@forklaunch/core 1.6.7 → 2.1.0

package/lib/persistence/tenantEm.d.ts

@@ -48,26 +48,29 @@ import type { EntityManager } from '@mikro-orm/core';
  * }
  * ```
  *
- * # The empty tenant is a tenant
+ * # The empty tenant is not a tenant
  *
- * Global rows (a billing plan, a trial, a template) are encrypted under the
- * empty tenant `''`. A caller that passes `''` means "bind the no-tenant
- * key", and gets a Proxy that runs every EM call inside
- * `withEncryptionContext('', …)`. Only `undefined` means "do not wrap": the
- * EM is returned as is and inherits whatever context is already bound,
- * which is right for a super-admin lookup that has not resolved a tenant
- * yet, and wrong for anything that writes.
+ * `''` is rejected: it throws `EmptyTenantError`. It used to mean "bind the
+ * no-tenant key", which is how global rows (a billing plan, a trial, a
+ * template) were encrypted — and it made a deliberate global row and a tenant
+ * nobody resolved the same key. A path that forgot to bind wrote perfectly
+ * readable rows under `''`, and the mistake surfaced later, somewhere else, as
+ * the owning tenant's "Failed to decrypt encrypted column value".
  *
- * Earlier versions treated `''` like `undefined` and also seeded the ALS
- * with `enterWith`, which mutates the *calling* async resource. Together
- * those meant: after one org-scoped EM was created on a request, a later
- * "no-tenant" EM on the same resource silently read and wrote under that
- * org's key. Global rows then came out unreadable ("Failed to decrypt
- * encrypted column value") depending on what had run before on the worker.
+ * Global rows need an id you can name and search for. Pick a constant no
+ * organization can collide with — the platform uses `'_internal'` — and bind
+ * it like any other tenant.
+ *
+ * `undefined` still means "do not wrap": the EM is returned as is and inherits
+ * whatever context is already bound. That is right only for a lookup that has
+ * not resolved a tenant yet and reads no encrypted column; anything that
+ * touches one now fails with `UnboundTenantError` rather than quietly using
+ * the empty key.
  *
  * @param em        a freshly forked `EntityManager` from `orm.em.fork(...)`
- * @param tenantId  the org/tenant id to bind; `''` binds the no-tenant key;
+ * @param tenantId  the org/tenant id to bind; `''` throws;
  *                  `undefined` skips wrapping entirely
+ * @throws EmptyTenantError when `tenantId` is `''`
  */
 export declare function wrapEmWithTenantContext(em: EntityManager, tenantId: string | undefined): EntityManager;
 //# sourceMappingURL=tenantEm.d.ts.map

package/lib/persistence/tenantEm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenantEm.d.ts","sourceRoot":"","sources":["../../src/persistence/tenantEm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,aAAa,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,aAAa,CA8Bf"}
+{"version":3,"file":"tenantEm.d.ts","sourceRoot":"","sources":["../../src/persistence/tenantEm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,aAAa,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,aAAa,CA4Bf"}

package/lib/services/complianceDataService.d.ts

@@ -12,13 +12,45 @@ export interface ComplianceOrm {
     getMetadata(): MetadataStorage;
 }
 import { MetricsDefinition } from '../http/types/openTelemetryCollector.types';
+/**
+ * Which tenants a subject's rows live under.
+ *
+ * A compliance walk cannot be tenant-blind. Every PII column is encrypted
+ * under its row's tenant, and a WHERE value on one is encrypted under the
+ * CURRENT tenant before it is compared — so an unbound walk searches with a
+ * key nothing was written with. It matches nothing, everywhere, and an erase
+ * that finds nothing looks exactly like an erase with nothing to do.
+ *
+ * Pass every tenant the subject may have rows under — their organizations,
+ * plus whatever constant holds rows belonging to no organization. The walk
+ * runs once per tenant and the results are merged.
+ */
+export interface ComplianceTenantScope {
+    tenantIds?: readonly string[];
+}
+/** An entity the walk could not read, and why. */
+export interface ComplianceEntityFailure {
+    entityName: string;
+    tenantId?: string;
+    reason: string;
+}
 export interface EraseResult {
     entitiesAffected: string[];
     recordsDeleted: number;
+    /**
+     * Entities the walk could not read. NON-EMPTY MEANS THE ERASE IS
+     * INCOMPLETE: the caller asked for a subject's data to be deleted and some
+     * of it may remain. It is reported rather than thrown so the rows that
+     * could be erased still are, but it must not be ignored — treat a non-empty
+     * list as a failed erasure request.
+     */
+    failures: ComplianceEntityFailure[];
 }
 export interface ExportResult {
     userId: string;
     entities: Record<string, unknown[]>;
+    /** As `EraseResult.failures`: non-empty means the export is incomplete. */
+    failures: ComplianceEntityFailure[];
 }
 /**
  * Per-entity userIdField overrides.
