@open-mercato/core 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/auth/services/principalService.ts

@@ -0,0 +1,266 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { sql } from 'kysely'
+import type {
+  AuthPrincipalLabel,
+  AuthPrincipalRolePage,
+  AuthPrincipalService,
+  OrganizationHierarchyService,
+  PrincipalScope,
+} from '@open-mercato/shared/lib/auth/principal-service'
+import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Role, RoleAcl, User, UserRole } from '../data/entities'
+import { listSuperAdminUserIds } from '../lib/grantChecks'
+import { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from './roleOrganizationScope'
+
+const MAX_ROLE_PAGE_SIZE = 100
+const MAX_ROLE_RESULTS = 1_000
+
+type AuthPrincipalDatabase = {
+  roles: {
+    id: string
+    tenant_id: string
+    name: string
+    deleted_at: Date | null
+  }
+  role_acls: {
+    role_id: string
+    tenant_id: string
+    organizations_json: string[] | null
+    deleted_at: Date | null
+  }
+}
+
+function normalizeIds(ids: string[]): string[] {
+  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))
+}
+
+function relationId(value: unknown): string | null {
+  if (typeof value === 'string') return value.trim() || null
+  if (!value || typeof value !== 'object') return null
+  const id = (value as { id?: unknown }).id
+  return typeof id === 'string' && id.trim().length > 0 ? id.trim() : null
+}
+
+export class DefaultAuthPrincipalService implements AuthPrincipalService {
+  constructor(
+    private readonly em: EntityManager,
+    private readonly organizationHierarchyService?: OrganizationHierarchyService,
+  ) {}
+
+  async principalExists(input: {
+    type: 'user' | 'role'
+    id: string
+    scope: PrincipalScope
+  }): Promise<boolean> {
+    if (input.type === 'role') {
+      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id)
+    }
+    return Boolean(await findOneWithDecryption(
+      this.em,
+      User,
+      {
+        id: input.id,
+        tenantId: input.scope.tenantId,
+        deletedAt: null,
+        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],
+      } as FilterQuery<User>,
+      { fields: ['id'] as const },
+      input.scope,
+    ))
+  }
+
+  async resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]> {
+    const links = await findWithDecryption(
+      this.em,
+      UserRole,
+      {
+        user: userId,
+        deletedAt: null,
+        role: { tenantId: scope.tenantId, deletedAt: null },
+      } as FilterQuery<UserRole>,
+      { fields: ['role'] as const },
+      scope,
+    )
+    return this.filterActiveRoleIds(
+      normalizeIds(links.flatMap((link) => {
+        const id = relationId(link.role)
+        return id ? [id] : []
+      })),
+      scope,
+    )
+  }
+
+  async filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]> {
+    const ids = normalizeIds(roleIds)
+    if (ids.length === 0) return []
+    const roles = await findWithDecryption(
+      this.em,
+      Role,
+      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null } as FilterQuery<Role>,
+      { fields: ['id'] as const },
+      scope,
+    )
+    const activeIds = normalizeIds(roles.map((role) => role.id))
+    if (activeIds.length === 0) return []
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      scope.tenantId,
+      scope.organizationId,
+    )
+    const acls = await findWithDecryption(
+      this.em,
+      RoleAcl,
+      {
+        tenantId: scope.tenantId,
+        role: { $in: activeIds },
+        deletedAt: null,
+      } as FilterQuery<RoleAcl>,
+      { fields: ['role', 'organizationsJson'] as const },
+      scope,
+    )
+    const eligibilityById = new Map<string, boolean>()
+    for (const acl of acls) {
+      const id = relationId(acl.role)
+      if (!id) continue
+      eligibilityById.set(
+        id,
+        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope),
+      )
+    }
+    // A tenant role without an ACL remains a valid explicit-share principal.
+    // Only an existing ACL can restrict that role away from this organization.
+    return activeIds.filter((id) => eligibilityById.get(id) !== false)
+  }
+
+  async resolveLabels(input: {
+    type: 'user' | 'role'
+    ids: string[]
+    scope: PrincipalScope
+  }): Promise<AuthPrincipalLabel[]> {
+    const ids = normalizeIds(input.ids)
