@porulle/core 0.11.0 → 0.14.0

package/src/kernel/plugin/manifest.ts

@@ -2,7 +2,8 @@ import type { Hono } from "hono";
 import type { OpenAPIHono, RouteConfig } from "@hono/zod-openapi";
 import type { PluginDb } from "../database/plugin-types.js";
 import type { DatabaseAdapter } from "../database/adapter.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
+import { isRoutePermissionGuard, markRoutePermissionGuard } from "../../interfaces/rest/utils.js";
 import { createScopedDb } from "../database/scoped-db.js";
 import {
   getPluginDatabaseScopeOrganizationId,
@@ -97,7 +98,7 @@ function buildPluginContextDatabase(
 ): PluginContext["database"] {
   const orgGetter = () =>
     getPluginDatabaseScopeOrganizationId() ??
-    resolveOrgId(null, undefined, commerceConfig);
+    resolveOrgIdForCommerce(null, commerceConfig);
 
   const scopedDb = createScopedDb(rawDb, orgGetter);
   const warnUnscoped = createRateLimitedUnscopedAccessWarning(logger);
@@ -288,7 +289,7 @@ export function defineCommercePlugin(
             const wrappedHandler = async (...args: unknown[]) => {
               const c = args[0] as { get?: (key: string) => unknown } | undefined;
               const actor = c?.get?.("actor");
-              const orgId = resolveOrgId(actor, undefined, k.config);
+              const orgId = resolveOrgIdForCommerce(actor, k.config);
               try {
                 return await runWithPluginDatabaseScope(orgId, async () => {
                   const out = originalHandler(...args);
@@ -305,19 +306,22 @@ export function defineCommercePlugin(
                 throw err; // re-throw so global handler still catches
               }
             };
+            const registeredHandler = isRoutePermissionGuard(originalHandler)
+              ? markRoutePermissionGuard(wrappedHandler)
+              : wrappedHandler;
 
             if ("openapi" in route) {
               // OpenAPI route: validated by Zod, appears in /api/doc
               // Hono type interop — OpenAPIHono.openapi() expects strict RouteConfig+Handler
               // generics that can't be statically resolved for dynamic plugin routes.
               // @ts-expect-error -- dynamic plugin routes cannot satisfy Hono's strict handler generics
-              (app as OpenAPIHono).openapi(route.openapi, wrappedHandler);
+              (app as OpenAPIHono).openapi(route.openapi, registeredHandler);
             } else {
               // Legacy route: raw handler, invisible to OpenAPI spec.
               // Explicit dispatch avoids casting Hono to a Record.
               // Handler cast is a single `as any` (Hono's overloaded method
               // signatures can't unify with our generic handler shape).
-              const h = wrappedHandler as any;
+              const h = registeredHandler as any;
               switch (route.method.toLowerCase()) {
                 case "get":     app.get(route.path, h); break;
                 case "post":    app.post(route.path, h); break;

package/src/modules/analytics/service.ts

@@ -9,7 +9,7 @@
 import type { CommerceConfig } from "../../config/types.js";
 import { CommerceValidationError } from "../../kernel/errors.js";
 import { Err, Ok, type Result } from "../../kernel/result.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import type { Actor } from "../../auth/types.js";
 import type { ReportParams, RetailReportsEngine } from "./reports.js";
 import { RETAIL_REPORTS } from "./reports.js";
@@ -135,7 +135,7 @@ export class AnalyticsService {
     if (!this.deps.reports) {
       return Err(new CommerceValidationError("Retail reports are not available."));
     }
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     return this.deps.reports.run(name, params, orgId);
   }
 

package/src/modules/audit/service.ts

@@ -3,7 +3,7 @@ import type { InferSelectModel } from "drizzle-orm";
 import type { DrizzleDatabase } from "../../kernel/database/drizzle-db.js";
 import type { TxContext } from "../../kernel/database/tx-context.js";
 import type { HookContext } from "../../kernel/hooks/types.js";
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { auditLog } from "./schema.js";
 
