task-l.3

src/app/api/crm/dashboard/export/route.ts

@@ -1,6 +1,11 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { auditAction } from '@/features/foundation/audit-log/service';
 import { getCrmDashboardData } from '@/features/crm/dashboard/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -34,19 +39,27 @@ export async function GET(request: NextRequest) {
     const searchParams = request.nextUrl.searchParams;
     const section = searchParams.get('section') ?? 'sales-ranking';
     const format = searchParams.get('format') ?? 'csv';
-    const data = await getCrmDashboardData(
-      {
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (section === 'revenue-analytics' && !canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
         organizationId: organization.id,
         userId: session.user.id,
-        membershipRole: membership.role,
-        businessRole: membership.businessRole,
-        permissions: membership.permissions,
-        branchScopeIds: membership.branchScopeIds ?? [],
-        productTypeScopeIds: membership.productTypeScopeIds ?? [],
-        ownershipScope: membership.ownershipScope ?? 'organization',
-        branchScopeMode: membership.branchScopeMode === 'assigned' ? 'assigned' : 'all',
-        productScopeMode: membership.productScopeMode === 'assigned' ? 'assigned' : 'all'
-      },
+        action: 'permission_violation',
+        entityType: 'crm_dashboard_export',
+        entityId: section,
+        reason: 'Revenue export requires quotation pricing visibility',
+        metadata: { format }
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
+    const data = await getCrmDashboardData(
+      securityContext,
       {
         dateFrom: searchParams.get('dateFrom'),
         dateTo: searchParams.get('dateTo'),

src/app/api/crm/dashboard/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getCrmDashboardData } from '@/features/crm/dashboard/server/service';
+import { buildCrmSecurityContext } from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -9,19 +10,13 @@ export async function GET(request: NextRequest) {
       permission: PERMISSIONS.crmDashboardRead
     });
     const searchParams = request.nextUrl.searchParams;
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const data = await getCrmDashboardData(
-      {
-        organizationId: organization.id,
-        userId: session.user.id,
-        membershipRole: membership.role,
-        businessRole: membership.businessRole,
-        permissions: membership.permissions,
-        branchScopeIds: membership.branchScopeIds ?? [],
-        productTypeScopeIds: membership.productTypeScopeIds ?? [],
-        ownershipScope: membership.ownershipScope ?? 'organization',
-        branchScopeMode: membership.branchScopeMode === 'assigned' ? 'assigned' : 'all',
-        productScopeMode: membership.productScopeMode === 'assigned' ? 'assigned' : 'all'
-      },
+      securityContext,
       {
         dateFrom: searchParams.get('dateFrom'),
         dateTo: searchParams.get('dateTo'),

src/app/api/crm/document-artifacts/[id]/download/route.ts

@@ -1,5 +1,13 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { downloadArtifact } from '@/features/foundation/document-artifact/server/service';
+import {
+  downloadArtifact,
+  getArtifact
+} from '@/features/foundation/document-artifact/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +18,33 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmDocumentArtifactDownload
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const artifact = await getArtifact(id, organization.id);
+
+    if (
+      artifact.entityType === 'quotation' &&
+      artifact.artifactType === 'approved_pdf' &&
+      !canViewQuotationPricing(securityContext)
+    ) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: artifact.entityType,
+        entityId: artifact.entityId,
+        reason: 'Approved quotation artifact download requires pricing visibility',
+        metadata: { artifactId: artifact.id }
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const { object } = await downloadArtifact({
       artifactId: id,
       organizationId: organization.id,

src/app/api/crm/quotations/[id]/approved-pdf/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { auditAction } from '@/features/foundation/audit-log/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import {
   generateApprovedQuotationPdf,
   getStoredApprovedQuotationPdf
@@ -15,9 +20,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationPdfDownload
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Approved quotation PDF download requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const pdf = await getStoredApprovedQuotationPdf(id, organization.id, {
       userId: session.user.id,
       auditDownload: true
@@ -40,12 +63,30 @@ export async function GET(_request: NextRequest, { params }: Params) {
 export async function POST(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationPdfGenerateApproved
     });
-    const before = await getQuotationDetail(id, organization.id);
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Approved quotation PDF generation requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
+    const before = await getQuotationDetail(id, organization.id, securityContext);
     const pdf = await generateApprovedQuotationPdf(id, organization.id, session.user.id);
-    const after = await getQuotationDetail(id, organization.id);
+    const after = await getQuotationDetail(id, organization.id, securityContext);
 
     await auditAction({
       organizationId: organization.id,

src/app/api/crm/quotations/[id]/document-data/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { buildQuotationDocumentData } from '@/features/crm/quotations/document/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +15,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationDocumentPreview
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Quotation document data requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const documentData = await buildQuotationDocumentData(id, organization.id);
 
     return NextResponse.json({

src/app/api/crm/quotations/[id]/document-preview/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getQuotationDocumentPreviewData } from '@/features/crm/quotations/document/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +15,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationDocumentPreview
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Quotation document preview requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const preview = await getQuotationDocumentPreviewData(id, organization.id);
 