+    if (ids.length === 0) return []
+    if (input.type === 'role') {
+      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope)
+      if (eligibleIds.length === 0) return []
+      const roles = await findWithDecryption(
+        this.em,
+        Role,
+        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null } as FilterQuery<Role>,
+        { fields: ['id', 'name'] as const },
+        input.scope,
+      )
+      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }))
+    }
+    const users = await findWithDecryption(
+      this.em,
+      User,
+      {
+        id: { $in: ids },
+        tenantId: input.scope.tenantId,
+        deletedAt: null,
+        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],
+      } as FilterQuery<User>,
+      { fields: ['id', 'name', 'email'] as const },
+      input.scope,
+    )
+    return users.map((user) => ({
+      id: user.id,
+      label: user.name?.trim() || user.email,
+      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null,
+    }))
+  }
+
+  async queryActiveRolePage(input: {
+    scope: PrincipalScope
+    search?: string
+    excludedIds?: string[]
+    page: number
+    pageSize: number
+  }): Promise<AuthPrincipalRolePage> {
+    const page = Math.max(1, Math.floor(input.page))
+    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)))
+    const offset = (page - 1) * pageSize
+    const excludedIds = normalizeIds(input.excludedIds ?? [])
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      input.scope.tenantId,
+      input.scope.organizationId,
+    )
+    const db = this.em.getKysely<AuthPrincipalDatabase>()
+    let eligibleRoles = db
+      .selectFrom('roles as r')
+      .where('r.tenant_id', '=', input.scope.tenantId)
+      .where('r.deleted_at', 'is', null)
+
+    if (roleOrganizationScope) {
+      const allowedOrganizations = Array.from(roleOrganizationScope)
+      const organizationPredicates = [
+        sql<boolean>`ra.organizations_json is null`,
+        sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify(['__all__'])}::jsonb`,
+        ...allowedOrganizations.map((organizationId) => (
+          sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`
+        )),
+      ]
+      const organizationAllowed = sql<boolean>`(${sql.join(organizationPredicates, sql` or `)})`
+      eligibleRoles = eligibleRoles.where(sql<boolean>`(
+        not exists (
+          select 1
+          from role_acls as ra_any
+          where ra_any.role_id = r.id
+            and ra_any.tenant_id = ${input.scope.tenantId}
+            and ra_any.deleted_at is null
+        )
+        or exists (
+          select 1
+          from role_acls as ra
+          where ra.role_id = r.id
+            and ra.tenant_id = ${input.scope.tenantId}
+            and ra.deleted_at is null
+            and ${organizationAllowed}
+        )
+      )`)
+    }
+    if (input.search?.trim()) {
+      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`
+      eligibleRoles = eligibleRoles.where(sql<boolean>`r.name ilike ${searchPattern}`)
+    }
+    if (excludedIds.length > 0) {
+      eligibleRoles = eligibleRoles.where('r.id', 'not in', excludedIds)
+    }
+
+    const boundedRoleIds = eligibleRoles
+      .select('r.id')
+      .limit(MAX_ROLE_RESULTS)
+      .as('bounded_roles')
+    const countQuery = db
+      .selectFrom(boundedRoleIds)
+      .select(sql<string>`count(*)`.as('count'))
+    const pageQuery = eligibleRoles
+      .select(['r.id', 'r.name'])
+      .orderBy('r.id', 'asc')
+      .limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0)
+      .offset(Math.min(offset, MAX_ROLE_RESULTS))
+
+    const [rows, countRow] = await Promise.all([
+      pageQuery.execute() as Promise<Array<{ id: string; name: string }>>,
+      countQuery.executeTakeFirst() as Promise<{ count?: string | number } | undefined>,
+    ])
+    const parsedTotal = Number(countRow?.count ?? 0)
+    const total = Number.isFinite(parsedTotal)
+      ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal)))
+      : 0
+
+    return {
+      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),
+      page,
+      pageSize,
+      total,
+    }
+  }
+
+  async listSuperAdminUserIds(tenantId: string): Promise<string[]> {
+    return Array.from(await listSuperAdminUserIds(this.em, tenantId))
+  }
+}

