@open-mercato/core 0.6.6 → 0.6.7-develop.6553.1.2ec7246e04

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -4,6 +4,7 @@ import React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { ActionLogItem } from '../../components/AuditLogsActions'
 import { AuditLogsActions } from '../../components/AuditLogsActions'
@@ -182,28 +183,17 @@ export default function AuditLogsPage() {
   return (
     <Page>
       <PageBody>
-        <div className="mb-6 border-b border-border">
-      <nav className="flex items-center gap-6 text-sm" role="tablist" aria-label={t('audit_logs.tabs.label')}>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'actions'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'actions' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('actions')}
-            >
-              {t('audit_logs.actions.title')}
-            </button>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'access'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'access' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('access')}
-            >
-              {t('audit_logs.access.title')}
-            </button>
-          </nav>
-        </div>
+        <Tabs
+          value={tab}
+          onValueChange={(value) => setTab(value as TabOption)}
+          variant="underline"
+          className="mb-6"
+        >
+          <TabsList className="w-full flex-wrap" aria-label={t('audit_logs.tabs.label')}>
+            <TabsTrigger value="actions">{t('audit_logs.actions.title')}</TabsTrigger>
+            <TabsTrigger value="access">{t('audit_logs.access.title')}</TabsTrigger>
+          </TabsList>
+        </Tabs>
 
         {error && <div className="mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text">{error}</div>}
 

package/src/modules/auth/api/autologin.ts

@@ -0,0 +1,100 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
+import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'
+import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
+import { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
+
+export const metadata = { requireAuth: false }
+
+const accessTokenMaxAgeSeconds = 60 * 60 * 8
+const logger = createLogger('auth').child({ component: 'autologin' })
+
+// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the
+// visitor in with those credentials and redirect into the app. Gated entirely
+// behind env vars — the homepage only routes here when they are set. On any
+// failure (feature off, bad credentials) it falls back to the manual login form
+// so a misconfigured demo can never loop.
+export async function GET(req: Request) {
+  const url = new URL(req.url)
+  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin
+  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')
+
+  const credentials = resolveAutoLoginCredentials()
+  if (!credentials) {
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  // Already signed in — go straight to the app instead of re-issuing a session.
+  const existing = await getAuthFromRequest(req)
+  if (existing) {
+    return buildSafeRedirectResponse(req, redirectTo)
+  }
+
+  const container = await createRequestContainer()
+  const auth = container.resolve<AuthService>('authService')
+
+  let user = null
+  if (credentials.tenantId) {
+    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)
+  } else {
+    const users = await auth.findUsersByEmail(credentials.email)
+    user = users.length === 1 ? users[0] : null
+  }
+
+  const ok = await auth.verifyPassword(user, credentials.password)
+  if (!user || !ok) {
+    // Misconfigured demo credentials — never loop; drop to the manual form.
+    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)
+  const roles = await auth.getUserRoles(user, resolvedTenantId)
+  await auth.updateLastLoginAt(user)
+  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)
+  const { session } = await auth.createSession(user, expiresAt)
+  const token = signJwt({
+    sub: String(user.id),
+    sid: String(session.id),
+    tenantId: resolvedTenantId,
+    orgId: user.organizationId ? String(user.organizationId) : null,
+    email: user.email,
+    roles,
+  })
+  void emitAuthEvent('auth.login.success', {
+    id: String(user.id),
+    email: user.email,
+    tenantId: resolvedTenantId,
+    organizationId: user.organizationId ? String(user.organizationId) : null,
+  }).catch(() => undefined)
+
+  const res = buildSafeRedirectResponse(req, redirectTo)
+  res.cookies.set('auth_token', token, {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: accessTokenMaxAgeSeconds,
+  })
+  return res
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Authentication & Accounts',
+  summary: 'Demo autologin',
+  methods: {
+    GET: {
+      summary: 'Auto sign-in using env-configured demo credentials',
+      description:
+        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',
+      responses: [
+        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },
+      ],
+    },
+  },
+}

package/src/modules/auth/api/users/route.ts

@@ -22,6 +22,7 @@ import {
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
@@ -41,6 +42,7 @@ const querySchema = z.object({
   search: z.string().optional(),
   name: z.string().optional(),
   organizationId: z.string().uuid().optional(),
+  scopeToActiveOrganization: z.boolean().optional(),
   roleIds: z.array(z.string().uuid()).optional(),
 }).passthrough()
 
