@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/src/modules/entities/lib/encryption-maps.ts

@@ -0,0 +1,164 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { ModuleEncryptionFieldRule } from '@open-mercato/shared/modules/encryption'
+import { forgetEncryptionPolicyMemo } from '@open-mercato/shared/lib/encryption/policyMemo'
+
+export type EncryptionMapLike = {
+  id: string
+  entityId: string
+  tenantId?: string | null
+  organizationId?: string | null
+  fieldsJson?: ModuleEncryptionFieldRule[] | null
+  isActive: boolean
+  createdAt: Date
+  updatedAt: Date
+  deletedAt?: Date | null
+}
+
+export type CanonicalEncryptionMap = EncryptionMapLike & {
+  fieldsJson: ModuleEncryptionFieldRule[]
+}
+
+export type UpsertCanonicalEncryptionMapInput = {
+  entityId: string
+  tenantId: string | null
+  organizationId: string | null
+  fields: ModuleEncryptionFieldRule[]
+  isActive: boolean
+  /**
+   * When set, an existing live row is only updated while its `updated_at` still equals this
+   * version (millisecond precision, matching the optimistic-lock token). A concurrent write that
+   * moved the version makes the upsert throw {@link EncryptionMapVersionConflictError} instead of
+   * overwriting it.
+   */
+  expectedUpdatedAt?: Date | null
+}
+
+export type UpsertedEncryptionMap = {
+  id: string
+  updatedAt: Date
+}
+
+export class EncryptionMapVersionConflictError extends Error {
+  constructor(
+    readonly expectedUpdatedAt: Date,
+    readonly currentUpdatedAt: Date | null,
+  ) {
+    super('[internal] Encryption map version changed before the conditional update')
+    this.name = 'EncryptionMapVersionConflictError'
+  }
+}
+
+function toDate(value: Date | string): Date {
+  return value instanceof Date ? value : new Date(value)
+}
+
+function orderedMaps<T extends EncryptionMapLike>(records: readonly T[]): T[] {
+  return [...records].sort((left, right) => {
+    const createdDelta = left.createdAt.getTime() - right.createdAt.getTime()
+    return createdDelta || left.id.localeCompare(right.id)
+  })
+}
+
+export function mergeEncryptionMapFields(records: readonly EncryptionMapLike[]): ModuleEncryptionFieldRule[] {
+  const merged: ModuleEncryptionFieldRule[] = []
+  const byField = new Map<string, ModuleEncryptionFieldRule>()
+  for (const record of orderedMaps(records)) {
+    for (const rule of record.fieldsJson ?? []) {
+      const field = typeof rule?.field === 'string' ? rule.field.trim() : ''
+      if (!field) continue
+      const existing = byField.get(field)
+      if (!existing) {
+        const copy = { field, hashField: typeof rule.hashField === 'string' ? rule.hashField : null }
+        byField.set(field, copy)
+        merged.push(copy)
+        continue
+      }
+      if (!existing.hashField && typeof rule.hashField === 'string' && rule.hashField) {
+        existing.hashField = rule.hashField
+      }
+    }
+  }
+  return merged
+}
+
+export function resolveCanonicalEncryptionMap<T extends EncryptionMapLike>(records: readonly T[]): CanonicalEncryptionMap | null {
+  const ordered = orderedMaps(records)
+  const canonical = ordered[0]
+  if (!canonical) return null
+  const active = ordered.filter((record) => record.isActive)
+  return {
+    ...canonical,
+    isActive: active.length > 0,
+    fieldsJson: mergeEncryptionMapFields(active.length > 0 ? active : ordered),
+  }
+}
+
+export async function upsertCanonicalEncryptionMap(
+  em: EntityManager,
+  input: UpsertCanonicalEncryptionMapInput,
+): Promise<UpsertedEncryptionMap> {
+  const expectedUpdatedAt = input.expectedUpdatedAt ?? null
+  const versionCondition = expectedUpdatedAt
+    ? `where date_trunc('milliseconds', "encryption_maps"."updated_at") = date_trunc('milliseconds', ?::timestamptz)`
+    : ''
+  const params: unknown[] = [
+    input.entityId,
+    input.tenantId,
+    input.organizationId,
+    JSON.stringify(input.fields),
+    input.isActive,
+  ]
+  if (expectedUpdatedAt) params.push(expectedUpdatedAt.toISOString())
+  const rows = await em.execute<Array<{ id: string; updated_at: Date | string }>>(
+    `
+      insert into "encryption_maps"
+        ("id", "entity_id", "tenant_id", "organization_id", "fields_json", "is_active", "created_at", "updated_at")
+      values
+        (gen_random_uuid(), ?, ?, ?, ?::jsonb, ?, now(), now())
+      on conflict ("entity_id", "tenant_id", "organization_id") where "deleted_at" is null
+      do update set
+        "fields_json" = excluded."fields_json",
+        "is_active" = excluded."is_active",
+        "updated_at" = now()
+      ${versionCondition}
+      returning "id", "updated_at"
+    `,
+    params,
+  )
+  forgetEncryptionPolicyMemo(em)
+  const saved = rows[0]
+  if (!saved?.id || !saved.updated_at) {
+    if (expectedUpdatedAt) {
+      throw new EncryptionMapVersionConflictError(
+        expectedUpdatedAt,
+        await readLiveEncryptionMapVersion(em, input),
+      )
+    }
+    throw new Error('[internal] Encryption map upsert did not return the canonical row')
+  }
+  return {
+    id: saved.id,
+    updatedAt: toDate(saved.updated_at),
+  }
+}
+
+async function readLiveEncryptionMapVersion(
+  em: EntityManager,
+  input: UpsertCanonicalEncryptionMapInput,
+): Promise<Date | null> {
+  const rows = await em.execute<Array<{ updated_at: Date | string | null }>>(
+    `
+      select "updated_at"
+      from "encryption_maps"
+      where "entity_id" = ?
+        and "tenant_id" is not distinct from ?
+        and "organization_id" is not distinct from ?
+        and "deleted_at" is null
+      order by "created_at" asc, "id" asc
+      limit 1
+    `,
+    [input.entityId, input.tenantId, input.organizationId],
+  )
+  const current = rows[0]?.updated_at
+  return current ? toDate(current) : null
+}