     return NextResponse.json({

src/app/api/crm/quotations/[id]/pdf-download/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { generateQuotationPdf } from '@/features/foundation/pdf-generator/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +15,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationPdfDownload
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Quotation PDF download requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const pdf = await generateQuotationPdf(id, organization.id);
 
     return new NextResponse(pdf.buffer, {

src/app/api/crm/quotations/[id]/pdf-preview/route.ts

@@ -1,5 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { generateQuotationPreviewPdf } from '@/features/foundation/pdf-generator/server/service';
+import {
+  auditCrmSecurityEvent,
+  buildCrmSecurityContext,
+  canViewQuotationPricing
+} from '@/features/crm/security/server/service';
 import { PERMISSIONS } from '@/lib/auth/rbac';
 import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
@@ -10,9 +15,27 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationPdfPreview
     });
+    const securityContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+
+    if (!canViewQuotationPricing(securityContext)) {
+      await auditCrmSecurityEvent({
+        organizationId: organization.id,
+        userId: session.user.id,
+        action: 'pricing_hidden',
+        entityType: 'crm_quotation',
+        entityId: id,
+        reason: 'Quotation PDF preview requires pricing visibility'
+      });
+      return NextResponse.json({ message: 'Forbidden' }, { status: 403 });
+    }
+
     const pdf = await generateQuotationPreviewPdf(id, organization.id);
 
     return new NextResponse(pdf.buffer, {

src/app/api/crm/quotations/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditDelete, auditUpdate } from '@/features/foundation/audit-log/service';
+import { buildCrmSecurityContext } from '@/features/crm/security/server/service';
 import {
   getQuotationActivity,
   getQuotationDetail,
@@ -18,11 +19,16 @@ type Params = {
 export async function GET(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationRead
     });
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const [quotation, activity] = await Promise.all([
-      getQuotationDetail(id, organization.id),
+      getQuotationDetail(id, organization.id, accessContext),
       getQuotationActivity(id, organization.id)
     ]);
 
@@ -49,12 +55,23 @@ export async function GET(_request: NextRequest, { params }: Params) {
 export async function PATCH(request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationUpdate
     });
     const payload = quotationSchema.parse(await request.json());
-    const before = await getQuotationDetail(id, organization.id);
-    const updated = await updateQuotation(id, organization.id, session.user.id, payload);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getQuotationDetail(id, organization.id, accessContext);
+    const updated = await updateQuotation(
+      id,
+      organization.id,
+      session.user.id,
+      payload,
+      accessContext
+    );
 
     await auditUpdate({
       organizationId: organization.id,
@@ -94,11 +111,16 @@ export async function PATCH(request: NextRequest, { params }: Params) {
 export async function DELETE(_request: NextRequest, { params }: Params) {
   try {
     const { id } = await params;
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationDelete
     });
-    const before = await getQuotationDetail(id, organization.id);
-    const updated = await softDeleteQuotation(id, organization.id, session.user.id);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const before = await getQuotationDetail(id, organization.id, accessContext);
+    const updated = await softDeleteQuotation(id, organization.id, session.user.id, accessContext);
 
     await auditDelete({
       organizationId: organization.id,

src/app/api/crm/quotations/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { z } from 'zod';
 import { auditCreate } from '@/features/foundation/audit-log/service';
+import { buildCrmSecurityContext } from '@/features/crm/security/server/service';
 import { createQuotation, listQuotations } from '@/features/crm/quotations/server/service';
 import { quotationSchema } from '@/features/crm/quotations/schemas/quotation.schema';
 import { PERMISSIONS } from '@/lib/auth/rbac';
@@ -8,7 +9,7 @@ import { AuthError, requireOrganizationAccess } from '@/lib/auth/session';
 
 export async function GET(request: NextRequest) {
   try {
-    const { organization } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationRead
     });
     const { searchParams } = request.nextUrl;
@@ -22,6 +23,11 @@ export async function GET(request: NextRequest) {
     const enquiry = searchParams.get('enquiry') ?? undefined;
     const hot = searchParams.get('hot') ?? undefined;
     const sort = searchParams.get('sort') ?? undefined;
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
     const result = await listQuotations(organization.id, {
       page,
       limit,
@@ -33,7 +39,7 @@ export async function GET(request: NextRequest) {
       enquiry,
       hot,
       sort
-    });
+    }, accessContext);
     const offset = (page - 1) * limit;
 
     return NextResponse.json({
@@ -60,11 +66,16 @@ export async function GET(request: NextRequest) {
 
 export async function POST(request: NextRequest) {
   try {
-    const { organization, session } = await requireOrganizationAccess({
+    const { organization, session, membership } = await requireOrganizationAccess({
       permission: PERMISSIONS.crmQuotationCreate
     });
     const payload = quotationSchema.parse(await request.json());
-    const created = await createQuotation(organization.id, session.user.id, payload);
+    const accessContext = buildCrmSecurityContext({
+      organizationId: organization.id,
+      userId: session.user.id,
+      membership
+    });
+    const created = await createQuotation(organization.id, session.user.id, payload, accessContext);
 
     await auditCreate({
       organizationId: organization.id,