payment-kit 1.29.0 → 1.29.2

package/api/src/queues/subscription.ts

@@ -2,7 +2,9 @@ import type { LiteralUnion } from 'type-fest';
 
 import { BN } from '@ocap/util';
 import { Op } from 'sequelize';
-import { createEvent } from '../libs/audit';
+import { paymentReloadSubscriptionJobs } from '../libs/env';
+import { systemFindAll, systemFindByPk, systemFindOne } from '../store/scoped';
+import { createEvent, reportAuditFailure } from '../libs/audit';
 import { ensurePassportRevoked } from '../integrations/blocklet/passport';
 // eslint-disable-next-line import/no-cycle
 import { batchHandleStripeSubscriptions } from '../integrations/stripe/resource';
@@ -13,7 +15,7 @@ import { events } from '../libs/event';
 import { getLock } from '../libs/lock';
 import logger from '../libs/logger';
 import { getGasPayerExtra, isDelegationSufficientForPayment } from '../libs/payment';
-import createQueue from '../libs/queue';
+import createQueue, { assertJobObjectTenant } from '../libs/queue';
 import { getStatementDescriptor } from '../libs/session';
 import { NonRetryableError } from '../libs/error';
 import {
@@ -83,7 +85,7 @@ async function attachQuotesForInvoice(
     return { lineItems, quotes: [] };
   }
 
-  const currency = (await PaymentCurrency.findByPk(currencyId, {
+  const currency = (await systemFindByPk(PaymentCurrency, currencyId, {
     include: [{ model: PaymentMethod, as: 'payment_method' }],
   })) as PaymentCurrency & { payment_method: PaymentMethod };
   if (!currency) {
@@ -178,22 +180,24 @@ const doHandleSubscriptionInvoice = async ({
   metadata?: Record<string, any>;
 }) => {
   // Do we still have the customer
-  const customer = await Customer.findByPk(subscription.customer_id);
+  const customer = await systemFindByPk(Customer, subscription.customer_id);
   if (!customer) {
     logger.warn(`Customer ${subscription.customer_id} not found for subscription: ${subscription.id}`);
     return null;
   }
+  assertJobObjectTenant(customer);
 
   // Do we still have the currency
-  const currency = await PaymentCurrency.findByPk(subscription.currency_id);
+  const currency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
   if (!currency) {
     logger.warn(`Currency ${subscription.currency_id} not found for subscription: ${subscription.id}`);
     return null;
   }
+  assertJobObjectTenant(currency);
 
   // Do not proceed if previous invoice is not immutable
   if (reason === 'cycle') {
-    const previous = await Invoice.findOne({
+    const previous = await systemFindOne(Invoice, {
       where: {
         subscription_id: subscription.id,
         period_start: subscription.current_period_start,
@@ -203,7 +207,7 @@ const doHandleSubscriptionInvoice = async ({
     });
     let existOverdraftProtection;
     if (previous) {
-      existOverdraftProtection = await Invoice.findOne({
+      existOverdraftProtection = await systemFindOne(Invoice, {
         where: {
           subscription_id: subscription.id,
           billing_reason: 'overdraft_protection',
@@ -220,7 +224,7 @@ const doHandleSubscriptionInvoice = async ({
 
   // check if invoice already created for this reason
   if (['cycle', 'cancel', 'recover'].includes(reason)) {
-    const exist = await Invoice.findOne({
+    const exist = await systemFindOne(Invoice, {
       where: {
         subscription_id: subscription.id,
         period_start: start,
@@ -235,7 +239,7 @@ const doHandleSubscriptionInvoice = async ({
   }
 
