@open-mercato/core 0.6.6-develop.6458.1.113a54fb91 → 0.6.6-develop.6465.1.019f0fb26f

package/src/helpers/integration/auth.ts

@@ -1,4 +1,4 @@
-import { type Page } from '@playwright/test';
+import { type Page, type Response } from '@playwright/test';
 import { readFileSync } from 'fs';
 import { resolve } from 'path';
 
@@ -136,102 +136,194 @@ async function recoverGenericErrorPageIfPresent(page: Page): Promise<void> {
   await dismissGlobalNoticesIfPresent(page);
 }
 
-export async function login(page: Page, role: Role = 'admin'): Promise<void> {
-  const creds = DEFAULT_CREDENTIALS[role];
-  const loginReadySelector = 'form[data-auth-ready="1"]';
-  const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
-  const waitForBackend = async (timeout: number): Promise<boolean> => {
-    try {
-      await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
-      return true;
-    } catch {
-      return hasBackendUrl();
-    }
-  };
+type AuthNavigationTraceEntry = {
+  path: string;
+  status: number;
+  location: string | null;
+};
 
-  await acknowledgeGlobalNotices(page);
-  const apiLoginForm = new URLSearchParams();
-  apiLoginForm.set('email', creds.email);
-  apiLoginForm.set('password', creds.password);
-  // Retry-on-429 against the auth rate limit (5/60s per email). Capped
-  // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
-  let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
-  for (let retry = 0; retry < 4; retry += 1) {
-    apiLoginResponse = await page.request.post('/api/auth/login', {
-      headers: {
-        'content-type': 'application/x-www-form-urlencoded',
-      },
-      data: apiLoginForm.toString(),
-    }).catch(() => null);
-    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
-    await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
+function toPathOnly(rawUrl: string): string {
+  try {
+    const url = new URL(rawUrl);
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-url]';
+  }
+}
+
+function toRedactedLocation(rawLocation: string | undefined): string | null {
+  if (!rawLocation) return null;
+  try {
+    const url = new URL(rawLocation, 'http://integration.local');
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-location]';
   }
-  if (apiLoginResponse?.ok()) {
-    const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
-    const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
-    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
-    const cookies = [];
-    if (claims?.tenantId) {
-      cookies.push({
-        name: 'om_selected_tenant',
-        value: claims.tenantId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
+}
+
+function createAuthNavigationTrace(page: Page): {
+  entries: AuthNavigationTraceEntry[];
+  stop: () => void;
+} {
+  const entries: AuthNavigationTraceEntry[] = [];
+  const onResponse = (response: Response) => {
+    const path = toPathOnly(response.url());
+    if (path === '/backend' || path.startsWith('/api/auth/session/refresh')) {
+      entries.push({
+        path,
+        status: response.status(),
+        location: toRedactedLocation(response.headers().location),
       });
     }
-    if (claims?.orgId) {
-      cookies.push({
-        name: 'om_selected_org',
-        value: claims.orgId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
-      });
+  };
+  page.on('response', onResponse);
+  return {
+    entries,
+    stop: () => page.off('response', onResponse),
+  };
+}
+
+async function formatLoginDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+): Promise<string> {
+  const cookieNames = Array.from(
+    new Set((await page.context().cookies()).map((cookie) => cookie.name)),
+  ).sort((left, right) => left.localeCompare(right));
+  const traceLines = entries.length
+    ? entries.map((entry) => {
+      const location = entry.location ? ` -> ${entry.location}` : '';
+      return `${entry.status} ${entry.path}${location}`;
+    })
+    : ['none'];
+
+  return [
+    `Login diagnostics for role "${role}":`,
+    `current URL: ${toPathOnly(page.url())}`,
+    `browser cookie names: ${cookieNames.length ? cookieNames.join(', ') : 'none'}`,
+    'backend/refresh trace:',
+    ...traceLines,
+  ].join('\n');
+}
+
+async function throwLoginErrorWithDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+  error: unknown,
+): Promise<never> {
+  const message = error instanceof Error ? error.message : String(error);
+  throw new Error([
+    `Login did not reach backend for role: ${role}.`,
+    await formatLoginDiagnostics(page, role, entries),
+    `Original error: ${message}`,
+  ].join('\n'));
+}
+
+export async function login(page: Page, role: Role = 'admin'): Promise<void> {
+  const authTrace = createAuthNavigationTrace(page);
+  try {
+    const creds = DEFAULT_CREDENTIALS[role];
+    const loginReadySelector = 'form[data-auth-ready="1"]';
+    const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
+    const waitForBackend = async (timeout: number): Promise<boolean> => {
+      try {
+        await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
+        return true;
+      } catch {
+        return hasBackendUrl();
+      }
+    };
+
+    await acknowledgeGlobalNotices(page);
+    const apiLoginForm = new URLSearchParams();
+    apiLoginForm.set('email', creds.email);
+    apiLoginForm.set('password', creds.password);
+    // Retry-on-429 against the auth rate limit (5/60s per email). Capped
+    // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
+    let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
+    for (let retry = 0; retry < 4; retry += 1) {
+      apiLoginResponse = await page.request.post('/api/auth/login', {
+        headers: {
+          'content-type': 'application/x-www-form-urlencoded',
+        },
+        data: apiLoginForm.toString(),
+      }).catch(() => null);
+      if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
+      await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
     }
-    if (cookies.length > 0) {
-      await page.context().addCookies(cookies);
+    if (apiLoginResponse?.ok()) {
+      const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
+      const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
+      const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
+      const cookies = [];
+      if (claims?.tenantId) {
+        cookies.push({
+          name: 'om_selected_tenant',
+          value: claims.tenantId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (claims?.orgId) {
+        cookies.push({
+          name: 'om_selected_org',
+          value: claims.orgId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (cookies.length > 0) {
+        await page.context().addCookies(cookies);
+      }
+      await page.goto('/backend', { waitUntil: 'domcontentloaded' });
+      if (await waitForBackend(8_000)) return;
     }
-    await page.goto('/backend', { waitUntil: 'domcontentloaded' });
-    if (await waitForBackend(8_000)) return;
-  }
 
