@open-mercato/shared 0.10.1-develop.7679.1.cb2c13f49e → 0.10.1-develop.7687.1.e1a6f9de51

package/src/lib/encryption/__tests__/subscriber.tenant-binding.test.ts

@@ -0,0 +1,131 @@
+import { ReferenceKind } from '@mikro-orm/core'
+import { TenantEncryptionSubscriber } from '../subscriber'
+import { registerEntityIds } from '../entityIds'
+import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
+
+// Coverage for the ORM half of #5430. `findWithDecryption` passes the caller's scope as a fallback,
+// but the entity's own tenant took precedence — so an entity from another tenant that reached a
+// tenant-scoped read was decrypted with that other tenant's DEK. The subscriber now refuses it.
+
+const CHILD_META = { className: 'Child', tableName: 'children', properties: {} } as any
+
+const PARENT_META = {
+  className: 'Parent',
+  tableName: 'parents',
+  properties: { child: { name: 'child', kind: ReferenceKind.MANY_TO_ONE } },
+} as any
+
+const makeEm = () => ({ getMetadata: () => undefined, getComparator: () => undefined })
+
+function makeService(calls: Array<{ entityId: string; tenantId: string | null }>): TenantDataEncryptionService {
+  return {
+    isEnabled: () => true,
+    async decryptEntityPayload(
+      entityId: string,
+      target: Record<string, unknown>,
+      tenantId: string | null,
+    ) {
+      calls.push({ entityId, tenantId })
+      const value = target.secret
+      if (typeof value === 'string' && value.startsWith('enc:')) return { secret: value.slice('enc:'.length) }
+      return {}
+    },
+  } as unknown as TenantDataEncryptionService
+}
+
+describe('TenantEncryptionSubscriber decrypt tenant binding (#5430)', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    delete process.env.TENANT_DATA_ENCRYPTION
+    registerEntityIds({ test: { parent: 'test:parent', child: 'test:child' } })
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+    jest.restoreAllMocks()
+  })
+
+  it('leaves an entity untouched when its tenant contradicts the caller scope', async () => {
+    const calls: Array<{ entityId: string; tenantId: string | null }> = []
+    const entity = { secret: 'enc:alpha', tenantId: 'tenant-b', __meta: CHILD_META }
+
+    await new TenantEncryptionSubscriber(makeService(calls)).decryptEntityGraph(
+      entity,
+      CHILD_META,
+      makeEm() as any,
+      { syncOriginal: true, fallbackScope: { tenantId: 'tenant-a', organizationId: null } },
+    )
+
+    expect(calls).toEqual([])
+    expect(entity.secret).toBe('enc:alpha')
+  })
+
+  it('still decrypts an entity whose tenant matches the caller scope', async () => {
+    const calls: Array<{ entityId: string; tenantId: string | null }> = []
+    const entity = { secret: 'enc:alpha', tenantId: 'tenant-a', __meta: CHILD_META }
+
+    await new TenantEncryptionSubscriber(makeService(calls)).decryptEntityGraph(
+      entity,
+      CHILD_META,
+      makeEm() as any,
+      { syncOriginal: true, fallbackScope: { tenantId: 'tenant-a', organizationId: null } },
+    )
+
+    expect(calls).toEqual([{ entityId: 'test:child', tenantId: 'tenant-a' }])
+    expect(entity.secret).toBe('alpha')
+  })
+
+  it('still decrypts when the caller supplied no scope at all', async () => {
+    const calls: Array<{ entityId: string; tenantId: string | null }> = []
+    const entity = { secret: 'enc:alpha', tenantId: 'tenant-b', __meta: CHILD_META }
+
+    await new TenantEncryptionSubscriber(makeService(calls)).decryptEntityGraph(
+      entity,
+      CHILD_META,
+      makeEm() as any,
+      { syncOriginal: true },
+    )
+
+    expect(calls).toEqual([{ entityId: 'test:child', tenantId: 'tenant-b' }])
+    expect(entity.secret).toBe('alpha')
+  })
+
+  it('falls back to the caller tenant for an entity that carries none of its own', async () => {
+    const calls: Array<{ entityId: string; tenantId: string | null }> = []
+    const entity = { secret: 'enc:alpha', __meta: CHILD_META }
+
+    await new TenantEncryptionSubscriber(makeService(calls)).decryptEntityGraph(
+      entity,
+      CHILD_META,
+      makeEm() as any,
+      { syncOriginal: true, fallbackScope: { tenantId: 'tenant-a', organizationId: null } },
+    )
+
+    expect(calls).toEqual([{ entityId: 'test:child', tenantId: 'tenant-a' }])
+    expect(entity.secret).toBe('alpha')
+  })
+
+  it('does not leak a refused parent scope into its loaded relations', async () => {
+    const calls: Array<{ entityId: string; tenantId: string | null }> = []
+    const child = { secret: 'enc:beta', tenantId: 'tenant-b', __meta: CHILD_META }
+    const parent = {
+      secret: 'enc:alpha',
+      tenantId: 'tenant-b',
+      child: { isInitialized: () => true, unwrap: () => child },
+      __meta: PARENT_META,
+    }
+
+    await new TenantEncryptionSubscriber(makeService(calls)).decryptEntityGraph(
+      parent,
+      PARENT_META,
+      makeEm() as any,
+      { syncOriginal: true, fallbackScope: { tenantId: 'tenant-a', organizationId: null } },
+    )
+
+    expect(calls).toEqual([])
+    expect(parent.secret).toBe('enc:alpha')
+    expect(child.secret).toBe('enc:beta')
+  })
+})