package/src/modules/auth/services/rbacService.ts

@@ -4,12 +4,14 @@ import { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'
 import { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
 import { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import {
   authorizeFeatures,
   resolveEffectiveFeatures,
 } from '@open-mercato/shared/security/featurePolicy'
 import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
+import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from './roleOrganizationScope'
 
 interface AclData {
   isSuperAdmin: boolean
@@ -29,12 +31,22 @@ function isAclData(value: unknown): value is AclData {
   return true
 }
 
+function isRestrictedRoleAcl(acl: Pick<RoleAcl, 'organizationsJson'>): boolean {
+  return Array.isArray(acl.organizationsJson)
+    && acl.organizationsJson.length > 0
+    && !acl.organizationsJson.includes('__all__')
+}
+
 export class RbacService {
   private cacheTtlMs: number = 5 * 60 * 1000 // 5 minutes default
   private cache: CacheStrategy | null = null
   private globalSuperAdminCache = new Map<string, boolean>()
 
-  constructor(private em: EntityManager, cache?: CacheStrategy) {
+  constructor(
+    private em: EntityManager,
+    cache?: CacheStrategy,
+    private readonly organizationHierarchyService?: OrganizationHierarchyService,
+  ) {
     this.cache = cache || null
   }
 
@@ -51,13 +63,6 @@ export class RbacService {
     return authorizeFeatures(required, { grantedFeatures: granted })
   }
 
-  private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {
-    if (!organizationId) return true
-    const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null
-    if (!organizations || !organizations.length || organizations.includes('__all__')) return true
-    return organizations.includes(organizationId)
-  }
-
   private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {
     return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`
   }
@@ -91,6 +96,10 @@ export class RbacService {
 
     if (scope.tenantId) {
       tags.push(this.getTenantTag(scope.tenantId))
+      // Scoped role projections depend on the selected organization's ancestor
+      // chain, so Directory hierarchy changes must evict them as well as the
+      // separately cached OrganizationScope entries.
+      tags.push(buildOrgScopeTenantCacheTag(scope.tenantId))
     }
 
     if (scope.organizationId) {
@@ -203,8 +212,10 @@ export class RbacService {
       this.globalSuperAdminCache.set(userId, false)
       return false
     }
-    const roleSuper = await em.findOne(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)
-    const result = !!(roleSuper && (roleSuper as any).isSuperAdmin)
+    const roleSupers = await em.find(RoleAcl, { isSuperAdmin: true, role: { $in: roleIds as any } } as any)
+    const result = roleSupers.some((roleAcl) => (
+      !!roleAcl.isSuperAdmin && !isRestrictedRoleAcl(roleAcl)
+    ))
     this.globalSuperAdminCache.set(userId, result)
     return result
   }
@@ -239,6 +250,10 @@ export class RbacService {
     const cached = await this.getFromCache(cacheKey)
     if (cached) return cached
 
