@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/src/modules/directory/utils/organizationScope.ts

@@ -25,7 +25,7 @@ export type { OrganizationScope }
 // (every ACL/role grant change goes through it — see buildOrgScopeUserCacheTag)
 // and per-tenant entries by the directory.organization.* subscriber plus
 // RbacService.invalidateTenantCache (role-ACL changes).
-const ORG_SCOPE_CACHE_KEY_PREFIX = 'org-scope'
+const ORG_SCOPE_CACHE_KEY_PREFIX = 'org-scope:v2'
 // Phase 4 default-off until the same readiness probe (`GET /api/customers/people`)
 // stays green with the cache layer engaged. Set `OM_ORG_SCOPE_CACHE_TTL_MS=60000`
 // (or any positive integer) to opt in once cross-request safety is re-verified.
@@ -135,6 +135,14 @@ export async function invalidateOrganizationScopeCacheForTenant(
 // dropped with the request object by the GC.
 const orgScopeRequestMemo = new WeakMap<object, Map<string, Promise<OrganizationScope>>>()
 
+type BoundFeatureScope = {
+  userId: string
+  scope: OrganizationScope
+  organizationId: string | null
+}
+
+const featureScopeRequestMemo = new WeakMap<object, BoundFeatureScope>()
+
 function getRequestScopeMemo(request: unknown): Map<string, Promise<OrganizationScope>> | null {
   if (!request || (typeof request !== 'object' && typeof request !== 'function')) return null
   const key = request as object
@@ -146,6 +154,24 @@ function getRequestScopeMemo(request: unknown): Map<string, Promise<Organization
   return memo
 }
 
+function bindFeatureScopeToRequest(request: unknown, binding: BoundFeatureScope): void {
+  if (!request || (typeof request !== 'object' && typeof request !== 'function')) return
+  featureScopeRequestMemo.set(request as object, binding)
+}
+
+function getFeatureScopeForRequest(
+  request: unknown,
+  userId: string,
+  tenantOverride: string | null | undefined,
+): BoundFeatureScope | null {
+  if (!request || (typeof request !== 'object' && typeof request !== 'function')) return null
+  const entry = featureScopeRequestMemo.get(request as object)
+  if (!entry || entry.userId !== userId) return null
+  if (tenantOverride === undefined) return entry
+  const requestedTenantId = typeof tenantOverride === 'string' ? tenantOverride.trim() : ''
+  return requestedTenantId.length > 0 && requestedTenantId === entry.scope.tenantId ? entry : null
+}
+
 function normalizeOrganizationId(value: unknown): string | null {
   if (typeof value !== 'string') return null
   const trimmed = value.trim()
@@ -308,13 +334,6 @@ export async function resolveOrganizationScope({
     allowedSet = expandWithDescendants(orgDescendants, accessibleList)
   }
 
-  if (allowedSet && allowedSet.size === 0 && fallbackOrgId) {
-    const computed = loadFallbackSet()
-    if (computed && computed.size > 0) {
-      allowedSet = computed
-    }
-  }
-
   const hasUnrestrictedAccess = effectiveSuperAdmin || (accessibleList === null)
   const noOrgSelection = normalizedSelectedId === null && !explicitAllOrgsChoice
   const widenToAllOrgs =
@@ -357,7 +376,7 @@ export async function resolveOrganizationScope({
     }
   }
 
-  if ((!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {
+  if (allowedSet === null && (!filterSet || filterSet.size === 0) && fallbackOrgId && !widenToAllOrgs) {
     const computed = loadFallbackSet()
     if (computed && computed.size > 0) {
       filterSet = computed
@@ -402,6 +421,11 @@ export async function resolveOrganizationScopeForRequest({
     return { selectedId: null, filterIds: null, allowedIds: null, tenantId: null }
   }
 
