@open-mercato/core 0.6.6-develop.6304.1.4cf2b975cb → 0.6.6-develop.6309.1.983aeec27a

package/src/modules/sales/commands/documents.ts

@@ -1058,12 +1058,18 @@ async function applyDocumentUpdate({
     if (input.channelId === null) {
       entity.channelId = null;
     } else {
-      const channel = await em.findOne(SalesChannel, {
-        id: input.channelId,
-        organizationId,
-        tenantId,
-        deletedAt: null,
-      });
+      const channel = await findOneWithDecryption(
+        em,
+        SalesChannel,
+        {
+          id: input.channelId,
+          organizationId,
+          tenantId,
+          deletedAt: null,
+        },
+        {},
+        { tenantId, organizationId },
+      );
       if (!channel) {
         throw new CrudHttpError(400, {
           error: translate(
@@ -3793,7 +3799,16 @@ async function restoreQuoteGraph(
   em: EntityManager,
   snapshot: QuoteGraphSnapshot,
 ): Promise<SalesQuote> {
-  let quote = await em.findOne(SalesQuote, { id: snapshot.quote.id });
+  let quote = await findOneWithDecryption(
+    em,
+    SalesQuote,
+    { id: snapshot.quote.id },
+    {},
+    {
+      tenantId: snapshot.quote.tenantId,
+      organizationId: snapshot.quote.organizationId,
+    },
+  );
   if (!quote) {
     quote = em.create(SalesQuote, {
       id: snapshot.quote.id,
@@ -4085,7 +4100,16 @@ async function restoreOrderGraph(
   em: EntityManager,
   snapshot: OrderGraphSnapshot,
 ): Promise<SalesOrder> {
-  let order = await em.findOne(SalesOrder, { id: snapshot.order.id });
+  let order = await findOneWithDecryption(
+    em,
+    SalesOrder,
+    { id: snapshot.order.id },
+    {},
+    {
+      tenantId: snapshot.order.tenantId,
+      organizationId: snapshot.order.organizationId,
+    },
+  );
   if (!order) {
     order = em.create(SalesOrder, {
       id: snapshot.order.id,
@@ -4783,7 +4807,16 @@ const createQuoteCommand: CommandHandler<
     const after = payload?.after;
     if (!after) return;
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, { id: after.quote.id });
+    const quote = await findOneWithDecryption(
+      em,
+      SalesQuote,
+      { id: after.quote.id },
+      {},
+      {
+        tenantId: after.quote.tenantId,
+        organizationId: after.quote.organizationId,
+      },
+    );
     if (!quote) return;
     ensureQuoteScope(ctx, quote.organizationId, quote.tenantId);
     await em.nativeDelete(SalesQuoteAdjustment, { quote: quote.id });
@@ -4814,7 +4847,7 @@ const deleteQuoteCommand: CommandHandler<
   async execute(input, ctx) {
     const id = requireId(input, "Quote id is required");
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, { id });
+    const quote = await findOneWithDecryption(em, SalesQuote, { id });
     if (!quote)
       throw new CrudHttpError(404, { error: "Sales quote not found" });
     ensureQuoteScope(ctx, quote.organizationId, quote.tenantId);
@@ -4941,7 +4974,7 @@ const updateQuoteCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = documentUpdateSchema.parse(rawInput ?? {});
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, {
+    const quote = await findOneWithDecryption(em, SalesQuote, {
       id: parsed.id,
       deletedAt: null,
     });
@@ -5173,7 +5206,7 @@ const updateOrderCommand: CommandHandler<
   async execute(rawInput, ctx) {
     const parsed = documentUpdateSchema.parse(rawInput ?? {});
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, {
+    const order = await findOneWithDecryption(em, SalesOrder, {
       id: parsed.id,
       deletedAt: null,
     });
@@ -5779,7 +5812,16 @@ const createOrderCommand: CommandHandler<
     const after = payload?.after;
     if (!after) return;
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, { id: after.order.id });
+    const order = await findOneWithDecryption(
+      em,
+      SalesOrder,
+      { id: after.order.id },
+      {},
+      {
+        tenantId: after.order.tenantId,
+        organizationId: after.order.organizationId,
+      },
+    );
     if (!order) return;
     ensureOrderScope(ctx, order.organizationId, order.tenantId);
     await em.nativeDelete(SalesOrderAdjustment, { order: order.id });
@@ -5810,7 +5852,7 @@ const deleteOrderCommand: CommandHandler<
   async execute(input, ctx) {
     const id = requireId(input, "Order id is required");
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, { id });
+    const order = await findOneWithDecryption(em, SalesOrder, { id });
     if (!order)
       throw new CrudHttpError(404, { error: "Sales order not found" });
     ensureOrderScope(ctx, order.organizationId, order.tenantId);
@@ -6246,14 +6288,32 @@ const convertQuoteToOrderCommand: CommandHandler<
       });
 
