@open-mercato/core 0.6.6-develop.6460.1.f94c74174c → 0.6.6-develop.6471.1.9ab5bdd79a

package/src/modules/staff/commands/shared.ts

@@ -74,6 +74,44 @@ export function scopeForDecryption(scope: StaffCommandScope): { tenantId: string
   return { tenantId: scope.tenantId, organizationId: scope.organizationId }
 }
 
+export type StaffSnapshotScope = {
+  tenantId?: string | null
+  organizationId?: string | null
+}
+
+type StaffSnapshotScopeSource = {
+  tenantId?: string | null
+  organizationId?: string | null
+}
+
+const NULL_DECRYPTION_SCOPE = { tenantId: null, organizationId: null } as const
+
+export function staffSnapshotScopeFromContext(ctx: CommandRuntimeContext): StaffSnapshotScope | null {
+  const tenantId = ctx.auth?.tenantId ?? null
+  if (!tenantId) return null
+  return { tenantId }
+}
+
+export function staffSnapshotScopeFromSnapshot(source: StaffSnapshotScopeSource | null | undefined): StaffSnapshotScope | null {
+  if (!source?.tenantId || !source.organizationId) return null
+  return { tenantId: source.tenantId, organizationId: source.organizationId }
+}
+
+export function scopedStaffSnapshotWhere(id: string, scope?: StaffSnapshotScope | null) {
+  const where: { id: string; tenantId?: string; organizationId?: string } = { id }
+  if (scope?.tenantId) where.tenantId = scope.tenantId
+  if (scope?.organizationId) where.organizationId = scope.organizationId
+  return where
+}
+
+export function staffSnapshotDecryptionScope(scope?: StaffSnapshotScope | null) {
+  if (!scope) return NULL_DECRYPTION_SCOPE
+  return {
+    tenantId: scope.tenantId ?? null,
+    organizationId: scope.organizationId ?? null,
+  }
+}
+
 export async function requireTeamMember(
   em: EntityManager,
   memberId: string,

package/src/modules/staff/commands/tag-assignments.ts

@@ -20,6 +20,9 @@ import {
   explicitStaffCommandScope,
   extractUndoPayload,
   scopeForDecryption,
+  scopedStaffSnapshotWhere,
+  staffSnapshotDecryptionScope,
+  staffSnapshotScopeFromSnapshot,
 } from './shared'
 
 type TeamMemberTagAssignmentSnapshot = {
@@ -113,7 +116,14 @@ const assignTeamMemberTagCommand: CommandHandler<StaffTeamMemberTagAssignmentInp
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await em.findOne(StaffTeamMember, { id: before.memberId })
+    const snapshotScope = staffSnapshotScopeFromSnapshot(before)
+    const member = await findOneWithDecryption(
+      em,
+      StaffTeamMember,
+      scopedStaffSnapshotWhere(before.memberId, snapshotScope),
+      undefined,
+      staffSnapshotDecryptionScope(snapshotScope),
+    )
     if (!member) return
     const nextTags = normalizeTagList(
       Array.isArray(member.tags) ? member.tags.filter((tag) => tag !== before.tag) : [],
@@ -243,7 +253,14 @@ const unassignTeamMemberTagCommand: CommandHandler<StaffTeamMemberTagAssignmentI
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await em.findOne(StaffTeamMember, { id: before.memberId })
+    const snapshotScope = staffSnapshotScopeFromSnapshot(before)
+    const member = await findOneWithDecryption(
+      em,
+      StaffTeamMember,
+      scopedStaffSnapshotWhere(before.memberId, snapshotScope),
+      undefined,
+      staffSnapshotDecryptionScope(snapshotScope),
+    )
     if (!member) return
     const currentTags = Array.isArray(member.tags) ? member.tags : []
     if (!currentTags.includes(before.tag)) {

package/src/modules/staff/commands/team-members.ts

@@ -27,6 +27,11 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   scopeForDecryption,
+  scopedStaffSnapshotWhere,
+  staffSnapshotDecryptionScope,
+  staffSnapshotScopeFromContext,
+  staffSnapshotScopeFromSnapshot,
+  type StaffSnapshotScope,
 } from './shared'
 import { E } from '#generated/entities.ids.generated'
 
@@ -67,8 +72,14 @@ function normalizeStringList(value: unknown): string[] {
   return Array.from(set)
 }
 
