@open-mercato/core 0.6.6-develop.5612.1.d382eb2f33 → 0.6.6-develop.5619.1.29f01e2c42

package/src/modules/attachments/api/partitions/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Attachment, AttachmentPartition } from '../../data/entities'
 import { ensureDefaultPartitions, DEFAULT_ATTACHMENT_PARTITIONS, sanitizePartitionCode, isPartitionSettingsLocked } from '../../lib/partitions'
 import { resolvePartitionEnvKey } from '../../lib/partitionEnv'
@@ -23,6 +24,24 @@ const deleteSchema = z.object({
 
 const DEFAULT_CODES = new Set(DEFAULT_ATTACHMENT_PARTITIONS.map((entry) => entry.code))
 
+type AuthLike = { sub?: string; tenantId?: string | null; orgId?: string | null; isSuperAdmin?: boolean } | null | undefined
+
+function isSuperAdmin(auth: AuthLike): boolean {
+  return auth?.isSuperAdmin === true
+}
+
+function canManagePartition(auth: AuthLike, entry: AttachmentPartition): boolean {
+  if (!auth?.tenantId) return false
+  if (entry.tenantId && entry.tenantId === auth.tenantId) return true
+  if (entry.tenantId == null && isSuperAdmin(auth)) return true
+  return false
+}
+
+function partitionVisibilityFilter(auth: AuthLike) {
+  if (isSuperAdmin(auth)) return {}
+  return { $or: [{ tenantId: null }, { tenantId: auth?.tenantId ?? null }] }
+}
+
 function serializePartition(entry: AttachmentPartition) {
   return {
     id: entry.id,
@@ -54,12 +73,18 @@ async function resolveEm() {
 
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   const em = await resolveEm()
   await ensureDefaultPartitions(em)
-  const rows = await em.find(AttachmentPartition, {}, { orderBy: { createdAt: 'asc' } })
+  const rows = await findWithDecryption(
+    em,
+    AttachmentPartition,
+    partitionVisibilityFilter(auth),
+    { orderBy: { createdAt: 'asc' } },
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
   return NextResponse.json({ items: rows.map((entry) => serializePartition(entry)) })
 }
 
@@ -71,7 +96,7 @@ export async function POST(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   let json: unknown = null
@@ -90,7 +115,13 @@ export async function POST(req: Request) {
   }
   const em = await resolveEm()
   await ensureDefaultPartitions(em)
-  const exists = await em.findOne(AttachmentPartition, { code })
+  const exists = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { code },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
   if (exists) {
     return NextResponse.json({ error: 'Partition code already exists.' }, { status: 409 })
   }
@@ -106,6 +137,8 @@ export async function POST(req: Request) {
         ? parsed.data.requiresOcr
         : resolveDefaultAttachmentOcrEnabled(),
     ocrModel: parsed.data.ocrModel?.trim() || null,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
   })
   await em.persist(entry).flush()
   return NextResponse.json({ item: serializePartition(entry) }, { status: 201 })
@@ -119,7 +152,7 @@ export async function PUT(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   let json: unknown = null
@@ -133,8 +166,14 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
   const em = await resolveEm()
-  const entry = await em.findOne(AttachmentPartition, { id: parsed.data.id })
-  if (!entry) {
+  const entry = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { id: parsed.data.id },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
+  if (!entry || !canManagePartition(auth, entry)) {
     return NextResponse.json({ error: 'Partition not found' }, { status: 404 })
   }
   if (sanitizePartitionCode(parsed.data.code) !== entry.code) {
@@ -167,7 +206,7 @@ export async function DELETE(req: Request) {
     )
   }
   const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) {
+  if (!auth?.sub || !auth.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
   const url = new URL(req.url)
@@ -177,14 +216,22 @@ export async function DELETE(req: Request) {
     return NextResponse.json({ error: 'Partition id is required' }, { status: 400 })
   }
   const em = await resolveEm()
-  const entry = await em.findOne(AttachmentPartition, { id: parsed.data.id })
-  if (!entry) {
+  const entry = await findOneWithDecryption(
+    em,
+    AttachmentPartition,
+    { id: parsed.data.id },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId ?? null },
+  )
+  if (!entry || !canManagePartition(auth, entry)) {
     return NextResponse.json({ error: 'Partition not found' }, { status: 404 })
   }
   if (DEFAULT_CODES.has(entry.code)) {
     return NextResponse.json({ error: 'Default partitions cannot be removed.' }, { status: 400 })
   }
-  const usage = await em.count(Attachment, { partitionCode: entry.code })
+  const usageFilter: Record<string, unknown> = { partitionCode: entry.code }
+  if (entry.tenantId) usageFilter.tenantId = entry.tenantId
+  const usage = await em.count(Attachment, usageFilter)
   if (usage > 0) {
     return NextResponse.json({ error: 'Partition is in use and cannot be removed.' }, { status: 409 })
   }

package/src/modules/attachments/data/entities.ts

@@ -34,6 +34,13 @@ export class AttachmentPartition {
   @Property({ name: 'ocr_model', type: 'text', nullable: true })
   ocrModel?: string | null
 
