@porulle/core 0.11.0 → 0.14.0

package/src/auth/auth-schema.ts

@@ -4,6 +4,7 @@ import {
   timestamp,
   boolean,
   integer,
+  uniqueIndex,
 } from "drizzle-orm/pg-core";
 
 export const user = pgTable("user", {
@@ -19,6 +20,12 @@ export const user = pgTable("user", {
     .notNull(),
   vendorId: text("vendor_id"),
   posOperatorPin: text("pos_operator_pin"),
+  // Contributed by the twoFactor and phoneNumber plugins. Declared
+  // unconditionally: the plugins are config-gated, but one shipped schema has
+  // to satisfy every configuration a merchant can choose.
+  twoFactorEnabled: boolean("two_factor_enabled").default(false),
+  phoneNumber: text("phone_number").unique(),
+  phoneNumberVerified: boolean("phone_number_verified").default(false),
 });
 
 export const session = pgTable("session", {
@@ -37,25 +44,35 @@ export const session = pgTable("session", {
   activeOrganizationId: text("active_organization_id"),
 });
 
-export const account = pgTable("account", {
-  id: text("id").primaryKey(),
-  accountId: text("account_id").notNull(),
-  providerId: text("provider_id").notNull(),
-  userId: text("user_id")
-    .notNull()
-    .references(() => user.id, { onDelete: "cascade" }),
-  accessToken: text("access_token"),
-  refreshToken: text("refresh_token"),
-  idToken: text("id_token"),
-  accessTokenExpiresAt: timestamp("access_token_expires_at"),
-  refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
-  scope: text("scope"),
-  password: text("password"),
-  createdAt: timestamp("created_at").defaultNow().notNull(),
-  updatedAt: timestamp("updated_at")
-    .$onUpdate(() => /* @__PURE__ */ new Date())
-    .notNull(),
-});
+export const account = pgTable(
+  "account",
+  {
+    id: text("id").primaryKey(),
+    issuer: text("issuer").notNull(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at")
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+  },
+  (table) => [
+    uniqueIndex("account_issuer_account_id_unique").on(
+      table.issuer,
+      table.accountId,
+    ),
+  ],
+);
 
 export const verification = pgTable("verification", {
   id: text("id").primaryKey(),
@@ -136,4 +153,18 @@ export const jwks = pgTable("jwks", {
   privateKey: text("private_key").notNull(),
   createdAt: timestamp("created_at").notNull(),
   expiresAt: timestamp("expires_at"),
+  alg: text("alg"),
+  crv: text("crv"),
+});
+
+export const twoFactor = pgTable("twoFactor", {
+  id: text("id").primaryKey(),
+  secret: text("secret").notNull(),
+  backupCodes: text("backup_codes").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  verified: boolean("verified").default(false),
+  failedVerificationCount: integer("failed_verification_count").default(0),
+  lockedUntil: timestamp("locked_until"),
 });

package/src/auth/middleware.ts

@@ -1,40 +1,23 @@
 import type { MiddlewareHandler } from "hono";
-import type { AuthSessionLike, CommerceConfig } from "../config/types.js";
+import type { CommerceConfig } from "../config/types.js";
 import type { Actor } from "./types.js";
 import type { AuthInstance } from "./setup.js";
+import { getCustomerPermissions, resolveActor } from "./actor.js";
 import { DEFAULT_ORG_ID } from "./org.js";
 import { isStrictOrgResolution } from "./strict-org-resolution.js";
 
-const DEFAULT_CUSTOMER_PERMISSIONS = [
-  "catalog:read",
-  "cart:create",
-  "cart:read",
-  "cart:update",
-  "orders:create",
-  "orders:read:own",
-  "customers:read:self",
-  "customers:update:self",
-] as const;
-
-function getCustomerPermissions(config: CommerceConfig): string[] {
-  return config.auth?.customerPermissions ?? [...DEFAULT_CUSTOMER_PERMISSIONS];
+function emptyToNull(value: string | null | undefined): string | null {
+  return value == null || value === "" ? null : value;
 }
 
