task-l.3.1

src/app/api/crm/approvals/[id]/route.ts

@@ -1,5 +1,9 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { cancelApproval, getApprovalRequest } from '@/features/foundation/approval/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,10 +14,15 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmApprovalRead
     });
-    const approval = await getApprovalRequest(id, organization.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const approval = await getApprovalRequest(id, organization.id, accessContext);
 
     return NextResponse.json({
       success: true,
@@ -23,6 +32,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
     });
   } catch (error) {
     if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const session = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmApprovalRead
+        }).catch(() => null);
+
+        if (session) {
+          await auditCrmSecurityEvent({
+            organizationId: session.organization.id,
+            userId: session.session.user.id,
+            action: 'approval_scope_violation',
+            entityType: 'crm_approval_request',
+            entityId: (await params).id,
+            reason: 'Approval detail visibility denied'
+          });
+        }
+      }
       return NextResponse.json({ message: error.message }, { status: error.status });
     }
     if (error instanceof Error) {

src/app/api/crm/approvals/route.ts

@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { listApprovalRequests, submitForApproval } from '@/features/foundation/approval/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -13,7 +17,7 @@ const submitApprovalSchema = z.object({
 
 export async function GET(request: NextRequest) {
   try {
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmApprovalRead
     });
     const { searchParams } = request.nextUrl;
@@ -24,6 +28,11 @@ export async function GET(request: NextRequest) {
     const entityType = searchParams.get('entityType') ?? undefined;
     const entityId = searchParams.get('entityId') ?? undefined;
     const sort = searchParams.get('sort') ?? undefined;
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const result = await listApprovalRequests(organization.id, {
       page,
       limit,
@@ -32,7 +41,7 @@ export async function GET(request: NextRequest) {
       entityType,
       entityId,
       sort
-    });
+    }, accessContext);
 
     return NextResponse.json({
       success: true,
@@ -45,6 +54,22 @@ export async function GET(request: NextRequest) {
     });
   } catch (error) {
     if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const session = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmApprovalRead
+        }).catch(() => null);
+
+        if (session) {
+          await auditCrmSecurityEvent({
+            organizationId: session.organization.id,
+            userId: session.session.user.id,
+            action: 'approval_scope_violation',
+            entityType: 'crm_approval_request',
+            entityId: 'list',
+            reason: 'Approval list visibility denied'
+          });
+        }
+      }
       return NextResponse.json({ message: error.message }, { status: error.status });
     }
     if (error instanceof Error) {