package/src/lib/encryption/decryptScope.ts

@@ -0,0 +1,119 @@
+export type DecryptScopeDecision =
+  | { decrypt: true; tenantId: string | null; organizationId: string | null }
+  | { decrypt: false; reason: 'tenant-mismatch'; rowTenantId: string; callerTenantId: string }
+
+export type DecryptScopeInput = {
+  rowTenantId?: string | null
+  rowOrganizationId?: string | null
+  callerTenantId?: string | null
+  callerOrganizationId?: string | null
+}
+
+/**
+ * Decides whether a row may be decrypted, and with which scope.
+ *
+ * Decryption keys off the row's own `tenant_id` by design: a genuinely cross-tenant read
+ * passes no caller tenant, so the row is the only available key id. That precedence becomes
+ * dangerous when the caller DID assert a tenant and the row contradicts it — the engine would
+ * fetch the foreign tenant's DEK and hand back its plaintext, amplifying a scoping bug instead
+ * of containing it. In that state the row is refused: callers return it untouched (ciphertext).
+ *
+ * Organization is deliberately NOT compared. Organizations inside a tenant share the tenant DEK,
+ * so an org mismatch does not change which key is used, and comparing it would break legitimate
+ * multi-org reads for no key-scope benefit.
+ *
+ * That same argument does NOT exempt a `keyScope: 'system'` map, even though its key id is
+ * `system:<entityId>` and ignores the tenant entirely, so a mismatch there changes nothing about
+ * which key would be used. This helper is intentionally id-only — it never sees the map — so it
+ * refuses those rows too. That is conservative rather than correct-by-construction, and it is
+ * unreachable today: the only shipped system-scoped map is `onboarding:onboarding_request`, whose
+ * readers pass either no scope or the same tenant they filter on. A future system-scoped map read
+ * across tenants would need the decision moved to a caller that can see `keyScope`.
+ *
+ * The refusal branch engages only when BOTH ids are present. Two shapes therefore degrade instead
+ * of refusing, and both are safe:
+ * - No row tenant (`rowTenantId` null) — the caller's own tenant is used, which is the strongest
+ *   form of the binding: a foreign row can only ever be attempted with the caller's DEK. Both query
+ *   engines force `tenant_id` into the decrypt-decision projection so a narrow `fields` list cannot
+ *   silently land here, but a table without a `tenant_id` column genuinely has no row tenant.
+ * - No caller tenant (`callerTenantId` null) — there is no entitlement to bind against, so the row's
+ *   own tenant wins exactly as it did before this guard existed. The ORM path reaches this whenever
+ *   a `find*WithDecryption` call passes no scope.
+ */
+export function resolveDecryptScope(input: DecryptScopeInput): DecryptScopeDecision {
+  const rowTenantId = input.rowTenantId ?? null
+  const callerTenantId = input.callerTenantId ?? null
+  if (rowTenantId && callerTenantId && rowTenantId !== callerTenantId) {
+    return { decrypt: false, reason: 'tenant-mismatch', rowTenantId, callerTenantId }
+  }
+  return {
+    decrypt: true,
+    tenantId: rowTenantId ?? callerTenantId,
+    organizationId: input.rowOrganizationId ?? input.callerOrganizationId ?? null,
+  }
+}
+
