task-l.3.1

src/app/api/crm/customers/route.ts

@@ -1,6 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditCreate } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext
+} from '@/features/crm/security/server/service';
 import { createCustomer, listCustomers } from '@/features/crm/customers/server/service';
 import { customerSchema } from '@/features/crm/customers/schemas/customer.schema';
 import { PERMISSIONS } from '@/lib/auth/rbac';
@@ -15,7 +19,7 @@ const customerRequestSchema = customerSchema.extend({
 
 export async function GET(request: NextRequest) {
   try {
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmCustomerRead
     });
     const { searchParams } = request.nextUrl;
@@ -26,6 +30,11 @@ export async function GET(request: NextRequest) {
     const customerType = searchParams.get('customerType') ?? undefined;
     const branch = searchParams.get('branch') ?? undefined;
     const sort = searchParams.get('sort') ?? undefined;
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const result = await listCustomers(organization.id, {
       page,
       limit,
@@ -34,7 +43,7 @@ export async function GET(request: NextRequest) {
       customerType,
       branch,
       sort
-    });
+    }, accessContext);
     const offset = (page - 1) * limit;
 
     return NextResponse.json({
@@ -48,6 +57,22 @@ export async function GET(request: NextRequest) {
     });
   } catch (error) {
     if (error instanceof AuthError) {
+      if (error.status === 403) {
+        const access = await requireOrganizationAccess({
+          permission: PERMISSIONS.crmCustomerRead
+        }).catch(() => null);
+
+        if (access) {
+          await auditCrmSecurityEvent({
+            organizationId: access.organization.id,
+            userId: access.session.user.id,
+            action: 'customer_scope_violation',
+            entityType: 'crm_customer',
+            entityId: 'list',
+            reason: 'Customer list visibility denied'
+          });
+        }
+      }
       return NextResponse.json({ message: error.message }, { status: error.status });
     }