@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/customers/api/dashboard/widgets/customer-todos/route.ts

@@ -28,7 +28,10 @@ export const metadata = {
 
 type WidgetContext = WidgetScopeContext & { limit: number }
 
-async function resolveContext(req: Request, translate: (key: string, fallback?: string) => string): Promise<WidgetContext> {
+async function resolveContext(
+  req: Request,
+  translate: (key: string, fallback?: string) => string,
+): Promise<WidgetContext> {
   const url = new URL(req.url)
   const rawQuery: Record<string, string> = {}
   for (const [key, value] of url.searchParams.entries()) {
@@ -39,16 +42,18 @@ async function resolveContext(req: Request, translate: (key: string, fallback?:
     throw new CrudHttpError(400, { error: translate('customers.errors.invalid_query', 'Invalid query parameters') })
   }
 
-  const { container, em, tenantId, organizationIds } = await resolveWidgetScope(req, translate, {
-    tenantId: parsed.data.tenantId ?? null,
-    organizationId: parsed.data.organizationId ?? null,
-  })
+  const { container, em, tenantId, organizationIds, isUnrestrictedOrganizationScope } =
+    await resolveWidgetScope(req, translate, {
+      tenantId: parsed.data.tenantId ?? null,
+      organizationId: parsed.data.organizationId ?? null,
+    })
 
   return {
     container,
     em,
     tenantId,
     organizationIds,
+    isUnrestrictedOrganizationScope,
     limit: parsed.data.limit,
   }
 }
@@ -56,7 +61,8 @@ async function resolveContext(req: Request, translate: (key: string, fallback?:
 export async function GET(req: Request) {
   const { translate } = await resolveTranslations()
   try {
-    const { container, em, tenantId, organizationIds, limit } = await resolveContext(req, translate)
+    const { container, em, tenantId, organizationIds, isUnrestrictedOrganizationScope, limit } =
+      await resolveContext(req, translate)
     const auth = {
       tenantId,
       orgId: organizationIds?.[0] ?? null,
@@ -64,6 +70,7 @@ export async function GET(req: Request) {
     }
     const flags = await resolveCustomerInteractionFeatureFlags(container, tenantId)
     const mergedWindow = Math.min(limit * 4, 50)
+    const isUnrestricted = isUnrestrictedOrganizationScope === true
     const rows = flags.unified
       ? (await listCanonicalTodoRows(
           em,
@@ -71,7 +78,7 @@ export async function GET(req: Request) {
           auth,
           organizationIds?.[0] ?? null,
           organizationIds ?? null,
-          { pagination: { page: 1, pageSize: limit } },
+          { pagination: { page: 1, pageSize: limit }, isUnrestricted },
         )).items
       : await Promise.all([
           listLegacyTodoRows(
@@ -80,7 +87,7 @@ export async function GET(req: Request) {
             tenantId,
             organizationIds ?? null,
             undefined,
-            { limit: mergedWindow },
+            { limit: mergedWindow, isUnrestricted },
           ),
           listCanonicalTodoRows(
             em,
@@ -91,6 +98,7 @@ export async function GET(req: Request) {
             {
               includeDeleted: true,
               limit: mergedWindow,
+              isUnrestricted,
             },
           ),
         ]).then(([legacyRows, canonicalRows]) =>

package/src/modules/customers/api/deals/[id]/companies/route.ts

@@ -101,8 +101,11 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
+    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+    // the parent-not-found above — so it cannot reveal that a deal exists in an
+    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
     const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -102,8 +102,11 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
+    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+    // the parent-not-found above — so it cannot reveal that a deal exists in an
+    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
     }
 
     const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }

package/src/modules/customers/api/deals/[id]/route.ts

@@ -19,10 +19,9 @@ import type { ActionLogService } from '@open-mercato/core/modules/audit_logs/ser
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'
 import { E } from '#generated/entities.ids.generated'
-import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+import { denyCustomerDetailReadAsNotFound } from '../../../lib/detailReadAccess'
 import { decryptEntitiesWithFallbackScope } from '@open-mercato/shared/lib/encryption/subscriber'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import {
@@ -47,10 +46,6 @@ function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
 