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    await page.goto('/login', { waitUntil: 'domcontentloaded' });
-    await dismissGlobalNoticesIfPresent(page);
-    await recoverClientSideErrorPageIfPresent(page);
-    await recoverGenericErrorPageIfPresent(page);
-    await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
-    if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
-    if (attempt === 3) {
-      throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      await page.goto('/login', { waitUntil: 'domcontentloaded' });
+      await dismissGlobalNoticesIfPresent(page);
+      await recoverClientSideErrorPageIfPresent(page);
+      await recoverGenericErrorPageIfPresent(page);
+      await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
+      if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
+      if (attempt === 3) {
+        throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+      }
     }
-  }
-  await page.getByLabel('Email').fill(creds.email);
+    await page.getByLabel('Email').fill(creds.email);
 
-  const passwordInput = page.getByLabel('Password', { exact: true }).first();
-  if (await passwordInput.isVisible().catch(() => false)) {
-    await passwordInput.fill(creds.password);
-    await passwordInput.press('Enter');
-  } else {
-    const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-    await submitButton.click();
-  }
+    const passwordInput = page.getByLabel('Password', { exact: true }).first();
+    if (await passwordInput.isVisible().catch(() => false)) {
+      await passwordInput.fill(creds.password);
+      await passwordInput.press('Enter');
+    } else {
+      const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+      await submitButton.click();
+    }
 
-  if (await waitForBackend(7_000)) return;
+    if (await waitForBackend(7_000)) return;
 
-  const loginForm = page.locator('form').first();
-  if (await loginForm.isVisible().catch(() => false)) {
-    await loginForm.evaluate((element) => {
-      const form = element as HTMLFormElement
-      form.requestSubmit()
-    }).catch(() => {})
-  }
-  if (await waitForBackend(5_000)) return;
+    const loginForm = page.locator('form').first();
+    if (await loginForm.isVisible().catch(() => false)) {
+      await loginForm.evaluate((element) => {
+        const form = element as HTMLFormElement
+        form.requestSubmit()
+      }).catch(() => {})
+    }
+    if (await waitForBackend(5_000)) return;
 
