@open-mercato/core 0.6.6 → 0.6.7-develop.6552.1.5208a19369

package/src/modules/attachments/api/route.ts

@@ -13,6 +13,7 @@ import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
 import { assertAttachmentScopeInvariant } from '../lib/access'
+import { resolveAttachmentOrganizationId } from '../lib/requestScope'
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -198,10 +199,11 @@ export async function GET(req: Request) {
   }
   const { entityId, recordId, page, pageSize } = parsedQuery.data
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }
-  if (auth.orgId) filter.organizationId = auth.orgId
+  if (orgId) filter.organizationId = orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
   const total = usePaging ? await em.count(Attachment, filter) : null
@@ -224,7 +226,7 @@ export async function GET(req: Request) {
     },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: auth.orgId ?? null,
+      organizationId: orgId ?? null,
     },
   )
   return NextResponse.json({
@@ -275,7 +277,6 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
   const tenantId = auth.tenantId
-  const orgId = auth.orgId
 
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
@@ -301,11 +302,13 @@ export async function POST(req: Request) {
   const tags = parseFormTags(form.get('tags'))
   const assignmentsFromForm = parseFormAssignments(form.get('assignments'))
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
@@ -436,12 +439,12 @@ export async function POST(req: Request) {
   }
   const metadata = mergeAttachmentMetadata(null, { assignments, tags })
   const attachmentId = randomUUID()
-  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,
     recordId,
-    organizationId: auth.orgId!,
+    organizationId: orgId,
     tenantId: auth.tenantId!,
     fileName: safeName,
     mimeType: fileMimeType,
@@ -545,17 +548,19 @@ export async function DELETE(req: Request) {
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
-  // organizations" selected has no concrete org, so scope the delete by tenant
-  // only and let them remove any attachment in the tenant. Non-superadmins stay
-  // scoped to their own organization (#3764).
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  // Resolve the currently selected organization (#3765) so a multi-org admin who
+  // switched the header org deletes within that org, not their pinned home org.
+  // A superadmin browsing with "All organizations" selected has no concrete org,
+  // so resolution returns null and the delete falls back to a tenant-only scope
+  // (#3764) — letting them remove any attachment in the tenant.
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
-  if (auth.orgId) deleteFilter.organizationId = auth.orgId
+  if (orgId) deleteFilter.organizationId = orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -565,7 +570,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? auth.orgId ?? '',
+      organizationId: record.organizationId ?? orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/attachments/components/AttachmentContentPreview.tsx

@@ -1,6 +1,7 @@
 import * as React from 'react'
 import { MarkdownContent } from '@open-mercato/ui/backend/markdown'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 type Props = {
   content?: string | null
@@ -25,12 +26,6 @@ export function AttachmentContentPreview({
   const [tab, setTab] = React.useState<'source' | 'preview'>('source')
   const text = (content ?? '').trim()
 
-  // ARIA IDs for accessibility
-  const sourceTabId = 'attachment-content-preview-tab-source'
-  const previewTabId = 'attachment-content-preview-tab-preview'
-  const sourcePanelId = 'attachment-content-preview-panel-source'
-  const previewPanelId = 'attachment-content-preview-panel-preview'
-
   if (!text) {
     return <div className="text-xs text-muted-foreground italic">{emptyLabel}</div>
   }
@@ -41,47 +36,18 @@ export function AttachmentContentPreview({
   return (
     <div className="space-y-2">
       {/* Tab Navigation */}
-      <div className="border-b border-border">
-        <nav className="flex items-center gap-4 text-xs" role="tablist" aria-label="Content preview mode">
-          <button
-            type="button"
-            id={sourceTabId}
-            role="tab"
-            aria-selected={tab === 'source'}
-            aria-controls={sourcePanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'source'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('source')}
-          >
-            {sourceLabel}
-          </button>
-          <button
-            type="button"
-            id={previewTabId}
-            role="tab"
-            aria-selected={tab === 'preview'}
-            aria-controls={previewPanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'preview'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('preview')}
-          >
-            {previewLabel}
-          </button>
-        </nav>
-      </div>
+      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant="underline">
+        <TabsList className="w-full">
+          <TabsTrigger value="source">{sourceLabel}</TabsTrigger>
+          <TabsTrigger value="preview">{previewLabel}</TabsTrigger>
+        </TabsList>
+      </Tabs>
 