-function forbidden(message: string) {
-  return NextResponse.json({ error: message }, { status: 403 })
-}
-
 type DealAssociation = {
   id: string
   label: string
@@ -416,23 +411,10 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
   }
 
-  let rbac: RbacService | null = null
-  try {
-    rbac = (container.resolve('rbacService') as RbacService)
-  } catch {
-    rbac = null
-  }
-
-  if (!rbac || !auth?.sub) {
-    return forbidden('Access denied')
-  }
-  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-  })
-  if (!hasFeature) {
-    return forbidden('Access denied')
-  }
+  // The API dispatcher already enforces `requireFeatures: ['customers.deals.view']`
+  // against the caller's effective (selected) organization before this handler
+  // runs, so no in-route feature re-check is needed. Re-checking here against the
+  // token org (auth.orgId) would wrongly 403 org-switched callers (#5012).
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const em = (container.resolve('em') as EntityManager)
@@ -454,9 +436,16 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return notFound('Deal not found')
   }
 
-  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-    return forbidden('Access denied')
-  }
+  // Existence oracle (issue #5504): a caller who holds customers.deals.view but
+  // whose scope excludes the record's organization must get the SAME response as
+  // for a non-existent id, so 403-when-present / 404-when-absent collapses to a
+  // uniform 404 not-found. The dispatcher already returns a uniform 403 for
+  // callers who lack the feature entirely.
+  const organizationReadDenied = denyCustomerDetailReadAsNotFound(
+    { scope, auth, organizationId: deal.organizationId },
+    'Deal not found',
+  )
+  if (organizationReadDenied) return organizationReadDenied
 
   const decryptionScope = {
     tenantId: deal.tenantId ?? auth.tenantId ?? null,
@@ -977,8 +966,8 @@ export const openApi: OpenApiRouteDoc = {
       ],
       errors: [
         { status: 401, description: 'Unauthorized', schema: dealDetailErrorSchema },
-        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealDetailErrorSchema },
-        { status: 404, description: 'Deal not found', schema: dealDetailErrorSchema },
+        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: dealDetailErrorSchema },
+        { status: 404, description: 'Deal not found, or its organization is not in the caller’s scope', schema: dealDetailErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/deals/[id]/stats/route.ts

@@ -7,7 +7,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CustomerDeal, CustomerPipeline } from '../../../../data/entities'
 import { DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
-import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
@@ -24,10 +23,6 @@ function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
 
-function forbidden(message: string) {
-  return NextResponse.json({ error: message }, { status: 403 })
-}
-
 function badRequest(message: string, code?: string) {
   return NextResponse.json(
     code ? { error: message, code } : { error: message },
@@ -67,23 +62,10 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return NextResponse.json({ error: translate('customers.errors.authentication_required', 'Authentication required') }, { status: 401 })
   }
 
-  let rbac: RbacService | null = null
-  try {
-    rbac = (container.resolve('rbacService') as RbacService)
-  } catch {
-    rbac = null
-  }
-
-  if (!rbac || !auth?.sub) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
-  }
-  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-  })
-  if (!hasFeature) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
-  }
+  // The API dispatcher already enforces `requireFeatures: ['customers.deals.view']`
+  // against the caller's effective (selected) organization before this handler
+  // runs, so no in-route feature re-check is needed. Re-checking against the token
+  // org (auth.orgId) would wrongly 403 org-switched callers (#5012).
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const em = (container.resolve('em') as EntityManager)
@@ -98,8 +80,11 @@ export async function GET(request: Request, context: { params?: Record<string, u
     return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
   }
 
+  // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+  // the deal-not-found above — so it cannot reveal that a deal exists in an
+  // organization the caller cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {
-    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+    return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
   }
 
   if (!deal.closureOutcome) {
@@ -206,8 +191,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Deal is not closed', schema: dealStatsErrorSchema },
         { status: 401, description: 'Unauthorized', schema: dealStatsErrorSchema },
-        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealStatsErrorSchema },
-        { status: 404, description: 'Deal not found', schema: dealStatsErrorSchema },
+        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: dealStatsErrorSchema },
+        { status: 404, description: 'Deal not found, or its organization is not in the caller’s scope', schema: dealStatsErrorSchema },
       ],
     },
   },

