@open-mercato/core 0.10.1-develop.7679.1.cb2c13f49e → 0.10.1-develop.7687.1.e1a6f9de51

package/src/modules/portal/i18n/de.json

@@ -64,6 +64,13 @@
   "portal.login.submit": "Anmelden",
   "portal.login.submitting": "Anmeldung…",
   "portal.login.title": "Anmelden",
+  "portal.magicLink.backToLogin": "Zurück zur Anmeldung",
+  "portal.magicLink.description": "Melden Sie sich mit dem Link aus Ihrer E-Mail im Portal an.",
+  "portal.magicLink.error.generic": "Anmeldung fehlgeschlagen. Bitte versuchen Sie es erneut.",
+  "portal.magicLink.error.invalidToken": "Dieser Anmeldelink ist ungültig oder abgelaufen. Fordern Sie einen neuen an.",
+  "portal.magicLink.error.missingToken": "Der Anmeldelink ist ungültig oder unvollständig.",
+  "portal.magicLink.submit": "Anmelden",
+  "portal.magicLink.title": "Mit einem Link anmelden",
   "portal.nav.account": "Konto",
   "portal.nav.dashboard": "Dashboard",
   "portal.nav.home": "Portal",

package/src/modules/portal/i18n/en.json

@@ -64,6 +64,13 @@
   "portal.login.submit": "Log In",
   "portal.login.submitting": "Logging in…",
   "portal.login.title": "Log In",
+  "portal.magicLink.backToLogin": "Back to sign in",
+  "portal.magicLink.description": "Continue to sign in to the portal with the link from your email.",
+  "portal.magicLink.error.generic": "Sign-in failed. Please try again.",
+  "portal.magicLink.error.invalidToken": "This sign-in link is invalid or has expired. Request a new one.",
+  "portal.magicLink.error.missingToken": "Sign-in link is invalid or incomplete.",
+  "portal.magicLink.submit": "Sign in",
+  "portal.magicLink.title": "Sign in with a link",
   "portal.nav.account": "Account",
   "portal.nav.dashboard": "Dashboard",
   "portal.nav.home": "Portal",

package/src/modules/portal/i18n/es.json

@@ -64,6 +64,13 @@
   "portal.login.submit": "Iniciar sesión",
   "portal.login.submitting": "Iniciando sesión…",
   "portal.login.title": "Iniciar sesión",
+  "portal.magicLink.backToLogin": "Volver al inicio de sesión",
+  "portal.magicLink.description": "Continúa para iniciar sesión en el portal con el enlace de tu correo.",
+  "portal.magicLink.error.generic": "Error al iniciar sesión. Inténtalo de nuevo.",
+  "portal.magicLink.error.invalidToken": "Este enlace de inicio de sesión no es válido o ha caducado. Solicita uno nuevo.",
+  "portal.magicLink.error.missingToken": "El enlace de inicio de sesión no es válido o está incompleto.",
+  "portal.magicLink.submit": "Iniciar sesión",
+  "portal.magicLink.title": "Inicia sesión con un enlace",
   "portal.nav.account": "Cuenta",
   "portal.nav.dashboard": "Panel",
   "portal.nav.home": "Portal",

package/src/modules/portal/i18n/ko.json

@@ -64,6 +64,13 @@
   "portal.login.submit": "로그인",
   "portal.login.submitting": "로그인 중…",
   "portal.login.title": "로그인",
+  "portal.magicLink.backToLogin": "로그인으로 돌아가기",
+  "portal.magicLink.description": "이메일의 링크로 포털에 로그인하려면 계속하세요.",
+  "portal.magicLink.error.generic": "로그인에 실패했습니다. 다시 시도하세요.",
+  "portal.magicLink.error.invalidToken": "이 로그인 링크가 유효하지 않거나 만료되었습니다. 새 링크를 요청하세요.",
+  "portal.magicLink.error.missingToken": "로그인 링크가 유효하지 않거나 불완전합니다.",
+  "portal.magicLink.submit": "로그인",
+  "portal.magicLink.title": "링크로 로그인",
   "portal.nav.account": "계정",
   "portal.nav.dashboard": "대시보드",
   "portal.nav.home": "포털",