       {/* Tab Panels */}
       {tab === 'source' ? (
         <div
           role="tabpanel"
-          id={sourcePanelId}
-          aria-labelledby={sourceTabId}
+          aria-label={sourceLabel}
           data-testid="attachment-content-preview"
           className="whitespace-pre-wrap text-sm text-muted-foreground"
         >
@@ -90,8 +56,7 @@ export function AttachmentContentPreview({
       ) : (
         <div
           role="tabpanel"
-          id={previewPanelId}
-          aria-labelledby={previewTabId}
+          aria-label={previewLabel}
           data-testid="markdown-preview"
         >
           <MarkdownContent

package/src/modules/attachments/lib/reconcileOrganization.ts

@@ -0,0 +1,188 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { Attachment } from '../data/entities'
+
+const logger = createLogger('attachments').child({ component: 'reconcileOrganization' })
+
+/**
+ * Virtual entity id for library attachments — these are not attached to a
+ * parent record that owns an organization, so there is nothing to reconcile
+ * against. They are counted as skipped rather than unresolved.
+ */
+const LIBRARY_ENTITY_ID = 'attachments:library'
+
+const DEFAULT_BATCH_SIZE = 500
+
+export type AttachmentOrgReconcileEntityStat = {
+  scanned: number
+  updated: number
+  unresolved: number
+}
+
+export type AttachmentOrgReconcileReport = {
+  scanned: number
+  updated: number
+  unresolved: number
+  skippedVirtual: number
+  byEntity: Record<string, AttachmentOrgReconcileEntityStat>
+}
+
+type AttachmentScanRow = {
+  id: string
+  entity_id: string | null
+  record_id: string | null
+  organization_id: string | null
+}
+
+function readParentOrganizationId(record: Record<string, unknown>): string | null {
+  const raw = record['organization_id'] ?? record['organizationId']
+  if (typeof raw === 'string' && raw.trim().length) return raw.trim()
+  return null
+}
+
+function ensureBucket(
+  report: AttachmentOrgReconcileReport,
+  entityId: string,
+): AttachmentOrgReconcileEntityStat {
+  const existing = report.byEntity[entityId]
+  if (existing) return existing
+  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }
+  report.byEntity[entityId] = bucket
+  return bucket
+}
+
+/**
+ * Reconcile the `organization_id` of existing attachments to the organization
+ * of the record they are attached to.
+ *
+ * Background (#3765): before the upload route became selected-organization
+ * aware, a multi-org admin who switched the header organization uploaded files
+ * that were silently stored under their *home* organization instead of the
+ * selected one (the organization of the parent record). Those rows are now
+ * invisible to org-scoped reads and stay orphaned. This heals them forward.
+ *
+ * The parent record's organization is the ground truth: an attachment is not
+ * distinguishable from a legitimately home-org one by looking at the attachment
+ * alone. Parent organizations are resolved generically through the Query Engine
+ * by `entityId` (works for both base and custom entities, tenant-scoped and
+ * organization-agnostic so the parent's real org is returned regardless of
+ * which org the caller sits in) — the same mechanism the attachments module
+ * already uses to enrich assignment details.
+ *
+ * The reconciliation is:
+ * - idempotent — rows already matching their parent are left untouched;
+ * - conservative — when the parent org cannot be resolved (unregistered
+ *   entity id, hard-deleted parent, parent without an org column) the row is
+ *   counted as `unresolved` and left as-is rather than guessed at;
+ * - tenant-scoped — it reconciles every attachment in the tenant across all
+ *   organizations (the whole point is moving rows between orgs).
+ *
+ * Writes go through the passed `EntityManager` (which the caller runs inside a
+ * transaction) so the whole reconciliation commits atomically.
+ */
+export async function reconcileAttachmentOrganizations(opts: {
+  em: EntityManager
+  queryEngine: QueryEngine
+  tenantId: string
+  batchSize?: number
+}): Promise<AttachmentOrgReconcileReport> {
+  const { em, queryEngine, tenantId } = opts
+  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE
+  const report: AttachmentOrgReconcileReport = {
+    scanned: 0,
+    updated: 0,
+    unresolved: 0,
+    skippedVirtual: 0,
+    byEntity: {},
+  }
+
+  const rows = (await em.getConnection().execute(
+    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',
+    [tenantId],
+  )) as AttachmentScanRow[]
+  report.scanned = rows.length
+  if (!rows.length) return report
+
+  const groups = new Map<string, AttachmentScanRow[]>()
+  for (const row of rows) {
+    if (!row.id || !row.entity_id || !row.record_id) continue
+    const list = groups.get(row.entity_id) ?? []
+    list.push(row)
+    groups.set(row.entity_id, list)
+  }
+
+  const pendingUpdates: Array<{ id: string; organizationId: string }> = []
+
+  for (const [entityId, group] of groups) {
+    const bucket = ensureBucket(report, entityId)
+    bucket.scanned += group.length
+
+    if (entityId === LIBRARY_ENTITY_ID) {
+      report.skippedVirtual += group.length
+      continue
+    }
+
+    const recordIds = Array.from(
+      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),
+    )
+    const parentOrgByRecordId = new Map<string, string | null>()
+    let resolvable = true
+
+    for (let index = 0; index < recordIds.length; index += batchSize) {
+      const chunk = recordIds.slice(index, index + batchSize)
+      try {
+        const result = await queryEngine.query(entityId as any, {
+          fields: ['id', 'organization_id'],
+          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
+          tenantId,
+          withDeleted: true,
+          page: { pageSize: Math.max(chunk.length, 1) },
+        })
+        for (const item of result.items ?? []) {
+          const record = item as Record<string, unknown>
+          const recordId = record.id != null ? String(record.id) : null
+          if (!recordId) continue
+          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))
+        }
+      } catch (error) {
+        resolvable = false
+        logger.warn('org reconcile: cannot resolve parent organization for entity', {
+          entityId,
+          error,
+        })
+        break
+      }
+    }
+
+    if (!resolvable) {
+      bucket.unresolved += group.length
+      report.unresolved += group.length
+      continue
+    }
+
+    for (const row of group) {
+      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null
+      if (!target) {
+        bucket.unresolved += 1
+        report.unresolved += 1
+        continue
+      }
+      if ((row.organization_id ?? null) === target) continue
+      pendingUpdates.push({ id: row.id, organizationId: target })
+      bucket.updated += 1
+      report.updated += 1
+    }
+  }
+
+  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
+    const chunk = pendingUpdates.slice(index, index + batchSize)
+    for (const update of chunk) {
+      const reference = em.getReference(Attachment, update.id)
+      reference.organizationId = update.organizationId
+    }
+    await em.flush()
+  }
+
+  return report
+}

