@open-mercato/core 0.9.1-develop.7519.1.38f51f8dbb → 0.9.1-develop.7536.1.f9a5776a07

package/src/modules/forms/api/runtime-helpers.ts

@@ -3,6 +3,7 @@
  */
 
 import { NextResponse, type NextRequest } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { SubmissionServiceError, isSubmissionServiceError } from '../services/submission-service'
 import { DistributionServiceError, isDistributionServiceError } from '../services/distribution-service'
 import { readEmbedSettings } from '../lib/embed-frame-policy'
@@ -27,6 +28,21 @@ export function mapSubmissionError(error: unknown): NextResponse {
   return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })
 }
 
+export function isPortalSubjectForbiddenError(error: unknown): boolean {
+  return isSubmissionServiceError(error) && error.code === 'SUBJECT_FORBIDDEN'
+}
+
+export async function portalSubjectForbiddenResponse(): Promise<NextResponse> {
+  const { translate } = await resolveTranslations()
+  return NextResponse.json(
+    {
+      error: 'SUBJECT_FORBIDDEN',
+      message: translate('forms.errors.subject_forbidden', 'You can only start or submit this form for yourself.'),
+    },
+    { status: 403 },
+  )
+}
+
 export function mapDistributionError(error: unknown): NextResponse {
   if (isDistributionServiceError(error)) {
     return NextResponse.json(

package/src/modules/forms/data/validators.ts

@@ -57,7 +57,8 @@ export type RoleIdentifier = z.infer<typeof roleIdentifierSchema>
  * Submission subject identifier. Polymorphic: subject_type is a free-form
  * string tag (`patient`, `customer`, `case`, etc.); subject_id MUST be a
  * UUID. Validation of the (subject_type, subject_id) pair against actual
- * domain entities is the responsibility of the calling module.
+ * domain entities is the responsibility of the calling module; the portal
+ * runtime enforces `lib/portal-subject-policy.ts`.
  */
 export const submissionSubjectSchema = z.object({
   subject_type: z.string().min(1).max(64),

package/src/modules/forms/i18n/de.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot-Eintrag nicht gefunden.",
   "forms.errors.snapshot_pending": "PDF-Snapshot wird erstellt.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot-Speicher ist noch nicht konfiguriert.",
+  "forms.errors.subject_forbidden": "Sie können dieses Formular nur für sich selbst starten oder absenden.",
   "forms.errors.submission_not_found": "Einreichung nicht gefunden.",
   "forms.errors.tenant_required": "Ein Mandantenkontext ist erforderlich.",
   "forms.errors.unauthorized": "Nicht autorisiert.",

package/src/modules/forms/i18n/en.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot record not found.",
   "forms.errors.snapshot_pending": "PDF snapshot is being generated.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot storage is not yet configured.",
+  "forms.errors.subject_forbidden": "You can only start or submit this form for yourself.",
   "forms.errors.submission_not_found": "Submission not found.",
   "forms.errors.tenant_required": "Tenant context is required.",
   "forms.errors.unauthorized": "Unauthorized.",

package/src/modules/forms/i18n/es.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Registro de instantánea no encontrado.",
   "forms.errors.snapshot_pending": "Se está generando la instantánea en PDF.",
   "forms.errors.snapshot_storage_unconfigured": "El almacenamiento de instantáneas aún no está configurado.",
+  "forms.errors.subject_forbidden": "Solo puede iniciar o enviar este formulario en su propio nombre.",
   "forms.errors.submission_not_found": "Envío no encontrado.",
   "forms.errors.tenant_required": "Se requiere el contexto del inquilino.",
   "forms.errors.unauthorized": "No autorizado.",

package/src/modules/forms/i18n/ko.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Snapshot record not found.",
   "forms.errors.snapshot_pending": "PDF snapshot is being generated.",
   "forms.errors.snapshot_storage_unconfigured": "Snapshot storage is not yet configured.",
+  "forms.errors.subject_forbidden": "이 양식은 본인에 대해서만 시작하거나 제출할 수 있습니다.",
   "forms.errors.submission_not_found": "Submission not found.",
   "forms.errors.tenant_required": "Tenant context is required.",
   "forms.errors.unauthorized": "Unauthorized.",

