verifies against ANY of the candidate secrets. Used
+// to bind the inbound signature to the resolved tenant: once the target inbox
+// declares its own per-tenant secret, the global INBOX_OPS_WEBHOOK_SECRET is no
+// longer accepted for that inbox, so a holder of the global key alone cannot
+// forge mail into a tenant that opted into a dedicated secret.
+function verifyHmacAgainstAny(
+  payload: string,
+  signature: string,
+  timestamp: string,
+  secrets: string[],
+): boolean {
+  for (const secret of secrets) {
+    if (secret && verifyHmacSignature(payload, signature, timestamp, secret)) return true
+  }
+  return false
+}
+
+// Stable, non-reversible identifier for the pre-DB global rate-limit bucket.
+// Keying on the configured signing secret (rather than the attacker-set `to` or
+// the per-request signature) means the bucket is request-invariant for a given
+// secret, so rotating recipients or mutating the body cannot dilute the limit.
+function secretFingerprint(secret: string): string {
+  return createHmac('sha256', 'inbox_ops:rate_limit:salt').update(secret).digest('hex').slice(0, 32)
+}
+
 function verifySvixSignature(
   rawBody: string,
   headers: Record<string, string>,
@@ -102,7 +132,7 @@ async function fetchResendEmail(emailId: string): Promise<{
 }
 
 type VerifiedPayload =
-  | { kind: 'custom'; payload: Record<string, unknown> }
+  | { kind: 'custom'; payload: Record<string, unknown>; signature: string; timestamp: string }
   | { kind: 'resend'; emailFields: Awaited<ReturnType<typeof fetchResendEmail>>; to: string[] }
 
 async function verifyAndParse(req: Request, rawBody: string): Promise<
@@ -119,7 +149,11 @@ async function verifyAndParse(req: Request, rawBody: string): Promise<
       return { ok: false, response: NextResponse.json({ error: 'Service unavailable' }, { status: 503 }) }
     }
     const timestamp = req.headers.get('x-webhook-timestamp') || ''
-    if (!verifyHmacSignature(rawBody, customSig, timestamp, webhookSecret)) {
+    // Cheap, secret-independent gate first: reject replayed/stale requests
+    // before parsing. The HMAC itself is verified later, against the secret
+    // bound to the resolved inbox (see the POST handler), so a holder of the
+    // global secret cannot inject into a tenant that owns its own secret.
+    if (!isTimestampFresh(timestamp)) {
       return { ok: false, response: NextResponse.json({ error: 'Invalid signature' }, { status: 400 }) }
     }
     let payload: Record<string, unknown>
@@ -128,7 +162,7 @@ async function verifyAndParse(req: Request, rawBody: string): Promise<
     } catch {
       return { ok: false, response: NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }
     }
-    return { ok: true, data: { kind: 'custom', payload } }
+    return { ok: true, data: { kind: 'custom', payload, signature: customSig, timestamp } }
   }
 
   if (svixId) {
@@ -238,23 +272,29 @@ export async function POST(req: Request) {
   try {
     cache = container.resolve('cache') as CacheStrategy
   } catch {
-    // Cache not available — proceed without rate limiting
+    // Cache not available — the limiter now fails closed with a process-local
+    // bucket instead of waving the request through.
   }
 
-  const rateCheck = await checkRateLimit(cache, `webhook:${toAddress}`)
-  if (!rateCheck.allowed) {
-    return NextResponse.json(
-      { error: 'Rate limit exceeded' },
-      {
-        status: 429,
-        headers: rateCheck.retryAfterSeconds
-          ? { 'Retry-After': String(rateCheck.retryAfterSeconds) }
-          : undefined,
-      },
-    )
+  // Pre-DB global bucket keyed on the configured signing secret (custom) or the
+  // static Resend path, NOT on the attacker-controllable `to` and NOT on the
+  // per-request signature (which mutates with timestamp/body, so it would mint a
+  // fresh bucket every request and never throttle). The per-tenant secret lives
+  // behind the encrypted-column lookup, so the only secret available here without
+  // a DB hit is the global one — keying on it caps total inbound volume for the
+  // custom path and runs BEFORE the lookup so a flood cannot amplify DB work.
+  const globalBucketKey = verified.data.kind === 'custom'
+    ? `webhook:secret:${secretFingerprint(process.env.INBOX_OPS_WEBHOOK_SECRET || '')}`
+    : 'webhook:resend'
+  const globalRateCheck = await checkRateLimit(cache, globalBucketKey)
+  if (!globalRateCheck.allowed) {
+    return rateLimitedResponse(globalRateCheck.retryAfterSeconds)
   }
+
   const em = (container.resolve('em') as EntityManager).fork()
 
