@porulle/core 0.8.0 → 0.9.0

package/src/auth/setup.ts

@@ -7,13 +7,13 @@ import type { CommerceConfig } from "../config/types.js";
 import type { DatabaseAdapter } from "../kernel/database/adapter.js";
 import * as authSchema from "./auth-schema.js";
 
-type BetterAuthDbProvider = "pg" | "mysql" | "sqlite";
+type BetterAuthDbProvider = "pg";
 
 function resolveAuthDbProvider(provider: string): BetterAuthDbProvider {
   if (provider === "postgres" || provider === "postgresql" || provider === "pg") return "pg";
-  if (provider === "mysql") return "mysql";
-  if (provider === "sqlite") return "sqlite";
-  throw new Error(`Unsupported auth database provider "${provider}".`);
+  throw new Error(
+    `Unsupported auth database provider "${provider}". Only PostgreSQL is supported.`,
+  );
 }
 
 interface AuthEmailPayload {
@@ -91,6 +91,12 @@ export function createAuth(
           }
         : {}),
       ...(scope.keyExpiration ? { keyExpiration: scope.keyExpiration } : {}),
+      ...("references" in scope && scope.references
+        ? { references: scope.references as "user" | "organization" }
+        : {}),
+      ...(scope.enableMetadata || scope.references === "organization"
+        ? { enableMetadata: true }
+        : {}),
     }));
     plugins.push(apiKey(apiKeyConfigs));
   } else if (config.auth?.apiKeys?.enabled) {

package/src/config/defaults.ts

@@ -27,7 +27,9 @@ export const defaultConfig: Partial<CommerceConfig> = {
           "inventory:read",
           "inventory:adjust",
           "orders:read",
+          "orders:create",
           "orders:update",
+          "orders:manage",
           "cart:create",
           "cart:update",
           "cart:manage",

package/src/config/types.ts

@@ -113,6 +113,10 @@ export interface ApiKeyScopeDefinition {
     minExpiresIn?: number;
     maxExpiresIn?: number;
   };
+  /** Better Auth ownership model — POS shift keys bind to an organization. */
+  references?: "user" | "organization";
+  /** Allow metadata on keys minted under this scope (e.g. operatorId on POS shift keys). */
+  enableMetadata?: boolean;
 }
 
 export interface AuthConfig {
@@ -214,6 +218,11 @@ export interface AuthConfig {
    * Appended to the core plugin list (organization, bearer, jwt, etc.).
    */
   extraAuthPlugins?: unknown[];
+  /**
+   * When true (and NODE_ENV === "test"), the `x-test-actor` header may inject
+   * a trusted actor for integration tests. Default false.
+   */
+  allowTestActor?: boolean;
 }
 
 export interface CartConfig {

package/src/hooks/checkout-completion.ts

@@ -13,14 +13,14 @@ interface InventoryServiceLike {
     quantity: number;
     orderId: string;
     performedBy: string;
-  }): Promise<{ ok: boolean; error?: { message: string } }>;
+  }, actor?: unknown): Promise<{ ok: boolean; error?: { message: string } }>;
   release(input: {
     entityId: string;
     variantId?: string;
     quantity: number;
     orderId: string;
     performedBy: string;
-  }): Promise<unknown>;
+  }, actor?: unknown): Promise<unknown>;
 }
 
 interface PaymentsServiceLike {
@@ -80,13 +80,16 @@ export const reserveInventoryStep: Step<
     const performedBy = ctx.hook.actor?.userId ?? "system";
 
     for (const item of data.lineItems) {
-      const result = await inventory.reserve({
-        entityId: item.entityId,
-        ...(item.variantId != null ? { variantId: item.variantId } : {}),
-        quantity: item.quantity,
-        orderId: data.checkoutId,
-        performedBy,
-      });
+      const result = await inventory.reserve(
+        {
+          entityId: item.entityId,
+          ...(item.variantId != null ? { variantId: item.variantId } : {}),
+          quantity: item.quantity,
+          orderId: data.checkoutId,
+          performedBy,
+        },
+        ctx.hook.actor,
+      );
 