+  if (selectedId === undefined) {
+    const boundFeatureScope = getFeatureScopeForRequest(request, auth.sub, tenantOverride)
+    if (boundFeatureScope) return boundFeatureScope.scope
+  }
+
   let em: EntityManager | null = null
   let rbac: RbacService | null = null
   try { em = container.resolve<EntityManager>('em') } catch { em = null }
@@ -532,20 +556,83 @@ export async function resolveFeatureCheckContext({
   request,
   selectedId,
   tenantId,
+  requiredFeatures,
 }: {
   container: AwilixContainer
   auth: AuthContext | null | undefined
-  request?: Request | { cookies?: { get: (name: string) => { value: string } | undefined } }
+  request?: Request | {
+    cookies?: { get: (name: string) => { value: string } | undefined }
+    headers?: { get(name: string): string | null }
+  }
   selectedId?: string | null
   tenantId?: string | null
+  requiredFeatures?: readonly string[]
 }): Promise<FeatureCheckContext> {
-  const scope = await resolveOrganizationScopeForRequest({ container, auth, request, selectedId, tenantId })
+  const boundFeatureScope = auth?.sub && selectedId === undefined
+    ? getFeatureScopeForRequest(request, auth.sub, tenantId)
+    : null
+  let scope = boundFeatureScope
+    ? boundFeatureScope.scope
+    : await resolveOrganizationScopeForRequest({ container, auth, request, selectedId, tenantId })
+  const organizationId = boundFeatureScope
+    ? boundFeatureScope.organizationId
+    : resolveFeatureCheckOrganizationId(scope, auth)
+  if (
+    auth?.sub
+    && request
+    && scope.selectedId === null
+    && scope.tenantId
+    && Array.isArray(requiredFeatures)
+    && requiredFeatures.length > 0
+  ) {
+    const em = container.resolve<EntityManager>('em')
+    const rbac = container.resolve<RbacService>('rbacService')
+    const featureAccess = await rbac.resolveFeatureOrganizationAccess(
+      auth.sub,
+      requiredFeatures,
+      { tenantId: scope.tenantId },
+    )
+    if (!featureAccess.unrestricted) {
+      const organizationFilter: FilterQuery<Organization> = {
+        tenant: scope.tenantId,
+        deletedAt: null,
+        ...(Array.isArray(scope.filterIds) ? { id: { $in: scope.filterIds } } : {}),
+      }
+      const organizations = await em.find(Organization, organizationFilter, {
+        fields: ['id', 'ancestorIds'],
+      })
+      const candidateOrganizationIds = new Set(
+        organizations.map((organization) => String(organization.id)),
+      )
+      const featureOrganizationIds = featureAccess.filterOrganizationIds(
+        organizations.map((organization) => ({
+          id: String(organization.id),
+          ancestorIds: Array.isArray(organization.ancestorIds) ? organization.ancestorIds : [],
+        })),
+      )
+      const approvedOrganizationIds = Array.from(new Set(
+        featureOrganizationIds.filter((featureOrganizationId) => candidateOrganizationIds.has(featureOrganizationId)),
+      ))
+      scope = {
+        selectedId: null,
+        filterIds: approvedOrganizationIds,
+        allowedIds: approvedOrganizationIds,
+        tenantId: scope.tenantId,
+      }
+    }
+    bindFeatureScopeToRequest(request, { userId: auth.sub, scope, organizationId })
+  }
+
+  return { organizationId, scope, allowedOrganizationIds: scope.allowedIds ?? null }
+}
+
+function resolveFeatureCheckOrganizationId(
+  scope: OrganizationScope,
+  auth: AuthContext | null | undefined,
+): string | null {
   const allowedOrganizationIds = scope.allowedIds ?? null
   const authOrgId = auth?.orgId ?? null
-  const organizationId =
-    scope.selectedId
+  return scope.selectedId
     ?? (authOrgId && (!Array.isArray(allowedOrganizationIds) || allowedOrganizationIds.includes(authOrgId)) ? authOrgId : null)
     ?? (Array.isArray(allowedOrganizationIds) && allowedOrganizationIds.length ? allowedOrganizationIds[0] : null)
-
-  return { organizationId, scope, allowedOrganizationIds }
 }