       const [addresses, notes, tags] = await Promise.all([
-        em.find(SalesDocumentAddress, {
-          documentId: snapshot.quote.id,
-          documentKind: "quote",
-        }),
-        em.find(SalesNote, {
-          contextType: "quote",
-          contextId: snapshot.quote.id,
-        }),
+        findWithDecryption(
+          em,
+          SalesDocumentAddress,
+          {
+            documentId: snapshot.quote.id,
+            documentKind: "quote",
+          },
+          {},
+          {
+            tenantId: snapshot.quote.tenantId,
+            organizationId: snapshot.quote.organizationId,
+          },
+        ),
+        findWithDecryption(
+          em,
+          SalesNote,
+          {
+            contextType: "quote",
+            contextId: snapshot.quote.id,
+          },
+          {},
+          {
+            tenantId: snapshot.quote.tenantId,
+            organizationId: snapshot.quote.organizationId,
+          },
+        ),
         em.find(SalesDocumentTagAssignment, {
           documentId: snapshot.quote.id,
           documentKind: "quote",
@@ -6478,7 +6538,7 @@ const orderLineUpsertCommand: CommandHandler<
     const rawBody = (input?.body as Record<string, unknown> | undefined) ?? {};
     const parsed = orderLineUpsertSchema.parse(rawBody);
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, {
+    const order = await findOneWithDecryption(em, SalesOrder, {
       id: parsed.orderId,
       deletedAt: null,
     });
@@ -6794,7 +6854,7 @@ const orderLineDeleteCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, {
+    const order = await findOneWithDecryption(em, SalesOrder, {
       id: parsed.orderId,
       deletedAt: null,
     });
@@ -6970,7 +7030,7 @@ const quoteLineUpsertCommand: CommandHandler<
     const rawBody = (input?.body as Record<string, unknown> | undefined) ?? {};
     const parsed = quoteLineUpsertSchema.parse(rawBody);
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, {
+    const quote = await findOneWithDecryption(em, SalesQuote, {
       id: parsed.quoteId,
       deletedAt: null,
     });
@@ -7282,7 +7342,7 @@ const quoteLineDeleteCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, {
+    const quote = await findOneWithDecryption(em, SalesQuote, {
       id: parsed.quoteId,
       deletedAt: null,
     });
@@ -7436,7 +7496,7 @@ const orderAdjustmentUpsertCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, {
+    const order = await findOneWithDecryption(em, SalesOrder, {
       id: parsed.orderId,
       deletedAt: null,
     });
@@ -7730,7 +7790,7 @@ const orderAdjustmentDeleteCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const order = await em.findOne(SalesOrder, {
+    const order = await findOneWithDecryption(em, SalesOrder, {
       id: parsed.orderId,
       deletedAt: null,
     });
@@ -7895,7 +7955,7 @@ const quoteAdjustmentUpsertCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, {
+    const quote = await findOneWithDecryption(em, SalesQuote, {
       id: parsed.quoteId,
       deletedAt: null,
     });
@@ -8187,7 +8247,7 @@ const quoteAdjustmentDeleteCommand: CommandHandler<
       (input?.body as Record<string, unknown> | undefined) ?? {},
     );
     const em = (ctx.container.resolve("em") as EntityManager).fork();
-    const quote = await em.findOne(SalesQuote, {
+    const quote = await findOneWithDecryption(em, SalesQuote, {
       id: parsed.quoteId,
       deletedAt: null,
     });
@@ -8379,12 +8439,21 @@ const createInvoiceCommand: CommandHandler<
 