       if (!result.ok) {
         return Err(
@@ -112,13 +115,16 @@ export const reserveInventoryStep: Step<
     const performedBy = ctx.hook.actor?.userId ?? "system";
 
     for (const r of reservations) {
-      await inventory.release({
-        entityId: r.entityId,
-        ...(r.variantId != null ? { variantId: r.variantId } : {}),
-        quantity: r.quantity,
-        orderId: r.orderId,
-        performedBy,
-      });
+      await inventory.release(
+        {
+          entityId: r.entityId,
+          ...(r.variantId != null ? { variantId: r.variantId } : {}),
+          quantity: r.quantity,
+          orderId: r.orderId,
+          performedBy,
+        },
+        ctx.hook.actor,
+      );
     }
   },
 };

package/src/hooks/checkout.ts

@@ -566,16 +566,19 @@ export const reserveInventory: AfterHook<OrderResult> = async ({ result, context
       quantity: number;
       orderId: string;
       performedBy: string;
-    }): Promise<unknown>;
+    }, actor?: unknown): Promise<unknown>;
   };
   for (const lineItem of result.lineItems ?? []) {
-    await inventory.reserve({
-      entityId: lineItem.entityId,
-      ...(lineItem.variantId != null ? { variantId: lineItem.variantId } : {}),
-      quantity: lineItem.quantity,
-      orderId: result.id,
-      performedBy: context.actor?.userId ?? "system",
-    });
+    await inventory.reserve(
+      {
+        entityId: lineItem.entityId,
+        ...(lineItem.variantId != null ? { variantId: lineItem.variantId } : {}),
+        quantity: lineItem.quantity,
+        orderId: result.id,
+        performedBy: context.actor?.userId ?? "system",
+      },
+      context.actor,
+    );
   }
 };
 

package/src/interfaces/rest/routes/admin/staff.ts

@@ -55,6 +55,35 @@ export function adminStaffRoutes(kernel: Kernel) {
     );
   }
 
+  const BUILTIN_ROLE_RANK: Record<string, number> = {
+    owner: 3,
+    admin: 2,
+  };
+  const CUSTOM_ROLE_RANK = 1;
+
+  function roleRank(role: string): number {
+    return BUILTIN_ROLE_RANK[role] ?? CUSTOM_ROLE_RANK;
+  }
+
+  function canGrantRole(actorRole: string, targetRole: string): boolean {
+    return roleRank(actorRole) >= roleRank(targetRole);
+  }
+
+  function insufficientPrivilege(
+    c: { json: (d: unknown, s: number) => unknown },
+    targetRole: string,
+  ) {
+    return c.json(
+      {
+        error: {
+          code: "FORBIDDEN",
+          message: `Cannot assign role "${targetRole}": your role does not have sufficient privilege.`,
+        },
+      },
+      403,
+    );
+  }
+
   async function countOwners(orgId: string): Promise<number> {
     const rows = await db
       .select({ id: member.id })
@@ -83,9 +112,11 @@ export function adminStaffRoutes(kernel: Kernel) {
   // @ts-expect-error -- openapi handler union return type
   router.openapi(createStaffRoute, async (c) => {
     const body = c.req.valid("json") as { userId: string; role: string };
-    const orgId = resolveOrgId(c.get("actor"));
+    const actor = c.get("actor");
+    const orgId = resolveOrgId(actor);
 
     if (!validRoles().has(body.role)) return invalidRole(c, body.role);
+    if (!canGrantRole(actor!.role, body.role)) return insufficientPrivilege(c, body.role);
 
     const users = await db.select().from(user).where(eq(user.id, body.userId));
     if (users.length === 0) {
@@ -160,10 +191,12 @@ export function adminStaffRoutes(kernel: Kernel) {
   // @ts-expect-error -- openapi handler union return type
   router.openapi(updateStaffRoleRoute, async (c) => {
     const body = c.req.valid("json") as { role: string };
-    const orgId = resolveOrgId(c.get("actor"));
+    const actor = c.get("actor");
+    const orgId = resolveOrgId(actor);
     const id = c.req.param("id");
 
