@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7748.1.d745ba61aa

package/src/modules/attachments/lib/access-registry.ts

@@ -0,0 +1,117 @@
+import { matchesEntity } from '@open-mercato/shared/lib/crud/mutation-guard-registry'
+import { attachmentAccessResolverSchema, protectedAttachmentTargetSchema } from '../data/validators'
+import type {
+  AttachmentAccessAction,
+  AttachmentAccessRecord,
+  AttachmentAccessResolver,
+  AttachmentAccessResolverEntry,
+  AttachmentAccessTarget,
+  ProtectedAttachmentTarget,
+} from './access-types'
+
+const GLOBAL_KEY = '__openMercatoAttachmentAccessRegistry__'
+
+type RegisteredResolver = AttachmentAccessResolver & {
+  moduleOrder: number
+  declarationOrder: number
+}
+
+type Registry = {
+  invalid: boolean
+  resolvers: readonly RegisteredResolver[]
+  protectedTargets: readonly ProtectedAttachmentTarget[]
+}
+
+const emptyRegistry: Registry = Object.freeze({ invalid: false, resolvers: [], protectedTargets: [] })
+
+export function getAttachmentAccessRegistry(): Registry {
+  return (globalThis as Record<string, unknown>)[GLOBAL_KEY] as Registry | undefined ?? emptyRegistry
+}
+
+export function registerAttachmentAccessResolvers(entries: readonly AttachmentAccessResolverEntry[]): void {
+  const globalState = globalThis as Record<string, unknown>
+  globalState[GLOBAL_KEY] = { invalid: true, resolvers: [], protectedTargets: [] } satisfies Registry
+  const resolvers: RegisteredResolver[] = []
+  const protectedTargets: ProtectedAttachmentTarget[] = []
+  const ids = new Set<string>()
+  for (const [moduleOrder, entry] of entries.entries()) {
+    if (typeof entry.moduleId !== 'string' || !entry.moduleId || !Array.isArray(entry.resolvers)) {
+      throw new Error('[internal] Invalid attachment access registry entry')
+    }
+    for (const [declarationOrder, raw] of entry.resolvers.entries()) {
+      const resolver = attachmentAccessResolverSchema.parse(raw)
+      if (!resolver.id.startsWith(`${entry.moduleId}.`) || ids.has(resolver.id)) {
+        throw new Error('[internal] Attachment access resolver IDs must be unique and owned by their module')
+      }
+      ids.add(resolver.id)
+      resolvers.push(Object.freeze({
+        ...resolver,
+        actions: resolver.actions ? Object.freeze([...resolver.actions]) : undefined,
+        moduleOrder,
+        declarationOrder,
+      }))
+    }
+    for (const raw of entry.protectedTargets ?? []) {
+      const target = protectedAttachmentTargetSchema.parse(raw)
+      if (!target.resolverId.startsWith(`${entry.moduleId}.`)) {
+        throw new Error('[internal] Attachment access requirements must name their module resolver')
+      }
+      protectedTargets.push(Object.freeze(target))
+    }
+  }
+  resolvers.sort((left, right) => (
+    (left.priority ?? 50) - (right.priority ?? 50)
+    || left.moduleOrder - right.moduleOrder
+    || left.declarationOrder - right.declarationOrder
+  ))
+  globalState[GLOBAL_KEY] = Object.freeze({
+    invalid: false,
+    resolvers: Object.freeze(resolvers),
+    protectedTargets: Object.freeze(protectedTargets),
+  }) satisfies Registry
+}
+
+export function matchesAttachmentAccessSelector(selector: string, value: string): boolean {
+  return matchesEntity(selector, value)
+}
+
+export function matchesAttachmentAccessTargets(selector: string, targets: readonly AttachmentAccessTarget[]): boolean {
+  return selector === '*' || targets.some((target) => matchesAttachmentAccessSelector(selector, target.entityId))
+}
+
+export function matchesAttachmentAccessResolver(
+  resolver: AttachmentAccessResolver,
+  partitionCode: string,
+  targets: readonly AttachmentAccessTarget[],
+  action: AttachmentAccessAction,
+): boolean {
+  return matchesAttachmentAccessSelector(resolver.targetPartition, partitionCode)
+    && matchesAttachmentAccessTargets(resolver.targetEntity ?? '*', targets)
+    && (!resolver.actions || resolver.actions.includes(action))
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+export function collectAttachmentAccessTargets(attachment: AttachmentAccessRecord): readonly AttachmentAccessTarget[] {
+  const targets: AttachmentAccessTarget[] = []
+  function append(entityId: unknown, recordId: unknown, origin: AttachmentAccessTarget['origin']) {
+    if (typeof entityId !== 'string' || !entityId.trim()) return
+    const target = Object.freeze({
+      entityId: entityId.trim(),
+      recordId: typeof recordId === 'string' ? recordId.trim() : '',
+      origin,
+    })
+    if (!targets.some((candidate) => candidate.entityId === target.entityId && candidate.recordId === target.recordId)) {
+      targets.push(target)
+    }
+  }
+  append(attachment.entityId, attachment.recordId, 'primary')
+  const assignments = isRecord(attachment.storageMetadata) ? attachment.storageMetadata.assignments : undefined
+  const entries = Array.isArray(assignments) ? assignments : isRecord(assignments) ? [assignments] : []
+  for (const assignment of entries) {
+    if (isRecord(assignment)) append(assignment.type, assignment.id, 'assignment')
+  }
+  return Object.freeze(targets)
+}

