@open-mercato/core 0.6.6-develop.6429.1.2fba7258d1 → 0.6.6-develop.6450.1.b493fb430c

package/src/modules/customers/api/people/[id]/route.ts

@@ -42,6 +42,8 @@ import { loadPersonCompanyLinks, summarizePersonCompanies } from '../../../lib/p
 import { normalizeCustomerDetailCustomFields } from '../../detailCustomFields'
 import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
 import { resolveCustomerDetailTenantScope } from '../../../lib/detailTenantScope'
+import { runWithCacheTenant } from '@open-mercato/cache'
+import { buildCollectionTags, canonicalizeResourceTag, isCrudCacheEnabled, resolveCrudCache } from '@open-mercato/shared/lib/crud/cache'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },
@@ -51,6 +53,63 @@ const paramsSchema = z.object({
   id: z.string().uuid(),
 })
 
+// Person detail is one of the heaviest custom GETs (decryption sweeps across
+// addresses, tags, labels, interactions, custom fields, plus per-link query
+// engine enrichment). Mirror the gated get-then-set cache from the roles list
+// (#3143) so a hit skips every sweep below. Writes flow through the customers
+// command bus, which already flushes the matching crud:<resourceKind> collection
+// tags post-commit — these set tags reuse the exact same shapes (see
+// invalidateCrudCache), so no new invalidation wiring is needed (#3663).
+// The resource ids below are canonicalized with canonicalizeResourceTag (just
+// like invalidateCrudCache does via expandResourceAliases) before building the
+// collection tags, so camelCase ids (tagAssignment, labelAssignment,
+// personCompanyLink) produce the SAME tag the command bus deletes on
+// write/undo/redo — otherwise the cache would never be invalidated for them.
+const PERSON_DETAIL_TTL_MS = 60_000
+const PERSON_DETAIL_TAG_RESOURCES = [
+  'customers.person',
+  'customers.address',
+  'customers.tagAssignment',
+  'customers.labelAssignment',
+  'customers.personCompanyLink',
+  'customers.interaction',
+  'customers.activity',
+] as const
+
+function buildPersonDetailCacheKey(params: {
+  personId: string
+  tenantId: string | null
+  organizationId: string | null
+  callerId: string | null
+  selectedOrganizationId: string | null
+  scopedOrganizationIds: string[]
+  interactionMode: 'canonical' | 'legacy'
+  includeTokens: string[]
+}): string {
+  const include = [...params.includeTokens].sort((a, b) => a.localeCompare(b)).join('|') || 'none'
+  const scoped = [...params.scopedOrganizationIds].sort((a, b) => a.localeCompare(b)).join('|') || 'null'
+  return [
+    'customers:person-detail',
+    params.personId,
+    `tenant=${params.tenantId ?? 'null'}`,
+    `org=${params.organizationId ?? 'null'}`,
+    `caller=${params.callerId ?? 'null'}`,
+    `selOrg=${params.selectedOrganizationId ?? 'null'}`,
+    `scope=${scoped}`,
+    `mode=${params.interactionMode}`,
+    `include=${include}`,
+  ].join(':')
+}
+
+function buildPersonDetailCacheTags(tenantId: string | null, organizationId: string | null): string[] {
+  const tags: string[] = []
+  for (const resource of PERSON_DETAIL_TAG_RESOURCES) {
+    const canonical = canonicalizeResourceTag(resource) ?? resource
+    tags.push(...buildCollectionTags(canonical, tenantId, [organizationId]))
+  }
+  return tags
+}
+
 function parseIncludeParams(request: Request): Set<string> {
   const url = new URL(request.url)
   const raw = url.searchParams.getAll('include')
@@ -485,6 +544,39 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       return forbidden('Access denied')
     }
 