   // expand subscription items
-  const subscriptionItems = await SubscriptionItem.findAll({ where: { subscription_id: subscription.id } });
+  const subscriptionItems = await systemFindAll(SubscriptionItem, { where: { subscription_id: subscription.id } });
   let expandedItems = await Price.expand(
     subscriptionItems.map((x) => ({ id: x.id, price_id: x.price_id, quantity: x.quantity })),
     { product: true }
@@ -251,7 +255,7 @@ const doHandleSubscriptionInvoice = async ({
       createEvent('Subscription', 'usage.report.empty', subscription, {
         usageReportStart,
         usageReportEnd,
-      }).catch(console.error);
+      }).catch(reportAuditFailure);
       logger.info('create usage report empty event', {
         subscriptionId: subscription.id,
         usageReportStart,
@@ -542,11 +546,12 @@ export async function handleSubscriptionInvoice(args: Parameters<typeof doHandle
 }
 
 const handleSubscriptionBeforeCancel = async (subscription: Subscription) => {
-  const paymentCurrency = await PaymentCurrency.findByPk(subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
   if (!paymentCurrency) {
     logger.warn('Payment currency not found for subscription', { subscription: subscription.id });
     return;
   }
+  assertJobObjectTenant(paymentCurrency);
   if (paymentCurrency.isCredit()) {
     logger.info('Skip invoice creation for credit subscription', { subscription: subscription.id });
     return;
@@ -592,12 +597,12 @@ const handleSubscriptionWhenActive = async (subscription: Subscription) => {
 
   // Check if this is a credit subscription
   const isCredit = await subscription.isConsumesCredit();
-  const paymentCurrency = await PaymentCurrency.findByPk(subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
 
   if (isCredit && paymentCurrency?.isCredit()) {
     // For credit subscriptions, check credit availability instead of creating invoices
-    const customer = await Customer.findByPk(subscription.customer_id);
-    const paymentMethod = await PaymentMethod.findByPk(subscription.default_payment_method_id);
+    const customer = await systemFindByPk(Customer, subscription.customer_id);
+    const paymentMethod = await systemFindByPk(PaymentMethod, subscription.default_payment_method_id);
 
     if (!customer || !paymentMethod || !paymentCurrency) {
       logger.warn('Credit subscription cycle skipped due to missing dependencies', {
@@ -757,7 +762,7 @@ const handleFinalInvoicePayment = async (
   paymentCurrency: PaymentCurrency
 ) => {
   // Check if there's any unpaid final metered invoice
-  const lastInvoice = await Invoice.findOne({
+  const lastInvoice = await systemFindOne(Invoice, {
     where: {
       subscription_id: subscription.id,
       billing_reason: 'subscription_cancel',
@@ -775,7 +780,7 @@ const handleFinalInvoicePayment = async (
   }
 
   // Check payment status and handle accordingly
-  const paymentIntent = await PaymentIntent.findByPk(lastInvoice.payment_intent_id);
+  const paymentIntent = await systemFindByPk(PaymentIntent, lastInvoice.payment_intent_id);
   if (!paymentIntent) {
     logger.warn('PaymentIntent not found for final invoice', {
       subscription: subscription.id,
@@ -783,6 +788,7 @@ const handleFinalInvoicePayment = async (
     });
     return;
   }
+  assertJobObjectTenant(paymentIntent);
 
   // If payment already succeeded, skip processing
   if (paymentIntent.status === 'succeeded') {
@@ -794,7 +800,7 @@ const handleFinalInvoicePayment = async (
     return;
   }
 
-  const customer = await Customer.findByPk(subscription.customer_id);
+  const customer = await systemFindByPk(Customer, subscription.customer_id);
   if (!customer) {
     logger.warn('Final invoice settlement skipped because customer not found', {
       subscription: subscription.id,
@@ -802,6 +808,7 @@ const handleFinalInvoicePayment = async (
     });
     return;
   }
+  assertJobObjectTenant(customer);
 
   logger.info('Found unpaid final invoice, checking user delegation balance', {
     subscription: subscription.id,
@@ -834,7 +841,7 @@ const handleFinalInvoicePayment = async (
 };
 