package/src/modules/directory/utils/organizationScopeFilter.ts

@@ -1,4 +1,5 @@
 import type { OrganizationScope } from './organizationScope'
+export { resolveSingleOrganizationIdOrDeny } from '@open-mercato/shared/lib/auth/organizationScope'
 
 export type OrganizationScopeFilter = {
   organizationIds: string[] | undefined
@@ -14,15 +15,17 @@ export function resolveOrganizationScopeFilter(
 ): OrganizationScopeFilter {
   const organizationIds = (() => {
     if (scope?.selectedId) return [scope.selectedId]
-    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds
+    if (Array.isArray(scope?.filterIds)) return scope.filterIds
     if (scope?.filterIds === null) return undefined
-    if (auth?.orgId) return [auth.orgId]
+    if (!scope && auth?.orgId) return [auth.orgId]
     return undefined
   })()
 
+  const isExplicitlyEmpty = Array.isArray(scope?.filterIds) && scope.filterIds.length === 0
+
   return {
     organizationIds,
     where: organizationIds ? { organizationId: { $in: organizationIds } } : {},
-    rbacOrganizationId: scope?.selectedId ?? auth?.orgId ?? null,
+    rbacOrganizationId: scope?.selectedId ?? (isExplicitlyEmpty ? null : auth?.orgId ?? null),
   }
 }

package/src/modules/directory/utils/organizationScopeGuard.ts

@@ -14,20 +14,24 @@ export type OrganizationReadAccessInput = {
  * and their own i18n key.
  *
  * Unrestricted access (super admin or `scope.allowedIds === null`) is the only
- * bypass. For a restricted principal the allowed set is derived the same way
- * the detail routes always have (`filterIds` narrows the active view, else the
- * principal's home org); an empty derived set denies instead of skipping.
+ * bypass. For a resolved restricted scope, `filterIds` narrows the active view
+ * and an empty array denies. The principal's home organization remains only as
+ * the legacy fallback for callers that have no resolved scope object.
  */
 export function isOrganizationReadAccessAllowed(input: OrganizationReadAccessInput): boolean {
   const isSuperAdmin = input.auth?.isSuperAdmin === true
   if (isSuperAdmin || input.scope?.allowedIds === null) return true
 
   const allowedOrganizationIds = new Set<string>()
-  if (input.scope?.filterIds?.length) {
+  if (Array.isArray(input.scope?.filterIds)) {
     for (const id of input.scope.filterIds) {
       if (typeof id === 'string' && id.trim().length) allowedOrganizationIds.add(id)
     }
-  } else if (input.auth?.orgId) {
+  } else if (input.scope && Array.isArray(input.scope.allowedIds)) {
+    for (const id of input.scope.allowedIds) {
+      if (typeof id === 'string' && id.trim().length) allowedOrganizationIds.add(id)
+    }
+  } else if (!input.scope && input.auth?.orgId) {
     allowedOrganizationIds.add(input.auth.orgId)
   }
 

package/src/modules/entities/api/encryption.ts

@@ -5,21 +5,44 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'
 import { upsertEncryptionMapSchema } from '@open-mercato/core/modules/entities/data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import {
+  buildOptimisticLockConflictBody,
+  enforceCommandOptimisticLock,
+  readOptimisticLockExpected,
+} from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { normalizeIsoToken, parseOptimisticLockEnv } from '@open-mercato/shared/lib/crud/optimistic-lock'
+import { OPTIMISTIC_LOCK_ENV_VAR } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import {
+  EncryptionMapVersionConflictError,
+  resolveCanonicalEncryptionMap,
+  upsertCanonicalEncryptionMap,
+} from '@open-mercato/core/modules/entities/lib/encryption-maps'
 
 const ENCRYPTION_MAP_RESOURCE_KIND = 'entities.encryption_map'
 
