@open-mercato/core 0.9.1-develop.7519.1.38f51f8dbb → 0.9.1-develop.7532.1.8eac7e198f

package/src/modules/customer_accounts/api/login.ts

@@ -8,6 +8,7 @@ import { CustomerUserService } from '@open-mercato/core/modules/customer_account
 import { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
 import {
@@ -28,6 +29,10 @@ export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth:
 // so account existence cannot be inferred from a timing side channel. Mirrors signup.ts.
 const TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'
 
+function reportLoginEventError(error: unknown): void {
+  getTelemetryRuntime()?.reportError(error, { module: 'customer_accounts', code: 'customer_accounts.login_event_failed' })
+}
+
 export async function POST(req: Request) {
   let body: unknown
   try {
@@ -77,26 +82,26 @@ export async function POST(req: Request) {
   // conveyed out-of-band (e.g. email), never in the synchronous response.
   if (!user || !user.passwordHash) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (!user.isActive) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'inactive', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'inactive', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   if (customerUserService.checkLockout(user)) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
   const passwordValid = await customerUserService.verifyPassword(user, password)
   if (!passwordValid) {
     await customerUserService.incrementFailedAttempts(user)
-    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
@@ -105,11 +110,14 @@ export async function POST(req: Request) {
       email,
       reason: 'email_not_verified',
       tenantId,
-    }).catch(() => undefined)
+    }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
   }
 
-  await customerUserService.resetFailedAttempts(user)
+  if (!(await customerUserService.resetFailedAttemptsUnlessLocked(user))) {
+    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(reportLoginEventError)
+    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })
+  }
   await customerUserService.updateLastLoginAt(user)
 
   if (compoundKey) {
@@ -130,7 +138,7 @@ export async function POST(req: Request) {
     email: user.email,
     tenantId,
     organizationId: user.organizationId,
-  }).catch(() => undefined)
+  }).catch(reportLoginEventError)
 
   const res = NextResponse.json({
     ok: true,

package/src/modules/customer_accounts/services/customerUserService.ts

@@ -8,6 +8,14 @@ const BCRYPT_COST = 10
 const MAX_FAILED_ATTEMPTS = 5
 const LOCKOUT_DURATION_MS = 15 * 60 * 1000 // 15 minutes
 
+type CustomerUserLockoutDatabase = {
+  customer_users: {
+    id: string
+    failed_login_attempts: number
+    locked_until: Date | null
+  }
+}
+
 export class CustomerUserService {
   constructor(private em: EntityManager) {}
 
@@ -81,14 +89,32 @@ export class CustomerUserService {
   }
 
   async incrementFailedAttempts(user: CustomerUser): Promise<void> {
-    const newCount = (user.failedLoginAttempts || 0) + 1
-    const updates: Record<string, unknown> = { failedLoginAttempts: newCount }
-    if (newCount >= MAX_FAILED_ATTEMPTS) {
-      updates.lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)
-    }
-    await this.em.nativeUpdate(CustomerUser, { id: user.id }, updates)
-    user.failedLoginAttempts = newCount
-    if (updates.lockedUntil) user.lockedUntil = updates.lockedUntil as Date
+    const lockedUntil = new Date(Date.now() + LOCKOUT_DURATION_MS)
+    await this.em.getKysely<CustomerUserLockoutDatabase>()
+      .updateTable('customer_users')
+      .set((eb) => ({
+        failed_login_attempts: eb('failed_login_attempts', '+', 1),
+        locked_until: eb
+          .case()
+          .when('failed_login_attempts', '>=', MAX_FAILED_ATTEMPTS - 1)
+          .then(eb.fn<Date>('greatest', [eb.ref('locked_until'), eb.val(lockedUntil)]))
+          .else(eb.ref('locked_until'))
+          .end(),
+      }))
+      .where('id', '=', user.id)
+      .execute()
+  }
+
+  async resetFailedAttemptsUnlessLocked(user: CustomerUser): Promise<boolean> {
+    const now = new Date()
+    const row = await this.em.getKysely<CustomerUserLockoutDatabase>()
+      .updateTable('customer_users')
+      .set({ failed_login_attempts: 0, locked_until: null })
+      .where('id', '=', user.id)
+      .where((eb) => eb.or([eb('locked_until', 'is', null), eb('locked_until', '<=', now)]))
+      .returning('id')
+      .executeTakeFirst()
+    return row !== undefined
   }
 