+  // No explicit scope: decryptEntitiesWithFallbackScope reads tenant/org off the
+  // resolved row, which is exactly what binds webhook_secret to its own tenant.
   const settings = await findOneWithDecryption(
     em,
     InboxSettings,
@@ -265,10 +305,41 @@ export async function POST(req: Request) {
     },
   )
 
+  // Final HMAC verification for the custom provider path: bind the signature to
+  // the resolved tenant. When the inbox declares its own secret, ONLY that
+  // secret is accepted; otherwise the global secret is accepted (back-compat).
+  // For an unknown `to` we still require the global secret so the endpoint never
+  // behaves as an unauthenticated probe oracle.
+  if (verified.data.kind === 'custom') {
+    const globalSecret = process.env.INBOX_OPS_WEBHOOK_SECRET || ''
+    const inboxSecret = settings?.webhookSecret || ''
+    const acceptableSecrets = inboxSecret ? [inboxSecret] : [globalSecret]
+    const signatureValid = verifyHmacAgainstAny(
+      rawBody,
+      verified.data.signature,
+      verified.data.timestamp,
+      acceptableSecrets,
+    )
+    if (!signatureValid) {
+      return NextResponse.json({ error: 'Invalid signature' }, { status: 400 })
+    }
+  }
+
   if (!settings) {
     return NextResponse.json({ ok: true })
   }
 
+  // Per-tenant bucket keyed on the RESOLVED tenant (not the raw `to`), so it
+  // cannot be diluted by alias addresses that map to the same inbox.
+  const tenantRateCheck = await checkRateLimit(
+    cache,
+    `webhook:tenant:${settings.tenantId}`,
+    settings.tenantId,
+  )
+  if (!tenantRateCheck.allowed) {
+    return rateLimitedResponse(tenantRateCheck.retryAfterSeconds)
+  }
+
   const parsed = parseInboundEmail(emailInput)
 
   const isDuplicate = await checkDuplicate(em, settings, parsed.messageId, parsed.contentHash)
@@ -328,6 +399,16 @@ export async function POST(req: Request) {
   return NextResponse.json({ ok: true })
 }
 
+function rateLimitedResponse(retryAfterSeconds?: number): NextResponse {
+  return NextResponse.json(
+    { error: 'Rate limit exceeded' },
+    {
+      status: 429,
+      headers: retryAfterSeconds ? { 'Retry-After': String(retryAfterSeconds) } : undefined,
+    },
+  )
+}
+
 function extractToAddress(payload: Record<string, unknown>): string | null {
   const to = payload.to
   if (typeof to === 'string') {

