@objectstack/plugin-approvals 17.1.0 → 17.2.0

package/dist/index.mjs

@@ -2220,6 +2220,38 @@ async function filterApproversWhoCanRead(deps, userIds, requestOrgId, context) {
   return userIds.filter((u) => canRead.has(u));
 }
 
+// src/payload-redaction.ts
+function redactSnapshot(payload, readable) {
+  if (readable === void 0) return { payload, redactedKeys: [] };
+  if (payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+    return { payload, redactedKeys: [] };
+  }
+  const allowed = new Set(readable.map((f) => String(f)));
+  const source = payload;
+  const redactedKeys = [];
+  const kept = {};
+  for (const key of Object.keys(source)) {
+    if (allowed.has(key)) kept[key] = source[key];
+    else redactedKeys.push(key);
+  }
+  if (redactedKeys.length === 0) return { payload, redactedKeys: [] };
+  return { payload: kept, redactedKeys: redactedKeys.sort() };
+}
+async function resolveReadableSnapshotFields(security, objectName, context, logger) {
+  if (!security || typeof security.getReadableFields !== "function") return void 0;
+  const object = String(objectName ?? "").trim();
+  if (!object) return void 0;
+  try {
+    return await security.getReadableFields(object, context);
+  } catch (err) {
+    logger?.warn?.("[approvals] payload redaction could not resolve readable fields \u2014 serving the snapshot unredacted", {
+      object,
+      error: err?.message ?? String(err)
+    });
+    return void 0;
+  }
+}
+
 // src/approval-service.ts
 var REMIND_COOLDOWN_MS = 4 * 60 * 60 * 1e3;
 var ESCALATION_JOB_NAME = "approvals-sla-escalation";
@@ -2240,6 +2272,7 @@ function actingUserId(context) {
   return typeof userId === "string" && userId ? userId : null;
 }
 var OOO_MAX_CHAIN = 8;
+var MEMBER_SCREEN_READ_LIMIT = 5e4;
 var GRAPH_APPROVER_TYPES = /* @__PURE__ */ new Set([
   "team",
   "department",
@@ -2392,6 +2425,7 @@ var _ApprovalService = class _ApprovalService {
     this.messaging = opts.messaging;
     this.publicBaseUrl = (opts.publicBaseUrl ?? "").replace(/\/$/, "");
     this.tenancyPosture = opts.tenancyPosture;
+    this.fieldVisibility = opts.fieldVisibility;
     this.recordReaderVisibleObjects = new Set(
       (Array.isArray(opts.recordReaderVisibleObjects) ? opts.recordReaderVisibleObjects : []).map((n) => String(n ?? "").trim()).filter(Boolean)
     );
@@ -2400,6 +2434,57 @@ var _ApprovalService = class _ApprovalService {
   attachTenancyPosture(provider) {
     this.tenancyPosture = provider;
   }
+  /**
+   * [#10749] Attach (or replace) the field-visibility authority the payload
+   * redaction seam reads. Late-bound: plugin load order does not guarantee the
+   * security service exists when this one is constructed.
+   */
+  attachFieldVisibility(source) {
+    this.fieldVisibility = source;
+  }
+  /**
+   * [#10749] Redact each row's payload snapshot down to the fields the READING
+   * caller may see on that row's subject object.
+   *
+   * Runs BEFORE {@link ApprovalService.enrichRows}, and that ordering is
+   * load-bearing rather than incidental: `enrichRows` derives `payload_display`
+   * (lookup foreign keys inside the snapshot resolved to referenced record
+   * titles) and `payload_labels` (a label per snapshot key) by WALKING THE
+   * SNAPSHOT'S OWN KEYS. Redact first and both derived maps are clean for free;
+   * redact after and a restricted field's name, its authored label and the
+   * title of the record it points at all still ship — the value would be gone
+   * and the disclosure would not.
+   *
+   * Rows are grouped by subject object so one `getReadableFields` call covers a
+   * whole page of same-object requests.
