diff --git a/Distribution/Features/ShopPO/ShopPOController.cs b/Distribution/Features/ShopPO/ShopPOController.cs
index af13e30..f8f5fe9 100644
--- a/Distribution/Features/ShopPO/ShopPOController.cs
+++ b/Distribution/Features/ShopPO/ShopPOController.cs
@@ -33,10 +33,13 @@ public class ShopPOController(ShopPOService service, ICurrentUserService current
     [HttpPost]
     public async Task<IActionResult> Create(CreateShopPORequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
+        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
+        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
+        var userId = currentUser.UserId ?? request.RaisedByUserId;
+        if (userId is null) return BadRequest(new { error = "RaisedByUserId is required while auth is unavailable" });
         try
         {
-            var result = await service.CreateAsync(request, userId, ct);
+            var result = await service.CreateAsync(request, userId.Value, ct);
             return CreatedAtAction(nameof(GetById), new { id = result.Id }, result);
         }
         catch (InvalidOperationException ex) { return BadRequest(new { error = ex.Message }); }
@@ -55,12 +58,15 @@ public class ShopPOController(ShopPOService service, ICurrentUserService current
     }
 
     [HttpPost("{id:guid}/confirm")]
-    public async Task<IActionResult> Confirm(Guid id, CancellationToken ct)
+    public async Task<IActionResult> Confirm(Guid id, ConfirmShopPORequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
+        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
+        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
+        var userId = currentUser.UserId ?? request.ConfirmedByUserId;
+        if (userId is null) return BadRequest(new { error = "ConfirmedByUserId is required while auth is unavailable" });
         try
         {
-            var result = await service.ConfirmAsync(id, userId, ct);
+            var result = await service.ConfirmAsync(id, userId.Value, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }
@@ -68,12 +74,15 @@ public class ShopPOController(ShopPOService service, ICurrentUserService current
     }
 
     [HttpPost("{id:guid}/confirm-and-create-invoice")]
-    public async Task<IActionResult> ConfirmAndCreateInvoice(Guid id, CancellationToken ct)
+    public async Task<IActionResult> ConfirmAndCreateInvoice(Guid id, ConfirmShopPORequest request, CancellationToken ct)
     {
-        var userId = currentUser.UserId ?? throw new UnauthorizedAccessException();
+        // TEMPORARY: currentUser.UserId is always unset due to the broken auth middleware
+        // (testbug.md #28) — fall back to the explicitly supplied user until that's fixed.
+        var userId = currentUser.UserId ?? request.ConfirmedByUserId;
+        if (userId is null) return BadRequest(new { error = "ConfirmedByUserId is required while auth is unavailable" });
         try
         {
-            var result = await service.ConfirmAndCreateInvoiceAsync(id, userId, ct);
+            var result = await service.ConfirmAndCreateInvoiceAsync(id, userId.Value, ct);
             return Ok(result);
         }
         catch (KeyNotFoundException) { return NotFound(); }
diff --git a/Distribution/Features/ShopPO/ShopPODTOs.cs b/Distribution/Features/ShopPO/ShopPODTOs.cs
index 2eb2604..5d50e6d 100644
--- a/Distribution/Features/ShopPO/ShopPODTOs.cs
+++ b/Distribution/Features/ShopPO/ShopPODTOs.cs
@@ -2,9 +2,10 @@
 
 namespace Distribution.Features.ShopPO;
 
-public record CreateShopPORequest(Guid StoreId, List<ShopPOItemRequest> Items);
+public record CreateShopPORequest(Guid StoreId, List<ShopPOItemRequest> Items, Guid? RaisedByUserId = null);
 public record ShopPOItemRequest(Guid ItemId, int Quantity, decimal? UnitPrice = null);
 public record UpdateShopPOItemsRequest(List<ShopPOItemRequest> Items);
+public record ConfirmShopPORequest(Guid? ConfirmedByUserId = null);
 
 public record ShopPOItemResponse(Guid Id, Guid ItemId, string ItemName, int Quantity, int QuantityFulfilled, decimal UnitPrice, bool IsActive);