@oondemand/oon-core-back 0.7.11 → 0.7.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oondemand/oon-core-back",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/oondemand/oon-platform.git",

package/src/core/define.js

@@ -75,14 +75,42 @@ function addDataScopeFields(schema, definition) {
   return schema;
 }
 
+// Natural-key uniqueness follows the same data scope as CRUD. This only
+// declares indexes for new schemas; it never drops or migrates existing indexes.
+function buildScopedSchema(definition) {
+  const scope = dataScope(definition), prefix = {};
+  if (scope === "tenant" || scope === "user" && (ctx.config.tenancyModel || ctx.config.ecosystem?.tenancyModel) !== "none") prefix[tenantField(definition)] = 1;
+  if (scope === "user") prefix[userField(definition)] = 1;
+  if (!Object.keys(prefix).length) return buildSchema(definition.schema, definition.options);
+  const shape = {}, indexes = [];
+  for (const [field, descriptor] of Object.entries(definition.schema)) {
+    if (descriptor && typeof descriptor === "object" && (descriptor.unique === true || descriptor.index?.unique === true)) {
+      const { unique, index, sparse, ...rest } = descriptor;
+      // Retain partial/collation/sparse semantics on the compound index.
+      const options = { ...(index && typeof index === "object" ? index : {}), unique: true, ...(sparse !== undefined ? { sparse } : {}) };
+      // A field-level name may belong to an existing global index. Use the
+      // generated compound name so adoption can retain and review both indexes.
+      delete options.name;
+      if (options.sparse) {
+        delete options.sparse;
+        const exists = { [field]: { $exists: true } };
+        options.partialFilterExpression = options.partialFilterExpression
+          ? { $and: [options.partialFilterExpression, exists] } : exists;
+      }
+      shape[field] = rest;
+      indexes.push([{ ...prefix, [field]: 1 }, options]);
+    } else shape[field] = descriptor;
+  }
+  const result = buildSchema(shape, definition.options);
+  for (const [keys, options] of indexes) result.schema.index(keys, options);
+  return result;
+}
+
 function defineModel(definition) {
   if (!definition?.name) throw new Error("defineModel requer `name`.");
   if (!definition?.schema) throw new Error(`defineModel("${definition.name}") requer \`schema\`.`);
 
-  const { schema, metaFields, searchableFields } = buildSchema(
-    definition.schema,
-    definition.options
-  );
+  const { schema, metaFields, searchableFields } = buildScopedSchema(definition);
   // Campos de isolamento são internos: fazem parte do schema e dos índices,
   // mas não vazam para metadata/formulários declarativos.
   addDataScopeFields(schema, definition);

package/src/core/factories/crudController.js

@@ -127,7 +127,7 @@ function createCrudController(entry, service) {
 
   async function createOne(data, method, session, accessContext) {
     const prepared = await prepareCreate(data, method, session, accessContext);
-    await assertAtomicInvariants(entry, prepared.consolidated, null, session);
+    await assertAtomicInvariants(entry, prepared.consolidated, null, session, accessContext);
     const record = await service.create(prepared.changes, { session, accessContext });
     await recalculateDependents(entry, null, toPlainRecord(record), {
       session,
@@ -139,7 +139,7 @@ function createCrudController(entry, service) {
 
   async function updateOne(id, changes, method, session, accessContext) {
     const prepared = await prepareUpdate(id, changes, method, session, accessContext);
-    await assertAtomicInvariants(entry, prepared.consolidated, prepared.current, session);
+    await assertAtomicInvariants(entry, prepared.consolidated, prepared.current, session, accessContext);
     const record = await service.update(id, prepared.changes, { session, accessContext });
     await recalculateDependents(entry, prepared.current, toPlainRecord(record), {
       session,

package/src/index.js

@@ -23,6 +23,7 @@ const localDevelopment = require("./core/runtime/localDevelopment");
 const localExecutionPolicy = require("./core/runtime/localExecutionPolicy");
 
