@elevasis/core 0.12.0 → 0.13.0

package/dist/test-utils/index.d.ts

@@ -413,7 +413,6 @@ type Database = {
             acq_deals: {
                 Row: {
                     activity_log: Json;
-                    cached_stage: string | null;
                     closed_lost_at: string | null;
                     closed_lost_reason: string | null;
                     contact_email: string;
@@ -428,6 +427,7 @@ type Database = {
                     organization_id: string;
                     payment_link_sent_at: string | null;
                     payment_received_at: string | null;
+                    pipeline_key: string;
                     proposal_data: Json | null;
                     proposal_generated_at: string | null;
                     proposal_pdf_url: string | null;
@@ -435,10 +435,11 @@ type Database = {
                     proposal_reviewed_by: string | null;
                     proposal_sent_at: string | null;
                     proposal_signed_at: string | null;
-                    proposal_status: string | null;
                     signature_envelope_id: string | null;
                     source_list_id: string | null;
                     source_type: string | null;
+                    stage_key: string | null;
+                    state_key: string | null;
                     stripe_payment_id: string | null;
                     stripe_payment_link: string | null;
                     stripe_payment_link_id: string | null;
@@ -447,7 +448,6 @@ type Database = {
                 };
                 Insert: {
                     activity_log?: Json;
-                    cached_stage?: string | null;
                     closed_lost_at?: string | null;
                     closed_lost_reason?: string | null;
                     contact_email: string;
@@ -462,6 +462,7 @@ type Database = {
                     organization_id: string;
                     payment_link_sent_at?: string | null;
                     payment_received_at?: string | null;
+                    pipeline_key?: string;
                     proposal_data?: Json | null;
                     proposal_generated_at?: string | null;
                     proposal_pdf_url?: string | null;
@@ -469,10 +470,11 @@ type Database = {
                     proposal_reviewed_by?: string | null;
                     proposal_sent_at?: string | null;
                     proposal_signed_at?: string | null;
-                    proposal_status?: string | null;
                     signature_envelope_id?: string | null;
                     source_list_id?: string | null;
                     source_type?: string | null;
+                    stage_key?: string | null;
+                    state_key?: string | null;
                     stripe_payment_id?: string | null;
                     stripe_payment_link?: string | null;
                     stripe_payment_link_id?: string | null;
@@ -481,7 +483,6 @@ type Database = {
                 };
                 Update: {
                     activity_log?: Json;
-                    cached_stage?: string | null;
                     closed_lost_at?: string | null;
                     closed_lost_reason?: string | null;
                     contact_email?: string;
@@ -496,6 +497,7 @@ type Database = {
                     organization_id?: string;
                     payment_link_sent_at?: string | null;
                     payment_received_at?: string | null;
+                    pipeline_key?: string;
                     proposal_data?: Json | null;
                     proposal_generated_at?: string | null;
                     proposal_pdf_url?: string | null;
@@ -503,10 +505,11 @@ type Database = {
                     proposal_reviewed_by?: string | null;
                     proposal_sent_at?: string | null;
                     proposal_signed_at?: string | null;
-                    proposal_status?: string | null;
                     signature_envelope_id?: string | null;
                     source_list_id?: string | null;
                     source_type?: string | null;
+                    stage_key?: string | null;
+                    state_key?: string | null;
                     stripe_payment_id?: string | null;
                     stripe_payment_link?: string | null;
                     stripe_payment_link_id?: string | null;
@@ -2755,12 +2758,6 @@ type Database = {
                 };
                 Returns: boolean;
             };
-            is_org_admin: {
-                Args: {
-                    org_id: string;
-                };
-                Returns: boolean;
-            };
             is_org_member: {
                 Args: {
                     org_id: string;
@@ -2915,6 +2912,14 @@ declare class RLSTestContext {
      * Create an organization membership
      */
     createMembership(userId: string, organizationId: string, role: Role): Promise<Membership>;
+    /**
+     * Assign a system role to a membership via org_rol_assignments.
+     * After the 2026-04-25 auth refactor, RLS policies read `effective_permissions[]`
+     * (materialized by trigger from org_rol_assignments → org_rol_grants).
+     * Without this assignment, role_slug is informational only and the membership
+     * has zero permissions, causing all has_org_permission() checks to deny.
+     */
+    private assignSystemRole;
     /**
      * Create a pre-provisioned organization membership (without WorkOS membership ID)
      * Used for testing invitation flows where memberships are created before user accepts