-async function loadTeamMemberSnapshot(em: EntityManager, id: string): Promise<TeamMemberSnapshot | null> {
-  const member = await findOneWithDecryption(em, StaffTeamMember, { id }, undefined, { tenantId: null, organizationId: null })
+async function loadTeamMemberSnapshot(em: EntityManager, id: string, scope?: StaffSnapshotScope | null): Promise<TeamMemberSnapshot | null> {
+  const member = await findOneWithDecryption(
+    em,
+    StaffTeamMember,
+    scopedStaffSnapshotWhere(id, scope),
+    undefined,
+    staffSnapshotDecryptionScope(scope),
+  )
   if (!member) return null
   return {
     id: member.id,
@@ -232,14 +243,14 @@ const createTeamMemberCommand: CommandHandler<StaffTeamMemberCreateInput, { memb
   },
   captureAfter: async (_input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamMemberSnapshot(em, result.memberId)
+    const snapshot = await loadTeamMemberSnapshot(em, result.memberId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamMemberCustomSnapshot(em, snapshot)
     return { snapshot, custom }
   },
   buildLog: async ({ result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamMemberSnapshot(em, result.memberId)
+    const snapshot = await loadTeamMemberSnapshot(em, result.memberId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamMemberCustomSnapshot(em, snapshot)
     const { translate } = await resolveTranslations()
@@ -263,7 +274,7 @@ const createTeamMemberCommand: CommandHandler<StaffTeamMemberCreateInput, { memb
     const after = payload?.after
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await em.findOne(StaffTeamMember, { id: after.id })
+    const member = await em.findOne(StaffTeamMember, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
     if (member) {
       member.deletedAt = new Date()
       await em.flush()
@@ -306,7 +317,7 @@ const updateTeamMemberCommand: CommandHandler<StaffTeamMemberUpdateInput, { memb
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(staffTeamMemberUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamMemberSnapshot(em, parsed.id)
+    const snapshot = await loadTeamMemberSnapshot(em, parsed.id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamMemberCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -387,7 +398,7 @@ const updateTeamMemberCommand: CommandHandler<StaffTeamMemberUpdateInput, { memb
     const before = snapshots.before as TeamMemberSnapshot | undefined
     if (!before) return null
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const after = await loadTeamMemberSnapshot(em, before.id)
+    const after = await loadTeamMemberSnapshot(em, before.id, staffSnapshotScopeFromSnapshot(before))
     if (!after) return null
     const customBefore = (snapshots as { customBefore?: CustomFieldSnapshot | null }).customBefore ?? undefined
     const customAfter = await loadTeamMemberCustomSnapshot(em, after)
@@ -430,7 +441,7 @@ const updateTeamMemberCommand: CommandHandler<StaffTeamMemberUpdateInput, { memb
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const member = await em.findOne(StaffTeamMember, { id: before.id })
+    const member = await em.findOne(StaffTeamMember, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!member) return
     member.teamId = before.teamId ?? null
     member.displayName = before.displayName
@@ -477,7 +488,7 @@ const deleteTeamMemberCommand: CommandHandler<{ id?: string }, { memberId: strin
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Member id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamMemberSnapshot(em, id)
+    const snapshot = await loadTeamMemberSnapshot(em, id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamMemberCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -542,7 +553,7 @@ const deleteTeamMemberCommand: CommandHandler<{ id?: string }, { memberId: strin
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let member = await em.findOne(StaffTeamMember, { id: before.id })
+    let member = await em.findOne(StaffTeamMember, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!member) {
       member = em.create(StaffTeamMember, {
         id: before.id,

package/src/modules/staff/commands/team-roles.ts

@@ -25,6 +25,11 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   scopeForDecryption,
+  scopedStaffSnapshotWhere,
+  staffSnapshotDecryptionScope,
+  staffSnapshotScopeFromContext,
+  staffSnapshotScopeFromSnapshot,
+  type StaffSnapshotScope,
 } from './shared'
 import { E } from '#generated/entities.ids.generated'
 
@@ -51,8 +56,14 @@ type TeamRoleUndoPayload = {
   customAfter?: CustomFieldSnapshot | null
 }
 