 export const handleStakeSlashAfterCancel = async (subscription: Subscription, forceSlash: boolean = false) => {
-  const invoice = await Invoice.findByPk(subscription.latest_invoice_id);
+  const invoice = await systemFindByPk(Invoice, subscription.latest_invoice_id);
   if (!invoice || (invoice.status !== 'uncollectible' && !forceSlash)) {
     logger.warn('Stake slashing aborted because invoice status', {
       subscription: subscription.id,
@@ -843,7 +850,7 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
     });
     return;
   }
-  const currency = await PaymentCurrency.findByPk(invoice.currency_id || subscription.currency_id);
+  const currency = await systemFindByPk(PaymentCurrency, invoice.currency_id || subscription.currency_id);
   if (!currency) {
     logger.warn('Stake slashing aborted because currency not found', {
       subscription: subscription.id,
@@ -852,7 +859,8 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
     });
     return;
   }
-  const method = await PaymentMethod.findByPk(currency.payment_method_id);
+  assertJobObjectTenant(currency);
+  const method = await systemFindByPk(PaymentMethod, currency.payment_method_id);
   if (!method || method.type !== 'arcblock') {
     logger.warn('Stake slashing aborted because payment method not arcblock', {
       subscription: subscription.id,
@@ -861,7 +869,7 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
     });
     return;
   }
-  const customer = await Customer.findByPk(subscription.customer_id);
+  const customer = await systemFindByPk(Customer, subscription.customer_id);
   if (!customer) {
     logger.warn('Stake slashing aborted because customer not found', {
       subscription: subscription.id,
@@ -870,7 +878,8 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
     });
     return;
   }
-  const paymentIntent = await PaymentIntent.findByPk(invoice.payment_intent_id);
+  assertJobObjectTenant(customer);
+  const paymentIntent = await systemFindByPk(PaymentIntent, invoice.payment_intent_id);
   if (!paymentIntent) {
     logger.warn('Stake slashing aborted because payment intent not found', {
       subscription: subscription.id,
@@ -878,6 +887,7 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
     });
     return;
   }
+  assertJobObjectTenant(paymentIntent);
 
   // Use lock to prevent race condition with payment queue
   const lock = getLock(`payment-${paymentIntent.id}`);
@@ -1023,7 +1033,7 @@ export const handleStakeSlashAfterCancel = async (subscription: Subscription, fo
 };
 
 const ensureReturnStake = async (subscription: Subscription, paymentCurrencyId?: string, stakingAddress?: string) => {
-  const paymentCurrency = await PaymentCurrency.findByPk(paymentCurrencyId || subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, paymentCurrencyId || subscription.currency_id);
   if (!paymentCurrency) {
     logger.warn('Stake return skipped because no payment currency', {
       subscription: subscription.id,
@@ -1031,7 +1041,9 @@ const ensureReturnStake = async (subscription: Subscription, paymentCurrencyId?:
     });
     return;
   }
-  const paymentMethod = await PaymentMethod.findByPk(
+  assertJobObjectTenant(paymentCurrency);
+  const paymentMethod = await systemFindByPk(
+    PaymentMethod,
     paymentCurrency.payment_method_id || subscription.default_payment_method_id
   );
   if (paymentMethod?.type !== 'arcblock') {
@@ -1066,7 +1078,7 @@ const ensureReturnStake = async (subscription: Subscription, paymentCurrencyId?:
     return;
   }
   if (result.return_amount !== '0') {
-    const invoice = await Invoice.findOne({
+    const invoice = await systemFindOne(Invoice, {
       where: {
         billing_reason: 'stake',
         subscription_id: subscription.id,
@@ -1122,7 +1134,7 @@ const ensureReturnStake = async (subscription: Subscription, paymentCurrencyId?:
 };
 
