@open-mercato/core 0.6.7-develop.6785.1.1dd7cfac55 → 0.6.7-develop.6795.1.8a3f27921c

package/src/modules/customers/search.ts

@@ -6,6 +6,8 @@ import type {
   SearchResultLink,
   SearchIndexSource,
 } from '@open-mercato/shared/modules/search'
+import type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CUSTOMER_INTERACTION_TASK_SOURCE, EXAMPLE_TODO_SOURCE } from './lib/interactionCompatibility'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -480,6 +482,7 @@ function ensureFallbackLines(lines: string[], record: Record<string, unknown>, o
 // =============================================================================
 
 function resolvePersonPresenter(
+  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -495,7 +498,7 @@ function resolvePersonPresenter(
     (nameParts.length ? nameParts : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    'Person'
+    translate('customers.search.fallback.person', 'Person')
   const subtitlePieces: string[] = []
   const jobTitle = record.job_title ?? record.jobTitle ?? customFields.job_title ?? customFields.jobTitle
   if (jobTitle) subtitlePieces.push(String(jobTitle))
@@ -515,11 +518,14 @@ function resolvePersonPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'user',
-    badge: pickValue(entity, 'display_name', 'displayName') ? 'Person' : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName')
+      ? translate('customers.search.badge.person', 'Person')
+      : undefined,
   }
 }
 
 function resolveCompanyPresenter(
+  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -537,7 +543,7 @@ function resolveCompanyPresenter(
     (entity?.id && entity?.display_name ? entity.display_name as string : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    'Company'
+    translate('customers.search.fallback.company', 'Company')
   const subtitlePieces: string[] = []
   const industry = record.industry
   if (industry) subtitlePieces.push(String(industry))
@@ -567,7 +573,9 @@ function resolveCompanyPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'building',
-    badge: pickValue(entity, 'display_name', 'displayName') ? 'Company' : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName')
+      ? translate('customers.search.badge.company', 'Company')
+      : undefined,
   }
 }
 
@@ -605,6 +613,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Preferred name', record.preferred_name ?? record.preferredName ?? ctx.customFields.preferred_name)
@@ -643,9 +652,9 @@ export const searchConfig: SearchModuleConfig = {
           })
         }
 
-        const presenter = resolvePersonPresenter(record, entity, ctx.customFields)
+        const presenter = resolvePersonPresenter(t, record, entity, ctx.customFields)
         logMissingPresenterTitle('person', record, entity, presenter)
-        const presenterLabel = pickLabel(presenter.title) ?? 'Open person'
+        const presenterLabel = pickLabel(presenter.title) ?? t('customers.search.link.openPerson', 'Open person')
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('person', entityId)
@@ -669,8 +678,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolvePersonPresenter(ctx.record, entity, ctx.customFields)
+        return resolvePersonPresenter(t, ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -679,11 +689,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('person', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -714,6 +725,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Legal name', record.legal_name ?? record.legalName ?? ctx.customFields.legal_name)
@@ -734,9 +746,9 @@ export const searchConfig: SearchModuleConfig = {
         ensureFallbackLines(lines, record)
         if (!lines.length) return null
 
-        const presenter = resolveCompanyPresenter(record, entity, ctx.customFields)
+        const presenter = resolveCompanyPresenter(t, record, entity, ctx.customFields)
         logMissingPresenterTitle('company', record, entity, presenter)
-        const primaryLabel = pickLabel(presenter.title) ?? 'Open company'
+        const primaryLabel = pickLabel(presenter.title) ?? t('customers.search.link.openCompany', 'Open company')
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('company', entityId)
@@ -760,8 +772,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolveCompanyPresenter(ctx.record, entity, ctx.customFields)
+        return resolveCompanyPresenter(t, ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -770,11 +783,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('company', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -832,8 +846,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
-        const title = (parent?.display_name as string | undefined) ?? 'Customer note'
+        const title = (parent?.display_name as string | undefined) ?? t('customers.search.fallback.customerNote', 'Customer note')
         return {
           title,
           subtitle: snippet(ctx.record.body),
@@ -850,15 +865,16 @@ export const searchConfig: SearchModuleConfig = {
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const parentUrl = buildCustomerUrl(parent?.kind as string ?? null, (parent?.id ?? ctx.record.entity_id ?? ctx.record.entityId) as string)
         if (parentUrl) {
-          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? 'View customer', kind: 'primary' })
+          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? t('customers.search.link.viewCustomer', 'View customer'), kind: 'primary' })
         }
         if (ctx.record.deal_id) {
           const dealUrl = `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`
-          links.push({ href: dealUrl, label: 'Open deal', kind: 'secondary' })
+          links.push({ href: dealUrl, label: t('customers.search.link.openDeal', 'Open deal'), kind: 'secondary' })
         }
         return links.length ? links : null
       },
@@ -880,6 +896,7 @@ export const searchConfig: SearchModuleConfig = {
       priority: 8,
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Title', record.title)
@@ -898,10 +915,10 @@ export const searchConfig: SearchModuleConfig = {
         return {
           text: lines,
           presenter: {
-            title: String(record.title ?? 'Deal'),
+            title: String(record.title ?? t('customers.search.fallback.deal', 'Deal')),
             subtitle: subtitleParts.join(' · ') || undefined,
             icon: 'briefcase',
-            badge: 'Deal',
+            badge: t('customers.search.badge.deal', 'Deal'),
           },
           checksumSource: {
             title: record.title,
@@ -913,8 +930,9 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
+        const { t } = await resolveTranslations()
         const { record } = ctx
-        const title = pickString(record.title as string, 'Deal')
+        const title = pickString(record.title as string, t('customers.search.fallback.deal', 'Deal'))
         const subtitleParts: string[] = []
         if (record.pipeline_stage) subtitleParts.push(String(record.pipeline_stage))
         if (record.status) subtitleParts.push(String(record.status))
@@ -925,10 +943,10 @@ export const searchConfig: SearchModuleConfig = {
         }
 