@@ -180,6 +182,7 @@ export async function GET(req: Request) {
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
+    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),
     roleIds: rawRoleIds.length ? rawRoleIds : undefined,
   })
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
@@ -195,7 +198,7 @@ export async function GET(req: Request) {
   } catch (err) {
     logger.error('Failed to resolve rbac', { err })
   }
-  const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
+  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -244,6 +247,12 @@ export async function GET(req: Request) {
     ? effectiveSelectedOrganizationId
     : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
+  // Recipient/assignee pickers scope to the caller's active organization so they never
+  // suggest users outside it. A message composed here is stamped with the caller's
+  // active org (auth.orgId), and the message detail endpoint enforces
+  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the
+  // suggestions to the same org keeps a picked recipient able to open what they were sent.
+  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
     const searchPattern = `%${escapeLikePattern(trimmedName)}%`
@@ -620,7 +629,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/cli.ts

@@ -9,6 +9,7 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
@@ -71,7 +72,7 @@ const addUser: ModuleCli = {
     })
     await em.persist(u).flush()
     if (rolesCsv) {
-      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
+      const names = parseCommaSeparatedList(rolesCsv)
       for (const name of names) {
         const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
@@ -493,7 +494,7 @@ const setupApp: ModuleCli = {
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
     const roleNames = rolesCsv
-      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)
+      ? parseCommaSeparatedList(rolesCsv)
       : undefined
 
     try {

package/src/modules/auth/lib/autologin.ts

@@ -0,0 +1,36 @@
+export type AutoLoginCredentials = {
+  email: string
+  password: string
+  tenantId: string | null
+}
+
+function readEnvValue(env: Record<string, string | undefined>, key: string): string {
+  const value = env[key]
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+/**
+ * Reads the optional demo-autologin credentials from env. When both
+ * `OM_AUTOLOGIN_EMAIL` and `OM_AUTOLOGIN_PASSWORD` are set, the homepage hands
+ * unauthenticated visitors to the autologin route which signs them in and drops
+ * them into the app. Unset (the default) → `null` → normal login flow.
+ *
+ * `OM_AUTOLOGIN_TENANT` is optional and only needed when the same email exists
+ * across multiple tenants. Pure: pass the env bag so it stays testable.
+ */
+export function resolveAutoLoginCredentials(
+  env: Record<string, string | undefined> = process.env,
+): AutoLoginCredentials | null {
+  const email = readEnvValue(env, 'OM_AUTOLOGIN_EMAIL')
+  const password = env.OM_AUTOLOGIN_PASSWORD ?? ''
+  if (!email || !password) return null
+  const tenantId = readEnvValue(env, 'OM_AUTOLOGIN_TENANT')
+  return { email, password, tenantId: tenantId || null }
+}
+
+/** True when demo autologin credentials are configured via env. */
+export function isAutoLoginEnabled(
+  env: Record<string, string | undefined> = process.env,
+): boolean {
+  return resolveAutoLoginCredentials(env) !== null
+}

package/src/modules/configs/i18n/de.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup-Drosselfenster",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatisch Query-Index-Neuindizierungsaufträge bei Lücken planen.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatische Neuindizierung",
-  "configs.systemStatus.viewDocs": "Dokumentation anzeigen"
+  "configs.systemStatus.viewDocs": "Dokumentation anzeigen",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Anhang-Organisationen abgleichen",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Anhang-Organisationen werden abgeglichen…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} behebt Anhänge, die unter der falschen Organisation gespeichert wurden. Führen Sie den Abgleich aus, um vorhandene Anhänge in die Organisation des zugehörigen Datensatzes zu verschieben.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Anhang-Organisationen abgeglichen."
 }

package/src/modules/configs/i18n/en.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup throttle window",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatically schedule query index reindex jobs when gaps appear.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Auto reindex",
-  "configs.systemStatus.viewDocs": "View documentation"
+  "configs.systemStatus.viewDocs": "View documentation",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconcile attachment organizations",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciling attachment organizations…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} fixes attachments that were saved under the wrong organization. Run the reconciliation to move existing attachments to the organization of the record they belong to.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Attachment organizations reconciled."
 }

package/src/modules/configs/i18n/es.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Ventana de limitación del calentamiento",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Programar automáticamente trabajos de reindexación cuando se detecten brechas.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Reindexación automática",
-  "configs.systemStatus.viewDocs": "Ver documentación"
+  "configs.systemStatus.viewDocs": "Ver documentación",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconciliar organizaciones de adjuntos",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciliando organizaciones de adjuntos…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "La versión {{version}} corrige los adjuntos guardados en la organización incorrecta. Ejecuta la reconciliación para mover los adjuntos existentes a la organización del registro al que pertenecen.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizaciones de adjuntos reconciliadas."
 }

