@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/modules/progress/api/jobs/[id]/route.ts

@@ -1,10 +1,13 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { ProgressJob } from '../../../data/entities'
 import { updateProgressSchema } from '../../../data/validators'
 import type { ProgressService } from '../../../lib/progressService'
+import {
+  hasReadableProgressScope,
+  hasWritableProgressScope,
+  resolveProgressRequestScope,
+} from '../../requestScope'
 
 const routeMetadata = {
   GET: { requireAuth: true, requireFeatures: ['progress.view'] },
@@ -21,12 +24,16 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   }
 
   const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-
-  const job = await em.findOne(ProgressJob, {
-    id: params.id,
-    tenantId: auth.tenantId,
-    ...(auth.orgId ? { organizationId: auth.orgId } : {}),
+  const scope = await resolveProgressRequestScope(container, auth, req)
+  if (!hasReadableProgressScope(scope)) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+  const progressService = container.resolve('progressService') as ProgressService
+  const job = await progressService.getJob(params.id, {
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
+    organizationIds: scope.filterIds,
+    userId: auth.sub,
   })
 
   if (!job) {
@@ -74,23 +81,23 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   }
 
   const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const existing = await em.findOne(ProgressJob, {
-    id: params.id,
-    tenantId: auth.tenantId,
-    ...(auth.orgId ? { organizationId: auth.orgId } : {}),
-  })
-  if (!existing) {
+  const scope = await resolveProgressRequestScope(container, auth, req)
+  if (!hasWritableProgressScope(scope)) {
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }
-
   const progressService = container.resolve('progressService') as ProgressService
-
-  const job = await progressService.updateProgress(params.id, parsed.data, {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+  const progressContext = {
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
+    organizationIds: scope.filterIds,
     userId: auth.sub,
-  })
+  }
+  const existing = await progressService.getJob(params.id, progressContext)
+  if (!existing) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+
+  const job = await progressService.updateProgress(params.id, parsed.data, progressContext)
 
   return NextResponse.json({ ok: true, progressPercent: job.progressPercent })
 }
@@ -103,13 +110,23 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
 
   const container = await createRequestContainer()
   const progressService = container.resolve('progressService') as ProgressService
-
+  const scope = await resolveProgressRequestScope(container, auth, req)
+  if (!hasWritableProgressScope(scope)) {
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  }
+  const progressContext = {
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
+    organizationIds: scope.filterIds,
+    userId: auth.sub,
+  }
+  // No existence pre-check here on purpose. `cancelJob` already loads the job
+  // through the SAME scoped filter and throws when it resolves to nothing, so a
+  // job outside the caller's organization scope is rejected exactly like one that
+  // does not exist — and the route keeps its documented answer for an unknown id
+  // (400 "Cannot cancel this job", TC-PROG-009) instead of a 404.
   try {
-    await progressService.cancelJob(params.id, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId,
-      userId: auth.sub,
-    })
+    await progressService.cancelJob(params.id, progressContext)
     return NextResponse.json({ ok: true })
   } catch {
     return NextResponse.json({ error: 'Cannot cancel this job' }, { status: 400 })

package/src/modules/progress/api/jobs/route.ts

@@ -12,6 +12,12 @@ import {
   createPagedListResponseSchema,
 } from '../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { buildProgressOrganizationFilter } from '../../lib/organizationScope'
+import {
+  hasReadableProgressScope,
+  hasWritableProgressScope,
+  resolveProgressRequestScope,
+} from '../requestScope'
 
 const logger = createLogger('progress').child({ component: 'jobs' })
 
@@ -87,14 +93,16 @@ export async function GET(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-
+  const scope = await resolveProgressRequestScope(container, auth, req)
   const { status, jobType, parentJobId, includeCompleted, completedSince, page, pageSize, search, sortField, sortDir } = parsed.data
-  const filter: FilterQuery<ProgressJob> = {
-    tenantId: auth.tenantId,
+
+  if (!hasReadableProgressScope(scope)) {
+    return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 1 })
   }
 