package/src/modules/inbox_ops/backend/inbox-ops/settings/page.tsx

@@ -11,7 +11,9 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -30,7 +32,7 @@ export default function InboxSettingsPage() {
     value: key,
     label: t(`inbox_ops.settings.language_${key}` as never, key),
   }))
-  const [settings, setSettings] = React.useState<{ inboxAddress?: string; isActive?: boolean; workingLanguage?: string } | null>(null)
+  const [settings, setSettings] = React.useState<{ inboxAddress?: string; isActive?: boolean; workingLanguage?: string; updatedAt?: string | null } | null>(null)
   const [isLoading, setIsLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
   const [copied, setCopied] = React.useState(false)
@@ -42,7 +44,7 @@ export default function InboxSettingsPage() {
       setIsLoading(true)
       setError(null)
       try {
-        const result = await apiCall<{ settings: { inboxAddress?: string; isActive?: boolean; workingLanguage?: string } | null }>('/api/inbox_ops/settings')
+        const result = await apiCall<{ settings: { inboxAddress?: string; isActive?: boolean; workingLanguage?: string; updatedAt?: string | null } | null }>('/api/inbox_ops/settings')
         if (!cancelled) {
           if (result?.ok && result.result?.settings) {
             setSettings(result.result.settings)
@@ -71,20 +73,23 @@ export default function InboxSettingsPage() {
   const handleLanguageChange = React.useCallback(async (workingLanguage: string) => {
     setIsSavingLanguage(true)
     const result = await runMutation({
-      operation: () => apiCall<{ ok: boolean; settings: { workingLanguage: string } }>('/api/inbox_ops/settings', {
-        method: 'PATCH',
-        body: JSON.stringify({ workingLanguage }),
-      }),
+      operation: () => withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(settings?.updatedAt ?? null),
+        () => apiCall<{ ok: boolean; settings: { workingLanguage: string; updatedAt?: string | null } }>('/api/inbox_ops/settings', {
+          method: 'PATCH',
+          body: JSON.stringify({ workingLanguage }),
+        }),
+      ),
       context: {},
     })
     if (result?.ok && result.result?.ok) {
-      setSettings((prev) => prev ? { ...prev, workingLanguage: result.result!.settings.workingLanguage } : prev)
+      setSettings((prev) => prev ? { ...prev, workingLanguage: result.result!.settings.workingLanguage, updatedAt: result.result!.settings.updatedAt ?? prev.updatedAt } : prev)
       flash(t('inbox_ops.settings.language_saved', 'Working language updated'), 'success')
-    } else {
+    } else if (!surfaceRecordConflict({ status: result?.status, body: result?.result }, t)) {
       flash(t('inbox_ops.settings.language_save_failed', 'Failed to update working language'), 'error')
     }
     setIsSavingLanguage(false)
-  }, [t, runMutation])
+  }, [t, runMutation, settings?.updatedAt])
 
   return (
     <Page>

package/src/modules/inbox_ops/components/proposals/EditActionDialog.tsx

@@ -9,7 +9,8 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -461,9 +462,13 @@ export function EditActionDialog({
 
     setIsSaving(true)
     const result = await runMutation({
-      operation: () => apiCall<{ ok: boolean; error?: string }>(
-        `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
-        { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+      // TODO(#2373-D): thread updatedAt — ActionDetail type lives outside this file's edit scope
+      operation: () => withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(undefined),
+        () => apiCall<{ ok: boolean; error?: string }>(
+          `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
+          { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+        ),
       ),
       context: {},
     })

package/src/modules/inbox_ops/data/entities.ts

@@ -82,6 +82,13 @@ export class InboxSettings {
   @Property({ name: 'inbox_address', type: 'text' })
   inboxAddress!: string
 
+  // Per-tenant inbound-webhook secret. When set, custom-provider webhook
+  // signatures for this inbox MUST verify against THIS secret (not the global
+  // INBOX_OPS_WEBHOOK_SECRET), binding the shared signing key to a single
+  // tenant and preventing cross-tenant injection by a holder of the global key.
+  @Property({ name: 'webhook_secret', type: 'text', nullable: true })
+  webhookSecret?: string | null
+
   @Property({ name: 'is_active', type: 'boolean', default: true })
   isActive: boolean = true
 

package/src/modules/inbox_ops/data/validators.ts

@@ -254,6 +254,10 @@ export const translateProposalSchema = z.object({
 export const updateSettingsSchema = z.object({
   workingLanguage: z.enum(['en', 'de', 'es', 'pl']).optional(),
   isActive: z.boolean().optional(),
+  // Per-tenant inbound-webhook secret. Write-only: it is never returned by the
+  // settings GET. A non-empty value binds custom-provider webhook signatures for
+  // this inbox to this secret; null/empty clears it and reverts to the global key.
+  webhookSecret: z.string().trim().min(16).max(256).nullable().optional(),
 })
 