-  const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-  if (await loginButton.isVisible().catch(() => false)) {
-    await loginButton.click({ force: true });
-  }
-  if (await waitForBackend(8_000)) return;
+    const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+    if (await loginButton.isVisible().catch(() => false)) {
+      await loginButton.click({ force: true });
+    }
+    if (await waitForBackend(8_000)) return;
 
-  throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+    throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+  } catch (error) {
+    await throwLoginErrorWithDiagnostics(page, role, authTrace.entries, error);
+  } finally {
+    authTrace.stop();
+  }
 }

package/src/modules/query_index/api/status.ts

@@ -4,7 +4,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { sql } from 'kysely'
-import { readCoverageSnapshots, refreshCoverageSnapshot } from '../lib/coverage'
+import { readCoverageSnapshots, refreshCoverageSnapshot, type CoverageSnapshot } from '../lib/coverage'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import type { FullTextSearchStrategy } from '@open-mercato/search/strategies'
 import type { SearchModuleConfig } from '@open-mercato/shared/modules/search'
@@ -17,6 +17,33 @@ export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['query_index.status.view'] },
 }
 
+const STATUS_REFRESH_COOLDOWN_MS = 60_000
+
+function getCoverageSnapshotRefreshedAt(snapshot: Pick<CoverageSnapshot, 'refreshed_at'> | null | undefined): number | null {
+  const value = snapshot?.refreshed_at
+  if (value instanceof Date) {
+    const time = value.getTime()
+    return Number.isFinite(time) ? time : null
+  }
+  if (typeof value === 'string') {
+    const time = new Date(value).getTime()
+    return Number.isFinite(time) ? time : null
+  }
+  return null
+}
+
+function hasFreshCoverageSnapshots(
+  snapshots: Map<string, CoverageSnapshot>,
+  entityIds: string[],
+  now: number,
+): boolean {
+  for (const entityId of entityIds) {
+    const refreshedAt = getCoverageSnapshotRefreshedAt(snapshots.get(entityId))
+    if (refreshedAt === null || now - refreshedAt >= STATUS_REFRESH_COOLDOWN_MS) return false
+  }
+  return entityIds.length > 0
+}
+
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -303,9 +330,10 @@ export async function GET(req: Request) {
   // event emitted below, never inline per entity.
   const snapshotByEntity = await readCoverageSnapshots(db, { entityTypes: entityIds, ...coverageScope })
 
-  // An explicit refresh action (?refresh) is allowed to block: recompute every entity's
-  // coverage with bounded concurrency, then re-read the freshly written snapshots.
-  if (forceRefresh && entityIds.length > 0) {
+  // An explicit refresh action (?refresh) may block, but only when the durable
+  // coverage snapshots are stale. Recent persisted snapshots survive workers/restarts,
+  // so repeated refresh requests use them instead of hammering base-table counts.
+  if (forceRefresh && entityIds.length > 0 && !hasFreshCoverageSnapshots(snapshotByEntity, entityIds, Date.now())) {
     await mapWithConcurrency(entityIds, COVERAGE_REFRESH_CONCURRENCY, (entityId) =>
       refreshCoverageSnapshot(em, { entityType: entityId, ...coverageScope }).catch(() => undefined),
     )

package/src/modules/sales/api/document-addresses/route.ts

@@ -1,10 +1,13 @@
 import { z } from 'zod'
-import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createSalesCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../openapi'
 import { withScopedPayload } from '../utils'
-import { SalesDocumentAddress } from '../../data/entities'
+import { SalesDocumentAddress, SalesOrder, SalesQuote } from '../../data/entities'
 import {
   documentAddressCreateSchema,
   documentAddressDeleteSchema,
@@ -34,8 +37,131 @@ const routeMetadata = {
 