-async function loadTeamRoleSnapshot(em: EntityManager, id: string): Promise<TeamRoleSnapshot | null> {
-  const role = await findOneWithDecryption(em, StaffTeamRole, { id }, undefined, { tenantId: null, organizationId: null })
+async function loadTeamRoleSnapshot(em: EntityManager, id: string, scope?: StaffSnapshotScope | null): Promise<TeamRoleSnapshot | null> {
+  const role = await findOneWithDecryption(
+    em,
+    StaffTeamRole,
+    scopedStaffSnapshotWhere(id, scope),
+    undefined,
+    staffSnapshotDecryptionScope(scope),
+  )
   if (!role) return null
   return {
     id: role.id,
@@ -157,14 +168,14 @@ const createTeamRoleCommand: CommandHandler<StaffTeamRoleCreateInput, { roleId:
   },
   captureAfter: async (_input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamRoleSnapshot(em, result.roleId)
+    const snapshot = await loadTeamRoleSnapshot(em, result.roleId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamRoleCustomSnapshot(em, snapshot)
     return { snapshot, custom }
   },
   buildLog: async ({ result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamRoleSnapshot(em, result.roleId)
+    const snapshot = await loadTeamRoleSnapshot(em, result.roleId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamRoleCustomSnapshot(em, snapshot)
     const { translate } = await resolveTranslations()
@@ -188,7 +199,7 @@ const createTeamRoleCommand: CommandHandler<StaffTeamRoleCreateInput, { roleId:
     const after = payload?.after
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const role = await em.findOne(StaffTeamRole, { id: after.id })
+    const role = await em.findOne(StaffTeamRole, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
     if (role) {
       role.deletedAt = new Date()
       await em.flush()
@@ -231,7 +242,7 @@ const updateTeamRoleCommand: CommandHandler<StaffTeamRoleUpdateInput, { roleId:
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(staffTeamRoleUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamRoleSnapshot(em, parsed.id)
+    const snapshot = await loadTeamRoleSnapshot(em, parsed.id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamRoleCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -293,7 +304,7 @@ const updateTeamRoleCommand: CommandHandler<StaffTeamRoleUpdateInput, { roleId:
     const before = snapshots.before as TeamRoleSnapshot | undefined
     if (!before) return null
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const after = await loadTeamRoleSnapshot(em, before.id)
+    const after = await loadTeamRoleSnapshot(em, before.id, staffSnapshotScopeFromSnapshot(before))
     if (!after) return null
     const customBefore = (snapshots as { customBefore?: CustomFieldSnapshot | null }).customBefore ?? undefined
     const customAfter = await loadTeamRoleCustomSnapshot(em, after)
@@ -334,7 +345,7 @@ const updateTeamRoleCommand: CommandHandler<StaffTeamRoleUpdateInput, { roleId:
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const role = await em.findOne(StaffTeamRole, { id: before.id })
+    const role = await em.findOne(StaffTeamRole, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!role) return
     role.teamId = before.teamId ?? null
     role.name = before.name
@@ -379,7 +390,7 @@ const deleteTeamRoleCommand: CommandHandler<{ id?: string }, { roleId: string }>
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Role id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamRoleSnapshot(em, id)
+    const snapshot = await loadTeamRoleSnapshot(em, id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamRoleCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -464,7 +475,7 @@ const deleteTeamRoleCommand: CommandHandler<{ id?: string }, { roleId: string }>
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let role = await em.findOne(StaffTeamRole, { id: before.id })
+    let role = await em.findOne(StaffTeamRole, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!role) {
       role = em.create(StaffTeamRole, {
         id: before.id,

package/src/modules/staff/commands/teams.ts

@@ -25,6 +25,11 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   scopeForDecryption,
+  scopedStaffSnapshotWhere,
+  staffSnapshotDecryptionScope,
+  staffSnapshotScopeFromContext,
+  staffSnapshotScopeFromSnapshot,
+  type StaffSnapshotScope,
 } from './shared'
 import { E } from '#generated/entities.ids.generated'
 
@@ -49,8 +54,14 @@ type TeamUndoPayload = {
   customAfter?: CustomFieldSnapshot | null
 }
 