+    // Gated get-then-set cache. Key on the resolved person plus the effective
+    // RBAC scope (caller identity, selected/visible orgs) and the payload-shaping
+    // inputs (interaction mode + include set). The lookup sits before the
+    // expensive sweeps below so a hit returns without touching the DB.
+    const personDetailTenantId = person.tenantId ?? auth.tenantId ?? null
+    const personDetailOrganizationId = person.organizationId ?? null
+    const personDetailCache = isCrudCacheEnabled() ? resolveCrudCache(container) : null
+    const personDetailCacheKey = personDetailCache
+      ? buildPersonDetailCacheKey({
+          personId: person.id,
+          tenantId: personDetailTenantId,
+          organizationId: personDetailOrganizationId,
+          callerId: auth.sub ?? null,
+          selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+          scopedOrganizationIds: Array.isArray(scope?.filterIds) ? scope.filterIds : [],
+          interactionMode,
+          includeTokens: Array.from(includeTokens),
+        })
+      : null
+    const personDetailCacheTags = personDetailCache
+      ? buildPersonDetailCacheTags(personDetailTenantId, personDetailOrganizationId)
+      : []
+
+    if (personDetailCache && personDetailCacheKey) {
+      const cached = await runWithCacheTenant(personDetailTenantId, () => personDetailCache.get(personDetailCacheKey))
+      if (cached) {
+        statusCode = 200
+        profileMeta = { cacheHit: true, include: Array.from(includeTokens), interactionMode }
+        profiler.mark('cache_hit')
+        return NextResponse.json(cached)
+      }
+    }
+
     const [profileResult, personCompanyLinks] = await Promise.all([
       findOneWithDecryption(em, CustomerPersonProfile, { entity: person }, { populate: ['company'] }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null }),
       loadPersonCompanyLinks(em, person),
@@ -801,7 +893,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       companies: companies.length,
     }
 
-    const response = NextResponse.json({
+    const payload = {
       interactionMode,
       person: {
         id: person.id,
@@ -1011,7 +1103,20 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         name: viewerUserIdFinal ? userMap.get(viewerUserIdFinal)?.name ?? null : null,
         email: viewerUserIdFinal ? userMap.get(viewerUserIdFinal)?.email ?? auth.email ?? null : auth.email ?? null,
       },
-    })
+    }
+
+    if (personDetailCache && personDetailCacheKey) {
+      try {
+        await runWithCacheTenant(personDetailTenantId, () =>
+          personDetailCache.set(personDetailCacheKey, payload, {
+            ttl: PERSON_DETAIL_TTL_MS,
+            tags: personDetailCacheTags,
+          }),
+        )
+      } catch {}
+    }
+
+    const response = NextResponse.json(payload)
     statusCode = 200
     profileMeta = {
       include: Array.from(includeTokens),

package/src/modules/planner/commands/shared.ts

@@ -1,13 +1,4 @@
-import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { ensureOrganizationScope } from '@open-mercato/shared/lib/commands/scope'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 
-export function ensureTenantScope(ctx: CommandRuntimeContext, tenantId: string): void {
-  const currentTenant = ctx.auth?.tenantId ?? null
-  if (currentTenant && currentTenant !== tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
-export { ensureOrganizationScope, extractUndoPayload }
+export { ensureOrganizationScope, ensureTenantScope, extractUndoPayload }

package/src/modules/resources/commands/shared.ts

@@ -1,18 +1,10 @@
-import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { ensureOrganizationScope } from '@open-mercato/shared/lib/commands/scope'
+import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { ResourcesResource } from '../data/entities'
 
-export function ensureTenantScope(ctx: CommandRuntimeContext, tenantId: string): void {
-  const currentTenant = ctx.auth?.tenantId ?? null
-  if (currentTenant && currentTenant !== tenantId) {
-    throw new CrudHttpError(403, { error: 'Forbidden' })
-  }
-}
-
-export { ensureOrganizationScope, extractUndoPayload }
+export { ensureOrganizationScope, ensureTenantScope, extractUndoPayload }
 
 export async function requireResource(
   em: EntityManager,

package/src/modules/shipping_carriers/api/cancel/route.ts

@@ -8,6 +8,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { ShippingCarrierService } from '../../lib/shipping-service'
 import { isShipmentCancelNotAllowedError } from '../../lib/status-sync'
+import { shippingCarrierUpstreamErrorResponse } from '../../lib/upstream-error-response'
 import { cancelShipmentSchema } from '../../data/validators'
 import { shippingCarriersTag } from '../openapi'
 
@@ -81,8 +82,7 @@ export async function POST(req: Request) {
     if (isShipmentCancelNotAllowedError(error)) {
       return NextResponse.json({ error: error.message }, { status: 422 })
     }
-    const message = error instanceof Error ? error.message : 'Failed to cancel shipment'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('cancel.post', error)
   }
 }
 

package/src/modules/shipping_carriers/api/points/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ShippingCarrierService } from '../../lib/shipping-service'
+import { shippingCarrierUpstreamErrorResponse } from '../../lib/upstream-error-response'
 import { searchDropOffPointsQuerySchema } from '../../data/validators'
 import { shippingCarriersTag } from '../openapi'
 