 module.exports = {
+  appArchitecture: require("./manifest/appArchitecture"),
   start, createApp, activate,
   defineCentral: define.defineCentral, defineModel: define.defineModel,
   defineCollection: define.defineCollection, defineDocument: define.defineDocument,

package/src/manifest/appArchitecture.js

@@ -0,0 +1,31 @@
+"use strict";
+
+// Canonical #290 contract. Deployment is a derived technical projection, never
+// a second architectural authority. This module has no commercial policy.
+const DEPLOYMENT_BY_TENANCY = Object.freeze({ none: "singleton", single_tenant: "dedicated", multi_tenant: "shared" });
+const AVAILABILITY_TENANCY = Object.freeze({
+  system: Object.freeze(["none"]), common: Object.freeze(["none", "multi_tenant"]),
+  self: Object.freeze(["single_tenant"]), licensed: Object.freeze(["single_tenant", "multi_tenant"]),
+});
+function invalid(code, field, message) {
+  throw Object.assign(new Error(message), { code, statusCode: 422, details: { field } });
+}
+function deriveDeploymentMode(tenancyModel) {
+  if (!Object.hasOwn(DEPLOYMENT_BY_TENANCY, tenancyModel)) invalid("APP_TENANCY_INVALID", "tenancyModel", "Modelo de tenancy inválido.");
+  return DEPLOYMENT_BY_TENANCY[tenancyModel];
+}
+function resolveAppArchitecture(input) {
+  const { availability, tenancyModel } = input || {};
+  const deploymentMode = deriveDeploymentMode(tenancyModel);
+  if (!Object.hasOwn(AVAILABILITY_TENANCY, availability) || !AVAILABILITY_TENANCY[availability].includes(tenancyModel)) {
+    invalid("APP_ARCHITECTURE_INVALID", "availability", "Disponibilidade e tenancy fora da matriz suportada.");
+  }
+  if (input.ecosystemRole && (input.ecosystemRole === "root") !== (availability === "system")) {
+    invalid("APP_ARCHITECTURE_INVALID", "ecosystemRole", "Somente a Central root usa availability=system.");
+  }
+  if (input.deploymentMode !== undefined && input.deploymentMode !== deploymentMode) {
+    invalid(input.deploymentMode === "hybrid" ? "APP_HYBRID_UNSUPPORTED" : "APP_DEPLOYMENT_CONTRADICTION", "deploymentMode", "Implantação legada deve concordar com tenancyModel; hybrid não é suportado.");
+  }
+  return Object.freeze({ availability, tenancyModel, deploymentMode });
+}
+module.exports = { DEPLOYMENT_BY_TENANCY, AVAILABILITY_TENANCY, deriveDeploymentMode, resolveAppArchitecture };

package/src/manifest/appManifest.js

@@ -5,6 +5,7 @@ const path = require("node:path");
 const ctx = require("../core/context");
 const corePackage = require("../../package.json");
 const { validateRbac } = require("./rbacManifest");
+const { deriveDeploymentMode, resolveAppArchitecture } = require("./appArchitecture");
 