package/src/modules/attachments/lib/access-runner.ts

@@ -0,0 +1,183 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import type { Attachment, AttachmentPartition } from '../data/entities'
+import { attachmentAccessDecisionSchema, attachmentAccessRequirementsSchema, attachmentAccessSubjectFeaturesSchema } from '../data/validators'
+import { checkAttachmentAccess } from './access'
+import {
+  collectAttachmentAccessTargets,
+  getAttachmentAccessRegistry,
+  matchesAttachmentAccessResolver,
+  matchesAttachmentAccessSelector,
+  matchesAttachmentAccessTargets,
+} from './access-registry'
+import type {
+  AttachmentAccessAction, AttachmentAccessDecision, AttachmentAccessPartition,
+  AttachmentAccessRecord, AttachmentAccessSubject,
+} from './access-types'
+
+const logger = createLogger('attachments').child({ component: 'access' })
+const DEFAULT_TIMEOUT_MS = 1500
+
+type RbacProjectionService = {
+  loadAcl(subject: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<{
+    isSuperAdmin: boolean; organizations: string[] | null
+  }>
+  getEffectiveFeatures(subject: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<string[]>
+}
+
+export type AttachmentAccessContext = {
+  container: AwilixContainer
+  subjects: Map<string, Promise<AttachmentAccessSubject>>
+  resolverCaches: Map<string, Map<string, unknown>>
+}
+
+export function createAttachmentAccessContext(container: AwilixContainer): AttachmentAccessContext {
+  return { container, subjects: new Map(), resolverCaches: new Map() }
+}
+
+export type AttachmentAccessResult = AttachmentAccessDecision & { protected: boolean }
+
+class AccessTimeout extends Error {}
+
+async function withinBudget<Result>(work: () => Promise<Result>, timeoutMs: number, controller: AbortController): Promise<Result> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      Promise.resolve().then(work),
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(() => {
+          controller.abort()
+          reject(new AccessTimeout('[internal] Attachment access evaluation timed out'))
+        }, timeoutMs)
+      }),
+    ])
+  } finally {
+    if (timer) clearTimeout(timer)
+  }
+}
+
+async function projectSubject(
+  context: AttachmentAccessContext,
+  auth: NonNullable<AuthContext>,
+  attachment: AttachmentAccessRecord,
+): Promise<AttachmentAccessSubject> {
+  const scope = {
+    tenantId: attachment.tenantId ?? auth.tenantId ?? null,
+    organizationId: attachment.organizationId ?? auth.orgId ?? null,
+  }
+  const key = JSON.stringify([auth.sub, scope.tenantId, scope.organizationId])
+  let pending = context.subjects.get(key)
+  if (!pending) {
+    pending = (async () => {
+      const rbac = context.container.resolve<RbacProjectionService>('rbacService')
+      const acl = await rbac.loadAcl(auth.sub, scope)
+      const userFeatures = attachmentAccessSubjectFeaturesSchema.parse(await rbac.getEffectiveFeatures(auth.sub, scope))
+      if (typeof acl.isSuperAdmin !== 'boolean') {
+        throw new Error('[internal] Invalid attachment subject projection')
+      }
+      if (!acl.isSuperAdmin && acl.organizations && scope.organizationId
+        && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes('__all__')) {
+        throw new Error('[internal] Attachment subject is outside its current organization grants')
+      }
+      return Object.freeze({
+        auth: Object.freeze({
+          sub: auth.sub, tenantId: scope.tenantId, orgId: scope.organizationId,
+          isApiKey: auth.isApiKey === true, userId: auth.userId, keyId: auth.keyId,
+          isSuperAdmin: acl.isSuperAdmin,
+        }),
+        ...scope,
+        userFeatures: Object.freeze([...userFeatures]),
+        isSuperAdmin: acl.isSuperAdmin,
+      })
+    })()
+    context.subjects.set(key, pending)
+  }
+  return pending
+}
+
+export async function evaluateAttachmentAccess(input: {
+  auth: AuthContext | undefined
+  attachment: AttachmentAccessRecord
+  partition: AttachmentAccessPartition
+  action: AttachmentAccessAction
+  context?: AttachmentAccessContext | null
+  requireAuthForPublic?: boolean
+}): Promise<AttachmentAccessResult> {
+  const { auth, attachment, partition, action, context } = input
+  const baseline = checkAttachmentAccess(auth, attachment as Attachment, partition as AttachmentPartition, { requireAuthForPublic: input.requireAuthForPublic })
+  if (!baseline.ok) return { ok: false, status: baseline.status === 401 ? 401 : 403, reason: 'scope', protected: false }
+  const deny = (status: 401 | 403 | 404 | 504, reason: string, resolverId?: string): AttachmentAccessResult => {