 export type AuditEntry = InferSelectModel<typeof auditLog>;
@@ -47,7 +47,7 @@ export function createNullAuditService(): AuditService {
     async record(args) {
       entries.push({
         id: crypto.randomUUID(),
-        organizationId: resolveOrgId(args.ctx.actor),
+        organizationId: resolveOrgIdForCommerce(args.ctx.actor, args.ctx.commerceConfig),
         entityType: args.entityType,
         entityId: args.entityId,
         event: args.event,
@@ -94,7 +94,7 @@ export function createAuditService(db: DrizzleDatabase): AuditService {
           : db;
 
       await dbOrTx.insert(auditLog).values({
-        organizationId: resolveOrgId(ctx.actor),
+        organizationId: resolveOrgIdForCommerce(ctx.actor, ctx.commerceConfig),
         entityType,
         entityId,
         event,

package/src/modules/cart/repository/index.ts

@@ -130,34 +130,48 @@ export class CartRepository {
   }
 
   /**
-   * Atomically transitions a cart from "active" to "checking_out".
-   * Returns the updated cart if the transition succeeded, or undefined if
-   * the cart was not in "active" status (e.g., a concurrent checkout already
-   * claimed it). This prevents TOCTOU race conditions on double-checkout.
+   * Atomically transitions a cart from "active" to "checking_out" and records
+   * `claimToken` as the holder of that claim. Returns the updated cart if the
+   * transition succeeded, or undefined if the cart was not in "active" status
+   * (e.g., a concurrent checkout already claimed it). This prevents TOCTOU race
+   * conditions on double-checkout.
    */
   async transitionToCheckingOut(
     id: string,
+    claimToken: string,
     ctx?: TxContext,
   ): Promise<Cart | undefined> {
     const db = this.getDb(ctx);
     const rows = await db
       .update(carts)
-      .set({ status: "checking_out", updatedAt: new Date() })
+      .set({ status: "checking_out", checkoutClaimToken: claimToken, updatedAt: new Date() })
       .where(and(eq(carts.id, id), eq(carts.status, "active")))
       .returning();
     return rows[0];
   }
 
-  /** Release only an in-progress checkout claim; terminal cart states are untouched. */
+  /**
+   * Release an in-progress checkout claim held by `claimToken`. Terminal cart
+   * states are untouched, and so is a claim held by a different checkout
+   * attempt — a losing attempt's failure path must not reopen the cart the
+   * winner is still checking out.
+   */
   async releaseCheckoutClaim(
     id: string,
+    claimToken: string,
     ctx?: TxContext,
   ): Promise<Cart | undefined> {
     const db = this.getDb(ctx);
     const rows = await db
       .update(carts)
-      .set({ status: "active", updatedAt: new Date() })
-      .where(and(eq(carts.id, id), eq(carts.status, "checking_out")))
+      .set({ status: "active", checkoutClaimToken: null, updatedAt: new Date() })
+      .where(
+        and(
+          eq(carts.id, id),
+          eq(carts.status, "checking_out"),
+          eq(carts.checkoutClaimToken, claimToken),
+        ),
+      )
       .returning();
     return rows[0];
   }

package/src/modules/cart/schema.ts

@@ -15,6 +15,10 @@ export const carts = pgTable("carts", {
   // Shopper contact for guest carts — enables abandoned-checkout recovery
   email: text("email"),
   secret: text("secret"),
+  // Owner of an in-progress `checking_out` claim. Minted by the checkout
+  // attempt that wins the CAS; only that holder may release the claim, so a
+  // losing attempt's failure path cannot unwind the winner's claim.
+  checkoutClaimToken: text("checkout_claim_token"),
   metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}),
   expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
   createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),

package/src/modules/cart/service.ts

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertOwnership, assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import type { CommerceConfig } from "../../config/types.js";
@@ -60,6 +60,7 @@ function makeContext(
   actor: Actor | null,
   services: Record<string, unknown>,
   database: DatabaseAdapter,
+  config: CommerceConfig,
   tx: unknown = null,
 ): HookContext {
   return createHookContext({
@@ -69,6 +70,7 @@ function makeContext(
     services,
     context: { moduleName: "cart" },
     database: { db: database.db as PluginDb },
+    commerceConfig: config,
   });
 }
 
