@de-otio/trellis 0.4.0

package/dist/lib/data-router.js

@@ -0,0 +1,792 @@
+"use strict";
+/**
+ * Data Router Module
+ *
+ * Routes data operations to region-specific databases and enforces data residency.
+ *
+ * Security: All operations validate region and enforce strict region boundaries.
+ *
+ * Performance: Uses cached database connections (via createPrismaForRegion).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataRouter = void 0;
+const db_1 = require("../db");
+const audit_logger_1 = require("./audit-logger");
+const database_wrapper_helper_1 = require("./database-wrapper-helper");
+const ip_scrubber_1 = require("./ip-scrubber");
+const logger_1 = require("./logger");
+const region_detection_1 = require("./region-detection");
+/**
+ * Data Router class for region-aware data operations
+ *
+ * Security: All operations validate region and enforce dataRegion matching.
+ *
+ * Audit: All operations are logged for compliance and security monitoring.
+ */
+class DataRouter {
+    static auditLogger;
+    /**
+     * Get or create audit logger instance
+     */
+    static getAuditLogger(env, requestId) {
+        if (!this.auditLogger) {
+            this.auditLogger = new audit_logger_1.AuditLogger(env);
+        }
+        if (requestId) {
+            return this.auditLogger.withRequestId(requestId);
+        }
+        return this.auditLogger;
+    }
+    /**
+     * Validate region access for data operations
+     *
+     * Security: Ensures dataRegion matches requested region to prevent cross-region data access.
+     *
+     * @param dataRegion - Region where data is stored (from database)
+     * @param requestedRegion - Region where request originated
+     * @param userId - Optional user ID for audit logging
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging
+     * @param requestId - Optional request ID for audit log correlation
+     * @throws Error if dataRegion doesn't match requested region
+     */
+    /**
+     * Check if user has consented to cross-region access
+     */
+    static async checkCrossRegionConsent(userId, dataRegion, accessRegion, env) {
+        try {
+            const db = this.getDatabaseForRegion(accessRegion, env);
+            const consent = await db.crossRegionConsent.findUnique({
+                where: {
+                    userId_dataRegion_accessRegion: {
+                        userId,
+                        dataRegion,
+                        accessRegion,
+                    },
+                },
+            });
+            return consent?.consented === true && consent.withdrawnAt === null;
+        }
+        catch (error) {
+            logger_1.Logger.getInstance(env).warn("[DataRouter] Error checking cross-region consent:", error);
+            return false;
+        }
+    }
+    static validateRegionAccess(dataRegion, requestedRegion, userId, env, request, requestId) {
+        if (!dataRegion) {
+            // Log missing dataRegion as security issue
+            try {
+                const auditLogger = this.getAuditLogger(env, requestId);
+                auditLogger
+                    .log({
+                    type: "authorization",
+                    action: "DATA_REGION_MISSING",
+                    resource: "unknown",
+                    userId,
+                    region: requestedRegion,
+                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    userAgent: request?.headers.get("User-Agent") || undefined,
+                    severity: "high",
+                    success: false,
+                    metadata: {
+                        requestedRegion,
+                        error: "dataRegion not set",
+                    },
+                }, env)
+                    .catch((err) => {
+                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                });
+            }
+            catch (auditError) {
+                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for missing dataRegion:", auditError);
+            }
+            throw new Error("Data residency violation: dataRegion not set");
+        }
+        if (dataRegion !== requestedRegion) {
+            // Log security violation
+            try {
+                const auditLogger = this.getAuditLogger(env, requestId);
+                auditLogger
+                    .log({
+                    type: "authorization",
+                    action: "CROSS_REGION_DATA_ACCESS_BLOCKED",
+                    resource: "unknown",
+                    userId,
+                    region: requestedRegion,
+                    dataRegion,
+                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    userAgent: request?.headers.get("User-Agent") || undefined,
