@memberjunction/core 6.2.0-edge.6 → 6.2.0-edge.7

package/dist/generic/localCacheManager.js

@@ -1,4 +1,4 @@
-import { BaseSingleton, MJGlobal, MJEventType } from "@memberjunction/global";
+import { BaseSingleton, MJGlobal, MJEventType, IsValueEncrypted, ENCRYPTED_SENTINEL } from "@memberjunction/global";
 import { IsMaterializedDataSource, NormalizeAlternateBaseViewName } from "../views/runView.js";
 import { GetEffectiveAlternateBaseViewName } from "./alternateBaseViews.js";
 import { ViewPropertyValuesKey } from "../views/viewProperties.js";
@@ -467,6 +467,17 @@ export class LocalCacheManager extends BaseSingleton {
             || this.hasNarrowingSegment(parts)
             || this.hasAggregates(parts);
     }
+    /**
+     * Returns true when a cached `RunView` slot identified by `fingerprint` is eligible for
+     * in-place maintenance across entity saves (unfiltered, unordered, uncapped, no aggregates
+     * or narrowing segments).
+     */
+    IsRunViewFingerprintMaintainableOnSave(fingerprint) {
+        if (!fingerprint || !fingerprint.includes('|')) {
+            return false;
+        }
+        return !this.isSubsetFingerprint(fingerprint) && !this.isFilteredFingerprint(fingerprint);
+    }
     /**
      * Returns true if the slot was cached under an ORDER BY (fingerprint segment [2]).
      *
@@ -870,7 +881,7 @@ export class LocalCacheManager extends BaseSingleton {
      * @param fingerprint - The slot key
      * @param expiresAt - Absolute expiry (ms since epoch), when the slot has one
      */
-    runViewWriteOptions(fingerprint, expiresAt) {
+    runViewWriteOptions(fingerprint, expiresAt, pubSubOverride) {
         const options = {};
         const entity = this.extractEntityFromFingerprint(fingerprint);
         if (entity) {
@@ -879,6 +890,10 @@ export class LocalCacheManager extends BaseSingleton {
         if (expiresAt) {
             options.TTLSeconds = Math.max(1, Math.ceil((expiresAt - Date.now()) / 1000));
         }
+        if (pubSubOverride) {
+            options.pubSubAction = pubSubOverride.pubSubAction;
+            options.pubSubData = pubSubOverride.pubSubData;
+        }
         return options;
     }
     /** Storage write options for any registry entry; only RunView slots are indexed. */
@@ -1457,7 +1472,8 @@ export class LocalCacheManager extends BaseSingleton {
                 if (key.KeyValuePairs.some(kv => kv.Value == null))
                     return;
                 LogStatusVerbose(`LocalCacheManager: remote-invalidate (save) for "${entityName}" PK=${key.ToConcatenatedString()}, updating ${fingerprints.size} cached fingerprint(s)`);
-                const rowComplete = LocalCacheManager.RowHasEveryField(entityInfo, recordData); // per row, not per slot
+                const rowComplete = LocalCacheManager.RowHasEveryField(entityInfo, recordData)
+                    && !LocalCacheManager.RowContainsPlaintextEncryptedField(entityInfo, recordData); // per row, not per slot
                 for (const fingerprint of fingerprintSnapshot) {
                     try {
                         // Subset slot (MaxRows/StartRow): upserting would grow the slot past the
@@ -1581,9 +1597,12 @@ export class LocalCacheManager extends BaseSingleton {
         }
         else if (!this.isFilteredFingerprint(fingerprint)) {
             // Unfiltered cache: update the record in place, unless the saved row is missing columns
+            // or carries decrypted plaintext on an Encrypt=true field (BaseEntity.GetAll() holds
+            // in-memory plaintext after Save(), which must never be persisted to shared cache/Redis).
             const entityData = baseEntity.GetAll();
-            if (!LocalCacheManager.RowHasEveryField(baseEntity.EntityInfo, entityData)) {
-                LogStatusVerbose(`LocalCacheManager: Invalidating "${fingerprint.substring(0, 60)}" — the saved row is missing columns`);
+            if (!LocalCacheManager.RowHasEveryField(baseEntity.EntityInfo, entityData) ||
+                LocalCacheManager.RowContainsPlaintextEncryptedField(baseEntity.EntityInfo, entityData)) {
+                LogStatusVerbose(`LocalCacheManager: Invalidating "${fingerprint.substring(0, 60)}" — the saved row is missing columns or holds decrypted plaintext`);
                 await this.InvalidateRunViewResult(fingerprint);
                 return;
             }
@@ -1631,14 +1650,48 @@ export class LocalCacheManager extends BaseSingleton {
         }
         return true;
     }
-    /** Whether every saved row among `changes` carries every column ({@link RowHasEveryField}). */
+    /**
+     * Returns `true` when `entity` declares one or more encrypted fields (`Encrypt && EncryptionKeyID`)
+     * and `row` contains a non-empty string value for any such field that is neither ciphertext
+     * (`$ENC$...`) nor `ENCRYPTED_SENTINEL`.