package/src/modules/forms/i18n/pl.json

@@ -193,6 +193,7 @@
   "forms.errors.snapshot_missing": "Nie znaleziono rekordu migawki.",
   "forms.errors.snapshot_pending": "Migawka PDF jest generowana.",
   "forms.errors.snapshot_storage_unconfigured": "Magazyn migawek nie został jeszcze skonfigurowany.",
+  "forms.errors.subject_forbidden": "Możesz rozpocząć lub wysłać ten formularz tylko we własnym imieniu.",
   "forms.errors.submission_not_found": "Nie znaleziono zgłoszenia.",
   "forms.errors.tenant_required": "Wymagany jest kontekst najemcy.",
   "forms.errors.unauthorized": "Brak uprawnień.",

package/src/modules/forms/lib/portal-subject-policy.ts

@@ -0,0 +1,42 @@
+/**
+ * Portal subject policy (#7224).
+ *
+ * A portal customer may start a submission, and finalize a submission they
+ * started themselves, only for the subject that identifies them: the
+ * `customer` subject whose id is their own customer user id (`auth.sub`).
+ * Any other pair is refused before anything is persisted, because the
+ * subject is what the consent projector attributes signatures to.
+ *
+ * A submission started by someone else reached the caller through a staff
+ * actor assignment (`forms.submissions.manage`), so staff already vouched for
+ * that pairing and the submit is not re-checked here. Token (invitation)
+ * principals carry a server-derived subject and are out of scope.
+ *
+ * The start route applies `isPortalSubjectAllowed` before anything is
+ * persisted; `SubmissionService.submit()` applies `isPortalSubmitAllowed`
+ * inside its locked transaction when the caller is a portal customer.
+ */
+
+export const PORTAL_SUBJECT_TYPE = 'customer'
+
+export type PortalSubject = {
+  subjectType: string
+  subjectId: string
+}
+
+export type PortalSubmissionSubject = PortalSubject & {
+  startedBy: string
+}
+
+function isSameId(left: string, right: string): boolean {
+  return left.toLowerCase() === right.toLowerCase()
+}
+
+export function isPortalSubjectAllowed(customerUserId: string, subject: PortalSubject): boolean {
+  return subject.subjectType === PORTAL_SUBJECT_TYPE && isSameId(subject.subjectId, customerUserId)
+}
+
+export function isPortalSubmitAllowed(customerUserId: string, submission: PortalSubmissionSubject): boolean {
+  if (!isSameId(submission.startedBy, customerUserId)) return true
+  return isPortalSubjectAllowed(customerUserId, submission)
+}

package/src/modules/forms/lib/runtime-principal.ts

@@ -9,12 +9,16 @@
  * the org/tenant are NEVER trusted from the token body — they are re-derived
  * from the persisted `forms_form_submission` row. The token only authorizes a
  * single `(submissionId, invitationId, role)` triple; it asserts the token's
- * submission matches the route's submission before trusting anything.
+ * submission matches the route's submission before trusting anything. The
+ * token is also only honoured while its invitation is live (not revoked or
+ * expired) and its actor row on the submission is active; the role comes from
+ * that actor row, never from the token.
  */
 
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
-import { FormSubmission, FormSubmissionActor } from '../data/entities'
+import { FormInvitation, FormSubmission, FormSubmissionActor } from '../data/entities'
+import { INVITATION_ACCESS_CLOSED_STATUSES } from '../services/distribution-service'
 import { verifyAccessToken } from '../services/distribution-token'
 
 export type RuntimePrincipal = {
@@ -54,15 +58,35 @@ export async function resolveRuntimePrincipal(
         id: submissionId,
         deletedAt: null,
       })
-      if (submission) {
-        return {
-          source: 'token',
-          principal: verified.invitationId,
-          role: verified.role ?? null,
-          organizationId: submission.organizationId,
-          tenantId: submission.tenantId,
-          submissionId,
-        }
+      if (!submission) return null
+      const invitation = await em.findOne(FormInvitation, {
+        id: verified.invitationId,
+        organizationId: submission.organizationId,
+        tenantId: submission.tenantId,
+        deletedAt: null,
+      })
+      if (
+        !invitation ||
+        invitation.submissionId !== submissionId ||
+        INVITATION_ACCESS_CLOSED_STATUSES.has(invitation.status)
+      ) {
+        return null
+      }
+      const actor = await em.findOne(FormSubmissionActor, {
+        submissionId,
+        organizationId: submission.organizationId,
+        userId: invitation.id,
+        revokedAt: null,
+        deletedAt: null,
+      })
+      if (!actor) return null
+      return {
+        source: 'token',
+        principal: verified.invitationId,
+        role: actor.role,
+        organizationId: submission.organizationId,
+        tenantId: submission.tenantId,
+        submissionId,
       }
     }
     // A present-but-invalid bearer token does not fall through to customer