+export type DecryptEnabledInput = {
+  decryptEncryptedFields?: boolean
+}
+
+/**
+ * Resolves whether a query decrypts its encrypted fields at all.
+ *
+ * A pure opt-in to declining decryption: unset means today's behaviour, and only an explicit
+ * `false` turns decryption off. It is deliberately NOT defaulted off for
+ * `omitAutomaticTenantOrgScope` queries — both engines require `opts.tenantId` on every query,
+ * so `resolveDecryptScope` always has a caller tenant to bind against and already refuses any
+ * foreign-tenant row on those reads. Flipping the default there would only strip plaintext from
+ * legitimately global rows (`tenant_id IS NULL`), which the guard correctly allows.
+ *
+ * Declining also disables the plaintext-sort path, so a sort on an encrypted field degrades to
+ * SQL ordering over ciphertext. The engines warn once when that happens.
+ */
+export function resolveDecryptEnabled(opts: DecryptEnabledInput): boolean {
+  return opts.decryptEncryptedFields !== false
+}
+
+const MAX_SAMPLED_TENANT_IDS = 3
+
+export const DECRYPT_REFUSAL_LOG_MESSAGE =
+  'Skipped decryption for rows whose tenant does not match the query tenant'
+
+export const DECLINED_ENCRYPTED_SORT_LOG_MESSAGE =
+  'Sorting on an encrypted field while decryption is declined; rows are ordered by ciphertext'
+
+/**
+ * Collects refused rows during one query execution so the caller can emit a single aggregated
+ * warning instead of one line per row — a mis-scoped query can refuse a whole page.
+ *
+ * Refusals are deduplicated by row id because the plaintext-sort path decrypts an overlapping row
+ * set twice (a candidate scan, then the page rows); counting both passes would overstate the
+ * refusal count by up to a page. Rows recorded without an id cannot be deduplicated and are
+ * counted individually.
+ */
+export class DecryptRefusalTally {
+  private readonly refusedRowIds = new Set<string>()
+  private unidentifiedCount = 0
+  private readonly rowTenantIds = new Set<string>()
+  private callerTenantId: string | null = null
+
+  record(decision: Extract<DecryptScopeDecision, { decrypt: false }>, rowId?: string | null): void {
+    if (rowId === undefined || rowId === null || rowId === '') this.unidentifiedCount += 1
+    else this.refusedRowIds.add(String(rowId))
+    this.callerTenantId = decision.callerTenantId
+    if (this.rowTenantIds.size < MAX_SAMPLED_TENANT_IDS) this.rowTenantIds.add(decision.rowTenantId)
+  }
+
+  get refused(): number {
+    return this.refusedRowIds.size + this.unidentifiedCount
+  }
+
+  toLogContext(entity: string): Record<string, unknown> {
+    return {
+      entity,
+      refusedRows: this.refused,
+      callerTenantId: this.callerTenantId,
+      rowTenantIds: Array.from(this.rowTenantIds),
+    }
+  }
+}

package/src/lib/encryption/find.ts

@@ -6,7 +6,8 @@ import type {
   FindOptions,
 } from '@mikro-orm/postgresql'
 import { warnOnEncryptedLikeFilter } from './likeFilterWarning'
-import { decryptEntitiesWithFallbackScope } from './subscriber'
+import { decryptEntitiesWithFallbackScope, runWithCallerDecryptScope } from './subscriber'
+import { DecryptRefusalTally } from './decryptScope'
 import type { TenantDataEncryptionService } from './tenantDataEncryptionService'
 