+   */
+  async redactPayloads(rows, context) {
+    const withPayload = rows.filter((r) => r?.payload != null);
+    if (withPayload.length === 0) return;
+    const byObject = /* @__PURE__ */ new Map();
+    for (const r of withPayload) {
+      const key = String(r.object_name ?? "");
+      let list = byObject.get(key);
+      if (!list) {
+        list = [];
+        byObject.set(key, list);
+      }
+      list.push(r);
+    }
+    for (const [object, group] of byObject) {
+      const readable = await resolveReadableSnapshotFields(
+        this.fieldVisibility,
+        object,
+        context,
+        this.logger
+      );
+      if (readable === void 0) continue;
+      for (const r of group) {
+        const { payload } = redactSnapshot(r.payload, readable);
+        r.payload = payload;
+      }
+    }
+  }
   /** Deps bundle for the ADR-0105 D9 org-scope helpers. */
   get orgScopeDeps() {
     return {
@@ -2666,7 +2751,7 @@ var _ApprovalService = class _ApprovalService {
     }) : users;
     try {
       if (type === "team") {
-        const users = await this.expandTeamUsers(String(a.value));
+        const users = await this.expandTeamUsers(String(a.value), organizationId);
         if (users.length) return users;
       } else if (type === "department" || type === "business_unit" || type === "bu") {
         const users = await bounded(await this.expandBusinessUnitUsers(String(a.value), directoryOrg));
@@ -2680,7 +2765,7 @@ var _ApprovalService = class _ApprovalService {
       } else if (type === "manager" && record) {
         const subject = record[a.value] ?? record.owner_id;
         if (subject) {
-          const mgr = await this.lookupManager(String(subject));
+          const mgr = await this.lookupManager(String(subject), organizationId);
           if (mgr) return this.applyOooDelegation(mgr, now, organizationId, substitutions);
         }
       }
@@ -2777,7 +2862,7 @@ var _ApprovalService = class _ApprovalService {
       try {
         if (resolveAs === "department") users = await this.expandBusinessUnitUsers(key, directoryOrg);
         else if (resolveAs === "position") users = await this.expandPositionUsers(key, directoryOrg);
-        else if (resolveAs === "team") users = await this.expandTeamUsers(key);
+        else if (resolveAs === "team") users = await this.expandTeamUsers(key, directoryOrg);
         else {
           throw new Error(
             `VALIDATION_FAILED: expression approver has unknown resolveAs '${resolveAs}' \u2014 use 'user', 'department', 'position', or 'team'`
@@ -2802,9 +2887,50 @@ var _ApprovalService = class _ApprovalService {
     }
     return { slots, raw };
   }
-  /** Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy). */
-  async expandTeamUsers(teamId) {
+  /**
+   * Flat team — `sys_team` is better-auth's collaboration grouping (no hierarchy).
+   *
+   * Takes an organization for the reason every sibling expansion does
+   * ({@link expandBusinessUnitUsers}, {@link expandPositionUsers},
+   * {@link expandMembershipTierUsers}): an approver expansion answers "who, in
+   * THIS organization". Before #10230 this one did not ask, and it was the last
+   * expansion that did not — a `team` approver naming ANOTHER organization's
+   * team routed that organization's people an approval over a record they are
+   * not a tenant of.
+   *
+   * TWO screens run here, and they assert different things (#10230, #10547):
+   *
+   *   1. the TEAM must not provably belong to another organization
+   *      ({@link teamIsProvablyOutsideOrg}) — `sys_team` carries
+   *      `organization_id` outright
+   *      (`packages/platform-objects/src/identity/sys-team.object.ts`), so a
+   *      team id transitively names exactly one organization and ONE row
+   *      answers the question;
+   *   2. each expanded MEMBER must not provably hold membership only in other
+   *      organizations ({@link dropMembersProvablyOutsideOrg}) —
+   *      `sys_team_member` carries `team_id` and `user_id` and NO tenancy
+   *      column at all, so passing (1) says nothing whatever about the people
+   *      it lists.