package/dist/test-utils/index.js

@@ -1991,6 +1991,7 @@ var RLSTestContext = class {
       throw new Error(`Failed to create membership: ${error.message}`);
     }
     this.createdIds.memberships.push(data.id);
+    await this.assignSystemRole(data.id, role);
     return {
       id: data.id,
       user_id: data.user_id,
@@ -1998,6 +1999,23 @@ var RLSTestContext = class {
       role_slug: data.role_slug
     };
   }
+  /**
+   * Assign a system role to a membership via org_rol_assignments.
+   * After the 2026-04-25 auth refactor, RLS policies read `effective_permissions[]`
+   * (materialized by trigger from org_rol_assignments → org_rol_grants).
+   * Without this assignment, role_slug is informational only and the membership
+   * has zero permissions, causing all has_org_permission() checks to deny.
+   */
+  async assignSystemRole(membershipId, slug) {
+    const { data: roleDef, error: roleErr } = await this.adminClient.from("org_rol_definitions").select("id").is("organization_id", null).eq("slug", slug).single();
+    if (roleErr || !roleDef) {
+      throw new Error(`Failed to look up system role '${slug}': ${roleErr?.message ?? "not found"}`);
+    }
+    const { error: assignErr } = await this.adminClient.from("org_rol_assignments").insert({ membership_id: membershipId, role_id: roleDef.id });
+    if (assignErr) {
+      throw new Error(`Failed to assign system role '${slug}' to membership: ${assignErr.message}`);
+    }
+  }
   /**
    * Create a pre-provisioned organization membership (without WorkOS membership ID)
    * Used for testing invitation flows where memberships are created before user accepts
@@ -2016,6 +2034,7 @@ var RLSTestContext = class {
       throw new Error(`Failed to create pre-provisioned membership: ${error.message}`);
     }
     this.createdIds.memberships.push(data.id);
+    await this.assignSystemRole(data.id, role);
     return {
       id: data.id,
       user_id: data.user_id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elevasis/core",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "license": "MIT",
   "description": "Minimal shared constants across Elevasis monorepo",
   "sideEffects": false,

