@forklaunch/core 3.1.0 → 3.2.1

package/lib/persistence/index.mjs

@@ -727,6 +727,22 @@ var LegacyCiphertextError = class extends Error {
 var CompliantQueryError = class extends Error {
   name = "CompliantQueryError";
 };
+var TenantMismatchError = class extends Error {
+  constructor(path, operation, ownerTenantId, boundTenantId) {
+    super(
+      `Cannot ${operation} ${path || "a compliant field"} under tenant '${boundTenantId}': it belongs to tenant '${ownerTenantId}', the tenant it was loaded or assigned under. Read it outside any encryption context, or inside the owning tenant's.`
+    );
+    this.path = path;
+    this.operation = operation;
+    this.ownerTenantId = ownerTenantId;
+    this.boundTenantId = boundTenantId;
+  }
+  path;
+  operation;
+  ownerTenantId;
+  boundTenantId;
+  name = "TenantMismatchError";
+};
 var MINT = /* @__PURE__ */ Symbol.for("forklaunch.compliance.mint");
 var ANON_BRAND = /* @__PURE__ */ Symbol.for("forklaunch.compliance.anon");
 var Anon = class {
@@ -807,10 +823,11 @@ var CompliantField = class _CompliantField {
     Object.freeze(this);
   }
   /**
-   * @internal Wrap a plaintext value for `spec`. Applications assign plain
-   * values to the entity property instead.
+   * @internal Wrap a plaintext value for `spec`, owned by `tenant` (the one
+   * bound where it was assigned, if any). Applications assign plain values to
+   * the entity property instead.
    */
-  static fromPlain(value, spec) {
+  static fromPlain(value, spec, tenant) {
     if (spec.enumValues) {
       const values = spec.isArray && Array.isArray(value) ? value : [value];
       for (const v of values) {
@@ -823,16 +840,22 @@ var CompliantField = class _CompliantField {
     }
     return new _CompliantField({
       spec,
+      tenant,
       hasPlain: true,
       plain: value,
       anon: computeAnon(spec.anon, value)
     });
   }
-  /** @internal Wrap a stored value (any envelope, or legacy plaintext). */
-  static fromStored(stored, spec, index) {
+  /**
+   * @internal Wrap a stored value (any envelope, or legacy plaintext) loaded
+   * under `tenant`: the tenant bound during hydration, which is the loading
+   * entity manager's.
+   */
+  static fromStored(stored, spec, index, tenant) {
     if (!isEncryptedCiphertext(stored)) {
       return new _CompliantField({
         spec,
+        tenant,
         hasPlain: true,
         plain: deserializeFromEncryption(
           stored,
@@ -844,6 +867,7 @@ var CompliantField = class _CompliantField {
     }
     return new _CompliantField({
       spec,
+      tenant,
       hasPlain: false,
       sealed: stored,
       anon: sealedAnon(stored) ?? void 0,
@@ -876,11 +900,24 @@ var CompliantField = class _CompliantField {
     return readPlaintext(this, true);
   }
 };
+function tenantOf(state, operation) {
+  const bound = getBoundTenantId();
+  if (state.tenant === void 0) return requireBoundTenantId(operation);
+  if (bound !== void 0 && bound !== state.tenant) {
+    throw new TenantMismatchError(
+      state.spec.path,
+      operation,
+      state.tenant,
+      bound
+    );
+  }
+  return state.tenant;
+}
 function readPlaintext(field, report) {
   const state = stateOf(field);
   let tenantId = "";
   if (!state.hasPlain) {
-    tenantId = requireBoundTenantId("read");
+    tenantId = tenantOf(state, "read");
     if (state.sealed === void 0) {
       throw new Error(
         `${state.spec.path} was not loaded: its ciphertext column was left out of the selection`
@@ -899,6 +936,8 @@ function readPlaintext(field, report) {
       state.spec.isArray
     );
     state.hasPlain = true;
+  } else if (state.tenant !== void 0) {
+    tenantId = tenantOf(state, "read");
   }
   if (report) {
     tenantId ||= getBoundTenantId() ?? "";
@@ -926,10 +965,11 @@ function sealedValueOf(field) {
     return state.sealed;
   }
   if (!state.hasPlain) return state.sealed;
-  const tenantId = requireBoundTenantId("write");
-  if (state.sealed !== void 0 && state.sealedTenant === tenantId) {
+  if (state.sealed !== void 0 && state.sealedTenant === state.tenant) {
     return state.sealed;
   }
+  const tenantId = tenantOf(state, "write");
+  state.tenant = tenantId;
   if (state.anon === void 0) {
     state.anon = computeAnon(state.spec.anon, state.plain);
   }
@@ -948,9 +988,12 @@ function normalizedForIndex(value, spec) {
   return normalizeSerializedForIndex(serializeForEncryption(value), spec);
