task-l.3.1

src/app/api/crm/customers/[id]/route.ts

@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditDelete, auditUpdate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import {
   getCustomerActivity,
   getCustomerDetail,
@@ -25,11 +29,16 @@ const customerRequestSchema = customerSchema.extend({
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmCustomerRead
     });
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const [customer, activity] = await Promise.all([
-      getCustomerDetail(id, organization.id),
+      getCustomerDetail(id, organization.id, accessContext),
       getCustomerActivity(id, organization.id)
     ]);
 
@@ -42,6 +51,22 @@ export async function GET(_request: NextRequest, { params }: Params) {
     });
   } catch (error) {
     if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmCustomerRead
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'customer_scope_violation',
+            entityType: 'crm_customer',
+            entityId: (await params).id,
+            reason: 'Customer detail visibility denied'
+          });
+        }
+      }
       return NextResponse.json({ message: error.message }, { status: error.status });
     }
 
@@ -54,12 +79,17 @@ export async function GET(_request: NextRequest, { params }: Params) {
 export async function PATCH(request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmCustomerUpdate
     });
     const payload = customerRequestSchema.parse(await request.json());
-    const before = await getCustomerDetail(id, organization.id);
-    const updated = await updateCustomer(id, organization.id, session.user.id, payload);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getCustomerDetail(id, organization.id, accessContext);
+    const updated = await updateCustomer(id, organization.id, session.user.id, payload, accessContext);
 
     await auditUpdate({
       organizationId: organization.id,
@@ -97,11 +127,16 @@ export async function PATCH(request: NextRequest, { params }: Params) {
 export async function DELETE(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmCustomerDelete
     });
-    const before = await getCustomerDetail(id, organization.id);
-    const updated = await softDeleteCustomer(id, organization.id, session.user.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getCustomerDetail(id, organization.id, accessContext);
+    const updated = await softDeleteCustomer(id, organization.id, session.user.id, accessContext);
 
     await auditDelete({
       organizationId: organization.id,