package/src/modules/entities/lib/helpers.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/core'
 import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
-import { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
+import { decryptCustomFieldValue, encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import {
   MAX_CUSTOM_FIELD_KEYS_PER_RECORD,
   TOO_MANY_CUSTOM_FIELDS_ERROR,
@@ -23,6 +23,17 @@ export type SetRecordCustomFieldsOptions = {
   onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void
   // Optional: re-use an existing tenant encryption service instance
   encryptionService?: TenantDataEncryptionService | null
+  // When true, additionally scope the reconciling delete/lookup by organizationId,
+  // restoring the pre-#5970 organization pin. Default false relies on `recordId`
+  // being unique across organizations for a given entityId — true for every
+  // ORM-backed entity, where recordId is the record's own primary key. That
+  // invariant does not hold for `custom_entities_storage` records written under
+  // `ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM`: the table upserts on
+  // `(entity_type, entity_id, organization_id)`, so the same id can be a live
+  // record in two organizations of one tenant, and an organization-agnostic
+  // delete could remove another organization's values (#6034 review). Callers
+  // writing those records must pass pinOrganizationId: true.
+  pinOrganizationId?: boolean
 }
 
 function columnFromKind(kind: string): keyof CustomFieldValue {
@@ -62,6 +73,26 @@ function clearValueColumns(cf: CustomFieldValue) {
   cf.valueBool = null
 }
 