-async function loadTeamSnapshot(em: EntityManager, id: string): Promise<TeamSnapshot | null> {
-  const team = await findOneWithDecryption(em, StaffTeam, { id }, undefined, { tenantId: null, organizationId: null })
+async function loadTeamSnapshot(em: EntityManager, id: string, scope?: StaffSnapshotScope | null): Promise<TeamSnapshot | null> {
+  const team = await findOneWithDecryption(
+    em,
+    StaffTeam,
+    scopedStaffSnapshotWhere(id, scope),
+    undefined,
+    staffSnapshotDecryptionScope(scope),
+  )
   if (!team) return null
   return {
     id: team.id,
@@ -129,14 +140,14 @@ const createTeamCommand: CommandHandler<StaffTeamCreateInput, { teamId: string }
   },
   captureAfter: async (_input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamSnapshot(em, result.teamId)
+    const snapshot = await loadTeamSnapshot(em, result.teamId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamCustomSnapshot(em, snapshot)
     return { snapshot, custom }
   },
   buildLog: async ({ result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTeamSnapshot(em, result.teamId)
+    const snapshot = await loadTeamSnapshot(em, result.teamId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const custom = await loadTeamCustomSnapshot(em, snapshot)
     const { translate } = await resolveTranslations()
@@ -160,7 +171,7 @@ const createTeamCommand: CommandHandler<StaffTeamCreateInput, { teamId: string }
     const after = payload?.after
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const team = await em.findOne(StaffTeam, { id: after.id })
+    const team = await em.findOne(StaffTeam, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
     if (team) {
       team.deletedAt = new Date()
       await em.flush()
@@ -203,7 +214,7 @@ const updateTeamCommand: CommandHandler<StaffTeamUpdateInput, { teamId: string }
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(staffTeamUpdateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamSnapshot(em, parsed.id)
+    const snapshot = await loadTeamSnapshot(em, parsed.id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -258,7 +269,7 @@ const updateTeamCommand: CommandHandler<StaffTeamUpdateInput, { teamId: string }
     const before = snapshots.before as TeamSnapshot | undefined
     if (!before) return null
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const after = await loadTeamSnapshot(em, before.id)
+    const after = await loadTeamSnapshot(em, before.id, staffSnapshotScopeFromSnapshot(before))
     if (!after) return null
     const customBefore = (snapshots as { customBefore?: CustomFieldSnapshot | null }).customBefore ?? undefined
     const customAfter = await loadTeamCustomSnapshot(em, after)
@@ -297,7 +308,7 @@ const updateTeamCommand: CommandHandler<StaffTeamUpdateInput, { teamId: string }
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const team = await em.findOne(StaffTeam, { id: before.id })
+    const team = await em.findOne(StaffTeam, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!team) return
     team.name = before.name
     team.description = before.description ?? null
@@ -340,7 +351,7 @@ const deleteTeamCommand: CommandHandler<{ id?: string }, { teamId: string }> = {
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Team id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTeamSnapshot(em, id)
+    const snapshot = await loadTeamSnapshot(em, id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     const custom = await loadTeamCustomSnapshot(em, snapshot)
     return { before: snapshot, customBefore: custom }
@@ -418,7 +429,7 @@ const deleteTeamCommand: CommandHandler<{ id?: string }, { teamId: string }> = {
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let team = await em.findOne(StaffTeam, { id: before.id })
+    let team = await em.findOne(StaffTeam, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!team) {
       team = em.create(StaffTeam, {
         id: before.id,

package/src/modules/staff/commands/timesheets-entries.ts

@@ -30,8 +30,16 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   scopeForDecryption,
+  scopedStaffSnapshotWhere,
+  staffSnapshotDecryptionScope,
+  staffSnapshotScopeFromContext,
+  staffSnapshotScopeFromSnapshot,
+  type StaffSnapshotScope,
 } from './shared'
 import { getStaffMemberByUserId } from '../lib/staffMemberResolver'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('staff')
 
 type RbacServiceLike = {
   userHasAllFeatures: (
@@ -132,8 +140,14 @@ type TimeEntryUndoPayload = {
   after?: TimeEntrySnapshot | null
 }
 