-  if (auth.orgId) {
-    filter.organizationId = auth.orgId
+  const filter: Record<string, unknown> = {
+    tenantId: scope.tenantId,
+    ...buildProgressOrganizationFilter({ organizationIds: scope.filterIds }),
   }
 
   if (status) {
@@ -129,7 +137,7 @@ export async function GET(req: Request) {
     orderBy.createdAt = 'DESC'
   }
 
-  const [rows, total] = await em.findAndCount(ProgressJob, filter, {
+  const [rows, total] = await em.findAndCount(ProgressJob, filter as FilterQuery<ProgressJob>, {
     orderBy,
     limit: pageSize,
     offset: (page - 1) * pageSize,
@@ -155,10 +163,16 @@ export async function POST(req: Request) {
 
     const container = await createRequestContainer()
     const progressService = container.resolve('progressService') as import('../../lib/progressService').ProgressService
+    const scope = await resolveProgressRequestScope(container, auth, req)
+    const hasConcreteCreateTarget = scope.selectedId !== null || scope.filterIds === null
+    if (!hasWritableProgressScope(scope) || !hasConcreteCreateTarget) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+    }
 
     const job = await progressService.createJob(parsed.data, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId,
+      tenantId: scope.tenantId,
+      organizationId: scope.selectedId ?? auth.orgId ?? null,
+      organizationIds: scope.filterIds,
       userId: auth.sub,
     })
 

package/src/modules/progress/api/requestScope.ts

@@ -0,0 +1,43 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type {
+  OrganizationScope,
+  OrganizationScopeService,
+} from '@open-mercato/shared/lib/auth/principal-service'
+
+export async function resolveProgressRequestScope(
+  container: AwilixContainer,
+  auth: NonNullable<AuthContext>,
+  request: Request,
+): Promise<OrganizationScope> {
+  const tenantId = normalizeScopeId(auth.tenantId)
+  if (tenantId === null) return deniedOrganizationScope()
+
+  const organizationScopeService = container.resolve<OrganizationScopeService>('organizationScopeService')
+  const scope = await organizationScopeService.resolveForRequest({ auth, request, tenantId })
+  if (normalizeScopeId(scope.tenantId) !== tenantId) return deniedOrganizationScope()
+
+  return { ...scope, tenantId }
+}
+
+function normalizeScopeId(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+function deniedOrganizationScope(): OrganizationScope {
+  return {
+    selectedId: null,
+    filterIds: [],
+    allowedIds: [],
+    tenantId: null,
+    selectionRejected: true,
+  }
+}
+
+export function hasReadableProgressScope(scope: OrganizationScope): scope is OrganizationScope & { tenantId: string } {
+  return scope.tenantId !== null && (scope.filterIds === null || scope.filterIds.length > 0)
+}
+
+export function hasWritableProgressScope(scope: OrganizationScope): scope is OrganizationScope & { tenantId: string } {
+  return hasReadableProgressScope(scope) && scope.selectionRejected !== true
+}

package/src/modules/progress/lib/organizationScope.ts

@@ -0,0 +1,17 @@
+export type ProgressOrganizationScope = {
+  organizationId?: string | null
+  organizationIds?: string[] | null
+}
+
+export function buildProgressOrganizationFilter(
+  scope: ProgressOrganizationScope,
+): Record<string, unknown> {
+  if (scope.organizationIds !== undefined) {
+    return scope.organizationIds === null
+      ? {}
+      : { organizationId: { $in: scope.organizationIds } }
+  }
+  return scope.organizationId
+    ? { organizationId: scope.organizationId }
+    : {}
+}

package/src/modules/progress/lib/progressService.ts

@@ -4,6 +4,7 @@ import type { CreateProgressJobInput, UpdateProgressInput, CompleteJobInput, Fai
 export interface ProgressServiceContext {
   tenantId: string
   organizationId?: string | null
+  organizationIds?: string[] | null
   userId?: string | null
 }
 