 const APP_MANIFEST_FILENAME = "central.app.json";
 const APP_MANIFEST_SCHEMA_VERSION = 2;
@@ -13,10 +14,10 @@ const SUPPORTED_MODULES = Object.freeze([
   "collections", "documents", "pipelines", "assistants", "currencies",
 ]);
 const SUPPORTED_TENANCY_MODELS = Object.freeze(["none", "single_tenant", "multi_tenant"]);
-const SUPPORTED_AVAILABILITIES = Object.freeze(["system", "common", "licensed"]);
+const SUPPORTED_AVAILABILITIES = Object.freeze(["system", "common", "self", "licensed"]);
 const SUPPORTED_ACCESS_MODES = Object.freeze(["tenant_members", "explicit_users", "authenticated_users"]);
 const SUPPORTED_AUTHORIZATION_MODES = Object.freeze(["none", "rbac"]);
-const SUPPORTED_DEPLOYMENT_MODES = Object.freeze(["singleton", "shared", "dedicated", "hybrid"]);
+const SUPPORTED_DEPLOYMENT_MODES = Object.freeze(["singleton", "shared", "dedicated"]);
 const TRANSACTIONAL_EMAIL_CAPABILITY = "core.transactional-email";
 const EMAIL_SCOPE_POLICIES = Object.freeze(["app_only", "tenant_required", "tenant_override"]);
 const APP_KIND_ROLE = Object.freeze({
@@ -201,7 +202,7 @@ function dimensionsFor(manifest) {
     availability: manifest.availability || defaults.availability,
     accessMode: manifest.accessMode || defaults.accessMode,
     authorizationMode: manifest.authorizationMode || defaults.authorizationMode,
-    deploymentMode: manifest.deploymentMode || defaults.deploymentMode,
+    deploymentMode: deriveDeploymentMode(SUPPORTED_TENANCY_MODELS.includes(manifest.tenancyModel) ? manifest.tenancyModel : defaults.tenancyModel),
   };
 }
 
@@ -238,6 +239,11 @@ function validateAppManifest(input, { coreVersion = corePackage.version } = {})
   validateDimension(input.deploymentMode, "deploymentMode", SUPPORTED_DEPLOYMENT_MODES, issues);
   const dimensions = dimensionsFor(input);
   const role = APP_KIND_ROLE[input.appKind];
+  try {
+    resolveAppArchitecture({ ...dimensions, ecosystemRole: role, ...(input.deploymentMode !== undefined ? { deploymentMode: input.deploymentMode } : {}) });
+  } catch (error) {
+    addIssue(issues, error.details?.field || "tenancyModel", `${error.code}: ${error.message}`);
+  }
   if (role === "root" && (
     dimensions.tenancyModel !== "none" ||
     dimensions.availability !== "system" ||

package/src/manifest/processRuntime.js

@@ -2,6 +2,7 @@
 
 const mongoose = require("../core/database/mongoose");
 const registry = require("../core/registry");
+const { mergeScopedFilter, scopedIdFilter, scopeFilter } = require("../core/tenancy");
 const {
   DomainRuleError,
   applyDomainMutation,
@@ -13,6 +14,7 @@ const {
 const MAX_AUTOMATIC_TRANSITIONS = 8;
 const MAX_TRANSACTION_ATTEMPTS = 3;
 let asynchronousQueue = Promise.resolve();
+const transactionJobs = new WeakMap();
 
 function toPlainRecord(record) {
   if (!record || typeof record !== "object") return {};
@@ -182,20 +184,20 @@ function bindingDefault(binding) {
   return binding.kind === "aggregate" ? 0 : null;
 }
 
-async function loadLookupValues(binding, states, session) {
+async function loadLookupValues(binding, states, session, accessContext) {
   const sourceEntry = registry.getModel(binding.sourceModel);
   if (!sourceEntry) throw new Error(`Model ${binding.sourceModel} não registrada.`);
   const ids = [...new Set(states.map((state) => idKey(state[binding.localField])).filter(Boolean))];
   if (!ids.length) return new Map();
   let query = sourceEntry.mongooseModel
-    .find({ _id: { $in: ids } })
+    .find(mergeScopedFilter(sourceEntry, { _id: { $in: ids } }, accessContext))
     .select(`_id ${binding.sourceField}`);
   query = queryWithSession(query, session);
   const rows = await query.lean();
   return new Map(rows.map((row) => [idKey(row._id), row[binding.sourceField]]));
 }
 
