@open-mercato/core 0.10.1-develop.7679.1.cb2c13f49e → 0.10.1-develop.7687.1.e1a6f9de51

package/dist/modules/query_index/lib/engine.js

@@ -12,6 +12,13 @@ import { sql } from "kysely";
 import { readCoverageSnapshot, refreshCoverageSnapshot } from "./coverage.js";
 import { createProfiler, shouldEnableProfiler } from "@open-mercato/shared/lib/profiler";
 import { decryptIndexDocCustomFields } from "@open-mercato/shared/lib/encryption/indexDoc";
+import {
+  DECLINED_ENCRYPTED_SORT_LOG_MESSAGE,
+  DECRYPT_REFUSAL_LOG_MESSAGE,
+  DecryptRefusalTally,
+  resolveDecryptEnabled,
+  resolveDecryptScope
+} from "@open-mercato/shared/lib/encryption/decryptScope";
 import {
   buildCustomFieldKindIndex,
   createCustomFieldKindMapResolver,
@@ -37,7 +44,13 @@ import { tokenizeText } from "@open-mercato/shared/lib/search/tokenize";
 import { buildContainmentPatterns } from "@open-mercato/shared/lib/search/containment";
 import { runBeforeQueryPipeline, runAfterQueryPipeline } from "@open-mercato/shared/lib/query/query-extension-runner";
 import { warnOnCiphertextLikeFallback } from "@open-mercato/shared/lib/query/ciphertext-search-warning";
-import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from "@open-mercato/shared/lib/query/encrypted-sort";
+import {
+  matchEncryptedSortFields,
+  resolveEncryptedFieldNames,
+  resolveEncryptedSortFields,
+  resolveEncryptedSortMaxRows,
+  sortRowsInMemory
+} from "@open-mercato/shared/lib/query/encrypted-sort";
 import { resolveListCountCap } from "@open-mercato/shared/lib/query/count-cap";
 import { resolveCfDefIndexOrgCandidates } from "@open-mercato/shared/lib/crud/custom-field-definition-index";
 import { mapWithConcurrency } from "@open-mercato/shared/lib/query/bounded-decrypt";
@@ -584,7 +597,8 @@ class HybridQueryEngine {
         return null;
       };
       const fallbackOrgId = opts.organizationId ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null);
-      const encSvc = this.getEncryptionService();
+      const decryptEnabled = resolveDecryptEnabled(opts);
+      const encSvc = decryptEnabled ? this.getEncryptionService() : null;
       const resolvedSorts = [];
       for (const sort of opts.sort || []) {
         const field = String(sort.field);
@@ -595,14 +609,32 @@ class HybridQueryEngine {
           if (baseField) resolvedSorts.push({ ...sort, field: baseField });
         }
       }
-      const encryptedSortFields = await resolveEncryptedSortFields(
+      const plainSortFields = resolvedSorts.filter((sort) => !sort.field.startsWith("cf:")).map((sort) => sort.field);
+      const encryptedFieldNames = await resolveEncryptedFieldNames(
         encSvc,
         entity,
-        resolvedSorts.filter((sort) => !sort.field.startsWith("cf:")).map((sort) => sort.field),
         opts.tenantId ?? null,
         fallbackOrgId
       );
+      const encryptedSortFields = matchEncryptedSortFields(encryptedFieldNames, plainSortFields);
       const requiresPlaintextSort = encryptedSortFields.size > 0;
+      if (!decryptEnabled && plainSortFields.length > 0) {
+        const declinedSortFields = await resolveEncryptedSortFields(
+          this.getEncryptionService(),
+          entity,
+          plainSortFields,
+          opts.tenantId ?? null,
+          fallbackOrgId
+        );
+        if (declinedSortFields.size > 0) {
+          logger.warn(DECLINED_ENCRYPTED_SORT_LOG_MESSAGE, {
+            entity: String(entity),
+            sortFields: Array.from(declinedSortFields)
+          });
+        }
+      }
+      const requestedFields = opts.fields && opts.fields.length ? opts.fields.map(String) : null;
+      const injectsTenantIdForDecrypt = encSvc != null && hasTenantColumn && requestedFields != null && !requestedFields.includes("tenant_id") && !requestedFields.includes("tenantId") && (encryptedFieldNames === null || encryptedFieldNames.length > 0);
       const cfSortKeys = Array.from(new Set(
         resolvedSorts.filter((sort) => sort.field.startsWith("cf:")).map((sort) => sort.field.slice(3))
       ));
@@ -923,6 +955,7 @@ class HybridQueryEngine {
       if (requiresPlaintextSort) {
         for (const field of encryptedSortFields) selectFieldSet.add(field);
       }
+      if (injectsTenantIdForDecrypt) selectFieldSet.add("tenant_id");
       if (opts.includeCustomFields === true) {
         const entityIds = Array.from(new Set(indexSources.map((src) => String(src.entityId))));
         try {
@@ -1020,18 +1053,24 @@ class HybridQueryEngine {
         }
         return customFieldKinds;
       };
+      const refusalTally = new DecryptRefusalTally();
       const decryptRow = async (item) => {
         let next = item;
+        if (!encSvc) return next;
+        const decision = resolveDecryptScope({
+          rowTenantId: next?.tenant_id ?? next?.tenantId ?? null,
+          rowOrganizationId: next?.organization_id ?? next?.organizationId ?? null,
+          callerTenantId: opts.tenantId ?? null,
+          callerOrganizationId: fallbackOrgId ?? null
+        });
+        if (!decision.decrypt) {
+          refusalTally.record(decision, next?.id == null ? null : String(next.id));
+          return next;
+        }
         if (encSvc?.decryptEntityPayload) {
           const decrypt = encSvc.decryptEntityPayload.bind(encSvc);
           try {
-            const decrypted = await decrypt(
-              entity,
-              next,
-              next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null,
-              next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null,
-              { em: this.em }
-            );
+            const decrypted = await decrypt(entity, next, decision.tenantId, decision.organizationId, { em: this.em });
             next = { ...next, ...decrypted };
           } catch (err) {
             logger.error("Error decrypting entity payload", { err });
@@ -1040,8 +1079,8 @@ class HybridQueryEngine {
         if (encSvc) {
           try {
             const cfScope = {
-              tenantId: next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null,
-              organizationId: next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null
+              tenantId: decision.tenantId,
+              organizationId: decision.organizationId
             };
             const resolveKinds = await resolveCustomFieldKinds();
             next = await decryptIndexDocCustomFields(
@@ -1056,6 +1095,10 @@ class HybridQueryEngine {
         }
         return next;
       };
+      const reportDecryptRefusals = () => {
+        if (refusalTally.refused === 0) return;
+        logger.warn(DECRYPT_REFUSAL_LOG_MESSAGE, refusalTally.toLogContext(String(entity)));
+      };
       let items;
       let encryptedSortRowCapWarning;
       if (requiresPlaintextSort) {
@@ -1136,6 +1179,10 @@ class HybridQueryEngine {
         );
         items = await mapWithConcurrency(itemsRaw, DECRYPT_CONCURRENCY, decryptRow);
       }
+      reportDecryptRefusals();
+      if (injectsTenantIdForDecrypt) {
+        for (const row of items) delete row.tenant_id;
+      }
       if (debugEnabled) this.debug("query:complete", { entity, total, items: items.length });
       const typedItems = items;
       let result = { items: typedItems, page, pageSize, total };