@open-mercato/core 0.6.7-develop.6630.1.c8a615e536 → 0.6.7-develop.6645.1.52f0b37813

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.7-develop.6630.1.c8a615e536",
+  "version": "0.6.7-develop.6645.1.52f0b37813",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6630.1.c8a615e536",
-    "@open-mercato/shared": "0.6.7-develop.6630.1.c8a615e536",
-    "@open-mercato/ui": "0.6.7-develop.6630.1.c8a615e536",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6645.1.52f0b37813",
+    "@open-mercato/shared": "0.6.7-develop.6645.1.52f0b37813",
+    "@open-mercato/ui": "0.6.7-develop.6645.1.52f0b37813",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6630.1.c8a615e536",
-    "@open-mercato/shared": "0.6.7-develop.6630.1.c8a615e536",
-    "@open-mercato/ui": "0.6.7-develop.6630.1.c8a615e536",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6645.1.52f0b37813",
+    "@open-mercato/shared": "0.6.7-develop.6645.1.52f0b37813",
+    "@open-mercato/ui": "0.6.7-develop.6645.1.52f0b37813",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/attachments/components/AttachmentLibrary.tsx

@@ -199,7 +199,7 @@ type AssignmentsEditorProps = {
   disabled?: boolean
 }
 
-function AttachmentAssignmentsEditor({ value, onChange, labels, disabled }: AssignmentsEditorProps) {
+export function AttachmentAssignmentsEditor({ value, onChange, labels, disabled }: AssignmentsEditorProps) {
   const handleChange = React.useCallback(
     (index: number, patch: Partial<AssignmentDraft>) => {
       onChange(value.map((entry, idx) => (idx === index ? { ...entry, ...patch } : entry)))
@@ -229,7 +229,7 @@ function AttachmentAssignmentsEditor({ value, onChange, labels, disabled }: Assi
           <div className="text-xs text-muted-foreground">No assignments yet.</div>
         ) : (
           value.map((entry, index) => (
-            <div key={`${index}-${entry.type}-${entry.id}`} className="rounded border p-3 space-y-2">
+            <div key={index} className="rounded border p-3 space-y-2">
               <div className="grid gap-2 sm:grid-cols-2">
                 <div className="space-y-1">
                   <label className="text-xs font-medium">{labels.type}</label>
@@ -916,6 +916,7 @@ export function AttachmentLibrary() {
                     className="text-sm text-blue-600 underline"
                     target="_blank"
                     rel="noreferrer"
+                    onClick={(event) => event.stopPropagation()}
                   >
                     {content}
                   </a>
@@ -961,7 +962,12 @@ export function AttachmentLibrary() {
           const absolute = resolveAbsoluteUrl(downloadPath)
           return (
             <Button variant="ghost" size="icon" asChild>
-              <a href={absolute} download aria-label={t('attachments.library.table.download', 'Download')}>
+              <a
+                href={absolute}
+                download
+                aria-label={t('attachments.library.table.download', 'Download')}
+                onClick={(event) => event.stopPropagation()}
+              >
                 <Download className="h-4 w-4" />
               </a>
             </Button>

package/src/modules/catalog/di.ts

@@ -12,7 +12,9 @@ export function register(container: AppContainer) {
   container.register({
     catalogPricingService: asFunction(({ eventBus }: AppCradle) => {
       return new DefaultCatalogPricingService(eventBus ?? null)
-    }).singleton(),
+    })
+      .singleton()
+      .proxy(),
     CatalogProduct: asValue(CatalogProduct),
     CatalogProductPrice: asValue(CatalogProductPrice),
   })

package/src/modules/dashboards/lib/widgets.ts

@@ -1,5 +1,6 @@
 import type { Module, ModuleDashboardWidgetEntry } from '@open-mercato/shared/modules/registry'
 import type { DashboardWidgetMetadata, DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
+import { applyDashboardWidgetOverridesToEntries } from '@open-mercato/shared/modules/overrides'
 import { getModules } from '@open-mercato/shared/lib/i18n/server'
 