   async resetFailedAttempts(user: CustomerUser): Promise<void> {
@@ -96,8 +122,6 @@ export class CustomerUserService {
       failedLoginAttempts: 0,
       lockedUntil: null,
     })
-    user.failedLoginAttempts = 0
-    user.lockedUntil = null
   }
 
   async updatePassword(user: CustomerUser, newPassword: string, em?: EntityManager): Promise<void> {

package/src/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.ts

@@ -84,7 +84,7 @@ export const openApi: OpenApiRouteDoc = {
     DELETE: {
       summary: 'Revoke invitation',
       description:
-        'Soft-revokes an invitation — the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).',
+        'Soft-revokes an invitation — the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404); access tokens already issued for the invitation stop working (401).',
       responses: [{ status: 200, description: 'Invitation revoked', schema: deleteResponseSchema }],
       errors: [{ status: 404, description: 'Invitation not found', schema: errorSchema }],
     },

package/src/modules/forms/api/form-submissions/[id]/submit/route.ts

@@ -3,8 +3,11 @@
  *
  * Final submit. Body: `{ base_revision_id, submit_metadata? }`. Sets
  * status = submitted, captures `submit_metadata` (locale, IP, UA), emits
- * `forms.submission.submitted`. Idempotency hardening lands in 1d once the
- * client renderer is in place; phase 1c rejects double-submits with 422.
+ * `forms.submission.submitted`. A submission the caller started themselves
+ * must carry their own subject (`lib/portal-subject-policy.ts`), so a draft
+ * started for someone else before that check existed cannot be finalized.
+ * Idempotency hardening lands in 1d once the client renderer is in place;
+ * phase 1c rejects double-submits with 422.
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
@@ -14,7 +17,14 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { SubmissionService } from '../../../../services/submission-service'
 import { submissionSubmitInputSchema } from '../../../../data/validators'
-import { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from '../../../runtime-helpers'
+import {
+  buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeSubmission,
+} from '../../../runtime-helpers'
 
 export const metadata = {
   POST: { requireAuth: false },
@@ -56,9 +66,11 @@ export async function POST(
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: auth.sub,
       submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: true,
     })
     return NextResponse.json({ submission: serializeSubmission(submission) })
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()
     return mapSubmissionError(error)
   }
 }
@@ -79,6 +91,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],
   errors: [
     { status: 401, description: 'Not authenticated', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: caller-started submission is not on the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Submission not found', schema: errorSchema },
     { status: 409, description: 'Stale base_revision_id', schema: errorSchema },
     { status: 422, description: 'Submission already in terminal state', schema: errorSchema },

package/src/modules/forms/api/form-submissions/route.ts

@@ -2,7 +2,9 @@
  * Runtime API — POST /api/form-submissions
  *
  * Starts a new submission for the active version of a form. Customer auth is
- * required. The starter is auto-assigned the form version's
+ * required, and the subject must be the caller's own `customer` subject
+ * (`lib/portal-subject-policy.ts`); any other pair is refused with 403 before
+ * anything is persisted. The starter is auto-assigned the form version's
  * `x-om-default-actor-role` (or first declared role) — admin assignment of
  * additional actors is the admin route.
  */
@@ -18,7 +20,15 @@ import {
   type PrefillResolver,
 } from '../../services/prefill-resolver'
 import { submissionStartInputSchema } from '../../data/validators'
-import { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from '../runtime-helpers'
+import { isPortalSubjectAllowed } from '../../lib/portal-subject-policy'
+import {
+  mapSubmissionError,
+  portalSubjectForbiddenResponse,
+  readJsonBody,
+  serializeActor,
+  serializeRevision,
+  serializeSubmission,
+} from '../runtime-helpers'
 