     if (!validRoles().has(body.role)) return invalidRole(c, body.role);
+    if (!canGrantRole(actor!.role, body.role)) return insufficientPrivilege(c, body.role);
 
     const rows = await db
       .select()
@@ -174,6 +207,10 @@ export function adminStaffRoutes(kernel: Kernel) {
       return c.json({ error: { code: "NOT_FOUND", message: "Staff member not found." } }, 404);
     }
 
+    // SEC-18/R-02: the actor must also outrank (or equal) the target's CURRENT
+    // role, else an admin could demote an owner they do not outrank.
+    if (!canGrantRole(actor!.role, target.role)) return insufficientPrivilege(c, target.role);
+
     if (target.role === "owner" && body.role !== "owner" && (await countOwners(orgId)) <= 1) {
       return c.json(
         { error: { code: "VALIDATION_FAILED", message: "Cannot demote the organization's last owner." } },
@@ -191,7 +228,8 @@ export function adminStaffRoutes(kernel: Kernel) {
 
   // @ts-expect-error -- openapi handler union return type
   router.openapi(revokeStaffRoute, async (c) => {
-    const orgId = resolveOrgId(c.get("actor"));
+    const actor = c.get("actor");
+    const orgId = resolveOrgId(actor);
     const id = c.req.param("id");
 
     const rows = await db
@@ -203,6 +241,10 @@ export function adminStaffRoutes(kernel: Kernel) {
       return c.json({ error: { code: "NOT_FOUND", message: "Staff member not found." } }, 404);
     }
 
+    // SEC-18/R-02: the actor must outrank (or equal) the target's current role
+    // to revoke it — an admin cannot revoke an owner.
+    if (!canGrantRole(actor!.role, target.role)) return insufficientPrivilege(c, target.role);
+
     if (target.role === "owner" && (await countOwners(orgId)) <= 1) {
       return c.json(
         { error: { code: "VALIDATION_FAILED", message: "Cannot revoke the organization's last owner." } },

package/src/interfaces/rest/routes/checkout.ts

@@ -21,8 +21,58 @@ import type { AfterHook, BeforeHook, ServiceContainer } from "../../../kernel/ho
 import type { PluginDb } from "../../../kernel/database/plugin-types.js";
 import { type AppEnv, mapErrorToResponse, mapErrorToStatus } from "../utils.js";
 import { isCommerceError } from "../../../kernel/errors.js";
+import { assertPermission } from "../../../auth/permissions.js";
 import { makeId } from "../../../utils/id.js";
 import type { ShippingAddress } from "../../../modules/shipping/calculator.js";
+import type { Actor } from "../../../auth/types.js";
+
+/**
+ * SEC-07 — resolve the customer profile a checkout order is attributed to.
+ * A self-service actor may ONLY attribute the order to its own customer
+ * profile; only actors with org-level `customers:read` (staff/clienteling) may
+ * name an arbitrary `customerId`. Returns undefined for guests / unresolved
+ * (guest checkout). Exported for unit testing.
+ */
+export async function resolveCheckoutCustomerUuid(
+  customers: Kernel["services"]["customers"],
+  actor: Actor | null,
+  customerId: string | undefined,
+): Promise<string | undefined> {
+  const actorUserId = actor?.userId;
+  let canActForOthers = false;
+  if (actorUserId) {
+    try {
+      assertPermission(actor, "customers:read");
+      canActForOthers = true;
+    } catch {
+      canActForOthers = false;
+    }
+  }
+
+  if (customerId) {
+    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (uuidRe.test(customerId)) {
+      const byId = await customers.getById(customerId, actor);
+      // Honor a profile UUID only if it is the actor's own, or the actor may
+      // act for other customers.
+      if (byId.ok && (canActForOthers || byId.value.userId === actorUserId)) {
+        return byId.value.id;
+      }
+    }
+    if (canActForOthers) {
+      // Staff may resolve/create a customer by a supplied user_id.
+      const byUser = await customers.getByUserId(customerId, actor);
+      if (byUser.ok) return byUser.value.id;
+    }
+  }
+
+  // Self-service default: the authenticated actor's own customer profile.
+  if (actorUserId && !canActForOthers) {
+    const own = await customers.getByUserId(actorUserId, actor);
+    if (own.ok) return own.value.id;
+  }
+  return undefined;
+}
 