@@ -16,11 +17,11 @@ export interface ProgressService {
   failJob(jobId: string, input: FailJobInput, ctx: ProgressServiceContext): Promise<ProgressJob>
   cancelJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob>
   markCancelled(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob>
-  isCancellationRequested(jobId: string, tenantId: string, organizationId?: string | null): Promise<boolean>
+  isCancellationRequested(jobId: string, tenantId: string, organizationId?: string | null, organizationIds?: string[] | null): Promise<boolean>
   getActiveJobs(ctx: ProgressServiceContext): Promise<ProgressJob[]>
   getRecentlyCompletedJobs(ctx: ProgressServiceContext, sinceSeconds?: number): Promise<ProgressJob[]>
   getJob(jobId: string, ctx: ProgressServiceContext): Promise<ProgressJob | null>
-  markStaleJobsFailed(tenantId: string, timeoutSeconds?: number, organizationId?: string | null): Promise<number>
+  markStaleJobsFailed(tenantId: string, timeoutSeconds?: number, organizationId?: string | null, organizationIds?: string[] | null): Promise<number>
   // Optional so third-party ProgressService implementations keep compiling; callers must
   // optional-chain. Runs on a forked EntityManager, so it is safe to call while the shared
   // request/worker EM is mid-transaction (e.g. from a keepalive timer around adapter I/O).

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -13,6 +13,7 @@ import {
 } from './progressService'
 import { PROGRESS_EVENTS } from './events'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { buildProgressOrganizationFilter } from './organizationScope'
 
 const DEFAULT_BROADCAST_MIN_INTERVAL_MS = 250
 
@@ -84,7 +85,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     return {
       id: jobId,
       tenantId: ctx.tenantId,
-      ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      ...buildProgressOrganizationFilter(ctx),
     }
   }
 
@@ -92,9 +93,24 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     return em.findOne(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })
   }
 
+  function isJobWithinScope(job: ProgressJob, ctx: ProgressServiceContext): boolean {
+    if (job.tenantId !== ctx.tenantId) return false
+    if (ctx.organizationIds !== undefined) {
+      if (ctx.organizationIds === null) return true
+      return typeof job.organizationId === 'string' && ctx.organizationIds.includes(job.organizationId)
+    }
+    if (ctx.organizationId) return job.organizationId === ctx.organizationId
+    return true
+  }
+
   async function ensureThrottleEntry(jobId: string, ctx: ProgressServiceContext): Promise<JobUpdateThrottleEntry> {
     const cached = jobUpdateThrottle.get(jobId)
-    if (cached) return cached
+    if (cached) {
+      if (!isJobWithinScope(cached.job, ctx)) {
+        throw new Error(`[internal] Progress job ${jobId} not found`)
+      }
+      return cached
+    }
     const job = await em.findOneOrFail(ProgressJob, jobScopeFilter(jobId, ctx), { disableIdentityMap: true })
     const entry: JobUpdateThrottleEntry = {
       job,
@@ -255,6 +271,15 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
 
   return {
     async createJob(input, ctx) {
+      if (Array.isArray(ctx.organizationIds)) {
+        const organizationId = typeof ctx.organizationId === 'string' && ctx.organizationId.trim().length > 0
+          ? ctx.organizationId
+          : null
+        if (organizationId === null || !ctx.organizationIds.includes(organizationId)) {
+          throw new Error('[internal] Progress job creation is outside the allowed organization scope')
+        }
+      }
+
       const job = em.create(ProgressJob, {
         jobType: input.jobType,
         name: input.name,
@@ -418,7 +443,8 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         return job
       }
 
-      const entry = jobUpdateThrottle.get(jobId)
+      const cachedEntry = jobUpdateThrottle.get(jobId)
+      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : undefined
       const snapshot = entry?.job ?? job
       const now = new Date()
       const data: EntityData<ProgressJob> = {
@@ -476,7 +502,8 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         return job
       }
 