+function valueFromRow(row: CustomFieldValue): Primitive {
+  if (row.valueMultiline != null) return row.valueMultiline
+  if (row.valueText != null) return row.valueText
+  if (row.valueInt != null) return row.valueInt
+  if (row.valueFloat != null) return row.valueFloat
+  if (row.valueBool != null) return row.valueBool
+  return null
+}
+
+// Keeps the value the caller's own scope already holds when the echoed array contains it,
+// so a save that never touched the field does not swap in another organization's value.
+function pickSingleValue(candidates: Primitive[], currentValue: unknown): Primitive {
+  if (currentValue != null) {
+    const kept = candidates.find((candidate) => candidate != null && String(candidate) === String(currentValue))
+    if (kept !== undefined) return kept
+  }
+  const present = candidates.filter((candidate) => candidate != null)
+  return present.length ? present[present.length - 1] : null
+}
+
 export async function setRecordCustomFields(
   em: EntityManager,
   opts: SetRecordCustomFieldsOptions,
@@ -84,6 +115,32 @@ export async function setRecordCustomFields(
     encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)
     return encryptionService
   }
+  // A write owns every value row a reader in ITS OWN tenant scope could return for this
+  // record: same logical key (entityId, recordId, fieldKey), any organization, and either
+  // the caller's tenant or the instance-global NULL tenant — exactly what the Query Engine
+  // matches. Organization is left out because the Query Engine's value join does not filter
+  // it (engine.ts, the cf join and the EXISTS subquery), so a row from a scope the record
+  // has left is indistinguishable from the live one (#5970). The query-index reader does
+  // scope organization_id, but it never sees another organization's row for a record it is
+  // indexing, so dropping the column here cannot widen what it returns.
+  //
+  // This relies on recordId being unique across organizations and tenants for a given
+  // entityId — true of every ORM-backed caller, which passes the record's own primary key.
+  // A caller that passed a per-organization natural key — or a recordId that is only unique
+  // WITHIN an organization, as custom_entities_storage's EAV backcompat writes are — would
+  // have one organization's write delete another's live rows. Those callers opt into
+  // pinOrganizationId (see SetRecordCustomFieldsOptions) to restore the organization pin.
+  //
+  // Scope of the delete, precisely: another TENANT's own rows are never touched. Rows with a
+  // NULL tenant are, deliberately — they are instance-global and answer every tenant's reads,
+  // so leaving one behind would reproduce the very duplicate this reconciles. Spelled as an
+  // explicit $or rather than `$in: [tenantId, null]` because SQL `IN (NULL)` never matches a
+  // NULL row.
+  const tenantScopeFilter = { $or: [{ tenantId }, { tenantId: null }] }
+  const pinOrganizationId = opts.pinOrganizationId === true
+  const reconcileScopeFilter = pinOrganizationId
+    ? { organizationId, ...tenantScopeFilter }
+    : tenantScopeFilter
   const keys = Object.keys(values)
   const presentKeyCount = keys.filter((key) => values[key] !== undefined).length
   if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {
@@ -120,7 +177,13 @@ export async function setRecordCustomFields(
 
     const def = defsByKey?.get(fieldKey)
     const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)
-    const isArray = Array.isArray(raw)
+    // A single-value definition never stores an array. One arrives when the detail read
+    // returned the duplicate rows #5970 left behind as an array and a form echoed it back
+    // unchanged; treating it as a multi-value replacement re-creates every duplicate under
+    // the caller's organization (#6468). Collapse it to one value so the scalar branch
+    // below reconciles the duplicates away.
+    const collapseToSingle = Array.isArray(raw) && Boolean(def) && (def as any).configJson?.multi !== true
+    const isArray = Array.isArray(raw) && !collapseToSingle
     // When array (multi-value): replace all existing rows for the key. Delete
     // first, then create replacements, all inside the transaction opened above.
     // Creating rows before a native delete can auto-flush and delete the new
@@ -129,7 +192,13 @@ export async function setRecordCustomFields(
     // the replacement atomic without letting old-row cleanup target new rows.
     if (isArray) {
       const arr = raw as Primitive[]
-      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
+      // Reconciling delete (see tenantScopeFilter/reconcileScopeFilter): pinning
+      // organizationId here left the rows written under the record's PREVIOUS
+      // organization alive next to the replacements, and the Query Engine's value join
+      // does not filter organization_id, so both generations answered the same lookup
+      // (#5970) — unless the caller opted into pinOrganizationId because its recordId
+      // is not unique across organizations.
+      await em.nativeDelete(CustomFieldValue, { entityId, recordId, fieldKey, ...reconcileScopeFilter })
       for (const val of arr) {
         const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)
         const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })
@@ -150,12 +219,30 @@ export async function setRecordCustomFields(
       continue
     }
 