+// Exported so the storefront contract can be pinned by a test: an anonymous
+// visitor resolved by `storeResolver` gets these permissions, so dropping
+// `catalog:read` here would 401 every public storefront read.
+export { DEFAULT_CUSTOMER_PERMISSIONS } from "./actor.js";
+
 const LEGACY_STORE_RESOLVER_WARN_COOLDOWN_MS = 60_000;
 let lastLegacyStoreResolverWarnAt = 0;
 
-function resolvePermissions(
-  session: AuthSessionLike,
-  config: CommerceConfig,
-): string[] {
-  const role = session.session.activeOrganizationRole;
-  if (!role) {
-    return getCustomerPermissions(config);
-  }
-  const roleConfig = config.auth?.roles?.[role];
-  return roleConfig ? roleConfig.permissions : [];
-}
-
 export function authMiddleware(
   auth: AuthInstance,
   config: CommerceConfig,
@@ -60,77 +43,14 @@ export function authMiddleware(
       }
     }
 
-    const session = (await auth.api.getSession({
-      headers: c.req.raw.headers,
-    })) as AuthSessionLike | null;
-
-    if (session) {
-      // Better Auth's session stores activeOrganizationId, but often not the role.
-      // For single-store apps (org_default), users may never call set-active,
-      // so activeOrganizationId can be null even for valid org members.
-      let role = session.session.activeOrganizationRole as string | undefined;
-      let orgId = session.session.activeOrganizationId as string | null;
-
-      // If no active org, try to resolve the user's membership in org_default.
-      // This handles the common case where the user is a member but hasn't
-      // called organization/set-active (single-store apps, seed scripts, tests).
-      if (!role && auth.api.getFullOrganization) {
-        try {
-          const org = await auth.api.getFullOrganization({
-            query: { organizationId: orgId ?? defaultOrgId },
-            headers: c.req.raw.headers,
-          });
-          if (org?.members) {
-            const membership = org.members.find(
-              (m) => m.userId === session.user.id,
-            );
-            if (membership) {
-              role = membership.role;
-              orgId = orgId ?? defaultOrgId;
-            }
-          }
-        } catch {
-          // fall through — treat as customer
-        }
-      }
-
-      // Also try getActiveMemberRole if active org is set
-      if (!role && orgId && auth.api.getActiveMemberRole) {
-        try {
-          const roleResult = await auth.api.getActiveMemberRole({
-            headers: c.req.raw.headers,
-          });
-          role = (roleResult as Record<string, unknown>)?.role as string | undefined;
-        } catch {
-          // fall through — treat as customer
-        }
-      }
-
-      // For customers without org membership, resolve the store from the request.
-      // This enables multi-store SaaS where each storefront is a different org.
-      if (!orgId && config.auth?.storeResolver) {
-        try {
-          const resolved = await config.auth.storeResolver(c.req.raw);
-          if (resolved) orgId = resolved;
-        } catch {
-          // fall through — use defaultOrgId
-        }
-      }
-
-      const enrichedSession = {
-        ...session,
-        session: { ...session.session, activeOrganizationRole: role ?? null },
-      };
-      c.set("actor", {
-        type: "user",
-        userId: session.user.id,
-        email: session.user.email ?? null,
-        name: session.user.name ?? "User",
-        vendorId: session.user.vendorId ?? null,
-        organizationId: orgId ?? defaultOrgId,
-        role: role ?? "customer",
-        permissions: resolvePermissions(enrichedSession, config),
-      } satisfies Actor);
+    const actor = await resolveActor(
+      c.req.raw.headers,
+      auth,
+      config,
+      c.req.raw,
+    );
+    if (actor) {
+      c.set("actor", actor);
       await next();
       return;
     }
@@ -192,9 +112,13 @@ export function authMiddleware(
                 : null;
           const metaOrg = typeof meta?.organizationId === "string" ? meta.organizationId : undefined;
           const orgId = (metaOrg ?? apiKey.organizationId ?? defaultOrgId) as string;
-          const userId = ((typeof meta?.operatorId === "string" ? meta.operatorId : undefined)
-            ?? apiKey.referenceId
-            ?? "") as string;
+          // No operator and no reference means the key carries no user
+          // identity. Leave it absent rather than substituting a shared
+          // placeholder, which would make every such key look like one person.
+          const userId = emptyToNull(
+            (typeof meta?.operatorId === "string" ? meta.operatorId : undefined) ??
+              (typeof apiKey.referenceId === "string" ? apiKey.referenceId : undefined),
+          );
 