         return {
-          title: title ?? 'Deal',
+          title: title ?? t('customers.search.fallback.deal', 'Deal'),
           subtitle: subtitleParts.length ? subtitleParts.join(' · ') : undefined,
           icon: 'briefcase',
-          badge: 'Deal',
+          badge: t('customers.search.badge.deal', 'Deal'),
         }
       },
 
@@ -939,12 +957,13 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const id = ctx.record.id
         if (!id) return null
         return [
           {
             href: `/backend/customers/deals/${encodeURIComponent(String(id))}/edit`,
-            label: 'Edit',
+            label: t('customers.search.link.edit', 'Edit'),
             kind: 'secondary',
           },
         ]
@@ -968,6 +987,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const lines: string[] = []
         if (parent?.display_name) lines.push(`Customer: ${parent.display_name}`)
@@ -976,7 +996,11 @@ export const searchConfig: SearchModuleConfig = {
         if (ctx.record.body) lines.push(`Body: ${ctx.record.body}`)
 
         const presenter: SearchResultPresenter = {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
+          title: ctx.record.subject
+            ? String(ctx.record.subject)
+            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
+                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
+              }),
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
         }
@@ -995,12 +1019,17 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
+          title: ctx.record.subject
+            ? String(ctx.record.subject)
+            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
+                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
+              }),
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
-          badge: 'Activity',
+          badge: t('customers.search.badge.activity', 'Activity'),
         }
       },
 
@@ -1012,11 +1041,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         if (ctx.record.deal_id) {
           links.push({
             href: `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`,
-            label: 'Open deal',
+            label: t('customers.search.link.openDeal', 'Open deal'),
             kind: 'secondary',
           })
         }
@@ -1064,10 +1094,11 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const todo = await getLinkedTodo(ctx) as Record<string, unknown> | null
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: (todo?.title as string | undefined) ?? 'Customer task',
+          title: (todo?.title as string | undefined) ?? t('customers.search.fallback.customerTask', 'Customer task'),
           subtitle: parent?.display_name as string | undefined,
           icon: 'check-square',
         }
@@ -1081,11 +1112,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const todoId = ctx.record.todo_id ?? ctx.record.todoId
         if (!todoId) return null
         return [{
           href: `/backend/todos/${encodeURIComponent(todoId as string)}/edit`,
-          label: 'Open todo',
+          label: t('customers.search.link.openTodo', 'Open todo'),
           kind: 'secondary',
         }]
       },

package/src/modules/data_sync/AGENTS.md

@@ -9,6 +9,7 @@ The `data_sync` module provides a streaming data synchronization hub for import/
 ## Always
 
 - **Always scope by organizationId + tenantId** — every entity query
+- **Resolve the organization in API routes with `resolveActiveOrganizationId(auth)`** from `@open-mercato/shared/lib/auth/organizationScope`, never with raw `auth.orgId` — a super-admin viewing "all organizations" has `auth.orgId === null`. The fallback is tenant-aware: it never pairs the actor organization with a foreign selected tenant. When it returns `null` for an authenticated caller, answer with `organizationScopeRequiredResponse()` (400) — never 401, which sends `apiFetch` into a session-refresh loop
 - **Use the queue system** — never run syncs inline in API handlers
 - **New sync providers MUST support provider-owned env preconfiguration** when fresh installs need credentials or default mappings/locales/channels from deployment env
 - **Persist cursor after each batch** — enables resume on failure

package/src/modules/data_sync/api/mappings/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -36,9 +37,13 @@ async function resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: s
 
 export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const parsedParams = await resolveParams(ctx)
   if (!parsedParams.success) {
@@ -47,14 +52,14 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId as string,
+      organizationId,
       tenantId: auth.tenantId,
     },
     undefined,
@@ -77,9 +82,13 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
 