-    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)
+    // Same reconciliation as the multi-value branch (see tenantScopeFilter): load every
+    // reachable row for the logical key, reuse the one already in the caller's exact
+    // scope and drop the rest, so a row left behind by a previous organization — and
+    // same-scope duplicates from two writes that both missed the lookup — cannot
+    // survive (#5970). Picking the survivor in JS rather than narrowing the query keeps
+    // NULL organizations out of SQL three-valued logic, where an inequality predicate
+    // would silently spare exactly the stale rows this is meant to remove.
+    const existingRows = await em.find(CustomFieldValue, { entityId, recordId, fieldKey, ...reconcileScopeFilter })
+    // A soft-deleted row is never the survivor: writing the new value onto it would leave
+    // deleted_at set, hiding the field from loadCustomFieldValues while the live row it
+    // replaced goes into staleIds. Tombstones still get deleted as stale — the Query
+    // Engine's join does not filter deleted_at, so one left behind would answer reads.
+    let cf = existingRows.find((row) => !row.deletedAt
+      && (row.organizationId ?? null) === organizationId
+      && (row.tenantId ?? null) === tenantId) ?? null
+    const value: Primitive = collapseToSingle
+      ? pickSingleValue(raw as Primitive[], cf ? await decryptCustomFieldValue(valueFromRow(cf), tenantId, encrypted ? getEncryptionService() : null, encryptionCache, { kind: def?.kind ?? null }) : undefined)
+      : raw as Primitive
+    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(value)
     const storedValue = encrypted
-      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache, { entityId, fieldKey })
-      : raw
-
-    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })
+      ? await encryptCustomFieldValue(value, tenantId, getEncryptionService(), encryptionCache, { entityId, fieldKey })
+      : value
+    const staleIds = existingRows.filter((row) => row !== cf).map((row) => row.id)
+    if (staleIds.length) await em.nativeDelete(CustomFieldValue, { id: { $in: staleIds } })
     if (!cf) {
       cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })
       toPersist.push(cf)

package/src/modules/entities/migrations/.snapshot-open-mercato.json

@@ -775,6 +775,18 @@
           "primary": false,
           "unique": false
         },
+        {
+          "keyName": "cf_values_entity_record_key_idx",
+          "columnNames": [
+            "entity_id",
+            "record_id",
+            "field_key"
+          ],
+          "composite": true,
+          "constraint": false,
+          "primary": false,
+          "unique": false
+        },
         {
           "keyName": "custom_field_values_pkey",
           "columnNames": [
@@ -894,6 +906,15 @@
           "primary": false,
           "unique": false
         },
+        {
+          "keyName": "encryption_maps_entity_scope_live_unique",
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"encryption_maps_entity_scope_live_unique\" on \"encryption_maps\" (\"entity_id\", \"tenant_id\", \"organization_id\") nulls not distinct where deleted_at is null"
+        },
         {
           "keyName": "encryption_maps_pkey",
           "columnNames": [

package/src/modules/entities/migrations/.snapshot-openmercato.json

@@ -765,6 +765,18 @@
           "primary": false,
           "unique": false
         },
+        {
+          "keyName": "cf_values_entity_record_key_idx",
+          "columnNames": [
+            "entity_id",
+            "record_id",
+            "field_key"
+          ],
+          "composite": true,
+          "constraint": false,
+          "primary": false,
+          "unique": false
+        },
         {
           "keyName": "custom_field_values_pkey",
           "columnNames": [