package/src/modules/attachments/lib/requestScope.ts

@@ -0,0 +1,27 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+/**
+ * Resolve the organization an attachment request should act within.
+ *
+ * `auth.orgId` alone is NOT selected-organization aware for non-superadmin
+ * principals: `applySuperAdminScope` only rewrites `orgId` from the
+ * `om_selected_org` cookie for superadmins, so a regular multi-org admin who
+ * switches the header organization keeps `auth.orgId` pinned to their own home
+ * organization. The CRUD factory and other org-scoped routes derive the active
+ * organization via `resolveOrganizationScopeForRequest` (cookie-driven and
+ * RBAC-validated for ALL users, falling back to the home org when the selection
+ * is absent or inaccessible). Attachments must do the same so uploaded files
+ * land under — and are read back from — the currently selected organization
+ * rather than the uploader's home organization (#3765).
+ */
+export async function resolveAttachmentOrganizationId(
+  container: AwilixContainer,
+  auth: AuthContext,
+  request: Request,
+): Promise<string | null> {
+  if (!auth) return null
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+  return scope?.selectedId ?? auth.orgId ?? null
+}

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -4,6 +4,7 @@ import React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { ActionLogItem } from '../../components/AuditLogsActions'
 import { AuditLogsActions } from '../../components/AuditLogsActions'
@@ -182,28 +183,17 @@ export default function AuditLogsPage() {
   return (
     <Page>
       <PageBody>
-        <div className="mb-6 border-b border-border">
-      <nav className="flex items-center gap-6 text-sm" role="tablist" aria-label={t('audit_logs.tabs.label')}>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'actions'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'actions' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('actions')}
-            >
-              {t('audit_logs.actions.title')}
-            </button>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'access'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'access' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('access')}
-            >
-              {t('audit_logs.access.title')}
-            </button>
-          </nav>
-        </div>
+        <Tabs
+          value={tab}
+          onValueChange={(value) => setTab(value as TabOption)}
+          variant="underline"
+          className="mb-6"
+        >
+          <TabsList className="w-full flex-wrap" aria-label={t('audit_logs.tabs.label')}>
+            <TabsTrigger value="actions">{t('audit_logs.actions.title')}</TabsTrigger>
+            <TabsTrigger value="access">{t('audit_logs.access.title')}</TabsTrigger>
+          </TabsList>
+        </Tabs>
 