@@ -52,7 +84,15 @@ export declare class ComplianceDataService {
      * Returns undefined if no link can be determined.
      */
     private resolveUserIdField;
-    erase(userId: string): Promise<EraseResult>;
-    export(userId: string): Promise<ExportResult>;
+    /**
+     * Run `fn` once per tenant in scope, each inside its own encryption
+     * context. With no tenants named it runs once unbound — which is correct
+     * only for entities with no encrypted column, and fails loudly otherwise.
+     */
+    private perTenant;
+    erase(userId: string, scope?: ComplianceTenantScope): Promise<EraseResult>;
+    private eraseUnderCurrentTenant;
+    export(userId: string, scope?: ComplianceTenantScope): Promise<ExportResult>;
+    private exportUnderCurrentTenant;
 }
 //# sourceMappingURL=complianceDataService.d.ts.map

package/lib/services/complianceDataService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complianceDataService.d.ts","sourceRoot":"","sources":["../../src/services/complianceDataService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,IAAI,eAAe,CAAC;CAChC;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAM/E,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAiB1D;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAI9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAE5D,YACmB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAChE,oBAAoB,CAAC,EAAE,oBAAoB,EAG5C;IAED;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwBpB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA6DhD;IAEK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA8DlD;CACF"}
+{"version":3,"file":"complianceDataService.d.ts","sourceRoot":"","sources":["../../src/services/complianceDataService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,IAAI,eAAe,CAAC;CAChC;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAO/E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpC,2EAA2E;IAC3E,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAiB1D;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAI9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAE5D,YACmB,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,EAChE,oBAAoB,CAAC,EAAE,oBAAoB,EAG5C;IAED;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;;OAIG;YACW,SAAS;IAajB,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,WAAW,CAAC,CA0BtB;YAEa,uBAAuB;IAkE/B,MAAM,CACV,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,qBAAqB,GAC5B,OAAO,CAAC,YAAY,CAAC,CAevB;YAEa,wBAAwB;CAoEvC"}

package/lib/services/index.js

@@ -489,6 +489,28 @@ var ValidConfigInjector = class extends ConfigInjector {
   validConfigInjector;
 };
 
+// src/persistence/encryptedType.ts
+var import_core = require("@mikro-orm/core");
+var import_node_async_hooks = require("async_hooks");
+var _tenantContext = new import_node_async_hooks.AsyncLocalStorage();
+var EmptyTenantError = class extends Error {
+  constructor(api) {
+    super(
+      `${api}: '' is not a tenant id. It used to mean "global", which made a deliberate global row indistinguishable from a tenant nobody resolved. Bind an explicit constant (for example '_internal') for rows that genuinely belong to no organization.`
+    );
+    this.name = "EmptyTenantError";
+  }
+};
+function assertBindableTenantId(tenantId, api) {
+  if (tenantId === "") {
+    throw new EmptyTenantError(api);
+  }
+}
+function withEncryptionContext(tenantId, fn) {
+  assertBindableTenantId(tenantId, "withEncryptionContext");
+  return _tenantContext.run({ tenantId }, fn);
+}
+
 // src/persistence/complianceTypes.ts
 var complianceRegistry = /* @__PURE__ */ new Map();
 function getEntityComplianceFields(entityName) {
@@ -540,6 +562,47 @@ var RetentionService = class {
   otel;
   DEFAULT_BATCH_SIZE = 1e3;
   async enforce(options) {
+    const tenantIds = options?.tenantIds ?? [];
+    if (tenantIds.length > 1) {
+      const merged = {
+        processed: 0,
+        deleted: 0,
+        anonymized: 0,
+        errors: 0,
+        byEntity: {},
+        durationMs: 0
+      };
+      const start2 = Date.now();
+      for (const tenantId of tenantIds) {
+        const one = await withEncryptionContext(
+          tenantId,
+          () => this.enforce({ ...options, tenantIds: [tenantId] })
+        );
+        merged.processed += one.processed;
+        merged.deleted += one.deleted;
+        merged.anonymized += one.anonymized;
+        merged.errors += one.errors;
+        for (const [entityName, counts] of Object.entries(one.byEntity)) {
+          const into = merged.byEntity[entityName] ??= {
+            deleted: 0,
+            anonymized: 0,
+            errors: 0
+          };
+          into.deleted += counts.deleted;
+          into.anonymized += counts.anonymized;
+          into.errors += counts.errors;
+        }
+      }
+      merged.durationMs = Date.now() - start2;
+      return merged;
+    }
+    if (tenantIds.length === 1) {
+      const only = tenantIds[0];
+      return withEncryptionContext(
+        only,
+        () => this.enforce({ ...options, tenantIds: void 0 })
+      );
+    }
     const start = Date.now();
     const batchSize = options?.batchSize ?? this.DEFAULT_BATCH_SIZE;
     const dryRun = options?.dryRun ?? false;
@@ -734,9 +797,46 @@ var ComplianceDataService = class {
     }
     return void 0;
   }
-  async erase(userId) {
+  /**
+   * Run `fn` once per tenant in scope, each inside its own encryption
+   * context. With no tenants named it runs once unbound — which is correct
+   * only for entities with no encrypted column, and fails loudly otherwise.