           // Better Auth stores permissions as Record<string, string[]>
           // (e.g. {"catalog":["read","create"]}).  Flatten to the
@@ -245,7 +169,7 @@ export function authMiddleware(
             // services can scope queries correctly.
             c.set("actor", {
               type: "user",
-              userId: "anonymous",
+              userId: null,
               email: null,
               name: "Anonymous",
               vendorId: null,

package/src/auth/org.ts

@@ -37,14 +37,26 @@ export function setBootDefaultOrgId(orgId: string): void {
   _bootDefaultOrgId = orgId;
 }
 
+/**
+ * Resolves org using an explicit config default — not ambient boot state.
+ * Use when the caller holds CommerceConfig and may lack an actor organizationId.
+ */
+export function resolveOrgIdForCommerce(
+  actor: unknown,
+  config?: CommerceConfig | null,
+): string {
+  return resolveOrgId(actor, config?.auth?.defaultOrganizationId, config ?? undefined);
+}
+
 /**
  * Extracts the organization ID from an actor.
  *
  * Resolution order:
  * 1. Actor's organizationId (set by middleware from session/API key/storeResolver)
  * 2. Explicit defaultOrgId parameter (caller override)
- * 3. Boot-time default (from config.auth.defaultOrganizationId via setBootDefaultOrgId)
- * 4. Deprecated fallback to DEFAULT_ORG_ID (will be removed)
+ * 3. Strict check — throw OrgResolutionError when enabled
+ * 4. Boot-time default (from config.auth.defaultOrganizationId via setBootDefaultOrgId)
+ * 5. Deprecated fallback to DEFAULT_ORG_ID (will be removed)
  */
 export function resolveOrgId(
   actor: unknown,
@@ -56,12 +68,12 @@ export function resolveOrgId(
     if (typeof orgId === "string") return orgId;
   }
   if (defaultOrgId) return defaultOrgId;
-  if (_bootDefaultOrgId) return _bootDefaultOrgId;
   if (isStrictOrgResolution(commerceConfig)) {
     throw new OrgResolutionError(
       "Organization could not be resolved: no actor organizationId, no defaultOrgId, and no configured default organization.",
     );
   }
+  if (_bootDefaultOrgId) return _bootDefaultOrgId;
   warnDeprecatedOrgDefaultFallback();
   return DEFAULT_ORG_ID;
 }