 export const metadata = {
   POST: { requireAuth: false },
@@ -43,6 +53,14 @@ export async function POST(req: NextRequest) {
       { status: 422 },
     )
   }
+  if (
+    !isPortalSubjectAllowed(auth.sub, {
+      subjectType: parsed.data.subject_type,
+      subjectId: parsed.data.subject_id,
+    })
+  ) {
+    return portalSubjectForbiddenResponse()
+  }
 
   const container = await createRequestContainer()
   const service = container.resolve('formsSubmissionService') as SubmissionService
@@ -122,6 +140,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 201, description: 'Submission started', schema: submissionResponseSchema }],
   errors: [
     { status: 401, description: 'Not authenticated', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: subject is not the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Form not found', schema: errorSchema },
     { status: 422, description: 'Validation or form-state error', schema: errorSchema },
   ],

package/src/modules/forms/api/public/submissions/[id]/submit/route.ts

@@ -9,6 +9,8 @@
  * then mark the invitation submitted. A capped distribution returns 410 BEFORE
  * any submission state changes. Customer-session submits skip the
  * reserve/mark-invitation steps — those are anonymous-distribution concerns.
+ * A customer-session submit of a submission the caller started themselves
+ * must carry their own subject (`lib/portal-subject-policy.ts`).
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
@@ -23,7 +25,9 @@ import { submissionSubmitInputSchema } from '../../../../../data/validators'
 import { resolveRuntimePrincipal } from '../../../../../lib/runtime-principal'
 import {
   buildSubmitMetadata,
+  isPortalSubjectForbiddenError,
   mapDistributionError,
+  portalSubjectForbiddenResponse,
   readJsonBody,
   serializeSubmission,
 } from '../../../../runtime-helpers'
@@ -104,6 +108,7 @@ export async function POST(
       baseRevisionId: parsed.data.base_revision_id,
       submittedBy: principal.principal,
       submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),
+      submittedByPortalCustomer: principal.source === 'customer',
     })
 
     if (principal.source === 'token') {
@@ -121,6 +126,7 @@ export async function POST(
       redirect_url: distribution?.redirectUrl ?? null,
     })
   } catch (error) {
+    if (isPortalSubjectForbiddenError(error)) return portalSubjectForbiddenResponse()
     return mapDistributionError(error)
   }
 }
@@ -144,6 +150,7 @@ const postMethodDoc: OpenApiMethodDoc = {
   responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],
   errors: [
     { status: 401, description: 'Missing or invalid access token / session', schema: errorSchema },
+    { status: 403, description: 'SUBJECT_FORBIDDEN: customer-started submission is not on the caller\'s own customer subject', schema: errorSchema },
     { status: 404, description: 'Submission or invitation not found', schema: errorSchema },
     { status: 409, description: 'Stale base_revision_id', schema: errorSchema },
     { status: 410, description: 'Distribution response cap reached or unavailable', schema: errorSchema },

package/src/modules/forms/api/runtime-helpers.ts

@@ -3,6 +3,7 @@
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { SubmissionServiceError, isSubmissionServiceError } from '../services/submission-service'
 import { DistributionServiceError, isDistributionServiceError } from '../services/distribution-service'
 import { readEmbedSettings } from '../lib/embed-frame-policy'
@@ -27,6 +28,21 @@ export function mapSubmissionError(error: unknown): NextResponse {
   return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })
 }
 