+                    severity: "high",
+                    success: false,
+                    metadata: {
+                        requestedRegion,
+                        actualDataRegion: dataRegion,
+                        requiresConsent: true,
+                    },
+                }, env)
+                    .catch((err) => {
+                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                });
+            }
+            catch (auditError) {
+                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+            }
+            // Throw error with specific code that frontend can detect
+            const error = new Error(`CROSS_REGION_ACCESS_REQUIRES_CONSENT: Cannot access ${dataRegion} data from ${requestedRegion} region`);
+            error.code = "CROSS_REGION_ACCESS_REQUIRES_CONSENT";
+            error.dataRegion = dataRegion;
+            error.requestedRegion = requestedRegion;
+            throw error;
+        }
+    }
+    /**
+     * Validate region access with consent check (async version)
+     * Use this when you need to check for existing consent
+     */
+    static async validateRegionAccessWithConsent(dataRegion, requestedRegion, userId, env, request, requestId) {
+        if (!dataRegion) {
+            throw new Error("Data residency violation: dataRegion not set");
+        }
+        if (dataRegion !== requestedRegion) {
+            // Check for existing consent
+            if (userId) {
+                const hasConsent = await this.checkCrossRegionConsent(userId, dataRegion, requestedRegion, env);
+                if (hasConsent) {
+                    // Log consent-based access
+                    try {
+                        const auditLogger = this.getAuditLogger(env, requestId);
+                        auditLogger
+                            .log({
+                            type: "authorization",
+                            action: "CROSS_REGION_DATA_ACCESS_ALLOWED_WITH_CONSENT",
+                            resource: "unknown",
+                            userId,
+                            region: requestedRegion,
+                            dataRegion,
+                            ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                            userAgent: request?.headers.get("User-Agent") || undefined,
+                            severity: "medium",
+                            success: true,
+                            metadata: {
+                                requestedRegion,
+                                actualDataRegion: dataRegion,
+                                consentBased: true,
+                            },
+                        }, env)
+                            .catch((err) => {
+                            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", err);
+                        });
+                    }
+                    catch (auditError) {
+                        logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed:", auditError);
+                    }
+                    return; // Access allowed with consent
+                }
+            }
+            // No consent, throw error
+            this.validateRegionAccess(dataRegion, requestedRegion, userId, env, request, requestId);
+        }
+    }
+    /**
+     * Get database client for a specific region
+     *
+     * Performance: Uses createPrismaForRegion for database connection pooling and caching.
+     *
+     * If request and userId are provided, returns a wrapped client with monitoring and rate limiting.
+     * Otherwise, returns an unwrapped client (for backward compatibility).
+     *
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object (if provided, enables monitoring and rate limiting)
+     * @param userId - Optional user ID (if provided, enables per-user rate limiting)
+     * @returns Prisma client for the region
+     * @throws Error if region is invalid
+     */
+    static getDatabaseForRegion(region, env, request, userId) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // If request is provided, return wrapped client with monitoring
+        if (request) {
+            return (0, database_wrapper_helper_1.getWrappedDatabase)(region, env, request, userId);
+        }
+        // Otherwise, return unwrapped client (backward compatibility)
+        // Get region-specific database connection
+        // Uses existing createPrismaForRegion which handles connection string selection
+        return (0, db_1.createPrismaForRegion)(region, env);
+    }
+    /**
+     * Create a user in the region-specific database
+     *
+     * Security: Enforces region validation and dataRegion matching.
+     *
+     * Audit: Logs user creation for compliance.