package/src/auth/organization-guard.ts

@@ -0,0 +1,158 @@
+import type { MiddlewareHandler } from "hono";
+import { and, eq } from "drizzle-orm";
+import type { CommerceConfig } from "../config/types.js";
+import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
+import { invitation, member } from "./auth-schema.js";
+import { canGrantRole, granterForRole, isCompositeRole } from "./role-authority.js";
+
+/**
+ * Guards Better Auth's organization endpoints, which this repository mounts but
+ * does not govern.
+ *
+ * Red-team round 6 found two problems behind that mount.
+ *
+ * Invitation acceptance re-checked nothing: an invitation minted a member at
+ * the authority its inviter held up to seven days ago, so a demoted or revoked
+ * inviter's outstanding invitation still handed out ownership — a full
+ * organization takeover. Acceptance now re-reads the inviter's current
+ * authority before the grant is allowed through.
+ *
+ * And the plugin's own membership writers are a second role-changing surface
+ * running none of the rules `admin/staff.ts` enforces: no permission
+ * containment, no rank floor, no last-owner invariant, and they accept
+ * comma-composite role strings that `admin/staff.ts` refuses. They are refused
+ * here. `admin/staff.ts` is this repository's governed membership surface, and
+ * having one is worth more than making two of them agree.
+ */
+
+const ORGANIZATION_PREFIX = "/api/auth/organization/";
+
+/**
+ * Better Auth endpoints that write membership or define what a role may do.
+ *
+ * `invite-member` currently throws for every role instead of refusing: the
+ * plugin is configured with commerce permission arrays where its access-control
+ * model expects `Role` objects exposing `.authorize()`, so its permission check
+ * dies of type confusion. That is fail-closed by accident, and the accident is
+ * one "fix the roles wiring" commit away from being fail-open. Refusing here
+ * makes the closure deliberate, so repairing that wiring cannot quietly open an
+ * ungoverned door. `update-member-role` is not even inert today — Better Auth
+ * short-circuits it for organization creators, so an owner reaches it.
+ */
+const REFUSED_ENDPOINTS = new Set([
+  "invite-member",
+  "update-member-role",
+  "remove-member",
+  "leave",
+  "create-role",
+  "update-role",
+  "delete-role",
+]);
+
+function endpointName(path: string): string | null {
+  const normalized = path.replace(/\/+$/, "");
+  return normalized.startsWith(ORGANIZATION_PREFIX)
+    ? normalized.slice(ORGANIZATION_PREFIX.length)
+    : null;
+}
+
+async function readJsonBody(request: Request): Promise<Record<string, unknown>> {
+  try {
+    return (await request.clone().json()) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+}
+
+export function organizationGuard(
+  db: DrizzleDatabase,
+  config: CommerceConfig,
+): MiddlewareHandler {
+  return async (c, next) => {
+    if (c.req.method !== "POST") {
+      await next();
+      return;
+    }
+
+    const endpoint = endpointName(c.req.path);
+    if (endpoint === null) {
+      await next();
+      return;
+    }
+
+    if (REFUSED_ENDPOINTS.has(endpoint)) {
+      return c.json(
+        {
+          error: {
+            code: "FORBIDDEN",
+            message: `"${endpoint}" is not a governed membership surface. Use /api/admin/staff, which enforces permission containment, the rank floor, and the last-owner invariant.`,
+          },
+        },
+        403,
+      );
+    }
+
+    if (endpoint !== "accept-invitation") {
+      await next();
+      return;
+    }
+
+    const body = await readJsonBody(c.req.raw);
+    const invitationId = typeof body.invitationId === "string" ? body.invitationId : null;
+    if (!invitationId) {
+      await next();
+      return;
+    }
+
+    const rows = await db
+      .select()
+      .from(invitation)
+      .where(eq(invitation.id, invitationId));
+    const pending = rows[0];
+    // Missing, already-answered, or expired invitations are Better Auth's own
+    // error surface — do not duplicate its messages here.
+    if (!pending || pending.status !== "pending") {
+      await next();
+      return;
+    }
+
+    const invitedRole = pending.role ?? "member";
+    const inviterRows = await db
+      .select({ role: member.role })
+      .from(member)
+      .where(
+        and(
+          eq(member.organizationId, pending.organizationId),
+          eq(member.userId, pending.inviterId),
+        ),
+      );
+    const inviterRole = inviterRows[0]?.role;
+
+    const stillAuthorized =
+      inviterRole !== undefined &&
+      !isCompositeRole(invitedRole) &&
+      canGrantRole(config, granterForRole(config, inviterRole), invitedRole);
+
+    if (stillAuthorized) {
+      await next();
+      return;
+    }
+
+    // The grant is dead: burn it rather than leaving it to be retried.
+    await db
+      .update(invitation)
+      .set({ status: "canceled" })
+      .where(and(eq(invitation.id, invitationId), eq(invitation.status, "pending")));
+
+    return c.json(
+      {
+        error: {
+          code: "FORBIDDEN",
+          message:
+            "This invitation is no longer valid: the member who sent it can no longer grant that role.",
+        },
+      },
+      403,
+    );
+  };
+}

package/src/auth/permissions.ts

@@ -1,16 +1,18 @@
 import { CommerceForbiddenError } from "../kernel/errors.js";
 import type { Actor } from "./types.js";
 