package/src/modules/customers/api/deals/aggregate/route.ts

@@ -14,6 +14,7 @@ import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { fetchStuckDealIds } from '../../../lib/stuckDeals'
+import { expandDealStatusAliases } from '../../../lib/dealStatus'
 import { findMatchingEntityIdsBySearchTokensAcrossSources } from '../../utils'
 import { E } from '#generated/entities.ids.generated'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -27,7 +28,7 @@ export const metadata = {
 const querySchema = z.object({
   pipelineId: z.string().uuid().optional(),
   search: z.string().optional(),
-  status: z.array(z.enum(['open', 'closed', 'win', 'loose'])).optional(),
+  status: z.array(z.string().max(50)).max(20).optional(),
   ownerUserId: z.array(z.string().uuid()).optional(),
   personId: z.array(z.string().uuid()).optional(),
   companyId: z.array(z.string().uuid()).optional(),
@@ -247,9 +248,11 @@ export async function GET(req: Request) {
     }
   }
   if (parsed.data.status && parsed.data.status.length) {
-    const placeholders = parsed.data.status.map(() => '?').join(',')
+    // Non-empty input always expands to a non-empty set, so this always narrows.
+    const expandedStatuses = expandDealStatusAliases(parsed.data.status)
+    const placeholders = expandedStatuses.map(() => '?').join(',')
     where.push(`status IN (${placeholders})`)
-    values.push(...parsed.data.status)
+    values.push(...expandedStatuses)
   }
   if (parsed.data.ownerUserId && parsed.data.ownerUserId.length) {
     const placeholders = parsed.data.ownerUserId.map(() => '?').join(',')
@@ -265,7 +268,14 @@ export async function GET(req: Request) {
     values.push(parsed.data.expectedCloseAtTo)
   }
   if (parsed.data.isOverdue) {
-    where.push("expected_close_at < CURRENT_DATE AND status = 'open'")
+    // Mirror the list route's precedence: the caller-supplied status filter wins, and
+    // status='open' is injected only when none was provided.
+    const hasCallerStatus = !!parsed.data.status?.length
+    if (hasCallerStatus) {
+      where.push('expected_close_at < CURRENT_DATE')
+    } else {
+      where.push("expected_close_at < CURRENT_DATE AND status = 'open'")
+    }
   }
   if (parsed.data.isStuck) {
     // Reuse the list endpoint's stuck-deal lookup so kanban headers, lane counts, and the

package/src/modules/customers/api/deals/map/route.ts

@@ -545,5 +545,6 @@ export async function GET(req: Request) {
     page: query.page,
     pageSize: query.pageSize,
     totalPages: Math.ceil(res.total / (query.pageSize || 1)),
+    ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),
   })
 }

package/src/modules/customers/api/deals/route.ts

@@ -22,7 +22,9 @@ import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'
+import type { FilterGroup, FilterRule } from '@open-mercato/shared/lib/query/advanced-filter-tree'
 import { fetchStuckDealIds } from '../../lib/stuckDeals'
+import { expandDealStatusAliases } from '../../lib/dealStatus'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customers')
@@ -31,6 +33,19 @@ const rawBodySchema = z.object({}).passthrough()
 
 const stringOrStringArray = z.union([z.string(), z.array(z.string())])
 const OPEN_DEAL_STATUSES = ['open', 'in_progress'] as const
+// Tree operators whose `status` values are rewritten through the canonical vocabulary.
+// Text (`contains`/`starts_with`/…) and range (`between`) operators are left untouched
+// so a URL-supplied rule keeps its scalar semantics.
+const STATUS_TREE_OPERATORS = new Set([
+  'is',
+  'equals',
+  'is_not',
+  'not_equals',
+  'is_any_of',
+  'has_any_of',
+  'is_none_of',
+  'has_none_of',
+])
 const booleanQueryParam = z.preprocess((value) => {
   const parsed = parseBooleanFromUnknown(value)
   return parsed === null ? value : parsed
@@ -245,6 +260,39 @@ function normalizeUuidList(values: Array<unknown>): string[] {
 