+const logger = createLogger('entities').child({ component: 'encryption-map-api' })
+
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },
   POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },
 }
 
+function shouldEnforceVersionOnWrite(req: Request): boolean {
+  const expected = readOptimisticLockExpected(req)
+  if (!expected || normalizeIsoToken(expected) == null) return false
+  const config = parseOptimisticLockEnv(process.env[OPTIMISTIC_LOCK_ENV_VAR])
+  if (config.mode === 'off') return false
+  return config.mode === 'all' || config.entities.has(ENCRYPTION_MAP_RESOURCE_KIND)
+}
+
 function toIsoOrNull(value: Date | string | null | undefined): string | null {
   if (value == null) return null
   if (value instanceof Date) {
@@ -49,11 +72,15 @@ export async function GET(req: Request) {
     { entityId, tenantId, organizationId: null },
     { entityId, tenantId: null, organizationId: null },
   ]
-  let record: any = null
+  let record: ReturnType<typeof resolveCanonicalEncryptionMap> = null
   for (const where of candidates) {
-    const found = await repo.findOne({ ...where, deletedAt: null })
-    if (found) {
-      record = found
+    const found = await repo.find(
+      { ...where, deletedAt: null },
+      { orderBy: { createdAt: 'asc', id: 'asc' } },
+    )
+    const canonical = resolveCanonicalEncryptionMap(found)
+    if (canonical) {
+      record = canonical
       break
     }
   }
@@ -94,7 +121,11 @@ export async function POST(req: Request) {
     const organizationId = scope.selectedId
     const em = container.resolve('em') as any
     const repo = em.getRepository(EncryptionMap)
-    const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })
+    const existingRecords = await repo.find(
+      { entityId: payload.entityId, tenantId, organizationId, deletedAt: null },
+      { orderBy: { createdAt: 'asc', id: 'asc' } },
+    )
+    const existing = resolveCanonicalEncryptionMap(existingRecords)
 
     // Reject stale writes: a save started from an older tab must not silently
     // overwrite a newer encryption configuration. No-op when the client did not
@@ -125,23 +156,45 @@ export async function POST(req: Request) {
       return NextResponse.json(guardResult.body, { status: guardResult.status })
     }
 
-    let saved: any
-    if (existing) {
-      existing.fieldsJson = payload.fields
-      existing.isActive = payload.isActive ?? true
-      existing.updatedAt = new Date()
-      await em.persist(existing).flush()
-      saved = existing
-    } else {
-      const map = repo.create({
+    let saved: Awaited<ReturnType<typeof upsertCanonicalEncryptionMap>>
+    try {
+      saved = await upsertCanonicalEncryptionMap(em, {
         entityId: payload.entityId,
         tenantId,
         organizationId,
-        fieldsJson: payload.fields,
+        fields: payload.fields,
         isActive: payload.isActive ?? true,
+        // The version check above is advisory; this makes the write itself conditional so a
+        // concurrent save that lands between that read and this upsert is not overwritten.
+        expectedUpdatedAt: existing && shouldEnforceVersionOnWrite(req) ? existing.updatedAt : null,
+      })
+    } catch (err) {
+      if (err instanceof EncryptionMapVersionConflictError) {
+        const expectedIso = err.expectedUpdatedAt.toISOString()
+        const currentIso = err.currentUpdatedAt ? err.currentUpdatedAt.toISOString() : expectedIso
+        throw new CrudHttpError(409, buildOptimisticLockConflictBody(currentIso, expectedIso))
+      }
+      throw err
+    }
+
+    // The map row is committed and every reader resolves policy from it, so a failure to drop
+    // this process's per-request memo must not turn a successful write into an error response.
+    try {
+      const svc = container.resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }
+      if (!svc || typeof svc.invalidateMap !== 'function') {
+        throw new Error('[internal] Tenant encryption service cannot invalidate map caches')
+      }
+      await svc.invalidateMap(payload.entityId, tenantId, organizationId)
+    } catch (err) {
+      logger.warn('Encryption map saved but post-commit invalidation failed', {
+        entityId: payload.entityId,
+        err,
+      })
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'entities',
+        code: 'entities.encryption_map_invalidation_failed',
+        attributes: { entityId: payload.entityId },
       })
-      await em.persist(map).flush()
-      saved = map
     }
 