+   *
+   * #10230 landed (1) alone and deferred (2) on purpose. What closed the
+   * deferral is that (1) does not imply (2) even a little: a member removed
+   * from the organization but left on the team, a team re-parented across
+   * organizations (`/organization/update-team` accepts `organizationId` in its
+   * partial body), or a `sys_team_member` row written by a seed rather than
+   * through better-auth all produce a team that passes (1) carrying a user who
+   * is provably a tenant of somewhere else. Measured on this tree, not read off
+   * the schema — the probe is quoted in `team-member-org-screen.test.ts`.
+   *
+   * (2) is the SAME assertion as {@link managerIsProvablyOutsideOrg}, one hop
+   * further out, and it is asserted the same way: `sys_user` carries no tenancy
+   * fact, so `sys_member` rows are the only evidence that a person is placed
+   * anywhere. Like that screen, this one grants no reads and applies no read
+   * screen to any approver type that lacks one today, so it decides nothing
+   * #7497 (does approver routing imply record read visibility?) asks.
+   */
+  async expandTeamUsers(teamId, organizationId) {
     if (!teamId) return [];
+    if (await this.teamIsProvablyOutsideOrg(teamId, organizationId)) return [];
     let rows = [];
     try {
       rows = await this.engine.find("sys_team_member", {
@@ -2816,7 +2942,149 @@ var _ApprovalService = class _ApprovalService {
     } catch {
       rows = [];
     }
-    return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    const users = Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
+    return await this.dropMembersProvablyOutsideOrg(teamId, users, organizationId);
+  }
+  /**
+   * Is `teamId` PROVABLY a team of a DIFFERENT organization? (#10230)
+   *
+   * "Provably" carries the same posture the sibling screen states at length in
+   * {@link managerIsProvablyOutsideOrg}, for the same reasons:
+   *
+   *   - the team row carries an `organization_id` and it is not the request's
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen it out;
+   *   - the row carries no `organization_id`, does not exist, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The `organization_id = null` limb is not timidity — it is the reading
+   * {@link businessUnitOrgScope} settled on one screen below, for the identical
+   * shape: null on a platform object means "owned by no organization", which is
+   * what a seed writes because a seed cannot know the organization id the
+   * runtime mints at boot. Treating null as "not mine" would delete every
+   * seeded team approver at once — a larger behaviour change than the hole
+   * being closed. Measured, and not hypothetically: this package's own
+   * `team_ok` expansion fixture is exactly such a stack (it has
+   * `sys_team_member` rows, a request carrying an organization, and no
+   * `sys_team` row at all).
+   *
+   * Screening the TEAM before reading its members is also what keeps the cost
+   * at one row: a team that fails the screen never fans out.
+   */
+  async teamIsProvablyOutsideOrg(teamId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_team", {
+        where: { id: teamId },
+        fields: ["id", "organization_id"],
+        limit: 1,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const row = Array.isArray(rows) ? rows[0] : null;
+    const teamOrg = row?.organization_id ? String(row.organization_id) : "";
+    if (!teamOrg) return false;
+    if (teamOrg === requestOrg) return false;
+    this.logger?.warn?.(
+      `[approvals] #10230: team '${teamId}' was dropped from the approver slate \u2014 'sys_team.organization_id' is '${teamOrg}', not the request's organization '${requestOrg}', so routing this approval to its members would put approval authority over the record outside its tenant. Point the approver at a team in this organization, or route this step with an approver type that names someone in it.`,
+      { teamId, teamOrganizationId: teamOrg, requestOrganizationId: requestOrg }
+    );
+    return true;
+  }
+  /**
+   * Drop the expanded team members who are PROVABLY tenants of other
+   * organizations and not of `organizationId`. (#10547)
+   *
+   * Returns the survivors, in the order they were expanded.
+   *
+   * Posture — identical to {@link managerIsProvablyOutsideOrg} and
+   * {@link teamIsProvablyOutsideOrg}, deliberately, because it is the same
+   * assertion about the same table:
+   *
+   *   - membership rows exist for this user, none in `organizationId`
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ drop him;
+   *   - no membership rows at all for him, the read failed, or the request
+   *     carries no organization
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The absent limb is load-bearing rather than timid, and #3807 is the recorded
+   * cost of getting it wrong: a stack that stamps an organization on requests
+   * but never materializes `sys_member` rows would otherwise lose EVERY team
+   * approver at once. This package's own `team_ok` expansion fixture and
+   * #10230's T2/T3 fixtures are exactly such stacks — they carry team rows and
+   * a request organization and no `sys_member` table at all — so the absent
+   * limb is exercised by neighbours on every run of this suite.
