@open-mercato/core 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/generated/entity-fields-registry.ts

@@ -1225,6 +1225,18 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "value": "value"
     },
+    "gateway_session_initialization": {
+      "id": "id",
+      "operation_key": "operation_key",
+      "provider_key": "provider_key",
+      "claim_token": "claim_token",
+      "claimed_at": "claimed_at",
+      "gateway_transaction_id": "gateway_transaction_id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
     "gateway_transaction": {
       "id": "id",
       "payment_id": "payment_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6",
+  "version": "0.6.7-develop.6553.1.2ec7246e04",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6",
-    "@open-mercato/shared": "0.6.6",
-    "@open-mercato/ui": "0.6.6",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6553.1.2ec7246e04",
+    "@open-mercato/shared": "0.6.7-develop.6553.1.2ec7246e04",
+    "@open-mercato/ui": "0.6.7-develop.6553.1.2ec7246e04",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6",
-    "@open-mercato/shared": "0.6.6",
-    "@open-mercato/ui": "0.6.6",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6553.1.2ec7246e04",
+    "@open-mercato/shared": "0.6.7-develop.6553.1.2ec7246e04",
+    "@open-mercato/ui": "0.6.7-develop.6553.1.2ec7246e04",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",
@@ -285,5 +285,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/core"
-  }
+  },
+  "stableVersion": "0.6.6"
 }

package/src/modules/api_keys/api/keys/route.ts

@@ -13,6 +13,8 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'
+import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 type ApiKeyCrudCtx = CrudCtx & {
   __apiKeySecret?: { secret: string; prefix: string }
@@ -297,10 +299,15 @@ const crud = makeCrudRoute<
 
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
       const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null
-      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(organizationId)) {
-          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
-        }
+      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
+      if (
+        !isOrganizationAccessAllowed({
+          isSuperAdmin,
+          allowedOrganizationIds: allowedIds,
+          targetOrganizationId: organizationId,
+        })
+      ) {
+        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
       }
       scopedCtx.__apiKeyOrganizationId = organizationId ?? null
 
@@ -322,18 +329,34 @@ const crud = makeCrudRoute<
       const { translate } = await resolveTranslations()
       if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })
       const em = (ctx.container.resolve('em') as EntityManager)
-      const record = await em.findOne(ApiKey, { id, deletedAt: null })
-      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       const scopedCtx = ctx as ApiKeyCrudCtx
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
-      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
-        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })
-      }
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
-      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(record.organizationId)) {
-          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
-        }
+      const recordFilter: FilterQuery<ApiKey> = {
+        id,
+        tenantId: auth.tenantId,
+        deletedAt: null,
+      }
+      if (!isSuperAdmin && Array.isArray(allowedIds)) {
+        recordFilter.organizationId = { $in: allowedIds }
+      }
+      const record = await findOneWithDecryption(
+        em,
+        ApiKey,
+        recordFilter,
+        undefined,
+        { tenantId: auth.tenantId, organizationId: null },
+      )
+      if (
+        !record ||
+        record.tenantId !== auth.tenantId ||
+        !isOrganizationAccessAllowed({
+          isSuperAdmin,
+          allowedOrganizationIds: allowedIds,
+          targetOrganizationId: record.organizationId ?? null,
+        })
+      ) {
+        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null
     },

package/src/modules/api_keys/cli.ts

@@ -3,6 +3,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createApiKey } from './services/apiKeyService'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 function parseArgs(rest: string[]): Record<string, string> {
   const args: Record<string, string> = {}
@@ -47,9 +48,7 @@ const addApiKey: ModuleCli = {
       return
     }
 
-    const roleInputs = rolesCsv
-      ? rolesCsv.split(',').map((value) => value.trim()).filter(Boolean)
-      : []
+    const roleInputs = parseCommaSeparatedList(rolesCsv)
     const roleIds: string[] = []
     if (roleInputs.length) {
       for (const token of roleInputs) {

package/src/modules/attachments/api/file/[id]/route.ts

@@ -15,6 +15,7 @@ import {
   canRenderInlineAttachment,
 } from "@open-mercato/core/modules/attachments/lib/security";
 import { StorageDriverFactory } from '../../../lib/drivers';
+import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope';
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -32,16 +33,19 @@ export async function GET(
     );
   }
   const auth = await getAuthFromRequest(req);
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em") as EntityManager;
+  const container = await createRequestContainer();
+  const em = container.resolve("em") as EntityManager;
   const storageDriverFactory =
-    (resolve("storageDriverFactory") as StorageDriverFactory | null) ??
+    (container.resolve("storageDriverFactory") as StorageDriverFactory | null) ??
     new StorageDriverFactory(em);
 