package/src/modules/forms/services/distribution-service.ts

@@ -92,7 +92,9 @@ const noopLogger: StructuredLogger = {
   error: () => {},
 }
 
-const INVITATION_TERMINAL_STATUSES: ReadonlySet<string> = new Set(['submitted', 'revoked', 'expired'])
+export const INVITATION_ACCESS_CLOSED_STATUSES: ReadonlySet<string> = new Set(['revoked', 'expired'])
+
+const INVITATION_TERMINAL_STATUSES: ReadonlySet<string> = new Set(['submitted', ...INVITATION_ACCESS_CLOSED_STATUSES])
 
 export type BeginAnonymousArgs = {
   distribution: FormDistribution
@@ -378,20 +380,40 @@ export class DistributionService {
     submissionId: string
   }): Promise<void> {
     const em = this.emFactory()
-    const invitation = await em.findOne(FormInvitation, {
-      id: args.invitationId,
-      organizationId: args.organizationId,
-      tenantId: args.tenantId,
-      deletedAt: null,
+    const marked = await em.transactional(async (trx) => {
+      const invitation = await trx.findOne(
+        FormInvitation,
+        {
+          id: args.invitationId,
+          organizationId: args.organizationId,
+          tenantId: args.tenantId,
+          deletedAt: null,
+        },
+        { lockMode: LockMode.PESSIMISTIC_WRITE },
+      )
+      if (!invitation) {
+        throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)
+      }
+      if (INVITATION_ACCESS_CLOSED_STATUSES.has(invitation.status)) {
+        this.logger.warn(
+          {
+            event: 'forms.distribution.invitation_submit_skipped',
+            invitationId: invitation.id,
+            submissionId: args.submissionId,
+            status: invitation.status,
+          },
+          'Invitation access closed before submit; status left unchanged.',
+        )
+        return false
+      }
+      invitation.status = 'submitted'
+      invitation.submittedAt = this.now()
+      await trx.flush()
+      return true
     })
-    if (!invitation) {
-      throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)
-    }
-    invitation.status = 'submitted'
-    invitation.submittedAt = this.now()
-    await em.flush()
+    if (!marked) return
     await this.safeEmit('forms.invitation.submitted', {
-      invitationId: invitation.id,
+      invitationId: args.invitationId,
       submissionId: args.submissionId,
     })
   }

package/src/modules/forms/services/submission-service.ts

@@ -39,6 +39,7 @@ import {
   type VisibilitySchemaNode,
 } from './visibility-resolver'
 import { buildTamperingMarker, type StructuredLogger } from '../lib/log-redaction'
+import { isPortalSubmitAllowed } from '../lib/portal-subject-policy'
 import { formsEventPayloadSchemas } from '../events-payloads'
 import { validateFieldValue } from './field-validation-service'
 import type { FieldNode } from '../backend/forms/[id]/studio/schema-helpers'
@@ -74,6 +75,7 @@ export type SubmissionServiceErrorCode =
   | 'INVALID_ROLE'
   | 'FORM_INACTIVE'
   | 'FORM_VERSION_NOT_PUBLISHED'
+  | 'SUBJECT_FORBIDDEN'
 
 /**
  * `Symbol.for` so the brand survives module duplication across bundle
@@ -144,6 +146,13 @@ export type SubmitArgs = Scope & {
   baseRevisionId: string
   submittedBy: string
   submitMetadata?: Record<string, unknown> | null
+  /**
+   * Set when `submittedBy` is a signed-in portal customer. A submission that
+   * customer started themselves must then carry their own `customer` subject
+   * (`lib/portal-subject-policy.ts`), otherwise 403 SUBJECT_FORBIDDEN. Left
+   * unset for invitation (token) principals, whose subject is server-derived.
+   */
+  submittedByPortalCustomer?: boolean
 }
 
