@open-mercato/core 0.6.6-develop.6535.1.5cf43724de → 0.6.6-develop.6540.1.ae856df1ec

package/src/modules/attachments/lib/reconcileOrganization.ts

@@ -0,0 +1,188 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { Attachment } from '../data/entities'
+
+const logger = createLogger('attachments').child({ component: 'reconcileOrganization' })
+
+/**
+ * Virtual entity id for library attachments — these are not attached to a
+ * parent record that owns an organization, so there is nothing to reconcile
+ * against. They are counted as skipped rather than unresolved.
+ */
+const LIBRARY_ENTITY_ID = 'attachments:library'
+
+const DEFAULT_BATCH_SIZE = 500
+
+export type AttachmentOrgReconcileEntityStat = {
+  scanned: number
+  updated: number
+  unresolved: number
+}
+
+export type AttachmentOrgReconcileReport = {
+  scanned: number
+  updated: number
+  unresolved: number
+  skippedVirtual: number
+  byEntity: Record<string, AttachmentOrgReconcileEntityStat>
+}
+
+type AttachmentScanRow = {
+  id: string
+  entity_id: string | null
+  record_id: string | null
+  organization_id: string | null
+}
+
+function readParentOrganizationId(record: Record<string, unknown>): string | null {
+  const raw = record['organization_id'] ?? record['organizationId']
+  if (typeof raw === 'string' && raw.trim().length) return raw.trim()
+  return null
+}
+
+function ensureBucket(
+  report: AttachmentOrgReconcileReport,
+  entityId: string,
+): AttachmentOrgReconcileEntityStat {
+  const existing = report.byEntity[entityId]
+  if (existing) return existing
+  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }
+  report.byEntity[entityId] = bucket
+  return bucket
+}
+
+/**
+ * Reconcile the `organization_id` of existing attachments to the organization
+ * of the record they are attached to.
+ *
+ * Background (#3765): before the upload route became selected-organization
+ * aware, a multi-org admin who switched the header organization uploaded files
+ * that were silently stored under their *home* organization instead of the
+ * selected one (the organization of the parent record). Those rows are now
+ * invisible to org-scoped reads and stay orphaned. This heals them forward.
+ *
+ * The parent record's organization is the ground truth: an attachment is not
+ * distinguishable from a legitimately home-org one by looking at the attachment
+ * alone. Parent organizations are resolved generically through the Query Engine
+ * by `entityId` (works for both base and custom entities, tenant-scoped and
+ * organization-agnostic so the parent's real org is returned regardless of
+ * which org the caller sits in) — the same mechanism the attachments module
+ * already uses to enrich assignment details.
+ *
+ * The reconciliation is:
+ * - idempotent — rows already matching their parent are left untouched;
+ * - conservative — when the parent org cannot be resolved (unregistered
+ *   entity id, hard-deleted parent, parent without an org column) the row is
+ *   counted as `unresolved` and left as-is rather than guessed at;
+ * - tenant-scoped — it reconciles every attachment in the tenant across all
+ *   organizations (the whole point is moving rows between orgs).
+ *
+ * Writes go through the passed `EntityManager` (which the caller runs inside a
+ * transaction) so the whole reconciliation commits atomically.
+ */
+export async function reconcileAttachmentOrganizations(opts: {
+  em: EntityManager
+  queryEngine: QueryEngine
+  tenantId: string
+  batchSize?: number
+}): Promise<AttachmentOrgReconcileReport> {
+  const { em, queryEngine, tenantId } = opts
+  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE
+  const report: AttachmentOrgReconcileReport = {
+    scanned: 0,
+    updated: 0,
+    unresolved: 0,
+    skippedVirtual: 0,
+    byEntity: {},
+  }
+
+  const rows = (await em.getConnection().execute(
+    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',
+    [tenantId],
+  )) as AttachmentScanRow[]
+  report.scanned = rows.length
+  if (!rows.length) return report
+
+  const groups = new Map<string, AttachmentScanRow[]>()
+  for (const row of rows) {
+    if (!row.id || !row.entity_id || !row.record_id) continue
+    const list = groups.get(row.entity_id) ?? []
+    list.push(row)
+    groups.set(row.entity_id, list)
+  }
+
+  const pendingUpdates: Array<{ id: string; organizationId: string }> = []
+
+  for (const [entityId, group] of groups) {
+    const bucket = ensureBucket(report, entityId)
+    bucket.scanned += group.length
+
+    if (entityId === LIBRARY_ENTITY_ID) {
+      report.skippedVirtual += group.length
+      continue
+    }
+
+    const recordIds = Array.from(
+      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),
+    )
+    const parentOrgByRecordId = new Map<string, string | null>()
+    let resolvable = true
+
+    for (let index = 0; index < recordIds.length; index += batchSize) {
+      const chunk = recordIds.slice(index, index + batchSize)
+      try {
+        const result = await queryEngine.query(entityId as any, {
+          fields: ['id', 'organization_id'],
+          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
+          tenantId,
+          withDeleted: true,
+          page: { pageSize: Math.max(chunk.length, 1) },
+        })
+        for (const item of result.items ?? []) {
+          const record = item as Record<string, unknown>
+          const recordId = record.id != null ? String(record.id) : null
+          if (!recordId) continue
+          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))
+        }
+      } catch (error) {
+        resolvable = false
+        logger.warn('org reconcile: cannot resolve parent organization for entity', {
+          entityId,
+          error,
+        })
+        break
+      }
+    }
+
+    if (!resolvable) {
+      bucket.unresolved += group.length
+      report.unresolved += group.length
+      continue
+    }
+
+    for (const row of group) {
+      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null
+      if (!target) {
+        bucket.unresolved += 1
+        report.unresolved += 1
+        continue
+      }
+      if ((row.organization_id ?? null) === target) continue
+      pendingUpdates.push({ id: row.id, organizationId: target })
+      bucket.updated += 1
+      report.updated += 1
+    }
+  }
+
+  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
+    const chunk = pendingUpdates.slice(index, index + batchSize)
+    for (const update of chunk) {
+      const reference = em.getReference(Attachment, update.id)
+      reference.organizationId = update.organizationId
+    }
+    await em.flush()
+  }
+
+  return report
+}