+  const scopedAuth = auth
+    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
+    : auth;
   const findFilter: Record<string, unknown> = { id };
-  if (auth && !isSuperAdminAuth(auth)) {
-    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
-    if (auth.orgId) findFilter.organizationId = auth.orgId;
+  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
+    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;
+    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;
   }
   const attachment = await em.findOne(Attachment, findFilter);
   if (!attachment) {
@@ -60,7 +64,7 @@ export async function GET(
     );
   }
 
-  const access = checkAttachmentAccess(auth, attachment, partition);
+  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
   if (!access.ok) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -20,6 +20,7 @@ import {
   validateImageMagicBytes,
 } from '@open-mercato/core/modules/attachments/lib/imageSafety'
 import { StorageDriverFactory } from '../../../../lib/drivers'
+import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('attachments').child({ component: 'image' })
@@ -51,15 +52,18 @@ export async function GET(
   }
   const { width, height, cropType } = parsedQuery.data
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
 
+  const scopedAuth = auth
+    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
+    : auth
   const findFilter: Record<string, unknown> = { id }
-  if (auth && !isSuperAdminAuth(auth)) {
-    if (auth.tenantId) findFilter.tenantId = auth.tenantId
-    if (auth.orgId) findFilter.organizationId = auth.orgId
+  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
+    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId
+    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId
   }
   const attachment = await em.findOne(Attachment, findFilter)
   if (!attachment) {
@@ -72,7 +76,7 @@ export async function GET(
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
-  const access = checkAttachmentAccess(auth, attachment, partition)
+  const access = checkAttachmentAccess(scopedAuth, attachment, partition)
   if (!access.ok) {
     const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'
     return NextResponse.json({ error: message }, { status: access.status })

package/src/modules/attachments/api/route.ts

@@ -13,6 +13,7 @@ import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
 import { assertAttachmentScopeInvariant } from '../lib/access'
+import { resolveAttachmentOrganizationId } from '../lib/requestScope'
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -198,10 +199,11 @@ export async function GET(req: Request) {
   }
   const { entityId, recordId, page, pageSize } = parsedQuery.data
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }
-  if (auth.orgId) filter.organizationId = auth.orgId
+  if (orgId) filter.organizationId = orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
   const total = usePaging ? await em.count(Attachment, filter) : null
@@ -224,7 +226,7 @@ export async function GET(req: Request) {
     },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: auth.orgId ?? null,
+      organizationId: orgId ?? null,
     },
   )
   return NextResponse.json({
@@ -275,7 +277,6 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
   const tenantId = auth.tenantId
-  const orgId = auth.orgId
 
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
@@ -301,11 +302,13 @@ export async function POST(req: Request) {
   const tags = parseFormTags(form.get('tags'))
   const assignmentsFromForm = parseFormAssignments(form.get('assignments'))
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
@@ -436,12 +439,12 @@ export async function POST(req: Request) {
   }
   const metadata = mergeAttachmentMetadata(null, { assignments, tags })
   const attachmentId = randomUUID()
-  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,
     recordId,
-    organizationId: auth.orgId!,
+    organizationId: orgId,
     tenantId: auth.tenantId!,
     fileName: safeName,
     mimeType: fileMimeType,
@@ -545,17 +548,19 @@ export async function DELETE(req: Request) {
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
-  // organizations" selected has no concrete org, so scope the delete by tenant
-  // only and let them remove any attachment in the tenant. Non-superadmins stay
-  // scoped to their own organization (#3764).
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  // Resolve the currently selected organization (#3765) so a multi-org admin who
+  // switched the header org deletes within that org, not their pinned home org.
+  // A superadmin browsing with "All organizations" selected has no concrete org,
+  // so resolution returns null and the delete falls back to a tenant-only scope
+  // (#3764) — letting them remove any attachment in the tenant.
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
-  if (auth.orgId) deleteFilter.organizationId = auth.orgId
+  if (orgId) deleteFilter.organizationId = orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -565,7 +570,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? auth.orgId ?? '',
+      organizationId: record.organizationId ?? orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/attachments/components/AttachmentContentPreview.tsx

@@ -1,6 +1,7 @@
 import * as React from 'react'
 import { MarkdownContent } from '@open-mercato/ui/backend/markdown'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 type Props = {
   content?: string | null
@@ -25,12 +26,6 @@ export function AttachmentContentPreview({
   const [tab, setTab] = React.useState<'source' | 'preview'>('source')
   const text = (content ?? '').trim()
 
