@open-mercato/core 0.6.6-develop.6429.1.2fba7258d1 → 0.6.6-develop.6450.1.b493fb430c

package/src/modules/staff/commands/comments.ts

@@ -14,7 +14,16 @@ import {
   type StaffTeamMemberCommentUpdateInput,
 } from '../data/validators'
 import { staffTeamMemberCommentCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload, requireTeamMember } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitStaffCommandScope,
+  extractUndoPayload,
+  requireTeamMember,
+} from './shared'
 import { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'
 import { E } from '#generated/entities.ids.generated'
 
@@ -62,10 +71,16 @@ const createCommentCommand: CommandHandler<
     const parsed = staffTeamMemberCommentCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
     const normalizedAuthor = normalizeAuthorUserId(parsed.authorUserId, ctx.auth)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      parsed.entityId,
+      scope,
+      'Team member not found',
+    )
     ensureTenantScope(ctx, member.tenantId)
     ensureOrganizationScope(ctx, member.organizationId)
 
@@ -151,7 +166,12 @@ const createCommentCommand: CommandHandler<
       appearanceColor: snapshot.appearanceColor,
     }),
     beforeRestore: async ({ em, snapshot }) => {
-      const member = await requireTeamMember(em, snapshot.memberId, 'Team member not found')
+      const member = await requireTeamMember(
+        em,
+        snapshot.memberId,
+        explicitStaffCommandScope(snapshot.tenantId, snapshot.organizationId),
+        'Team member not found',
+      )
       return { member }
     },
     buildResult: (entity) => ({ commentId: entity.id, authorUserId: entity.authorUserId ?? null }),
@@ -169,13 +189,17 @@ const updateCommentCommand: CommandHandler<StaffTeamMemberCommentUpdateInput, {
   async execute(rawInput, ctx) {
     const parsed = staffTeamMemberCommentUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const comment = await em.findOne(StaffTeamMemberComment, { id: parsed.id })
+    const scope = commandActorScope(ctx)
+    const comment = await em.findOne(
+      StaffTeamMemberComment,
+      applyScopeToWhere<StaffTeamMemberComment>({ id: parsed.id }, scope),
+    )
     if (!comment) throw new CrudHttpError(404, { error: 'Comment not found' })
     ensureTenantScope(ctx, comment.tenantId)
     ensureOrganizationScope(ctx, comment.organizationId)
 
     if (parsed.entityId !== undefined) {
-      const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+      const member = await requireTeamMember(em, parsed.entityId, scope, 'Team member not found')
       ensureTenantScope(ctx, member.tenantId)
       ensureOrganizationScope(ctx, member.organizationId)
       comment.member = member
@@ -245,7 +269,12 @@ const updateCommentCommand: CommandHandler<StaffTeamMemberCommentUpdateInput, {
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let comment = await em.findOne(StaffTeamMemberComment, { id: before.id })
-    const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      before.memberId,
+      explicitStaffCommandScope(before.tenantId, before.organizationId),
+      'Team member not found',
+    )
 
     if (!comment) {
       comment = em.create(StaffTeamMemberComment, {
@@ -298,7 +327,11 @@ const deleteCommentCommand: CommandHandler<{ body?: Record<string, unknown>; que
     async execute(input, ctx) {
       const id = requireId(input, 'Comment id required')
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const comment = await em.findOne(StaffTeamMemberComment, { id })
+      const scope = commandActorScope(ctx)
+      const comment = await em.findOne(
+        StaffTeamMemberComment,
+        applyScopeToWhere<StaffTeamMemberComment>({ id }, scope),
+      )
       if (!comment) throw new CrudHttpError(404, { error: 'Comment not found' })
       ensureTenantScope(ctx, comment.tenantId)
       ensureOrganizationScope(ctx, comment.organizationId)
@@ -345,7 +378,12 @@ const deleteCommentCommand: CommandHandler<{ body?: Record<string, unknown>; que
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+      const member = await requireTeamMember(
+        em,
+        before.memberId,
+        explicitStaffCommandScope(before.tenantId, before.organizationId),
+        'Team member not found',
+      )
       let comment = await em.findOne(StaffTeamMemberComment, { id: before.id })
       if (!comment) {
         comment = em.create(StaffTeamMemberComment, {

package/src/modules/staff/commands/job-histories.ts

@@ -12,8 +12,12 @@ import {
 } from '../data/validators'
 import { staffTeamMemberJobHistoryCrudEvents } from '../lib/crud'
 import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
   ensureOrganizationScope,
   ensureTenantScope,
+  explicitStaffCommandScope,
   extractUndoPayload,
   requireTeamMember,
 } from './shared'
@@ -74,9 +78,15 @@ const createJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryCreateInp
     const parsed = staffTeamMemberJobHistoryCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      parsed.entityId,
+      scope,
+      'Team member not found',
+    )
     ensureTenantScope(ctx, member.tenantId)
     ensureOrganizationScope(ctx, member.organizationId)
 