package/src/auth/multi-tenancy/credentials/__tests__/encryption.test.ts

@@ -1,216 +1,217 @@
-import { describe, it, expect } from 'vitest'
-import { encryptCredential, decryptCredential } from '../server/encryption'
-
-// Note: SECRETS_ENCRYPTION_KEY is set in vitest.config.ts env section
-// The encryption module reads it at load time
-
-describe('Credential Encryption', () =>{
-
-  describe('encryptCredential', () => {
-    it('encrypts plaintext to base64-encoded JSON string', () => {
-      const plaintext = 'my-secret-api-key'
-      const encrypted = encryptCredential(plaintext)
-
-      // Should be a valid JSON string
-      expect(() => JSON.parse(encrypted)).not.toThrow()
-
-      const parsed = JSON.parse(encrypted)
-      expect(parsed).toHaveProperty('iv')
-      expect(parsed).toHaveProperty('authTag')
-      expect(parsed).toHaveProperty('data')
-    })
-
-    it('produces different ciphertext for same input (random IV)', () => {
-      const plaintext = 'same-secret'
-
-      const encrypted1 = encryptCredential(plaintext)
-      const encrypted2 = encryptCredential(plaintext)
-
-      // Different IVs mean different ciphertext
-      expect(encrypted1).not.toBe(encrypted2)
-
-      // But both decrypt to same plaintext
-      expect(decryptCredential(encrypted1)).toBe(plaintext)
-      expect(decryptCredential(encrypted2)).toBe(plaintext)
-    })
-
-    it('handles empty string', () => {
-      const plaintext = ''
-      const encrypted = encryptCredential(plaintext)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe('')
-    })
-
-    it('handles long strings', () => {
-      const plaintext = 'x'.repeat(10000)
-      const encrypted = encryptCredential(plaintext)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(plaintext)
-    })
-
-    it('handles special characters and unicode', () => {
-      const plaintext = 'Hello 世界! 🔐 Special chars: \n\t\r"\'\\`'
-      const encrypted = encryptCredential(plaintext)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(plaintext)
-    })
-
-    it('validates key is configured at module load', () => {
-      // We can't test missing key dynamically since MASTER_KEY is set at module load
-      // Instead, verify the key is set and encryption works
-      const encrypted = encryptCredential('test')
-      expect(encrypted).toBeDefined()
-    })
-  })
-
-  describe('decryptCredential', () => {
-    it('decrypts ciphertext back to original plaintext', () => {
-      const plaintext = 'my-secret-api-key'
-      const encrypted = encryptCredential(plaintext)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(plaintext)
-    })
-
-    it('successfully decrypts with configured key', () => {
-      const encrypted = encryptCredential('test')
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe('test')
-    })
-
-    it('throws error on malformed JSON', () => {
-      expect(() => decryptCredential('not-json')).toThrow()
-    })
-
-    it('throws error on missing fields', () => {
-      const invalidData = JSON.stringify({ iv: 'abc', authTag: 'def' }) // Missing 'data'
-
-      expect(() => decryptCredential(invalidData)).toThrow()
-    })
-
-    it('throws error on tampered ciphertext', () => {
-      const encrypted = encryptCredential('secret')
-      const parsed = JSON.parse(encrypted)
-
-      // Tamper with the data
-      parsed.data = 'tampered-data'
-      const tampered = JSON.stringify(parsed)
-
-      expect(() => decryptCredential(tampered)).toThrow()
-    })
-
-    it('throws error on tampered auth tag', () => {
-      const encrypted = encryptCredential('secret')
-      const parsed = JSON.parse(encrypted)
-
-      // Tamper with the auth tag
-      parsed.authTag = 'AAAAAAAAAAAAAAAAAAAAAA=='
-      const tampered = JSON.stringify(parsed)
-
-      expect(() => decryptCredential(tampered)).toThrow()
-    })
-
-    it('detects tampering via auth tag (GCM mode)', () => {
-      const encrypted = encryptCredential('secret')
-      const parsed = JSON.parse(encrypted)
-
-      // Tamper with just one byte of data
-      const dataBuffer = Buffer.from(parsed.data, 'base64')
-      dataBuffer[0] ^= 0x01 // Flip one bit
-      parsed.data = dataBuffer.toString('base64')
-
-      const tampered = JSON.stringify(parsed)
-
-      // GCM should detect the tampering and throw
-      expect(() => decryptCredential(tampered)).toThrow()
-    })
-
-    it('throws error on invalid base64 encoding', () => {
-      const invalidData = JSON.stringify({
-        iv: 'not-valid-base64!!!',
-        authTag: 'AAAA',
-        data: 'BBBB'
-      })
-
-      expect(() => decryptCredential(invalidData)).toThrow()
-    })
-  })
-
-  describe('Round-trip encryption/decryption', () => {
-    it('preserves API key format', () => {
-      const apiKey = 'sk_test_1234567890abcdefghijklmnopqrstuvwxyz'
-      const encrypted = encryptCredential(apiKey)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(apiKey)
-    })
-
-    it('preserves database connection strings', () => {
-      const connString = 'postgresql://user:password@localhost:5432/database?sslmode=require'
-      const encrypted = encryptCredential(connString)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(connString)
-    })
-
-    it('preserves JSON credentials', () => {
-      const jsonCreds = JSON.stringify({
-        type: 'service_account',
-        project_id: 'my-project',
-        private_key: '-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----\n'
-      })
-
-      const encrypted = encryptCredential(jsonCreds)
-      const decrypted = decryptCredential(encrypted)
-
-      expect(decrypted).toBe(jsonCreds)
-      expect(JSON.parse(decrypted)).toEqual(JSON.parse(jsonCreds))
-    })
-  })
-
-  describe('Security properties', () => {
-    it('uses AES-256-GCM (authenticated encryption)', () => {
-      const encrypted = encryptCredential('test')
-      const parsed = JSON.parse(encrypted)
-
-      // Auth tag should be present (GCM mode)
-      expect(parsed.authTag).toBeDefined()
-      expect(parsed.authTag.length).toBeGreaterThan(0)
-    })
-
-    it('uses random IV for each encryption', () => {
-      const ivs = new Set()
-
-      for (let i = 0; i < 100; i++) {
-        const encrypted = encryptCredential('test')
-        const parsed = JSON.parse(encrypted)
-        ivs.add(parsed.iv)
-      }
-
-      // All IVs should be unique
-      expect(ivs.size).toBe(100)
-    })
-
-    it('IV is 16 bytes (128 bits)', () => {
-      const encrypted = encryptCredential('test')
-      const parsed = JSON.parse(encrypted)
-
-      // Base64-encoded 16 bytes = 24 characters