+   */
+  async perTenant(scope, fn) {
+    const tenantIds = scope?.tenantIds ?? [];
+    if (tenantIds.length === 0) return [await fn(void 0)];
+    const results = [];
+    for (const tenantId of tenantIds) {
+      results.push(await withEncryptionContext(tenantId, () => fn(tenantId)));
+    }
+    return results;
+  }
+  async erase(userId, scope) {
+    const entitiesAffected = /* @__PURE__ */ new Set();
+    const failures = [];
+    let recordsDeleted = 0;
+    await this.perTenant(scope, async (tenantId) => {
+      recordsDeleted += await this.eraseUnderCurrentTenant(
+        userId,
+        tenantId,
+        entitiesAffected,
+        failures
+      );
+    });
+    this.otel.info("[ComplianceDataService] Erase complete", {
+      userId,
+      entitiesAffected: [...entitiesAffected].join(","),
+      recordsDeleted,
+      failures: failures.length
+    });
+    return {
+      entitiesAffected: [...entitiesAffected],
+      recordsDeleted,
+      failures
+    };
+  }
+  async eraseUnderCurrentTenant(userId, tenantId, entitiesAffected, failures) {
     const em = this.orm.em.fork();
-    const entitiesAffected = [];
     let recordsDeleted = 0;
     const allMetadata = [...this.orm.getMetadata().getAll().values()];
     for (const metadata of allMetadata) {
@@ -764,14 +864,16 @@ var ComplianceDataService = class {
           [userIdField]: userId
         });
         if (records.length > 0) {
-          entitiesAffected.push(entityName);
+          entitiesAffected.add(entityName);
           recordsDeleted += records.length;
           records.forEach((r) => em.remove(r));
         }
       } catch (err) {
+        failures.push({ entityName, tenantId, reason: String(err) });
         this.otel.error("[ComplianceDataService] Failed to erase entity", {
           entityName,
           userIdField,
+          tenantId,
           error: String(err)
         });
       }
@@ -779,16 +881,24 @@ var ComplianceDataService = class {
     if (recordsDeleted > 0) {
       await em.flush();
     }
-    this.otel.info("[ComplianceDataService] Erase complete", {
+    return recordsDeleted;
+  }
+  async export(userId, scope) {
+    const entities = {};
+    const failures = [];
+    await this.perTenant(
+      scope,
+      (tenantId) => this.exportUnderCurrentTenant(userId, tenantId, entities, failures)
+    );
+    this.otel.info("[ComplianceDataService] Export complete", {
       userId,
-      entitiesAffected: entitiesAffected.join(","),
-      recordsDeleted
+      entityCount: Object.keys(entities).length,
+      failures: failures.length
     });
-    return { entitiesAffected, recordsDeleted };
+    return { userId, entities, failures };
   }
-  async export(userId) {
+  async exportUnderCurrentTenant(userId, tenantId, entities, failures) {
     const em = this.orm.em.fork();
-    const entities = {};
     const allMetadata = [...this.orm.getMetadata().getAll().values()];
     for (const metadata of allMetadata) {
       const entityName = metadata.className;
@@ -812,7 +922,7 @@ var ComplianceDataService = class {
         });
         if (records.length > 0) {
           const piiFieldNames = [...fields.entries()].filter(([, level]) => level !== "none").map(([name]) => name);
-          entities[entityName] = records.map((record) => {
+          const rows = records.map((record) => {
             const filtered = {};
             filtered["id"] = record["id"];
             for (const fieldName of piiFieldNames) {
@@ -820,20 +930,18 @@ var ComplianceDataService = class {
             }
             return filtered;
           });
+          entities[entityName] = [...entities[entityName] ?? [], ...rows];
         }
       } catch (err) {
+        failures.push({ entityName, tenantId, reason: String(err) });
         this.otel.error("[ComplianceDataService] Failed to export entity", {
           entityName,
           userIdField,
+          tenantId,
           error: String(err)
         });
       }
     }
-    this.otel.info("[ComplianceDataService] Export complete", {
-      userId,
-      entityCount: Object.keys(entities).length
-    });
-    return { userId, entities };
   }
 };