+    // Direct user-level super-admin grants and unrestricted role-level
+    // super-admin grants are global. Organization-restricted role grants are
+    // deliberately excluded by isGlobalSuperAdmin and continue through the
+    // scoped ACL projection below.
     if (!userId.startsWith('api_key:')) {
       if (await this.isGlobalSuperAdmin(userId)) {
         const result = { isSuperAdmin: true, features: ['*'], organizations: null }
@@ -258,28 +273,71 @@ export class RbacService {
       }
       const tenantId = scope.tenantId || key.tenantId || null
       const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []
+      const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0
+        ? key.organizationId.trim()
+        : null
+      const evaluatedOrganizationId = scope.organizationId || keyOrganizationId
       let isSuper = false
       const features: string[] = []
-      let organizations: string[] | null = key.organizationId ? [key.organizationId] : null
+      let roleOrganizations: string[] | null = []
+      let hasApplicableRestrictedRole = false
       if (tenantId && roleIds.length) {
+        const roleOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId,
+          evaluatedOrganizationId,
+        )
         const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any)
         for (const acl of racls) {
-          isSuper = isSuper || !!acl.isSuperAdmin
-          if (Array.isArray(acl.featuresJson)) {
-            for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)
+          if (roleAclAllowsOrganization(acl, roleOrganizationScope)) {
+            isSuper = isSuper || !!acl.isSuperAdmin
+            if (Array.isArray(acl.featuresJson)) {
+              for (const f of acl.featuresJson) if (!features.includes(f)) features.push(f)
+            }
+            if (isRestrictedRoleAcl(acl)) hasApplicableRestrictedRole = true
           }
-          if (organizations !== null) {
-            if (acl.organizationsJson == null) {
-              organizations = null
+          if (roleOrganizations !== null) {
+            if (acl.organizationsJson == null || (Array.isArray(acl.organizationsJson) && acl.organizationsJson.length === 0)) {
+              roleOrganizations = null
             } else if (Array.isArray(acl.organizationsJson) && acl.organizationsJson.includes('__all__')) {
-              organizations = null
+              roleOrganizations = null
             } else {
-              organizations = Array.from(new Set([...(organizations || []), ...acl.organizationsJson]))
+              roleOrganizations = Array.from(new Set([
+                ...roleOrganizations,
+                ...(Array.isArray(acl.organizationsJson) ? acl.organizationsJson : []),
+              ]))
             }
           }
         }
+        if (
+          roleOrganizations !== null
+          && evaluatedOrganizationId
+          && roleOrganizationScope !== null
+          && roleOrganizationScope.size > 0
+          && hasApplicableRestrictedRole
+          && !roleOrganizations.includes(evaluatedOrganizationId)
+        ) {
+          roleOrganizations.push(evaluatedOrganizationId)
+        }
+      }
+      let organizations = roleOrganizations
+      if (keyOrganizationId) {
+        const keyOrganizationScope = await resolveRoleOrganizationScope(
+          this.organizationHierarchyService,
+          tenantId,
+          keyOrganizationId,
+        )
+        organizations = roleOrganizations === null
+          || roleOrganizations.some((organizationId) => keyOrganizationScope?.has(organizationId))
+          ? [keyOrganizationId]
+          : []
       }
-      const result = { isSuperAdmin: isSuper, features, organizations }
+      // A role-level super-admin grant still respects the API key's effective
+      // organization allowlist. Represent it as a wildcard feature whenever
+      // the key is restricted so downstream super-admin shortcuts cannot
+      // bypass the key or role organization bounds.
+      if (isSuper && organizations !== null && !features.includes('*')) features.push('*')
+      const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }
       await this.setCache(cacheKey, result, userId, scope)
       return result
     }
@@ -326,18 +384,42 @@ export class RbacService {
     let isSuper = false
     const features: string[] = []
     let organizations: string[] | null = []
+    let hasApplicableRestrictedRole = false
     if (roleIds.length) {
+      const roleOrganizationScope = await resolveRoleOrganizationScope(
+        this.organizationHierarchyService,
+        tenantId,
+        scope.organizationId,
+      )
       const racls = await em.find(RoleAcl, { tenantId, role: { $in: roleIds as any } } as any, {})
       const roleAcls = Array.isArray(racls) ? racls : []
       for (const r of roleAcls) {
-        isSuper = isSuper || !!r.isSuperAdmin
-        if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)
+        if (roleAclAllowsOrganization(r, roleOrganizationScope)) {
+          isSuper = isSuper || !!r.isSuperAdmin
+          if (Array.isArray(r.featuresJson)) for (const f of r.featuresJson) if (!features.includes(f)) features.push(f)
+          if (isRestrictedRoleAcl(r)) hasApplicableRestrictedRole = true
+        }
         if (organizations !== null) {
+          // For a user principal an empty allowlist is a deny-all scope (#4033), not
+          // "unrestricted": it must merge to an empty set so scoped reads and deletes
+          // fail closed. Only an absent allowlist or an explicit '__all__' widens to
+          // every organization. (The API-key branch above deliberately differs — an
+          // empty role list there means the key inherits the key's own scope.)
           if (r.organizationsJson == null) organizations = null
           else if (Array.isArray(r.organizationsJson) && r.organizationsJson.includes('__all__')) organizations = null
           else organizations = Array.from(new Set([...(organizations || []), ...r.organizationsJson]))
         }
       }
+      if (
+        organizations !== null
+        && scope.organizationId
+        && roleOrganizationScope !== null
+        && roleOrganizationScope.size > 0
+        && hasApplicableRestrictedRole
+        && !organizations.includes(scope.organizationId)
+      ) {
+        organizations.push(scope.organizationId)
+      }
     }
     if (organizations && orgId && !organizations.includes(orgId) && !organizations.includes('__all__')) {
       // Out-of-scope org; caller will enforce
@@ -361,12 +443,16 @@ export class RbacService {
     if (!tenantId || !feature) return false
 
     const em = this.em.fork()
+    const roleOrganizationScope = await resolveRoleOrganizationScope(
+      this.organizationHierarchyService,
+      tenantId,
+      opts?.organizationId,
+    )
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})
     const list = Array.isArray(roleAcls) ? roleAcls : []
-    const organizationId = opts?.organizationId ?? null
 
     for (const acl of list) {
-      if (!this.roleAclAllowsOrganization(acl, organizationId)) continue
+      if (!roleAclAllowsOrganization(acl, roleOrganizationScope)) continue
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
       if (authorizeFeatures([feature], {
         grantedFeatures: grants,