+     *
+     * @param userData - User data to create
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @returns Created user
+     * @throws Error if region is invalid or dataRegion mismatch
+     */
+    static async createUser(userData, region, env, request, requestId) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // OPTIMIZATION: For test users, use executeWithRetry with appropriate timeout
+        // In CI, database connections can be slower, so we use slightly longer timeouts
+        const isTestUser = userData.email?.includes("@test.example.com") ||
+            userData.email?.includes("test-");
+        // Detect CI environment for timeout adjustment
+        const isCI = env.CI === "true" || env.GITHUB_ACTIONS === "true";
+        // OPTIMIZATION: For test users, use aggressive timeouts since they should be fast
+        // Test users are created frequently in tests and should complete quickly
+        // In CI, database connections can take longer due to network latency
+        // CRITICAL FIX: Increased timeouts based on Cloudflare logs analysis
+        // Logs showed 108 query timeouts - 500-800ms is too aggressive
+        // Queries are taking 800ms+ under load, causing premature timeouts
+        // Use 3s timeout for test users in CI (allows for database connection + query + retry)
+        // Use 2s timeout locally (gives queries enough time to complete)
+        const testUserTimeoutMs = isCI ? 3000 : 2000;
+        const testUserRetryTimeoutMs = isCI ? 1000 : 500;
+        // Allow 1 retry in CI for transient connection issues, no retries locally for speed
+        const testUserMaxRetries = isCI ? 1 : 0;
+        // Use executeWithRetry for proper timeout protection (connection + query)
+        const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
+        const logger = logger_1.Logger.getInstance(env);
+        const dbWriteStartTime = Date.now();
+        const user = await sharedDatabaseConnectionManager.executeWithRetry(region, env, async (db) => {
+            // OPTIMIZATION: For test users, try create first (faster than upsert)
+            // If user already exists, fall back to upsert
+            // This optimizes the common case where test users are new
+            if (isTestUser) {
+                try {
+                    return await db.user.create({
+                        data: {
+                            ...userData,
+                            region,
+                            dataRegion: region, // CRITICAL: Must match region
+                        },
+                    });
+                }
+                catch (createError) {
+                    // If user already exists (unique constraint violation), use upsert
+                    // This handles cross-region test scenarios where user might exist in different region
+                    if (createError.code === "P2002" ||
+                        createError.message?.includes("Unique constraint")) {
+                        logger.debug("[DataRouter] Test user already exists, using upsert", { userId: userData.id });
+                        // Fall through to upsert
+                    }
+                    else {
+                        // Re-throw other errors
+                        throw createError;
+                    }
+                }
+            }
+            // Use upsert for production users or when test user already exists
+            // This prevents unique constraint violations when user ID is globally unique
+            // CRITICAL: Set region and dataRegion to match
+            // dataRegion must match region for compliance
+            // Note: Type assertion needed since Prisma client hasn't been regenerated with region/dataRegion fields
+            // TODO: Remove type assertion after running `npx prisma generate`
+            return await db.user.upsert({
+                where: { id: userData.id },
+                create: {
+                    ...userData,
+                    region,
+                    dataRegion: region, // CRITICAL: Must match region
+                },
+                update: {
+                    // Update email if provided and different
+                    email: userData.email,
+                    // For test users, allow region/dataRegion update to handle cross-region test scenarios
+                    // For production users, preserve their region (compliance requirement)
+                    ...(isTestUser
+                        ? {
+                            region,
+                            dataRegion: region, // Update to match requested region for test users
+                        }
+                        : {
+                        // Don't update region/dataRegion on existing users (preserve their region)
+                        }),
+                },
+            });
+        }, {
+            timeoutMs: isTestUser ? testUserTimeoutMs : 3000, // 2s in CI / 1s locally for test users, 3s for real users
+            retryTimeoutMs: isTestUser ? testUserRetryTimeoutMs : 1000, // 1s in CI / 0.5s locally for test users, 1s for real users
+            maxRetries: isTestUser ? testUserMaxRetries : 1, // 1 retry in CI / 0 retries locally for test users, 1 retry for real users
+            context: {
+                operation: "createUser",
+                userId: userData.id,
+                isTestUser,
+                isCI,
+            },
+        });
+        const dbWriteDuration = Date.now() - dbWriteStartTime;