 export const metadata = routeMetadata
 
+type DocumentKind = 'order' | 'quote'
+type DocumentAddressAccess = 'view' | 'manage'
+type Translate = (key: string, fallback?: string) => string
+
+const DOCUMENT_ADDRESS_FEATURES: Record<DocumentKind, Record<DocumentAddressAccess, string>> = {
+  order: { view: 'sales.orders.view', manage: 'sales.orders.manage' },
+  quote: { view: 'sales.quotes.view', manage: 'sales.quotes.manage' },
+}
+
+function toDocumentKind(value: unknown): DocumentKind | null {
+  return value === 'order' || value === 'quote' ? value : null
+}
+
+async function resolveDocumentKindForRead(query: { documentId?: string; documentKind?: DocumentKind }, ctx: CrudCtx) {
+  if (query.documentKind) return query.documentKind
+
+  const tenantId = ctx.auth?.tenantId ?? null
+  const organizationId =
+    ctx.selectedOrganizationId ??
+    ctx.auth?.orgId ??
+    (Array.isArray(ctx.organizationIds) && ctx.organizationIds.length === 1 ? ctx.organizationIds[0] : null)
+  if (!query.documentId || !tenantId || !organizationId) return null
+
+  const em = ctx.container.resolve('em') as EntityManager
+  const scope = { tenantId, organizationId }
+  const order = await findOneWithDecryption(em, SalesOrder, { id: query.documentId, tenantId, organizationId }, {}, scope)
+  if (order) return 'order'
+  const quote = await findOneWithDecryption(em, SalesQuote, { id: query.documentId, tenantId, organizationId }, {}, scope)
+  if (quote) return 'quote'
+  return null
+}
+
+async function ensureDocumentAddressReadAccess(query: { documentId?: string; documentKind?: DocumentKind }, ctx: CrudCtx) {
+  const documentKind = await resolveDocumentKindForRead(query, ctx)
+  const requiredFeatures = documentKind
+    ? [DOCUMENT_ADDRESS_FEATURES[documentKind].view]
+    : [DOCUMENT_ADDRESS_FEATURES.order.view, DOCUMENT_ADDRESS_FEATURES.quote.view]
+  await ensureDocumentAddressAccess(ctx, requiredFeatures)
+  return documentKind
+}
+
+async function resolveExistingAddressKind(
+  ctx: CrudCtx,
+  id: string,
+  scope: { tenantId: string; organizationId: string },
+): Promise<DocumentKind | null> {
+  const em = ctx.container.resolve('em') as EntityManager
+  const address = await findOneWithDecryption(
+    em,
+    SalesDocumentAddress,
+    { id, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    {},
+    scope,
+  )
+  return toDocumentKind(address?.documentKind)
+}
+
+async function ensureDocumentAddressAccess(
+  ctx: CrudCtx,
+  requiredFeatures: string[],
+  translate?: Translate,
+): Promise<void> {
+  const resolvedTranslate = translate ?? (await resolveTranslations()).translate
+  const auth = ctx.auth
+  if (!auth?.sub) {
+    throw new CrudHttpError(401, { error: resolvedTranslate('api.errors.unauthorized', 'Unauthorized') })
+  }
+
+  let rbac: RbacService | null = null
+  try {
+    rbac = ctx.container.resolve('rbacService') as RbacService
+  } catch {
+    rbac = null
+  }
+
+  const ok = rbac
+    ? await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {
+        tenantId: auth.tenantId ?? null,
+        organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,
+      })
+    : false
+  if (!ok) {
+    throw new CrudHttpError(403, {
+      error: resolvedTranslate('api.errors.forbidden', 'Forbidden'),
+      requiredFeatures,
+    })
+  }
+}
+
+async function ensureDocumentAddressKindAccess(
+  ctx: CrudCtx,
+  documentKind: DocumentKind,
+  access: DocumentAddressAccess,
+  translate?: Translate,
+): Promise<void> {
+  await ensureDocumentAddressAccess(ctx, [DOCUMENT_ADDRESS_FEATURES[documentKind][access]], translate)
+}
+
+async function ensureDocumentAddressMutationAccess(
+  ctx: CrudCtx,
+  input: { id: string; documentKind: DocumentKind; tenantId: string; organizationId: string },
+  options: { includeTargetKind: boolean; translate?: Translate },
+): Promise<void> {
+  const existingKind = await resolveExistingAddressKind(ctx, input.id, {
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+  })
+  const featureKinds = new Set<DocumentKind>()
+  if (existingKind) featureKinds.add(existingKind)
+  if (!existingKind || options.includeTargetKind) featureKinds.add(input.documentKind)
+
+  await ensureDocumentAddressAccess(
+    ctx,
+    [...featureKinds].map((kind) => DOCUMENT_ADDRESS_FEATURES[kind].manage),
+    options.translate,
+  )
+}
+
 const crud = makeCrudRoute({
   metadata: routeMetadata,
+  hooks: {
+    beforeList: async (query, ctx) => {
+      await ensureDocumentAddressReadAccess(query, ctx)
+    },
+  },
   orm: {
     entity: SalesDocumentAddress,
     idField: 'id',
@@ -76,12 +202,13 @@ const crud = makeCrudRoute({
       createdAt: 'created_at',
       updatedAt: 'updated_at',
     },
-    buildFilters: async (query: any) => {
+    buildFilters: async (query: any, ctx) => {
+      const documentKind = await resolveDocumentKindForRead(query, ctx)
       const filters: Record<string, any> = {
         document_id: { $eq: query.documentId },
       }
 