package/src/modules/attachments/lib/requestScope.ts

@@ -0,0 +1,27 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+/**
+ * Resolve the organization an attachment request should act within.
+ *
+ * `auth.orgId` alone is NOT selected-organization aware for non-superadmin
+ * principals: `applySuperAdminScope` only rewrites `orgId` from the
+ * `om_selected_org` cookie for superadmins, so a regular multi-org admin who
+ * switches the header organization keeps `auth.orgId` pinned to their own home
+ * organization. The CRUD factory and other org-scoped routes derive the active
+ * organization via `resolveOrganizationScopeForRequest` (cookie-driven and
+ * RBAC-validated for ALL users, falling back to the home org when the selection
+ * is absent or inaccessible). Attachments must do the same so uploaded files
+ * land under — and are read back from — the currently selected organization
+ * rather than the uploader's home organization (#3765).
+ */
+export async function resolveAttachmentOrganizationId(
+  container: AwilixContainer,
+  auth: AuthContext,
+  request: Request,
+): Promise<string | null> {
+  if (!auth) return null
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+  return scope?.selectedId ?? auth.orgId ?? null
+}

package/src/modules/auth/api/users/route.ts

@@ -22,6 +22,7 @@ import {
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
@@ -41,6 +42,7 @@ const querySchema = z.object({
   search: z.string().optional(),
   name: z.string().optional(),
   organizationId: z.string().uuid().optional(),
+  scopeToActiveOrganization: z.boolean().optional(),
   roleIds: z.array(z.string().uuid()).optional(),
 }).passthrough()
 