 const slashStakeOnCancel = async (subscription: Subscription) => {
-  const paymentMethod = await PaymentMethod.findByPk(subscription.default_payment_method_id);
+  const paymentMethod = await systemFindByPk(PaymentMethod, subscription.default_payment_method_id);
   if (paymentMethod?.type !== 'arcblock') {
     logger.warn('Stake slashing skipped because payment method not arcblock', {
       subscription: subscription.id,
@@ -1130,7 +1142,7 @@ const slashStakeOnCancel = async (subscription: Subscription) => {
     });
     return;
   }
-  const customer = await Customer.findByPk(subscription.customer_id);
+  const customer = await systemFindByPk(Customer, subscription.customer_id);
   if (!customer) {
     logger.warn('Stake slashing skipped because customer not found', {
       subscription: subscription.id,
@@ -1138,7 +1150,8 @@ const slashStakeOnCancel = async (subscription: Subscription) => {
     });
     return;
   }
-  const currency = await PaymentCurrency.findByPk(subscription.currency_id);
+  assertJobObjectTenant(customer);
+  const currency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
   if (!currency) {
     logger.warn('Stake slashing skipped because currency not found', {
       subscription: subscription.id,
@@ -1146,6 +1159,7 @@ const slashStakeOnCancel = async (subscription: Subscription) => {
     });
     return;
   }
+  assertJobObjectTenant(currency);
   const address = await getSubscriptionStakeAddress(subscription, customer.did, paymentMethod);
   const result = await getSubscriptionStakeSlashSetup(subscription, address, paymentMethod);
   const stakeEnough = await checkRemainingStake(paymentMethod, currency, address, result.return_amount);
@@ -1169,7 +1183,7 @@ const slashStakeOnCancel = async (subscription: Subscription) => {
   }
 
   // FIXME: handle exist one more invoices
-  const invoice = await Invoice.findOne({
+  const invoice = await systemFindOne(Invoice, {
     where: {
       subscription_id: subscription.id,
       billing_reason: 'slash_stake',
@@ -1235,13 +1249,14 @@ const ensureRefundOnCancel = async (subscription: Subscription) => {
     });
     return;
   }
-  const lastInvoice = await Invoice.findByPk(subscription.latest_invoice_id);
+  const lastInvoice = await systemFindByPk(Invoice, subscription.latest_invoice_id);
   if (!lastInvoice) {
     logger.warn('Refund skipped because no latest invoice', {
       subscription: subscription.id,
     });
     return;
   }
+  assertJobObjectTenant(lastInvoice);
 