+        logger.debug("[UserCreation] Database write completed", {
+            duration: dbWriteDuration,
+            userId: user.id,
+            region,
+            isTestUser,
+        });
+        // CRITICAL: Verify dataRegion was set correctly
+        if (user.dataRegion !== region) {
+            throw new Error(`Data region mismatch: expected ${region}, got ${user.dataRegion}`);
+        }
+        // Audit log: User creation (don't fail operation if audit logging fails)
+        // Use fire-and-forget for test user creation to avoid blocking on slow audit logging
+        // Note: isTestUser is already determined above for database optimization
+        if (!isTestUser) {
+            try {
+                const auditLogger = this.getAuditLogger(env, requestId);
+                // Fire and forget - don't await to avoid blocking user creation
+                auditLogger
+                    .logUserAction({
+                    action: "user_created",
+                    resource: "user",
+                    resourceId: user.id,
+                    userId: user.id, // User creating themselves
+                    region: region,
+                    dataRegion: user.dataRegion || region,
+                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    userAgent: request?.headers.get("User-Agent") || undefined,
+                    success: true,
+                }, env)
+                    .catch((auditError) => {
+                    // Don't fail the operation if audit logging fails
+                    // Error is already logged by AuditLogger
+                    logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user creation:", auditError);
+                });
+            }
+            catch (auditError) {
+                // Don't fail the operation if audit logging fails
+                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging setup failed for user creation:", auditError);
+            }
+        }
+        return user;
+    }
+    /**
+     * Get a user from the region-specific database
+     *
+     * Security: Validates region and verifies dataRegion matches requested region.
+     *
+     * Audit: Logs data access for compliance.
+     *
+     * @param userId - User ID
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns User or null if not found
+     * @throws Error if region is invalid or dataRegion mismatch detected
+     */
+    static async getUser(userId, region, env, request, requestId, requestingUserId) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // Get region-specific database (with monitoring/rate limiting if request provided)
+        const db = this.getDatabaseForRegion(region, env, request, userId);
+        // Find user in region-specific database
+        // Note: Type assertion needed since Prisma client hasn't been regenerated with region/dataRegion fields
+        // TODO: Remove type assertion after running `npx prisma generate`
+        const user = await db.user.findUnique({
+            where: { id: userId },
+        });
+        // CRITICAL: Verify dataRegion matches requested region
+        // This is defense in depth - routing should prevent this, but we check anyway
+        if (user && user.dataRegion && user.dataRegion !== region) {
+            // Log security violation and return null (don't expose cross-region data)
+            try {
+                const auditLogger = this.getAuditLogger(env, requestId);
+                await auditLogger.log({
+                    type: "authorization",
+                    action: "CROSS_REGION_DATA_ACCESS_BLOCKED",
+                    resource: "user",
+                    resourceId: userId,
+                    userId: requestingUserId,
+                    region: region,
+                    dataRegion: user.dataRegion,
+                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    userAgent: request?.headers.get("User-Agent") || undefined,
+                    severity: "high",
+                    success: false,
+                    metadata: {
+                        requestedRegion: region,
+                        actualDataRegion: user.dataRegion,
+                    },
+                }, env);
+            }
+            catch (auditError) {
+                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+            }
+            // Return null instead of throwing (don't expose cross-region data)
+            return null;
+        }
+        // Audit log: Data access (don't fail operation if audit logging fails)
+        try {
+            const auditLogger = this.getAuditLogger(env, requestId);
+            await auditLogger.logDataAccess({
+                action: "user_accessed",
+                resource: "user",
+                resourceId: userId,
+                userId: requestingUserId,
+                region: region,
+                dataRegion: user?.dataRegion || region,
+                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                userAgent: request?.headers.get("User-Agent") || undefined,
+                success: user !== null,
+            }, env);
+        }
+        catch (auditError) {
+            // Don't fail the operation if audit logging fails
+            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user access:", auditError);
+        }
+        return user;
+    }
+    /**
+     * Update a user in the region-specific database
+     *
+     * Security: Validates region and ensures dataRegion cannot be changed.