 }
 function blindIndexOfValue(value, spec) {
+  return blindIndexUnder(value, spec, requireBoundTenantId("query"));
+}
+function blindIndexUnder(value, spec, tenantId) {
   return requireEncryptor(spec.path).blindIndex(
     normalizedForIndex(value, spec),
-    requireBoundTenantId("query")
+    tenantId
   );
 }
 function blindIndexOf(field) {
@@ -959,7 +1002,7 @@ function blindIndexOf(field) {
   if (!state.hasPlain && state.sealed === void 0) return state.index ?? null;
   try {
     const plain = state.hasPlain ? state.plain : readPlaintext(field, false);
-    state.index = blindIndexOfValue(plain, state.spec);
+    state.index = blindIndexUnder(plain, state.spec, tenantOf(state, "index"));
   } catch {
     return state.index ?? null;
   }
@@ -972,6 +1015,7 @@ function isPendingIndex(value) {
 function pendingIndexValue(value) {
   return value[PENDING];
 }
+var COMPLIANT_RUNTIME_TYPE = "CompliantField";
 var CompliantTypeBase = class extends Type2 {
   constructor(spec) {
     super();
@@ -982,7 +1026,7 @@ var CompliantTypeBase = class extends Type2 {
     return "text";
   }
   get runtimeType() {
-    return "string";
+    return COMPLIANT_RUNTIME_TYPE;
   }
   ensureComparable() {
     return false;
@@ -993,7 +1037,7 @@ var CompliantTypeBase = class extends Type2 {
 };
 var CompliantType = class extends CompliantTypeBase {
   convertToDatabaseValue(value, _platform, context) {
-    if (context?.fromQuery) {
+    if (context?.fromQuery && context.mode !== "query-data") {
       throw new CompliantQueryError(
         `${this.spec.path} cannot be queried: declare it with .compliance('${this.spec.level}', { queryable: true }) to allow equality lookups`
       );
@@ -1001,18 +1045,30 @@ var CompliantType = class extends CompliantTypeBase {
     if (value === null || value === void 0) return null;
     if (isCompliantField(value)) return sealedValueOf(value) ?? null;
     if (isEncryptedCiphertext(value)) return value;
-    return sealedValueOf(CompliantField.fromPlain(value, this.spec)) ?? null;
+    return sealedValueOf(
+      CompliantField.fromPlain(value, this.spec, getBoundTenantId())
+    ) ?? null;
   }
   convertToJSValue(value) {
     if (value === null || value === void 0) return value;
     if (isCompliantField(value)) return value;
-    return CompliantField.fromStored(String(value), this.spec);
+    return CompliantField.fromStored(
+      String(value),
+      this.spec,
+      void 0,
+      getBoundTenantId()
+    );
   }
 };
 var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["$eq", "$ne", "$in", "$nin"]);
 var CompliantIndexType = class extends CompliantTypeBase {
   convertToDatabaseValue(value, _platform, context) {
     if (value === null || value === void 0) return null;
+    if (context?.mode === "query-data") {
+      throw new CompliantQueryError(
+        `${this.spec.path} is queryable, so a bulk update (nativeUpdate, qb.update) cannot set it: its sealed value lives in a second column the update does not write. Load the entity, assign the value and flush.`
+      );
+    }
     if (context?.fromQuery) {
       const key = context.key;
       if (key !== void 0 && !EQUALITY_OPERATORS.has(String(key)) && !/^\d+$/.test(String(key))) {
@@ -1035,6 +1091,18 @@ function isCompliantType(type) {
   return type instanceof CompliantType || type instanceof CompliantIndexType;
 }
 var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+var LOADED_TENANTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.loadedTenants")] ??= /* @__PURE__ */ new WeakMap();
+function loadedTenantOf(entity, binding) {
+  return LOADED_TENANTS.get(entity)?.[binding.property];
+}
+function recordLoadedTenant(entity, binding) {
+  let tenants = LOADED_TENANTS.get(entity);
+  if (!tenants) {
+    tenants = {};
+    LOADED_TENANTS.set(entity, tenants);
+  }
+  tenants[binding.property] = getBoundTenantId();
+}
 function slotsOf(entity) {
   let slots = SLOTS.get(entity);
   if (!slots) {
@@ -1050,12 +1118,22 @@ function readProperty(entity, binding) {
     const stored = slots[binding.sibling];
     if (isPendingIndex(value)) {
       const index = pendingIndexValue(value);
-      const field = typeof stored === "string" ? CompliantField.fromStored(stored, binding.spec, index) : CompliantField.fromIndexOnly(index, binding.spec);
+      const field = typeof stored === "string" ? CompliantField.fromStored(
+        stored,
+        binding.spec,
+        index,