     // Validate orderId belongs to same org/tenant
     if (parsed.orderId) {
-      const orderExists = await em.findOne(SalesOrder, {
-        id: parsed.orderId,
-        organizationId: parsed.organizationId,
-        tenantId: parsed.tenantId,
-        deletedAt: null,
-      });
+      const orderExists = await findOneWithDecryption(
+        em,
+        SalesOrder,
+        {
+          id: parsed.orderId,
+          organizationId: parsed.organizationId,
+          tenantId: parsed.tenantId,
+          deletedAt: null,
+        },
+        {},
+        {
+          tenantId: parsed.tenantId,
+          organizationId: parsed.organizationId,
+        },
+      );
       if (!orderExists) {
         throw new CrudHttpError(400, { error: "Referenced order not found in current scope." });
       }
@@ -8869,12 +8938,21 @@ const createCreditMemoCommand: CommandHandler<
 
     // Validate orderId belongs to same org/tenant
     if (parsed.orderId) {
-      const orderExists = await em.findOne(SalesOrder, {
-        id: parsed.orderId,
-        organizationId: parsed.organizationId,
-        tenantId: parsed.tenantId,
-        deletedAt: null,
-      });
+      const orderExists = await findOneWithDecryption(
+        em,
+        SalesOrder,
+        {
+          id: parsed.orderId,
+          organizationId: parsed.organizationId,
+          tenantId: parsed.tenantId,
+          deletedAt: null,
+        },
+        {},
+        {
+          tenantId: parsed.tenantId,
+          organizationId: parsed.organizationId,
+        },
+      );
       if (!orderExists) {
         throw new CrudHttpError(400, { error: "Referenced order not found in current scope." });
       }

