task-l.3.1

docs/security/crm-access-enforcement-inventory.md

@@ -11,13 +11,13 @@
 
 | Area | Route / Module | Status | Notes |
 | --- | --- | --- | --- |
-| Customers | `/api/crm/customers` | `Partially Protected` | Permission-gated, but service is still mostly organization-wide and not yet ownership-scoped |
-| Contacts | `/api/crm/customers/[id]/contacts` | `Partially Protected` | Bound to customer org, but no dedicated resolved ownership/contact-sharing policy yet |
+| Customers | `/api/crm/customers` | `Protected` | List/detail/update/delete now pass resolved CRM scope context and customer visibility is filtered by ownership plus related enquiry/quotation signals |
+| Contacts | `/api/crm/customers/[id]/contacts` | `Protected` | Contact APIs now inherit customer visibility and creator/admin/team visibility rules from resolved CRM access |
 | Leads / Enquiries | `/api/crm/enquiries` and child routes | `Partially Protected` | Uses branch/product/own-scope logic already, but still passes legacy `businessRole` fields through route/service seams |
 | Quotations | `/api/crm/quotations` and `[id]` | `Protected` | List/detail/create/update/delete now pass resolved CRM scope context and enforce branch/product/own visibility |
 | Quotation pricing surfaces | document data, preview, PDF preview/download, approved PDF | `Protected` | Pricing-bearing outputs now require pricing visibility and emit `crm_security_access` audit events when denied |
 | Document artifacts | `/api/crm/document-artifacts/[id]/download` | `Protected` | Approved quotation artifacts now require artifact permission plus pricing visibility guard |
-| Approvals | `/api/crm/approvals`, approve/reject/return | `Legacy Protected` | Permission-gated; step actor resolution now uses resolved CRM access union, but request listing is still organization-wide |
+| Approvals | `/api/crm/approvals`, approve/reject/return | `Protected` | Approval list/detail now require related quotation visibility or current-actor/admin visibility; step actor resolution uses resolved CRM access union |
 | Dashboard | `/api/crm/dashboard` | `Protected` | Route uses resolved context; revenue widgets are hidden unless quotation pricing is visible |
 | Dashboard export | `/api/crm/dashboard/export` | `Protected` | Revenue export explicitly blocked without pricing visibility |
 | CRM settings: roles | `/api/crm/settings/roles*` | `Partially Protected` | Permission-gated, but inventory still needs full pass for every mutation route |
@@ -28,14 +28,12 @@
 
 ## High-Risk Findings
 
-1. Customer/contact services still need full ownership-scope enforcement rather than organization-only reads.
-2. Approval request listing and detail visibility are still broader than the final resolved-ownership model.
+1. Team-scope semantics are still coarse because the current model does not yet carry a first-class subordinate/team graph.
+2. Production contact sharing is not yet backed by a persisted sharing table; current enforcement covers creator/customer/admin visibility only.
 3. Enquiry services already enforce meaningful scope, but several route files still pass legacy role-shaped context instead of a dedicated security context object.
-4. Team-scope semantics are still coarse because the current model does not yet carry a first-class subordinate/team graph.
 
 ## Follow-up Focus
 
-- Finish customer/contact ownership enforcement.
-- Convert approval list/detail visibility from organization scope to resolved quotation visibility.
 - Normalize remaining enquiry routes onto the same security-context builder used by quotations and dashboard.
-- Add runtime scenario tests once seeded multi-role fixtures are available.
+- Add runtime seeded scenario tests once dedicated security fixtures are available.
+- Introduce a first-class team hierarchy and production contact-sharing model if the business requires them.