+     *
+     * Audit: Logs user update for compliance.
+     *
+     * @param userId - User ID
+     * @param updateData - Data to update
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns Updated user
+     * @throws Error if region is invalid or dataRegion mismatch
+     */
+    static async updateUser(userId, updateData, region, env, request, requestId, requestingUserId) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // CRITICAL: Prevent dataRegion from being changed
+        // dataRegion is immutable - it tracks where data is stored for compliance
+        if ("dataRegion" in updateData) {
+            throw new Error("dataRegion cannot be changed - it is immutable for compliance");
+        }
+        // Get region-specific database (with monitoring/rate limiting if request provided)
+        const db = this.getDatabaseForRegion(region, env, request, userId);
+        // Update user
+        // Note: Type assertion needed since Prisma client hasn't been regenerated with region/dataRegion fields
+        // TODO: Remove type assertion after running `npx prisma generate`
+        const user = await db.user.update({
+            where: { id: userId },
+            data: updateData, // Type assertion needed for updateData (role type mismatch)
+        });
+        // CRITICAL: Verify dataRegion still matches region using validation middleware
+        this.validateRegionAccess(user.dataRegion, region, requestingUserId || userId, env, request, requestId);
+        // Audit log: User update (don't fail operation if audit logging fails)
+        try {
+            const auditLogger = this.getAuditLogger(env, requestId);
+            await auditLogger.logUserAction({
+                action: "user_updated",
+                resource: "user",
+                resourceId: userId,
+                userId: requestingUserId || userId,
+                region: region,
+                dataRegion: user.dataRegion || region,
+                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                userAgent: request?.headers.get("User-Agent") || undefined,
+                metadata: {
+                    updatedFields: Object.keys(updateData),
+                },
+                success: true,
+            }, env);
+        }
+        catch (auditError) {
+            // Don't fail the operation if audit logging fails
+            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for user update:", auditError);
+        }
+        return user;
+    }
+    /**
+     * Create a post in the region-specific database
+     *
+     * Security: Enforces region validation and dataRegion matching.
+     *
+     * Audit: Logs post creation for compliance.
+     *
+     * @param postData - Post data to create
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @returns Created post
+     * @throws Error if region is invalid
+     */
+    static async createPost(postData, region, env, request, requestId, session) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // Get region-specific database (with monitoring/rate limiting if request provided)
+        // For transactions, we need the unwrapped Prisma client to avoid Symbol serialization issues
+        // Prisma's transaction timeout mechanism tries to serialize the callback, and Proxies contain Symbols
+        const wrappedDb = this.getDatabaseForRegion(region, env, request, postData.authorId);
+        // Get unwrapped Prisma client for transactions to avoid Proxy Symbol serialization
+        const { getUnwrappedDatabase } = await Promise.resolve().then(() => __importStar(require("./database-wrapper-helper")));
+        const db = request ? getUnwrappedDatabase(region, env) : wrappedDb;
+        // Extract entityRefs (will be handled separately in transaction)
+        const entityRefs = postData.entityRefs || [];
+        // Extract media (will be handled separately in transaction)
+        const media = postData.media || [];
+        // Sanitize data to ensure only serializable values are passed to Prisma
+        // This prevents Symbol serialization errors
+        // Only include known, safe fields that Prisma expects
+        const sanitizedPostData = {
+            authorId: String(postData.authorId),
+            text: String(postData.text),
+            visibility: String(postData.visibility),
+        };
+        // Only include optional fields if they exist and are serializable
+        if (postData.geoData !== undefined && postData.geoData !== null) {
+            try {
+                // Ensure geoData is serializable (JSON round-trip test)