@@ -150,7 +160,12 @@ const createJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryCreateInp
       throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for job history create' })
     }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, after.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      after.memberId,
+      explicitStaffCommandScope(after.tenantId, after.organizationId),
+      'Team member not found',
+    )
     let record = await em.findOne(StaffTeamMemberJobHistory, { id: after.id })
     if (!record) {
       record = em.create(StaffTeamMemberJobHistory, {
@@ -206,7 +221,11 @@ const updateJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryUpdateInp
   async execute(rawInput, ctx) {
     const parsed = staffTeamMemberJobHistoryUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const record = await em.findOne(StaffTeamMemberJobHistory, { id: parsed.id })
+    const scope = commandActorScope(ctx)
+    const record = await em.findOne(
+      StaffTeamMemberJobHistory,
+      applyScopeToWhere<StaffTeamMemberJobHistory>({ id: parsed.id }, scope),
+    )
     if (!record) {
       enforceRecordGoneIsConflict({
         resourceKind: JOB_HISTORY_LOCK_RESOURCE_KIND,
@@ -227,7 +246,7 @@ const updateJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryUpdateInp
     })
 
     if (parsed.entityId !== undefined) {
-      const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+      const member = await requireTeamMember(em, parsed.entityId, scope, 'Team member not found')
       ensureTenantScope(ctx, member.tenantId)
       ensureOrganizationScope(ctx, member.organizationId)
       record.member = member
@@ -298,7 +317,12 @@ const updateJobHistoryCommand: CommandHandler<StaffTeamMemberJobHistoryUpdateInp
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let record = await em.findOne(StaffTeamMemberJobHistory, { id: before.id })
-    const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      before.memberId,
+      explicitStaffCommandScope(before.tenantId, before.organizationId),
+      'Team member not found',
+    )
 
     if (!record) {
       record = em.create(StaffTeamMemberJobHistory, {
@@ -354,7 +378,11 @@ const deleteJobHistoryCommand: CommandHandler<{ id?: string; updatedAt?: string;
       const id = requireId(input, 'Job history id required')
       const expectedUpdatedAt = typeof input.updatedAt === 'string' ? input.updatedAt : undefined
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const record = await em.findOne(StaffTeamMemberJobHistory, { id })
+      const scope = commandActorScope(ctx)
+      const record = await em.findOne(
+        StaffTeamMemberJobHistory,
+        applyScopeToWhere<StaffTeamMemberJobHistory>({ id }, scope),
+      )
       if (!record) {
         enforceRecordGoneIsConflict({
           resourceKind: JOB_HISTORY_LOCK_RESOURCE_KIND,
@@ -416,7 +444,12 @@ const deleteJobHistoryCommand: CommandHandler<{ id?: string; updatedAt?: string;
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+      const member = await requireTeamMember(
+        em,
+        before.memberId,
+        explicitStaffCommandScope(before.tenantId, before.organizationId),
+        'Team member not found',
+      )
       let record = await em.findOne(StaffTeamMemberJobHistory, { id: before.id })
       if (!record) {
         record = em.create(StaffTeamMemberJobHistory, {

package/src/modules/staff/commands/leave-requests.ts

@@ -21,7 +21,17 @@ import {
   type StaffLeaveRequestDecisionInput,
   type StaffLeaveRequestUpdateInput,
 } from '../data/validators'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload, requireTeamMember } from './shared'
+import {
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitStaffCommandScope,
+  extractUndoPayload,
+  requireTeamMember,
+  scopeForDecryption,
+  applyScopeToWhere,
+} from './shared'
 import { E } from '#generated/entities.ids.generated'
 import { resolveNotificationService } from '../../notifications/lib/notificationService'
 import { buildFeatureNotificationFromType, buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
@@ -167,8 +177,18 @@ function leaveRequestSeedFromSnapshot(snapshot: LeaveRequestSnapshot): Record<st
   }
 }
 