+  @Property({ name: 'organization_id', type: 'uuid', nullable: true })
+  organizationId?: string | null
+
+  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })
+  @Index({ name: 'attachment_partitions_tenant_idx' })
+  tenantId?: string | null
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 

package/src/modules/attachments/migrations/.snapshot-open-mercato.json

@@ -270,6 +270,24 @@
           "nullable": true,
           "mappedType": "text"
         },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "uuid"
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "uuid"
+        },
         "created_at": {
           "name": "created_at",
           "type": "timestamptz",
@@ -294,6 +312,16 @@
       "name": "attachment_partitions",
       "schema": "public",
       "indexes": [
+        {
+          "keyName": "attachment_partitions_tenant_idx",
+          "columnNames": [
+            "tenant_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "primary": false,
+          "unique": false
+        },
         {
           "keyName": "attachment_partitions_code_unique",
           "columnNames": [

package/src/modules/attachments/migrations/Migration20260524000000.ts

@@ -0,0 +1,25 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export class Migration20260524000000 extends Migration {
+  override async up(): Promise<void> {
+    this.addSql(
+      `alter table "attachment_partitions" add column "organization_id" uuid null;`,
+    )
+    this.addSql(
+      `alter table "attachment_partitions" add column "tenant_id" uuid null;`,
+    )
+    this.addSql(
+      `create index "attachment_partitions_tenant_idx" on "attachment_partitions" ("tenant_id");`,
+    )
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "attachment_partitions_tenant_idx";`)
+    this.addSql(
+      `alter table "attachment_partitions" drop column "tenant_id";`,
+    )
+    this.addSql(
+      `alter table "attachment_partitions" drop column "organization_id";`,
+    )
+  }
+}

package/src/modules/auth/api/roles/route.ts

@@ -14,11 +14,8 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { roleCrudEvents, roleCrudIndexer } from '@open-mercato/core/modules/auth/commands/roles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import {
-  assertActorCanAccessRoleTarget,
-  assertActorCanModifySuperAdminRoleTarget,
-} from '@open-mercato/core/modules/auth/lib/grantChecks'
-import { enforceTenantSelection } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import { assertActorCanModifySuperAdminRoleTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { enforceRoleTenantAccess } from '@open-mercato/core/modules/auth/lib/roleTenantGuard'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const querySchema = z.object({
@@ -88,18 +85,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
     create: {
       commandId: 'auth.roles.create',
       schema: rawBodySchema,
-      mapInput: async ({ parsed, ctx }) => {
-        // Preserve an explicit null so the create command rejects it (400 — global
-        // roles are unsupported); only resolve string/omitted tenantId against the actor.
-        if (parsed.tenantId === null) return parsed
-        const requestedTenantId = typeof parsed.tenantId === 'string' ? parsed.tenantId : undefined
-        const resolvedTenantId = await enforceTenantSelection(
-          { auth: ctx.auth, container: ctx.container },
-          requestedTenantId,
-        )
-        if (resolvedTenantId) parsed.tenantId = resolvedTenantId
-        return parsed
-      },
+      mapInput: async ({ parsed, ctx }) =>
+        enforceRoleTenantAccess('create', parsed, { auth: ctx.auth, container: ctx.container }),
       response: ({ result }) => ({ id: String(result.id) }),
       status: 201,
     },
@@ -109,9 +96,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
       mapInput: async ({ parsed, ctx }) => {
         if (ctx.request && typeof parsed.id === 'string' && parsed.id.length) {
           await assertCanModifySuperAdminRole(ctx.request, parsed.id)
-          await assertCanAccessRoleTarget(ctx.request, parsed.id)
         }
-        return parsed
+        return enforceRoleTenantAccess('update', parsed, { auth: ctx.auth, container: ctx.container })
       },
       response: () => ({ ok: true }),
     },
@@ -121,9 +107,8 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
         const targetId = resolveDeleteTargetId(parsed, raw)
         if (ctx.request && targetId) {
           await assertCanModifySuperAdminRole(ctx.request, targetId)
-          await assertCanAccessRoleTarget(ctx.request, targetId)
         }
-        return parsed
+        return enforceRoleTenantAccess('delete', parsed, { auth: ctx.auth, container: ctx.container })
       },
       response: () => ({ ok: true }),
     },
@@ -275,7 +260,6 @@ export const DELETE = async (req: Request) => {
   if (targetId) {
     try {
       await assertCanModifySuperAdminRole(req, targetId)
-      await assertCanAccessRoleTarget(req, targetId)
     } catch (err) {
       if (err instanceof CrudHttpError) {
         return NextResponse.json(err.body, { status: err.status })
@@ -301,21 +285,6 @@ async function assertCanModifySuperAdminRole(req: Request, targetRoleId: string)
   })
 }
 