+   *
+   * ONE read for the whole slate, never one per person: the expansion is capped
+   * at 10000 members and a per-user query would turn a single team approver
+   * into 10000 round trips.
+   *
+   * ⚠️ A TRUNCATED read fails open, and that is the subtle half. This read is
+   * the only evidence that a member IS a tenant here, so a result cut off at
+   * the limit could be missing the very row that keeps a legitimate approver on
+   * the slate — screening him out on missing evidence, which inverts the
+   * posture into fail-CLOSED precisely where it must not. When the read comes
+   * back at the cap it is treated as no evidence at all.
+   */
+  async dropMembersProvablyOutsideOrg(teamId, userIds, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg || !userIds.length) return userIds;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: { $in: userIds } },
+        fields: ["user_id", "organization_id"],
+        limit: MEMBER_SCREEN_READ_LIMIT,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return userIds;
+    }
+    if ((rows?.length ?? 0) >= MEMBER_SCREEN_READ_LIMIT) {
+      this.logger?.warn?.(
+        `[approvals] #10547: the membership screen for team '${teamId}' read ${rows.length} 'sys_member' rows, at or above its ${MEMBER_SCREEN_READ_LIMIT}-row cap, so the result may be truncated. Routing is left unchanged rather than risk dropping a member whose proof of membership fell outside the read.`,
+        { teamId, requestOrganizationId: requestOrg, rowsRead: rows.length }
+      );
+      return userIds;
+    }
+    const orgsByUser = /* @__PURE__ */ new Map();
+    for (const r of rows ?? []) {
+      const uid2 = String(r?.user_id ?? "");
+      const org = String(r?.organization_id ?? "");
+      if (!uid2 || !org) continue;
+      const seen = orgsByUser.get(uid2);
+      if (seen) seen.push(org);
+      else orgsByUser.set(uid2, [org]);
+    }
+    const kept = [];
+    const dropped = [];
+    for (const uid2 of userIds) {
+      const orgs = orgsByUser.get(uid2);
+      if (!orgs?.length) {
+        kept.push(uid2);
+        continue;
+      }
+      if (orgs.includes(requestOrg)) {
+        kept.push(uid2);
+        continue;
+      }
+      dropped.push({ userId: uid2, organizationIds: orgs });
+    }
+    if (dropped.length) {
+      this.logger?.warn?.(
+        `[approvals] #10547: ${dropped.length} member(s) of team '${teamId}' were dropped from the approver slate \u2014 ${dropped.map((d) => `'${d.userId}'`).join(", ")} hold membership in other organization(s), none of them the request's organization '${requestOrg}', so routing this approval to them would put approval authority over the record outside its tenant. The TEAM itself belongs to this organization; its 'sys_team_member' rows carry no organization of their own. Remove them from the team, grant them a membership in this organization, or route this step with an approver type that names someone in it.`,
+        {
+          teamId,
+          requestOrganizationId: requestOrg,
+          droppedUserIds: dropped.map((d) => d.userId),
+          droppedMemberOrganizationIds: dropped.map((d) => d.organizationIds)
+        }
+      );
+    }
+    return kept;
   }
   /**
    * Tenant scope for a `sys_business_unit` read that may legitimately be
@@ -2985,7 +3253,36 @@ var _ApprovalService = class _ApprovalService {
     }
     return Array.from(new Set((rows ?? []).map((r) => String(r.user_id ?? "")).filter(Boolean)));
   }
-  async lookupManager(userId) {
+  /**
+   * `sys_user.manager_id`, screened to the request's organization (#10153).
+   *
+   * Takes an organization argument for the same reason its siblings do
+   * ({@link expandPositionUsers}, {@link expandMembershipTierUsers}): an
+   * approver expansion answers "who, in THIS organization". Before #10153 this
+   * one did not ask, and it was the only expansion that did not — a
+   * `manager_id` pointing at a person in another organization routed that
+   * person an approval over a record they are not a tenant of.
