@open-mercato/core 0.10.1-develop.7728.1.6b52eb2849 → 0.10.1-develop.7741.1.61a2652671

package/src/modules/api_keys/migrations/.snapshot-open-mercato.json

@@ -1,29 +1,63 @@
 {
+  "name": "public",
   "namespaces": [
     "public"
   ],
-  "name": "public",
   "tables": [
     {
+      "name": "api_keys",
+      "schema": "public",
       "columns": {
-        "id": {
-          "name": "id",
-          "type": "uuid",
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": false,
-          "default": "gen_random_uuid()",
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
-        "name": {
-          "name": "name",
-          "type": "text",
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": false,
-          "mappedType": "text"
+          "nullable": true,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
         "description": {
           "name": "description",
@@ -32,24 +66,48 @@
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "uuid",
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "mappedType": "uuid"
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
-        "organization_id": {
-          "name": "organization_id",
+        "id": {
+          "name": "id",
           "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
-          "primary": false,
-          "nullable": true,
+          "primary": true,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "gen_random_uuid()",
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
         "key_hash": {
@@ -59,6 +117,14 @@
           "autoincrement": false,
           "primary": false,
           "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
         "key_prefix": {
@@ -68,44 +134,101 @@
           "autoincrement": false,
           "primary": false,
           "nullable": false,
+          "unique": true,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "roles_json": {
-          "name": "roles_json",
-          "type": "jsonb",
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "mappedType": "json"
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "datetime"
         },
-        "created_by": {
-          "name": "created_by",
-          "type": "uuid",
+        "name": {
+          "name": "name",
+          "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": true,
-          "mappedType": "uuid"
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "text"
         },
-        "session_token": {
-          "name": "session_token",
+        "opencode_session_id": {
+          "name": "opencode_session_id",
           "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "session_user_id": {
-          "name": "session_user_id",
+        "organization_id": {
+          "name": "organization_id",
           "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "uuid"
         },
+        "roles_json": {
+          "name": "roles_json",
+          "type": "jsonb",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "json"
+        },
         "session_secret_encrypted": {
           "name": "session_secret_encrypted",
           "type": "text",
@@ -113,88 +236,129 @@
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "opencode_session_id": {
-          "name": "opencode_session_id",
+        "session_token": {
+          "name": "session_token",
           "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "text"
         },
-        "last_used_at": {
-          "name": "last_used_at",
-          "type": "timestamptz",
+        "session_token_hash": {
+          "name": "session_token_hash",
+          "type": "text",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "text"
         },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamptz",
+        "session_user_id": {
+          "name": "session_user_id",
+          "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamptz",
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
-          "nullable": false,
-          "length": 6,
-          "mappedType": "datetime"
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "uuid"
         },
         "updated_at": {
           "name": "updated_at",
-          "type": "timestamptz",
-          "unsigned": false,
-          "autoincrement": false,
-          "primary": false,
-          "nullable": true,
-          "length": 6,
-          "mappedType": "datetime"
-        },
-        "deleted_at": {
-          "name": "deleted_at",
-          "type": "timestamptz",
+          "type": "timestamptz(6)",
           "unsigned": false,
           "autoincrement": false,
           "primary": false,
           "nullable": true,
+          "unique": false,
           "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
           "mappedType": "datetime"
         }
       },
-      "name": "api_keys",
-      "schema": "public",
       "indexes": [
         {
-          "keyName": "api_keys_key_prefix_unique",
           "columnNames": [
             "key_prefix"
           ],
           "composite": false,
           "constraint": true,
+          "keyName": "api_keys_key_prefix_unique",
           "primary": false,
           "unique": true
         },
         {
-          "keyName": "api_keys_pkey",
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "api_keys_opencode_session_id_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null"
+        },
+        {
           "columnNames": [
             "id"
           ],
           "composite": false,
           "constraint": true,
+          "keyName": "api_keys_pkey",
           "primary": true,
           "unique": true
         },
@@ -202,16 +366,18 @@
           "columnNames": [],
           "composite": false,
           "constraint": false,
-          "keyName": "api_keys_opencode_session_id_uq",
+          "keyName": "api_keys_session_token_hash_uq",
           "primary": false,
           "unique": false,
-          "expression": "create unique index \"api_keys_opencode_session_id_uq\" on \"api_keys\" (\"opencode_session_id\") where \"opencode_session_id\" is not null and \"deleted_at\" is null"
+          "expression": "create unique index \"api_keys_session_token_hash_uq\" on \"api_keys\" (\"session_token_hash\") where \"session_token_hash\" is not null and \"deleted_at\" is null"
         }
       ],
       "checks": [],
+      "triggers": [],
       "foreignKeys": {},
-      "nativeEnums": {}
+      "comment": null
     }
   ],
+  "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/api_keys/migrations/Migration20261012202110_api_keys.ts