-export function assertPermission(actor: Actor | null, required: string): void {
-  if (!actor) {
-    throw new CommerceForbiddenError("Authentication required.");
-  }
-
-  if (actor.permissions.includes("*:*")) return;
+export function hasPermission(actor: Actor | null, required: string): boolean {
+  if (!actor) return false;
+  if (actor.permissions.includes("*:*")) return true;
 
   const [resource] = required.split(":");
-  if (resource && actor.permissions.includes(`${resource}:*`)) return;
-  if (actor.permissions.includes(required)) return;
+  if (resource && actor.permissions.includes(`${resource}:*`)) return true;
+  return actor.permissions.includes(required);
+}
+
+export function assertPermission(actor: Actor | null, required: string): void {
+  if (hasPermission(actor, required)) return;
+  if (!actor) throw new CommerceForbiddenError("Authentication required.");
 
   throw new CommerceForbiddenError(
     `Permission "${required}" is required. Your role "${actor.role}" does not include this permission.`,
@@ -22,7 +24,28 @@ export function assertOwnership(actor: Actor | null, resourceOwnerId: string | n
     throw new CommerceForbiddenError("Authentication required.");
   }
   if (actor.permissions.includes("*:*")) return;
+  if (!actor.userId || !resourceOwnerId) {
+    throw new CommerceForbiddenError("You do not have access to this resource.");
+  }
   if (actor.userId !== resourceOwnerId) {
     throw new CommerceForbiddenError("You do not have access to this resource.");
   }
 }
+
+/**
+ * The actor's user id, for code that keys a per-person resource on it.
+ *
+ * An actor without a user identity — a store resolver, an API key — has no
+ * owner key at all. Passing its absence through as one would make every such
+ * caller look like the same person, so this refuses instead of returning a
+ * value that reads as an identity.
+ */
+export function requireUserId(actor: Pick<Actor, "userId"> | null): string {
+  if (!actor) {
+    throw new CommerceForbiddenError("Authentication required.");
+  }
+  if (!actor.userId) {
+    throw new CommerceForbiddenError("This action requires a signed-in user.");
+  }
+  return actor.userId;
+}

package/src/auth/role-authority.ts

@@ -0,0 +1,107 @@
+import type { CommerceConfig } from "../config/types.js";
+
+const BUILTIN_ROLE_RANK: Record<string, number> = {
+  owner: 3,
+  admin: 2,
+};
+const CUSTOM_ROLE_RANK = 1;
+
+/**
+ * Who may grant which role.
+ *
+ * Every surface that mints or changes a membership answers this question, and
+ * they must all answer it the same way — the admin staff routes, and the guard
+ * in front of Better Auth's organization endpoints. Red-team round 6 found the
+ * takeover that follows from two surfaces disagreeing, so the arithmetic lives
+ * here and nowhere else.
+ */
+
+/**
+ * Better Auth stores a member's role as a comma-separated list, so `"owner"`
+ * and `"owner,admin"` are both owners to it. Commerce role lookups are exact
+ * string matches, which is how a composite string used to read as an unknown
+ * custom role on one side and an owner on the other.
+ */
+export function roleParts(role: string | null | undefined): string[] {
+  return (role ?? "")
+    .split(",")
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0);
+}
+
+export function isCompositeRole(role: string | null | undefined): boolean {
+  return roleParts(role).length > 1;
+}
+
+/** True when any part of the role string is `owner`, matching Better Auth. */
+export function isOwnerRole(role: string | null | undefined): boolean {
+  return roleParts(role).includes("owner");
+}
+
+export function permissionsForRole(config: CommerceConfig, role: string): string[] {
+  return config.auth?.roles?.[role]?.permissions ?? [];
+}
+
+export function hasPermissionFromList(
+  actorPermissions: readonly string[],
+  required: string,
+): boolean {
+  if (actorPermissions.includes("*:*")) return true;
+
+  const [resource] = required.split(":");
+  if (resource && actorPermissions.includes(`${resource}:*`)) return true;
+  return actorPermissions.includes(required);
+}
+
+/**
+ * The role's privilege rank. A composite role ranks as its strongest part, so
+ * `"owner,admin"` cannot slip past a rank floor by failing an exact lookup.
+ */
+export function roleRank(config: CommerceConfig, role: string | null | undefined): number {
+  const ranks = roleParts(role).map((part) => {
+    const builtin = BUILTIN_ROLE_RANK[part];
+    if (builtin !== undefined) return builtin;
+    if (permissionsForRole(config, part).includes("*:*")) return BUILTIN_ROLE_RANK["admin"]!;
+    return CUSTOM_ROLE_RANK;
+  });
+  return ranks.length > 0 ? Math.max(...ranks) : CUSTOM_ROLE_RANK;
+}
+
+export interface Granter {
+  role: string;
+  permissions: readonly string[];
+}
+
+/**
+ * A granter may assign `targetRole` only when it already holds every permission
+ * that role carries (containment) and outranks or equals it (rank floor).
+ */
+export function canGrantRole(
+  config: CommerceConfig,
+  granter: Granter | null,
+  targetRole: string,
+): boolean {
+  if (!granter) return false;
+  const contains = permissionsForRole(config, targetRole).every((permission) =>
+    hasPermissionFromList(granter.permissions, permission),
+  );
+  return contains && roleRank(config, granter.role) >= roleRank(config, targetRole);
+}
+
+/**
+ * The granter a stored membership row represents. Permissions come from the
+ * role's current definition, which is the whole point of re-checking authority
+ * later: the row is re-read, not the authority the actor had when they acted.
+ */
+export function granterForRole(config: CommerceConfig, role: string): Granter {
+  return { role, permissions: permissionsForRole(config, role) };
+}
+
+export function validRoles(config: CommerceConfig): Set<string> {
+  return new Set([
+    ...Object.keys(config.auth?.roles ?? {}),
+    "owner",
+    "admin",
+    "member",
+  ]);
+}

