@porulle/core 0.8.0 → 0.9.0

package/src/modules/catalog/entity-service.ts

@@ -271,7 +271,12 @@ export class EntityService {
         entity = refetched;
       }
     }
-    if (actor && entity.organizationId && entity.organizationId !== resolveOrgId(actor)) return Err(new CommerceNotFoundError("Entity not found."));
+    const resolvedActor = actor ?? ctx?.actor ?? null;
+    try {
+      this.assertSameOrg(entity, resolvedActor);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
     const result = await this.hydrateEntity(entity, processed.options ?? options, ctx);
     const entityAfterHooks = this.deps.hooks.resolve(`catalog.${entity.type}.afterRead`) as CatalogReadAfterHook[];
     const report = mergeHookReports(await runAfterHooks(globalAfterHooks, null, result, "read", context), await runAfterHooks(entityAfterHooks, null, result, "read", context));
@@ -407,6 +412,11 @@ export class EntityService {
     assertPermission(actor, "catalog:update");
     const entity = await this.repo.findEntityById(input.entityId, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
+    try {
+      this.assertSameOrg(entity, actor);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
     const optionType = await this.repo.createOptionType({ entityId: input.entityId, name: input.name, displayName: input.name, sortOrder: 0 }, ctx);
     if (input.values) {
       for (const value of input.values) {
@@ -420,6 +430,13 @@ export class EntityService {
     assertPermission(actor, "catalog:update");
     const optionType = await this.repo.findOptionTypeById(input.optionTypeId, ctx);
     if (!optionType) return Err(new CommerceNotFoundError("Option type not found."));
+    const entity = await this.repo.findEntityById(optionType.entityId, ctx);
+    if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
+    try {
+      this.assertSameOrg(entity, actor);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
     return Ok(await this.repo.createOptionValue({ optionTypeId: input.optionTypeId, value: input.value, displayValue: input.value, sortOrder: 0, metadata: {} }, ctx));
   }
 
@@ -427,6 +444,11 @@ export class EntityService {
     assertPermission(actor, "catalog:update");
     const entity = await this.repo.findEntityById(input.entityId, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
+    try {
+      this.assertSameOrg(entity, actor);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
     const entityOptionTypes = await this.repo.findOptionTypesByEntityId(input.entityId, ctx);
     const optionValueIds: string[] = [];
     for (const [optName, optVal] of Object.entries(input.options)) {
@@ -461,6 +483,11 @@ export class EntityService {
     }
     const entity = await this.repo.findEntityById(entityId, ctx);
     if (!entity) return Err(new CommerceNotFoundError("Entity not found."));
+    try {
+      this.assertSameOrg(entity, actor);
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
     const entityOptionTypes = await this.repo.findOptionTypesByEntityId(entityId, ctx);
     const sortedOptionTypes = entityOptionTypes.sort((a, b) => a.sortOrder - b.sortOrder);
     const optionValueGroups: string[][] = [];

package/src/modules/customers/service.ts

@@ -241,6 +241,12 @@ export class CustomerService {
     ctx?: TxContext,
     options?: { replaceMetadata?: boolean },
   ): Promise<Result<Customer>> {
+    try {
+      assertPermission(actor ?? null, "customers:update");
+    } catch (error) {
+      return Err(toCommerceError(error));
+    }
+
     const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
     const existing = await this.repo.findById(orgId, id, ctx);
     if (!existing) return Err(new CommerceNotFoundError("Customer not found."));

package/src/modules/orders/schema.ts

@@ -50,6 +50,10 @@ export const orderLineItems = pgTable("order_line_items", {
   quantity: integer("quantity").notNull(),
   unitPrice: integer("unit_price").notNull(),
   totalPrice: integer("total_price").notNull(),
+  // Price provenance (matches Medusa's `is_custom_price`): true when a staff
+  // actor with `orders:manage` supplied an explicit override price rather than
+  // the server-derived catalog price. Audit + reporting signal.
+  isCustomPrice: boolean("is_custom_price").notNull().default(false),
   taxAmount: integer("tax_amount").notNull().default(0),
   discountAmount: integer("discount_amount").notNull().default(0),
   // Units already refunded on this line (issue #52) — line-level refund REST