@@ -98,7 +100,7 @@ export class CartService {
 
     const ttlMinutes = this.deps.config.cart?.ttlMinutes ?? 60 * 24 * 7;
     const now = new Date();
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
 
     // SECURITY: cart.customerId is service-managed.
     //
@@ -145,6 +147,7 @@ export class CartService {
       }
     }
 
+    const guestSecret = resolvedCustomerId === null ? crypto.randomUUID() : undefined;
     const cart = await this.repo.create(
       {
         organizationId: orgId,
@@ -153,6 +156,7 @@ export class CartService {
         metadata: input.metadata ?? {},
         expiresAt: new Date(now.getTime() + ttlMinutes * 60 * 1000),
         ...(resolvedCustomerId !== null ? { customerId: resolvedCustomerId } : {}),
+        ...(guestSecret !== undefined ? { secret: guestSecret } : {}),
         ...(input.email !== undefined ? { email: input.email } : {}),
       },
       ctx,
@@ -173,7 +177,7 @@ export class CartService {
     // read any cart's contents, prices, line items, and metadata. This now
     // requires either an authenticated owner/staff actor OR the cart's
     // secret token (returned only at createGuest()).
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, id, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
@@ -195,10 +199,31 @@ export class CartService {
     });
   }
 
+  /**
+   * Reads a cart for a trusted server pipeline after the request boundary has
+   * already authenticated the caller. Organization scope is explicit; caller
+   * identity and guest secrets are intentionally not consulted here.
+   */
+  async getByIdForInternalUse(
+    id: string,
+    organizationId: string,
+    ctx?: TxContext,
+  ): Promise<Result<Cart & { lineItems: CartLineItem[] }>> {
+    const cart = await this.repo.findById(organizationId, id, ctx);
+    if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
+
+    const lineItems = await this.repo.findLineItemsByCartId(id, ctx);
+    return Ok({
+      ...cart,
+      lineItems,
+    });
+  }
+
   async addItem(
     input: AddCartItemInput,
     actor?: Actor | null,
     ctx?: TxContext,
+    presentedSecret?: string,
   ): Promise<Result<CartLineItem>> {
     try {
       assertPermission(actor ?? null, "cart:update");
@@ -206,12 +231,12 @@ export class CartService {
       return Err(toCommerceError(error));
     }
 
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, input.cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
     try {
-      await this.assertCartOwnership(actor ?? null, cart, ctx);
+      await this.assertCartOwnership(actor ?? null, cart, ctx, presentedSecret);
     } catch (error) {
       return Err(toCommerceError(error));
     }
@@ -253,7 +278,7 @@ export class CartService {
       );
     }
 
-    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, ctx?.tx);
+    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
     const beforeHooks = this.deps.hooks.resolve(
       "cart.beforeAddItem",
     ) as CartAddBeforeHook[];
@@ -319,6 +344,7 @@ export class CartService {
     itemId: string,
     actor?: Actor | null,
     ctx?: TxContext,
+    presentedSecret?: string,
   ): Promise<Result<void>> {
     try {
       assertPermission(actor ?? null, "cart:update");
@@ -326,12 +352,12 @@ export class CartService {
       return Err(toCommerceError(error));
     }
 
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
     try {
-      await this.assertCartOwnership(actor ?? null, cart, ctx);
+      await this.assertCartOwnership(actor ?? null, cart, ctx, presentedSecret);
     } catch (error) {
       return Err(toCommerceError(error));
     }
@@ -341,7 +367,7 @@ export class CartService {
       return Err(new CommerceNotFoundError("Cart item not found."));
     }
 
-    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, ctx?.tx);
+    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
     const beforeHooks = this.deps.hooks.resolve(
       "cart.beforeRemoveItem",
     ) as CartRemoveBeforeHook[];
@@ -360,6 +386,7 @@ export class CartService {
     input: UpdateCartItemInput,
     actor?: Actor | null,
     ctx?: TxContext,
+    presentedSecret?: string,
   ): Promise<Result<CartLineItem>> {
     try {
       assertPermission(actor ?? null, "cart:update");
@@ -367,12 +394,12 @@ export class CartService {
       return Err(toCommerceError(error));
     }
 