 // ---------------------------------------------------------------------------

package/src/modules/inbox_ops/encryption.ts

@@ -7,6 +7,15 @@ import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryptio
 // for now — encrypting them requires paired `*_hash` columns plus rewriting
 // the inbound-webhook lookups, which is out of scope for this fix.
 export const defaultEncryptionMaps: ModuleEncryptionMap[] = [
+  {
+    // `webhook_secret` is a tenant-scoped signing credential, never used in a
+    // WHERE/ILIKE lookup (it is loaded via the settings row, then compared with
+    // timingSafeEqual), so it is safe — and required — to encrypt at rest.
+    entityId: 'inbox_ops:inbox_settings',
+    fields: [
+      { field: 'webhook_secret' },
+    ],
+  },
   {
     entityId: 'inbox_ops:inbox_email',
     fields: [

package/src/modules/inbox_ops/i18n/de.json

@@ -155,6 +155,8 @@
   "inbox_ops.preview.sku": "SKU",
   "inbox_ops.processing_log": "Verarbeitungsprotokoll",
   "inbox_ops.proposal": "Vorschlag",
+  "inbox_ops.proposal.backToList": "Zurück zum Posteingang",
+  "inbox_ops.proposal.notFound": "Vorschlag nicht gefunden.",
   "inbox_ops.recategorize": "Kategorie \u00e4ndern",
   "inbox_ops.received_at": "Empfangen",
   "inbox_ops.reply.send": "Antwort senden",

package/src/modules/inbox_ops/i18n/en.json

@@ -155,6 +155,8 @@
   "inbox_ops.preview.sku": "SKU",
   "inbox_ops.processing_log": "Processing Log",
   "inbox_ops.proposal": "Proposal",
+  "inbox_ops.proposal.backToList": "Back to inbox",
+  "inbox_ops.proposal.notFound": "Proposal not found.",
   "inbox_ops.recategorize": "Change Category",
   "inbox_ops.received_at": "Received",
   "inbox_ops.reply.send": "Send Reply",

package/src/modules/inbox_ops/i18n/es.json

@@ -155,6 +155,8 @@
   "inbox_ops.preview.sku": "SKU",
   "inbox_ops.processing_log": "Registro de procesamiento",
   "inbox_ops.proposal": "Propuesta",
+  "inbox_ops.proposal.backToList": "Volver a la bandeja de entrada",
+  "inbox_ops.proposal.notFound": "Propuesta no encontrada.",
   "inbox_ops.recategorize": "Cambiar categor\u00eda",
   "inbox_ops.received_at": "Recibido",
   "inbox_ops.reply.send": "Enviar respuesta",

package/src/modules/inbox_ops/i18n/pl.json

@@ -155,6 +155,8 @@
   "inbox_ops.preview.sku": "SKU",
   "inbox_ops.processing_log": "Dziennik przetwarzania",
   "inbox_ops.proposal": "Propozycja",
+  "inbox_ops.proposal.backToList": "Wróć do skrzynki",
+  "inbox_ops.proposal.notFound": "Nie znaleziono propozycji.",
   "inbox_ops.recategorize": "Zmie\u0144 kategori\u0119",
   "inbox_ops.received_at": "Odebrano",
   "inbox_ops.reply.send": "Wy\u015blij odpowied\u017a",

package/src/modules/inbox_ops/lib/executionEngine.ts

@@ -452,7 +452,12 @@ async function resolveUnknownContactDiscrepanciesInProposal(
 
 async function ensureUserCanExecuteAction(action: InboxProposalAction, ctx: ExecutionContext): Promise<void> {
   const requiredFeature = getRequiredFeatureForAction(action)
-  if (!requiredFeature) return
+  if (!requiredFeature || requiredFeature.trim().length === 0) {
+    throw new ExecutionError(
+      `No required feature is mapped for action type "${action.actionType}"; refusing to execute`,
+      403,
+    )
+  }
 
   const rbacService = ctx.container.resolve('rbacService') as {
     userHasAllFeatures: (

package/src/modules/inbox_ops/lib/executionHelpers.ts

@@ -65,14 +65,15 @@ interface FeatureCheckingRbacService {
   ) => Promise<boolean>
 }
 