@@ -0,0 +1,47 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20261012202110_api_keys extends Migration {
+
+  override name = 'Migration20261012202110';
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "api_keys" add "session_token_hash" text null;`);
+
+    // Backfill before switching any lookup to the hash column (#2254). AI-chat session keys
+    // carry a 2-hour TTL and mint once per conversation (ai_assistant chat route, `!sessionId`
+    // branch) — a session already in flight when this deploys must keep resolving, or the
+    // conversation silently loses its MCP tool-call auth with no automatic re-mint. `sha256()`
+    // is a PostgreSQL 13+ built-in (no pgcrypto dependency) and matches
+    // `hashSessionToken`'s `createHash('sha256').update(token).digest('hex')` byte for byte.
+    this.addSql(`
+      update "api_keys"
+      set "session_token_hash" = encode(sha256("session_token"::bytea), 'hex')
+      where "session_token" is not null and "session_token_hash" is null;
+    `);
+
+    // Legacy rows embedded the raw token in `name` (`__session_<token>__`, for operator
+    // visibility in an admin listing) — the same credential leaking a second way. Replace it
+    // with a hash-derived, non-secret label before the token itself is cleared below.
+    this.addSql(`
+      update "api_keys"
+      set "name" = '__session_' || substr("session_token_hash", 1, 12) || '__'
+      where "session_token" is not null and "name" = '__session_' || "session_token" || '__';
+    `);
+
+    // Stop storing the plaintext bearer credential. The column is kept, not dropped, per the
+    // "renamed/removed DB column" rule in `.ai/review-checklist.md` (keep old column, add new
+    // one, backfill, deprecate old) — see `ApiKey.sessionToken`'s `@deprecated` doc comment for
+    // the removal criteria for a later migration.
+    this.addSql(`update "api_keys" set "session_token" = null where "session_token" is not null;`);
+
+    this.addSql(`create unique index "api_keys_session_token_hash_uq" on "api_keys" ("session_token_hash") where "session_token_hash" is not null and "deleted_at" is null;`);
+  }
+
+  override down(): void | Promise<void> {
+    // Schema-only reversal. The plaintext `session_token` values cleared above cannot be
+    // restored — that data loss is the point of the migration, not an oversight.
+    this.addSql(`drop index "api_keys_session_token_hash_uq";`);
+    this.addSql(`alter table "api_keys" drop column "session_token_hash";`);
+  }
+
+}

package/src/modules/api_keys/services/apiKeyService.ts

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto'
+import { randomBytes, createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { hash, compare } from 'bcryptjs'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
@@ -227,6 +227,17 @@ export function generateSessionToken(): string {
   return `sess_${randomBytes(16).toString('hex')}`
 }
 
+/**
+ * Hash a session token for storage/lookup (#2254). The session token is a bearer credential —
+ * it unlocks the decrypted API key secret and the user's ACL on the MCP server — so, mirroring
+ * `customer_accounts`' `hashToken`, only its hash is ever persisted. 128 bits of entropy from
+ * `generateSessionToken` is sufficient for a plain SHA-256 (no bcrypt cost needed, and a slow
+ * hash would just add latency to every MCP tool call that resolves a session).
+ */
+export function hashSessionToken(sessionToken: string): string {
+  return createHash('sha256').update(sessionToken).digest('hex')
+}
+
 /**
  * Create an ephemeral API key scoped to a chat session.
  * The key inherits the user's roles and expires after ttlMinutes (default 30).
@@ -244,12 +255,16 @@ export async function createSessionApiKey(
   // Encrypt the secret for later retrieval (used by MCP server for API calls)
   const encryptedSecret = await encryptSessionSecret(secret, input.tenantId ?? null)
 
+  // Hash before storage (#2254) — the row (and its `name` column, previously embedding the raw
+  // token for operator visibility) must never carry the live bearer credential in the clear.
+  const sessionTokenHash = hashSessionToken(input.sessionToken)
+
   const roleIds = Array.from(new Set(input.userRoles.filter(Boolean))).sort((left, right) => left.localeCompare(right))
   let record!: ApiKey
   await withAtomicFlush(em, [async () => {
     await lockRoleWriterAuthorizationState(em, roleIds)
     record = em.create(ApiKey, {
-      name: `__session_${input.sessionToken}__`,
+      name: `__session_${sessionTokenHash.slice(0, 12)}__`,
       description: 'Ephemeral session API key for AI chat',
       tenantId: input.tenantId ?? null,
       organizationId: input.organizationId ?? null,
@@ -257,7 +272,7 @@ export async function createSessionApiKey(
       keyPrefix: prefix,
       rolesJson: roleIds,
       createdBy: input.userId,
-      sessionToken: input.sessionToken,
+      sessionTokenHash,
       sessionUserId: input.userId,
       sessionSecretEncrypted: encryptedSecret,
       expiresAt,
@@ -283,10 +298,26 @@ export async function findApiKeyBySessionToken(
 ): Promise<ApiKey | null> {
   if (!sessionToken) return null
 