 export async function buildDealListFilters(query: DealListQuery, ctx?: import('@open-mercato/shared/lib/crud/factory').CrudCtx) {
   const advancedFilterTree = consumeAdvancedFilterState(query)
+  if (advancedFilterTree) {
+    // Expand status aliases in the advanced-filter tree so List (tree path) and
+    // Kanban (plain ?status=) share the same canonical vocabulary (#5107). Only
+    // set-membership operators are rewritten — text/range operators on `status`
+    // keep their pre-existing scalar semantics instead of being corrupted.
+    const walk = (node: FilterGroup | FilterRule): void => {
+      if (node.type === 'rule' && node.field === 'status' && STATUS_TREE_OPERATORS.has(node.operator)) {
+        const listOperators = new Set(['is_any_of', 'has_any_of', 'is_none_of', 'has_none_of'])
+        const rawValues: string[] = Array.isArray(node.value)
+          ? (node.value as unknown[]).filter((v): v is string => typeof v === 'string')
+          : typeof node.value === 'string'
+            ? [node.value]
+            : []
+        if (rawValues.length === 0) return
+        const expanded = expandDealStatusAliases(rawValues)
+        if (listOperators.has(node.operator)) {
+          node.value = expanded
+        } else if (expanded.length === 1) {
+          node.value = expanded[0]
+        } else {
+          node.value = expanded
+          if (node.operator === 'is' || node.operator === 'equals') {
+            node.operator = 'is_any_of'
+          } else if (node.operator === 'is_not' || node.operator === 'not_equals') {
+            node.operator = 'is_none_of'
+          }
+        }
+      } else if (node.type === 'group') {
+        for (const child of node.children) walk(child)
+      }
+    }
+    walk(advancedFilterTree.root)
+  }
   const filters: Record<string, unknown> = {}
   let restrictedIds: string[] | null = null
 
@@ -300,7 +348,8 @@ export async function buildDealListFilters(query: DealListQuery, ctx?: import('@
     }
   }
 
-  const statusList = query.status ? normalizeStringList(query.status) : []
+  const rawStatusList = query.status ? normalizeStringList(query.status) : []
+  const statusList = expandDealStatusAliases(rawStatusList)
   if (statusList.length > 0) {
     filters.status = statusList.length === 1 ? { $eq: statusList[0] } : { $in: statusList }
   }

package/src/modules/customers/api/entity-roles-factory.ts

@@ -77,10 +77,14 @@ function ensureRouteOrganizationAccess(
   organizationId: string,
   scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],
   auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],
-  translate: Translator,
+  notFoundMessage: string,
 ) {
+  // Existence oracle (#5504): a caller who holds the feature but whose scope
+  // excludes the record's organization is denied as not-found (the same response
+  // the caller gets for a missing record), so this cannot reveal that the record
+  // exists in an organization they cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {
-    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    throw notFound(notFoundMessage)
   }
 }
 
@@ -132,7 +136,7 @@ async function resolveEntityRouteScope(
   if (!entity || entity.tenantId !== auth.tenantId) {
     throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))
   }
-  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate)
+  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate('customers.errors.customer_not_found', 'Customer not found'))
   return {
     entity,
     organizationId: entity.organizationId,
@@ -164,7 +168,7 @@ async function resolveRoleRouteScope(
   ) {
     throw notFound(translate('customers.errors.role_not_found', 'Role not found'))
   }
-  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate)
+  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate('customers.errors.role_not_found', 'Role not found'))
   return {
     role,
     organizationId: role.organizationId,

package/src/modules/customers/api/interactions/route.ts

@@ -180,7 +180,7 @@ type InteractionListRow = {
   all_day: boolean | null
   recurrence_rule: string | null
   recurrence_end: Date | null
-  participants: Array<{ userId: string; name?: string; email?: string; status?: string }> | null
+  participants: Array<{ userId?: string; name?: string; email?: string; status?: string }> | null
   reminder_minutes: number | null
   visibility: string | null
   linked_entities: Array<{ id: string; type: string; label: string }> | null
@@ -744,7 +744,13 @@ const interactionListItemSchema = z
     recurrenceEnd: z.string().nullable().optional(),
     participants: z.array(
       z.object({
-        userId: z.string().uuid(),
+        userId: z
+          .string()
+          .uuid()
+          .optional()
+          .describe(
+            'Absent for an external guest, who has no person/customer/staff record and is identified by email instead. Identify a participant by userId when present, otherwise by its normalized email.',
+          ),
         name: z.string().optional(),
         email: z.string().optional(),
         status: z.string().optional(),