-      const entry = jobUpdateThrottle.get(jobId)
+      const cachedEntry = jobUpdateThrottle.get(jobId)
+      const entry = cachedEntry && isJobWithinScope(cachedEntry.job, ctx) ? cachedEntry : undefined
       const snapshot = entry?.job ?? job
       const now = new Date()
       const data: EntityData<ProgressJob> = {
@@ -600,6 +627,12 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       const cancelledByUserId = job.cancelledByUserId ?? ctx.userId ?? null
       const finishedAt = job.finishedAt ?? now
 
+      // Flush the throttled entry the way completeJob and failJob do. Without this a producer
+      // that writes its partial result through updateProgress immediately before cancelling
+      // loses it whenever that write landed inside the persistence throttle window, because
+      // forgetJobThrottle below discards the only copy that ever existed.
+      const entry = jobUpdateThrottle.get(jobId)
+      const snapshot = entry?.job
       const affected = await em.nativeUpdate(ProgressJob, {
         ...jobScopeFilter(jobId, ctx),
         status: { $in: CANCEL_FROM_STATUSES as ProgressJobStatus[] },
@@ -610,6 +643,13 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         finishedAt,
         etaSeconds: 0,
         updatedAt: now,
+        ...(entry && snapshot
+          ? {
+              totalCount: snapshot.totalCount ?? null,
+              meta: snapshot.meta ?? null,
+              ...buildBufferedCountData(entry),
+            }
+          : {}),
       })
       forgetJobThrottle(jobId)
 
@@ -624,16 +664,18 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       job.finishedAt = finishedAt
       job.etaSeconds = 0
 
+      const persistedJob = (await loadFreshJob(jobId, ctx)) ?? job
+
       await eventBus.emit(PROGRESS_EVENTS.JOB_CANCELLED, {
-        ...buildJobPayload(job),
+        ...buildJobPayload(persistedJob),
         tenantId: ctx.tenantId,
-        organizationId: job.organizationId ?? null,
+        organizationId: persistedJob.organizationId ?? null,
       })
 
-      return job
+      return persistedJob
     },
 
-    async isCancellationRequested(jobId, tenantId, organizationId) {
+    async isCancellationRequested(jobId, tenantId, organizationId, organizationIds) {
       // Forked EM, for the same reason touchJobHeartbeat forks: this is polled from the
       // keepalive timer, which spans the producer's own transactional writes on the shared
       // EM, so an unawaited poll would issue a SELECT into an open em.begin()/em.commit()
@@ -646,7 +688,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       const job = await findOneWithDecryption(em.fork(), ProgressJob, {
         id: jobId,
         tenantId,
-        ...(organizationId ? { organizationId } : {}),
+        ...buildProgressOrganizationFilter({ organizationId, organizationIds }),
       }, { disableIdentityMap: true })
       return job?.cancelRequestedAt != null
     },
@@ -654,7 +696,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     async getActiveJobs(ctx) {
       return em.find(ProgressJob, {
         tenantId: ctx.tenantId,
-        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+        ...buildProgressOrganizationFilter(ctx),
         status: { $in: ['pending', 'running'] },
         parentJobId: null,
       }, {
@@ -667,7 +709,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       const cutoff = new Date(Date.now() - sinceSeconds * 1000)
       return em.find(ProgressJob, {
         tenantId: ctx.tenantId,
-        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+        ...buildProgressOrganizationFilter(ctx),
         status: { $in: ['completed', 'failed'] },
         finishedAt: { $gte: cutoff },
         parentJobId: null,
@@ -681,16 +723,21 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       return em.findOne(ProgressJob, {
         id: jobId,
         tenantId: ctx.tenantId,
-        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+        ...buildProgressOrganizationFilter(ctx),
       })
     },
 