-async function assertCanAccessRoleTarget(req: Request, targetRoleId: string) {
-  const auth = await getAuthFromRequest(req)
-  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  await assertActorCanAccessRoleTarget({
-    em,
-    rbacService: container.resolve('rbacService') as RbacService,
-    actorUserId: auth.sub,
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-    targetRoleId,
-  })
-}
-
 function resolveDeleteTargetId(parsed: unknown, raw: unknown): string | null {
   const fromParsed = readId(parsed as Record<string, unknown> | null | undefined)
   if (fromParsed) return fromParsed
@@ -343,7 +312,7 @@ export const openApi: OpenApiRouteDoc = {
     },
     POST: {
       summary: 'Create role',
-      description: 'Creates a new role for the current tenant or globally when `tenantId` is omitted.',
+      description: 'Creates a new role anchored to the caller\'s tenant. Non-superadmins cannot target another tenant; supplying a foreign `tenantId` is rejected.',
       requestBody: {
         contentType: 'application/json',
         schema: roleCreateSchema,

package/src/modules/auth/cli.ts

@@ -5,7 +5,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
-import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError } from './lib/setup-app'
+import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -401,7 +401,7 @@ const addOrganization: ModuleCli = {
   },
 }
 
-const SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--with-examples] [--json]'
+const SETUP_USAGE = 'Usage: mercato auth setup --orgName <name> --email <email> --password <password> [--orgSlug <slug>] [--roles superadmin,admin,employee] [--skip-password-policy] [--include-demo-users] [--with-examples] [--json]'
 
 const setupApp: ModuleCli = {
   command: 'setup',
@@ -440,6 +440,10 @@ const setupApp: ModuleCli = {
     const withExamples = typeof withExamplesRaw === 'boolean'
       ? withExamplesRaw
       : parseBooleanToken(typeof withExamplesRaw === 'string' ? withExamplesRaw : null) ?? false
+    const includeDemoUsersRaw = args['include-demo-users'] ?? args.includeDemoUsers
+    const includeDemoUsers = typeof includeDemoUsersRaw === 'boolean'
+      ? includeDemoUsersRaw
+      : parseBooleanToken(typeof includeDemoUsersRaw === 'string' ? includeDemoUsersRaw : null) ?? false
     const jsonModeRaw = args.json
     const jsonMode = typeof jsonModeRaw === 'boolean'
       ? jsonModeRaw
@@ -489,7 +493,14 @@ const setupApp: ModuleCli = {
         orgSlug,
         roleNames,
         primaryUser: { email, password, confirm: true },
-        includeDerivedUsers: true,
+        // Derived admin/employee demo accounts only land when the operator
+        // explicitly opts in via --include-demo-users. Default-deny prevents
+        // production deployments from silently seeding well-known emails.
+        includeDerivedUsers: includeDemoUsers,
+        // When demo users are explicitly requested, the operator has consented
+        // to having admin@/employee@ accounts created with autogenerated
+        // passwords (surfaced in stdout) when no env override is provided.
+        allowDemoDerivedPasswords: includeDemoUsers,
         // When the caller passes an explicit slug, treat it as a "fresh tenant"
         // signal — silent reuse of an existing user's tenant defeats the point
         // of slugging the new tenant for downstream tooling.
@@ -537,7 +548,12 @@ const setupApp: ModuleCli = {
       if (env.NODE_ENV !== 'test') {
         for (const snapshot of result.users) {
           if (snapshot.created) {
-            console.log('🎉 Created user', snapshot.user.email)
+            if (snapshot.generatedPassword) {
+              console.log('⚠️  GENERATED password — copy now; it is not stored in plain text')
+              console.log('🎉 Created user', snapshot.user.email, 'password:', snapshot.generatedPassword)
+            } else {
+              console.log('🎉 Created user', snapshot.user.email)
+            }
           } else {
             console.log(`Updated user ${snapshot.user.email}`)
           }
@@ -552,6 +568,13 @@ const setupApp: ModuleCli = {
         process.exitCode = 1
         return
       }
+      if (err instanceof DerivedUserPasswordRequiredError) {
+        process.stderr.write(
+          `Setup aborted: ${err.message}. In production, set OM_INIT_ADMIN_PASSWORD and OM_INIT_EMPLOYEE_PASSWORD before passing --include-demo-users, or omit --include-demo-users to skip derived demo accounts entirely.\n`,
+        )
+        process.exitCode = 2
+        return
+      }
       if (err instanceof Error && err.message === 'USER_EXISTS') {
         process.stderr.write('Setup aborted: user already exists with the provided email.\n')
         process.exitCode = 1