 export function checkoutRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -44,7 +94,35 @@ export function checkoutRoutes(kernel: Kernel) {
         actor,
       );
       if (replay.ok && replay.value) {
-        return c.json({ data: replay.value }, 201);
+        // IDOR guard: an idempotency key must only replay the requester's OWN
+        // order. Without this, a same-org customer who supplies/guesses another
+        // customer's key would receive that customer's order (PII, totals, lines).
+        let canActForOthers = false;
+        try {
+          assertPermission(actor, "customers:read");
+          canActForOthers = true;
+        } catch {
+          canActForOthers = false;
+        }
+        const ownCustomer = actor
+          ? await resolveCheckoutCustomerUuid(kernel.services.customers, actor, undefined)
+          : undefined;
+        const replayCustomer = replay.value.customerId ?? null;
+        const ownsOrder =
+          (replayCustomer !== null && replayCustomer === ownCustomer) ||
+          (replayCustomer === null && !ownCustomer);
+        if (canActForOthers || ownsOrder) {
+          return c.json({ data: replay.value }, 201);
+        }
+        return c.json(
+          {
+            error: {
+              code: "IDEMPOTENCY_CONFLICT",
+              message: "Idempotency key does not belong to this account.",
+            },
+          },
+          409,
+        );
       }
     }
 
@@ -135,32 +213,14 @@ export function checkoutRoutes(kernel: Kernel) {
         context,
       );
 
-      // Resolve customer profile UUID from customerId (may be a profile UUID or a Better Auth user_id)
-      let customerUuid: string | undefined = undefined;
-      if (processed.customerId) {
-        const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-        if (uuidRe.test(processed.customerId)) {
-          // Looks like a profile UUID — try direct lookup (no auto-create)
-          const byIdResult = await kernel.services.customers.getById(
-            processed.customerId,
-            actor,
-          );
-          if (byIdResult.ok) {
-            customerUuid = byIdResult.value.id;
-          }
-        }
-        if (!customerUuid) {
-          // Fall back to user_id lookup (auto-creates customer profile if needed)
-          const byUserIdResult = await kernel.services.customers.getByUserId(
-            processed.customerId,
-            actor,
-          );
-          if (byUserIdResult.ok) {
-            customerUuid = byUserIdResult.value.id;
-          }
-        }
-        // If both lookups fail, we still allow guest checkout (customerUuid remains undefined)
-      }
+      // SEC-07: resolve the order's customer server-side. A self-service actor
+      // can only attribute the order to its own profile; a client-supplied
+      // foreign customerId is ignored unless the actor is staff.
+      const customerUuid = await resolveCheckoutCustomerUuid(
+        kernel.services.customers,
+        actor,
+        processed.customerId,
+      );
 
       const orderPayload = {
         ...(body.idempotencyKey !== undefined
@@ -209,7 +269,12 @@ export function checkoutRoutes(kernel: Kernel) {
           : {}),
       };
 
-      const order = await kernel.services.orders.create(orderPayload, actor);
+      // Checkout is a trusted, already-server-priced pipeline (resolveCurrentPrices
+      // + promotions/tax) and reserves stock in its own after-hooks — so it hands
+      // the order primitive precomputed totals rather than re-deriving them.
+      const order = await kernel.services.orders.create(orderPayload, actor, undefined, {
+        trustedPricing: true,
+      });
 
       if (!order.ok) {
         return c.json(

package/src/interfaces/rest/routes/inventory.ts

@@ -17,6 +17,14 @@ export function inventoryRoutes(kernel: Kernel) {
   // Inventory levels listing requires inventory:read
   router.use("/levels", requirePerm("inventory:read"));
 