   const result = await getSubscriptionRefundSetup(subscription, subscription.cancel_at, lastInvoice.currency_id);
   if (result.remainingUnused === '0') {
@@ -1251,7 +1266,7 @@ const ensureRefundOnCancel = async (subscription: Subscription) => {
     });
     return;
   }
-  const currency = await PaymentCurrency.findByPk(lastInvoice?.currency_id);
+  const currency = await systemFindByPk(PaymentCurrency, lastInvoice?.currency_id);
   const item = await Refund.create({
     type: 'refund',
     livemode: subscription.livemode,
@@ -1299,7 +1314,7 @@ const ensureReturnOverdraftProtectionStake = async (subscription: Subscription,
     });
     return;
   }
-  const paymentCurrency = await PaymentCurrency.findByPk(paymentCurrencyId || subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, paymentCurrencyId || subscription.currency_id);
   if (!paymentCurrency) {
     logger.warn('Return overdraft protection stake skipped because currency not found', {
       subscription: subscription.id,
@@ -1307,7 +1322,8 @@ const ensureReturnOverdraftProtectionStake = async (subscription: Subscription,
     });
     return;
   }
-  const paymentMethod = await PaymentMethod.findByPk(paymentCurrency.payment_method_id);
+  assertJobObjectTenant(paymentCurrency);
+  const paymentMethod = await systemFindByPk(PaymentMethod, paymentCurrency.payment_method_id);
   if (!paymentMethod) {
     logger.warn('Return overdraft protection stake skipped because payment method not found', {
       subscription: subscription.id,
@@ -1315,6 +1331,7 @@ const ensureReturnOverdraftProtectionStake = async (subscription: Subscription,
     });
     return;
   }
+  assertJobObjectTenant(paymentMethod);
   if (paymentMethod?.type !== 'arcblock') {
     logger.info('Return overdraft protection stake skipped because payment method is not arcblock', {
       subscription: subscription.id,
@@ -1346,7 +1363,7 @@ const ensureSlashOverdraftProtectionStake = async (subscription: Subscription) =
     });
     return;
   }
-  const paymentCurrency = await PaymentCurrency.findByPk(subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
   if (!paymentCurrency) {
     logger.warn('Slash overdraft protection stake skipped because currency not found', {
       subscription: subscription.id,
@@ -1354,7 +1371,8 @@ const ensureSlashOverdraftProtectionStake = async (subscription: Subscription) =
     });
     return;
   }
-  const paymentMethod = await PaymentMethod.findByPk(paymentCurrency.payment_method_id);
+  assertJobObjectTenant(paymentCurrency);
+  const paymentMethod = await systemFindByPk(PaymentMethod, paymentCurrency.payment_method_id);
   if (!paymentMethod) {
     logger.warn('Slash overdraft protection stake skipped because payment method not found', {
       subscription: subscription.id,
@@ -1362,6 +1380,7 @@ const ensureSlashOverdraftProtectionStake = async (subscription: Subscription) =
     });
     return;
   }
+  assertJobObjectTenant(paymentMethod);
   if (paymentMethod?.type !== 'arcblock') {
     logger.info('Slash overdraft protection stake skipped because payment method is not arcblock', {
       subscription: subscription.id,
@@ -1386,11 +1405,12 @@ const ensureSlashOverdraftProtectionStake = async (subscription: Subscription) =
 export const handleSubscription = async (job: SubscriptionJob) => {
   logger.info('handle subscription', job);
 
-  const subscription = await Subscription.findByPk(job.subscriptionId);
+  const subscription = await systemFindByPk(Subscription, job.subscriptionId);
   if (!subscription) {
     logger.warn('Subscription not found', { subscription: job.subscriptionId });
     return;
   }
+  assertJobObjectTenant(subscription);
   if (EXPECTED_SUBSCRIPTION_STATUS.includes(subscription.status) === false) {
     logger.warn('Subscription status not expected', { subscription: subscription.id, status: subscription.status });
     return;
@@ -1468,7 +1488,7 @@ export const subscriptionQueue = createQueue<SubscriptionJob>({
  * Checks for subscriptions that may have missed billing periods during downtime
  */
 export const handleCreditSubscriptionRecovery = async () => {
-  const lock = getLock('creditSubscriptionRecovery');
+  const lock = getLock('creditSubscriptionRecovery', { scope: 'global' });
   if (lock.locked) {
     return;
   }
@@ -1478,7 +1498,7 @@ export const handleCreditSubscriptionRecovery = async () => {
     await lock.acquire();
 
     // Find active credit subscriptions that might need recovery
-    const creditSubscriptions = await Subscription.findAll({
+    const creditSubscriptions = await systemFindAll(Subscription, {
       where: {
         status: ['active', 'trialing'],
       },
@@ -1565,7 +1585,7 @@ export const handleCreditSubscriptionRecovery = async () => {
 };
 
 export const startSubscriptionQueue = async () => {
-  const lock = getLock('startSubscriptionQueue');
+  const lock = getLock('startSubscriptionQueue', { scope: 'global' });
   if (lock.locked) {
     return;
   }
@@ -1576,7 +1596,7 @@ export const startSubscriptionQueue = async () => {
     // First handle credit subscription recovery
     await handleCreditSubscriptionRecovery();
 