+   *
+   * ⚠️ The screen reads `sys_member`, which LOOKS like the D2 read-visibility
+   * filter next to it ({@link filterApproversWhoCanRead}). It is not, and this
+   * comment exists so the next reader does not conclude that #7497 (does
+   * approver routing imply record read visibility?) was settled here. It was
+   * not. Two facts make this the SIBLING treatment rather than a
+   * read-visibility ruling:
+   *
+   *   1. Two of the three org-scoped expansions already screen on exactly this
+   *      column — `expandMembershipTierUsers` filters `sys_member.organization_id`
+   *      outright, and it is also the second limb of `expandPositionUsers`. So
+   *      `sys_member.organization_id` is already this file's answer to "which
+   *      organization is this person in", independent of what they may read.
+   *   2. `sys_user` carries no `organization_id` at all. It is a GLOBAL identity
+   *      table, so a membership row is the only tenancy fact that exists for a
+   *      user — there is no other read this screen could have been written with.
+   *
+   * This change grants no reads and applies no read screen to any type that
+   * lacks one today, so it decides nothing #7497 asks.
+   */
+  async lookupManager(userId, organizationId) {
     try {
       const rows = await this.engine.find("sys_user", {
         where: { id: userId },
@@ -2994,11 +3291,64 @@ var _ApprovalService = class _ApprovalService {
         context: SYSTEM_CTX2
       });
       const row = Array.isArray(rows) ? rows[0] : null;
-      return row?.manager_id ? String(row.manager_id) : null;
+      const managerId = row?.manager_id ? String(row.manager_id) : null;
+      if (!managerId) return null;
+      if (await this.managerIsProvablyOutsideOrg(managerId, organizationId)) return null;
+      return managerId;
     } catch {
       return null;
     }
   }
+  /**
+   * Is `managerId` PROVABLY a member of other organizations and not of
+   * `organizationId`? (#10153)
+   *
+   * "Provably" is the whole shape of this screen, and it is deliberate rather
+   * than a weaker version of "must prove membership":
+   *
+   *   - membership rows exist for this user, none in the request's org
+   *       ⇒ the tenancy fact is present and NEGATIVE ⇒ screen him out;
+   *   - no membership rows at all, or the read failed
+   *       ⇒ the tenancy fact is ABSENT ⇒ leave routing exactly as it was.
+   *
+   * The fail-open half is not timidity, it is this file's ruled posture on
+   * addressing paths, stated twice already: {@link filterApproversWhoCanRead}
+   * refuses to empty a live slate on an infrastructure hiccup, and
+   * {@link expandPositionUsers} carries "a step routing to nobody is worse than
+   * one routing to a lapsed holder". It is also load-bearing in practice — a
+   * stack that stamps an organization on its requests but does not materialize
+   * `sys_member` rows would otherwise lose every manager approver at once,
+   * which is a bigger behaviour change than the hole being closed. Measured:
+   * this repo's own `type:manager` out-of-office fixture is such a stack.
+   *
+   * Screening the MANAGER only, before OOO delegation, is deliberate too: the
+   * delegate arrives from `sys_approval_delegation`, whose rows already carry
+   * (and are already filtered by) an `organization_id` in
+   * {@link lookupActiveDelegation}. This card is about `sys_user.manager_id`.