+    logger.info('Attachment owner access denied', { resolverId, action, attachmentId: attachment.id, reason })
+    return { ok: false, status, reason, protected: true }
+  }
+  const registry = getAttachmentAccessRegistry()
+  if (registry.invalid) return deny(403, 'invalid_registry')
+  const parsedRequirements = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? [])
+  if (!parsedRequirements.success) return deny(403, 'invalid_requirements')
+  const targets = collectAttachmentAccessTargets(attachment)
+  const requirements = [...parsedRequirements.data, ...registry.protectedTargets.filter((target) => (
+    matchesAttachmentAccessSelector(target.targetPartition, partition.code)
+  ))].filter((requirement) => matchesAttachmentAccessTargets(requirement.targetEntity, targets))
+  const resolvers = registry.resolvers.filter((resolver) => matchesAttachmentAccessResolver(resolver, partition.code, targets, action))
+  if (!requirements.length && !resolvers.length) return { ok: true, protected: false }
+  if (!auth) return deny(401, 'authentication_required')
+  for (const requirement of requirements) {
+    const requiredTargets = targets.filter((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId))
+    const provider = resolvers.find((resolver) => resolver.id === requirement.resolverId)
+    if (!provider || (requiredTargets.length
+      ? requiredTargets.some((target) => !matchesAttachmentAccessSelector(provider.targetEntity ?? '*', target.entityId))
+      : (provider.targetEntity ?? '*') !== '*')) return deny(403, 'required_resolver_missing', requirement.resolverId)
+    if (targets.some((target) => matchesAttachmentAccessSelector(requirement.targetEntity, target.entityId) && !target.recordId)) {
+      return deny(403, 'invalid_owner', requirement.resolverId)
+    }
+  }
+  if (!context) return deny(403, 'policy_context_missing')
+  let subject: AttachmentAccessSubject
+  try {
+    subject = await withinBudget(() => projectSubject(context, auth, attachment), DEFAULT_TIMEOUT_MS, new AbortController())
+  } catch (error) {
+    getTelemetryRuntime()?.reportError(new Error('[internal] Attachment subject projection failed'), {
+      module: 'attachments', code: 'attachments.subject_projection_failed', attributes: { attachmentId: attachment.id, action },
+    })
+    return deny(error instanceof AccessTimeout ? 504 : 403, 'subject_projection_failed')
+  }
+  const liveBaseline = checkAttachmentAccess({ ...auth, roles: [], isSuperAdmin: subject.isSuperAdmin }, attachment as Attachment, partition as AttachmentPartition, { requireAuthForPublic: input.requireAuthForPublic })
+  if (!liveBaseline.ok) return deny(403, 'current_scope')
+  for (const resolver of resolvers) {
+    const controller = new AbortController()
+    let cache = context.resolverCaches.get(resolver.id)
+    if (!cache) {
+      cache = new Map()
+      context.resolverCaches.set(resolver.id, cache)
+    }
+    try {
+      const raw = await withinBudget(() => resolver.resolve(Object.freeze({
+        action, subject,
+        attachment: Object.freeze({
+          id: attachment.id, entityId: attachment.entityId, recordId: attachment.recordId,
+          partitionCode: attachment.partitionCode, tenantId: attachment.tenantId,
+          organizationId: attachment.organizationId, fileName: attachment.fileName, mimeType: attachment.mimeType,
+        }),
+        partition: Object.freeze({
+          code: partition.code, isPublic: partition.isPublic,
+          tenantId: partition.tenantId, organizationId: partition.organizationId,
+        }),
+        targets, container: context.container, cache, signal: controller.signal,
+      })), resolver.timeoutMs ?? DEFAULT_TIMEOUT_MS, controller)
+      const decision = attachmentAccessDecisionSchema.parse(raw)
+      if (!decision.ok) return deny(decision.status, decision.reason, resolver.id)
+    } catch (error) {
+      controller.abort()
+      getTelemetryRuntime()?.reportError(new Error(error instanceof AccessTimeout
+        ? '[internal] Attachment resolver exceeded its time budget'
+        : '[internal] Attachment resolver failed or returned an invalid decision'), {
+        module: 'attachments', code: 'attachments.resolver_failed',
+        attributes: { resolverId: resolver.id, attachmentId: attachment.id, action },
+      })
+      return deny(error instanceof AccessTimeout ? 504 : 403, error instanceof AccessTimeout ? 'resolver_timeout' : 'resolver_failed', resolver.id)
+    }
+  }
+  return { ok: true, protected: true }
+}