-    const subscriptions = await Subscription.findAll({
+    const subscriptions = await systemFindAll(Subscription, {
       where: {
         status: EXPECTED_SUBSCRIPTION_STATUS,
       },
@@ -1603,7 +1623,7 @@ export const startSubscriptionQueue = async () => {
           return;
         }
         logger.info('add subscription job', { subscription: x.id, action: 'cycle' });
-        await addSubscriptionJob(x, 'cycle', process.env.PAYMENT_RELOAD_SUBSCRIPTION_JOBS === '1');
+        await addSubscriptionJob(x, 'cycle', paymentReloadSubscriptionJobs());
       })
     );
 
@@ -1624,10 +1644,11 @@ export const slashStakeQueue = createQueue({
   name: 'slashStake',
   onJob: async (job) => {
     const { subscriptionId } = job;
-    const subscription = await Subscription.findByPk(subscriptionId);
+    const subscription = await systemFindByPk(Subscription, subscriptionId);
     if (!subscription) {
       return;
     }
+    assertJobObjectTenant(subscription);
     await slashStakeOnCancel(subscription);
   },
   options: {
@@ -1643,10 +1664,11 @@ export const returnStakeQueue = createQueue({
   name: 'returnStake',
   onJob: async (job) => {
     const { subscriptionId, stakingAddress, paymentCurrencyId } = job;
-    const subscription = await Subscription.findByPk(subscriptionId);
+    const subscription = await systemFindByPk(Subscription, subscriptionId);
     if (!subscription) {
       return;
     }
+    assertJobObjectTenant(subscription);
     await ensureReturnStake(subscription, paymentCurrencyId, stakingAddress);
   },
   options: {
@@ -1662,10 +1684,11 @@ export const subscriptionCancelRefund = createQueue({
   name: 'subscription-cancel-refund',
   onJob: async (job) => {
     const { subscriptionId } = job;
-    const subscription = await Subscription.findByPk(subscriptionId);
+    const subscription = await systemFindByPk(Subscription, subscriptionId);
     if (!subscription) {
       return;
     }
+    assertJobObjectTenant(subscription);
     await ensureRefundOnCancel(subscription);
   },
   options: {
@@ -1681,10 +1704,11 @@ export const returnOverdraftProtectionQueue = createQueue({
   name: 'returnOverdraftProtection',
   onJob: async (job) => {
     const { subscriptionId, paymentCurrencyId } = job;
-    const subscription = await Subscription.findByPk(subscriptionId);
+    const subscription = await systemFindByPk(Subscription, subscriptionId);
     if (!subscription) {
       return;
     }
+    assertJobObjectTenant(subscription);
     await ensureReturnOverdraftProtectionStake(subscription, paymentCurrencyId);
   },
   options: {
@@ -1700,10 +1724,11 @@ export const slashOverdraftProtectionQueue = createQueue({
   name: 'slashOverdraftProtection',
   onJob: async (job) => {
     const { subscriptionId } = job;
-    const subscription = await Subscription.findByPk(subscriptionId);
+    const subscription = await systemFindByPk(Subscription, subscriptionId);
     if (!subscription) {
       return;
     }
+    assertJobObjectTenant(subscription);
     await ensureSlashOverdraftProtectionStake(subscription);
   },
   options: {
@@ -1791,7 +1816,7 @@ events.on('customer.subscription.recovered', async (subscription: Subscription)
   logger.info('subscription cancel job replaced after recover', { subscription: subscription.id });
   await subscriptionQueue.delete(`cancel-${subscription.id}`);
   await subscriptionQueue.delete(subscription.id);
-  const doc = await Subscription.findByPk(subscription.id);
+  const doc = await systemFindByPk(Subscription, subscription.id);
   await handleSubscriptionAfterRecover(doc!);
 });
 