+export function isPortalSubjectForbiddenError(error: unknown): boolean {
+  return isSubmissionServiceError(error) && error.code === 'SUBJECT_FORBIDDEN'
+}
+
+export async function portalSubjectForbiddenResponse(): Promise<NextResponse> {
+  const { translate } = await resolveTranslations()
+  return NextResponse.json(
+    {
+      error: 'SUBJECT_FORBIDDEN',
+      message: translate('forms.errors.subject_forbidden', 'You can only start or submit this form for yourself.'),
+    },
+    { status: 403 },
+  )
+}
+
 export function mapDistributionError(error: unknown): NextResponse {
   if (isDistributionServiceError(error)) {
     return NextResponse.json(

package/src/modules/forms/data/validators.ts

@@ -57,7 +57,8 @@ export type RoleIdentifier = z.infer<typeof roleIdentifierSchema>
  * Submission subject identifier. Polymorphic: subject_type is a free-form
  * string tag (`patient`, `customer`, `case`, etc.); subject_id MUST be a
  * UUID. Validation of the (subject_type, subject_id) pair against actual
- * domain entities is the responsibility of the calling module.
+ * domain entities is the responsibility of the calling module; the portal
+ * runtime enforces `lib/portal-subject-policy.ts`.
  */
 export const submissionSubjectSchema = z.object({
   subject_type: z.string().min(1).max(64),

package/src/modules/forms/i18n/de.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot-Eintrag nicht gefunden.",
   "forms.errors.snapshot_pending": "PDF-Snapshot wird erstellt.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot-Speicher ist noch nicht konfiguriert.",
+  "forms.errors.subject_forbidden": "Sie können dieses Formular nur für sich selbst starten oder absenden.",
   "forms.errors.submission_not_found": "Einreichung nicht gefunden.",
   "forms.errors.tenant_required": "Ein Mandantenkontext ist erforderlich.",
   "forms.errors.unauthorized": "Nicht autorisiert.",

package/src/modules/forms/i18n/en.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot record not found.",
   "forms.errors.snapshot_pending": "PDF snapshot is being generated.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot storage is not yet configured.",
+  "forms.errors.subject_forbidden": "You can only start or submit this form for yourself.",
   "forms.errors.submission_not_found": "Submission not found.",
   "forms.errors.tenant_required": "Tenant context is required.",
   "forms.errors.unauthorized": "Unauthorized.",

package/src/modules/forms/i18n/es.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Registro de instantánea no encontrado.",
   "forms.errors.snapshot_pending": "Se está generando la instantánea en PDF.",
   "forms.errors.snapshot_storage_unconfigured": "El almacenamiento de instantáneas aún no está configurado.",
+  "forms.errors.subject_forbidden": "Solo puede iniciar o enviar este formulario en su propio nombre.",
   "forms.errors.submission_not_found": "Envío no encontrado.",
   "forms.errors.tenant_required": "Se requiere el contexto del inquilino.",
   "forms.errors.unauthorized": "No autorizado.",

package/src/modules/forms/i18n/ko.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot record not found.",
   "forms.errors.snapshot_pending": "PDF snapshot is being generated.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot storage is not yet configured.",
+  "forms.errors.subject_forbidden": "이 양식은 본인에 대해서만 시작하거나 제출할 수 있습니다.",
   "forms.errors.submission_not_found": "Submission not found.",
   "forms.errors.tenant_required": "Tenant context is required.",
   "forms.errors.unauthorized": "Unauthorized.",

package/src/modules/forms/i18n/pl.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Nie znaleziono rekordu migawki.",
   "forms.errors.snapshot_pending": "Migawka PDF jest generowana.",
   "forms.errors.snapshot_storage_unconfigured": "Magazyn migawek nie został jeszcze skonfigurowany.",
+  "forms.errors.subject_forbidden": "Możesz rozpocząć lub wysłać ten formularz tylko we własnym imieniu.",
   "forms.errors.submission_not_found": "Nie znaleziono zgłoszenia.",
   "forms.errors.tenant_required": "Wymagany jest kontekst najemcy.",
   "forms.errors.unauthorized": "Brak uprawnień.",