+                const serialized = JSON.parse(JSON.stringify(postData.geoData));
+                sanitizedPostData.geoData = serialized;
+            }
+            catch (e) {
+                logger_1.Logger.getInstance(env).warn("[DataRouter] geoData is not serializable, skipping:", e);
+            }
+        }
+        if (postData.contentWarnings !== undefined &&
+            Array.isArray(postData.contentWarnings)) {
+            // Ensure all array items are strings
+            sanitizedPostData.contentWarnings = postData.contentWarnings
+                .filter((item) => typeof item === "string")
+                .map((item) => String(item));
+        }
+        // Extract only the values needed from env before transaction
+        // This prevents Symbol serialization issues when Prisma serializes the transaction callback
+        const envForValidation = env.CACHE_KV
+            ? { CACHE_KV: env.CACHE_KV }
+            : {};
+        // Use transaction to ensure atomicity
+        const result = await db.$transaction(async (tx) => {
+            // Validate entity tagging permissions within transaction (if entities provided and session available)
+            if (entityRefs.length > 0 && session) {
+                const { validateEntityTagging } = await Promise.resolve().then(() => __importStar(require("./entity-tagging-validator")));
+                const { FriendsHandler } = await Promise.resolve().then(() => __importStar(require("./friends-handler")));
+                const friendsHandler = new FriendsHandler();
+                // Sanitize session object to avoid Symbol serialization issues
+                const sanitizedSession = {
+                    userId: String(session.userId),
+                    email: String(session.email),
+                };
+                // Validate using transaction client to ensure consistency
+                // Only pass minimal env object (CACHE_KV if available) to avoid Symbol issues
+                await validateEntityTagging(sanitizedSession.userId, entityRefs, tx, // Transaction client
+                friendsHandler, envForValidation, sanitizedSession);
+            }
+            // CRITICAL: Set dataRegion to match region
+            // Note: Type assertion needed since Prisma client hasn't been regenerated with dataRegion field
+            // Explicitly construct data object to avoid Symbol serialization issues
+            const createData = {
+                authorId: sanitizedPostData.authorId,
+                text: sanitizedPostData.text,
+                visibility: sanitizedPostData.visibility,
+                dataRegion: region, // CRITICAL: Must match region
+            };
+            // Only add optional fields if they exist
+            if (sanitizedPostData.geoData !== undefined) {
+                createData.geoData = sanitizedPostData.geoData;
+            }
+            if (sanitizedPostData.contentWarnings !== undefined) {
+                createData.contentWarnings = sanitizedPostData.contentWarnings;
+            }
+            const post = await tx.post.create({
+                data: createData, // Type assertion needed until Prisma client is regenerated
+            });
+            // CRITICAL: Verify dataRegion was set correctly
+            if (post.dataRegion !== region) {
+                throw new Error(`Data region mismatch: expected ${region}, got ${post.dataRegion}`);
+            }
+            // Create PostEntity records if entities are tagged
+            if (entityRefs.length > 0) {
+                await tx.postEntity.createMany({
+                    data: entityRefs.map((entityId) => ({
+                        postId: post.id,
+                        entityId,
+                    })),
+                    skipDuplicates: true, // Handle race conditions
+                });
+            }
+            // Create PostMedia records if media are attached
+            if (media.length > 0) {
+                await tx.postMedia.createMany({
+                    data: media.map((m, index) => ({
+                        postId: post.id,
+                        mediaId: m.id,
+                        alt: m.alt || "",
+                        order: index,
+                    })),
+                    skipDuplicates: true, // Handle race conditions
+                });
+                // Mark these files as attached, clearing any stale orphan flag.
+                // This is the authoritative source of truth: once a PostMedia record
+                // exists, the file is attached regardless of whether completeSession()
+                // was called by the client.