-async function requireLeaveRequest(em: EntityManager, id: string): Promise<StaffLeaveRequest> {
-  const request = await findOneWithDecryption(em, StaffLeaveRequest, { id, deletedAt: null }, undefined, { tenantId: null, organizationId: null })
+async function requireLeaveRequest(
+  em: EntityManager,
+  id: string,
+  scope: ReturnType<typeof explicitStaffCommandScope>,
+): Promise<StaffLeaveRequest> {
+  const request = await findOneWithDecryption(
+    em,
+    StaffLeaveRequest,
+    applyScopeToWhere<StaffLeaveRequest>({ id, deletedAt: null }, scope),
+    undefined,
+    scopeForDecryption(scope),
+  )
   if (!request) throw new CrudHttpError(404, { error: 'Leave request not found.' })
   return request
 }
@@ -245,9 +265,15 @@ const createLeaveRequestCommand: CommandHandler<StaffLeaveRequestCreateInput, {
     const parsed = staffLeaveRequestCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, parsed.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      parsed.memberId,
+      scope,
+      'Team member not found',
+    )
     ensureTenantScope(ctx, member.tenantId)
     ensureOrganizationScope(ctx, member.organizationId)
 
@@ -400,13 +426,14 @@ const updateLeaveRequestCommand: CommandHandler<StaffLeaveRequestUpdateInput, {
   async execute(rawInput, ctx) {
     const parsed = staffLeaveRequestUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const request = await requireLeaveRequest(em, parsed.id)
+    const scope = commandActorScope(ctx)
+    const request = await requireLeaveRequest(em, parsed.id, scope)
     ensureTenantScope(ctx, request.tenantId)
     ensureOrganizationScope(ctx, request.organizationId)
     ensurePendingStatus(request)
 
     if (parsed.memberId !== undefined) {
-      const member = await requireTeamMember(em, parsed.memberId, 'Team member not found')
+      const member = await requireTeamMember(em, parsed.memberId, scope, 'Team member not found')
       ensureTenantScope(ctx, member.tenantId)
       ensureOrganizationScope(ctx, member.organizationId)
       request.member = member
@@ -514,7 +541,7 @@ const deleteLeaveRequestCommand: CommandHandler<{ id: string }, { requestId: str
   async execute(rawInput, ctx) {
     const parsed = staffLeaveRequestDecisionSchema.pick({ id: true }).parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const request = await requireLeaveRequest(em, parsed.id)
+    const request = await requireLeaveRequest(em, parsed.id, commandActorScope(ctx))
     ensureTenantScope(ctx, request.tenantId)
     ensureOrganizationScope(ctx, request.organizationId)
     ensurePendingStatus(request)
@@ -595,7 +622,7 @@ const acceptLeaveRequestCommand: CommandHandler<StaffLeaveRequestDecisionInput,
   async execute(rawInput, ctx) {
     const parsed = staffLeaveRequestDecisionSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const request = await requireLeaveRequest(em, parsed.id)
+    const request = await requireLeaveRequest(em, parsed.id, commandActorScope(ctx))
     ensureTenantScope(ctx, request.tenantId)
     ensureOrganizationScope(ctx, request.organizationId)
     ensurePendingStatus(request)
@@ -802,7 +829,7 @@ const rejectLeaveRequestCommand: CommandHandler<StaffLeaveRequestDecisionInput,
   async execute(rawInput, ctx) {
     const parsed = staffLeaveRequestDecisionSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const request = await requireLeaveRequest(em, parsed.id)
+    const request = await requireLeaveRequest(em, parsed.id, commandActorScope(ctx))
     ensureTenantScope(ctx, request.tenantId)
     ensureOrganizationScope(ctx, request.organizationId)
     ensurePendingStatus(request)

package/src/modules/staff/commands/shared.ts

@@ -1,25 +1,88 @@
-import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { ensureOrganizationScope } from '@open-mercato/shared/lib/commands/scope'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
-import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { StaffTeamMember } from '../data/entities'
 
