@open-mercato/core 0.6.8-develop.7067.1.82e9867ea1 → 0.6.8-develop.7071.1.58862d0c9f

package/src/modules/customers/api/deals/[id]/stats/route.ts

@@ -7,7 +7,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CustomerDeal, CustomerPipeline } from '../../../../data/entities'
 import { DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
-import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
@@ -24,10 +23,6 @@ function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
 
-function forbidden(message: string) {
-  return NextResponse.json({ error: message }, { status: 403 })
-}
-
 function badRequest(message: string, code?: string) {
   return NextResponse.json(
     code ? { error: message, code } : { error: message },
@@ -67,23 +62,10 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return NextResponse.json({ error: translate('customers.errors.authentication_required', 'Authentication required') }, { status: 401 })
   }
 
-  let rbac: RbacService | null = null
-  try {
-    rbac = (container.resolve('rbacService') as RbacService)
-  } catch {
-    rbac = null
-  }
-
-  if (!rbac || !auth?.sub) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
-  }
-  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-  })
-  if (!hasFeature) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
-  }
+  // The API dispatcher already enforces `requireFeatures: ['customers.deals.view']`
+  // against the caller's effective (selected) organization before this handler
+  // runs, so no in-route feature re-check is needed. Re-checking against the token
+  // org (auth.orgId) would wrongly 403 org-switched callers (#5012).
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const em = (container.resolve('em') as EntityManager)
@@ -98,8 +80,11 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
   }
 
+  // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+  // the deal-not-found above — so it cannot reveal that a deal exists in an
+  // organization the caller cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+    return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
   }
 
   if (!deal.closureOutcome) {
@@ -206,8 +191,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Deal is not closed', schema: dealStatsErrorSchema },
         { status: 401, description: 'Unauthorized', schema: dealStatsErrorSchema },
-        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealStatsErrorSchema },
-        { status: 404, description: 'Deal not found', schema: dealStatsErrorSchema },
+        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: dealStatsErrorSchema },
+        { status: 404, description: 'Deal not found, or its organization is not in the caller’s scope', schema: dealStatsErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/entity-roles-factory.ts

@@ -77,10 +77,14 @@ function ensureRouteOrganizationAccess(
   organizationId: string,
   scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],
   auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],
-  translate: Translator,
+  notFoundMessage: string,
 ) {
+  // Existence oracle (#5504): a caller who holds the feature but whose scope
+  // excludes the record's organization is denied as not-found (the same response
+  // the caller gets for a missing record), so this cannot reveal that the record
+  // exists in an organization they cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {
-    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    throw notFound(notFoundMessage)
   }
 }
 
@@ -132,7 +136,7 @@ async function resolveEntityRouteScope(
   if (!entity || entity.tenantId !== auth.tenantId) {
     throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))
   }
-  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate)
+  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate('customers.errors.customer_not_found', 'Customer not found'))
   return {
     entity,
     organizationId: entity.organizationId,
@@ -164,7 +168,7 @@ async function resolveRoleRouteScope(
   ) {
     throw notFound(translate('customers.errors.role_not_found', 'Role not found'))
   }
-  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate)
+  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate('customers.errors.role_not_found', 'Role not found'))
   return {
     role,
     organizationId: role.organizationId,

package/src/modules/customers/api/people/[id]/companies/context.ts

@@ -38,8 +38,11 @@ export async function loadPersonContext(req: Request, personId: string) {
     throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
   }
 