         {error && <div className="mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text">{error}</div>}
 

package/src/modules/auth/api/autologin.ts

@@ -0,0 +1,100 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
+import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'
+import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
+import { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
+
+export const metadata = { requireAuth: false }
+
+const accessTokenMaxAgeSeconds = 60 * 60 * 8
+const logger = createLogger('auth').child({ component: 'autologin' })
+
+// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the
+// visitor in with those credentials and redirect into the app. Gated entirely
+// behind env vars — the homepage only routes here when they are set. On any
+// failure (feature off, bad credentials) it falls back to the manual login form
+// so a misconfigured demo can never loop.
+export async function GET(req: Request) {
+  const url = new URL(req.url)
+  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin
+  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')
+
+  const credentials = resolveAutoLoginCredentials()
+  if (!credentials) {
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  // Already signed in — go straight to the app instead of re-issuing a session.
+  const existing = await getAuthFromRequest(req)
+  if (existing) {
+    return buildSafeRedirectResponse(req, redirectTo)
+  }
+
+  const container = await createRequestContainer()
+  const auth = container.resolve<AuthService>('authService')
+
+  let user = null
+  if (credentials.tenantId) {
+    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)
+  } else {
+    const users = await auth.findUsersByEmail(credentials.email)
+    user = users.length === 1 ? users[0] : null
+  }
+
+  const ok = await auth.verifyPassword(user, credentials.password)
+  if (!user || !ok) {
+    // Misconfigured demo credentials — never loop; drop to the manual form.
+    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)
+  const roles = await auth.getUserRoles(user, resolvedTenantId)
+  await auth.updateLastLoginAt(user)
+  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)
+  const { session } = await auth.createSession(user, expiresAt)
+  const token = signJwt({
+    sub: String(user.id),
+    sid: String(session.id),
+    tenantId: resolvedTenantId,
+    orgId: user.organizationId ? String(user.organizationId) : null,
+    email: user.email,
+    roles,
+  })
+  void emitAuthEvent('auth.login.success', {
+    id: String(user.id),
+    email: user.email,
+    tenantId: resolvedTenantId,
+    organizationId: user.organizationId ? String(user.organizationId) : null,
+  }).catch(() => undefined)
+
+  const res = buildSafeRedirectResponse(req, redirectTo)
+  res.cookies.set('auth_token', token, {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: accessTokenMaxAgeSeconds,
+  })
+  return res
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Authentication & Accounts',
+  summary: 'Demo autologin',
+  methods: {
+    GET: {
+      summary: 'Auto sign-in using env-configured demo credentials',
+      description:
+        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',
+      responses: [
+        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },
+      ],
+    },
+  },
+}

package/src/modules/auth/api/users/route.ts

@@ -22,6 +22,7 @@ import {
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
@@ -41,6 +42,7 @@ const querySchema = z.object({
   search: z.string().optional(),
   name: z.string().optional(),
   organizationId: z.string().uuid().optional(),
+  scopeToActiveOrganization: z.boolean().optional(),
   roleIds: z.array(z.string().uuid()).optional(),
 }).passthrough()
 
@@ -180,6 +182,7 @@ export async function GET(req: Request) {
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
+    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),
     roleIds: rawRoleIds.length ? rawRoleIds : undefined,
   })
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
@@ -195,7 +198,7 @@ export async function GET(req: Request) {
   } catch (err) {
     logger.error('Failed to resolve rbac', { err })
   }
-  const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
+  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -244,6 +247,12 @@ export async function GET(req: Request) {
     ? effectiveSelectedOrganizationId
     : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
+  // Recipient/assignee pickers scope to the caller's active organization so they never
+  // suggest users outside it. A message composed here is stamped with the caller's
+  // active org (auth.orgId), and the message detail endpoint enforces
+  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the
+  // suggestions to the same org keeps a picked recipient able to open what they were sent.
+  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
     const searchPattern = `%${escapeLikePattern(trimmedName)}%`
@@ -620,7 +629,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/cli.ts

@@ -9,6 +9,7 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
@@ -71,7 +72,7 @@ const addUser: ModuleCli = {
     })
     await em.persist(u).flush()
     if (rolesCsv) {
-      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
+      const names = parseCommaSeparatedList(rolesCsv)
       for (const name of names) {
         const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
@@ -493,7 +494,7 @@ const setupApp: ModuleCli = {
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
     const roleNames = rolesCsv
-      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)
+      ? parseCommaSeparatedList(rolesCsv)
       : undefined
 
     try {