+// Super-admin status is the immutable `isSuperAdmin` flag derived from the ACL
+// `is_super_admin` column at session resolution. Never fall back to comparing the
+// auth context's `roles` against a literal like 'superadmin' — role names are
+// tenant-mutable and trivially spoofable, so a role-name fallback would let a tenant
+// admin mint a `superadmin`-named role to bypass every inbox-ops feature gate
+// (#2699). Mirrors the scheduler module's hardened gate.
 function hasSuperAdminAccess(auth: ExecutionHelperContext['auth']): boolean {
   if (!auth || typeof auth !== 'object') return false
-  if ((auth as Record<string, unknown>).isSuperAdmin === true) return true
-  const roles = (auth as Record<string, unknown>).roles
-  if (!Array.isArray(roles)) return false
-  return roles.some(
-    (role) => typeof role === 'string' && role.trim().toLowerCase() === 'superadmin',
-  )
+  return (auth as Record<string, unknown>).isSuperAdmin === true
 }
 
 // ---------------------------------------------------------------------------
@@ -136,7 +137,7 @@ export async function userHasFeature(
   ctx: ExecutionHelperContext,
   feature: string,
 ): Promise<boolean> {
-  if (!feature) return true
+  if (!feature || feature.trim().length === 0) return false
   if (hasSuperAdminAccess(ctx.auth)) return true
 
   try {

package/src/modules/inbox_ops/lib/priceValidator.ts

@@ -29,6 +29,8 @@ interface PriceValidatorScope {
 
 interface CatalogProductPriceLike {
   product?: unknown
+  priceKind?: unknown
+  offer?: unknown
   unitPriceNet?: string | null
   unitPriceGross?: string | null
   currencyCode?: string | null
@@ -38,18 +40,54 @@ interface CatalogProductPriceLike {
   createdAt?: Date
 }
 
+// Minimal structural view of catalog's `PricingContext`. The validator resolves
+// prices through the catalog pricing engine so channel/customer/quantity/time/kind
+// scoping is honored consistently with the rest of the platform.
+export interface CatalogPricingContext {
+  channelId?: string | null
+  customerId?: string | null
+  customerGroupId?: string | null
+  quantity: number
+  date: Date
+}
+
+// Minimal structural view of the `catalogPricingService` DI token. Using the engine
+// (selectBestPrice + resolver pipeline) instead of a bespoke query is mandated by
+// packages/core/src/modules/catalog/AGENTS.md and ensures tenant pricing overrides apply.
+export interface CatalogPricingServiceLike {
+  resolvePrice(
+    rows: CatalogProductPriceLike[],
+    context: CatalogPricingContext,
+  ): Promise<CatalogProductPriceLike | null>
+}
+
+interface PriceValidatorDeps {
+  catalogProductPriceClass: EntityClass<CatalogProductPriceLike>
+  catalogPricingService: CatalogPricingServiceLike
+}
+
 const DEFAULT_MISMATCH_THRESHOLD = 0.05 // 5%
 