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, input.cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
     try {
-      await this.assertCartOwnership(actor ?? null, cart, ctx);
+      await this.assertCartOwnership(actor ?? null, cart, ctx, presentedSecret);
     } catch (error) {
       return Err(toCommerceError(error));
     }
@@ -388,7 +415,7 @@ export class CartService {
       );
     }
 
-    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, ctx?.tx);
+    const context = makeContext(actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx);
     const beforeHooks = this.deps.hooks.resolve(
       "cart.beforeUpdateQuantity",
     ) as CartUpdateBeforeHook[];
@@ -424,7 +451,7 @@ export class CartService {
       return Err(toCommerceError(error));
     }
 
-    const orgId = resolveOrgId(actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? null, this.deps.config);
     const source = await this.repo.findById(orgId, sourceCartId, ctx);
     const target = await this.repo.findById(orgId, targetCartId, ctx);
     if (!source || !target)
@@ -479,7 +506,7 @@ export class CartService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const rows = await this.repo.list(
       orgId,
       {
@@ -518,7 +545,7 @@ export class CartService {
     } catch (error) {
       return Err(toCommerceError(error));
     }
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
     if (cart.status === "checked_out" || cart.status === "merged" || cart.status === "checking_out") {
@@ -544,7 +571,7 @@ export class CartService {
       null,
       updated ?? cart,
       "recover",
-      makeContext(actor ?? null, this.deps.services, this.deps.database, ctx?.tx ?? null),
+      makeContext(actor ?? null, this.deps.services, this.deps.database, this.deps.config, ctx?.tx ?? null),
     );
 
     return Ok({
@@ -558,7 +585,7 @@ export class CartService {
   }
 
   async abandon(cartId: string, actor?: Actor | null, ctx?: TxContext): Promise<Result<void>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
@@ -571,24 +598,27 @@ export class CartService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<void>> {
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const orgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const cart = await this.repo.findById(orgId, cartId, ctx);
     if (!cart) return Err(new CommerceNotFoundError("Cart not found."));
 
-    await this.repo.updateStatus(cartId, "checked_out", ctx);
+    await this.repo.update(cartId, { status: "checked_out", checkoutClaimToken: null }, ctx);
     return Ok(undefined);
   }
 
   /**
-   * Atomically transitions a cart from "active" to "checking_out".
-   * Returns Err if the cart was already claimed by a concurrent checkout.
-   * This prevents TOCTOU race conditions on double-checkout.
+   * Atomically transitions a cart from "active" to "checking_out", recording
+   * `claimToken` as the holder. Returns Err if the cart was already claimed by
+   * a concurrent checkout. This prevents TOCTOU race conditions on
+   * double-checkout, and the token is what lets {@link releaseCheckoutClaim}
+   * tell the winner's release from a loser's.
    */
   async claimForCheckout(
     cartId: string,
+    claimToken: string,
     ctx?: TxContext,
   ): Promise<Result<Cart>> {
-    const claimed = await this.repo.transitionToCheckingOut(cartId, ctx);
+    const claimed = await this.repo.transitionToCheckingOut(cartId, claimToken, ctx);
     if (!claimed) {
       return Err(
         new CommerceValidationError(
@@ -601,13 +631,17 @@ export class CartService {
 
   /**
    * Atomically returns a failed checkout claim to `active`. A checked-out,
-   * merged, abandoned, or already-active cart is left untouched.
+   * merged, abandoned, or already-active cart is left untouched — and so is a
+   * claim held by a different checkout attempt, so a losing attempt's failure
+   * path cannot reopen the cart the winner is still checking out. Returns null
+   * when nothing was released.
    */
   async releaseCheckoutClaim(
     cartId: string,
+    claimToken: string,
     ctx?: TxContext,
   ): Promise<Result<Cart | null>> {
-    return Ok((await this.repo.releaseCheckoutClaim(cartId, ctx)) ?? null);
+    return Ok((await this.repo.releaseCheckoutClaim(cartId, claimToken, ctx)) ?? null);
   }
 