 export type ReopenArgs = Scope & {
@@ -748,6 +757,9 @@ export class SubmissionService {
       if (!submission) {
         throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)
       }
+      if (args.submittedByPortalCustomer && !isPortalSubmitAllowed(args.submittedBy, submission)) {
+        throw new SubmissionServiceError('SUBJECT_FORBIDDEN', 'Submission subject is not the caller\'s own customer subject.', 403)
+      }
       if (submission.status === 'submitted') {
         throw new SubmissionServiceError('INVALID_STATUS', 'Submission already submitted.', 422)
       }

package/src/modules/staff/commands/leave-requests.ts

@@ -12,7 +12,7 @@ import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { PlannerAvailabilityRule } from '@open-mercato/core/modules/planner/data/entities'
-import { StaffLeaveRequest, type StaffLeaveRequestStatus } from '../data/entities'
+import { StaffLeaveRequest, StaffTeamMember, type StaffLeaveRequestStatus } from '../data/entities'
 import {
   staffLeaveRequestCreateSchema,
   staffLeaveRequestDecisionSchema,
@@ -210,6 +210,36 @@ function ensurePendingStatus(request: StaffLeaveRequest): void {
   }
 }
 
+async function ensureUndoablePending(request: StaffLeaveRequest): Promise<void> {
+  if (request.status === 'pending') return
+  const { translate } = await resolveTranslations()
+  throw new CrudHttpError(409, {
+    error: translate(
+      'staff.leaveRequests.errors.undoAfterDecision',
+      'This leave request has already been approved or rejected and can no longer be undone. Undo the decision first.',
+    ),
+  })
+}
+
+async function requireUndoMember(em: EntityManager, snapshot: LeaveRequestSnapshot): Promise<StaffTeamMember> {
+  const scope = explicitStaffCommandScope(snapshot.tenantId, snapshot.organizationId)
+  const member = await findOneWithDecryption(
+    em,
+    StaffTeamMember,
+    applyScopeToWhere<StaffTeamMember>({ id: snapshot.memberId, deletedAt: null }, scope),
+    undefined,
+    scopeForDecryption(scope),
+  )
+  if (member) return member
+  const { translate } = await resolveTranslations()
+  throw new CrudHttpError(409, {
+    error: translate(
+      'staff.leaveRequests.errors.undoMemberMissing',
+      'The original team member of this leave request no longer exists, so the change cannot be undone.',
+    ),
+  })
+}
+
 async function createUnavailabilityRules(params: {
   em: EntityManager
   tenantId: string
@@ -388,25 +418,25 @@ const createLeaveRequestCommand: CommandHandler<StaffLeaveRequestCreateInput, {
     if (!after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const request = await em.findOne(StaffLeaveRequest, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
-    if (request) {
-      request.deletedAt = new Date()
-      request.updatedAt = new Date()
-      await em.flush()
+    if (!request || request.deletedAt) return
+    await ensureUndoablePending(request)
+    request.deletedAt = new Date()
+    request.updatedAt = new Date()
+    await em.flush()
 
-      const de = (ctx.container.resolve('dataEngine') as DataEngine)
-      await emitCrudUndoSideEffects({
-        dataEngine: de,
-        action: 'deleted',
-        entity: request,
-        identifiers: {
-          id: request.id,
-          organizationId: request.organizationId,
-          tenantId: request.tenantId,
-        },
-        events: staffLeaveRequestCrudEvents,
+    const de = (ctx.container.resolve('dataEngine') as DataEngine)
+    await emitCrudUndoSideEffects({
+      dataEngine: de,
+      action: 'deleted',
+      entity: request,
+      identifiers: {
+        id: request.id,
+        organizationId: request.organizationId,
+        tenantId: request.tenantId,
+      },
+      events: staffLeaveRequestCrudEvents,
       indexer: leaveRequestCrudIndexer,
-      })
-    }
+    })
   },
   redo: makeCreateRedo<StaffLeaveRequest, LeaveRequestSnapshot, StaffLeaveRequestCreateInput, { requestId: string }>({
     entityClass: StaffLeaveRequest,
@@ -517,17 +547,18 @@ const updateLeaveRequestCommand: CommandHandler<StaffLeaveRequestUpdateInput, {
     if (!before || !after) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const request = await em.findOne(StaffLeaveRequest, scopedStaffSnapshotWhere(after.id, staffSnapshotScopeFromSnapshot(after)))
-    if (!request) return
+    if (!request || request.deletedAt) return
+    await ensureUndoablePending(request)
+    const currentMemberId = typeof request.member === 'string' ? request.member : request.member.id
+    if (before.memberId !== currentMemberId) {
+      request.member = await requireUndoMember(em, before)
+    }
     request.startDate = new Date(before.startDate)
     request.endDate = new Date(before.endDate)
     request.timezone = before.timezone
-    request.status = before.status
     request.unavailabilityReasonEntryId = before.unavailabilityReasonEntryId
     request.unavailabilityReasonValue = before.unavailabilityReasonValue
     request.note = before.note
-    request.decisionComment = before.decisionComment
-    request.decidedByUserId = before.decidedByUserId
-    request.decidedAt = before.decidedAt ? new Date(before.decidedAt) : null
     request.updatedAt = new Date()
     await em.flush()
 