 type LoadedWidgetModule = DashboardWidgetModule<any> & { metadata: DashboardWidgetMetadata }
@@ -20,13 +21,14 @@ async function loadWidgetEntries(): Promise<WidgetEntry[]> {
   if (!widgetEntriesPromise) {
     widgetEntriesPromise = Promise.resolve().then(() => {
       const list = getModules() as Module[]
-      return list.flatMap((mod) => {
-        const entries = mod.dashboardWidgets ?? []
-        return entries.map((entry) => ({
+      const entries = list.flatMap((mod) => {
+        const moduleEntries = mod.dashboardWidgets ?? []
+        return moduleEntries.map((entry) => ({
           ...entry,
           moduleId: mod.id,
         }))
       })
+      return applyDashboardWidgetOverridesToEntries(entries) as WidgetEntry[]
     })
   }
   return widgetEntriesPromise

package/src/modules/directory/api/get/organizations/lookup.ts

@@ -2,8 +2,13 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'
+import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
+import { checkRateLimit, getClientIp, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 
 export const metadata = {
   path: '/directory/organizations/lookup',
@@ -16,7 +21,76 @@ const orgLookupQuerySchema = z.object({
   slug: z.string().min(1).max(150),
 })
 
+// Unauthenticated pre-auth portal resolver: an anonymous caller can probe any
+// slug, so cap probes per IP to keep slug enumeration bounded and noisy.
+//
+// The cap matches the sibling tenant lookup (60/min/IP) because the legitimate
+// call pattern is the same: useTenantContext resolves the org on every portal
+// page mount without caching, and a whole workforce behind one NAT egress IP —
+// or one reverse proxy — shares this budget. A tripped lookup renders as a
+// missing organization, so the cap must clear real portal traffic by a wide
+// margin. Tune per deployment with RATE_LIMIT_DIRECTORY_ORG_LOOKUP_POINTS /
+// _DURATION / _BLOCK_DURATION.
+const orgLookupIpRateLimitConfig = readEndpointRateLimitConfig('DIRECTORY_ORG_LOOKUP', {
+  points: 60,
+  duration: 60,
+  blockDuration: 60,
+  keyPrefix: 'directory-org-lookup',
+})
+
+// Structural contract for the OPTIONAL `domainMappingService` owned by
+// `customer_accounts`. Declared locally (never imported) because
+// `customer_accounts` already depends on `directory` — importing it back would
+// invert the dependency and break this module's isomorphism.
+type DomainTenantResolver = {
+  resolveByHostname(hostname: string): Promise<{ tenantId: string; status: string } | null>
+}
+
+// A branded (custom-domain) portal host already implies a tenant, so bound the
+// slug lookup to it. Returns null on the platform domain, on an unmapped or
+// inactive host, and when the peer module is absent — those keep the global
+// resolution the platform-domain portal bootstrap depends on. The Host header is
+// caller-controlled, so this is containment for legitimate branded traffic, not
+// a trust boundary; the rate limit above is what bounds enumeration.
+async function resolveTenantFromHost(container: AppContainer, req: Request): Promise<string | null> {
+  const host = req.headers.get('host')
+  if (!host) return null
+  try {
+    const resolver = container.resolve('domainMappingService') as DomainTenantResolver
+    const mapping = await resolver.resolveByHostname(host)
+    if (!mapping || mapping.status !== 'active') return null
+    return mapping.tenantId
+  } catch {
+    return null
+  }
+}
+
+// Fail-open, like auth's checkAuthRateLimit: this resolver sits on the unauthenticated
+// portal bootstrap path, so a limiter outage must degrade to unlimited lookups rather
+// than 500 the portal.
+async function enforceOrgLookupRateLimit(req: Request): Promise<NextResponse | null> {
+  try {
+    const rateLimiterService = getCachedRateLimiterService()
+    if (!rateLimiterService) return null
+    const clientIp = getClientIp(req, rateLimiterService.trustProxyDepth)
+    if (!clientIp) return null
+    const { translate } = await resolveTranslations()
+    return await checkRateLimit(
+      rateLimiterService,
+      orgLookupIpRateLimitConfig,
+      clientIp,
+      translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),
+    )
+  } catch {
+    return null
+  }
+}
+
 export async function GET(req: Request) {
+  // Consume the limit before validation or DB work, so junk input cannot bypass it.
+  const rateLimitResponse = await enforceOrgLookupRateLimit(req)
+  if (rateLimitResponse) return rateLimitResponse
+
   const url = new URL(req.url)
   const slug = url.searchParams.get('slug') || ''
   const parsed = orgLookupQuerySchema.safeParse({ slug })
@@ -26,9 +100,18 @@ export async function GET(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
+  const tenantId = await resolveTenantFromHost(container, req)
+  // `slug` is unique per (tenant, slug), not globally, so an unscoped match can
+  // hit several tenants' rows. Order deterministically so an unscoped collision
+  // always resolves to the same organization instead of an arbitrary one.
   const organization = await em.findOne(
     Organization,
-    { slug: parsed.data.slug, deletedAt: null },
+    {
+      slug: parsed.data.slug,
+      deletedAt: null,
+      ...(tenantId ? { tenant: tenantId } : {}),
+    },
+    { orderBy: { createdAt: 'ASC' } },
   )
   if (!organization) {
     return NextResponse.json({ ok: false, error: 'Organization not found.' }, { status: 404 })
@@ -61,7 +144,8 @@ const orgLookupErrorSchema = z.object({
 