package/src/modules/sales/commands/notes.ts

@@ -64,7 +64,7 @@ const noteCrudEvents: CrudEventsConfig = {
 }
 
 async function loadNoteSnapshot(em: EntityManager, id: string): Promise<NoteSnapshot | null> {
-  const note = await em.findOne(SalesNote, { id })
+  const note = await findOneWithDecryption(em, SalesNote, { id }, {})
   if (!note) return null
   return {
     id: note.id,
@@ -94,7 +94,7 @@ async function requireContext(
   quote?: SalesQuote | null
 }> {
   if (contextType === 'order') {
-    const order = await em.findOne(SalesOrder, { id: contextId })
+    const order = await findOneWithDecryption(em, SalesOrder, { id: contextId }, {}, { tenantId, organizationId })
     if (!order) {
       throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })
     }
@@ -109,7 +109,7 @@ async function requireContext(
     }
   }
   if (contextType === 'quote') {
-    const quote = await em.findOne(SalesQuote, { id: contextId })
+    const quote = await findOneWithDecryption(em, SalesQuote, { id: contextId }, {}, { tenantId, organizationId })
     if (!quote) {
       throw new CrudHttpError(404, { error: 'sales.notes.context_not_found' })
     }
@@ -216,7 +216,7 @@ const createNoteCommand: CommandHandler<NoteCreateInput, { noteId: string; autho
     const noteId = logEntry?.resourceId ?? null
     if (!noteId) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const existing = await em.findOne(SalesNote, { id: noteId })
+    const existing = await findOneWithDecryption(em, SalesNote, { id: noteId }, {})
     if (existing) {
       em.remove(existing)
       await em.flush()
@@ -272,7 +272,7 @@ const updateNoteCommand: CommandHandler<NoteUpdateInput, { noteId: string }> = {
   async execute(rawInput, ctx) {
     const parsed = noteUpdateSchema.parse(rawInput ?? {})
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const note = await em.findOne(SalesNote, { id: parsed.id })
+    const note = await findOneWithDecryption(em, SalesNote, { id: parsed.id }, {})
     if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })
     ensureTenantScope(ctx, note.tenantId)
     ensureOrganizationScope(ctx, note.organizationId)
@@ -344,7 +344,7 @@ const updateNoteCommand: CommandHandler<NoteUpdateInput, { noteId: string }> = {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)
     if (!context) return
-    let note = await em.findOne(SalesNote, { id: before.id })
+    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })
     if (!note) {
       note = em.create(SalesNote, {
         id: before.id,
@@ -404,7 +404,7 @@ const deleteNoteCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     async execute(input, ctx) {
       const id = requireId(input, 'Note id required')
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const note = await em.findOne(SalesNote, { id })
+      const note = await findOneWithDecryption(em, SalesNote, { id }, {})
       if (!note) throw new CrudHttpError(404, { error: 'sales.notes.not_found' })
       ensureTenantScope(ctx, note.tenantId)
       ensureOrganizationScope(ctx, note.organizationId)
@@ -453,7 +453,7 @@ const deleteNoteCommand: CommandHandler<{ body?: Record<string, unknown>; query?
       const em = (ctx.container.resolve('em') as EntityManager).fork()
       const context = await requireContext(em, before.contextType, before.contextId).catch(() => null)
       if (!context) return
-    let note = await em.findOne(SalesNote, { id: before.id })
+    let note = await findOneWithDecryption(em, SalesNote, { id: before.id }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })
     if (!note) {
       note = em.create(SalesNote, {
         id: before.id,

package/src/modules/sales/commands/payments.ts

@@ -253,12 +253,7 @@ async function recomputeOrderPaymentTotals(
   const scope = { organizationId: order.organizationId, tenantId: order.tenantId }
 
   if (options?.lock) {
-    // Raw findOne is intentional: this acquires a row lock only — no encrypted
-    // SalesOrder field is read, so decryption (findOneWithDecryption) is unnecessary.
-    // Scope filter is defence-in-depth (#2111): the caller is expected to pass a
-    // correctly scoped order, but filtering here ensures we never lock a foreign
-    // tenant's row even if a caller messed up.
-    await em.findOne(SalesOrder, { id: orderId, ...scope }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+    await findOneWithDecryption(em, SalesOrder, { id: orderId, ...scope }, { lockMode: LockMode.PESSIMISTIC_WRITE }, scope)
   }
 