-async function loadAggregateValues(binding, states, session) {
+async function loadAggregateValues(binding, states, session, accessContext) {
   const sourceEntry = registry.getModel(binding.sourceModel);
   if (!sourceEntry) throw new Error(`Model ${binding.sourceModel} não registrada.`);
   const parentIds = [...new Map(
@@ -216,7 +218,7 @@ async function loadAggregateValues(binding, states, session) {
     default: accumulator = { $sum: { $ifNull: [`$${binding.sourceField}`, 0] } }; break;
   }
   let aggregate = sourceEntry.mongooseModel.aggregate([
-    { $match: match },
+    { $match: mergeScopedFilter(sourceEntry, match, accessContext) },
     { $group: { _id: `$${binding.foreignField}`, value: accumulator } },
   ]);
   if (session && typeof aggregate.session === "function") aggregate = aggregate.session(session);
@@ -231,7 +233,7 @@ async function resolveBindingsForRecords(entry, records, options = {}) {
 
   for (const binding of bindings) {
     if (binding.kind === "lookup") {
-      const values = await loadLookupValues(binding, states, options.session);
+      const values = await loadLookupValues(binding, states, options.session, options.accessContext);
       states.forEach((state, index) => {
         const value = values.has(idKey(state[binding.localField]))
           ? values.get(idKey(state[binding.localField]))
@@ -243,7 +245,7 @@ async function resolveBindingsForRecords(entry, records, options = {}) {
     }
 
     if (binding.kind === "aggregate") {
-      const values = await loadAggregateValues(binding, states, options.session);
+      const values = await loadAggregateValues(binding, states, options.session, options.accessContext);
       states.forEach((state, index) => {
         const value = values.has(idKey(state._id))
           ? values.get(idKey(state._id))
@@ -341,7 +343,7 @@ function invariantError(rule, total, limit) {
   });
 }
 
-async function assertAtomicInvariants(entry, candidate, current, session) {
+async function assertAtomicInvariants(entry, candidate, current, session, accessContext) {
   for (const rule of entry.definition?.processRules?.atomicInvariants || []) {
     if (rule.kind !== "relatedSumLteParentField") continue;
     const parentId = candidate?.[rule.parentLocalField];
@@ -350,7 +352,7 @@ async function assertAtomicInvariants(entry, candidate, current, session) {
     if (!parentEntry) throw new Error(`Model pai ${rule.parentModel} não registrada.`);
 
     let parentQuery = parentEntry.mongooseModel.findOneAndUpdate(
-      { _id: parentId },
+      scopedIdFilter(parentEntry, parentId, accessContext),
       { $inc: { __oonInvariantVersion: 1 } },
       { new: true, session },
     );
@@ -372,7 +374,7 @@ async function assertAtomicInvariants(entry, candidate, current, session) {
     };
     if (current?._id) match._id = { $ne: current._id };
     let aggregate = entry.mongooseModel.aggregate([
-      { $match: match },
+      { $match: mergeScopedFilter(entry, match, accessContext) },
       { $group: { _id: null, total: { $sum: { $ifNull: [`$${rule.sourceField}`, 0] } } } },
     ]);
     if (session && typeof aggregate.session === "function") aggregate = aggregate.session(session);
@@ -400,10 +402,10 @@ async function assertDeleteAllowed(entry, id, options = {}) {
   for (const rule of entry.definition?.processRules?.deleteProtection || []) {
     const sourceEntry = registry.getModel(rule.sourceModel);
     if (!sourceEntry) throw new Error(`Model ${rule.sourceModel} não registrada.`);
-    let query = sourceEntry.mongooseModel.exists({
+    let query = sourceEntry.mongooseModel.exists(mergeScopedFilter(sourceEntry, {
       [rule.foreignField]: id,
       ...compileMongoMatch(rule.match),
-    });
+    }, options.accessContext));
     query = queryWithSession(query, options.session);
     if (await query) {
       throw new DomainRuleError(rule.message, {
@@ -436,15 +438,18 @@ async function withProcessTransaction(entry, work) {
     try {
       let result;
       await session.withTransaction(async () => {
+        transactionJobs.set(session, []);
         result = await work(session);
       }, {
         readConcern: { level: "snapshot" },
         writeConcern: { w: "majority" },
       });
+      for (const job of transactionJobs.get(session) || []) enqueueAsynchronousRecalculation(job.target, job.options);
       return result;
     } catch (error) {
       if (attempt === MAX_TRANSACTION_ATTEMPTS || !isTransientTransactionError(error)) throw error;
     } finally {
+      transactionJobs.delete(session);
       await session.endSession();
     }
   }
@@ -492,7 +497,7 @@ function collectDependentTargets(sourceEntry, before, after, changedFields) {
 async function recalculateTarget(entry, selectors, options = {}) {
   const clauses = selectors.map(({ field, value }) => ({ [field]: value }));
   if (!clauses.length) return { matched: 0, modified: 0 };
-  let query = entry.mongooseModel.find(clauses.length === 1 ? clauses[0] : { $or: clauses });
+  let query = entry.mongooseModel.find(mergeScopedFilter(entry, clauses.length === 1 ? clauses[0] : { $or: clauses }, options.accessContext));
   query = queryWithSession(query, options.session);
   const documents = await query.lean();
   if (!documents.length) return { matched: 0, modified: 0 };
@@ -513,7 +518,7 @@ async function recalculateTarget(entry, selectors, options = {}) {
     if (Object.keys(changed).length) {
       operations.push({
         updateOne: {
-          filter: { _id: documents[index]._id },
+          filter: scopedIdFilter(entry, documents[index]._id, options.accessContext),
           update: { $set: changed },
           // Only server-derived, validated changes reach this recalculation path.
           // readonly still rejects client writes in applyDomainMutation.
@@ -530,10 +535,14 @@ async function recalculateTarget(entry, selectors, options = {}) {
   return { matched: documents.length, modified: result.modifiedCount || 0 };
 }
 