-async function loadTimeEntrySnapshot(em: EntityManager, id: string): Promise<TimeEntrySnapshot | null> {
-  const entry = await findOneWithDecryption(em, StaffTimeEntry, { id }, undefined, { tenantId: null, organizationId: null })
+async function loadTimeEntrySnapshot(em: EntityManager, id: string, scope?: StaffSnapshotScope | null): Promise<TimeEntrySnapshot | null> {
+  const entry = await findOneWithDecryption(
+    em,
+    StaffTimeEntry,
+    scopedStaffSnapshotWhere(id, scope),
+    undefined,
+    staffSnapshotDecryptionScope(scope),
+  )
   if (!entry) return null
   return {
     id: entry.id,
@@ -241,13 +255,13 @@ const createTimeEntryCommand: CommandHandler<StaffTimeEntryCreateInput, { timeEn
   },
   captureAfter: async (_input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     return { snapshot }
   },
   buildLog: async ({ result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const { translate } = await resolveTranslations()
     return {
@@ -269,7 +283,7 @@ const createTimeEntryCommand: CommandHandler<StaffTimeEntryCreateInput, { timeEn
     const after = payload?.after
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entry = await em.findOne(StaffTimeEntry, { id: after.id })
+    const entry = await em.findOne(StaffTimeEntry, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
     if (entry) {
       entry.deletedAt = new Date()
       await em.flush()
@@ -404,20 +418,20 @@ const startTimerCommand: CommandHandler<StaffTimeEntryStartTimerInput, { timeEnt
       organizationId: parsed.organizationId,
       startedAt: startedAt.toISOString(),
     }, { persistent: true }).catch((err) => {
-      console.error('[staff.timesheets] emit timer_started failed', err)
+      logger.error('staff.timesheets emit timer_started failed', { err })
     })
 
     return { timeEntryId: entry.id }
   },
   captureAfter: async (_input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     return { snapshot }
   },
   buildLog: async ({ result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId)
+    const snapshot = await loadTimeEntrySnapshot(em, result.timeEntryId, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return null
     const { translate } = await resolveTranslations()
     return {
@@ -439,7 +453,7 @@ const startTimerCommand: CommandHandler<StaffTimeEntryStartTimerInput, { timeEnt
     const after = payload?.after
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entry = await em.findOne(StaffTimeEntry, { id: after.id })
+    const entry = await em.findOne(StaffTimeEntry, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
     if (entry) {
       entry.deletedAt = new Date()
       await em.flush()
@@ -460,7 +474,7 @@ const updateTimeEntryCommand: CommandHandler<StaffTimeEntryUpdateInput, { timeEn
   async prepare(rawInput, ctx) {
     const parsed = staffTimeEntryUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTimeEntrySnapshot(em, parsed.id)
+    const snapshot = await loadTimeEntrySnapshot(em, parsed.id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     return { before: snapshot }
   },
@@ -521,7 +535,7 @@ const updateTimeEntryCommand: CommandHandler<StaffTimeEntryUpdateInput, { timeEn
     const before = snapshots.before as TimeEntrySnapshot | undefined
     if (!before) return null
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const after = await loadTimeEntrySnapshot(em, before.id)
+    const after = await loadTimeEntrySnapshot(em, before.id, staffSnapshotScopeFromSnapshot(before))
     if (!after) return null
     const changes = buildChanges(before as unknown as Record<string, unknown>, after as unknown as Record<string, unknown>, [
       'date',
@@ -556,7 +570,7 @@ const updateTimeEntryCommand: CommandHandler<StaffTimeEntryUpdateInput, { timeEn
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entry = await em.findOne(StaffTimeEntry, { id: before.id })
+    const entry = await em.findOne(StaffTimeEntry, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!entry) return
     entry.date = before.date as unknown as Date
     entry.durationMinutes = before.durationMinutes
@@ -586,7 +600,7 @@ const deleteTimeEntryCommand: CommandHandler<{ id?: string }, { timeEntryId: str
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Time entry id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadTimeEntrySnapshot(em, id)
+    const snapshot = await loadTimeEntrySnapshot(em, id, staffSnapshotScopeFromContext(ctx))
     if (!snapshot) return {}
     return { before: snapshot }
   },
@@ -656,7 +670,7 @@ const deleteTimeEntryCommand: CommandHandler<{ id?: string }, { timeEntryId: str
     const before = payload?.before
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let entry = await em.findOne(StaffTimeEntry, { id: before.id })
+    let entry = await em.findOne(StaffTimeEntry, scopedStaffSnapshotWhere(before.id, staffSnapshotScopeFromSnapshot(before)))
     if (!entry) {
       entry = em.create(StaffTimeEntry, {
         id: before.id,