 const orgLookupDoc: OpenApiMethodDoc = {
   summary: 'Public organization lookup by slug',
-  description: 'Resolves organization metadata for portal flows. No authentication required.',
+  description:
+    'Resolves organization metadata for portal flows. No authentication required, so the endpoint is rate limited per IP. On a custom-domain host the lookup is scoped to that host\'s tenant.',
   tags: [lookupTag],
   query: orgLookupQuerySchema,
   responses: [
@@ -70,6 +154,7 @@ const orgLookupDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid slug', schema: orgLookupErrorSchema },
     { status: 404, description: 'Organization not found', schema: orgLookupErrorSchema },
+    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },
   ],
 }
 

package/src/modules/directory/api/get/tenants/lookup.ts

@@ -4,6 +4,10 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'
+import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
+import { checkRateLimit, getClientIp, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 
 export const metadata = {
   path: '/directory/tenants/lookup',
@@ -16,7 +20,48 @@ const tenantLookupQuerySchema = z.object({
   tenantId: z.string().uuid(),
 })
 
+// Unauthenticated login/onboarding resolver: it returns the tenant name to anyone
+// holding the id, so cap probes per IP to keep name-harvesting from leaked ids —
+// and the unauthenticated DB query behind it — bounded and noisy.
+//
+// The cap is deliberately generous: the login screen resolves the tenant on every
+// render and a workforce behind one NAT egress IP shares this budget, while a
+// tripped lookup renders as an invalid tenant. 60/min/IP stays clear of that.
+// Tune per deployment with RATE_LIMIT_DIRECTORY_TENANT_LOOKUP_POINTS / _DURATION /
+// _BLOCK_DURATION.
+const tenantLookupIpRateLimitConfig = readEndpointRateLimitConfig('DIRECTORY_TENANT_LOOKUP', {
+  points: 60,
+  duration: 60,
+  blockDuration: 60,
+  keyPrefix: 'directory-tenant-lookup',
+})
+
+// Fail-open, like auth's checkAuthRateLimit: this resolver sits on the unauthenticated
+// login bootstrap path, so a limiter outage must degrade to unlimited lookups rather
+// than 500 the login screen.
+async function enforceTenantLookupRateLimit(req: Request): Promise<NextResponse | null> {
+  try {
+    const rateLimiterService = getCachedRateLimiterService()
+    if (!rateLimiterService) return null
+    const clientIp = getClientIp(req, rateLimiterService.trustProxyDepth)
+    if (!clientIp) return null
+    const { translate } = await resolveTranslations()
+    return await checkRateLimit(
+      rateLimiterService,
+      tenantLookupIpRateLimitConfig,
+      clientIp,
+      translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),
+    )
+  } catch {
+    return null
+  }
+}
+
 export async function GET(req: Request) {
+  // Consume the limit before validation or DB work, so junk input cannot bypass it.
+  const rateLimitResponse = await enforceTenantLookupRateLimit(req)
+  if (rateLimitResponse) return rateLimitResponse
+
   const url = new URL(req.url)
   const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''
   const parsed = tenantLookupQuerySchema.safeParse({ tenantId })
@@ -62,6 +107,7 @@ const tenantLookupDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid tenant id', schema: tenantLookupErrorSchema },
     { status: 404, description: 'Tenant not found', schema: tenantLookupErrorSchema },
+    { status: 429, description: 'Too many tenant lookups', schema: rateLimitErrorSchema },
   ],
 }
 