 export type DecryptionScope = {
@@ -32,15 +33,17 @@ export async function findWithDecryption<Entity extends object, Hint extends str
     tenantId: scope?.tenantId,
     encryptionService: scope?.encryptionService,
   })
-  const records = (await em.find<Entity, Hint, any, any>(entityName as any, where as any, options as any)) as any as
-    | Entity[]
-    | undefined
+  const refusalTallies = new Map<string, DecryptRefusalTally>()
+  const records = (await runWithCallerDecryptScope(scope ?? {}, refusalTallies, () =>
+    em.find<Entity, Hint, any, any>(entityName as any, where as any, options as any),
+  )) as any as Entity[] | undefined
   if (!Array.isArray(records) || records.length === 0) return records ?? []
   await decryptEntitiesWithFallbackScope(records, {
     em,
     tenantId: scope?.tenantId ?? null,
     organizationId: scope?.organizationId ?? null,
     encryptionService: scope?.encryptionService ?? null,
+    refusalTallies,
   })
   return records
 }
@@ -59,15 +62,17 @@ export async function findOneWithDecryption<Entity extends object, Hint extends
     tenantId: scope?.tenantId,
     encryptionService: scope?.encryptionService,
   })
-  const record = (await em.findOne<Entity, Hint, any, any>(entityName as any, where as any, options as any)) as any as
-    | Entity
-    | null
+  const refusalTallies = new Map<string, DecryptRefusalTally>()
+  const record = (await runWithCallerDecryptScope(scope ?? {}, refusalTallies, () =>
+    em.findOne<Entity, Hint, any, any>(entityName as any, where as any, options as any),
+  )) as any as Entity | null
   if (!record) return record
   await decryptEntitiesWithFallbackScope(record, {
     em,
     tenantId: scope?.tenantId ?? null,
     organizationId: scope?.organizationId ?? null,
     encryptionService: scope?.encryptionService ?? null,
+    refusalTallies,
   })
   return record
 }
@@ -86,11 +91,10 @@ export async function findAndCountWithDecryption<Entity extends object, Hint ext
     tenantId: scope?.tenantId,
     encryptionService: scope?.encryptionService,
   })
-  const [recordsRaw, count] = await em.findAndCount<Entity, Hint, any, any>(
-    entityName as any,
-    where as any,
-    options as any,
-  ) as any as [Entity[] | undefined, number]
+  const refusalTallies = new Map<string, DecryptRefusalTally>()
+  const [recordsRaw, count] = (await runWithCallerDecryptScope(scope ?? {}, refusalTallies, () =>
+    em.findAndCount<Entity, Hint, any, any>(entityName as any, where as any, options as any),
+  )) as any as [Entity[] | undefined, number]
   const records = Array.isArray(recordsRaw) ? recordsRaw : []
   if (!records.length) return [records, count]
   await decryptEntitiesWithFallbackScope(records, {
@@ -98,6 +102,7 @@ export async function findAndCountWithDecryption<Entity extends object, Hint ext
     tenantId: scope?.tenantId ?? null,
     organizationId: scope?.organizationId ?? null,
     encryptionService: scope?.encryptionService ?? null,
+    refusalTallies,
   })
   return [records, count]
 }

package/src/lib/encryption/subscriber.ts

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
 import type { EntityMetadata, EventArgs, EventSubscriber, FlushEventArgs } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { DriverException, ReferenceKind } from '@mikro-orm/core'
@@ -8,6 +9,7 @@ import { isTenantDataEncryptionEnabled } from './toggles'
 import { isEncryptionDebugEnabled } from './toggles'
 import { resolveTenantEncryptionService } from './customFieldValues'
 import { createLogger } from '../logger'
+import { DECRYPT_REFUSAL_LOG_MESSAGE, DecryptRefusalTally, resolveDecryptScope } from './decryptScope'
 import { listEntityMetadataFromRegistry } from '../db/entityMetadata'
 
 const logger = createLogger('shared').child({ component: 'encryption' })
@@ -21,7 +23,38 @@ type Scoped = {
   organization?: { id?: string | null } | null
 }
 