package/src/modules/customers/api/interactions/tasks/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { isUnrestrictedOrganizationScope } from '@open-mercato/shared/lib/auth/organizationAccess'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import { createCustomersCrudOpenApi, createPagedListResponseSchema } from '../../openapi'
@@ -40,11 +41,30 @@ const MERGED_TASK_FETCH_CAP = 2000
 export async function GET(request: Request): Promise<Response> {
   const { translate } = await resolveTranslations()
   try {
-    const { auth, em, organizationIds, container, selectedOrganizationId } =
+    const { auth, em, organizationIds, container, selectedOrganizationId, scope } =
       await resolveCustomersRequestContext(request)
     const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams))
     const flags = await resolveCustomerInteractionFeatureFlags(container, auth.tenantId)
     const exportAll = parseBooleanToken(query.all) === true
+    const isUnrestricted = isUnrestrictedOrganizationScope({
+      isSuperAdmin: auth.isSuperAdmin === true,
+      allowedOrganizationIds: scope?.allowedIds,
+    })
+    if (!isUnrestricted && (!organizationIds || organizationIds.length === 0)) {
+      logger.warn('customers.interactions.tasks.list collapsed organization scope', {
+        tenantId: auth.tenantId,
+        organizationIds,
+        selectedId: scope?.selectedId ?? null,
+        allowedIdsCount: scope?.allowedIds?.length ?? null,
+      })
+      return NextResponse.json({
+        items: [],
+        total: 0,
+        page: exportAll ? 1 : query.page,
+        pageSize: exportAll ? 0 : query.pageSize,
+        totalPages: 1,
+      })
+    }
     const search = normalizeTodoSearch(query.search)
     const queryEngine = container.resolve('queryEngine') as QueryEngine
 
@@ -59,6 +79,7 @@ export async function GET(request: Request): Promise<Response> {
           entityId: query.entityId,
           pagination: exportAll ? null : { page: query.page, pageSize: query.pageSize },
           searchText: search,
+          isUnrestricted,
         },
       )
       const total = canonical.total
@@ -80,6 +101,7 @@ export async function GET(request: Request): Promise<Response> {
     const [legacyRows, canonicalRows] = await Promise.all([
       listLegacyTodoRows(em, queryEngine, auth.tenantId, organizationIds, query.entityId, {
         limit: legacyWindow,
+        isUnrestricted,
       }),
       listCanonicalTodoRows(
         em,
@@ -91,6 +113,7 @@ export async function GET(request: Request): Promise<Response> {
           entityId: query.entityId,
           includeDeleted: true,
           limit: legacyWindow,
+          isUnrestricted,
         },
       ),
     ])

package/src/modules/customers/api/people/[id]/companies/[linkId]/route.ts

@@ -234,7 +234,7 @@ export async function DELETE(req: Request, ctx: { params?: { id?: string; linkId
   const { translate } = await resolveTranslations()
   try {
     const { id, linkId } = paramsSchema.parse({ id: ctx.params?.id, linkId: ctx.params?.linkId })
-    const { container, auth, selectedOrganizationId, person } = await loadPersonContext(req, id)
+    const { container, auth, selectedOrganizationId, person, profile } = await loadPersonContext(req, id)
     if (!selectedOrganizationId) {
       throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })
     }
@@ -262,18 +262,26 @@ export async function DELETE(req: Request, ctx: { params?: { id?: string; linkId
       auth.tenantId,
       selectedOrganizationId,
     )
-    if (!resolvedLinkId) {
+    // No `CustomerPersonCompanyLink` row resolves for the profile-only association case
+    // (`CustomerPersonProfile.company` set without a link row, e.g. from a CRM migration).
+    // The delete command accepts that shape too, so it is dispatched instead of 404ing and
+    // the detach keeps its audit entry, undo token and cache invalidation (#5114).
+    const isProfileOnlyMatch =
+      profile.company && typeof profile.company !== 'string' && profile.company.id === linkId
+    if (!resolvedLinkId && !isProfileOnlyMatch) {
       throw notFound(translate('customers.errors.person_company_link_not_found', 'Person-company link not found'))
     }
 