package/src/modules/notifications/di.ts

@@ -6,6 +6,6 @@ export function register(container: AppContainer): void {
   container.register({
     notificationService: asFunction(({ em, eventBus, commandBus }) =>
       createNotificationService({ em, eventBus, commandBus })
-    ).scoped(),
+    ).scoped().proxy(),
   })
 }

package/src/modules/planner/commands/availability-rule-sets.ts

@@ -17,7 +17,16 @@ import {
 } from '../data/validators'
 import { plannerAvailabilityRuleSetCrudEvents } from '../lib/crud'
 import { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitPlannerCommandScope,
+  extractUndoPayload,
+  scopeForDecryption,
+  type PlannerCommandScope,
+} from './shared'
 import { E } from '#generated/entities.ids.generated'
 
 const availabilityRuleSetCrudIndexer: CrudIndexerConfig<PlannerAvailabilityRuleSet> = {
@@ -43,13 +52,14 @@ type AvailabilityRuleSetUndoPayload = {
 async function loadAvailabilityRuleSetSnapshot(
   em: EntityManager,
   id: string,
+  scope: PlannerCommandScope,
 ): Promise<AvailabilityRuleSetSnapshot | null> {
   const ruleSet = await findOneWithDecryption(
     em,
     PlannerAvailabilityRuleSet,
-    { id },
+    applyScopeToWhere<PlannerAvailabilityRuleSet>({ id }, scope),
     undefined,
-    { tenantId: null, organizationId: null },
+    scopeForDecryption(scope),
   )
   if (!ruleSet) return null
   const custom = await loadCustomFieldSnapshot(em, {
@@ -114,15 +124,23 @@ const createAvailabilityRuleSetCommand: CommandHandler<PlannerAvailabilityRuleSe
     })
     return { ruleSetId: record.id }
   },
-  captureAfter: async (_input, result, ctx) => {
+  captureAfter: async (input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadAvailabilityRuleSetSnapshot(em, result.ruleSetId)
+    const snapshot = await loadAvailabilityRuleSetSnapshot(
+      em,
+      result.ruleSetId,
+      explicitPlannerCommandScope(input.tenantId, input.organizationId),
+    )
     if (!snapshot) return null
     return snapshot
   },
-  buildLog: async ({ result, ctx }) => {
+  buildLog: async ({ input, result, ctx }) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const snapshot = await loadAvailabilityRuleSetSnapshot(em, result.ruleSetId)
+    const snapshot = await loadAvailabilityRuleSetSnapshot(
+      em,
+      result.ruleSetId,
+      explicitPlannerCommandScope(input.tenantId, input.organizationId),
+    )
     if (!snapshot) return null
     const { translate } = await resolveTranslations()
     return {
@@ -190,19 +208,20 @@ const updateAvailabilityRuleSetCommand: CommandHandler<PlannerAvailabilityRuleSe
   async prepare(input, ctx) {
     const { parsed } = parseWithCustomFields(plannerAvailabilityRuleSetUpdateSchema, input)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadAvailabilityRuleSetSnapshot(em, parsed.id)
+    const snapshot = await loadAvailabilityRuleSetSnapshot(em, parsed.id, commandActorScope(ctx))
     if (!snapshot) return {}
     return { before: snapshot }
   },
   async execute(input, ctx) {
     const { parsed, custom } = parseWithCustomFields(plannerAvailabilityRuleSetUpdateSchema, input)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const record = await findOneWithDecryption(
       em,
       PlannerAvailabilityRuleSet,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<PlannerAvailabilityRuleSet>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!record) throw new CrudHttpError(404, { error: 'Planner availability rule set not found.' })
     ensureTenantScope(ctx, record.tenantId)
@@ -240,7 +259,11 @@ const updateAvailabilityRuleSetCommand: CommandHandler<PlannerAvailabilityRuleSe
     const before = snapshots.before as AvailabilityRuleSetSnapshot | undefined
     if (!before) return null
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const after = await loadAvailabilityRuleSetSnapshot(em, before.id)
+    const after = await loadAvailabilityRuleSetSnapshot(
+      em,
+      before.id,
+      explicitPlannerCommandScope(before.tenantId, before.organizationId),
+    )
     if (!after) return null
     const changes = buildChanges(before as unknown as Record<string, unknown>, after as unknown as Record<string, unknown>, [
       'name',
@@ -319,7 +342,7 @@ const deleteAvailabilityRuleSetCommand: CommandHandler<{ id?: string }, { ruleSe
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Availability rule set id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadAvailabilityRuleSetSnapshot(em, id)
+    const snapshot = await loadAvailabilityRuleSetSnapshot(em, id, commandActorScope(ctx))
     if (!snapshot) return {}
     return { before: snapshot }
   },
@@ -327,12 +350,13 @@ const deleteAvailabilityRuleSetCommand: CommandHandler<{ id?: string }, { ruleSe
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Availability rule set id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const record = await findOneWithDecryption(
       em,
       PlannerAvailabilityRuleSet,
-      { id, deletedAt: null },
+      applyScopeToWhere<PlannerAvailabilityRuleSet>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!record) throw new CrudHttpError(404, { error: 'Planner availability rule set not found.' })
     ensureTenantScope(ctx, record.tenantId)