@@ -35,8 +36,7 @@ export async function GET(req: Request) {
     })
     return NextResponse.json({ points })
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : 'Failed to search drop-off points'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('points.search', error)
   }
 }
 

package/src/modules/shipping_carriers/api/rates/route.ts

@@ -3,6 +3,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import type { ShippingCarrierService } from '../../lib/shipping-service'
+import { shippingCarrierUpstreamErrorResponse } from '../../lib/upstream-error-response'
 import { calculateRatesSchema } from '../../data/validators'
 import { shippingCarriersTag } from '../openapi'
 
@@ -31,8 +32,7 @@ export async function POST(req: Request) {
     })
     return NextResponse.json({ rates })
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : 'Failed to calculate rates'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('rates.calculate', error)
   }
 }
 

package/src/modules/shipping_carriers/api/shipments/route.ts

@@ -8,6 +8,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { ShippingCarrierService } from '../../lib/shipping-service'
 import { isShipmentIdempotencyConflictError } from '../../lib/shipment-idempotency'
+import { shippingCarrierUpstreamErrorResponse } from '../../lib/upstream-error-response'
 import { createShipmentSchema } from '../../data/validators'
 import { shippingCarriersTag } from '../openapi'
 
@@ -90,8 +91,7 @@ export async function POST(req: Request) {
         { status: 409 },
       )
     }
-    const message = error instanceof Error ? error.message : 'Failed to create shipment'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('shipments.create', error)
   }
 }
 

package/src/modules/shipping_carriers/api/tracking/refresh/route.ts

@@ -3,6 +3,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import type { ShippingCarrierService } from '../../../lib/shipping-service'
+import { shippingCarrierUpstreamErrorResponse } from '../../../lib/upstream-error-response'
 import { trackingRefreshSchema } from '../../../data/validators'
 import { shippingCarriersTag } from '../../openapi'
 
@@ -31,8 +32,7 @@ export async function POST(req: Request) {
     })
     return NextResponse.json(tracking)
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : 'Failed to refresh tracking'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('tracking.refresh', error)
   }
 }
 

package/src/modules/shipping_carriers/api/tracking/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ShippingCarrierService } from '../../lib/shipping-service'
+import { shippingCarrierUpstreamErrorResponse } from '../../lib/upstream-error-response'
 import { trackingQuerySchema } from '../../data/validators'
 import { shippingCarriersTag } from '../openapi'
 
@@ -34,8 +35,7 @@ export async function GET(req: Request) {
     })
     return NextResponse.json(tracking)
   } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : 'Failed to fetch tracking'
-    return NextResponse.json({ error: message }, { status: 502 })
+    return shippingCarrierUpstreamErrorResponse('tracking.get', error)
   }
 }
 

package/src/modules/shipping_carriers/i18n/de.json

@@ -69,6 +69,7 @@
   "shipping_carriers.create.summary.targetPoint": "Paketbox",
   "shipping_carriers.create.summary.to": "Nach",
   "shipping_carriers.create.title": "Sendung beim Transporteur erstellen",
+  "shipping_carriers.errors.upstreamFailed": "Anfrage an den Transporteur fehlgeschlagen. Versuchen Sie es spaeter erneut.",
   "shipping_carriers.feature.manage": "Versanddienstleister-Vorgaenge verwalten",
   "shipping_carriers.feature.view": "Sendungen der Versanddienstleister anzeigen",
   "shipping_carriers.status.cancelled": "Storniert",

package/src/modules/shipping_carriers/i18n/en.json

@@ -69,6 +69,7 @@
   "shipping_carriers.create.summary.targetPoint": "Locker point",
   "shipping_carriers.create.summary.to": "To",
   "shipping_carriers.create.title": "Create carrier shipment",
+  "shipping_carriers.errors.upstreamFailed": "Carrier provider request failed. Try again later.",
   "shipping_carriers.feature.manage": "Manage shipping carrier operations",
   "shipping_carriers.feature.view": "View shipping carrier shipments",
   "shipping_carriers.status.cancelled": "Cancelled",

package/src/modules/shipping_carriers/i18n/es.json

@@ -69,6 +69,7 @@
   "shipping_carriers.create.summary.targetPoint": "Casillero",
   "shipping_carriers.create.summary.to": "Hasta",
   "shipping_carriers.create.title": "Crear envio con transportista",
+  "shipping_carriers.errors.upstreamFailed": "Error en la solicitud al transportista. Intentalo de nuevo mas tarde.",
   "shipping_carriers.feature.manage": "Gestionar operaciones de transportistas",
   "shipping_carriers.feature.view": "Ver envios de transportistas",
   "shipping_carriers.status.cancelled": "Cancelado",