     if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
@@ -150,7 +203,7 @@ export async function POST(req: Request) {
         organizationId,
         userId: auth.sub,
         resourceKind: ENCRYPTION_MAP_RESOURCE_KIND,
-        resourceId: saved?.id ?? payload.entityId,
+        resourceId: saved.id,
         operation: existing ? 'update' : 'create',
         requestMethod: req.method,
         requestHeaders: req.headers,
@@ -158,14 +211,7 @@ export async function POST(req: Request) {
       })
     }
 
-    try {
-      const svc = container.resolve('tenantEncryptionService') as { invalidateMap?: (e: string, t: string | null, o: string | null) => Promise<void> }
-      await svc?.invalidateMap?.(payload.entityId, tenantId, organizationId)
-    } catch {
-      // best-effort cache bust
-    }
-
-    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved?.updatedAt) })
+    return NextResponse.json({ ok: true, updatedAt: toIsoOrNull(saved.updatedAt) })
   } catch (err) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })

package/src/modules/entities/api/records.ts

@@ -6,6 +6,7 @@ import type { QueryEngine, QueryOptions, Where, Sort } from '@open-mercato/share
 import { normalizeExportFormat, serializeExport, defaultExportFilename, ensureColumns } from '@open-mercato/shared/lib/crud/exporters'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE } from '@open-mercato/shared/lib/data/engine'
 import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
 import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
@@ -147,7 +148,7 @@ export async function GET(req: Request) {
     // registered in `custom_entities`, so classification checks the declared registry plus
     // active registrations. System (table-backed) ids are rejected above; for the allowed
     // set `isCustomEntity` drives mapRow's cf_ stripping so the edit form reads back values.
-    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null })
     if (entityKind === 'system') return systemEntityRecordsRejection(entityId)
     const isCustomEntity = entityKind === 'custom'
     await assertEntityAclForRequest({ auth, entityId, action: 'view', isCustomEntity, isRestricted, rbac })
@@ -162,7 +163,7 @@ export async function GET(req: Request) {
     // boolean back over the stored option (#5791). Consult the declared kind instead.
     const needsFieldKinds = isCustomEntity || qpEntries.some(([key]) => key.startsWith('cf_'))
     const fieldKinds = needsFieldKinds
-      ? await loadCustomFieldKinds(em, { entityId, organizationId: scope.selectedId ?? auth.orgId ?? null, tenantId: auth.tenantId ?? null })
+      ? await loadCustomFieldKinds(em, { entityId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null, tenantId: auth.tenantId ?? null })
       : new Map<string, string>()
     const isBooleanField = (key: string) => fieldKinds.get(key) === 'boolean'
     const parseBooleanField = (key: string, value: unknown) => {
@@ -385,9 +386,9 @@ export async function POST(req: Request) {
     const em = resolve('em') as any
     const rbac = resolve('rbacService') as RbacService
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
-    const targetOrgId = scope.selectedId ?? auth.orgId
+    const targetOrgId = resolveSingleOrganizationIdOrDeny(scope, auth)
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
-    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null })
     if (entityKind === 'system') return systemEntityRecordsRejection(entityId)
     const isCustomEntity = entityKind === 'custom'
     await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })
@@ -459,9 +460,9 @@ export async function PUT(req: Request) {
     const em = resolve('em') as any
     const rbac = resolve('rbacService') as RbacService
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
-    const targetOrgId = scope.selectedId ?? auth.orgId
+    const targetOrgId = resolveSingleOrganizationIdOrDeny(scope, auth)
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
-    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null })
     if (entityKind === 'system') return systemEntityRecordsRejection(entityId)
     const isCustomEntity = entityKind === 'custom'
     await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })
@@ -558,9 +559,9 @@ export async function DELETE(req: Request) {
     const em = resolve('em') as any
     const rbac = resolve('rbacService') as RbacService
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })
-    const targetOrgId = scope.selectedId ?? auth.orgId
+    const targetOrgId = resolveSingleOrganizationIdOrDeny(scope, auth)
     if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })
-    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null })
     if (entityKind === 'system') return systemEntityRecordsRejection(entityId)
     const isCustomEntity = entityKind === 'custom'
     await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })

package/src/modules/entities/cli.ts

@@ -3,6 +3,7 @@ import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryptio
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { CacheStrategy } from '@open-mercato/cache/types'
 import { CustomEntity, CustomFieldDef, EncryptionMap } from './data/entities'
+import { upsertCanonicalEncryptionMap } from './lib/encryption-maps'
 import {
   installCustomEntitiesFromModules,
   getAggregatedCustomEntityConfigs,
@@ -28,6 +29,7 @@ import {
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
 import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 import { Organization } from '../directory/data/entities'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import crypto from 'node:crypto'
 
 function parseArgs(rest: string[]) {
@@ -287,45 +289,62 @@ function getSystemScopedEntityIds(): Set<string> {
 // upgrade actions can backfill a newly-added encrypted entity for pre-existing tenants (whose maps were
 // seeded once at tenant creation and never re-run) without depending on the full CLI module registry.
 export async function upsertEncryptionMapSpecs(
-  em: any,
+  em: EntityManager,
   tenantId: string,
   organizationId: string | null,
   specs: ModuleEncryptionMap[],
   logger: (msg: string) => void = () => {},
-) {
+  onMaterializedScope?: (scope: { entityId: string; tenantId: string; organizationId: string | null }) => void | Promise<void>,
+): Promise<Array<{ entityId: string; tenantId: string; organizationId: string | null }>> {
+  const materializedScopes: Array<{ entityId: string; tenantId: string; organizationId: string | null }> = []
   for (const spec of specs) {
     if (spec.keyScope === 'system') {
       logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)
       continue
     }
-    const existing = await em.findOne(EncryptionMap, {
-      entityId: spec.entityId,
-      tenantId,
-      organizationId,
-      deletedAt: null,
-    })
-    if (existing) {
-      existing.fieldsJson = spec.fields
-      existing.isActive = true
-      existing.updatedAt = new Date()
-      logger(`🔒 Updated encryption map for ${spec.entityId} ✨`)
-      await em.persist(existing).flush()
-      continue
-    }
-    const map = em.create(EncryptionMap, {
+    await upsertCanonicalEncryptionMap(em, {
       entityId: spec.entityId,
       tenantId,
       organizationId,
-      fieldsJson: spec.fields,
+      fields: spec.fields,
       isActive: true,
     })
-    await em.persist(map).flush()
-    logger(`Created encryption map for ${spec.entityId}`)
+    const materializedScope = { entityId: spec.entityId, tenantId, organizationId }
+    materializedScopes.push(materializedScope)
+    await onMaterializedScope?.(materializedScope)
+    logger(`🔒 Seeded encryption map for ${spec.entityId} ✨`)
   }
+  return materializedScopes
+}
+
+async function upsertEncryptionMaps(
+  em: EntityManager,
+  tenantId: string,
+  organizationId: string | null,
+  logger: (msg: string) => void,
+  onMaterializedScope?: (scope: { entityId: string; tenantId: string; organizationId: string | null }) => void | Promise<void>,
+) {
+  return upsertEncryptionMapSpecs(
+    em,
+    tenantId,
+    organizationId,
+    getDefaultEncryptionMaps(resolveEncryptionMapModules()),
+    logger,
+    onMaterializedScope,
+  )
 }
 