@@ -180,6 +182,7 @@ export async function GET(req: Request) {
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
+    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),
     roleIds: rawRoleIds.length ? rawRoleIds : undefined,
   })
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
@@ -195,7 +198,7 @@ export async function GET(req: Request) {
   } catch (err) {
     logger.error('Failed to resolve rbac', { err })
   }
-  const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
+  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -244,6 +247,12 @@ export async function GET(req: Request) {
     ? effectiveSelectedOrganizationId
     : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
+  // Recipient/assignee pickers scope to the caller's active organization so they never
+  // suggest users outside it. A message composed here is stamped with the caller's
+  // active org (auth.orgId), and the message detail endpoint enforces
+  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the
+  // suggestions to the same org keeps a picked recipient able to open what they were sent.
+  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
     const searchPattern = `%${escapeLikePattern(trimmedName)}%`
@@ -620,7 +629,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/cli.ts

@@ -9,6 +9,7 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
@@ -71,7 +72,7 @@ const addUser: ModuleCli = {
     })
     await em.persist(u).flush()
     if (rolesCsv) {
-      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
+      const names = parseCommaSeparatedList(rolesCsv)
       for (const name of names) {
         const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
@@ -493,7 +494,7 @@ const setupApp: ModuleCli = {
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
     const roleNames = rolesCsv
-      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)
+      ? parseCommaSeparatedList(rolesCsv)
       : undefined
 
     try {

package/src/modules/configs/i18n/de.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup-Drosselfenster",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatisch Query-Index-Neuindizierungsaufträge bei Lücken planen.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatische Neuindizierung",
-  "configs.systemStatus.viewDocs": "Dokumentation anzeigen"
+  "configs.systemStatus.viewDocs": "Dokumentation anzeigen",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Anhang-Organisationen abgleichen",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Anhang-Organisationen werden abgeglichen…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} behebt Anhänge, die unter der falschen Organisation gespeichert wurden. Führen Sie den Abgleich aus, um vorhandene Anhänge in die Organisation des zugehörigen Datensatzes zu verschieben.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Anhang-Organisationen abgeglichen."
 }

package/src/modules/configs/i18n/en.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup throttle window",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatically schedule query index reindex jobs when gaps appear.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Auto reindex",
-  "configs.systemStatus.viewDocs": "View documentation"
+  "configs.systemStatus.viewDocs": "View documentation",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconcile attachment organizations",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciling attachment organizations…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} fixes attachments that were saved under the wrong organization. Run the reconciliation to move existing attachments to the organization of the record they belong to.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Attachment organizations reconciled."
 }

package/src/modules/configs/i18n/es.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Ventana de limitación del calentamiento",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Programar automáticamente trabajos de reindexación cuando se detecten brechas.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Reindexación automática",
-  "configs.systemStatus.viewDocs": "Ver documentación"
+  "configs.systemStatus.viewDocs": "Ver documentación",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconciliar organizaciones de adjuntos",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciliando organizaciones de adjuntos…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "La versión {{version}} corrige los adjuntos guardados en la organización incorrecta. Ejecuta la reconciliación para mover los adjuntos existentes a la organización del registro al que pertenecen.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizaciones de adjuntos reconciliadas."
 }

package/src/modules/configs/i18n/pl.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Okno throttlingu rozgrzewki",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatycznie uruchamia przebudowę indeksu zapytań, gdy wykryte zostaną luki.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatyczna przebudowa indeksu",
-  "configs.systemStatus.viewDocs": "Zobacz dokumentację"
+  "configs.systemStatus.viewDocs": "Zobacz dokumentację",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Uzgodnij organizacje załączników",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Uzgadnianie organizacji załączników…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Wersja {{version}} naprawia załączniki zapisane pod niewłaściwą organizacją. Uruchom uzgadnianie, aby przenieść istniejące załączniki do organizacji rekordu, do którego należą.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizacje załączników zostały uzgodnione."
 }

package/src/modules/configs/lib/upgrade-actions.ts

@@ -1,6 +1,11 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import * as semver from 'semver'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'
+
+const logger = createLogger('configs').child({ component: 'upgrade-actions' })
 
 export type UpgradeActionContext = {
   tenantId: string
@@ -38,6 +43,25 @@ export function compareVersions(a: string, b: string): number {
 }
 