package/src/modules/entities/migrations/Migration20260910120000.ts

@@ -0,0 +1,42 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// Index the logical key of a custom field value: (entity_id, record_id, field_key).
+// `setRecordCustomFields` now reconciles every row for that key on write so a record whose
+// organization/tenant scope changed cannot keep the previous scope's row alive (#5970), and this
+// index is what makes that lookup — and the reader join, which matches the same three columns
+// without pinning organization_id — an index scan instead of a sequential one. The existing
+// `cf_values_entity_record_tenant_idx` cannot serve it: field_key is not in that index and its
+// third column is tenant_id, which the logical-key lookup deliberately does not filter on.
+//
+// Non-unique on purpose. A multi-value custom field legitimately stores one row per selected
+// value, all sharing (entity_id, record_id, field_key, organization_id, tenant_id) and differing
+// only in the value column, so a UNIQUE index on the logical key would reject every multi-select
+// write. The "one live row per single-value field" invariant is therefore enforced in the write
+// path rather than by a constraint.
+//
+// custom_field_values is the EAV values table — one row per custom field per record, and a write
+// on every record save — so the index is built CONCURRENTLY. A plain CREATE INDEX takes a SHARE
+// lock that blocks every INSERT/UPDATE/DELETE on the table, and inside a transactional migration
+// that lock is held until the whole migration commits, not just for the build. CREATE INDEX
+// CONCURRENTLY cannot run inside a transaction, hence isTransactional() => false; the migration
+// runner applies migrations one-by-one, so the opt-out is safe. Drop first so retrying a failed
+// concurrent build removes PostgreSQL's invalid index stub instead of letting IF NOT EXISTS
+// silently accept it: a half-built concurrent index is left INVALID, the planner ignores it, and
+// IF NOT EXISTS would report success while the table stays unindexed. Same shape as
+// Migration20260821120000_sales_notes_addresses_context_idx.
+export class Migration20260910120000 extends Migration {
+
+  override isTransactional(): boolean {
+    return false;
+  }
+
+  override async up(): Promise<void> {
+    this.addSql(`drop index concurrently if exists "cf_values_entity_record_key_idx";`);
+    this.addSql(`create index concurrently if not exists "cf_values_entity_record_key_idx" on "custom_field_values" ("entity_id", "record_id", "field_key");`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index concurrently if exists "cf_values_entity_record_key_idx";`);
+  }
+
+}

package/src/modules/entities/migrations/Migration20261004120000_encryption_map_scope_uniqueness.ts

@@ -0,0 +1,130 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export const ENCRYPTION_MAP_SCOPE_UNIQUE_INDEX = 'encryption_maps_entity_scope_live_unique'
+
+export class Migration20261004120000_encryption_map_scope_uniqueness extends Migration {
+  override async up(): Promise<void> {
+    this.addSql(`
+      with live_maps as (
+        select
+          map.*,
+          count(*) over (
+            partition by map."entity_id", map."tenant_id", map."organization_id"
+          ) as duplicate_count,
+          bool_or(map."is_active") over (
+            partition by map."entity_id", map."tenant_id", map."organization_id"
+          ) as any_active,
+          row_number() over (
+            partition by map."entity_id", map."tenant_id", map."organization_id"
+            order by map."created_at" asc, map."id" asc
+          ) as canonical_rank
+        from "encryption_maps" map
+        where map."deleted_at" is null
+      ),
+      field_occurrences as (
+        select
+          live."entity_id",
+          live."tenant_id",
+          live."organization_id",
+          live."created_at",
+          live."id" as row_id,
+          field.ordinality,
+          btrim(field.value ->> 'field') as field_name,
+          nullif(field.value ->> 'hashField', '') as hash_field
+        from live_maps live
+        cross join lateral jsonb_array_elements(
+          case
+            when jsonb_typeof(live."fields_json") = 'array' then live."fields_json"
+            else '[]'::jsonb
+          end
+        ) with ordinality as field(value, ordinality)
+        where live.duplicate_count > 1
+          and (not live.any_active or live."is_active")
+          and jsonb_typeof(field.value) = 'object'
+          and btrim(coalesce(field.value ->> 'field', '')) <> ''
+      ),
+      field_choices as (
+        select
+          occurrence."entity_id",
+          occurrence."tenant_id",
+          occurrence."organization_id",
+          occurrence.field_name,
+          (array_agg(
+            occurrence.hash_field
+            order by
+              (occurrence.hash_field is null) asc,
+              occurrence."created_at" asc,
+              occurrence.row_id asc,
+              occurrence.ordinality asc
+          ))[1] as hash_field
+        from field_occurrences occurrence
+        group by
+          occurrence."entity_id",
+          occurrence."tenant_id",
+          occurrence."organization_id",
+          occurrence.field_name
+      ),
+      field_sets as (
+        select
+          choice."entity_id",
+          choice."tenant_id",
+          choice."organization_id",
+          jsonb_agg(
+            jsonb_strip_nulls(jsonb_build_object('field', choice.field_name, 'hashField', choice.hash_field))
+            order by choice.field_name asc
+          ) as fields_json
+        from field_choices choice
+        group by choice."entity_id", choice."tenant_id", choice."organization_id"
+      )
+      update "encryption_maps" canonical
+      set
+        "fields_json" = coalesce(fields.fields_json, '[]'::jsonb),
+        "is_active" = live.any_active,
+        "updated_at" = now()
+      from live_maps live
+      left join field_sets fields
+        on fields."entity_id" = live."entity_id"
+        and fields."tenant_id" is not distinct from live."tenant_id"
+        and fields."organization_id" is not distinct from live."organization_id"
+      where canonical."id" = live."id"
+        and live.duplicate_count > 1
+        and live.canonical_rank = 1;
+    `)
+
+    this.addSql(`
+      with live_maps as (
+        select
+          map."id",
+          count(*) over (
+            partition by map."entity_id", map."tenant_id", map."organization_id"
+          ) as duplicate_count,
+          row_number() over (
+            partition by map."entity_id", map."tenant_id", map."organization_id"
+            order by map."created_at" asc, map."id" asc
+          ) as canonical_rank
+        from "encryption_maps" map
+        where map."deleted_at" is null
+      )
+      update "encryption_maps" duplicate
+      set
+        "is_active" = false,
+        "deleted_at" = now(),
+        "updated_at" = now()
+      from live_maps live
+      where duplicate."id" = live."id"
+        and live.duplicate_count > 1
+        and live.canonical_rank > 1;
+    `)
+
+    this.addSql(`
+      create unique index "${ENCRYPTION_MAP_SCOPE_UNIQUE_INDEX}"
+      on "encryption_maps" ("entity_id", "tenant_id", "organization_id")
+      nulls not distinct
+      where "deleted_at" is null;
+    `)
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "${ENCRYPTION_MAP_SCOPE_UNIQUE_INDEX}";`)
+  }
+}