-export function ensureTenantScope(ctx: CommandRuntimeContext, tenantId: string): void {
-  const currentTenant = ctx.auth?.tenantId ?? null
-  if (currentTenant && currentTenant !== tenantId) {
+export { ensureOrganizationScope, ensureTenantScope, extractUndoPayload }
+
+export type StaffCommandScope = {
+  tenantId: string | null
+  organizationId: string | null
+  requireTenant: boolean
+  requireOrganization: boolean
+}
+
+export function commandActorScope(ctx: CommandRuntimeContext): StaffCommandScope {
+  const isPrivilegedActor = ctx.auth?.isSuperAdmin === true || ctx.systemActor === true
+  const tenantId = isPrivilegedActor ? null : (ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null)
+  const organizationId = isPrivilegedActor ? null : (ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null)
+  const organizationUnrestricted =
+    isPrivilegedActor || (organizationId === null && tenantId !== null && ctx.organizationScope?.allowedIds === null)
+  return {
+    tenantId,
+    organizationId: organizationUnrestricted ? null : organizationId,
+    requireTenant: !isPrivilegedActor,
+    requireOrganization: !organizationUnrestricted,
+  }
+}
+
+export function explicitStaffCommandScope(tenantId: string | null, organizationId: string | null): StaffCommandScope {
+  return {
+    tenantId,
+    organizationId,
+    requireTenant: true,
+    requireOrganization: true,
+  }
+}
+
+export function commandInputScope(ctx: CommandRuntimeContext, tenantId: string, organizationId: string): StaffCommandScope {
+  if (ctx.auth?.isSuperAdmin === true || ctx.systemActor === true) {
+    return explicitStaffCommandScope(tenantId, organizationId)
+  }
+
+  ensureTenantScope(ctx, tenantId)
+  ensureOrganizationScope(ctx, organizationId)
+
+  const actorTenantId = ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null
+  if (!actorTenantId || actorTenantId !== tenantId) {
     throw new CrudHttpError(403, { error: 'Forbidden' })
   }
+
+  if (!ctx.organizationScope) {
+    const currentOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+    if (!currentOrganizationId || currentOrganizationId !== organizationId) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+  }
+
+  return explicitStaffCommandScope(tenantId, organizationId)
+}
+
+export function applyScopeToWhere<TEntity extends object>(
+  where: FilterQuery<TEntity>,
+  scope: StaffCommandScope,
+): FilterQuery<TEntity> {
+  const scoped = { ...(where as Record<string, unknown>) }
+  if (scope.requireTenant || scope.tenantId !== null) scoped.tenantId = scope.tenantId
+  if (scope.requireOrganization || scope.organizationId !== null) scoped.organizationId = scope.organizationId
+  return scoped as FilterQuery<TEntity>
 }
 
-export { ensureOrganizationScope, extractUndoPayload }
+export function scopeForDecryption(scope: StaffCommandScope): { tenantId: string | null; organizationId: string | null } {
+  return { tenantId: scope.tenantId, organizationId: scope.organizationId }
+}
 
 export async function requireTeamMember(
   em: EntityManager,
   memberId: string,
+  scope: StaffCommandScope,
   message = 'Team member not found',
 ): Promise<StaffTeamMember> {
-  const member = await em.findOne(StaffTeamMember, { id: memberId })
+  const member = await em.findOne(
+    StaffTeamMember,
+    applyScopeToWhere<StaffTeamMember>({ id: memberId, deletedAt: null }, scope),
+  )
   if (!member) throw new CrudHttpError(404, { error: message })
   return member
 }

package/src/modules/staff/commands/tag-assignments.ts

@@ -12,7 +12,15 @@ import {
   type StaffTeamMemberTagAssignmentInput,
 } from '../data/validators'
 import { staffTeamMemberCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitStaffCommandScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 
 type TeamMemberTagAssignmentSnapshot = {
   tag: string
@@ -43,12 +51,13 @@ const assignTeamMemberTagCommand: CommandHandler<StaffTeamMemberTagAssignmentInp
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
     const member = await findOneWithDecryption(
       em,
       StaffTeamMember,
-      { id: parsed.memberId, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id: parsed.memberId, deletedAt: null }, scope),
       undefined,
-      { tenantId: parsed.tenantId, organizationId: parsed.organizationId },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Team member not found.' })
     ensureTenantScope(ctx, member.tenantId)
@@ -131,12 +140,13 @@ const assignTeamMemberTagCommand: CommandHandler<StaffTeamMemberTagAssignmentInp
     const before = payload?.before
     if (!before) return { memberId: logEntry.resourceId ?? '' }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = explicitStaffCommandScope(before.tenantId, before.organizationId)
     const member = await findOneWithDecryption(
       em,
       StaffTeamMember,
-      { id: before.memberId, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id: before.memberId, deletedAt: null }, scope),
       undefined,
-      { tenantId: before.tenantId, organizationId: before.organizationId },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Team member not found.' })
     const currentTags = normalizeTagList(Array.isArray(member.tags) ? member.tags : [])
@@ -171,12 +181,13 @@ const unassignTeamMemberTagCommand: CommandHandler<StaffTeamMemberTagAssignmentI
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
     const member = await findOneWithDecryption(
       em,
       StaffTeamMember,
-      { id: parsed.memberId, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id: parsed.memberId, deletedAt: null }, scope),
       undefined,
-      { tenantId: parsed.tenantId, organizationId: parsed.organizationId },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Team member not found.' })
     ensureTenantScope(ctx, member.tenantId)