   /**
@@ -625,7 +659,8 @@ export class CartService {
 
     const cart = await this.repo.create(
       {
-        organizationId: resolveOrgId(null),
+        // Actor-less by design; resolves to the deployment's declared organization.
+        organizationId: resolveOrgIdForCommerce(null, this.deps.config),
         customerId: undefined,
         status: "active",
         currency,
@@ -651,7 +686,7 @@ export class CartService {
     actor: Actor,
     ctx?: TxContext,
   ): Promise<Result<Cart>> {
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const sourceCart = await this.repo.findById(orgId, sourceCartId, ctx);
     if (!sourceCart || sourceCart.secret !== sourceSecret) {
       return Err(

package/src/modules/catalog/brand-service.ts

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import {
@@ -23,14 +23,14 @@ export class BrandService {
 
   private assertSameOrg(resource: { organizationId?: string | null } | undefined, actor: Actor | null): void {
     if (!resource) return;
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     if (resource.organizationId && resource.organizationId !== orgId) {
       throw new CommerceNotFoundError("Entity not found.");
     }
   }
 
   async listBrands(ctx?: TxContext): Promise<Result<Brand[]>> {
-    const allBrands = await this.repo.findAllBrands(resolveOrgId(ctx?.actor ?? null), ctx);
+    const allBrands = await this.repo.findAllBrands(resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config), ctx);
     return Ok(allBrands.sort((a, b) => a.displayName.localeCompare(b.displayName)));
   }
 
@@ -40,7 +40,7 @@ export class BrandService {
       const existingById = await this.repo.findBrandById(input.id, ctx);
       if (existingById) return Err(new CommerceConflictError(`Brand with id ${input.id} already exists.`));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const existingBySlug = await this.repo.findBrandBySlug(orgId, input.slug, ctx);
     if (existingBySlug) return Err(new CommerceConflictError(`Brand with slug ${input.slug} already exists.`));
     return Ok(await this.repo.createBrand({ organizationId: orgId, ...(input.id ? { id: input.id } : {}), slug: input.slug, displayName: input.displayName, metadata: input.metadata ?? {} }, ctx));
@@ -52,7 +52,7 @@ export class BrandService {
     if (!existing) return Err(new CommerceNotFoundError("Brand not found."));
     try { this.assertSameOrg(existing, actor); } catch (error) { return Err(toCommerceError(error)); }
     if (input.slug) {
-      const existingBySlug = await this.repo.findBrandBySlug(resolveOrgId(actor), input.slug, ctx);
+      const existingBySlug = await this.repo.findBrandBySlug(resolveOrgIdForCommerce(actor, this.deps.config), input.slug, ctx);
       if (existingBySlug && existingBySlug.id !== id) return Err(new CommerceConflictError(`Brand with slug ${input.slug} already exists.`));
     }
     const updated = await this.repo.updateBrand(id, { ...(input.slug !== undefined ? { slug: input.slug } : {}), ...(input.displayName !== undefined ? { displayName: input.displayName } : {}), ...(input.metadata !== undefined ? { metadata: input.metadata } : {}) }, ctx);
@@ -75,7 +75,7 @@ export class BrandService {
     const entity = await this.deps.repository.findEntityById(entityId, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
     try { this.assertSameOrg(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
-    const addBrandOrgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const addBrandOrgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const isBrandUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(brandId);
     let brand = isBrandUuid ? await this.repo.findBrandById(brandId, ctx) : null;
     if (!brand) brand = await this.repo.findBrandBySlug(addBrandOrgId, brandId, ctx);
@@ -93,7 +93,7 @@ export class BrandService {
     try { this.assertSameOrg(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
     const isBrUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(brandId);
     let brand = isBrUuid ? await this.repo.findBrandById(brandId, ctx) : null;
-    if (!brand) brand = await this.repo.findBrandBySlug(resolveOrgId(actor ?? ctx?.actor ?? null), brandId, ctx);
+    if (!brand) brand = await this.repo.findBrandBySlug(resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config), brandId, ctx);
     const removed = await this.repo.removeEntityFromBrand(entityId, brand?.id ?? brandId, ctx);
     if (!removed) return Err(new CommerceNotFoundError("Brand assignment not found."));
     return Ok(undefined);

package/src/modules/catalog/category-service.ts

@@ -1,4 +1,4 @@
-import { resolveOrgId } from "../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../auth/org.js";
 import { assertPermission } from "../../auth/permissions.js";
 import type { Actor } from "../../auth/types.js";
 import {
@@ -23,14 +23,14 @@ export class CategoryService {
 