-    async markStaleJobsFailed(tenantId: string, timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS, organizationId?: string | null) {
+    async markStaleJobsFailed(
+      tenantId: string,
+      timeoutSeconds = STALE_JOB_TIMEOUT_SECONDS,
+      organizationId?: string | null,
+      organizationIds?: string[] | null,
+    ) {
       const now = new Date()
       const cutoff = new Date(now.getTime() - timeoutSeconds * 1000)
       const scope = {
         tenantId,
-        ...(organizationId ? { organizationId } : {}),
+        ...buildProgressOrganizationFilter({ organizationId, organizationIds }),
       }
       let failedCount = 0
 
@@ -713,6 +760,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         const affected = await em.nativeUpdate(ProgressJob, {
           id: job.id,
           tenantId: job.tenantId,
+          organizationId: job.organizationId ?? null,
           ...staleFilter,
         } as FilterQuery<ProgressJob>, {
           status: 'failed',
@@ -751,6 +799,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         const affected = await em.nativeUpdate(ProgressJob, {
           id: job.id,
           tenantId: job.tenantId,
+          organizationId: job.organizationId ?? null,
           ...stalePendingFilter,
         } as FilterQuery<ProgressJob>, {
           status: 'failed',

package/src/modules/push_notifications/api/custom-send/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -19,6 +20,7 @@ import {
   CUSTOM_SEND_NO_DEVICES_WARNING,
 } from '../../data/validators'
 import type { PushNotificationService } from '../../lib/send-custom-push'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('push_notifications')
 
@@ -65,7 +67,7 @@ export async function POST(req: Request) {
 
     const body = customSendSchema.parse(await readJsonSafe(req, {}))
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
 
     // Custom write route → wire the mutation-guard registry (AGENTS → API Routes). The send creates
     // append-only delivery rows; map it to a `create` on the delivery resource keyed by recipient.
@@ -131,6 +133,7 @@ export async function POST(req: Request) {
     // that key off the status code aren't told something was created when nothing was.
     return NextResponse.json(responseBody, { status: result.enqueued === 0 ? 200 : 201 })
   } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
     if (err instanceof z.ZodError) {
       return NextResponse.json(
         { error: translate('push_notifications.errors.invalid_payload', 'Invalid request'), details: err.flatten() },

package/src/modules/push_notifications/i18n/de.json

@@ -1,4 +1,5 @@
 {
+  "notifications.categories.system": "System",
   "push_notifications.deliveries.columns.attempts": "Versuche",
   "push_notifications.deliveries.columns.created": "Erstellt",
   "push_notifications.deliveries.columns.provider": "Anbieter",

package/src/modules/push_notifications/i18n/en.json

@@ -1,4 +1,5 @@
 {
+  "notifications.categories.system": "System",
   "push_notifications.deliveries.columns.attempts": "Attempts",
   "push_notifications.deliveries.columns.created": "Created",
   "push_notifications.deliveries.columns.provider": "Provider",

package/src/modules/push_notifications/i18n/es.json

@@ -1,4 +1,5 @@
 {
+  "notifications.categories.system": "Sistema",
   "push_notifications.deliveries.columns.attempts": "Intentos",
   "push_notifications.deliveries.columns.created": "Creado",
   "push_notifications.deliveries.columns.provider": "Proveedor",

package/src/modules/push_notifications/i18n/ko.json

@@ -1,4 +1,5 @@
 {
+  "notifications.categories.system": "시스템",
   "push_notifications.deliveries.columns.attempts": "시도 횟수",
   "push_notifications.deliveries.columns.created": "생성됨",
   "push_notifications.deliveries.columns.provider": "제공업체",

package/src/modules/push_notifications/i18n/pl.json

@@ -1,4 +1,5 @@
 {
+  "notifications.categories.system": "System",
   "push_notifications.deliveries.columns.attempts": "Próby",
   "push_notifications.deliveries.columns.created": "Utworzono",
   "push_notifications.deliveries.columns.provider": "Dostawca",

package/src/modules/query_index/api/status.ts

@@ -17,6 +17,7 @@ import {
   SEARCH_AUTO_INDEX_CONFIG_MODULE,
 } from '@open-mercato/shared/lib/search/auto-indexing'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'
 
 export const metadata = {
@@ -59,7 +60,7 @@ export async function GET(req: Request) {
   const db = (em as any).getKysely()
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
 
