- Shipped
- September 23, 2026 at 1:00 PM UTC
- Author
- Kamo
- Commit
- b418264
CommerceMarketController's get-one/update/delete handlers under /retail/... called RetailService methods that took no orgId (bare findById/deleteById) - a same-org-authenticated caller could read, edit or delete another organization's category, brand, attribute, image, variant, tag, review, customer, tier, tax rule, discount, price list/entry, gift card, location, stock level/adjustment, shipping zone/method, carrier, shipment, cart/cart item, draft order or order note by guessing or enumerating its uid. List/create endpoints were already org-scoped (e.g. getCategories(orgId, marketId)) and CommerceMarketService.getMarket already used findByIdAndOrganizationId - this wires every remaining handler through the equivalent RetailService fix landing alongside this one in kamo-shared-library, passing the session's orgId into every call the same way the org-scoped siblings already did. getMarketVendors(marketId) had the same gap relative to its own POST/PUT/DELETE siblings; fixed the same way in CommerceMarketService. None of the touched handlers had a right check beyond session+org on their sibling create/list endpoint, so none was added here either - see the report for the list of "any same-org member can edit X" resources, which is a product question, not this fix's to answer. The customer-tiers, tax-classes/zones/rates, discounts and price-lists/entries handlers already required VIEW_PRICING/ MANAGE_PRICING on every verb including the ones fixed here; that is unchanged. Central guard: **************** resolved its marketId path segment with a bare findById too, then asked the SESSION's org whether it was entitled to THAT market's commerce type - answerable with the wrong org's feature set for a foreign market. Scoped the same way, so a foreign market is now invisible to this gate exactly like a nonexistent one, in addition to (not instead of) the per-handler fix above. All parameter and behavior changes are described in the paired kamo-shared-library commit **************** this commit only threads the already-available orgId through to the new signatures. Tests: full mvn test green (2826 run, 0 failures, 1 pre-existing skip). Added **************** (mutation-checked: reverting the interceptor's lookup back to findById made the foreign-org test fail red, confirmed, then restored). The per-repository-pattern mutation-checked tests for the underlying fix live in kamo-shared-library's RetailServiceOrgScopingTest and **************** pushed first per the coordinator's ordering (securityservice's CI builds kamo-shared-library at HEAD of main).