   const allocations = await findWithDecryption(
@@ -666,11 +661,9 @@ const createPaymentCommand: CommandHandler<
       if (recomputed && (!totals || orderId === after.orderId)) {
         totals = recomputed
       }
-      // Raw findOne is intentional: the order is fetched only to read its id/scope
-      // for cache invalidation — no encrypted field is read, so decryption is unnecessary.
       // Scope filter (#2111): never cache-invalidate a foreign tenant's order even
       // if a snapshot's orderId was somehow tampered with.
-      const target = await em.findOne(SalesOrder, { id: orderId, organizationId: after.organizationId, tenantId: after.tenantId })
+      const target = await findOneWithDecryption(em, SalesOrder, { id: orderId, organizationId: after.organizationId, tenantId: after.tenantId }, {}, { tenantId: after.tenantId, organizationId: after.organizationId })
       if (target) {
         ensureSameScope(target, after.organizationId, after.tenantId)
         await invalidateOrderCache(ctx.container, target, ctx.auth?.tenantId ?? null)
@@ -939,10 +932,12 @@ const updatePaymentCommand: CommandHandler<
       totals = await em.transactional(async (tx) => {
         // Scope filter (#2111): never lock or recompute totals on a foreign
         // tenant's order, even if payment.order somehow points there.
-        const lockedOrder = await tx.findOne(
+        const lockedOrder = await findOneWithDecryption(
+          tx,
           SalesOrder,
           { id: nextOrderId, organizationId: payment.organizationId, tenantId: payment.tenantId },
           { lockMode: LockMode.PESSIMISTIC_WRITE },
+          { tenantId: payment.tenantId, organizationId: payment.organizationId },
         )
         if (!lockedOrder) return undefined
         ensureSameScope(lockedOrder, payment.organizationId, payment.tenantId)
@@ -951,10 +946,8 @@ const updatePaymentCommand: CommandHandler<
         return result
       })
       if (totals) {
-        // Raw findOne is intentional: the order is fetched only to read its id/scope
-        // for cache invalidation — no encrypted field is read, so decryption is unnecessary.
         // Scope filter (#2111): same rationale as the lock above.
-        const nextOrder = await em.findOne(SalesOrder, { id: nextOrderId, organizationId: payment.organizationId, tenantId: payment.tenantId })
+        const nextOrder = await findOneWithDecryption(em, SalesOrder, { id: nextOrderId, organizationId: payment.organizationId, tenantId: payment.tenantId }, {}, { tenantId: payment.tenantId, organizationId: payment.organizationId })
         if (nextOrder) {
           ensureSameScope(nextOrder, payment.organizationId, payment.tenantId)
           await invalidateOrderCache(ctx.container, nextOrder, ctx.auth?.tenantId ?? null)
@@ -966,10 +959,12 @@ const updatePaymentCommand: CommandHandler<
         // Scope filter (#2111): previousOrder was already loaded via the
         // payment's scope, so its tenant/org match the payment's. Filter
         // the lock query the same way as defence-in-depth.
-        const lockedOrder = await tx.findOne(
+        const lockedOrder = await findOneWithDecryption(
+          tx,
           SalesOrder,
           { id: previousOrder.id, organizationId: payment.organizationId, tenantId: payment.tenantId },
           { lockMode: LockMode.PESSIMISTIC_WRITE },
+          { tenantId: payment.tenantId, organizationId: payment.organizationId },
         )
         if (!lockedOrder) return
         ensureSameScope(lockedOrder, payment.organizationId, payment.tenantId)
@@ -1098,10 +1093,12 @@ const deletePaymentCommand: CommandHandler<
       const recomputed = await em.transactional(async (tx) => {
         // Scope filter (#2111): never lock or recompute totals on a foreign
         // tenant's order, even if a payment allocation somehow points there.
-        const lockedOrder = await tx.findOne(
+        const lockedOrder = await findOneWithDecryption(
+          tx,
           SalesOrder,
           { id: orderId, organizationId: payment.organizationId, tenantId: payment.tenantId },
           { lockMode: LockMode.PESSIMISTIC_WRITE },
+          { tenantId: payment.tenantId, organizationId: payment.organizationId },
         )
         if (!lockedOrder) return undefined
         ensureSameScope(lockedOrder, payment.organizationId, payment.tenantId)
@@ -1112,10 +1109,8 @@ const deletePaymentCommand: CommandHandler<
       if (recomputed && (!totals || (primaryOrderId && orderId === primaryOrderId))) {
         totals = recomputed
       }
-      // Raw findOne is intentional: the order is fetched only to read its id/scope
-      // for cache invalidation — no encrypted field is read, so decryption is unnecessary.
       // Scope filter (#2111): same rationale as the lock above.
-      const target = await em.findOne(SalesOrder, { id: orderId, organizationId: payment.organizationId, tenantId: payment.tenantId })
+      const target = await findOneWithDecryption(em, SalesOrder, { id: orderId, organizationId: payment.organizationId, tenantId: payment.tenantId }, {}, { tenantId: payment.tenantId, organizationId: payment.organizationId })
       if (target) {
         ensureSameScope(target, payment.organizationId, payment.tenantId)
         await invalidateOrderCache(ctx.container, target, ctx.auth?.tenantId ?? null)