+  // Warehouse config + reservation are staff operations, never public. Gate them
+  // at the route (reserve/release are also called internally by checkout with the
+  // customer's actor, so the service itself must stay callable — the boundary is
+  // the HTTP route). Blocks anonymous (401) and customers lacking the perm (403).
+  router.use("/warehouses", requirePerm("inventory:read"));
+  router.use("/reserve", requirePerm("inventory:adjust"));
+  router.use("/release", requirePerm("inventory:adjust"));
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(listInventoryLevelsRoute, async (c) => {
     const actor = c.get("actor");
@@ -78,6 +86,12 @@ export function inventoryRoutes(kernel: Kernel) {
   router.openapi(createWarehouseRoute, async (c) => {
     const body = c.req.valid("json") as Parameters<typeof kernel.services.inventory.createWarehouse>[0];
     const actor = c.get("actor");
+    // Creating a warehouse (write) needs the higher inventory:adjust perm; the
+    // router.use above already requires inventory:read for the /warehouses path.
+    const perms = (actor as { permissions?: string[] } | null)?.permissions ?? [];
+    if (!(perms.includes("inventory:adjust") || perms.includes("inventory:*") || perms.includes("*:*"))) {
+      return c.json({ error: { code: "FORBIDDEN", message: "Permission 'inventory:adjust' is required." } }, 403);
+    }
     const result = await kernel.services.inventory.createWarehouse(body, actor);
     if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
     return c.json({ data: result.value }, 201);

package/src/interfaces/rest/routes/orders.ts

@@ -3,6 +3,7 @@ import type { Kernel } from "../../../runtime/kernel.js";
 import { changeOrderStatusRoute, listOrdersRoute, orderLookupRoute, getOrderRoute, getOrderFulfillmentsRoute, createOrderRoute, refundOrderRoute, captureOrderRoute, createOrderFulfillmentRoute, addOrderLineItemRoute, updateOrderLineItemRoute, removeOrderLineItemRoute, refundOrderLinesRoute, undoOrderRefundRoute, listOrderRefundsRoute, refundCapStatusRoute, createOrderNoteRoute, listOrderNotesRoute, deleteOrderNoteRoute, orderTimelineRoute } from "../schemas/orders.js";
 import { type AppEnv, isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils.js";
 import type { CreateOrderInput } from "../../../modules/orders/service.js";
+import { assertPermission } from "../../../auth/permissions.js";
 
 export function orderRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
@@ -62,6 +63,11 @@ export function orderRoutes(kernel: Kernel) {
 
   // @ts-expect-error -- openapi handler union return type
   router.openapi(createOrderRoute, async (c) => {
+    try {
+      assertPermission(c.get("actor"), "orders:manage");
+    } catch (error) {
+      return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+    }
     const body = c.req.valid("json") as CreateOrderInput;
     const result = await kernel.services.orders.create(body, c.get("actor"));
     if (!result.ok) return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
@@ -170,6 +176,11 @@ export function orderRoutes(kernel: Kernel) {
 
   // @ts-expect-error -- openapi handler union return type
   router.openapi(addOrderLineItemRoute, async (c) => {
+    try {
+      assertPermission(c.get("actor"), "orders:manage");
+    } catch (error) {
+      return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+    }
     const body = c.req.valid("json");
     const result = await kernel.services.orders.addLineItem(
       c.req.param("id"),

