task-l.3.1

2026-06-22 14:18:26 +07:00
parent 42f403a7ed
commit 1b901efc51
21 changed files with 1320 additions and 102 deletions
--- a/src/app/api/crm/approvals/[id]/route.ts
+++ b/src/app/api/crm/approvals/[id]/route.ts
@@ -1,5 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { cancelApproval, getApprovalRequest } from '@/features/foundation/approval/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';

@@ -10,10 +14,15 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmApprovalRead
    });
-    const approval = await getApprovalRequest(id, organization.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const approval = await getApprovalRequest(id, organization.id, accessContext);

    return NextResponse.json({
      success: true,
@@ -23,6 +32,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const session = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmApprovalRead
+        }).catch(() => null);
+
+        if (session) {
+          await auditCrmSecurityEvent({
+            organizationId: session.organization.id,
+            userId: session.session.user.id,
+            action: 'approval_scope_violation',
+            entityType: 'crm_approval_request',
+            entityId: (await params).id,
+            reason: 'Approval detail visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }
    if (error instanceof Error) {
--- a/src/app/api/crm/approvals/route.ts
+++ b/src/app/api/crm/approvals/route.ts
@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { listApprovalRequests, submitForApproval } from '@/features/foundation/approval/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';

@@ -13,7 +17,7 @@ const submitApprovalSchema = z.object({

 export async function GET(request: NextRequest) {
  try {
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmApprovalRead
    });
    const { searchParams } = request.nextUrl;
@@ -24,6 +28,11 @@ export async function GET(request: NextRequest) {
    const entityType = searchParams.get('entityType') ?? undefined;
    const entityId = searchParams.get('entityId') ?? undefined;
    const sort = searchParams.get('sort') ?? undefined;
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
    const result = await listApprovalRequests(organization.id, {
      page,
      limit,
@@ -32,7 +41,7 @@ export async function GET(request: NextRequest) {
      entityType,
      entityId,
      sort
-    });
+    }, accessContext);

    return NextResponse.json({
      success: true,
@@ -45,6 +54,22 @@ export async function GET(request: NextRequest) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const session = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmApprovalRead
+        }).catch(() => null);
+
+        if (session) {
+          await auditCrmSecurityEvent({
+            organizationId: session.organization.id,
+            userId: session.session.user.id,
+            action: 'approval_scope_violation',
+            entityType: 'crm_approval_request',
+            entityId: 'list',
+            reason: 'Approval list visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }
    if (error instanceof Error) {
--- a/src/app/api/crm/customers/[id]/contacts/[contactId]/route.ts
+++ b/src/app/api/crm/customers/[id]/contacts/[contactId]/route.ts
@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditDelete, auditUpdate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import {
  listCustomerContacts,
  softDeleteCustomerContact,
@@ -17,11 +21,16 @@ type Params = {
 export async function PATCH(request: NextRequest, { params }: Params) {
  try {
    const { id, contactId } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmContactUpdate
    });
    const payload = customerContactSchema.parse(await request.json());
-    const before = (await listCustomerContacts(id, organization.id)).find(
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = (await listCustomerContacts(id, organization.id, accessContext)).find(
      (contact) => contact.id === contactId
    );

@@ -34,7 +43,8 @@ export async function PATCH(request: NextRequest, { params }: Params) {
      contactId,
      organization.id,
      session.user.id,
-      payload
+      payload,
+      accessContext
    );

    await auditUpdate({
@@ -53,6 +63,22 @@ export async function PATCH(request: NextRequest, { params }: Params) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmContactUpdate
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'contact_scope_violation',
+            entityType: 'crm_customer_contact',
+            entityId: (await params).contactId,
+            reason: 'Customer contact update visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }

@@ -74,10 +100,15 @@ export async function PATCH(request: NextRequest, { params }: Params) {
 export async function DELETE(_request: NextRequest, { params }: Params) {
  try {
    const { id, contactId } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmContactDelete
    });
-    const before = (await listCustomerContacts(id, organization.id)).find(
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = (await listCustomerContacts(id, organization.id, accessContext)).find(
      (contact) => contact.id === contactId
    );

@@ -89,7 +120,8 @@ export async function DELETE(_request: NextRequest, { params }: Params) {
      id,
      contactId,
      organization.id,
-      session.user.id
+      session.user.id,
+      accessContext
    );

    await auditDelete({
@@ -107,6 +139,22 @@ export async function DELETE(_request: NextRequest, { params }: Params) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmContactDelete
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'contact_scope_violation',
+            entityType: 'crm_customer_contact',
+            entityId: (await params).contactId,
+            reason: 'Customer contact delete visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }

--- a/src/app/api/crm/customers/[id]/contacts/route.ts
+++ b/src/app/api/crm/customers/[id]/contacts/route.ts
@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditCreate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import {
  createCustomerContact,
  listCustomerContacts
@@ -16,10 +20,15 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmContactRead
    });
-    const items = await listCustomerContacts(id, organization.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const items = await listCustomerContacts(id, organization.id, accessContext);

    return NextResponse.json({
      success: true,
@@ -29,6 +38,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmContactRead
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'contact_scope_violation',
+            entityType: 'crm_customer_contact',
+            entityId: (await params).id,
+            reason: 'Customer contact list visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }

@@ -43,11 +68,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
 export async function POST(request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmContactCreate
    });
    const payload = customerContactSchema.parse(await request.json());
-    const created = await createCustomerContact(id, organization.id, session.user.id, payload);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const created = await createCustomerContact(
+      id,
+      organization.id,
+      session.user.id,
+      payload,
+      accessContext
+    );

    await auditCreate({
      organizationId: organization.id,
--- a/src/app/api/crm/customers/[id]/route.ts
+++ b/src/app/api/crm/customers/[id]/route.ts
@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditDelete, auditUpdate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import {
  getCustomerActivity,
  getCustomerDetail,
@@ -25,11 +29,16 @@ const customerRequestSchema = customerSchema.extend({
 export async function GET(_request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmCustomerRead
    });
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
    const [customer, activity] = await Promise.all([
-      getCustomerDetail(id, organization.id),
+      getCustomerDetail(id, organization.id, accessContext),
      getCustomerActivity(id, organization.id)
    ]);

@@ -42,6 +51,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmCustomerRead
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'customer_scope_violation',
+            entityType: 'crm_customer',
+            entityId: (await params).id,
+            reason: 'Customer detail visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }

@@ -54,12 +79,17 @@ export async function GET(_request: NextRequest, { params }: Params) {
 export async function PATCH(request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmCustomerUpdate
    });
    const payload = customerRequestSchema.parse(await request.json());
-    const before = await getCustomerDetail(id, organization.id);
-    const updated = await updateCustomer(id, organization.id, session.user.id, payload);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getCustomerDetail(id, organization.id, accessContext);
+    const updated = await updateCustomer(id, organization.id, session.user.id, payload, accessContext);

    await auditUpdate({
      organizationId: organization.id,
@@ -97,11 +127,16 @@ export async function PATCH(request: NextRequest, { params }: Params) {
 export async function DELETE(_request: NextRequest, { params }: Params) {
  try {
    const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmCustomerDelete
    });
-    const before = await getCustomerDetail(id, organization.id);
-    const updated = await softDeleteCustomer(id, organization.id, session.user.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getCustomerDetail(id, organization.id, accessContext);
+    const updated = await softDeleteCustomer(id, organization.id, session.user.id, accessContext);

    await auditDelete({
      organizationId: organization.id,
--- a/src/app/api/crm/customers/route.ts
+++ b/src/app/api/crm/customers/route.ts
@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditCreate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { createCustomer, listCustomers } from '@/features/crm/customers/server/service';
 import { customerSchema } from '@/features/crm/customers/schemas/customer.schema';
 import { PERMISSIONS } from '@/lib/auth/rbac';
@@ -15,7 +19,7 @@ const customerRequestSchema = customerSchema.extend({

 export async function GET(request: NextRequest) {
  try {
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
      permission: PERMISSIONS.crmCustomerRead
    });
    const { searchParams } = request.nextUrl;
@@ -26,6 +30,11 @@ export async function GET(request: NextRequest) {
    const customerType = searchParams.get('customerType') ?? undefined;
    const branch = searchParams.get('branch') ?? undefined;
    const sort = searchParams.get('sort') ?? undefined;
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
    const result = await listCustomers(organization.id, {
      page,
      limit,
@@ -34,7 +43,7 @@ export async function GET(request: NextRequest) {
      customerType,
      branch,
      sort
-    });
+    }, accessContext);
    const offset = (page - 1) * limit;

    return NextResponse.json({
@@ -48,6 +57,22 @@ export async function GET(request: NextRequest) {
    });
  } catch (error) {
    if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmCustomerRead
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'customer_scope_violation',
+            entityType: 'crm_customer',
+            entityId: 'list',
+            reason: 'Customer list visibility denied'
+          });
+        }
+      }
      return NextResponse.json({ message: error.message }, { status: error.status });
    }