package/src/modules/attachments/lib/access-types.ts

@@ -0,0 +1,78 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+
+export type AttachmentAccessAction = 'read' | 'render' | 'metadata' | 'reassign' | 'delete' | 'export'
+
+export type AttachmentAccessTarget = Readonly<{
+  entityId: string
+  recordId: string
+  origin: 'primary' | 'assignment'
+}>
+
+export type AttachmentAccessRequirement = Readonly<{
+  resolverId: string
+  targetEntity: string
+}>
+
+export type ProtectedAttachmentTarget = AttachmentAccessRequirement & Readonly<{
+  targetPartition: string
+}>
+
+export type AttachmentAccessRecord = {
+  id: string
+  entityId: string
+  recordId: string
+  partitionCode: string
+  tenantId?: string | null
+  organizationId?: string | null
+  fileName: string
+  mimeType: string
+  storageMetadata?: unknown
+}
+
+export type AttachmentAccessPartition = {
+  code: string
+  isPublic: boolean
+  tenantId?: string | null
+  organizationId?: string | null
+  accessResolverRequirements?: unknown
+}
+
+export type AttachmentAccessSubject = Readonly<{
+  auth: Readonly<NonNullable<AuthContext>>
+  userFeatures: readonly string[]
+  tenantId: string | null
+  organizationId: string | null
+  isSuperAdmin: boolean
+}>
+
+export type AttachmentAccessInput = Readonly<{
+  action: AttachmentAccessAction
+  subject: AttachmentAccessSubject
+  attachment: Readonly<Omit<AttachmentAccessRecord, 'storageMetadata'>>
+  partition: Readonly<Omit<AttachmentAccessPartition, 'accessResolverRequirements'>>
+  targets: readonly AttachmentAccessTarget[]
+  container: AwilixContainer
+  cache: Map<string, unknown>
+  signal: AbortSignal
+}>
+
+export type AttachmentAccessDecision =
+  | { ok: true }
+  | { ok: false; status: 401 | 403 | 404 | 504; reason: string }
+
+export type AttachmentAccessResolver = Readonly<{
+  id: string
+  targetPartition: string
+  targetEntity?: string
+  actions?: readonly AttachmentAccessAction[]
+  priority?: number
+  timeoutMs?: number
+  resolve(input: AttachmentAccessInput): Promise<AttachmentAccessDecision>
+}>
+
+export type AttachmentAccessResolverEntry = {
+  moduleId: string
+  resolvers: readonly unknown[]
+  protectedTargets?: readonly unknown[]
+}