 export const upgradeActions: UpgradeActionDefinition[] = [
+  {
+    id: 'attachments.reconcile-organization',
+    version: '0.6.6',
+    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',
+    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',
+    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',
+    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',
+    async run({ container, em, tenantId }) {
+      const queryEngine = container.resolve('queryEngine') as QueryEngine
+      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })
+      logger.info('attachments organization reconcile completed', {
+        tenantId,
+        scanned: report.scanned,
+        updated: report.updated,
+        unresolved: report.unresolved,
+        skippedVirtual: report.skippedVirtual,
+      })
+    },
+  },
   {
     id: 'customers.seed-interaction-statuses',
     version: '0.6.5',

package/src/modules/dashboards/cli.ts

@@ -6,6 +6,7 @@ import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { seedAnalyticsData } from './seed/analytics'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 type Args = Record<string, string>
 
@@ -108,10 +109,7 @@ const seedDefaults: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to seed.')
@@ -125,7 +123,7 @@ const seedDefaults: ModuleCli = {
       tenantId,
       organizationId,
       roleNames,
-      widgetIds: widgetCsv ? widgetCsv.split(',').map((id) => id.trim()).filter(Boolean) : undefined,
+      widgetIds: widgetCsv ? parseCommaSeparatedList(widgetCsv) : undefined,
       logger: (message) => console.log(message),
     })
   },
@@ -143,10 +141,7 @@ const enableAnalyticsWidgets: ModuleCli = {
       return
     }
 
-    const roleNames = roleCsv
-      .split(',')
-      .map((name) => name.trim())
-      .filter(Boolean)
+    const roleNames = parseCommaSeparatedList(roleCsv)
 
     if (!roleNames.length) {
       console.log('No roles provided, nothing to update.')

package/src/modules/directory/utils/organizationScope.ts

@@ -18,6 +18,13 @@ export type OrganizationScope = {
   filterIds: string[] | null
   allowedIds: string[] | null
   tenantId: string | null
+  // True when the caller explicitly selected a concrete organization (cookie /
+  // selectedId param) that could not be honored — it does not exist for the
+  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
+  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
+  // this so a record never lands under an org the caller did not intend. Absent
+  // (undefined) means the selection — if any — was honored.
+  selectionRejected?: boolean
 }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
@@ -79,7 +86,8 @@ function isValidCachedScope(value: unknown): value is OrganizationScope {
   const record = value as Partial<OrganizationScope>
   const idOk = (v: unknown) => v === null || typeof v === 'string'
   const arrOk = (v: unknown) => v === null || (Array.isArray(v) && v.every((entry) => typeof entry === 'string'))
-  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds)
+  const flagOk = record.selectionRejected === undefined || typeof record.selectionRejected === 'boolean'
+  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds) && flagOk
 }
 
 function resolveCacheFromContainer(container: AwilixContainer | null | undefined): CacheStrategy | null {
@@ -320,9 +328,18 @@ export async function resolveOrganizationScope({
   const initialSelected =
     normalizedSelectedId
     ?? (widenToAllOrgs ? null : accountOrgId ?? null)
+  // A selection is only honored when it resolves to a real, non-deleted org for
+  // this tenant. `orgDescendants` holds exactly the existing orgs among the
+  // candidate ids, so a stale/dead id (e.g. a selected-org cookie or JWT org
+  // that no longer resolves after a DB reset) has no entry and is dropped here.
+  // Without the existence guard an unrestricted (all-orgs) principal — whose
+  // `allowedSet` is null — would accept the dead id as `effectiveSelected`, and
+  // writes derived from `selectedId` would land under an org the read scope
+  // (`filterIds`) never filters to, silently orphaning the record.
+  const selectionResolvesToOrg = (id: string): boolean => orgDescendants.has(id)
   let effectiveSelected: string | null = null
   if (initialSelected) {
-    if (allowedSet === null || allowedSet.has(initialSelected)) {
+    if ((allowedSet === null || allowedSet.has(initialSelected)) && selectionResolvesToOrg(initialSelected)) {
       effectiveSelected = initialSelected
     }
   }
@@ -336,6 +353,13 @@ export async function resolveOrganizationScope({
     filterSet = null
   } else if (auth.orgId) {
     filterSet = loadFallbackSet()
+    // Keep the write target (`selectedId`) aligned with the read scope
+    // (`filterIds`): when an unrestricted principal's requested selection was
+    // dropped above, fall the selection back to the account org too so a record
+    // created here is always readable back by the same caller.
+    if (!effectiveSelected && fallbackOrgId && filterSet && filterSet.size > 0) {
+      effectiveSelected = fallbackOrgId
+    }
   }
 