package/src/modules/auth/services/roleOrganizationScope.ts

@@ -0,0 +1,70 @@
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import type { RoleAcl } from '../data/entities'
+
+export type RoleOrganizationScope = ReadonlySet<string> | null
+
+function normalizeId(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+export async function resolveRoleOrganizationScope(
+  hierarchyService: OrganizationHierarchyService | null | undefined,
+  tenantId: string | null | undefined,
+  organizationId: string | null | undefined,
+): Promise<RoleOrganizationScope> {
+  const selectedId = normalizeId(organizationId)
+  if (!selectedId) return null
+  const normalizedTenantId = normalizeId(tenantId)
+  if (!normalizedTenantId) return new Set()
+
+  const ids = new Set<string>([selectedId])
+  // Auth remains independently usable when Directory is disabled: exact-org
+  // grants still apply, while parent-to-descendant expansion fails closed.
+  if (!hierarchyService) return ids
+
+  const ancestorIds = await hierarchyService.resolveAncestorIds({
+    tenantId: normalizedTenantId,
+    organizationId: selectedId,
+  })
+  // A registered Directory seam can prove an invalid/wrong-tenant selection.
+  // Fail closed for restricted roles in that case.
+  if (ancestorIds === null) return new Set()
+  for (const ancestorId of ancestorIds) {
+    const normalized = normalizeId(ancestorId)
+    if (normalized) ids.add(normalized)
+  }
+  return ids
+}
+
+export function roleAclAllowsOrganization(
+  acl: Pick<RoleAcl, 'organizationsJson'>,
+  scope: RoleOrganizationScope,
+): boolean {
+  if (!scope) return true
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null
+  if (!organizations || organizations.length === 0 || organizations.includes('__all__')) return true
+  return organizations.some((organizationId) => scope.has(organizationId))
+}
+
+/**
+ * Principal eligibility — which roles may be selected as, or resolved into, an explicit share
+ * target — follows the human-principal deny-all contract instead: an empty allowlist grants no
+ * organization reach, so such a role must not become a share principal here (#4033).
+ *
+ * This deliberately differs from `roleAclAllowsOrganization` above, which governs *feature*
+ * evaluation and keeps the wider "an empty list applies everywhere" meaning, and from the
+ * API-key projection, where an empty list means "inherit the key's own organization binding".
+ * Without this split a user who reaches an organization through a second role could inherit
+ * viewer/editor access from a share assigned to a deny-all role.
+ */
+export function roleAclGrantsPrincipalOrganization(
+  acl: Pick<RoleAcl, 'organizationsJson'>,
+  scope: RoleOrganizationScope,
+): boolean {
+  if (!scope) return true
+  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null
+  if (!organizations) return true
+  if (organizations.length === 0) return false
+  if (organizations.includes('__all__')) return true
+  return organizations.some((organizationId) => scope.has(organizationId))
+}

package/src/modules/directory/di.ts

@@ -1,6 +1,18 @@
+import { asClass, asFunction } from 'awilix'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { DefaultOrganizationScopeService } from './services/organizationScopeService'
+import { DefaultOrganizationHierarchyService } from './services/organizationHierarchyService'
+
+type OrganizationScopeRbac = ConstructorParameters<typeof DefaultOrganizationScopeService>[1]
 
 export function register(container: AppContainer) {
-  // Directory module has no services yet; placeholder for future overrides
+  container.register({
+    organizationHierarchyService: asClass(DefaultOrganizationHierarchyService).scoped(),
+    organizationScopeService: asFunction((cradle: { em: EntityManager; rbacService: OrganizationScopeRbac }) =>
+      new DefaultOrganizationScopeService(cradle.em, cradle.rbacService, container),
+    )
+      .scoped()
+      .proxy(),
+  })
 }
-

package/src/modules/directory/services/organizationHierarchyService.ts

@@ -0,0 +1,34 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Organization } from '../data/entities'
+
+function normalizeIds(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  return Array.from(new Set(values
+    .map((value) => typeof value === 'string' ? value.trim() : '')
+    .filter(Boolean)))
+}
+
+export class DefaultOrganizationHierarchyService implements OrganizationHierarchyService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveAncestorIds(input: {
+    tenantId: string
+    organizationId: string
+  }): Promise<string[] | null> {
+    const organization = await findOneWithDecryption(
+      this.em,
+      Organization,
+      {
+        id: input.organizationId,
+        tenant: input.tenantId,
+        deletedAt: null,
+      } as FilterQuery<Organization>,
+      { fields: ['id', 'ancestorIds'] },
+      { tenantId: input.tenantId, organizationId: input.organizationId },
+    )
+    return organization ? normalizeIds(organization.ancestorIds) : null
+  }
+}