-async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
-  await upsertEncryptionMapSpecs(em, tenantId, organizationId, getDefaultEncryptionMaps(resolveEncryptionMapModules()), logger)
+export async function invalidateEncryptionMapScopes(
+  encryptionService: Pick<TenantDataEncryptionService, 'invalidateMap'>,
+  scopes: ReadonlyArray<{ entityId: string; tenantId: string | null; organizationId: string | null }>,
+): Promise<void> {
+  const seen = new Set<string>()
+  for (const scope of scopes) {
+    const key = `${scope.entityId}\u0000${scope.tenantId ?? ''}\u0000${scope.organizationId ?? ''}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    await encryptionService.invalidateMap(scope.entityId, scope.tenantId, scope.organizationId)
+  }
 }
 
 const seedEncryptionMaps: ModuleCli = {
@@ -345,9 +364,12 @@ const seedEncryptionMaps: ModuleCli = {
     }
 
     const { resolve } = await createRequestContainer()
-    const em = resolve('em') as any
+    const em = resolve('em') as EntityManager
     const logger = (msg: string) => console.log(msg)
-    await upsertEncryptionMaps(em, tenantId, organizationId, logger)
+    const encryptionService = resolve('tenantEncryptionService') as Pick<TenantDataEncryptionService, 'invalidateMap'>
+    await upsertEncryptionMaps(em, tenantId, organizationId, logger, async (scope) => {
+      await invalidateEncryptionMapScopes(encryptionService, [scope])
+    })
     console.log('✅ Encryption maps seeded')
   },
 }

package/src/modules/entities/data/entities.ts

@@ -203,6 +203,16 @@ export class CustomEntityStorage {
   name: 'cf_values_entity_record_tenant_idx',
   properties: ['entityId', 'recordId', 'tenantId'],
 })
+// The logical key of a value row. Non-unique on purpose: a multi-value custom field
+// legitimately stores one row per selected value, all sharing this tuple, so the
+// invariant "one live row per single-value field" is enforced by the write path in
+// lib/helpers.ts rather than by a constraint. This index backs that write path's
+// scope-reconciliation lookup and the reader join, which matches entity_id +
+// record_id + field_key without pinning organization_id.
+@Index({
+  name: 'cf_values_entity_record_key_idx',
+  properties: ['entityId', 'recordId', 'fieldKey'],
+})
 export class CustomFieldValue {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -254,6 +264,11 @@ export class CustomFieldValue {
   name: 'encryption_maps_entity_scope_idx',
   properties: ['entityId', 'tenantId', 'organizationId'],
 })
+@Index({
+  name: 'encryption_maps_entity_scope_live_unique',
+  expression:
+    'create unique index "encryption_maps_entity_scope_live_unique" on "encryption_maps" ("entity_id", "tenant_id", "organization_id") nulls not distinct where deleted_at is null',
+})
 export class EncryptionMap {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string

package/src/modules/entities/lib/definition-scope.ts

@@ -1,5 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/shared/lib/auth/organizationScope'
 import { CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'
 import { createVisibleDefinitionScopeClause } from './definition-scope-where'
 
@@ -16,6 +17,8 @@ export type DefinitionMutationScope = {
 type OrganizationScopeLike = {
   tenantId?: string | null
   selectedId?: string | null
+  filterIds?: readonly string[] | null
+  allowedIds?: readonly string[] | null
 }
 
 type DefinitionKeySelector = string | { $in: string[] }
@@ -44,12 +47,13 @@ export function resolveDefinitionScopeFromOrganizationScope(
   const authTenantId = auth.tenantId ?? null
   const scopeTenantId = scope.tenantId ?? null
   const tenantMismatch = Boolean(authTenantId && scopeTenantId && authTenantId !== scopeTenantId)
+  const scopedOrganizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
   return {
     tenantId: tenantMismatch ? authTenantId : (scopeTenantId ?? authTenantId),
     organizationId: tenantMismatch
       ? (auth.orgId ?? null)
-      : (scope.selectedId ?? auth.orgId ?? null),
+      : scopedOrganizationId,
   }
 }