   if ((!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {
@@ -348,11 +372,21 @@ export async function resolveOrganizationScope({
     }
   }
 
+  // A concrete organization was explicitly requested (`normalizedSelectedId` is
+  // null for both "no selection" and the "all organizations" token) but the
+  // resolver could not honor it — it was dropped as non-existent/inaccessible
+  // and the effective selection fell back to something else. Surface this so the
+  // write layer can reject the request instead of silently creating the record
+  // under the fallback org. Only set the field when true to keep the scope shape
+  // unchanged for the common (honored) case.
+  const selectionRejected = normalizedSelectedId !== null && effectiveSelected !== normalizedSelectedId
+
   return {
     selectedId: effectiveSelected,
     filterIds: filterSet ? Array.from(filterSet) : null,
     allowedIds: allowedSet ? Array.from(allowedSet) : null,
     tenantId,
+    ...(selectionRejected ? { selectionRejected: true } : {}),
   }
 }
 

package/src/modules/entities/api/records.ts

@@ -8,6 +8,7 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'
 import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { setRecordCustomFields } from '../lib/helpers'
 import { CustomFieldValue } from '../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -151,10 +152,7 @@ export async function GET(req: Request) {
   const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'
   const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)
   const searchTerm = (url.searchParams.get('search') || '').trim()
-  const searchFields = (url.searchParams.get('searchFields') || '')
-    .split(',')
-    .map((field) => field.trim())
-    .filter(Boolean)
+  const searchFields = parseCommaSeparatedList(url.searchParams.get('searchFields'))
 
   const qpEntries: Array<[string, string]> = []
   for (const [key, val] of url.searchParams.entries()) {
@@ -211,11 +209,11 @@ export async function GET(req: Request) {
       if (key.startsWith('cf_')) {
         if (key.endsWith('In')) {
           const base = key.slice(0, -2)
-          const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+          const values = parseCommaSeparatedList(val)
           ;(filtersObj as any)[base] = { $in: values }
         } else {
           if (val.includes(',')) {
-            const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+            const values = parseCommaSeparatedList(val)
             ;(filtersObj as any)[key] = { $in: values }
           } else {
             const parsed = parseBooleanToken(val)
@@ -224,7 +222,7 @@ export async function GET(req: Request) {
         }
       } else if (allowAnyKey) {
         if (val.includes(',')) {
-          const values = val.split(',').map((s) => s.trim()).filter(Boolean)
+          const values = parseCommaSeparatedList(val)
           ;(filtersObj as any)[key] = { $in: values }
         } else {
           const parsed = parseBooleanToken(val)

package/src/modules/entities/cli.ts

@@ -10,6 +10,7 @@ import readline from 'node:readline/promises'
 import { stdin as input, stdout as output } from 'node:process'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { createKmsService, type KmsService, type TenantDek } from '@open-mercato/shared/lib/encryption/kms'
 import {
   decryptWithAesGcm,
@@ -193,7 +194,7 @@ const addField: ModuleCli = {
       let options: string[] | undefined
       if (kind === 'select') {
         const raw = (args.options as string) || await ask('Options (comma-separated)', 'low,medium,high')
-        options = raw.split(',').map((s) => s.trim()).filter(Boolean)
+        options = parseCommaSeparatedList(raw)
       }
       let defaultValue: any = undefined
       const defRaw = (args.default as string) ?? (args.defaultValue as string)