package/src/modules/eudr/api/dashboard/widgets/compliance-overview/route.ts

@@ -7,6 +7,7 @@ import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/er
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import {
   EudrDueDiligenceStatement,
@@ -53,7 +54,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('eudr.errors.organization_required', 'Organization context is required'),

package/src/modules/eudr/api/plots/import/route.ts

@@ -3,6 +3,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -107,7 +108,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('eudr.errors.organization_required', 'Organization context is required'),

package/src/modules/eudr/api/product-mappings/suggestions/apply/route.ts

@@ -3,6 +3,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -130,7 +131,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('eudr.errors.organization_required', 'Organization context is required'),

package/src/modules/eudr/api/product-mappings/suggestions/route.ts

@@ -7,6 +7,7 @@ import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/er
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import { E } from '#generated/entities.ids.generated'
 import { EudrProductMapping } from '../../../data/entities'
@@ -44,7 +45,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('eudr.errors.organization_required', 'Organization context is required'),

package/src/modules/eudr/api/reports/annual/route.ts

@@ -9,6 +9,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import {
   accumulateSupplementaryQuantities,
   annualReportSchema,
@@ -114,7 +115,7 @@ async function resolveRequestContext(request: Request): Promise<RequestContext>
   const organizationIds = Array.isArray(organizationScope.filterIds)
     ? organizationScope.filterIds
     : null
-  const featureOrganizationId = organizationScope.selectedId ?? auth.orgId ?? null
+  const featureOrganizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null
   const tenantId = auth.tenantId
   const userId = auth.sub ?? null
   const em = container.resolve('em') as EntityManager

package/src/modules/eudr/api/statements/[id]/export/route.ts

@@ -10,6 +10,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import {
   EudrDueDiligenceStatement,
   EudrEvidenceSubmission,
@@ -267,7 +268,7 @@ async function loadExportData(req: NextRequest, id: string) {
     if (Array.isArray(orgScope?.filterIds)) {
       statementFilter.organizationId = { $in: orgScope.filterIds }
     } else {
-      const organizationId = orgScope?.selectedId ?? auth.orgId
+      const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth)
       if (!organizationId) {
         return { response: Response.json({ error: translate('eudr.errors.forbidden', 'Forbidden') }, { status: 403 }) }
       }