package/src/modules/shipping_carriers/i18n/pl.json

@@ -69,6 +69,7 @@
   "shipping_carriers.create.summary.targetPoint": "Paczkomat",
   "shipping_carriers.create.summary.to": "Odbiór",
   "shipping_carriers.create.title": "Utwórz przesyłkę u przewoźnika",
+  "shipping_carriers.errors.upstreamFailed": "Żądanie do przewoźnika nie powiodło się. Spróbuj ponownie później.",
   "shipping_carriers.feature.manage": "Zarzadzanie operacjami przewoznikow",
   "shipping_carriers.feature.view": "Podglad przesylek przewoznikow",
   "shipping_carriers.status.cancelled": "Anulowano",

package/src/modules/shipping_carriers/lib/upstream-error-response.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+
+const upstreamFailedKey = 'shipping_carriers.errors.upstreamFailed'
+const upstreamFailedFallback = 'Carrier provider request failed. Try again later.'
+
+export async function shippingCarrierUpstreamErrorResponse(routeId: string, error: unknown) {
+  console.error(`[shipping_carriers.${routeId}] provider upstream error`, error)
+  const { translate } = await resolveTranslations()
+  return NextResponse.json({ error: translate(upstreamFailedKey, upstreamFailedFallback) }, { status: 502 })
+}

package/src/modules/staff/commands/activities.ts

@@ -22,7 +22,16 @@ import {
   type StaffTeamMemberActivityUpdateInput,
 } from '../data/validators'
 import { staffTeamMemberActivityCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload, requireTeamMember } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitStaffCommandScope,
+  extractUndoPayload,
+  requireTeamMember,
+} from './shared'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 import { E } from '#generated/entities.ids.generated'
 import {
@@ -118,10 +127,16 @@ const createActivityCommand: CommandHandler<
     const { parsed, custom } = parseWithCustomFields(staffTeamMemberActivityCreateSchema, rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
     const normalizedAuthor = normalizeAuthorUserId(parsed.authorUserId, ctx.auth)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      parsed.entityId,
+      scope,
+      'Team member not found',
+    )
     ensureTenantScope(ctx, member.tenantId)
     ensureOrganizationScope(ctx, member.organizationId)
 
@@ -199,7 +214,12 @@ const createActivityCommand: CommandHandler<
       throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for activity create' })
     }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, after.activity.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      after.activity.memberId,
+      explicitStaffCommandScope(after.activity.tenantId, after.activity.organizationId),
+      'Team member not found',
+    )
     let activity = await em.findOne(StaffTeamMemberActivity, { id: after.activity.id })
     if (!activity) {
       activity = em.create(StaffTeamMemberActivity, {
@@ -261,13 +281,17 @@ const updateActivityCommand: CommandHandler<StaffTeamMemberActivityUpdateInput,
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(staffTeamMemberActivityUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const activity = await em.findOne(StaffTeamMemberActivity, { id: parsed.id })
+    const scope = commandActorScope(ctx)
+    const activity = await em.findOne(
+      StaffTeamMemberActivity,
+      applyScopeToWhere<StaffTeamMemberActivity>({ id: parsed.id }, scope),
+    )
     if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })
     ensureTenantScope(ctx, activity.tenantId)
     ensureOrganizationScope(ctx, activity.organizationId)
 
     if (parsed.entityId !== undefined) {
-      const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+      const member = await requireTeamMember(em, parsed.entityId, scope, 'Team member not found')
       ensureTenantScope(ctx, member.tenantId)
       ensureOrganizationScope(ctx, member.organizationId)
       activity.member = member
@@ -354,7 +378,12 @@ const updateActivityCommand: CommandHandler<StaffTeamMemberActivityUpdateInput,
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let activity = await em.findOne(StaffTeamMemberActivity, { id: before.activity.id })
-    const member = await requireTeamMember(em, before.activity.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      before.activity.memberId,
+      explicitStaffCommandScope(before.activity.tenantId, before.activity.organizationId),
+      'Team member not found',
+    )
 
     if (!activity) {
       activity = em.create(StaffTeamMemberActivity, {
@@ -426,7 +455,11 @@ const deleteActivityCommand: CommandHandler<{ body?: Record<string, unknown>; qu
     async execute(input, ctx) {
       const id = requireId(input, 'Activity id required')
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const activity = await em.findOne(StaffTeamMemberActivity, { id })
+      const scope = commandActorScope(ctx)
+      const activity = await em.findOne(
+        StaffTeamMemberActivity,
+        applyScopeToWhere<StaffTeamMemberActivity>({ id }, scope),
+      )
       if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })
       ensureTenantScope(ctx, activity.tenantId)
       ensureOrganizationScope(ctx, activity.organizationId)
@@ -473,7 +506,12 @@ const deleteActivityCommand: CommandHandler<{ body?: Record<string, unknown>; qu
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const member = await requireTeamMember(em, before.activity.memberId, 'Team member not found')
+      const member = await requireTeamMember(
+        em,
+        before.activity.memberId,
+        explicitStaffCommandScope(before.activity.tenantId, before.activity.organizationId),
+        'Team member not found',
+      )
       let activity = await em.findOne(StaffTeamMemberActivity, { id: before.activity.id })
       if (!activity) {
         activity = em.create(StaffTeamMemberActivity, {