+   */
+  async managerIsProvablyOutsideOrg(managerId, organizationId) {
+    const requestOrg = organizationId ? String(organizationId) : "";
+    if (!requestOrg) return false;
+    let rows = [];
+    try {
+      rows = await this.engine.find("sys_member", {
+        where: { user_id: managerId },
+        fields: ["user_id", "organization_id"],
+        limit: 1e3,
+        context: SYSTEM_CTX2
+      });
+    } catch {
+      return false;
+    }
+    const orgs = (rows ?? []).map((r) => String(r?.organization_id ?? "")).filter(Boolean);
+    if (!orgs.length) return false;
+    if (orgs.includes(requestOrg)) return false;
+    this.logger?.warn?.(
+      `[approvals] #10153: manager '${managerId}' was dropped from the approver slate \u2014 'sys_user.manager_id' points across an organization boundary. He holds membership in ${orgs.length} organization(s), none of them the request's organization '${requestOrg}', so routing this approval to him would put approval authority over the record outside its tenant. Fix the 'manager_id' link, grant him a membership in this organization, or route this step with an approver type that names someone in it.`,
+      { managerId, requestOrganizationId: requestOrg, managerOrganizationIds: orgs }
+    );
+    return true;
+  }
   /**
    * Out-of-office auto-skip (#1322 M1). Given an individually-routed approver
    * id, follow any active `sys_approval_delegation` chain and return the id the
@@ -5124,8 +5474,70 @@ var _ApprovalService = class _ApprovalService {
     return { requests: desired.size, inserted, deleted };
   }
   // ── Read API ─────────────────────────────────────────────────
+  /**
+   * [#11040] May the free-text pushdown carry an arm on the SNAPSHOT column,
+   * for THIS caller over THIS query's scope?
+   *
+   * `payload_json` is the one searched column whose contents the serve path
+   * masks per reader (`redactPayloads`, #10749). A predicate over it is
+   * evaluated by the driver against the column AT REST — unmasked, before
+   * anything is served — so for a caller whose view of the snapshot is masked,
+   * row membership answers questions about contents that caller may not read.
+   * The other four arms are columns of `sys_approval_request` itself, which
+   * every caller who can see the row reads whole; they are untouched.
+   *
+   * ## The invariant this method exists to hold
+   *
+   * "This caller's view is masked" is read from **the same authority and the
+   * same per-caller call as the serve path** — `resolveReadableSnapshotFields`,
+   * asked as the CALLER (never `SYSTEM_CTX`). A second, independently derived
+   * notion of "redacted" — comparing the readable set against the object's
+   * schema, say — would be a fresh source of drift, and drift between the
+   * serve rule and the filter rule IS the defect this closes, reconstituted one
+   * layer down. So the only "not masked" answer accepted here is the one serve
+   * itself acts on: `undefined`, the seam's documented do-not-narrow branch.
+   * When the seam holds a concrete list the mask is IN FORCE, whether or not it
+   * happens to remove a key from any particular row — a row-dependent question
+   * no predicate can answer before rows exist.
+   *
+   * ## The two predicate-time cases
+   *
+   * Redaction is decided per ROW (each row names its own subject object, hence
+   * its own readable set), but a filter is built before any row exists:
+   *
+   *  - **authority absent** — `resolveReadableSnapshotFields` answers
+   *    `undefined` for EVERY object, so serve hands over every snapshot whole.
+   *    Keeping the arm leaks nothing serve does not already hand over, and this
+   *    is the shape every deployment that has not wired the security plugin
+   *    gets: search is byte-for-byte unchanged. Checked first, and that order
+   *    is load-bearing — see the object-scope note below.
+   *  - **authority wired** — the readable set is per object, so the arm is
+   *    admissible only for a scope of exactly one KNOWN object. With
+   *    `filter.object` present that object is known at predicate time and the
+   *    seam is asked about it directly. Absent, the query spans every object
+   *    and there is nothing sound to ask, so the arm is dropped.
+   *
+   * Dropping an arm is strictly NARROWING: it never refuses a query and never
+   * widens what comes back, so the fail-closed direction is cheap here and is
+   * taken rather than reaching for a per-object predicate machine to avoid it.
+   * Refusing the query outright would be the louder behaviour change, and is
+   * deliberately not what this does.