-      const ivBuffer = Buffer.from(parsed.iv, 'base64')
-      expect(ivBuffer.length).toBe(16)
-    })
-
-    it('auth tag is 16 bytes (128 bits)', () => {
-      const encrypted = encryptCredential('test')
-      const parsed = JSON.parse(encrypted)
-
-      // Base64-encoded 16 bytes = 24 characters
-      const authTagBuffer = Buffer.from(parsed.authTag, 'base64')
-      expect(authTagBuffer.length).toBe(16)
-    })
-  })
-})
+import crypto from 'crypto'
+import { describe, it, expect, beforeAll } from 'vitest'
+import { encryptCredential, decryptCredential, setKek, CURRENT_KEY_ID } from '../server/encryption'
+
+beforeAll(() => {
+  setKek(CURRENT_KEY_ID, crypto.randomBytes(32))
+})
+
+describe('Credential Encryption', () => {
+  describe('encryptCredential', () => {
+    it('encrypts plaintext to base64-encoded JSON string', () => {
+      const plaintext = 'my-secret-api-key'
+      const encrypted = encryptCredential(plaintext)
+
+      // Should be a valid JSON string
+      expect(() => JSON.parse(encrypted)).not.toThrow()
+
+      const parsed = JSON.parse(encrypted)
+      expect(parsed).toHaveProperty('iv')
+      expect(parsed).toHaveProperty('authTag')
+      expect(parsed).toHaveProperty('data')
+    })
+
+    it('produces different ciphertext for same input (random IV)', () => {
+      const plaintext = 'same-secret'
+
+      const encrypted1 = encryptCredential(plaintext)
+      const encrypted2 = encryptCredential(plaintext)
+
+      // Different IVs mean different ciphertext
+      expect(encrypted1).not.toBe(encrypted2)
+
+      // But both decrypt to same plaintext
+      expect(decryptCredential(encrypted1)).toBe(plaintext)
+      expect(decryptCredential(encrypted2)).toBe(plaintext)
+    })
+
+    it('handles empty string', () => {
+      const plaintext = ''
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe('')
+    })
+
+    it('handles long strings', () => {
+      const plaintext = 'x'.repeat(10000)
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('handles special characters and unicode', () => {
+      const plaintext = 'Hello 世界! 🔐 Special chars: \n\t\r"\'\\`'
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('validates key is configured at module load', () => {
+      // We can't test missing key dynamically since MASTER_KEY is set at module load
+      // Instead, verify the key is set and encryption works
+      const encrypted = encryptCredential('test')
+      expect(encrypted).toBeDefined()
+    })
+  })
+
+  describe('decryptCredential', () => {
+    it('decrypts ciphertext back to original plaintext', () => {
+      const plaintext = 'my-secret-api-key'
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('successfully decrypts with configured key', () => {
+      const encrypted = encryptCredential('test')
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe('test')
+    })
+
+    it('throws error on malformed JSON', () => {
+      expect(() => decryptCredential('not-json')).toThrow()
+    })
+
+    it('throws error on missing fields', () => {
+      const invalidData = JSON.stringify({ iv: 'abc', authTag: 'def' }) // Missing 'data'
+
+      expect(() => decryptCredential(invalidData)).toThrow()
+    })
+
+    it('throws error on tampered ciphertext', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with the data
+      parsed.data = 'tampered-data'
+      const tampered = JSON.stringify(parsed)
+
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('throws error on tampered auth tag', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with the auth tag
+      parsed.authTag = 'AAAAAAAAAAAAAAAAAAAAAA=='
+      const tampered = JSON.stringify(parsed)
+
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('detects tampering via auth tag (GCM mode)', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with just one byte of data
+      const dataBuffer = Buffer.from(parsed.data, 'base64')
+      dataBuffer[0] ^= 0x01 // Flip one bit
+      parsed.data = dataBuffer.toString('base64')
+
+      const tampered = JSON.stringify(parsed)
+
+      // GCM should detect the tampering and throw
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('throws error on invalid base64 encoding', () => {
+      const invalidData = JSON.stringify({
+        iv: 'not-valid-base64!!!',
+        authTag: 'AAAA',
+        data: 'BBBB'
+      })
+
+      expect(() => decryptCredential(invalidData)).toThrow()
+    })
+  })
+
+  describe('Round-trip encryption/decryption', () => {
+    it('preserves API key format', () => {
+      const apiKey = 'sk_test_1234567890abcdefghijklmnopqrstuvwxyz'
+      const encrypted = encryptCredential(apiKey)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(apiKey)
+    })
+
+    it('preserves database connection strings', () => {
+      const connString = 'postgresql://user:password@localhost:5432/database?sslmode=require'
+      const encrypted = encryptCredential(connString)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(connString)
+    })
+
+    it('preserves JSON credentials', () => {
+      const jsonCreds = JSON.stringify({
+        type: 'service_account',
+        project_id: 'my-project',
+        private_key: '-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----\n'
+      })
+
+      const encrypted = encryptCredential(jsonCreds)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(jsonCreds)
+      expect(JSON.parse(decrypted)).toEqual(JSON.parse(jsonCreds))
+    })
+  })
+
+  describe('Security properties', () => {
+    it('uses AES-256-GCM (authenticated encryption)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Auth tag should be present (GCM mode)
+      expect(parsed.authTag).toBeDefined()
+      expect(parsed.authTag.length).toBeGreaterThan(0)
+    })
+
+    it('uses random IV for each encryption', () => {
+      const ivs = new Set()
+
+      for (let i = 0; i < 100; i++) {
+        const encrypted = encryptCredential('test')
+        const parsed = JSON.parse(encrypted)
+        ivs.add(parsed.iv)
+      }
+
+      // All IVs should be unique
+      expect(ivs.size).toBe(100)
+    })
+
+    it('IV is 16 bytes (128 bits)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Base64-encoded 16 bytes = 24 characters
+      const ivBuffer = Buffer.from(parsed.iv, 'base64')
+      expect(ivBuffer.length).toBe(16)
+    })
+
+    it('auth tag is 16 bytes (128 bits)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Base64-encoded 16 bytes = 24 characters
+      const authTagBuffer = Buffer.from(parsed.authTag, 'base64')
+      expect(authTagBuffer.length).toBe(16)
+    })
+  })
+})