-  // ARIA IDs for accessibility
-  const sourceTabId = 'attachment-content-preview-tab-source'
-  const previewTabId = 'attachment-content-preview-tab-preview'
-  const sourcePanelId = 'attachment-content-preview-panel-source'
-  const previewPanelId = 'attachment-content-preview-panel-preview'
-
   if (!text) {
     return <div className="text-xs text-muted-foreground italic">{emptyLabel}</div>
   }
@@ -41,47 +36,18 @@ export function AttachmentContentPreview({
   return (
     <div className="space-y-2">
       {/* Tab Navigation */}
-      <div className="border-b border-border">
-        <nav className="flex items-center gap-4 text-xs" role="tablist" aria-label="Content preview mode">
-          <button
-            type="button"
-            id={sourceTabId}
-            role="tab"
-            aria-selected={tab === 'source'}
-            aria-controls={sourcePanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'source'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('source')}
-          >
-            {sourceLabel}
-          </button>
-          <button
-            type="button"
-            id={previewTabId}
-            role="tab"
-            aria-selected={tab === 'preview'}
-            aria-controls={previewPanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'preview'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('preview')}
-          >
-            {previewLabel}
-          </button>
-        </nav>
-      </div>
+      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant="underline">
+        <TabsList className="w-full">
+          <TabsTrigger value="source">{sourceLabel}</TabsTrigger>
+          <TabsTrigger value="preview">{previewLabel}</TabsTrigger>
+        </TabsList>
+      </Tabs>
 
       {/* Tab Panels */}
       {tab === 'source' ? (
         <div
           role="tabpanel"
-          id={sourcePanelId}
-          aria-labelledby={sourceTabId}
+          aria-label={sourceLabel}
           data-testid="attachment-content-preview"
           className="whitespace-pre-wrap text-sm text-muted-foreground"
         >
@@ -90,8 +56,7 @@ export function AttachmentContentPreview({
       ) : (
         <div
           role="tabpanel"
-          id={previewPanelId}
-          aria-labelledby={previewTabId}
+          aria-label={previewLabel}
           data-testid="markdown-preview"
         >
           <MarkdownContent