+        loadedTenantOf(entity, binding)
+      ) : CompliantField.fromIndexOnly(index, binding.spec);
       slots[binding.property] = field;
       return field;
     }
     if (value == null && typeof stored === "string") {
-      const field = CompliantField.fromStored(stored, binding.spec, null);
+      const field = CompliantField.fromStored(
+        stored,
+        binding.spec,
+        null,
+        loadedTenantOf(entity, binding)
+      );
       slots[binding.property] = field;
       return field;
     }
@@ -1077,10 +1155,18 @@ function writeProperty(entity, binding, value) {
     return;
   }
   if (isCompliantField(value)) {
-    slots[binding.property] = sameRules(stateOf(value).spec, binding.spec) ? value : CompliantField.fromPlain(readPlaintext(value, false), binding.spec);
+    slots[binding.property] = sameRules(stateOf(value).spec, binding.spec) ? value : CompliantField.fromPlain(
+      readPlaintext(value, false),
+      binding.spec,
+      stateOf(value).tenant ?? getBoundTenantId()
+    );
     return;
   }
-  slots[binding.property] = CompliantField.fromPlain(value, binding.spec);
+  slots[binding.property] = CompliantField.fromPlain(
+    value,
+    binding.spec,
+    getBoundTenantId()
+  );
 }
 function installCompliantAccessors(prototype, bindings) {
   installInspect(prototype, bindings);
@@ -1107,6 +1193,7 @@ function installCompliantAccessors(prototype, bindings) {
           return sealedValueOf(field) ?? stored;
         },
         set(value) {
+          recordLoadedTenant(this, binding);
           slotsOf(this)[sibling] = value;
         }
       });
@@ -1215,7 +1302,7 @@ function wrapClassified(builder, level, complianceOptions) {
       };
       options.type = spec.queryable ? new CompliantIndexType(spec) : new CompliantType(spec);
       options.columnType = "text";
-      options.runtimeType = "string";
+      options.runtimeType = COMPLIANT_RUNTIME_TYPE;
       options.accessor = true;
     }
   }
@@ -1323,6 +1410,47 @@ import {
   p as p2,
   UnderscoreNamingStrategy
 } from "@mikro-orm/core";
+
+// src/persistence/complianceChanges.ts
+var LISTENERS2 = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.changeListeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceChange(listener) {
+  LISTENERS2.add(listener);
+  return () => LISTENERS2.delete(listener);
+}
+function emit(event) {
+  for (const listener of LISTENERS2) {
+    try {
+      listener(event);
+    } catch (error) {
+      console.error("Compliance change listener failed:", error);
+    }
+  }
+}
+function installComplianceChangeHooks(schema, entityName, levels) {
+  const sensitive = new Set(
+    [...levels].filter(([, level]) => level !== "none").map(([name]) => name)
+  );
+  if (!sensitive.size) return;
+  const report = (action) => (args) => {
+    if (!LISTENERS2.size) return;
+    const entity = args.entity;
+    const keys = args.meta?.primaryKeys ?? ["id"];
+    const fields = action === "update" ? Object.keys(args.changeSet?.payload ?? {}) : action === "create" ? [...levels.keys()].filter((name) => entity[name] !== void 0) : [];
+    emit({
+      entity: entityName,
+      id: keys.map((key) => String(entity[key] ?? "")).join(":"),
+      action,
+      fields,
+      sensitiveFields: action === "delete" ? [...sensitive] : fields.filter((name) => sensitive.has(name)),
+      tenantId: getBoundTenantId() ?? null
+    });
+  };
+  schema.addHook("afterCreate", report("create"));
+  schema.addHook("afterUpdate", report("update"));
+  schema.addHook("afterDelete", report("delete"));
+}
+
+// src/persistence/defineComplianceEntity.ts
 var naming = new UnderscoreNamingStrategy();
 function wireCompliantProperties(entityName, properties) {
   const wired = {};
@@ -1402,6 +1530,11 @@ function defineComplianceEntity(meta) {
     ...meta,
     properties: wired.properties
   });
+  installComplianceChangeHooks(
+    schema,
+    entityName,
+    complianceFields
+  );
   if (wired.bindings.length > 0) {
     const entityClass = schema.meta.class;
     if (entityClass)
@@ -1983,6 +2116,7 @@ export {
   RetentionDuration,
   RlsEventSubscriber,
   TENANT_FILTER_NAME,
+  TenantMismatchError,
   UnboundTenantError,
   asEncryptionSafe,
   assertBindableTenantId,
@@ -2011,6 +2145,7 @@ export {
   isEncryptedCiphertext,
   isEncryptedValue,
   onComplianceAccess,
+  onComplianceChange,
   parseDuration,
   parseEncryptionKeyList,
   reencryptEncryptedColumns,