package/src/interfaces/rest/schemas/orders.ts

@@ -184,7 +184,7 @@ export const createOrderRoute = createRoute({
   path: "/",
   tags: ["Orders"],
   summary: "Create a draft / manual order",
-  description: "Operator-created order (phone / POS / manual) with line items and totals, optionally without immediate payment.",
+  description: "Requires `orders:manage`. Creates an operator-entered order (phone / POS / manual); supplied line prices are stored as audited manual overrides.",
   request: {
     body: {
       content: { "application/json": { schema: CreateOrderBodySchema } },
@@ -272,7 +272,7 @@ export const addOrderLineItemRoute = createRoute({
   path: "/{id}/line-items",
   tags: ["Orders"],
   summary: "Add a line item to a placed order",
-  description: "Adds a line item to a non-terminal order and recalculates subtotal/tax/grand totals. Records an audit entry.",
+  description: "Requires `orders:manage`. Adds a line item to a non-terminal order, records its supplied price as a manual override, and recalculates totals.",
   request: {
     params: OrderIdParam,
     body: {

package/src/kernel/database/scoped-db.ts

@@ -3,7 +3,8 @@
  *
  * Wraps a Drizzle PgDatabase instance so that INSERT operations on
  * org-scoped tables automatically include the actor's organizationId,
- * and SELECT ... FROM org-scoped tables constrain rows to that organization.
+ * and SELECT / UPDATE / DELETE against org-scoped tables constrain rows to
+ * that organization — including when the caller supplies no WHERE clause.
  *
  * Plugin route handlers receive this scoped db via PluginContext.database.db
  * (organization resolved per operation from AsyncLocalStorage when used from
@@ -30,6 +31,33 @@ function tableHasOrganizationId(table: unknown): boolean {
   }
 }
 
+/**
+ * Pre-apply the org predicate to a WHERE-able builder (UPDATE/DELETE) and wrap
+ * its `.where()` so a caller-supplied condition is AND-ed with the org filter
+ * rather than replacing it. Pre-applying `orgEq` immediately means a builder
+ * executed with NO caller `.where()` (e.g. `update(t).set(...)`) is still
+ * constrained to the org — it can never touch another tenant's rows.
+ */
+function scopeWhereBuilder(
+  builder: { where: (c: SQL | undefined) => unknown },
+  orgEq: SQL,
+): unknown {
+  const scoped = builder.where(orgEq);
+  return new Proxy(scoped as Record<string, unknown>, {
+    get(st, sp, sr) {
+      const sv = Reflect.get(st, sp, sr);
+      if (sp === "where" && typeof sv === "function") {
+        return (condition?: unknown, ...wRest: unknown[]) => {
+          const c = condition as SQL | undefined;
+          const merged = c ? and(orgEq, c) : orgEq;
+          return (sv as (...a: unknown[]) => unknown).call(st, merged, ...wRest);
+        };
+      }
+      return typeof sv === "function" ? sv.bind(st) : sv;
+    },
+  });
+}
+
 export function createScopedDb<TDb>(rawDb: TDb, orgSource: ScopedOrganizationId): TDb {
   if (!rawDb || typeof rawDb !== "object") return rawDb;
 
@@ -106,6 +134,47 @@ export function createScopedDb<TDb>(rawDb: TDb, orgSource: ScopedOrganizationId)
         };
       }
 
+      if (prop === "update" && typeof value === "function") {
+        return (table: PgTable) => {
+          const builder = value.call(target, table);
+          if (!tableHasOrganizationId(table)) return builder;
+          const orgCol = getTableColumns(table).organizationId;
+          if (!orgCol) return builder;
+          const orgEq = eq(orgCol, resolveOrganizationId(orgSource));
+          // The org filter lives after `.set()`, so wrap `.set()` and scope the
+          // resulting WHERE-able builder.
+          return new Proxy(builder as Record<string, unknown>, {
+            get(t, p, r) {
+              const v = Reflect.get(t, p, r);
+              if (p === "set" && typeof v === "function") {
+                return (data: unknown) => {
+                  const setBuilder = (v as (...a: unknown[]) => unknown).call(t, data);
+                  return scopeWhereBuilder(
+                    setBuilder as { where: (c: SQL | undefined) => unknown },
+                    orgEq,
+                  );
+                };
+              }
+              return typeof v === "function" ? v.bind(t) : v;
+            },
+          });
+        };
+      }
+
+      if (prop === "delete" && typeof value === "function") {
+        return (table: PgTable) => {
+          const builder = value.call(target, table);
+          if (!tableHasOrganizationId(table)) return builder;
+          const orgCol = getTableColumns(table).organizationId;
+          if (!orgCol) return builder;
+          const orgEq = eq(orgCol, resolveOrganizationId(orgSource));
+          return scopeWhereBuilder(
+            builder as { where: (c: SQL | undefined) => unknown },
+            orgEq,
+          );
+        };
+      }
+
       return typeof value === "function" ? value.bind(target) : value;
     },
   }) as TDb;