-      if (query.documentKind) filters.document_kind = { $eq: query.documentKind }
+      if (query.documentKind ?? documentKind) filters.document_kind = { $eq: query.documentKind ?? documentKind }
       return filters
     },
   },
@@ -91,7 +218,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return documentAddressCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = documentAddressCreateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureDocumentAddressKindAccess(ctx, input.documentKind, 'manage', translate)
+        return input
       },
       response: ({ result }) => ({ id: result?.id ?? null }),
       status: 201,
@@ -101,7 +230,9 @@ const crud = makeCrudRoute({
       schema: rawBodySchema,
       mapInput: async ({ raw, ctx }) => {
         const { translate } = await resolveTranslations()
-        return documentAddressUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        const input = documentAddressUpdateSchema.parse(withScopedPayload(raw ?? {}, ctx, translate))
+        await ensureDocumentAddressMutationAccess(ctx, input, { includeTargetKind: true, translate })
+        return input
       },
       response: () => ({ ok: true }),
     },
@@ -128,7 +259,9 @@ const crud = makeCrudRoute({
             error: translate('sales.documents.detail.error', 'Document not found or inaccessible.'),
           })
         }
-        return documentAddressDeleteSchema.parse(withScopedPayload({ id, documentId, documentKind }, ctx, translate))
+        const input = documentAddressDeleteSchema.parse(withScopedPayload({ id, documentId, documentKind }, ctx, translate))
+        await ensureDocumentAddressMutationAccess(ctx, input, { includeTargetKind: false, translate })
+        return input
       },
       response: () => ({ ok: true }),
     },

package/src/modules/sales/commands/documentAddresses.ts

@@ -104,6 +104,12 @@ function applyDocumentAddressSnapshot(em: EntityManager, entity: SalesDocumentAd
   entity.quote = snapshot.documentKind === 'quote' ? em.getReference(SalesQuote, snapshot.documentId) : null
 }
 
+function assertDocumentAddressParent(entity: SalesDocumentAddress, input: { documentId: string; documentKind: 'order' | 'quote' }): void {
+  if (entity.documentId !== input.documentId || entity.documentKind !== input.documentKind) {
+    throw new CrudHttpError(404, { error: 'sales.document.address.not_found' })
+  }
+}
+
 async function emitDocumentAddressIndexSideEffects(
   ctx: { container: { resolve: (name: string) => unknown } },
   action: 'created' | 'updated' | 'deleted',
@@ -256,6 +262,7 @@ const updateDocumentAddress: CommandHandler<DocumentAddressUpdateInput, { id: st
       'sales.document.address.not_found'
     )
     ensureSameScope(entity, input.organizationId, input.tenantId)
+    assertDocumentAddressParent(entity, input)
     const document = await requireDocument(em, input.documentKind, input.documentId, input.organizationId, input.tenantId)
     if (input.documentKind === 'order') {
       await assertAddressEditable(em, {
@@ -344,6 +351,7 @@ const deleteDocumentAddress: CommandHandler<
       'sales.document.address.not_found'
     )
     ensureSameScope(entity, input.organizationId, input.tenantId)
+    assertDocumentAddressParent(entity, input)
     const document = await requireDocument(em, input.documentKind, input.documentId, input.organizationId, input.tenantId)
     if (input.documentKind === 'order') {
       await assertAddressEditable(em, {