package/src/modules/auth/commands/roles.ts

@@ -24,7 +24,7 @@ import {
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
-import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import { resolveIsSuperAdmin, normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 
 type SerializedRole = {
@@ -84,6 +84,22 @@ function assertRoleNameAllowed(name: string | undefined | null) {
   }
 }
 
+type ResolvedActorScope = { isSuperAdmin: boolean; actorTenantId: string | null }
+
+async function resolveActorScope(ctx: { auth: { tenantId?: string | null; sub?: string | null; orgId?: string | null; isSuperAdmin?: boolean } | null; container: { resolve<T = unknown>(name: string): T } }): Promise<ResolvedActorScope> {
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  const actorTenantId = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null
+  return { isSuperAdmin, actorTenantId }
+}
+
+function buildScopedRoleFilter(roleId: string, scope: ResolvedActorScope): FilterQuery<Role> {
+  const filter: FilterQuery<Role> = { id: roleId, deletedAt: null }
+  if (!scope.isSuperAdmin) {
+    ;(filter as Record<string, unknown>).tenantId = scope.actorTenantId
+  }
+  return filter
+}
+
 const createSchema = z.object({
   name: z.string().min(2).max(100),
   tenantId: z.string().uuid().optional(),
@@ -128,7 +144,14 @@ const createRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     }
     const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)
     assertRoleNameAllowed(parsed.name)
-    const resolvedTenantId = parsed.tenantId ?? ctx.auth?.tenantId ?? null
+    const scope = await resolveActorScope(ctx)
+    const requestedTenantId = parsed.tenantId ?? null
+    if (!scope.isSuperAdmin && requestedTenantId && requestedTenantId !== scope.actorTenantId) {
+      throw new CrudHttpError(403, { error: 'Not authorized to target this tenant.' })
+    }
+    const resolvedTenantId = scope.isSuperAdmin
+      ? (requestedTenantId ?? scope.actorTenantId)
+      : scope.actorTenantId
     if (!resolvedTenantId) {
       throw new CrudHttpError(400, { error: 'tenantId is required — global roles are not supported' })
     }
@@ -279,7 +302,8 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const existing = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!existing) throw new CrudHttpError(404, { error: 'Role not found' })
     assertRoleTenantInScope(resolveActorTenantScope(ctx), existing.tenantId)
     const acls = await loadRoleAclSnapshots(em, parsed.id)
@@ -293,7 +317,8 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const current = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
     const actorTenantScope = resolveActorTenantScope(ctx)
     assertRoleTenantInScope(actorTenantScope, current.tenantId)
@@ -309,21 +334,22 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     }
     const wantsTenantChange = parsed.tenantId !== undefined && parsed.tenantId !== current.tenantId
     if (wantsTenantChange) {
+      if (!scope.isSuperAdmin) {
+        throw new CrudHttpError(403, { error: 'Not authorized to target this tenant.' })
+      }
       const assignments = await em.count(UserRole, { role: current, deletedAt: null })
       if (assignments > 0) {
         throw new CrudHttpError(400, { error: 'Role cannot be moved to another tenant while users are assigned' })
       }
       await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
     }
-    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }
-    if (actorTenantScope) updateWhere.tenantId = actorTenantScope
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const role = await de.updateOrmEntity({
       entity: Role,
-      where: updateWhere as FilterQuery<Role>,
+      where: buildScopedRoleFilter(parsed.id, scope),
       apply: (entity) => {
         if (parsed.name !== undefined) entity.name = parsed.name
-        if (parsed.tenantId !== undefined) entity.tenantId = parsed.tenantId
+        if (parsed.tenantId !== undefined && scope.isSuperAdmin) entity.tenantId = parsed.tenantId
       },
     })
     if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
@@ -446,7 +472,8 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async prepare(input, ctx) {
     const id = requireId(input, 'Role id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-    const existing = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!existing) return {}
     const actorTenantScope = resolveActorTenantScope(ctx)
     if (actorTenantScope) {
@@ -464,7 +491,8 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async execute(input, ctx) {
     const id = requireId(input, 'Role id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-    const role = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const role = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
     assertRoleTenantInScope(resolveActorTenantScope(ctx), role.tenantId)
     const activeAssignments = await em.count(UserRole, { role, deletedAt: null })
@@ -475,7 +503,7 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const deleted = await de.deleteOrmEntity({
       entity: Role,
-      where: { id, deletedAt: null } as FilterQuery<Role>,
+      where: buildScopedRoleFilter(id, scope),
       soft: false,
     })
     if (!deleted) throw new CrudHttpError(404, { error: 'Role not found' })