-  const record = await em.findOne(ApiKey, {
-    sessionToken,
-    deletedAt: null,
-  })
+  // Looked up by hash, never by the raw token (#2254).
+  const sessionTokenHash = hashSessionToken(sessionToken)
+  let record = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })
+
+  if (!record) {
+    // Version-skew fallback (#7304): during a rolling deploy/rollback window the app and the
+    // separate MCP process can briefly run different code versions. A row minted by
+    // pre-#2254 code in that window carries only the plaintext token (sessionTokenHash is
+    // still null) — fall back to it so the session still resolves instead of answering a
+    // false SESSION_EXPIRED, then self-heal the row onto the hash immediately so this is the
+    // only lookup that ever sees the plaintext, and the window closes as soon as each
+    // outstanding legacy row is touched once.
+    const legacyRecord = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+    if (legacyRecord) {
+      legacyRecord.sessionTokenHash = sessionTokenHash
+      legacyRecord.sessionToken = null
+      await em.persist(legacyRecord).flush()
+      record = legacyRecord
+    }
+  }
 
   if (!record) return null
   if (record.expiresAt && record.expiresAt.getTime() < Date.now()) return null
@@ -392,14 +423,29 @@ export async function deleteSessionApiKey(
   em: EntityManager,
   sessionToken: string
 ): Promise<void> {
-  const candidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+  // Looked up and re-checked by hash, never by the raw token (#2254). Deliberately does not
+  // call findApiKeyBySessionToken: that helper also drops already-expired rows, but deleting
+  // an expired-but-not-yet-cleaned-up row must still work here.
+  const sessionTokenHash = hashSessionToken(sessionToken)
+  let candidate = await em.findOne(ApiKey, { sessionTokenHash, deletedAt: null })
+  if (!candidate) {
+    // Version-skew fallback (#7304): see findApiKeyBySessionToken for the full rationale — a
+    // row minted by pre-#2254 code during a deploy window is plaintext-only until touched.
+    const legacyCandidate = await em.findOne(ApiKey, { sessionToken, deletedAt: null })
+    if (legacyCandidate) {
+      legacyCandidate.sessionTokenHash = sessionTokenHash
+      legacyCandidate.sessionToken = null
+      await em.persist(legacyCandidate).flush()
+      candidate = legacyCandidate
+    }
+  }
   if (!candidate) return
   let deletedId: string | null = null
   await withAtomicFlush(em, [async () => {
     const records = await lockAuthorizationApiKeyRows(em, [String(candidate.id)])
     const record = records.find((entry) => (
       String(entry.id) === String(candidate.id)
-      && entry.sessionToken === sessionToken
+      && entry.sessionTokenHash === sessionTokenHash
       && !entry.deletedAt
     ))
     if (!record) return

package/src/modules/attachments/lib/ocrService.ts

@@ -155,6 +155,14 @@ export class OcrService {
           guidance = 'Rate limit exceeded. Please try again later.'
           break
         default:
+          if (err?.name === 'TimeoutError') {
+            guidance = `OCR request timed out: ${rawMessage}`
+            break
+          }
+          if (err?.name === 'AbortError') {
+            guidance = `OCR request was aborted: ${rawMessage}`
+            break
+          }
           guidance = rawMessage.includes('https://')
             ? rawMessage
             : `${rawMessage}. Check OPENAI_API_KEY.`

package/src/modules/auth/api/logout.ts

@@ -86,6 +86,8 @@ export async function POST(req: Request) {
   const res = buildSafeRedirectResponse(req, '/login')
   res.cookies.set('auth_token', '', { path: '/', maxAge: 0 })
   res.cookies.set('session_token', '', { path: '/', maxAge: 0 })
+  res.cookies.set('om_selected_org', '', { path: '/', maxAge: 0 })
+  res.cookies.set('om_selected_tenant', '', { path: '/', maxAge: 0 })
   return res
 }
 
@@ -99,7 +101,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     POST: {
       summary: 'Invalidate session and redirect',
-      description: 'Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies, and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither cookie is only redirected.',
+      description: 'Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies together with the organization-scope cookies (`om_selected_org`, `om_selected_tenant`), and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither session cookie is only redirected.',
       responses: [
         { status: 307, description: 'Redirect to login after successful logout', mediaType: 'text/html' },
       ],

package/src/modules/auth/i18n/de.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Einreichungsdaten exportieren (Datenübertragbarkeit, DSGVO Art. 15/20)",
   "auth.acl.features.forms.submissions.manage": "Einreichungen verwalten (erneut öffnen, Beteiligte zuweisen, exportieren)",
   "auth.acl.features.forms.view": "Formulare und Einreichungen ansehen",
+  "auth.acl.features.gateway_autopay.configure": "Configure Autopay gateway settings",
+  "auth.acl.features.gateway_autopay.view": "View Autopay gateway configuration",
   "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
   "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
   "auth.acl.features.gateway_tpay.configure": "Tpay-Gateway-Einstellungen konfigurieren",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Example Module",
   "auth.acl.modules.example_customers_sync": "Example Customers Sync",
   "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_autopay": "Autopay Payment Gateway",
   "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
   "auth.acl.modules.gateway_tpay": "Tpay-Zahlungsgateway",
   "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",