package/src/auth/multi-tenancy/credentials/server/encryption.ts

@@ -5,10 +5,10 @@ const ALGORITHM = 'aes-256-gcm'
 // keyId stamped on all newly encrypted ciphertexts.
 export const CURRENT_KEY_ID = 'platform-v1'
 
-// Implicit keyId for pre-Vault ciphertext rows that were encrypted before this
-// field existed. The kek-loader registers the legacy SECRETS_ENCRYPTION_KEY env
-// value under this id during the migration window so existing rows decrypt
-// until the re-encryption script (B4) restamps them with CURRENT_KEY_ID.
+// Implicit keyId for pre-Vault ciphertext rows that lack a keyId field. All
+// known rows were restamped with CURRENT_KEY_ID during the re-encryption
+// migration; this constant remains only so any unexpected legacy blob produces
+// a clear "KEK not loaded" error rather than a silent default-key decrypt.
 export const LEGACY_KEY_ID = 'platform-v0-legacy'
 
 interface EncryptedData {
@@ -32,21 +32,7 @@ export function clearKeks(): void {
 }
 
 function resolveKek(keyId: string): Buffer | undefined {
-  const cached = kekMap.get(keyId)
-  if (cached) return cached
-
-  // Non-production fallback: bootstrap from SECRETS_ENCRYPTION_KEY so tests and
-  // local dev keep working without an explicit setKek() boot step. Production
-  // must register KEKs via the kek-loader; the env var is removed in Wave B5.
-  if (process.env.NODE_ENV !== 'production' && process.env.SECRETS_ENCRYPTION_KEY) {
-    const envKey = Buffer.from(process.env.SECRETS_ENCRYPTION_KEY, 'hex')
-    if (envKey.length === 32) {
-      kekMap.set(keyId, envKey)
-      return envKey
-    }
-  }
-
-  return undefined
+  return kekMap.get(keyId)
 }
 
 export function encryptCredential(plaintext: string): string {