   private assertSameOrg(resource: { organizationId?: string | null } | undefined, actor: Actor | null): void {
     if (!resource) return;
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     if (resource.organizationId && resource.organizationId !== orgId) {
       throw new CommerceNotFoundError("Entity not found.");
     }
   }
 
   async listCategories(ctx?: TxContext, opts?: { includeArchived?: boolean }): Promise<Result<CategorySummary[]>> {
-    const allCategories = await this.repo.findAllCategories(resolveOrgId(ctx?.actor ?? null), ctx);
+    const allCategories = await this.repo.findAllCategories(resolveOrgIdForCommerce(ctx?.actor ?? null, this.deps.config), ctx);
     const visible = opts?.includeArchived
       ? allCategories
       : allCategories.filter((c) => (c.status ?? "active") === "active");
@@ -62,7 +62,7 @@ export class CategoryService {
       const existingById = await this.repo.findCategoryById(input.id, ctx);
       if (existingById) return Err(new CommerceConflictError(`Category with id ${input.id} already exists.`));
     }
-    const orgId = resolveOrgId(actor);
+    const orgId = resolveOrgIdForCommerce(actor, this.deps.config);
     const existingBySlug = await this.repo.findCategoryBySlug(orgId, input.slug, ctx);
     if (existingBySlug) return Err(new CommerceConflictError(`Category with slug ${input.slug} already exists.`));
     const category = await this.repo.createCategory({ organizationId: orgId, ...(input.id ? { id: input.id } : {}), slug: input.slug, sortOrder: input.sortOrder ?? 0, metadata: input.metadata ?? {}, ...(input.parentId !== undefined ? { parentId: input.parentId } : {}) }, ctx);
@@ -75,7 +75,7 @@ export class CategoryService {
     if (!existing) return Err(new CommerceNotFoundError("Category not found."));
     try { this.assertSameOrg(existing, actor); } catch (error) { return Err(toCommerceError(error)); }
     if (input.slug) {
-      const existingBySlug = await this.repo.findCategoryBySlug(resolveOrgId(actor), input.slug, ctx);
+      const existingBySlug = await this.repo.findCategoryBySlug(resolveOrgIdForCommerce(actor, this.deps.config), input.slug, ctx);
       if (existingBySlug && existingBySlug.id !== id) return Err(new CommerceConflictError(`Category with slug ${input.slug} already exists.`));
     }
     const updated = await this.repo.updateCategory(id, { ...(input.slug !== undefined ? { slug: input.slug } : {}), ...(input.sortOrder !== undefined ? { sortOrder: input.sortOrder } : {}), ...(input.metadata !== undefined ? { metadata: input.metadata } : {}), ...(input.parentId !== undefined ? { parentId: input.parentId } : {}) }, ctx);
@@ -98,7 +98,7 @@ export class CategoryService {
     const entity = await this.deps.repository.findEntityById(entityId, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
     try { this.assertSameOrg(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
-    const addCatOrgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const addCatOrgId = resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config);
     const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(categoryId);
     let category = isUuid ? await this.repo.findCategoryById(categoryId, ctx) : null;
     if (!category) category = await this.repo.findCategoryBySlug(addCatOrgId, categoryId, ctx);
@@ -116,7 +116,7 @@ export class CategoryService {
     try { this.assertSameOrg(entity, actor); } catch (error) { return Err(toCommerceError(error)); }
     const isCatUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(categoryId);
     let category = isCatUuid ? await this.repo.findCategoryById(categoryId, ctx) : null;
-    if (!category) category = await this.repo.findCategoryBySlug(resolveOrgId(actor ?? ctx?.actor ?? null), categoryId, ctx);
+    if (!category) category = await this.repo.findCategoryBySlug(resolveOrgIdForCommerce(actor ?? ctx?.actor ?? null, this.deps.config), categoryId, ctx);
     const removed = await this.repo.removeEntityFromCategory(entityId, category?.id ?? categoryId, ctx);
     if (!removed) return Err(new CommerceNotFoundError("Category assignment not found."));
     return Ok(undefined);