+                await tx.mediaFile.updateMany({
+                    where: { id: { in: media.map((m) => m.id) } },
+                    data: {
+                        attachedToPost: true,
+                        orphanedAt: null,
+                    },
+                });
+            }
+            return post;
+        }, {
+            timeout: 3000, // 3 second timeout - fail fast if database is slow
+        });
+        // Audit log: Post creation (don't fail operation if audit logging fails)
+        try {
+            const auditLogger = this.getAuditLogger(env, requestId);
+            await auditLogger.logUserAction({
+                action: "post_created",
+                resource: "post",
+                resourceId: result.id,
+                userId: postData.authorId,
+                region: region,
+                dataRegion: result.dataRegion || region,
+                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                userAgent: request?.headers.get("User-Agent") || undefined,
+                metadata: {
+                    visibility: postData.visibility,
+                    hasGeoData: !!postData.geoData,
+                    entityCount: entityRefs.length,
+                },
+                success: true,
+            }, env);
+        }
+        catch (auditError) {
+            // Don't fail the operation if audit logging fails
+            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for post creation:", auditError);
+        }
+        return result;
+    }
+    /**
+     * Get a post from the region-specific database
+     *
+     * Security: Validates region and verifies dataRegion matches requested region.
+     *
+     * Audit: Logs data access for compliance.
+     *
+     * @param postId - Post ID
+     * @param region - Region code ('US', 'EU', 'CN')
+     * @param env - Environment variables
+     * @param request - Optional request object for audit logging (IP, user agent)
+     * @param requestId - Optional request ID for audit log correlation
+     * @param requestingUserId - Optional ID of user making the request (for audit)
+     * @returns Post or null if not found
+     * @throws Error if region is invalid or dataRegion mismatch detected
+     */
+    static async getPost(postId, region, env, request, requestId, requestingUserId) {
+        // CRITICAL: Validate region before routing
+        if (!(0, region_detection_1.isValidRegion)(region)) {
+            throw new Error(`Invalid region: ${region}. Valid regions: US, EU, CN`);
+        }
+        // Get region-specific database (with monitoring if request provided)
+        const db = this.getDatabaseForRegion(region, env, request, requestingUserId);
+        // Find post in region-specific database
+        // Note: Type assertion needed since Prisma client hasn't been regenerated with dataRegion field
+        // TODO: Remove type assertion after running `npx prisma generate`
+        const post = await db.post.findUnique({
+            where: { id: postId },
+        });
+        // CRITICAL: Verify dataRegion matches requested region
+        if (post && post.dataRegion && post.dataRegion !== region) {
+            // Log security violation and return null (don't expose cross-region data)
+            try {
+                const auditLogger = this.getAuditLogger(env, requestId);
+                await auditLogger.log({
+                    type: "authorization",
+                    action: "CROSS_REGION_DATA_ACCESS_BLOCKED",
+                    resource: "post",
+                    resourceId: postId,
+                    userId: requestingUserId,
+                    region: region,
+                    dataRegion: post.dataRegion,
+                    ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                    userAgent: request?.headers.get("User-Agent") || undefined,
+                    severity: "high",
+                    success: false,
+                    metadata: {
+                        requestedRegion: region,
+                        actualDataRegion: post.dataRegion,
+                    },
+                }, env);
+            }
+            catch (auditError) {
+                logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for cross-region access:", auditError);
+            }
+            // Return null instead of throwing (don't expose cross-region data)
+            return null;
+        }
+        // Audit log: Data access (don't fail operation if audit logging fails)
+        try {
+            const auditLogger = this.getAuditLogger(env, requestId);
+            await auditLogger.logDataAccess({
+                action: "post_accessed",
+                resource: "post",
+                resourceId: postId,
+                userId: requestingUserId,
+                region: region,
+                dataRegion: post?.dataRegion || region,
+                ipAddress: request ? (0, ip_scrubber_1.getIPAddress)(request) : undefined,
+                userAgent: request?.headers.get("User-Agent") || undefined,
+                success: post !== null,
+            }, env);
+        }
+        catch (auditError) {
+            // Don't fail the operation if audit logging fails
+            logger_1.Logger.getInstance(env).warn("[DataRouter] Audit logging failed for post access:", auditError);
+        }
+        return post;
+    }
+}
+exports.DataRouter = DataRouter;
+//# sourceMappingURL=data-router.js.map