-type Scope = { tenantId: string | null; organizationId: string | null }
+type Scope = { tenantId: string | null; organizationId: string | null; bindsTenant?: boolean }
+
+type CallerDecryptContext = { scope: Scope; refusalTallies: Map<string, DecryptRefusalTally> }
+
+const callerDecryptContext = new AsyncLocalStorage<CallerDecryptContext>()
+
+function toCallerScope(tenantId?: string | null, organizationId?: string | null): Scope | undefined {
+  if (!tenantId && !organizationId) return undefined
+  return { tenantId: tenantId ?? null, organizationId: organizationId ?? null }
+}
+
+/**
+ * Runs an ORM read so that the `onLoad` / `afterFind` hooks it triggers decrypt under the caller's
+ * scope instead of the loaded row's own tenant. Without it, hydration would decrypt a foreign-tenant
+ * entity with that tenant's DEK before `find*WithDecryption` gets to apply the tenant binding.
+ * Refusals raised during hydration are collected in `refusalTallies` so the caller reports them once.
+ */
+export async function runWithCallerDecryptScope<T>(
+  scope: { tenantId?: string | null; organizationId?: string | null },
+  refusalTallies: Map<string, DecryptRefusalTally>,
+  read: () => Promise<T>,
+): Promise<T> {
+  const callerScope = toCallerScope(scope.tenantId, scope.organizationId)
+  if (!callerScope) return callerDecryptContext.exit(read)
+  return callerDecryptContext.run({ scope: callerScope, refusalTallies }, read)
+}
+
+function readCallerDecryptContext(): { fallbackScope?: Scope; refusalTallies?: Map<string, DecryptRefusalTally> } {
+  const context = callerDecryptContext.getStore()
+  if (!context) return {}
+  return { fallbackScope: context.scope, refusalTallies: context.refusalTallies }
+}
 
 function resolveScope(entity: Scoped): Scope {
   const tenantId = entity.tenantId ?? entity.tenant_id ?? entity.tenant?.id ?? null
@@ -344,11 +377,36 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     target: Record<string, unknown>,
     meta: EntityMetadata<any> | undefined,
     em?: { getMetadata?: () => any; getComparator?: () => any },
-    opts: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},
+    opts: {
+      syncOriginal?: boolean
+      seen?: WeakSet<object>
+      fallbackScope?: Scope
+      refusalTallies?: Map<string, DecryptRefusalTally>
+    } = {},
   ) {
     await this.decrypt(target, meta, em, opts)
   }
 
+  /**
+   * Scope handed to a loaded relation. The caller's tenant binding is inherited only through a parent
+   * that carries a tenant of its own (and so already passed the binding): a tenant-less parent such as
+   * a join row may legitimately link entities of several tenants, so its relations keep the caller's
+   * scope as a key fallback but are not refused against it. Entities hydrated by the same read are
+   * still checked against the caller directly in `onLoad`.
+   */
+  private resolveRelationFallback(
+    fallbackScope: Scope | undefined,
+    tenantId: string | null,
+    organizationId: string | null,
+  ): Scope {
+    if (tenantId) {
+      if (fallbackScope && fallbackScope.bindsTenant !== false) return fallbackScope
+      return { tenantId, organizationId }
+    }
+    if (fallbackScope) return { ...fallbackScope, bindsTenant: false }
+    return { tenantId: null, organizationId }
+  }
+
   private async decrypt(
     target: Record<string, unknown>,
     meta: EntityMetadata<any> | undefined,
@@ -357,7 +415,13 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
       syncOriginal = false,
       seen,
       fallbackScope,
-    }: { syncOriginal?: boolean; seen?: WeakSet<object>; fallbackScope?: Scope } = {},
+      refusalTallies,
+    }: {
+      syncOriginal?: boolean
+      seen?: WeakSet<object>
+      fallbackScope?: Scope
+      refusalTallies?: Map<string, DecryptRefusalTally>
+    } = {},
   ) {
     const visited = seen ?? new WeakSet<object>()
     if (visited.has(target as object)) return
@@ -370,8 +434,27 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     const entityId = this.resolveEntityId(resolvedMeta)
     if (!entityId) return
     const { tenantId, organizationId } = resolveScope(target)
-    const scopedTenantId = tenantId ?? fallbackScope?.tenantId ?? null
-    const scopedOrgId = organizationId ?? fallbackScope?.organizationId ?? null
+    const decision = resolveDecryptScope({
+      rowTenantId: tenantId,
+      rowOrganizationId: organizationId,
+      callerTenantId: fallbackScope?.bindsTenant === false ? null : fallbackScope?.tenantId ?? null,
+      callerOrganizationId: fallbackScope?.organizationId ?? null,
+    })
+    if (!decision.decrypt) {
+      const rowId = (target as { id?: unknown }).id
+      if (refusalTallies) {
+        const tally = refusalTallies.get(entityId) ?? new DecryptRefusalTally()
+        refusalTallies.set(entityId, tally)
+        tally.record(decision, rowId == null ? null : String(rowId))
+      } else {
+        const tally = new DecryptRefusalTally()
+        tally.record(decision, rowId == null ? null : String(rowId))
+        logger.warn(DECRYPT_REFUSAL_LOG_MESSAGE, tally.toLogContext(entityId))
+      }
+      return
+    }
+    const scopedTenantId = decision.tenantId ?? fallbackScope?.tenantId ?? null
+    const scopedOrgId = decision.organizationId
     // Capture pending (un-flushed) changes BEFORE decrypt mutates the target. Re-baselining a
     // managed entity that a command already mutated would clear its dirty changeset and silently
     // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related
@@ -385,11 +468,7 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     if (syncOriginal && !hadPendingChanges) {
       this.syncOriginalEntityData(target, resolvedMeta, em as any)
     }
-    const nextFallback =
-      fallbackScope ??
-      (tenantId || organizationId
-        ? { tenantId: tenantId ?? null, organizationId: organizationId ?? null }
-        : { tenantId: scopedTenantId, organizationId: scopedOrgId })
+    const nextFallback = this.resolveRelationFallback(fallbackScope, tenantId, organizationId)
     // Best-effort deep decrypt for loaded relations so populated graphs get cleaned too.
     try {
       const extractEntities = (value: any): any[] => {
@@ -437,6 +516,7 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
               syncOriginal: true,
               seen: visited,
               fallbackScope: nextFallback,
+              refusalTallies,
             })
           }
           continue
@@ -451,6 +531,7 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
               syncOriginal: true,
               seen: visited,
               fallbackScope: nextFallback,
+              refusalTallies,
             })
           }
         }
@@ -488,7 +569,7 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
   }
 