package/src/modules/portal/i18n/pl.json

@@ -64,6 +64,13 @@
   "portal.login.submit": "Zaloguj się",
   "portal.login.submitting": "Logowanie…",
   "portal.login.title": "Logowanie",
+  "portal.magicLink.backToLogin": "Wróć do logowania",
+  "portal.magicLink.description": "Kontynuuj, aby zalogować się do portalu linkiem z wiadomości e-mail.",
+  "portal.magicLink.error.generic": "Logowanie nie powiodło się. Spróbuj ponownie.",
+  "portal.magicLink.error.invalidToken": "Ten link do logowania jest nieprawidłowy lub wygasł. Poproś o nowy.",
+  "portal.magicLink.error.missingToken": "Link do logowania jest nieprawidłowy lub niekompletny.",
+  "portal.magicLink.submit": "Zaloguj się",
+  "portal.magicLink.title": "Zaloguj się linkiem",
   "portal.nav.account": "Konto",
   "portal.nav.dashboard": "Panel",
   "portal.nav.home": "Portal",

package/src/modules/query_index/lib/engine.ts

@@ -17,6 +17,13 @@ import { readCoverageSnapshot, refreshCoverageSnapshot } from './coverage'
 import { createProfiler, shouldEnableProfiler, type Profiler } from '@open-mercato/shared/lib/profiler'
 import type { VectorIndexService } from '@open-mercato/search/vector'
 import { decryptIndexDocCustomFields } from '@open-mercato/shared/lib/encryption/indexDoc'
+import {
+  DECLINED_ENCRYPTED_SORT_LOG_MESSAGE,
+  DECRYPT_REFUSAL_LOG_MESSAGE,
+  DecryptRefusalTally,
+  resolveDecryptEnabled,
+  resolveDecryptScope,
+} from '@open-mercato/shared/lib/encryption/decryptScope'
 import {
   buildCustomFieldKindIndex,
   createCustomFieldKindMapResolver,
@@ -49,7 +56,13 @@ import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { buildContainmentPatterns } from '@open-mercato/shared/lib/search/containment'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from '@open-mercato/shared/lib/query/query-extension-runner'
 import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/ciphertext-search-warning'
-import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
+import {
+  matchEncryptedSortFields,
+  resolveEncryptedFieldNames,
+  resolveEncryptedSortFields,
+  resolveEncryptedSortMaxRows,
+  sortRowsInMemory,
+} from '@open-mercato/shared/lib/query/encrypted-sort'
 import { resolveListCountCap } from '@open-mercato/shared/lib/query/count-cap'
 import { resolveCfDefIndexOrgCandidates } from '@open-mercato/shared/lib/crud/custom-field-definition-index'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
@@ -776,7 +789,8 @@ export class HybridQueryEngine implements QueryEngine {
       const fallbackOrgId =
         opts.organizationId
         ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)
-      const encSvc = this.getEncryptionService()
+      const decryptEnabled = resolveDecryptEnabled(opts)
+      const encSvc = decryptEnabled ? this.getEncryptionService() : null
       const resolvedSorts: Sort[] = []
       for (const sort of opts.sort || []) {
         const field = String(sort.field)
@@ -787,14 +801,40 @@ export class HybridQueryEngine implements QueryEngine {
           if (baseField) resolvedSorts.push({ ...sort, field: baseField })
         }
       }
-      const encryptedSortFields = await resolveEncryptedSortFields(
+      const plainSortFields = resolvedSorts
+        .filter((sort) => !sort.field.startsWith('cf:'))
+        .map((sort) => sort.field)
+      const encryptedFieldNames = await resolveEncryptedFieldNames(
         encSvc,
         entity,
-        resolvedSorts.filter((sort) => !sort.field.startsWith('cf:')).map((sort) => sort.field),
         opts.tenantId ?? null,
         fallbackOrgId,
       )
+      const encryptedSortFields = matchEncryptedSortFields(encryptedFieldNames, plainSortFields)
       const requiresPlaintextSort = encryptedSortFields.size > 0
+      if (!decryptEnabled && plainSortFields.length > 0) {
+        const declinedSortFields = await resolveEncryptedSortFields(
+          this.getEncryptionService(),
+          entity,
+          plainSortFields,
+          opts.tenantId ?? null,
+          fallbackOrgId,
+        )
+        if (declinedSortFields.size > 0) {
+          logger.warn(DECLINED_ENCRYPTED_SORT_LOG_MESSAGE, {
+            entity: String(entity),
+            sortFields: Array.from(declinedSortFields),
+          })
+        }
+      }
+      const requestedFields = opts.fields && opts.fields.length ? opts.fields.map(String) : null
+      const injectsTenantIdForDecrypt =
+        encSvc != null
+        && hasTenantColumn
+        && requestedFields != null
+        && !requestedFields.includes('tenant_id')
+        && !requestedFields.includes('tenantId')
+        && (encryptedFieldNames === null || encryptedFieldNames.length > 0)
 