package/src/modules/forms/lib/portal-subject-policy.ts

@@ -0,0 +1,42 @@
+/**
+ * Portal subject policy (#7224).
+ *
+ * A portal customer may start a submission, and finalize a submission they
+ * started themselves, only for the subject that identifies them: the
+ * `customer` subject whose id is their own customer user id (`auth.sub`).
+ * Any other pair is refused before anything is persisted, because the
+ * subject is what the consent projector attributes signatures to.
+ *
+ * A submission started by someone else reached the caller through a staff
+ * actor assignment (`forms.submissions.manage`), so staff already vouched for
+ * that pairing and the submit is not re-checked here. Token (invitation)
+ * principals carry a server-derived subject and are out of scope.
+ *
+ * The start route applies `isPortalSubjectAllowed` before anything is
+ * persisted; `SubmissionService.submit()` applies `isPortalSubmitAllowed`
+ * inside its locked transaction when the caller is a portal customer.
+ */
+
+export const PORTAL_SUBJECT_TYPE = 'customer'
+
+export type PortalSubject = {
+  subjectType: string
+  subjectId: string
+}
+
+export type PortalSubmissionSubject = PortalSubject & {
+  startedBy: string
+}
+
+function isSameId(left: string, right: string): boolean {
+  return left.toLowerCase() === right.toLowerCase()
+}
+
+export function isPortalSubjectAllowed(customerUserId: string, subject: PortalSubject): boolean {
+  return subject.subjectType === PORTAL_SUBJECT_TYPE && isSameId(subject.subjectId, customerUserId)
+}
+
+export function isPortalSubmitAllowed(customerUserId: string, submission: PortalSubmissionSubject): boolean {
+  if (!isSameId(submission.startedBy, customerUserId)) return true
+  return isPortalSubjectAllowed(customerUserId, submission)
+}

package/src/modules/forms/lib/runtime-principal.ts

@@ -9,12 +9,16 @@
  * the org/tenant are NEVER trusted from the token body — they are re-derived
  * from the persisted `forms_form_submission` row. The token only authorizes a
  * single `(submissionId, invitationId, role)` triple; it asserts the token's
- * submission matches the route's submission before trusting anything.
+ * submission matches the route's submission before trusting anything. The
+ * token is also only honoured while its invitation is live (not revoked or
+ * expired) and its actor row on the submission is active; the role comes from
+ * that actor row, never from the token.
  */
 
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
-import { FormSubmission, FormSubmissionActor } from '../data/entities'
+import { FormInvitation, FormSubmission, FormSubmissionActor } from '../data/entities'
+import { INVITATION_ACCESS_CLOSED_STATUSES } from '../services/distribution-service'
 import { verifyAccessToken } from '../services/distribution-token'
 
 export type RuntimePrincipal = {
@@ -54,15 +58,35 @@ export async function resolveRuntimePrincipal(
         id: submissionId,
         deletedAt: null,
       })
-      if (submission) {
-        return {
-          source: 'token',
-          principal: verified.invitationId,
-          role: verified.role ?? null,
-          organizationId: submission.organizationId,
-          tenantId: submission.tenantId,
-          submissionId,
-        }
+      if (!submission) return null
+      const invitation = await em.findOne(FormInvitation, {
+        id: verified.invitationId,
+        organizationId: submission.organizationId,
+        tenantId: submission.tenantId,
+        deletedAt: null,
+      })
+      if (
+        !invitation ||
+        invitation.submissionId !== submissionId ||
+        INVITATION_ACCESS_CLOSED_STATUSES.has(invitation.status)
+      ) {
+        return null
+      }
+      const actor = await em.findOne(FormSubmissionActor, {
+        submissionId,
+        organizationId: submission.organizationId,
+        userId: invitation.id,
+        revokedAt: null,
+        deletedAt: null,
+      })
+      if (!actor) return null
+      return {
+        source: 'token',
+        principal: verified.invitationId,
+        role: actor.role,
+        organizationId: submission.organizationId,
+        tenantId: submission.tenantId,
+        submissionId,
       }
     }
     // A present-but-invalid bearer token does not fall through to customer

package/src/modules/forms/services/distribution-service.ts

@@ -92,7 +92,9 @@ const noopLogger: StructuredLogger = {
   error: () => {},
 }
 
-const INVITATION_TERMINAL_STATUSES: ReadonlySet<string> = new Set(['submitted', 'revoked', 'expired'])
+export const INVITATION_ACCESS_CLOSED_STATUSES: ReadonlySet<string> = new Set(['revoked', 'expired'])
+
+const INVITATION_TERMINAL_STATUSES: ReadonlySet<string> = new Set(['submitted', ...INVITATION_ACCESS_CLOSED_STATUSES])
 