package/src/modules/planner/commands/availability.ts

@@ -10,9 +10,16 @@ import {
   type PlannerAvailabilityRuleCreateInput,
   type PlannerAvailabilityRuleUpdateInput,
 } from '../data/validators'
-import { ensureOrganizationScope, ensureTenantScope } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  explicitPlannerCommandScope,
+  extractUndoPayload,
+  type PlannerCommandScope,
+} from './shared'
 import type { PlannerAvailabilityKind, PlannerAvailabilitySubjectType } from '../data/entities'
-import { extractUndoPayload } from './shared'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 
 const AVAILABILITY_RULE_RESOURCE_KIND = 'planner.availability.rule'
@@ -38,8 +45,15 @@ type AvailabilityRuleUndoPayload = {
   after?: AvailabilityRuleSnapshot | null
 }
 
-async function loadAvailabilityRuleSnapshot(em: EntityManager, id: string): Promise<AvailabilityRuleSnapshot | null> {
-  const record = await em.findOne(PlannerAvailabilityRule, { id })
+async function loadAvailabilityRuleSnapshot(
+  em: EntityManager,
+  id: string,
+  scope: PlannerCommandScope,
+): Promise<AvailabilityRuleSnapshot | null> {
+  const record = await em.findOne(
+    PlannerAvailabilityRule,
+    applyScopeToWhere<PlannerAvailabilityRule>({ id }, scope),
+  )
   if (!record) return null
   return {
     id: record.id,
@@ -125,9 +139,13 @@ const createAvailabilityRuleCommand: CommandHandler<PlannerAvailabilityRuleCreat
     await em.flush()
     return { ruleId: record.id }
   },
-  captureAfter: async (_input, result, ctx) => {
+  captureAfter: async (input, result, ctx) => {
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    return loadAvailabilityRuleSnapshot(em, result.ruleId)
+    return loadAvailabilityRuleSnapshot(
+      em,
+      result.ruleId,
+      explicitPlannerCommandScope(input.tenantId, input.organizationId),
+    )
   },
   buildLog: async ({ input, result, ctx, snapshots }) => {
     const snapshot = snapshots.after as AvailabilityRuleSnapshot | undefined
@@ -171,13 +189,19 @@ const updateAvailabilityRuleCommand: CommandHandler<PlannerAvailabilityRuleUpdat
   async prepare(input, ctx) {
     const parsed = plannerAvailabilityRuleUpdateSchema.parse(input)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadAvailabilityRuleSnapshot(em, parsed.id)
+    const snapshot = await loadAvailabilityRuleSnapshot(em, parsed.id, commandActorScope(ctx))
     return snapshot ? { before: snapshot } : {}
   },
   async execute(input, ctx) {
     const parsed = plannerAvailabilityRuleUpdateSchema.parse(input)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const record = await em.findOne(PlannerAvailabilityRule, { id: parsed.id, deletedAt: null })
+    const record = await em.findOne(
+      PlannerAvailabilityRule,
+      applyScopeToWhere<PlannerAvailabilityRule>(
+        { id: parsed.id, deletedAt: null },
+        commandActorScope(ctx),
+      ),
+    )
     if (!record) throw new CrudHttpError(404, { error: 'Planner availability rule not found.' })
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
@@ -208,7 +232,13 @@ const updateAvailabilityRuleCommand: CommandHandler<PlannerAvailabilityRuleUpdat
   buildLog: async ({ snapshots, input, result, ctx }) => {
     const before = snapshots.before as AvailabilityRuleSnapshot | undefined
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const afterSnapshot = before ? await loadAvailabilityRuleSnapshot(em, before.id) : null
+    const afterSnapshot = before