package/src/modules/staff/commands/team-members.ts

@@ -19,7 +19,15 @@ import {
   type StaffTeamMemberUpdateInput,
 } from '../data/validators'
 import { staffTeamMemberCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 import { E } from '#generated/entities.ids.generated'
 
 const teamMemberCrudIndexer: CrudIndexerConfig<StaffTeamMember> = {
@@ -165,6 +173,7 @@ const createTeamMemberCommand: CommandHandler<StaffTeamMemberCreateInput, { memb
     const { parsed, custom } = parseWithCustomFields(staffTeamMemberCreateSchema, rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const roleIds = normalizeStringList(parsed.roleIds)
@@ -305,12 +314,13 @@ const updateTeamMemberCommand: CommandHandler<StaffTeamMemberUpdateInput, { memb
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(staffTeamMemberUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const member = await findOneWithDecryption(
       em,
       StaffTeamMember,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Team member not found.' })
     ensureTenantScope(ctx, member.tenantId)
@@ -476,12 +486,13 @@ const deleteTeamMemberCommand: CommandHandler<{ id?: string }, { memberId: strin
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Member id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const member = await findOneWithDecryption(
       em,
       StaffTeamMember,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Team member not found.' })
     ensureTenantScope(ctx, member.tenantId)

package/src/modules/staff/commands/team-roles.ts

@@ -17,7 +17,15 @@ import {
   type StaffTeamRoleUpdateInput,
 } from '../data/validators'
 import { staffTeamRoleCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 import { E } from '#generated/entities.ids.generated'
 
 const teamRoleCrudIndexer: CrudIndexerConfig<StaffTeamRole> = {
@@ -100,6 +108,7 @@ const createTeamRoleCommand: CommandHandler<StaffTeamRoleCreateInput, { roleId:
     const { parsed, custom } = parseWithCustomFields(staffTeamRoleCreateSchema, rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     if (parsed.teamId) {
@@ -230,12 +239,13 @@ const updateTeamRoleCommand: CommandHandler<StaffTeamRoleUpdateInput, { roleId:
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(staffTeamRoleUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const role = await findOneWithDecryption(
       em,
       StaffTeamRole,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<StaffTeamRole>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!role) throw new CrudHttpError(404, { error: 'Team role not found.' })
     ensureTenantScope(ctx, role.tenantId)
@@ -378,12 +388,13 @@ const deleteTeamRoleCommand: CommandHandler<{ id?: string }, { roleId: string }>
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Role id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const role = await findOneWithDecryption(
       em,
       StaffTeamRole,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTeamRole>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!role) throw new CrudHttpError(404, { error: 'Team role not found.' })
     ensureTenantScope(ctx, role.tenantId)

package/src/modules/staff/commands/teams.ts

@@ -17,7 +17,15 @@ import {
   type StaffTeamUpdateInput,
 } from '../data/validators'
 import { staffTeamCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 import { E } from '#generated/entities.ids.generated'
 
 const teamCrudIndexer: CrudIndexerConfig<StaffTeam> = {
@@ -77,6 +85,7 @@ const createTeamCommand: CommandHandler<StaffTeamCreateInput, { teamId: string }
     const { parsed, custom } = parseWithCustomFields(staffTeamCreateSchema, rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const now = new Date()
@@ -202,12 +211,13 @@ const updateTeamCommand: CommandHandler<StaffTeamUpdateInput, { teamId: string }
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(staffTeamUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const team = await findOneWithDecryption(
       em,
       StaffTeam,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<StaffTeam>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!team) throw new CrudHttpError(404, { error: 'Team not found.' })
     ensureTenantScope(ctx, team.tenantId)
@@ -339,12 +349,13 @@ const deleteTeamCommand: CommandHandler<{ id?: string }, { teamId: string }> = {
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Team id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const team = await findOneWithDecryption(
       em,
       StaffTeam,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTeam>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!team) throw new CrudHttpError(404, { error: 'Team not found.' })
     ensureTenantScope(ctx, team.tenantId)