+   */
+  async freeTextMayMatchSnapshot(objectInScope, context) {
+    const authority = this.fieldVisibility;
+    if (!authority || typeof authority.getReadableFields !== "function") return true;
+    const object = String(objectInScope ?? "").trim();
+    if (!object) return false;
+    const readable = await resolveReadableSnapshotFields(
+      authority,
+      object,
+      context,
+      this.logger
+    );
+    return readable === void 0;
+  }
   /** Filter type accepted by {@link listRequests} / {@link countRequests}. */
-  buildRequestWhere(filter, context) {
+  async buildRequestWhere(filter, context) {
     const f = {};
     if (filter?.object) f.object_name = filter.object;
     if (filter?.recordId) f.record_id = filter.recordId;
@@ -5134,13 +5546,16 @@ var _ApprovalService = class _ApprovalService {
     if (tenantOrg) f.organization_id = tenantOrg;
     const q = filter?.q?.trim();
     if (q) {
-      f.$or = [
+      const arms = [
         { process_name: { $contains: q } },
         { object_name: { $contains: q } },
         { record_id: { $contains: q } },
-        { submitter_id: { $contains: q } },
-        { payload_json: { $contains: q } }
+        { submitter_id: { $contains: q } }
       ];
+      if (await this.freeTextMayMatchSnapshot(filter?.object, context)) {
+        arms.push({ payload_json: { $contains: q } });
+      }
+      f.$or = arms;
     }
     if (Array.isArray(filter?.status)) {
       const statuses = filter.status.filter(Boolean);
@@ -5343,7 +5758,7 @@ var _ApprovalService = class _ApprovalService {
     return true;
   }
   async listRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
@@ -5367,12 +5782,13 @@ var _ApprovalService = class _ApprovalService {
     }
     const rows = await this.engine.find("sys_approval_request", findOpts);
     const list = Array.isArray(rows) ? rows.map(rowFromRequest) : [];
+    await this.redactPayloads(list, context);
     await this.enrichRows(list);
     this.attachViewers(list, context);
     return list;
   }
   async countRequests(filter, context) {
-    const { where, tenantOrg } = this.buildRequestWhere(filter, context);
+    const { where, tenantOrg } = await this.buildRequestWhere(filter, context);
     const approverTargets = (Array.isArray(filter?.approverId) ? filter.approverId : filter?.approverId ? [filter.approverId] : []).map((t) => String(t).trim()).filter(Boolean);
     const ids = await this.approverRequestIds(approverTargets, tenantOrg);
     if (ids) {
@@ -5435,6 +5851,7 @@ var _ApprovalService = class _ApprovalService {
       if (visible && !visible.has(String(rows[0].id))) return null;
     }
     const row = rowFromRequest(rows[0]);
+    await this.redactPayloads([row], context);
     await this.enrichRows([row]);
     await this.attachFlowSteps(row);
     await this.attachDecisionProgress(row, rows[0]);
@@ -5938,6 +6355,52 @@ function unbindAllHooks(engine) {
   return engine.unregisterHooksByPackage(APPROVALS_HOOK_PACKAGE);
 }
 
+// src/payload-redaction-middleware.ts
+var APPROVAL_REQUEST_OBJECT = "sys_approval_request";
+function parseSnapshot(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return { ok: false, value: void 0 };
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch {
+    return { ok: false, value: void 0 };
+  }
+}
+async function redactRowsInPlace(rows, security, context, logger) {
+  const list = Array.isArray(rows) ? rows : rows ? [rows] : [];
+  if (list.length === 0) return;
+  const cache = /* @__PURE__ */ new Map();
+  for (const row of list) {
+    if (!row || typeof row !== "object") continue;
+    const raw = row.payload_json;
+    const parsed = parseSnapshot(raw);
+    if (!parsed.ok) continue;
+    const object = String(row.object_name ?? "").trim();
+    if (!object) continue;
+    if (!cache.has(object)) {
+      cache.set(object, await resolveReadableSnapshotFields(security, object, context, logger));
+    }
+    const readable = cache.get(object);
+    if (readable === void 0) continue;
+    const { payload, redactedKeys } = redactSnapshot(parsed.value, readable);
+    if (redactedKeys.length === 0) continue;