package/src/modules/configs/i18n/pl.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Okno throttlingu rozgrzewki",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatycznie uruchamia przebudowę indeksu zapytań, gdy wykryte zostaną luki.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatyczna przebudowa indeksu",
-  "configs.systemStatus.viewDocs": "Zobacz dokumentację"
+  "configs.systemStatus.viewDocs": "Zobacz dokumentację",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Uzgodnij organizacje załączników",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Uzgadnianie organizacji załączników…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Wersja {{version}} naprawia załączniki zapisane pod niewłaściwą organizacją. Uruchom uzgadnianie, aby przenieść istniejące załączniki do organizacji rekordu, do którego należą.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizacje załączników zostały uzgodnione."
 }

package/src/modules/configs/lib/upgrade-actions.ts

@@ -1,6 +1,11 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import * as semver from 'semver'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'
+
+const logger = createLogger('configs').child({ component: 'upgrade-actions' })
 
 export type UpgradeActionContext = {
   tenantId: string
@@ -38,6 +43,25 @@ export function compareVersions(a: string, b: string): number {
 }
 
 export const upgradeActions: UpgradeActionDefinition[] = [
+  {
+    id: 'attachments.reconcile-organization',
+    version: '0.6.6',
+    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',
+    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',
+    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',
+    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',
+    async run({ container, em, tenantId }) {
+      const queryEngine = container.resolve('queryEngine') as QueryEngine
+      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })
+      logger.info('attachments organization reconcile completed', {
+        tenantId,
+        scanned: report.scanned,
+        updated: report.updated,
+        unresolved: report.unresolved,
+        skippedVirtual: report.skippedVirtual,
+      })
+    },
+  },
   {
     id: 'customers.seed-interaction-statuses',
     version: '0.6.5',

package/src/modules/customer_accounts/AGENTS.md

@@ -306,15 +306,17 @@ Both link to `/backend/customer_accounts/{sourceEntityId}` for staff review.
 
 | Spot ID | Widget | Purpose |
 |---------|--------|---------|
-| `customers.person` | `account-status` | Shows portal account status on Customers v2 person detail forms |
-| `crud-form:customers.person` | `account-status` | Alias for CrudForm hosts deriving the spot from `customers.person` |
-| `crud-form:customers:customer_person_profile:fields` | `account-status` | Shows portal account status on CRM person detail page |
-| `customers.company` | `company-users` | Shows portal users on Customers v2 company detail forms |
-| `crud-form:customers.company` | `company-users` | Alias for CrudForm hosts deriving the spot from `customers.company` |
-| `crud-form:customers:customer_company_profile:fields` | `company-users` | Shows portal users linked to a CRM company |
+| `customers.person` | `account-status` | Alias for hosts requesting the bare `customers.person` entity spot |
+| `crud-form:customers.person` | `account-status` | Shows portal account status on the person v2 detail page (`people-v2/[id]`) |
+| `customers.company` | `company-users` | Alias for hosts requesting the bare `customers.company` entity spot |
+| `crud-form:customers.company` | `company-users` | Shows portal users on the company v2 detail page (`companies-v2/[id]`) |
 
 Both inject as column 2 groups with priority 200, gated by `customer_accounts.view` feature.
 
+CrudForm derives its spot id as `crud-form:${entityId}` with every `:` normalized to `.`, so a
+registered `crud-form:` key whose entity segment still contains `:` can never be requested by any
+host. Register against the normalized (dot) form only — `injection-table.test.ts` enforces this.
+
 ## Backend Pages
 
 | Path | Purpose |

package/src/modules/customer_accounts/api/admin/roles/[id]/acl.ts

@@ -49,6 +49,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {

package/src/modules/customer_accounts/api/admin/roles/[id].ts

@@ -36,6 +36,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -94,6 +95,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -127,7 +129,11 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault
   if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable
 
-  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  }, updates)
 
   void emitCustomerAccountsEvent('customer_accounts.role.updated', {
     id: role.id,
@@ -157,6 +163,7 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -191,8 +198,15 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })
   }
 
-  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: new Date() })
-  await em.nativeUpdate(CustomerRoleAcl, { role: role.id as any }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRoleAcl, {
+    role: role.id as any,
+    tenantId: auth.tenantId,
+  }, { deletedAt: new Date() })
 
   void emitCustomerAccountsEvent('customer_accounts.role.deleted', {
     id: role.id,

package/src/modules/customer_accounts/api/portal/users/[id]/roles.ts

@@ -60,7 +60,12 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     ? await findWithDecryption(
         em,
         CustomerRole,
-        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
+        {
+          id: { $in: requestedRoleIds },
+          tenantId: auth.tenantId,
+          organizationId: auth.orgId,
+          deletedAt: null,
+        } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -67,7 +67,12 @@ export async function POST(req: Request) {
     ? await findWithDecryption(
         em,
         CustomerRole,
-        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
+        {
+          id: { $in: requestedRoleIds },
+          tenantId: auth.tenantId,
+          organizationId: auth.orgId,
+          deletedAt: null,
+        } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -133,6 +133,7 @@ export class CustomerInvitationService {
           {
             id: { $in: roleIds } as any,
             tenantId: invitation.tenantId,
+            organizationId: invitation.organizationId,
             deletedAt: null,
           } as any,
           undefined,