-  const organizationId = scope.selectedId ?? auth.orgId ?? null
+  const { organizationIds, rbacOrganizationId: organizationId } = resolveOrganizationScopeFilter(scope, auth)
   const tenantId = typeof scope.tenantId === 'string' && scope.tenantId.trim().length > 0
     ? scope.tenantId.trim()
     : (typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null)
@@ -67,14 +68,7 @@ export async function GET(req: Request) {
     return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })
   }
 
-  const organizationFilter =
-    scope.filterIds === null
-      ? null
-      : Array.isArray(scope.filterIds) && scope.filterIds.length > 0
-        ? scope.filterIds
-        : organizationId
-          ? [organizationId]
-          : []
+  const organizationFilter = organizationIds ?? null
 
   if (Array.isArray(organizationFilter) && organizationFilter.length === 0) {
     return NextResponse.json({ error: 'Organization access denied' }, { status: 403 })
@@ -637,6 +631,7 @@ const queryIndexStatusDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Tenant or organization context required', schema: queryIndexErrorSchema },
     { status: 401, description: 'Authentication required', schema: queryIndexErrorSchema },
+    { status: 403, description: 'Organization access denied', schema: queryIndexErrorSchema },
   ],
 }
 

package/src/modules/query_index/di.ts

@@ -7,6 +7,7 @@ import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { BasicQueryEngine } from '@open-mercato/shared/lib/query/engine'
 import { HybridQueryEngine } from './lib/engine'
+import { bindEncryptionServiceToRequest } from './lib/request-encryption'
 import {
   loadQueryIndexRowScope,
   QueryIndexScopeError,
@@ -119,7 +120,7 @@ export function register(container: AppContainer) {
       undefined,
       () => {
         try {
-          return container.resolve('tenantEncryptionService') as any
+          return bindEncryptionServiceToRequest(container.resolve('tenantEncryptionService') as any, em)
         } catch {
           return null
         }

package/src/modules/query_index/lib/engine.ts

@@ -1300,12 +1300,14 @@ export class HybridQueryEngine implements QueryEngine {
         if (encSvc?.decryptEntityPayload) {
           const decrypt = encSvc.decryptEntityPayload.bind(encSvc) as (
             entityId: EntityId, payload: Record<string, unknown>, tenantId: string | null, organizationId: string | null,
+            options?: { em?: EntityManager },
           ) => Promise<Record<string, unknown>>
           try {
             const decrypted = await decrypt(
               entity, next,
               (next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null) as string | null,
               (next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null) as string | null,
+              { em: this.em },
             )
             next = { ...next, ...decrypted }
           } catch (err) {

package/src/modules/query_index/lib/request-encryption.ts

@@ -0,0 +1,31 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+
+type DecryptOptions = { em?: EntityManager }
+
+/**
+ * Binds row decryption to the request EntityManager so a query engine that decrypts
+ * many rows resolves each encryption-policy scope once per request (the policy memo
+ * is keyed by the EntityManager) instead of once per row.
+ */
+export function bindEncryptionServiceToRequest<T extends Pick<TenantDataEncryptionService, 'decryptEntityPayload'>>(
+  service: T | null | undefined,
+  em: EntityManager,
+): T | null {
+  if (!service) return null
+  return new Proxy(service, {
+    get(target, property, receiver) {
+      if (property === 'decryptEntityPayload') {
+        return (
+          entityId: string,
+          payload: Record<string, unknown>,
+          tenantId: string | null,
+          organizationId: string | null,
+          options?: DecryptOptions,
+        ) => target.decryptEntityPayload(entityId, payload, tenantId, organizationId, { ...options, em: options?.em ?? em })
+      }
+      const value = Reflect.get(target, property, receiver)
+      return typeof value === 'function' ? value.bind(target) : value
+    },
+  })
+}