Engineering record — internal detail. The manual is authoritative for product behaviour.
Engineering2026-08-196 min read
Orders & invoices security review
The procurement and sales order and invoice modules reviewed for cache-key leakage, cross-org references, deadlock-safe stock locking, status re-checks and transition rules.
ForEngineer
Findings and fixes
| Concern | Fix direction |
|---|---|
| Cache-key IDOR | Include the organisation id in every cache key |
| Cross-org references | Reject a foreign vendor, customer or variant at the action layer |
| Detail getters | Make every getter organisation-first |
| Stock locking | Batch stock locks in a fixed order so concurrent orders cannot deadlock |
| Time-of-check to time-of-use | Re-check status inside the transaction before mutating |
| Invoice transitions | Encode the legal status transitions explicitly and reject the rest |
| Schema bounds | Constrain numeric and string bounds in the schema |
| Enforcement | Stage the policy script after the code fixes land |
Why it matters
Order and invoice flows are the highest-traffic write paths and the place where money and stock meet. A cache key that omits the organisation, or a status re-check that happens outside the transaction, is not a cosmetic bug — it is a correctness and isolation failure.
Source records
- Design
- docs/superpowers/specs/2026-08-19-orders-invoices-security-review-design.md