package/src/modules/sales/commands/shipments.ts

@@ -219,7 +219,7 @@ export async function loadShipmentSnapshot(em: EntityManager, id: string): Promi
 }
 
 export async function restoreShipmentSnapshot(em: EntityManager, snapshot: ShipmentSnapshot): Promise<void> {
-  const order = await em.findOne(SalesOrder, { id: snapshot.orderId })
+  const order = await findOneWithDecryption(em, SalesOrder, { id: snapshot.orderId }, {}, { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId })
   if (!order) return
   const existing = await em.findOne(SalesShipment, { id: snapshot.id })
   const entity =
@@ -330,8 +330,12 @@ async function recomputeFulfilledQuantities(em: EntityManager, order: SalesOrder
   })
 }
 
-async function loadOrder(em: EntityManager, id: string): Promise<SalesOrder> {
-  const order = await em.findOne(SalesOrder, { id, deletedAt: null })
+async function loadOrder(
+  em: EntityManager,
+  id: string,
+  scope?: { tenantId: string; organizationId: string }
+): Promise<SalesOrder> {
+  const order = await findOneWithDecryption(em, SalesOrder, { id, deletedAt: null }, {}, scope)
   if (!order) throw new CrudHttpError(404, { error: 'sales.shipments.not_found' })
   return order
 }
@@ -436,7 +440,7 @@ const createShipmentCommand: CommandHandler<ShipmentCreateInput, { shipmentId: s
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const { translate } = await resolveTranslations()
     const shipment = await em.transactional(async (tx) => {
-      const order = await loadOrder(tx, input.orderId)
+      const order = await loadOrder(tx, input.orderId, { tenantId: input.tenantId, organizationId: input.organizationId })
       ensureSameScope(order, input.organizationId, input.tenantId)
       const { items: normalizedItems, lineMap } = await validateShipmentItems({
         em: tx,
@@ -601,7 +605,7 @@ const createShipmentCommand: CommandHandler<ShipmentCreateInput, { shipmentId: s
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     await em.transactional(async (tx) => {
       await restoreShipmentSnapshot(tx, after)
-      const order = await tx.findOne(SalesOrder, { id: after.orderId })
+      const order = await findOneWithDecryption(tx, SalesOrder, { id: after.orderId }, {}, { tenantId: after.tenantId, organizationId: after.organizationId })
       await tx.flush()
       if (order) {
         await recomputeFulfilledQuantities(tx, order)
@@ -872,7 +876,7 @@ const updateShipmentCommand: CommandHandler<ShipmentUpdateInput, { shipmentId: s
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     await em.transactional(async (tx) => {
       await restoreShipmentSnapshot(tx, before)
-      const order = await tx.findOne(SalesOrder, { id: before.orderId })
+      const order = await findOneWithDecryption(tx, SalesOrder, { id: before.orderId }, {}, { tenantId: before.tenantId, organizationId: before.organizationId })
       await tx.flush()
       if (order) {
         await recomputeFulfilledQuantities(tx, order)
@@ -1021,7 +1025,7 @@ const deleteShipmentCommand: CommandHandler<
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     await em.transactional(async (tx) => {
       await restoreShipmentSnapshot(tx, snapshot)
-      const order = await tx.findOne(SalesOrder, { id: snapshot.orderId })
+      const order = await findOneWithDecryption(tx, SalesOrder, { id: snapshot.orderId }, {}, { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId })
       await tx.flush()
       if (order) {
         await recomputeFulfilledQuantities(tx, order)