-function enqueueAsynchronousRecalculation(target) {
+function enqueueAsynchronousRecalculation(target, options) {
+  // Capture a value, never a mutable request/session or the next user's context.
+  const accessContext = options.accessContext ? Object.freeze({ ...options.accessContext,
+    permissions: Object.freeze([...(options.accessContext.permissions || [])]) }) : undefined;
+  scopeFilter(target.entry, accessContext);
   asynchronousQueue = asynchronousQueue
     .then(() => new Promise((resolve) => setImmediate(resolve)))
-    .then(() => recalculateTarget(target.entry, target.selectors, { session: null }))
+    .then(() => recalculateTarget(target.entry, target.selectors, { session: null, accessContext }))
     .catch((error) => {
       // A fila não pode morrer silenciosamente nem bloquear novas tarefas.
       console.error("OON_PROCESS_ASYNC_RECALCULATION_FAILED", {
@@ -556,7 +565,12 @@ async function recalculateDependents(entry, before, after, options = {}) {
   const results = [];
   for (const target of targets) {
     if (target.mode === "async") {
-      enqueueAsynchronousRecalculation(target);
+      if (options.session?.inTransaction()) {
+        const jobs = transactionJobs.get(options.session);
+        if (!jobs) throw new DomainRuleError("Fila assíncrona exige transação gerenciada.", { code: "OON_PROCESS_TRANSACTION_REQUIRED", statusCode: 409 });
+        scopeFilter(target.entry, options.accessContext);
+        jobs.push({ target, options: { accessContext: options.accessContext ? { ...options.accessContext } : undefined } });
+      } else enqueueAsynchronousRecalculation(target, options);
       results.push({ model: target.entry.name, mode: "async" });
     } else {
       results.push({

package/src/manifest/referencePolicies.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const registry = require("../core/registry");
+const { mergeScopedFilter } = require("../core/tenancy");
 const { DomainRuleError, valuesEquivalent } = require("./domainRules");
 
 function idKey(value) {
@@ -83,7 +84,7 @@ async function assertReferencePolicies(entry, candidate, options = {}) {
 
   for (const group of grouped.values()) {
     let query = group.entry.mongooseModel
-      .find({ _id: { $in: [...group.ids.values()] } })
+      .find(mergeScopedFilter(group.entry, { _id: { $in: [...group.ids.values()] } }, options.accessContext))
       .select(requiredProjection(group.rules.map((item) => item.rule)));
     query = queryWithSession(query, options.session);
     const records = await query.lean();