package/src/modules/staff/i18n/de.json

@@ -269,6 +269,8 @@
   "staff.leaveRequests.errors.profileLoad": "Profil konnte nicht geladen werden.",
   "staff.leaveRequests.errors.profileRequired": "Bitte zuerst dein Profil erstellen.",
   "staff.leaveRequests.errors.reject": "Urlaubsantrag konnte nicht abgelehnt werden.",
+  "staff.leaveRequests.errors.undoAfterDecision": "Dieser Urlaubsantrag wurde bereits genehmigt oder abgelehnt und kann nicht mehr rückgängig gemacht werden. Mache zuerst die Entscheidung rückgängig.",
+  "staff.leaveRequests.errors.undoMemberMissing": "Das ursprüngliche Teammitglied dieses Urlaubsantrags existiert nicht mehr, daher kann die Änderung nicht rückgängig gemacht werden.",
   "staff.leaveRequests.form.actions.create": "Erstellen",
   "staff.leaveRequests.form.actions.save": "Speichern",
   "staff.leaveRequests.form.createTitle": "Urlaubsantrag erstellen",

package/src/modules/staff/i18n/en.json

@@ -269,6 +269,8 @@
   "staff.leaveRequests.errors.profileLoad": "Failed to load your profile.",
   "staff.leaveRequests.errors.profileRequired": "Create your profile first.",
   "staff.leaveRequests.errors.reject": "Failed to reject leave request.",
+  "staff.leaveRequests.errors.undoAfterDecision": "This leave request has already been approved or rejected and can no longer be undone. Undo the decision first.",
+  "staff.leaveRequests.errors.undoMemberMissing": "The original team member of this leave request no longer exists, so the change cannot be undone.",
   "staff.leaveRequests.form.actions.create": "Create",
   "staff.leaveRequests.form.actions.save": "Save",
   "staff.leaveRequests.form.createTitle": "Create leave request",

package/src/modules/staff/i18n/es.json

@@ -269,6 +269,8 @@
   "staff.leaveRequests.errors.profileLoad": "No se pudo cargar tu perfil.",
   "staff.leaveRequests.errors.profileRequired": "Crea tu perfil primero.",
   "staff.leaveRequests.errors.reject": "No se pudo rechazar la solicitud de ausencia.",
+  "staff.leaveRequests.errors.undoAfterDecision": "Esta solicitud de ausencia ya fue aprobada o rechazada y ya no se puede deshacer. Deshaz primero la decisión.",
+  "staff.leaveRequests.errors.undoMemberMissing": "El miembro del equipo original de esta solicitud de ausencia ya no existe, por lo que el cambio no se puede deshacer.",
   "staff.leaveRequests.form.actions.create": "Crear",
   "staff.leaveRequests.form.actions.save": "Guardar",
   "staff.leaveRequests.form.createTitle": "Crear solicitud de ausencia",

package/src/modules/staff/i18n/ko.json

@@ -269,6 +269,8 @@
   "staff.leaveRequests.errors.profileLoad": "프로필을 불러오지 못했습니다.",
   "staff.leaveRequests.errors.profileRequired": "먼저 프로필을 생성하세요.",
   "staff.leaveRequests.errors.reject": "휴가 신청을 반려하지 못했습니다.",
+  "staff.leaveRequests.errors.undoAfterDecision": "이 휴가 신청은 이미 승인 또는 반려되어 더 이상 실행 취소할 수 없습니다. 먼저 결정을 실행 취소하세요.",
+  "staff.leaveRequests.errors.undoMemberMissing": "이 휴가 신청의 원래 팀원이 더 이상 존재하지 않아 변경 사항을 실행 취소할 수 없습니다.",
   "staff.leaveRequests.form.actions.create": "생성",
   "staff.leaveRequests.form.actions.save": "저장",
   "staff.leaveRequests.form.createTitle": "휴가 신청 생성",