package/src/modules/attachments/lib/attachment-service.ts

@@ -1,3 +1,5 @@
+import { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'
+import { throwAttachmentAccessError } from './access-errors'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -249,6 +251,7 @@ export class DefaultAttachmentService implements AttachmentService {
     private readonly em: EntityManager,
     private readonly storageDriverFactory: StorageDriverFactory,
     private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,
+    private readonly resolveAccessContext?: (() => AttachmentAccessContext) | null,
   ) {}
 
   validateUpload(input: {
@@ -368,10 +371,11 @@ export class DefaultAttachmentService implements AttachmentService {
     )
     if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })
 
-    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true })
-    if (!access.ok) {
-      throw new CrudHttpError(access.status, { error: access.status === 401 ? 'Unauthorized' : 'Forbidden' })
-    }
+    const access = await evaluateAttachmentAccess({
+      auth: input.auth, attachment, partition, action: 'read',
+      context: this.resolveAccessContext?.(), requireAuthForPublic: true,
+    })
+    if (!access.ok) await throwAttachmentAccessError(access.status)
     if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {
       throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })
     }

package/src/modules/attachments/lib/createFromBuffer.ts

@@ -8,6 +8,7 @@ import { buildAttachmentFileUrl } from './imageUrls'
 import { mergeAttachmentMetadata, upsertAssignment } from './metadata'
 import { assertAttachmentScopeInvariant } from './access'
 import { attachmentCrudEvents, attachmentCrudIndexer } from './crud'
+import { ensureAttachmentPartitionProtection } from './access-protection'
 
 /** DataEngine handle whose exact type is derived from `emitCrudSideEffects` (no `any`). */
 type CrudDataEngine = Parameters<typeof emitCrudSideEffects>[0]['dataEngine']
@@ -58,6 +59,8 @@ export async function createAttachmentFromBuffer(input: CreateAttachmentFromBuff
   }
   if (!partition) throw new Error(`[internal] attachment partition "${code}" is not available`)
 
+  await ensureAttachmentPartitionProtection(em, partition)
+
   const driver = await new StorageDriverFactory(em).resolveForPartition(partition.code, {
     tenantId: input.tenantId,
     organizationId: input.organizationId,

package/src/modules/attachments/lib/partitions.ts

@@ -3,6 +3,7 @@ import { AttachmentPartition } from '../data/entities'
 import { resolveDefaultAttachmentOcrEnabled } from './ocrConfig'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { E } from '#generated/entities.ids.generated'
+import { getDeclaredAttachmentAccessRequirements } from './access-protection'
 
 export type AttachmentPartitionSeed = {
   code: string
@@ -43,7 +44,6 @@ export async function ensureDefaultPartitions(em: EntityManager): Promise<void>
   const existing = await repo.findAll({ fields: ['code'] })
   const existingCodes = new Set(existing.map((entry) => entry.code))
   const pending = DEFAULT_ATTACHMENT_PARTITIONS.filter((seed) => !existingCodes.has(seed.code))
-  if (!pending.length) return
   for (const seed of pending) {
     const record = repo.create({
       code: seed.code,
@@ -51,11 +51,12 @@ export async function ensureDefaultPartitions(em: EntityManager): Promise<void>
       description: seed.description ?? null,
       storageDriver: 'local',
       isPublic: seed.isPublic ?? false,
+      accessResolverRequirements: getDeclaredAttachmentAccessRequirements(seed.code),
       requiresOcr: resolveDefaultAttachmentOcrEnabled(),
     })
     em.persist(record)
   }
-  await em.flush()
+  if (pending.length) await em.flush()
 }
 