package/src/modules/attachments/lib/reconcileOrganization.ts

@@ -0,0 +1,188 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { Attachment } from '../data/entities'
+
+const logger = createLogger('attachments').child({ component: 'reconcileOrganization' })
+
+/**
+ * Virtual entity id for library attachments — these are not attached to a
+ * parent record that owns an organization, so there is nothing to reconcile
+ * against. They are counted as skipped rather than unresolved.
+ */
+const LIBRARY_ENTITY_ID = 'attachments:library'
+
+const DEFAULT_BATCH_SIZE = 500
+
+export type AttachmentOrgReconcileEntityStat = {
+  scanned: number
+  updated: number
+  unresolved: number
+}
+
+export type AttachmentOrgReconcileReport = {
+  scanned: number
+  updated: number
+  unresolved: number
+  skippedVirtual: number
+  byEntity: Record<string, AttachmentOrgReconcileEntityStat>
+}
+
+type AttachmentScanRow = {
+  id: string
+  entity_id: string | null
+  record_id: string | null
+  organization_id: string | null
+}
+
+function readParentOrganizationId(record: Record<string, unknown>): string | null {
+  const raw = record['organization_id'] ?? record['organizationId']
+  if (typeof raw === 'string' && raw.trim().length) return raw.trim()
+  return null
+}
+
+function ensureBucket(
+  report: AttachmentOrgReconcileReport,
+  entityId: string,
+): AttachmentOrgReconcileEntityStat {
+  const existing = report.byEntity[entityId]
+  if (existing) return existing
+  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }
+  report.byEntity[entityId] = bucket
+  return bucket
+}
+
+/**
+ * Reconcile the `organization_id` of existing attachments to the organization
+ * of the record they are attached to.
+ *
+ * Background (#3765): before the upload route became selected-organization
+ * aware, a multi-org admin who switched the header organization uploaded files
+ * that were silently stored under their *home* organization instead of the
+ * selected one (the organization of the parent record). Those rows are now
+ * invisible to org-scoped reads and stay orphaned. This heals them forward.
+ *
+ * The parent record's organization is the ground truth: an attachment is not
+ * distinguishable from a legitimately home-org one by looking at the attachment
+ * alone. Parent organizations are resolved generically through the Query Engine
+ * by `entityId` (works for both base and custom entities, tenant-scoped and
+ * organization-agnostic so the parent's real org is returned regardless of
+ * which org the caller sits in) — the same mechanism the attachments module
+ * already uses to enrich assignment details.
+ *
+ * The reconciliation is:
+ * - idempotent — rows already matching their parent are left untouched;
+ * - conservative — when the parent org cannot be resolved (unregistered
+ *   entity id, hard-deleted parent, parent without an org column) the row is
+ *   counted as `unresolved` and left as-is rather than guessed at;
+ * - tenant-scoped — it reconciles every attachment in the tenant across all
+ *   organizations (the whole point is moving rows between orgs).
+ *
+ * Writes go through the passed `EntityManager` (which the caller runs inside a
+ * transaction) so the whole reconciliation commits atomically.
+ */
+export async function reconcileAttachmentOrganizations(opts: {
+  em: EntityManager
+  queryEngine: QueryEngine
+  tenantId: string
+  batchSize?: number
+}): Promise<AttachmentOrgReconcileReport> {
+  const { em, queryEngine, tenantId } = opts
+  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE
+  const report: AttachmentOrgReconcileReport = {
+    scanned: 0,
+    updated: 0,
+    unresolved: 0,
+    skippedVirtual: 0,
+    byEntity: {},
+  }
+
+  const rows = (await em.getConnection().execute(
+    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',
+    [tenantId],
+  )) as AttachmentScanRow[]
+  report.scanned = rows.length
+  if (!rows.length) return report
+
+  const groups = new Map<string, AttachmentScanRow[]>()
+  for (const row of rows) {
+    if (!row.id || !row.entity_id || !row.record_id) continue
+    const list = groups.get(row.entity_id) ?? []
+    list.push(row)
+    groups.set(row.entity_id, list)
+  }
+
+  const pendingUpdates: Array<{ id: string; organizationId: string }> = []
+
+  for (const [entityId, group] of groups) {
+    const bucket = ensureBucket(report, entityId)
+    bucket.scanned += group.length
+
+    if (entityId === LIBRARY_ENTITY_ID) {
+      report.skippedVirtual += group.length
+      continue
+    }
+
+    const recordIds = Array.from(
+      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),
+    )
+    const parentOrgByRecordId = new Map<string, string | null>()
+    let resolvable = true
+
+    for (let index = 0; index < recordIds.length; index += batchSize) {
+      const chunk = recordIds.slice(index, index + batchSize)
+      try {
+        const result = await queryEngine.query(entityId as any, {
+          fields: ['id', 'organization_id'],
+          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
+          tenantId,
+          withDeleted: true,
+          page: { pageSize: Math.max(chunk.length, 1) },
+        })
+        for (const item of result.items ?? []) {
+          const record = item as Record<string, unknown>
+          const recordId = record.id != null ? String(record.id) : null
+          if (!recordId) continue
+          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))
+        }
+      } catch (error) {
+        resolvable = false
+        logger.warn('org reconcile: cannot resolve parent organization for entity', {
+          entityId,
+          error,
+        })
+        break
+      }
+    }
+
+    if (!resolvable) {
+      bucket.unresolved += group.length
+      report.unresolved += group.length
+      continue
+    }
+
+    for (const row of group) {
+      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null
+      if (!target) {
+        bucket.unresolved += 1
+        report.unresolved += 1
+        continue
+      }
+      if ((row.organization_id ?? null) === target) continue
+      pendingUpdates.push({ id: row.id, organizationId: target })
+      bucket.updated += 1
+      report.updated += 1
+    }
+  }
+
+  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
+    const chunk = pendingUpdates.slice(index, index + batchSize)
+    for (const update of chunk) {
+      const reference = em.getReference(Attachment, update.id)
+      reference.organizationId = update.organizationId
+    }
+    await em.flush()
+  }
+
+  return report
+}

package/src/modules/attachments/lib/requestScope.ts

@@ -0,0 +1,27 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+/**
+ * Resolve the organization an attachment request should act within.
+ *
+ * `auth.orgId` alone is NOT selected-organization aware for non-superadmin
+ * principals: `applySuperAdminScope` only rewrites `orgId` from the
+ * `om_selected_org` cookie for superadmins, so a regular multi-org admin who
+ * switches the header organization keeps `auth.orgId` pinned to their own home
+ * organization. The CRUD factory and other org-scoped routes derive the active
+ * organization via `resolveOrganizationScopeForRequest` (cookie-driven and
+ * RBAC-validated for ALL users, falling back to the home org when the selection
+ * is absent or inaccessible). Attachments must do the same so uploaded files
+ * land under — and are read back from — the currently selected organization
+ * rather than the uploader's home organization (#3765).
+ */
+export async function resolveAttachmentOrganizationId(
+  container: AwilixContainer,
+  auth: AuthContext,
+  request: Request,
+): Promise<string | null> {
+  if (!auth) return null
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+  return scope?.selectedId ?? auth.orgId ?? null
+}