 export type BeginAnonymousArgs = {
   distribution: FormDistribution
@@ -378,20 +380,40 @@ export class DistributionService {
     submissionId: string
   }): Promise<void> {
     const em = this.emFactory()
-    const invitation = await em.findOne(FormInvitation, {
-      id: args.invitationId,
-      organizationId: args.organizationId,
-      tenantId: args.tenantId,
-      deletedAt: null,
+    const marked = await em.transactional(async (trx) => {
+      const invitation = await trx.findOne(
+        FormInvitation,
+        {
+          id: args.invitationId,
+          organizationId: args.organizationId,
+          tenantId: args.tenantId,
+          deletedAt: null,
+        },
+        { lockMode: LockMode.PESSIMISTIC_WRITE },
+      )
+      if (!invitation) {
+        throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)
+      }
+      if (INVITATION_ACCESS_CLOSED_STATUSES.has(invitation.status)) {
+        this.logger.warn(
+          {
+            event: 'forms.distribution.invitation_submit_skipped',
+            invitationId: invitation.id,
+            submissionId: args.submissionId,
+            status: invitation.status,
+          },
+          'Invitation access closed before submit; status left unchanged.',
+        )
+        return false
+      }
+      invitation.status = 'submitted'
+      invitation.submittedAt = this.now()
+      await trx.flush()
+      return true
     })
-    if (!invitation) {
-      throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)
-    }
-    invitation.status = 'submitted'
-    invitation.submittedAt = this.now()
-    await em.flush()
+    if (!marked) return
     await this.safeEmit('forms.invitation.submitted', {
-      invitationId: invitation.id,
+      invitationId: args.invitationId,
       submissionId: args.submissionId,
     })
   }

package/src/modules/forms/services/submission-service.ts

@@ -39,6 +39,7 @@ import {
   type VisibilitySchemaNode,
 } from './visibility-resolver'
 import { buildTamperingMarker, type StructuredLogger } from '../lib/log-redaction'
+import { isPortalSubmitAllowed } from '../lib/portal-subject-policy'
 import { formsEventPayloadSchemas } from '../events-payloads'
 import { validateFieldValue } from './field-validation-service'
 import type { FieldNode } from '../backend/forms/[id]/studio/schema-helpers'
@@ -74,6 +75,7 @@ export type SubmissionServiceErrorCode =
   | 'INVALID_ROLE'
   | 'FORM_INACTIVE'
   | 'FORM_VERSION_NOT_PUBLISHED'
+  | 'SUBJECT_FORBIDDEN'
 
 /**
  * `Symbol.for` so the brand survives module duplication across bundle
@@ -144,6 +146,13 @@ export type SubmitArgs = Scope & {
   baseRevisionId: string
   submittedBy: string
   submitMetadata?: Record<string, unknown> | null
+  /**
+   * Set when `submittedBy` is a signed-in portal customer. A submission that
+   * customer started themselves must then carry their own `customer` subject
+   * (`lib/portal-subject-policy.ts`), otherwise 403 SUBJECT_FORBIDDEN. Left
+   * unset for invitation (token) principals, whose subject is server-derived.
+   */
+  submittedByPortalCustomer?: boolean
 }
 
 export type ReopenArgs = Scope & {
@@ -748,6 +757,9 @@ export class SubmissionService {
       if (!submission) {
         throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)
       }
+      if (args.submittedByPortalCustomer && !isPortalSubmitAllowed(args.submittedBy, submission)) {
+        throw new SubmissionServiceError('SUBJECT_FORBIDDEN', 'Submission subject is not the caller\'s own customer subject.', 403)
+      }
       if (submission.status === 'submitted') {
         throw new SubmissionServiceError('INVALID_STATUS', 'Submission already submitted.', 422)
       }