+      ? await loadAvailabilityRuleSnapshot(
+          em,
+          before.id,
+          explicitPlannerCommandScope(before.tenantId, before.organizationId),
+        )
+      : null
     const { translate } = await resolveTranslations()
     return {
       actionLabel: translate('planner.audit.availability.update', 'Update availability rule'),
@@ -242,14 +272,17 @@ const deleteAvailabilityRuleCommand: CommandHandler<{ id?: string }, { ruleId: s
     const id = input?.id
     if (!id) return {}
     const em = (ctx.container.resolve('em') as EntityManager)
-    const snapshot = await loadAvailabilityRuleSnapshot(em, id)
+    const snapshot = await loadAvailabilityRuleSnapshot(em, id, commandActorScope(ctx))
     return snapshot ? { before: snapshot } : {}
   },
   async execute(input, ctx) {
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Availability rule id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const record = await em.findOne(PlannerAvailabilityRule, { id, deletedAt: null })
+    const record = await em.findOne(
+      PlannerAvailabilityRule,
+      applyScopeToWhere<PlannerAvailabilityRule>({ id, deletedAt: null }, commandActorScope(ctx)),
+    )
     if (!record) return { ruleId: id }
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)

package/src/modules/planner/commands/shared.ts

@@ -1,4 +1,55 @@
+import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { ensureOrganizationScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
+import type { FilterQuery } from '@mikro-orm/postgresql'
 
 export { ensureOrganizationScope, ensureTenantScope, extractUndoPayload }
+
+export type PlannerCommandScope = {
+  tenantId: string | null
+  organizationId: string | null
+  requireTenant: boolean
+  requireOrganization: boolean
+}
+
+export function commandActorScope(ctx: CommandRuntimeContext): PlannerCommandScope {
+  const isPrivilegedActor = ctx.auth?.isSuperAdmin === true || ctx.systemActor === true
+  const tenantId = isPrivilegedActor ? null : (ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null)
+  const organizationId = isPrivilegedActor ? null : (ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null)
+  const organizationUnrestricted =
+    isPrivilegedActor || (organizationId === null && tenantId !== null && ctx.organizationScope?.allowedIds === null)
+  return {
+    tenantId,
+    organizationId: organizationUnrestricted ? null : organizationId,
+    requireTenant: !isPrivilegedActor,
+    requireOrganization: !organizationUnrestricted,
+  }
+}
+
+export function explicitPlannerCommandScope(
+  tenantId: string | null,
+  organizationId: string | null,
+): PlannerCommandScope {
+  return {
+    tenantId,
+    organizationId,
+    requireTenant: true,
+    requireOrganization: true,
+  }
+}
+
+export function applyScopeToWhere<TEntity extends object>(
+  where: FilterQuery<TEntity>,
+  scope: PlannerCommandScope,
+): FilterQuery<TEntity> {
+  const scoped = { ...(where as Record<string, unknown>) }
+  if (scope.requireTenant || scope.tenantId !== null) scoped.tenantId = scope.tenantId
+  if (scope.requireOrganization || scope.organizationId !== null) scoped.organizationId = scope.organizationId
+  return scoped as FilterQuery<TEntity>
+}
+
+export function scopeForDecryption(
+  scope: PlannerCommandScope,
+): { tenantId: string | null; organizationId: string | null } {
+  return { tenantId: scope.tenantId, organizationId: scope.organizationId }
+}