package/src/modules/customer_accounts/services/customerRbacService.ts

@@ -29,7 +29,9 @@ export class CustomerRbacService {
   }
 
   private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {
-    return `customer_rbac:${userId}:${scope.tenantId}:${scope.organizationId}`
+    // Keep the authorization query versioned in the key so cache entries created
+    // before scope hardening cannot preserve grants that are no longer valid.
+    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`
   }
 
   private getUserTag(userId: string): string {
@@ -89,8 +91,13 @@ export class CustomerRbacService {
     // Aggregate role ACLs
     const links = await em.find(CustomerUserRole, {
       user: userId as any,
+      role: {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        deletedAt: null,
+      },
       deletedAt: null,
-    }, { populate: ['role'] })
+    } as any, { populate: ['role'] })
     const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)
 
     let isPortalAdmin = false

package/src/modules/customer_accounts/widgets/injection-table.ts

@@ -19,10 +19,8 @@ const companyUsersWidget = {
 export const injectionTable: ModuleInjectionTable = {
   'customers.person': [accountStatusWidget],
   'crud-form:customers.person': [accountStatusWidget],
-  'crud-form:customers:customer_person_profile:fields': [accountStatusWidget],
   'customers.company': [companyUsersWidget],
   'crud-form:customers.company': [companyUsersWidget],
-  'crud-form:customers:customer_company_profile:fields': [companyUsersWidget],
   // Step 4.10 — Portal AiChat injection example.
   // Mapped to the portal profile page's `pageAfter('profile')` spot;
   // third-party modules targeting other portal pages can copy this entry.

package/src/modules/customers/backend/customers/companies-v2/[id]/page.tsx

@@ -31,6 +31,7 @@ import type { TagsSectionController } from '@open-mercato/ui/backend/detail'
 import { coerceDisplayName } from '../../../../lib/displayName'
 import { CompanyDetailHeader } from '../../../../components/detail/CompanyDetailHeader'
 import { CompanyDetailTabs, resolveLegacyTab, type CompanyTabId } from '../../../../components/detail/CompanyDetailTabs'
+import { useDealsAccess } from '../../../../components/detail/useDealsAccess'
 import { CompanyKpiBar } from '../../../../components/detail/CompanyKpiBar'
 import { ScheduleActivityDialog, type ScheduleActivityEditData } from '../../../../components/detail/ScheduleActivityDialog'
 import { ChangelogTab } from '../../../../components/detail/ChangelogTab'
@@ -69,6 +70,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
   }, [searchParams])
   const [activeTab, setActiveTab] = React.useState<CompanyTabId>(initialTab)
   const [sectionAction, setSectionAction] = React.useState<SectionAction | null>(null)
+  const { canViewDeals, isReady: isDealsAccessReady } = useDealsAccess()
 
   // Form state
   const [isDirty, setIsDirty] = React.useState(false)
@@ -328,6 +330,14 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
     setSectionAction(null)
   }, [activeTab])
 
+  // A `?tab=deals` deep link must not strand users without `customers.deals.view`
+  // on a tab that no longer exists for them. Wait for the granted features to load
+  // so a permitted user is never bounced off the tab mid-fetch.
+  React.useEffect(() => {
+    if (!isDealsAccessReady || canViewDeals) return
+    setActiveTab((current) => (current === 'deals' ? 'people' : current))
+  }, [isDealsAccessReady, canViewDeals])
+
   // Deals scope
   const dealsScope = React.useMemo(
     () => (currentCompanyId ? ({ kind: 'company', entityId: currentCompanyId } as const) : null),
@@ -544,7 +554,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
                   />
                 )}
 
-                {activeTab === 'deals' && (
+                {activeTab === 'deals' && canViewDeals && (
                   <DealsSection
                     scope={dealsScope}
                     emptyLabel={t('customers.companies.detail.empty.deals', 'No deals linked to this company.')}

package/src/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.tsx

@@ -24,9 +24,13 @@ export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.Reac
     map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),
   }
 
+  // Link-based tab row (two routes), so the Tabs primitive (state-driven,
+  // onValueChange) does not fit — real <Link> semantics must stay. Classes
+  // mirror the Tabs underline variant: accent-indigo active border,
+  // shadow-focus halo.
   const baseTab =
-    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2'
-  const activeTab = 'border-b-2 border-foreground font-semibold text-foreground'
+    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:shadow-focus'
+  const activeTab = 'border-b-2 border-accent-indigo font-semibold text-foreground'
   const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'
 
   // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,