+function readUuid(value: unknown): string | undefined {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined
+}
+
+function parsePositiveQuantity(value: unknown): number {
+  const parsed = typeof value === 'number' ? value : typeof value === 'string' ? parseFloat(value) : NaN
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 1
+}
+
 export async function validatePrices(
   em: EntityManager,
   actions: { actionType: string; payload: Record<string, unknown>; index: number }[],
   scope: PriceValidatorScope,
-  deps?: { catalogProductPriceClass: EntityClass<CatalogProductPriceLike> },
+  deps?: PriceValidatorDeps,
 ): Promise<PriceDiscrepancy[]> {
-  if (!deps?.catalogProductPriceClass) return []
+  if (!deps?.catalogProductPriceClass || !deps?.catalogPricingService) return []
 
   const threshold = parseFloat(process.env.INBOX_OPS_PRICE_MISMATCH_THRESHOLD || String(DEFAULT_MISMATCH_THRESHOLD))
   const discrepancies: PriceDiscrepancy[] = []
+  const now = new Date()
 
   for (const action of actions) {
     if (action.actionType !== 'create_order' && action.actionType !== 'create_quote') {
@@ -62,11 +100,32 @@ export async function validatePrices(
       ? action.payload.currencyCode.trim().toUpperCase()
       : null
 
+    // Channel and customer scoping come from the proposal payload (or the caller's
+    // scope as a fallback). When unknown, the engine correctly excludes channel/
+    // customer-specific rows and falls back to the generally-applicable price.
+    const channelId = readUuid(action.payload.channelId) ?? scope.channelId ?? null
+    const customerId = readUuid(action.payload.customerEntityId) ?? scope.customerId ?? null
+
     for (const line of lineItems) {
       if (!line.productId || !line.unitPrice) continue
 
       try {
-        const catalogResult = await lookupCatalogPrice(em, line.productId, scope, deps.catalogProductPriceClass)
+        const pricingContext: CatalogPricingContext = {
+          channelId,
+          customerId,
+          customerGroupId: null,
+          quantity: parsePositiveQuantity(line.quantity),
+          date: now,
+        }
+        const catalogResult = await lookupCatalogPrice(
+          em,
+          line.productId,
+          scope,
+          deps.catalogProductPriceClass,
+          deps.catalogPricingService,
+          pricingContext,
+          orderCurrency,
+        )
         if (catalogResult === null) continue
 
         if (orderCurrency && catalogResult.currencyCode && orderCurrency !== catalogResult.currencyCode.toUpperCase()) {
@@ -113,9 +172,15 @@ async function lookupCatalogPrice(
   productId: string,
   scope: PriceValidatorScope,
   entityClass: EntityClass<CatalogProductPriceLike>,
+  pricingService: CatalogPricingServiceLike,
+  pricingContext: CatalogPricingContext,
+  orderCurrency: string | null,
 ): Promise<{ price: string; currencyCode: string | null } | null> {
   try {
-    const prices = await findWithDecryption(
+    // Load all non-deleted price rows for the product (populating the relations the
+    // pricing engine scores on), then let the engine pick the applicable one — never
+    // the "most recently created" row, which ignores every pricing dimension (#2737).
+    const rows = await findWithDecryption(
       em,
       entityClass,
       {
@@ -124,13 +189,23 @@ async function lookupCatalogPrice(
         organizationId: scope.organizationId,
         tenantId: scope.tenantId,
       },
-      { limit: 10, orderBy: { createdAt: 'DESC' } },
+      { populate: ['priceKind', 'offer'] },
       { tenantId: scope.tenantId, organizationId: scope.organizationId },
     )
 
-    if (!prices || prices.length === 0) return null
+    if (!rows || rows.length === 0) return null
+
+    // Prefer rows in the order's currency so we compare like-for-like instead of
+    // raising a spurious currency mismatch against an unrelated-currency row; fall
+    // back to all rows (which surfaces a genuine mismatch when no match exists).
+    const sameCurrencyRows = orderCurrency
+      ? rows.filter((row) => (row.currencyCode ?? '').toUpperCase() === orderCurrency)
+      : rows
+    const candidateRows = sameCurrencyRows.length > 0 ? sameCurrencyRows : rows
+
+    const priceRecord = await pricingService.resolvePrice(candidateRows, pricingContext)
+    if (!priceRecord) return null
 
-    const priceRecord = prices[0]
     const priceValue = priceRecord.unitPriceNet ?? priceRecord.unitPriceGross ?? null
     if (!priceValue) return null