+    row.payload_json = JSON.stringify(payload);
+  }
+}
+function bindSnapshotRedactionMiddleware(engine, getSecurity, logger) {
+  engine.registerMiddleware(async (opCtx, next) => {
+    await next();
+    if (opCtx?.operation !== "find" && opCtx?.operation !== "findOne") return;
+    if (opCtx?.context?.isSystem) return;
+    try {
+      await redactRowsInPlace(opCtx.result, getSecurity(), opCtx.context, logger);
+    } catch (err) {
+      logger?.warn?.("[approvals] snapshot redaction middleware failed", {
+        error: err?.message ?? String(err)
+      });
+    }
+  }, { object: APPROVAL_REQUEST_OBJECT });
+}
+
 // src/approval-node.ts
 import {
   defineActionDescriptor as defineActionDescriptor2,
@@ -6209,11 +6672,26 @@ var ApprovalsServicePlugin = class {
         }
       }
     });
+    const fieldVisibility = () => {
+      try {
+        const sec = ctx.getService("security");
+        return sec && typeof sec.getReadableFields === "function" ? sec : void 0;
+      } catch {
+        return void 0;
+      }
+    };
+    this.service.attachFieldVisibility({
+      getReadableFields: (object, context) => {
+        const sec = fieldVisibility();
+        return sec ? sec.getReadableFields(object, context) : Promise.resolve(void 0);
+      }
+    });
     if (!this.options.disableAutoHooks) {
       try {
         unbindAllHooks(engine);
         bindApprovalLockHook(engine, ctx.logger);
         bindDelegationWriteGuard(engine, ctx.logger);
+        bindSnapshotRedactionMiddleware(engine, fieldVisibility, ctx.logger);
       } catch (err) {
         ctx.logger.warn?.("[approvals] failed to bind approval hooks", { error: err?.message });
       }
@@ -6253,6 +6731,7 @@ var ApprovalsServicePlugin = class {
           }
         };
         await jobs.schedule(ESCALATION_JOB_NAME, { type: "interval", intervalMs }, sweep);
+        this.jobService = jobs;
         this.escalationJobScheduled = true;
         void sweep().catch((err) => {
           ctx.logger.warn?.("[approvals] boot sweep failed", { error: err?.message });
@@ -6339,14 +6818,32 @@ var ApprovalsServicePlugin = class {
       );
     }
   }
-  async stop(ctx) {
+  /**
+   * The kernel's teardown hook (`Plugin.destroy?()`, core `types.ts`) — the
+   * ONLY teardown entry point `ObjectKernel.performShutdown()` and
+   * `LiteKernel.destroy()` invoke.
+   *
+   * [#10371] IT USED TO BE `stop()`, WHICH NOTHING CALLED. `Plugin` declares
+   * `init()`, `start?()` and `destroy?()` and no `stop()`, so the kernel walked
+   * past this plugin at shutdown: the SLA escalation job stayed scheduled and
+   * this plugin's ObjectQL hooks stayed bound to an engine the kernel had
+   * finished with. `start()` IS on the interface, so the pair read as symmetric
+   * in review — that asymmetry is what let the same shape survive in six
+   * packages at once.
+   *
+   * This member owns no timer of its own (the escalation clock belongs to
+   * `service-job`), so it never cost a merge-queue eviction the way the
+   * `plugin-reports` / `service-messaging` members did (#9371). The class is
+   * the same one either way: a teardown the kernel does not reach.
+   */
+  async destroy() {
     if (this.escalationJobScheduled) {
       try {
-        const jobs = ctx.getService("job");
-        await jobs?.cancel?.(ESCALATION_JOB_NAME);
+        await this.jobService?.cancel?.(ESCALATION_JOB_NAME);
       } catch {
       }
       this.escalationJobScheduled = false;
+      this.jobService = void 0;
     }
     if (this.engine) {
       try {
@@ -6355,6 +6852,17 @@ var ApprovalsServicePlugin = class {
       }
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class, and removing it would break an embedder who learned to call
+   * it directly precisely BECAUSE the kernel never did. The parameter is now
+   * optional and ignored: `destroy()` takes no context, so teardown uses the
+   * job service captured when the escalation clock was wired. Prefer kernel
+   * shutdown; direct callers keep working unchanged.
+   */
+  async stop(_ctx) {
+    await this.destroy();
+  }
 };
 export {
   APPROVAL_REVISE_CORRELATION_PREFIX,