       const cfSortKeys = Array.from(new Set(
         resolvedSorts.filter((sort) => sort.field.startsWith('cf:')).map((sort) => sort.field.slice(3))
@@ -1177,6 +1217,7 @@ export class HybridQueryEngine implements QueryEngine {
       if (requiresPlaintextSort) {
         for (const field of encryptedSortFields) selectFieldSet.add(field)
       }
+      if (injectsTenantIdForDecrypt) selectFieldSet.add('tenant_id')
       if (opts.includeCustomFields === true) {
         const entityIds = Array.from(new Set(indexSources.map((src) => String(src.entityId))))
         try {
@@ -1304,20 +1345,28 @@ export class HybridQueryEngine implements QueryEngine {
         return customFieldKinds
       }
 
+      const refusalTally = new DecryptRefusalTally()
+
       const decryptRow = async (item: Record<string, unknown>): Promise<Record<string, unknown>> => {
         let next = item
+        if (!encSvc) return next
+        const decision = resolveDecryptScope({
+          rowTenantId: (next?.tenant_id ?? next?.tenantId ?? null) as string | null,
+          rowOrganizationId: (next?.organization_id ?? next?.organizationId ?? null) as string | null,
+          callerTenantId: opts.tenantId ?? null,
+          callerOrganizationId: fallbackOrgId ?? null,
+        })
+        if (!decision.decrypt) {
+          refusalTally.record(decision, next?.id == null ? null : String(next.id))
+          return next
+        }
         if (encSvc?.decryptEntityPayload) {
           const decrypt = encSvc.decryptEntityPayload.bind(encSvc) as (
             entityId: EntityId, payload: Record<string, unknown>, tenantId: string | null, organizationId: string | null,
             options?: { em?: EntityManager },
           ) => Promise<Record<string, unknown>>
           try {
-            const decrypted = await decrypt(
-              entity, next,
-              (next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null) as string | null,
-              (next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null) as string | null,
-              { em: this.em },
-            )
+            const decrypted = await decrypt(entity, next, decision.tenantId, decision.organizationId, { em: this.em })
             next = { ...next, ...decrypted }
           } catch (err) {
             logger.error('Error decrypting entity payload', { err })
@@ -1328,8 +1377,8 @@ export class HybridQueryEngine implements QueryEngine {
             // The kind is resolved against the very scope the value is decrypted with, so an
             // organization-specific definition can never type another organization's value.
             const cfScope = {
-              tenantId: (next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null) as string | null,
-              organizationId: (next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null) as string | null,
+              tenantId: decision.tenantId,
+              organizationId: decision.organizationId,
             }
             const resolveKinds = await resolveCustomFieldKinds()
             next = await decryptIndexDocCustomFields(
@@ -1341,6 +1390,11 @@ export class HybridQueryEngine implements QueryEngine {
         return next
       }
 
+      const reportDecryptRefusals = () => {
+        if (refusalTally.refused === 0) return
+        logger.warn(DECRYPT_REFUSAL_LOG_MESSAGE, refusalTally.toLogContext(String(entity)))
+      }
+
       let items: Record<string, unknown>[]
       let encryptedSortRowCapWarning: EncryptedSortRowCapWarning | undefined
 
@@ -1431,6 +1485,10 @@ export class HybridQueryEngine implements QueryEngine {
         ) as Record<string, unknown>[]
         items = await mapWithConcurrency(itemsRaw, DECRYPT_CONCURRENCY, decryptRow)
       }
+      reportDecryptRefusals()
+      if (injectsTenantIdForDecrypt) {
+        for (const row of items) delete row.tenant_id
+      }
       if (debugEnabled) this.debug('query:complete', { entity, total, items: items.length })
 
       const typedItems = items as unknown as T[]