package/src/modules/auth/lib/roleTenantGuard.ts

@@ -1,8 +1,13 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { enforceTenantSelection, normalizeTenantId, resolveIsSuperAdmin } from './tenantAccess'
 
+function roleNotFound(): never {
+  throw new CrudHttpError(404, { error: 'Role not found' })
+}
+
 type RoleTenantAccessCtx = {
   auth: {
     tenantId?: string | null
@@ -17,40 +22,74 @@ type RoleTenantAccessCtx = {
 type RoleTenantPayload = {
   id?: unknown
   tenantId?: unknown
+  body?: { id?: unknown } | null
+  query?: { id?: unknown } | null
+}
+
+function extractRoleId(input: Record<string, unknown>): string | null {
+  const payload = input as RoleTenantPayload
+  const candidates: unknown[] = [payload.id, payload.body?.id, payload.query?.id]
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.length) return candidate
+  }
+  return null
+}
+
+async function assertActorOwnsRole(
+  roleId: string,
+  ctx: RoleTenantAccessCtx,
+): Promise<{ matched: boolean }> {
+  const auth = ctx.auth
+  if (!auth) throw forbidden('Not authorized')
+  const em = (ctx.container.resolve('em') as EntityManager)
+  const existing = await findOneWithDecryption(
+    em,
+    Role,
+    { id: roleId, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!existing) return { matched: false }
+
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  if (isSuperAdmin) return { matched: true }
+
+  const actorTenant = normalizeTenantId(auth.tenantId ?? null) ?? null
+  const existingTenantId = normalizeTenantId(existing.tenantId ?? null) ?? null
+  // Unified 404 for "out of scope" — matches grantChecks.assertActorCanAccessRoleTarget
+  // and prevents existence enumeration of foreign-tenant or global roles.
+  if (!actorTenant) roleNotFound()
+  if (existingTenantId !== actorTenant) roleNotFound()
+  return { matched: true }
 }
 
 export async function enforceRoleTenantAccess(
-  mode: 'create' | 'update',
+  mode: 'create' | 'update' | 'delete',
   input: Record<string, unknown>,
   ctx: RoleTenantAccessCtx,
 ): Promise<Record<string, unknown>> {
   const auth = ctx.auth
   if (!auth) throw forbidden('Not authorized')
-  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
 
   if (mode === 'create') {
     const tenantId = await enforceTenantSelection(ctx, (input as RoleTenantPayload).tenantId)
     return { ...input, tenantId }
   }
 
+  if (mode === 'delete') {
+    const roleId = extractRoleId(input)
+    if (!roleId) return input
+    await assertActorOwnsRole(roleId, ctx)
+    return input
+  }
+
+  // mode === 'update'
   const roleIdCandidate = (input as RoleTenantPayload).id
   const roleId = typeof roleIdCandidate === 'string' ? roleIdCandidate : null
   if (!roleId) return input
 
-  const em = (ctx.container.resolve('em') as EntityManager)
-  const existing = await em.findOne(Role, { id: roleId, deletedAt: null })
-  if (!existing) return input
-
-  const actorTenant = normalizeTenantId(auth.tenantId ?? null) ?? null
-  const existingTenantId = normalizeTenantId(existing.tenantId ?? null) ?? null
-
-  if (!isSuperAdmin && !actorTenant) {
-    throw forbidden('Not authorized')
-  }
-
-  if (!isSuperAdmin && existingTenantId !== actorTenant) {
-    throw forbidden('Not authorized')
-  }
+  const ownership = await assertActorOwnsRole(roleId, ctx)
+  if (!ownership.matched) return input
 
   if ((input as RoleTenantPayload).tenantId === undefined) {
     return input