+  // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+  // the parent-not-found above — so it cannot reveal that a person exists in an
+  // organization the caller cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth: authenticatedAuth, organizationId: person.organizationId })) {
-    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
   }
 
   const profile = await findOneWithDecryption(

package/src/modules/customers/api/people/[id]/companies/enriched/route.ts

@@ -178,8 +178,11 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
     }
 
+    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+    // the parent-not-found above — so it cannot reveal that a person exists in an
+    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: person.organizationId })) {
-      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+      throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
     }
 
     const entityScope = { tenantId: auth.tenantId, organizationId: person.organizationId }

package/src/modules/customers/api/people/[id]/route.ts

@@ -38,7 +38,7 @@ import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { parseBooleanFromUnknown, parseBooleanToken } from '@open-mercato/shared/lib/boolean'
-import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+import { denyCustomerDetailReadAsNotFound } from '../../../lib/detailReadAccess'
 import { loadPersonCompanyLinks, summarizePersonCompanies } from '../../../lib/personCompanies'
 import { normalizeCustomerDetailCustomFields } from '../../detailCustomFields'
 import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
@@ -129,10 +129,6 @@ function parseIncludeParams(request: Request): Set<string> {
   return tokens
 }
 
-function forbidden(message: string) {
-  return NextResponse.json({ error: message }, { status: 403 })
-}
-
 function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
@@ -542,10 +538,19 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       return notFound('Person not found')
     }
 
-    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: person.organizationId })) {
-      statusCode = 403
-      profileMeta = { reason: 'organization_forbidden' }
-      return forbidden('Access denied')
+    // Existence oracle (issue #5504): a caller who holds customers.people.view
+    // but whose scope excludes the record's organization must get the SAME
+    // response as for a non-existent id, so 403-when-present / 404-when-absent
+    // collapses to a uniform 404 not-found. The dispatcher already returns a
+    // uniform 403 for callers who lack the feature entirely.
+    const organizationReadDenied = denyCustomerDetailReadAsNotFound(
+      { scope, auth, organizationId: person.organizationId },
+      'Person not found',
+    )
+    if (organizationReadDenied) {
+      statusCode = 404
+      profileMeta = { reason: 'organization_not_in_scope' }
+      return organizationReadDenied
     }
 
     // Gated get-then-set cache. Key on the resolved person plus the effective
@@ -1337,8 +1342,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid identifier', schema: personDetailErrorSchema },
         { status: 401, description: 'Unauthorized', schema: personDetailErrorSchema },
-        { status: 403, description: 'Forbidden for tenant/organization scope', schema: personDetailErrorSchema },
-        { status: 404, description: 'Person not found', schema: personDetailErrorSchema },
+        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: personDetailErrorSchema },
+        { status: 404, description: 'Person not found, or its organization is not in the caller’s scope', schema: personDetailErrorSchema },
       ],
     },
   },

package/src/modules/customers/lib/detailReadAccess.ts

@@ -0,0 +1,35 @@
+import { NextResponse } from 'next/server'
+import {
+  isOrganizationReadAccessAllowed,
+  type OrganizationReadAccessInput,
+} from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+
+/**
+ * Single-record customers detail routes (person / company / deal) must not leak
+ * whether a record exists through the organization-scope check.
+ *
+ * The API dispatcher already enforces each route's `metadata.requireFeatures`
+ * before the handler runs, returning a uniform `403` for callers who lack the
+ * grant — so that path never distinguishes an existing id from a missing one.
+ * The only remaining existence signal is the *post-load* organization guard: a
+ * caller who holds the feature but whose scope excludes the record's
+ * organization previously received `403` (record exists in another org) while a
+ * non-existent id received `404`. That 403-vs-404 split is an existence oracle
+ * (issue #5504).
+ *
+ * Collapse the organization-scope denial into the route's own not-found
+ * response so an out-of-scope caller cannot tell "exists in an organization you
+ * cannot see" from "does not exist" — the shape the api_keys hardening
+ * (#4033 / PR-4051) established. Sharing this decision keeps the three customers
+ * detail routes from drifting apart again.
+ *
+ * @returns the `404` response to return when read access is denied, or `null`
+ * when the caller may read the record.
+ */
+export function denyCustomerDetailReadAsNotFound(
+  input: OrganizationReadAccessInput,
+  notFoundMessage: string,
+): NextResponse | null {
+  if (isOrganizationReadAccessAllowed(input)) return null
+  return NextResponse.json({ error: notFoundMessage }, { status: 404 })
+}