   async onLoad(args: EventArgs<any>) {
-    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })
+    await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true, ...readCallerDecryptContext() })
   }
 
   afterFlush(args: FlushEventArgs) {
@@ -498,7 +579,7 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
   async afterFind(args: EventArgs<any> & { entities?: unknown[] }) {
     const entities = Array.isArray(args.entities) ? args.entities : []
     for (const entity of entities) {
-      await this.decrypt(entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })
+      await this.decrypt(entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true, ...readCallerDecryptContext() })
     }
   }
 }
@@ -521,11 +602,13 @@ export async function decryptEntitiesWithFallbackScope(
     tenantId,
     organizationId,
     encryptionService,
+    refusalTallies = new Map<string, DecryptRefusalTally>(),
   }: {
     em: { getMetadata?: () => any; getComparator?: () => any }
     tenantId?: string | null
     organizationId?: string | null
     encryptionService?: TenantDataEncryptionService | null
+    refusalTallies?: Map<string, DecryptRefusalTally>
   },
 ): Promise<void> {
   if (!isTenantDataEncryptionEnabled()) return
@@ -534,19 +617,18 @@ export async function decryptEntitiesWithFallbackScope(
   const service = encryptionService ?? resolveTenantEncryptionService(em as any)
   if (!service || !service.isEnabled()) return
   const subscriber = getSubscriberForService(service)
-  const fallback: Scope | undefined =
-    tenantId || organizationId
-      ? {
-          tenantId: tenantId ?? null,
-          organizationId: organizationId ?? null,
-        }
-      : undefined
+  const fallback = toCallerScope(tenantId, organizationId)
   for (const entity of list) {
     if (!entity || typeof entity !== 'object') continue
     const meta = (entity as any).__meta ?? (entity as any).__helper?.__meta
     await subscriber.decryptEntityGraph(entity as Record<string, unknown>, meta, em as any, {
       syncOriginal: true,
       fallbackScope: fallback,
+      refusalTallies,
     })
   }
+  for (const [entityId, tally] of refusalTallies) {
+    if (tally.refused === 0) continue
+    logger.warn(DECRYPT_REFUSAL_LOG_MESSAGE, tally.toLogContext(entityId))
+  }
 }