package/src/kernel/plugin/manifest.ts

@@ -158,6 +158,9 @@ export interface CommercePluginManifest {
     permissions?: Record<string, string[]>;
     /** Expiry bounds in DAYS (fractions allowed — 1/24 = one hour). */
     keyExpiration?: { minExpiresIn?: number; maxExpiresIn?: number };
+    /** Better Auth ownership model for keys minted under this scope. */
+    references?: "user" | "organization";
+    enableMetadata?: boolean;
   }>;
 }
 

package/src/modules/analytics/drizzle-adapter.ts

@@ -216,6 +216,17 @@ export class DrizzleAnalyticsAdapter implements AnalyticsAdapter {
       }
     }
 
+    // Validate that requested time dimensions exist in the cube
+    for (const td of params.timeDimensions ?? []) {
+      const shortName = td.dimension.split(".")[1];
+      if (shortName && !cube.dimensions[shortName]) {
+        const available = Object.keys(cube.dimensions).map((d) => `${cubeName}.${d}`).join(", ");
+        return Err(new CommerceValidationError(
+          `Unknown time dimension: "${td.dimension}". Available dimensions for ${cubeName}: ${available}`,
+        ));
+      }
+    }
+
     try {
       const rows = await this.executeQuery(cube, params, scope);
       return Ok({
@@ -330,14 +341,17 @@ export class DrizzleAnalyticsAdapter implements AnalyticsAdapter {
       const shortName = dim.split(".")[1]!;
       const dimDef = cube.dimensions[shortName];
       if (!dimDef) continue;
-      selectParts.push(sql.raw(`${dimDef.sql} AS "${dim}"`));
+      const alias = `${cube.name}.${shortName}`;
+      selectParts.push(sql.raw(`${dimDef.sql} AS "${alias}"`));
       groupByParts.push(sql.raw(dimDef.sql));
     }
 
     // Time dimensions → SELECT + GROUP BY + WHERE (dateRange)
     for (const td of params.timeDimensions ?? []) {
+      const shortName = td.dimension.split(".")[1]!;
       const selectExpr = compileTimeDimensionSelect(cube, td);
-      selectParts.push(sql`${selectExpr} AS ${sql.raw(`"${td.dimension}"`)}`);
+      const alias = `${cube.name}.${shortName}`;
+      selectParts.push(sql`${selectExpr} AS ${sql.raw(`"${alias}"`)}`);
       groupByParts.push(selectExpr);
 
       // Date range filter
@@ -357,7 +371,9 @@ export class DrizzleAnalyticsAdapter implements AnalyticsAdapter {
 
     // Measures → SELECT
     for (const measure of params.measures) {
-      selectParts.push(sql`${compileMeasure(cube, measure)} AS ${sql.raw(`"${measure}"`)}`);
+      const shortName = measure.split(".")[1]!;
+      const alias = `${cube.name}.${shortName}`;
+      selectParts.push(sql`${compileMeasure(cube, measure)} AS ${sql.raw(`"${alias}"`)}`);
     }
 
     // If no select parts (shouldn't happen with validation), bail

package/src/modules/cart/service.ts

@@ -227,8 +227,9 @@ export class CartService {
       );
     }
 
-    // Validate entity exists
-    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx);
+    // Validate entity exists AND belongs to the actor's org (org-scoped lookup
+    // so another tenant's entity id cannot be added to this cart).
+    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
 
     // Check if entity has variants