package/src/modules/staff/commands/addresses.ts

@@ -12,8 +12,12 @@ import {
 } from '../data/validators'
 import { staffTeamMemberAddressCrudEvents } from '../lib/crud'
 import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
   ensureOrganizationScope,
   ensureTenantScope,
+  explicitStaffCommandScope,
   extractUndoPayload,
   requireTeamMember,
 } from './shared'
@@ -92,9 +96,15 @@ const createAddressCommand: CommandHandler<StaffTeamMemberAddressCreateInput, {
     const parsed = staffTeamMemberAddressCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      parsed.entityId,
+      scope,
+      'Team member not found',
+    )
     ensureTenantScope(ctx, member.tenantId)
     ensureOrganizationScope(ctx, member.organizationId)
 
@@ -182,7 +192,12 @@ const createAddressCommand: CommandHandler<StaffTeamMemberAddressCreateInput, {
       throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for address create' })
     }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await requireTeamMember(em, after.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      after.memberId,
+      explicitStaffCommandScope(after.tenantId, after.organizationId),
+      'Team member not found',
+    )
     let address = await em.findOne(StaffTeamMemberAddress, { id: after.id })
     if (!address) {
       address = em.create(StaffTeamMemberAddress, {
@@ -260,13 +275,17 @@ const updateAddressCommand: CommandHandler<StaffTeamMemberAddressUpdateInput, {
   async execute(rawInput, ctx) {
     const parsed = staffTeamMemberAddressUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const address = await em.findOne(StaffTeamMemberAddress, { id: parsed.id })
+    const scope = commandActorScope(ctx)
+    const address = await em.findOne(
+      StaffTeamMemberAddress,
+      applyScopeToWhere<StaffTeamMemberAddress>({ id: parsed.id }, scope),
+    )
     if (!address) throw new CrudHttpError(404, { error: 'Address not found' })
     ensureTenantScope(ctx, address.tenantId)
     ensureOrganizationScope(ctx, address.organizationId)
 
     if (parsed.entityId !== undefined) {
-      const member = await requireTeamMember(em, parsed.entityId, 'Team member not found')
+      const member = await requireTeamMember(em, parsed.entityId, scope, 'Team member not found')
       ensureTenantScope(ctx, member.tenantId)
       ensureOrganizationScope(ctx, member.organizationId)
       address.member = member
@@ -367,7 +386,12 @@ const updateAddressCommand: CommandHandler<StaffTeamMemberAddressUpdateInput, {
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let address = await em.findOne(StaffTeamMemberAddress, { id: before.id })
-    const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+    const member = await requireTeamMember(
+      em,
+      before.memberId,
+      explicitStaffCommandScope(before.tenantId, before.organizationId),
+      'Team member not found',
+    )
 
     if (!address) {
       address = em.create(StaffTeamMemberAddress, {
@@ -444,7 +468,11 @@ const deleteAddressCommand: CommandHandler<{ body?: Record<string, unknown>; que
     async execute(input, ctx) {
       const id = requireId(input, 'Address id required')
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const address = await em.findOne(StaffTeamMemberAddress, { id })
+      const scope = commandActorScope(ctx)
+      const address = await em.findOne(
+        StaffTeamMemberAddress,
+        applyScopeToWhere<StaffTeamMemberAddress>({ id }, scope),
+      )
       if (!address) throw new CrudHttpError(404, { error: 'Address not found' })
       ensureTenantScope(ctx, address.tenantId)
       ensureOrganizationScope(ctx, address.organizationId)
@@ -491,7 +519,12 @@ const deleteAddressCommand: CommandHandler<{ body?: Record<string, unknown>; que
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const member = await requireTeamMember(em, before.memberId, 'Team member not found')
+      const member = await requireTeamMember(
+        em,
+        before.memberId,
+        explicitStaffCommandScope(before.tenantId, before.organizationId),
+        'Team member not found',
+      )
       let address = await em.findOne(StaffTeamMemberAddress, { id: before.id })
       if (!address) {
         address = em.create(StaffTeamMemberAddress, {