package/src/auth/setup.ts

@@ -6,6 +6,7 @@ import { organization, twoFactor, phoneNumber, jwt, bearer } from "better-auth/p
 import type { CommerceConfig } from "../config/types.js";
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import * as authSchema from "./auth-schema.js";
+import { AUTH_COOKIE_PREFIX } from "./actor.js";
 
 type BetterAuthDbProvider = "pg";
 
@@ -65,6 +66,23 @@ export function createAuth(
     | ReturnType<typeof jwt>
     | ReturnType<typeof bearer>
   > = [
+    // These are commerce permission arrays, not Better Auth access-control
+    // `Role` objects exposing `.authorize()`. Its organization plugin therefore
+    // cannot evaluate a permission with them, and every check reaching its
+    // authorize loop throws instead of deciding — fail-closed, but by type
+    // confusion rather than by intent.
+    //
+    // That is deliberate and stays. This repository does not use Better Auth's
+    // access-control model: `admin/staff.ts` is the governed membership
+    // surface, and `auth/role-authority.ts` holds the arithmetic. Handing the
+    // plugin real `Role` objects would stand up a second permission model to
+    // keep in agreement with the first, which is how the two layers disagreed
+    // about composite roles and owner counting in the first place.
+    //
+    // What must not be relied on is the throw. `auth/organization-guard.ts`
+    // refuses the plugin's membership writers outright, so repairing this
+    // wiring cannot turn an accidental closure into an open door. Pin that
+    // guard's test before changing anything here.
     organization({
       roles: (config.auth?.roles ?? {}) as unknown as Record<string, Role | undefined>,
     }),
@@ -161,7 +179,7 @@ export function createAuth(
         },
       },
       advanced: {
-        cookiePrefix: "uc",
+        cookiePrefix: AUTH_COOKIE_PREFIX,
         useSecureCookies: process.env.NODE_ENV === "production",
         // VAPT r2 (pi) finding: SameSite was never set anywhere. Without it,
         // browsers default to Lax for new cookies, but the explicit setting

package/src/auth/strict-org-resolution.ts

@@ -7,8 +7,14 @@ export function setBootStrictOrgResolution(strict: boolean): void {
 }
 
 export function isStrictOrgResolution(config?: CommerceConfig | null): boolean {
+  // Fail closed by default. Without an actor there is no tenant, and silently
+  // resolving to a default organization served one merchant's data to
+  // unauthenticated callers on every unguarded or allowlisted read path.
+  // Single-tenant deployments that relied on that fallback opt out explicitly.
+  if (config?.auth?.strictOrgResolution === false) return false;
+  if (process.env.STRICT_ORG_RESOLUTION === "false") return false;
   if (config?.auth?.strictOrgResolution === true) return true;
   if (process.env.STRICT_ORG_RESOLUTION === "true") return true;
   if ((config === undefined || config === null) && _bootStrictOrgResolution) return true;
-  return false;
+  return true;
 }