+     *
+     * Used as a defense-in-depth gate so decrypted in-memory entity values (e.g. from
+     * `BaseEntity.GetAll()` during `save` events) are never written in plaintext to local or
+     * distributed Redis caches.
+     */
+    static RowContainsPlaintextEncryptedField(entity, row) {
+        if (!entity || !row || typeof row !== 'object') {
+            return false;
+        }
+        const encryptedFields = Array.isArray(entity.EncryptedFields)
+            ? entity.EncryptedFields
+            : Array.isArray(entity.Fields)
+                ? entity.Fields.filter(f => f.Encrypt && Boolean(f.EncryptionKeyID))
+                : [];
+        if (encryptedFields.length === 0) {
+            return false;
+        }
+        const rowMap = row;
+        for (const field of encryptedFields) {
+            if (!field.EncryptionKeyID)
+                continue;
+            const val = rowMap[field.Name];
+            if (typeof val === 'string' && val.length > 0 && val !== ENCRYPTED_SENTINEL && !IsValueEncrypted(val)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Whether every saved row among `changes` carries every column ({@link RowHasEveryField}) and no plaintext encrypted values. */
     static everySavedRowComplete(changes) {
-        return changes.every(c => c.Type !== 'save' || LocalCacheManager.RowHasEveryField(c.EntityInfo, c.Record));
+        return changes.every(c => c.Type !== 'save' ||
+            (LocalCacheManager.RowHasEveryField(c.EntityInfo, c.Record) &&
+                !LocalCacheManager.RowContainsPlaintextEncryptedField(c.EntityInfo, c.Record)));
     }
     /**
      * True when a saved row may be written into `fingerprint`'s slot in place: the slot is neither
      * filtered (including row-security and field-security segments) nor a subset, and the row
-     * carries every column ({@link RowHasEveryField}). Otherwise the slot must be invalidated.
+     * carries every column ({@link RowHasEveryField}) with no plaintext secrets. Otherwise the slot must be invalidated.
      *
      * @param fingerprint - The slot to maintain
      * @param entity - The saved record's entity
@@ -1647,7 +1700,8 @@ export class LocalCacheManager extends BaseSingleton {
     CanUpsertRowIntoSlot(fingerprint, entity, row) {
         return !this.isFilteredFingerprint(fingerprint)
             && !this.isSubsetFingerprint(fingerprint)
-            && LocalCacheManager.RowHasEveryField(entity, row);
+            && LocalCacheManager.RowHasEveryField(entity, row)
+            && !LocalCacheManager.RowContainsPlaintextEncryptedField(entity, row);
     }
     /**
      * Handles a save/delete that could not be applied to a slot this process indexed — in practice
@@ -1746,7 +1800,25 @@ export class LocalCacheManager extends BaseSingleton {
             }
         }
         else {
-            // For set/removed, dispatch only to callbacks for the specific fingerprint
+            this._lastVerifiedAt.delete(event.CacheKey);
+            if (event.Action === 'row_delta' && event.Data) {
+                const existingEntry = this._registry.get(event.CacheKey);
+                if (existingEntry) {
+                    try {
+                        const parsedDelta = JSON.parse(event.Data);
+                        if (typeof parsedDelta.rowCount === 'number') {
+                            existingEntry.rowCount = parsedDelta.rowCount;
+                        }
+                        if (typeof parsedDelta.maxUpdatedAt === 'string') {
+                            existingEntry.maxUpdatedAt = parsedDelta.maxUpdatedAt;
+                        }
+                    }
+                    catch {
+                        // Best-effort local registry metadata update; callbacks handle invalid payloads safely.
+                    }
+                }
+            }
+            // For set/row_delta/removed, dispatch only to callbacks for the specific fingerprint
             const callbacks = this._changeCallbacks.get(event.CacheKey);
             if (callbacks) {
                 for (const cb of callbacks) {
@@ -2408,6 +2480,17 @@ export class LocalCacheManager extends BaseSingleton {
                     LogStatusEx({ message: `[CACHE-WRITE-GATE] Skipping cache write for external entity "${params.EntityName}" — no TTL provided (would never invalidate)`, verboseOnly: true });
                     return;
                 }
+                // Defense-in-depth on server caches (TrustLocalCacheCompletely === true):
+                // never persist decrypted plaintext values for Encrypt=true columns into shared/Redis cache.