package/src/modules/staff/i18n/pl.json

@@ -269,6 +269,8 @@
   "staff.leaveRequests.errors.profileLoad": "Nie udało się załadować profilu.",
   "staff.leaveRequests.errors.profileRequired": "Najpierw utwórz swój profil.",
   "staff.leaveRequests.errors.reject": "Nie udało się odrzucić wniosku urlopowego.",
+  "staff.leaveRequests.errors.undoAfterDecision": "Ten wniosek urlopowy został już zatwierdzony lub odrzucony i nie można go już cofnąć. Najpierw cofnij decyzję.",
+  "staff.leaveRequests.errors.undoMemberMissing": "Pierwotny członek zespołu tego wniosku urlopowego już nie istnieje, więc nie można cofnąć zmiany.",
   "staff.leaveRequests.form.actions.create": "Utwórz",
   "staff.leaveRequests.form.actions.save": "Zapisz",
   "staff.leaveRequests.form.createTitle": "Utwórz wniosek urlopowy",

package/src/modules/warranty_claims/api/portal/attachments/route.ts

@@ -17,7 +17,11 @@ import { checkAttachmentAccess } from '@open-mercato/core/modules/attachments/li
 import { attachmentCrudEvents, attachmentCrudIndexer } from '@open-mercato/core/modules/attachments/lib/crud'
 import { readAttachmentMetadata } from '@open-mercato/core/modules/attachments/lib/metadata'
 import { clearAttachmentThumbnailCache } from '@open-mercato/core/modules/attachments/lib/thumbnailCache'
-import { isMultipartRequestWithinUploadLimit } from '@open-mercato/core/modules/attachments/lib/upload-limits'
+import {
+  isMultipartUploadLimitError,
+  parseMultipartFormDataWithinUploadLimit,
+  resolveDefaultAttachmentMaxUploadBytes,
+} from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import {
   isScopedAttachmentUploadError,
   type ScopedAttachmentUploadErrorCode,
@@ -341,6 +345,14 @@ export async function GET(req: Request) {
   })
 }
 
+function uploadTooLargeResponse(t: Awaited<ReturnType<typeof resolveTranslations>>['t']): Response {
+  return NextResponse.json({
+    ok: false,
+    error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
+    code: 'max_upload_size',
+  }, { status: 413 })
+}
+
 async function handleUpload(req: Request, replacement: boolean): Promise<Response> {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
@@ -350,14 +362,13 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
     return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
-  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {
-    return NextResponse.json({
-      ok: false,
-      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
-    }, { status: 413 })
+  let form: FormData
+  try {
+    form = await parseMultipartFormDataWithinUploadLimit(req)
+  } catch (error) {
+    if (isMultipartUploadLimitError(error)) return uploadTooLargeResponse(t)
+    throw error
   }
-
-  const form = await req.formData()
   const parsed = uploadBodySchema.safeParse({
     claimId: form.get('claimId') ?? undefined,
     file: form.get('file') instanceof File ? (form.get('file') as File).name : '',
@@ -376,6 +387,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
   if (!(file instanceof File)) {
     return NextResponse.json({ ok: false, error: translate('warranty_claims.portal.detail.fileRequired', 'Choose a file before uploading.') }, { status: 400 })
   }
+  if (file.size > resolveDefaultAttachmentMaxUploadBytes()) return uploadTooLargeResponse(t)
   const buffer = Buffer.from(await file.arrayBuffer())
 
   const attachmentId = replacement && parsedAttachmentId?.success ? parsedAttachmentId.data : null