 export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const parsedParams = await resolveParams(ctx)
   if (!parsedParams.success) {
@@ -94,14 +103,14 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId as string,
+      organizationId,
       tenantId: auth.tenantId,
     },
     undefined,
@@ -155,9 +164,13 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
 
 export async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const parsedParams = await resolveParams(ctx)
   if (!parsedParams.success) {
@@ -166,14 +179,14 @@ export async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId as string,
+      organizationId,
       tenantId: auth.tenantId,
     },
     undefined,

package/src/modules/data_sync/api/mappings/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -35,9 +36,13 @@ export const openApi = {
 
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const url = new URL(req.url)
   const parsed = listMappingsQuerySchema.safeParse({
@@ -53,7 +58,7 @@ export async function GET(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const where: FilterQuery<SyncMapping> = {
     organizationId: scope.organizationId,
@@ -92,9 +97,13 @@ export async function GET(req: Request) {
 
 export async function POST(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const payload = await req.json().catch(() => null)
   const parsed = createMappingSchema.safeParse(payload)
@@ -104,7 +113,7 @@ export async function POST(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const existing = await findOneWithDecryption(
     em,

package/src/modules/data_sync/api/options.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'
 import type { CredentialsService } from '../../integrations/lib/credentials-service'
@@ -17,14 +18,18 @@ export const openApi = {
 
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const container = await createRequestContainer()
   const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService
   const stateService = container.resolve('integrationStateService') as IntegrationStateService
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const items = await Promise.all(
     getAllIntegrations()

package/src/modules/data_sync/api/run.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { getIntegration } from '@open-mercato/shared/modules/integrations/types'
@@ -29,9 +30,13 @@ export const openApi = {
 export async function POST(req: Request) {
   try {
     const auth = await getAuthFromRequest(req)
-    if (!auth?.tenantId || !auth.orgId) {
+    if (!auth?.tenantId) {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
+    const organizationId = resolveActiveOrganizationId(auth)
+    if (!organizationId) {
+      return organizationScopeRequiredResponse()
+    }
 
     const payload = await readJsonSafe(req)
     const parsed = runSyncSchema.safeParse(payload)
@@ -45,7 +50,7 @@ export async function POST(req: Request) {
     const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService
 
     const scope = {
-      organizationId: auth.orgId as string,
+      organizationId,
       tenantId: auth.tenantId,
     }
 

package/src/modules/data_sync/api/runs/[id]/cancel.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { IntegrationLogService } from '../../../../integrations/lib/log-service'
 import type { IntegrationStateService } from '../../../../integrations/lib/state-service'
@@ -24,9 +25,13 @@ export const openApi = {
 
 export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')
     ? await (ctx.params as Promise<{ id?: string }>)
@@ -42,7 +47,7 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
   const progressService = container.resolve('progressService') as ProgressService
   const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService
   const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const run = await syncRunService.getRun(parsed.data.id, scope)
   if (!run) {
@@ -69,7 +74,7 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
 
   const progressCtx = {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     userId: auth.sub,
   }
 

package/src/modules/data_sync/api/runs/[id]/retry.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import type { ProgressService } from '../../../../progress/lib/progressService'
@@ -25,9 +26,13 @@ export const openApi = {
 
 export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')
     ? await (ctx.params as Promise<{ id?: string }>)
@@ -47,7 +52,7 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
   const container = await createRequestContainer()
   const syncRunService = container.resolve('dataSyncRunService') as SyncRunService
   const progressService = container.resolve('progressService') as ProgressService
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const previous = await syncRunService.getRun(parsedParams.data.id, scope)
   if (!previous) {

package/src/modules/data_sync/api/runs/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ProgressService } from '../../../../progress/lib/progressService'
 import type { SyncRunService } from '../../../lib/sync-run-service'
@@ -18,9 +19,13 @@ export const openApi = {
 
 export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {
   const auth = await getAuthFromRequest(req)
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) {
+    return organizationScopeRequiredResponse()
+  }
 
   const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')
     ? await (ctx.params as Promise<{ id?: string }>)
@@ -34,7 +39,7 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
   const container = await createRequestContainer()
   const syncRunService = container.resolve('dataSyncRunService') as SyncRunService
   const progressService = container.resolve('progressService') as ProgressService
-  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const scope = { organizationId, tenantId: auth.tenantId }
 
   const run = await syncRunService.getRun(parsed.data.id, scope)
   if (!run) {
@@ -44,7 +49,7 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
   const progressJob = run.progressJobId
     ? await progressService.getJob(run.progressJobId, {
       tenantId: auth.tenantId,
-      organizationId: auth.orgId,
+      organizationId,
       userId: auth.sub,
     })
     : null