+                const cacheProvider = provider;
+                if (entity &&
+                    cacheProvider?.TrustLocalCacheCompletely === true &&
+                    !options?.ProviderInternalScaffolding &&
+                    Array.isArray(results) &&
+                    results.some(r => typeof r === 'object' && r !== null && LocalCacheManager.RowContainsPlaintextEncryptedField(entity, r))) {
+                    LogStatusEx({ message: `[CACHE-WRITE-GATE] Skipping server cache write for "${params.EntityName}" — rows contain decrypted plaintext for an encrypted field`, verboseOnly: true });
+                    return;
+                }
             }
             catch (err) {
                 // fall through and write — fail-open is safer than fail-closed here
@@ -2948,11 +3031,23 @@ export class LocalCacheManager extends BaseSingleton {
                 }
                 const pkFieldNames = changes[0].Key.KeyValuePairs.map(kv => kv.FieldName);
                 const resultMap = this.indexRowsByKey(cached.results, pkFieldNames);
-                if (!this.applyChangesToRowMap(resultMap, changes)) {
+                const deltaChanges = this.applyChangesToRowMap(resultMap, changes);
+                if (!deltaChanges.changed) {
                     return true; // only removals of rows the slot does not hold
                 }
-                return await this.storeCachedResults(fingerprint, Array.from(resultMap.values()), newMaxUpdatedAt, { totalRowCount: cached.totalRowCount, rowCount: cached.results.length, schemaHash: cached.schemaHash,
-                    schemaStamp: cached.schemaStamp, providerInternalScaffolding: cached.providerInternalScaffolding });
+                return await this.storeCachedResults(fingerprint, Array.from(resultMap.values()), newMaxUpdatedAt, {
+                    totalRowCount: cached.totalRowCount,
+                    rowCount: cached.results.length,
+                    schemaHash: cached.schemaHash,
+                    schemaStamp: cached.schemaStamp,
+                    providerInternalScaffolding: cached.providerInternalScaffolding,
+                }, cached.providerInternalScaffolding
+                    ? undefined
+                    : {
+                        upsertedRows: deltaChanges.upsertedRows,
+                        deletedPrimaryKeys: deltaChanges.deletedPrimaryKeys,
+                        primaryKeyFields: pkFieldNames,
+                    });
             }
             catch (e) {
                 LogError(`LocalCacheManager.ApplyRowChanges failed: ${e}`);
@@ -2975,20 +3070,38 @@ export class LocalCacheManager extends BaseSingleton {
         }
         return resultMap;
     }
-    /** Applies `changes` to `rows` in order. @returns True when anything changed. */
+    /** Applies `changes` to `rows` in order and collects the collapsed net row delta for pub/sub. */
     applyChangesToRowMap(rows, changes) {
         let changed = false;
+        const upsertsByKey = new Map();
+        const deletesByKey = new Map();
         for (const change of changes) {
             const keyStr = this.cheapKeyFromCompositeKey(change.Key);
             if (change.Row) {
                 rows.set(keyStr, change.Row);
+                deletesByKey.delete(keyStr);
+                upsertsByKey.set(keyStr, change.Row);
                 changed = true;
             }
             else if (rows.delete(keyStr)) {
+                upsertsByKey.delete(keyStr);
+                const pkRecord = {};
+                for (const kv of change.Key.KeyValuePairs) {
+                    const v = kv.Value;
+                    pkRecord[kv.FieldName] =
+                        typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' || v === null
+                            ? v
+                            : String(v);
+                }
+                deletesByKey.set(keyStr, pkRecord);
                 changed = true;
             }
         }
-        return changed;
+        return {
+            changed,
+            upsertedRows: Array.from(upsertsByKey.values()),
+            deletedPrimaryKeys: Array.from(deletesByKey.values()),
+        };
     }
     /**
      * Stores updated results array back to the cache and updates the registry.
@@ -3004,7 +3117,7 @@ export class LocalCacheManager extends BaseSingleton {
      * full-dataset slot is unchanged (prior total == prior length) while a subset slot keeps a
      * correct total.
      */
-    async storeCachedResults(fingerprint, updatedResults, newMaxUpdatedAt, prior) {
+    async storeCachedResults(fingerprint, updatedResults, newMaxUpdatedAt, prior, rowDelta) {
         // Stamp the slot the way the fill path does — the newest row's __mj_UpdatedAt — so the
         // stamp means the same thing whichever funnel wrote the slot and matches what the database
         // reports for the same rows (the client smart-cache check compares the two). The caller's
@@ -3058,7 +3171,23 @@ export class LocalCacheManager extends BaseSingleton {
         if (!prior?.providerInternalScaffolding) {
             this.freezeRowDataIfProviderSharesReferences(data);
         }
-        await this._storageProvider.SetItem(fingerprint, data, CacheCategory.RunViewCache, this.runViewWriteOptions(fingerprint, existingEntry?.expiresAt));
+        let pubSubOverride;
+        if (rowDelta) {
+            const deltaPayload = {
+                upsertedRows: rowDelta.upsertedRows,
+                deletedPrimaryKeys: rowDelta.deletedPrimaryKeys,
+                primaryKeyFields: rowDelta.primaryKeyFields,
+                maxUpdatedAt,
+                rowCount: updatedResults.length,
+                totalRowCount: data.totalRowCount ?? updatedResults.length,
+                schemaHash: data.schemaHash,
+            };
+            pubSubOverride = {
+                pubSubAction: 'row_delta',
+                pubSubData: JSON.stringify(deltaPayload),
+            };
+        }
+        await this._storageProvider.SetItem(fingerprint, data, CacheCategory.RunViewCache, this.runViewWriteOptions(fingerprint, existingEntry?.expiresAt, pubSubOverride));
         this._lastVerifiedAt.set(fingerprint, now);
         if (existingEntry) {
             existingEntry.maxUpdatedAt = maxUpdatedAt;