package/src/modules/warranty_claims/commands/claims.ts

@@ -269,7 +269,7 @@ function hasOwn(input: object, key: string): boolean {
 }
 
 function resolveScope(ctx: CommandRuntimeContext, input: ScopeInput): WarrantyClaimScope {
-  const tenantId = input.tenantId ?? ctx.auth?.tenantId ?? null
+  const tenantId = input.tenantId ?? ctx.auth?.tenantId ?? ctx.organizationScope?.tenantId ?? null
   const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
   if (!tenantId) throw new CrudHttpError(400, { error: '[internal] tenant scope required for warranty claim command' })
   if (!organizationId) throw new CrudHttpError(400, { error: '[internal] organization scope required for warranty claim command' })

package/src/modules/warranty_claims/subscribers/return-shipment-tracking.ts

@@ -7,7 +7,6 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { TransitionClaimInput } from '../data/validators'
 
 const logger = createLogger('warranty_claims')
-const SYSTEM_USER_ID = '00000000-0000-0000-0000-000000000000'
 
 export const metadata = {
   event: 'shipping_carriers.shipment.delivered',
@@ -182,12 +181,13 @@ export default async function handle(payload: unknown, ctx: SubscriberContext):
 
   const commandCtx: CommandRuntimeContext = {
     container: container as unknown as AwilixContainer,
-    auth: {
-      sub: SYSTEM_USER_ID,
+    auth: null,
+    organizationScope: {
+      selectedId: organizationId,
+      filterIds: null,
+      allowedIds: null,
       tenantId,
-      orgId: organizationId,
     },
-    organizationScope: null,
     selectedOrganizationId: organizationId,
     organizationIds: [organizationId],
     systemActor: true,

package/src/modules/wms/commands/inventory-actions.ts

@@ -734,19 +734,37 @@ async function findReservationBucketBalance(
   })
 }
 
+type BalanceBucketInput = {
+  warehouseId: string
+  locationId: string
+  catalogVariantId: string
+  lotId?: string
+  serialNumber?: string
+}
+
+const BALANCE_BUCKET_CREATE_LOCK_SQL = 'select pg_advisory_xact_lock(hashtextextended(?, 0))'
+
+function balanceBucketCreateLockKey(input: BalanceBucketInput): string {
+  return [
+    'wms:inventory-balance-bucket',
+    input.warehouseId.toLowerCase(),
+    input.locationId.toLowerCase(),
+    input.catalogVariantId.toLowerCase(),
+    input.lotId?.toLowerCase() ?? '',
+    input.serialNumber ?? '',
+  ].join(':')
+}
+
 async function upsertBalanceBucket(
   em: EntityManager,
   scope: Scope,
-  input: {
-    warehouseId: string
-    locationId: string
-    catalogVariantId: string
-    lotId?: string
-    serialNumber?: string
-  },
+  input: BalanceBucketInput,
 ): Promise<{ balance: InventoryBalance; created: boolean }> {
   const existing = await findExactBalanceForUpdate(em, scope, input)
   if (existing) return { balance: existing, created: false }
+  await em.execute(BALANCE_BUCKET_CREATE_LOCK_SQL, [balanceBucketCreateLockKey(input)])
+  const createdConcurrently = await findExactBalanceForUpdate(em, scope, input)
+  if (createdConcurrently) return { balance: createdConcurrently, created: false }
   const balance = em.create(InventoryBalance, {
     organizationId: scope.organizationId,
     tenantId: scope.tenantId,
@@ -1608,15 +1626,17 @@ const moveInventoryCommand: CommandHandler<InventoryMoveInput, { movementId: str
       if (sourceWarehouseId !== input.warehouseId || targetWarehouseId !== input.warehouseId) {
         throw new CrudHttpError(422, { error: 'invalid_location' })
       }
-      const sourceResult = await upsertBalanceBucket(trx, scope, {
+      const sourceBalance = await findExactBalanceForUpdate(trx, scope, {
         warehouseId: input.warehouseId,
         locationId: input.fromLocationId,
         catalogVariantId: input.catalogVariantId,
         lotId: input.lotId,
         serialNumber: input.serialNumber,
       })
-      const sourceBalance = sourceResult.balance
-      const sourceBalanceAction = sourceResult.created ? ('created' as const) : ('updated' as const)
+      if (!sourceBalance) {
+        throw new CrudHttpError(409, { error: 'insufficient_stock' })
+      }
+      const sourceBalanceAction = 'updated' as const
       const targetResult = await upsertBalanceBucket(trx, scope, {
         warehouseId: input.warehouseId,
         locationId: input.toLocationId,