package/src/modules/dashboards/i18n/es.json

@@ -7,10 +7,10 @@
   "dashboards.analytics.comparison.vsLastWeek": "vs semana pasada",
   "dashboards.analytics.comparison.vsLastYear": "vs año pasado",
   "dashboards.analytics.comparison.vsMonthBefore": "vs mes anterior",
-  "dashboards.analytics.comparison.vsPrevious30Days": "vs 30 dias anteriores",
-  "dashboards.analytics.comparison.vsPrevious7Days": "vs 7 dias anteriores",
-  "dashboards.analytics.comparison.vsPrevious90Days": "vs 90 dias anteriores",
-  "dashboards.analytics.comparison.vsPreviousPeriod": "vs periodo anterior",
+  "dashboards.analytics.comparison.vsPrevious30Days": "vs 30 días anteriores",
+  "dashboards.analytics.comparison.vsPrevious7Days": "vs 7 días anteriores",
+  "dashboards.analytics.comparison.vsPrevious90Days": "vs 90 días anteriores",
+  "dashboards.analytics.comparison.vsPreviousPeriod": "vs período anterior",
   "dashboards.analytics.comparison.vsQuarterBefore": "vs trimestre anterior",
   "dashboards.analytics.comparison.vsWeekBefore": "vs semana anterior",
   "dashboards.analytics.comparison.vsYearBefore": "vs año anterior",

package/src/modules/dashboards/i18n/pl.json

@@ -2,18 +2,18 @@
   "dashboards.analytics.chartVariant.donut": "Pierścieniowy",
   "dashboards.analytics.chartVariant.pie": "Kołowy",
   "dashboards.analytics.comparison.vsDayBefore": "vs przedwczoraj",
-  "dashboards.analytics.comparison.vsLastMonth": "vs poprzedni miesiac",
-  "dashboards.analytics.comparison.vsLastQuarter": "vs poprzedni kwartal",
-  "dashboards.analytics.comparison.vsLastWeek": "vs poprzedni tydzien",
+  "dashboards.analytics.comparison.vsLastMonth": "vs poprzedni miesiąc",
+  "dashboards.analytics.comparison.vsLastQuarter": "vs poprzedni kwartał",
+  "dashboards.analytics.comparison.vsLastWeek": "vs poprzedni tydzień",
   "dashboards.analytics.comparison.vsLastYear": "vs poprzedni rok",
-  "dashboards.analytics.comparison.vsMonthBefore": "vs miesiac wczesniej",
+  "dashboards.analytics.comparison.vsMonthBefore": "vs miesiąc wcześniej",
   "dashboards.analytics.comparison.vsPrevious30Days": "vs poprzednie 30 dni",
   "dashboards.analytics.comparison.vsPrevious7Days": "vs poprzednie 7 dni",
   "dashboards.analytics.comparison.vsPrevious90Days": "vs poprzednie 90 dni",
   "dashboards.analytics.comparison.vsPreviousPeriod": "vs poprzedni okres",
-  "dashboards.analytics.comparison.vsQuarterBefore": "vs kwartal wczesniej",
-  "dashboards.analytics.comparison.vsWeekBefore": "vs tydzien wczesniej",
-  "dashboards.analytics.comparison.vsYearBefore": "vs rok wczesniej",
+  "dashboards.analytics.comparison.vsQuarterBefore": "vs kwartał wcześniej",
+  "dashboards.analytics.comparison.vsWeekBefore": "vs tydzień wcześniej",
+  "dashboards.analytics.comparison.vsYearBefore": "vs rok wcześniej",
   "dashboards.analytics.comparison.vsYesterday": "vs wczoraj",
   "dashboards.analytics.currency.unlabelled": "Kwoty pokazane bez waluty",
   "dashboards.analytics.currency.unlabelledHint": "Nie udało się wiarygodnie ustalić waluty, dlatego kwota jest wyświetlana bez jej oznaczenia.",