     const commandInput = personCompanyLinkDeleteSchema.parse({
-      linkId: resolvedLinkId,
+      ...(resolvedLinkId
+        ? { linkId: resolvedLinkId }
+        : { personEntityId: person.id, companyEntityId: linkId }),
       tenantId: auth.tenantId,
       organizationId: selectedOrganizationId,
     } satisfies PersonCompanyLinkDeleteInput)
 
     const commandBus = container.resolve('commandBus') as CommandBus
-    const { result, logEntry } = await commandBus.execute<PersonCompanyLinkDeleteInput, { linkId: string }>(
+    const { result, logEntry } = await commandBus.execute<PersonCompanyLinkDeleteInput, { linkId: string | null }>(
       'customers.personCompanyLinks.delete',
       {
         input: commandInput,

package/src/modules/customers/api/people/[id]/companies/context.ts

@@ -38,8 +38,11 @@ export async function loadPersonContext(req: Request, personId: string) {
     throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
   }
 
+  // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+  // the parent-not-found above — so it cannot reveal that a person exists in an
+  // organization the caller cannot see.
   if (!isOrganizationReadAccessAllowed({ scope, auth: authenticatedAuth, organizationId: person.organizationId })) {
-    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
   }
 
   const profile = await findOneWithDecryption(

package/src/modules/customers/api/people/[id]/companies/enriched/route.ts

@@ -178,8 +178,11 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
     }
 
+    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
+    // the parent-not-found above — so it cannot reveal that a person exists in an
+    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: person.organizationId })) {
-      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+      throw notFound(translate('customers.errors.person_not_found', 'Person not found'))
     }
 
     const entityScope = { tenantId: auth.tenantId, organizationId: person.organizationId }

package/src/modules/customers/api/people/[id]/route.ts

@@ -38,7 +38,7 @@ import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { parseBooleanFromUnknown, parseBooleanToken } from '@open-mercato/shared/lib/boolean'
-import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+import { denyCustomerDetailReadAsNotFound } from '../../../lib/detailReadAccess'
 import { loadPersonCompanyLinks, summarizePersonCompanies } from '../../../lib/personCompanies'
 import { normalizeCustomerDetailCustomFields } from '../../detailCustomFields'
 import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
@@ -129,10 +129,6 @@ function parseIncludeParams(request: Request): Set<string> {
   return tokens
 }
 
-function forbidden(message: string) {
-  return NextResponse.json({ error: message }, { status: 403 })
-}
-
 function notFound(message: string) {
   return NextResponse.json({ error: message }, { status: 404 })
 }
@@ -542,10 +538,19 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       return notFound('Person not found')
     }
 
-    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: person.organizationId })) {
-      statusCode = 403
-      profileMeta = { reason: 'organization_forbidden' }
-      return forbidden('Access denied')
+    // Existence oracle (issue #5504): a caller who holds customers.people.view
+    // but whose scope excludes the record's organization must get the SAME
+    // response as for a non-existent id, so 403-when-present / 404-when-absent
+    // collapses to a uniform 404 not-found. The dispatcher already returns a
+    // uniform 403 for callers who lack the feature entirely.
+    const organizationReadDenied = denyCustomerDetailReadAsNotFound(
+      { scope, auth, organizationId: person.organizationId },
+      'Person not found',
+    )
+    if (organizationReadDenied) {
+      statusCode = 404
+      profileMeta = { reason: 'organization_not_in_scope' }
+      return organizationReadDenied
     }
 
     // Gated get-then-set cache. Key on the resolved person plus the effective
@@ -1337,8 +1342,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid identifier', schema: personDetailErrorSchema },
         { status: 401, description: 'Unauthorized', schema: personDetailErrorSchema },
-        { status: 403, description: 'Forbidden for tenant/organization scope', schema: personDetailErrorSchema },
-        { status: 404, description: 'Person not found', schema: personDetailErrorSchema },
+        { status: 403, description: 'Forbidden — caller lacks the required feature', schema: personDetailErrorSchema },
+        { status: 404, description: 'Person not found, or its organization is not in the caller’s scope', schema: personDetailErrorSchema },
       ],
     },
   },