@@ -1837,10 +1862,11 @@ events.on('customer.subscription.upgraded', async (subscription: Subscription) =
 });
 
 events.on('customer.stake.revoked', async ({ subscriptionId, tx }: { subscriptionId: string; tx: any }) => {
-  const subscription = await Subscription.findByPk(subscriptionId);
+  const subscription = await systemFindByPk(Subscription, subscriptionId);
   if (!subscription) {
     return;
   }
+  assertJobObjectTenant(subscription);
 
   const { address } = tx.tx.itxJson;
   if (address === subscription.overdraft_protection?.payment_details?.arcblock?.staking?.address) {
@@ -1893,12 +1919,13 @@ events.on('customer.stake.revoked', async ({ subscriptionId, tx }: { subscriptio
 events.on('setup_intent.succeeded', async (setupIntent: SetupIntent) => {
   logger.info('setup intent succeeded', { setupIntent: setupIntent.id });
   if (setupIntent.metadata?.from_currency && setupIntent?.metadata?.subscription_id) {
-    const subscription = await Subscription.findByPk(setupIntent.metadata.subscription_id);
+    const subscription = await systemFindByPk(Subscription, setupIntent.metadata.subscription_id);
     if (!subscription) {
       logger.info('skip return stake because no subscription found', { setupIntent: setupIntent.id });
       return;
     }
-    const stakingInvoice = await Invoice.findOne({
+    assertJobObjectTenant(subscription);
+    const stakingInvoice = await systemFindOne(Invoice, {
       where: {
         subscription_id: subscription.id,
         billing_reason: 'stake',
@@ -1984,11 +2011,12 @@ type SlippagePreCheckJob = {
 async function handleSlippagePreCheck(job: SlippagePreCheckJob): Promise<void> {
   const { subscriptionId, renewalTime } = job;
 
-  const subscription = await Subscription.findByPk(subscriptionId);
+  const subscription = await systemFindByPk(Subscription, subscriptionId);
   if (!subscription) {
     logger.warn('Slippage pre-check: Subscription not found', { subscriptionId });
     return;
   }
+  assertJobObjectTenant(subscription);
 
   // Skip if subscription is not in active status
   if (!['active', 'trialing'].includes(subscription.status)) {
@@ -2007,17 +2035,19 @@ async function handleSlippagePreCheck(job: SlippagePreCheckJob): Promise<void> {
   }
 
   // Get payment currency and payment method
-  const paymentCurrency = await PaymentCurrency.findByPk(subscription.currency_id);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, subscription.currency_id);
   if (!paymentCurrency) {
     logger.info('Slippage pre-check: Payment currency not found', { subscriptionId });
     return;
   }
+  assertJobObjectTenant(paymentCurrency);
 
-  const paymentMethod = await PaymentMethod.findByPk(paymentCurrency.payment_method_id);
+  const paymentMethod = await systemFindByPk(PaymentMethod, paymentCurrency.payment_method_id);
   if (!paymentMethod) {
     logger.info('Slippage pre-check: Payment method not found', { subscriptionId });
     return;
   }
+  assertJobObjectTenant(paymentMethod);
 
   // Get current exchange rate
   try {

package/api/src/queues/token-transfer.ts

@@ -1,8 +1,9 @@
 import { BN } from '@ocap/util';
 import logger from '../libs/logger';
-import createQueue from '../libs/queue';
+import createQueue, { assertJobObjectTenant } from '../libs/queue';
 import { getAccountState, transferTokenFromCustomer, getCustomerTokenBalance } from '../integrations/arcblock/token';
 import { CreditTransaction, CreditGrant, Customer, MeterEvent, PaymentCurrency, Subscription } from '../store/models';
+import { systemFindAll, systemFindByPk } from '../store/scoped';
 
 type TokenTransferJob = {
   creditTransactionId: string;
@@ -30,11 +31,12 @@ type ValidationResult =
  * Validate transfer job and fetch required data
  */
 async function validateAndFetchData(job: TokenTransferJob): Promise<ValidationResult> {
-  const creditTransaction = await CreditTransaction.findByPk(job.creditTransactionId);
+  const creditTransaction = await systemFindByPk(CreditTransaction, job.creditTransactionId);
   if (!creditTransaction) {
     logger.warn('CreditTransaction not found', { creditTransactionId: job.creditTransactionId });
     return { valid: false };
   }
+  assertJobObjectTenant(creditTransaction);
 
   // Check if already transferred
   if (creditTransaction.transfer_status === 'completed') {
@@ -42,11 +44,12 @@ async function validateAndFetchData(job: TokenTransferJob): Promise<ValidationRe
     return { valid: false };
   }
 
-  const creditGrant = await CreditGrant.findByPk(job.creditGrantId);
+  const creditGrant = await systemFindByPk(CreditGrant, job.creditGrantId);
   if (!creditGrant) {
     logger.warn('CreditGrant not found', { creditGrantId: job.creditGrantId });
     return { valid: false };
   }
+  assertJobObjectTenant(creditGrant);
 
   const customer = await Customer.findByPkOrDid(job.customerDid);
   if (!customer) {
@@ -54,21 +57,23 @@ async function validateAndFetchData(job: TokenTransferJob): Promise<ValidationRe
     return { valid: false };
   }
 
-  const paymentCurrency = await PaymentCurrency.findByPk(job.paymentCurrencyId);
+  const paymentCurrency = await systemFindByPk(PaymentCurrency, job.paymentCurrencyId);
   if (!paymentCurrency) {
     logger.warn('PaymentCurrency not found', { paymentCurrencyId: job.paymentCurrencyId });
     return { valid: false };
   }
+  assertJobObjectTenant(paymentCurrency);
 
-  const meterEvent = await MeterEvent.findByPk(job.meterEventId);
+  const meterEvent = await systemFindByPk(MeterEvent, job.meterEventId);
   if (!meterEvent) {
     logger.warn('MeterEvent not found', { meterEventId: job.meterEventId });
     return { valid: false };
   }
+  assertJobObjectTenant(meterEvent);
 
   let subscription: Subscription | undefined;
   if (job.subscriptionId) {
-    subscription = (await Subscription.findByPk(job.subscriptionId)) || undefined;
+    subscription = (await systemFindByPk(Subscription, job.subscriptionId)) || undefined;
   }
 
   return {
@@ -239,7 +244,7 @@ tokenTransferQueue.on('finished', ({ id, job }) => {
 tokenTransferQueue.on('failed', async ({ id, job, error }) => {
   logger.error('Token transfer job failed after all retries', { id, job, error: error.message });
 
-  const creditTransaction = await CreditTransaction.findByPk(job.creditTransactionId);
+  const creditTransaction = await systemFindByPk(CreditTransaction, job.creditTransactionId);
 
   if (creditTransaction && creditTransaction.transfer_status !== 'completed') {
     await creditTransaction.update({
@@ -295,7 +300,7 @@ export async function startTokenTransferQueue(): Promise<void> {
     logger.info('Token transfer queue started');
 
     // Process any pending transfers on startup
-    const pendingTransactions = await CreditTransaction.findAll({
+    const pendingTransactions = await systemFindAll(CreditTransaction, {
       where: {
         transfer_status: 'pending',
       },
@@ -309,8 +314,8 @@ export async function startTokenTransferQueue(): Promise<void> {
     await Promise.all(
       pendingTransactions.map(async (transaction) => {
         try {
-          const customer = (await Customer.findByPk(transaction.customer_id))!;
-          const creditGrant = (await CreditGrant.findByPk(transaction.credit_grant_id))!;
+          const customer = (await systemFindByPk(Customer, transaction.customer_id))!;
+          const creditGrant = (await systemFindByPk(CreditGrant, transaction.credit_grant_id))!;
 
           await addTokenTransferJob({
             creditTransactionId: transaction.id,