 export function sanitizePartitionCode(input: string): string {

package/src/modules/attachments/lib/scoped-upload-service.ts

@@ -8,6 +8,7 @@ import { Attachment, AttachmentPartition } from '../data/entities'
 import { attachmentCrudEvents, attachmentCrudIndexer } from './crud'
 import type { StorageDriverFactory } from './drivers'
 import { buildAttachmentFileUrl } from './imageUrls'
+import { ensureAttachmentPartitionProtection } from './access-protection'
 import { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'
 import { extractAttachmentContent } from './textExtraction'
 import { requestOcrProcessing } from './ocrQueue'
@@ -142,6 +143,7 @@ export class ScopedAttachmentUploadService {
       throw new ScopedAttachmentUploadError('partition_unavailable', 403)
     }
 
+    await ensureAttachmentPartitionProtection(em, partition)
     const driver = await storageDriverFactory.resolveForPartition(partition.code, {
       tenantId: input.tenantId,
       organizationId: input.organizationId,

package/src/modules/attachments/lib/target-access-service.ts

@@ -2,7 +2,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Attachment, AttachmentPartition } from '../data/entities'
-import { checkAttachmentAccess } from './access'
+import { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'
 import { readAttachmentMetadata } from './metadata'
 
 export type AttachmentRecordTarget = {
@@ -19,7 +19,10 @@ export type AttachmentTargetAccessInput = {
 }
 
 export class AttachmentTargetAccessService {
-  constructor(private readonly em: EntityManager) {}
+  constructor(
+    private readonly em: EntityManager,
+    private readonly resolveAccessContext?: (() => AttachmentAccessContext) | null,
+  ) {}
 
   async canAccessLinkedTarget(input: AttachmentTargetAccessInput): Promise<boolean> {
     if (!input.targets.length) return false
@@ -44,7 +47,11 @@ export class AttachmentTargetAccessService {
       ],
     })
     if (!partition) return false
-    if (!checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true }).ok) return false
+    const access = await evaluateAttachmentAccess({
+      auth: input.auth, attachment, partition, action: 'read',
+      context: this.resolveAccessContext?.(), requireAuthForPublic: true,
+    })
+    if (!access.ok) return false
 
     const metadata = readAttachmentMetadata(attachment.storageMetadata)
     return input.targets.some((target) => (

package/src/modules/attachments/migrations/.snapshot-open-mercato.json

@@ -8,6 +8,23 @@
       "name": "attachment_partitions",
       "schema": "public",
       "columns": {
+        "access_resolver_requirements": {
+          "name": "access_resolver_requirements",
+          "type": "jsonb",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "json"
+        },
         "code": {
           "name": "code",
           "type": "text",

package/src/modules/attachments/migrations/Migration20261001120000_attachments.ts

@@ -0,0 +1,35 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export class Migration20261001120000_attachments extends Migration {
+  override up(): void {
+    this.addSql('alter table "attachment_partitions" add column if not exists "access_resolver_requirements" jsonb null;')
+    this.addSql(`
+      update attachment_partitions as partition
+      set access_resolver_requirements = coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+        || '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb,
+        updated_at = now()
+      where (partition.access_resolver_requirements is null or jsonb_typeof(partition.access_resolver_requirements) = 'array')
+        and not coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+          @> '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb
+        and exists (
+          select 1 from attachments as attachment
+          where attachment.partition_code = partition.code
+            and (
+              btrim(attachment.entity_id) = 'documents:document'
+              or exists (
+                select 1
+                from jsonb_array_elements(
+                  case jsonb_typeof(attachment.storage_metadata->'assignments')
+                    when 'array' then attachment.storage_metadata->'assignments'
+                    when 'object' then jsonb_build_array(attachment.storage_metadata->'assignments')
+                    else '[]'::jsonb
+                  end
+                ) as assignment
+                where jsonb_typeof(assignment) = 'object'
+                  and btrim(assignment->>'type') = 'documents:document'
+              )
+            )
+        );
+    `)
+  }
+}

package/src/modules/attachments/setup.ts

@@ -1,6 +1,16 @@
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import { syncAttachmentAccessProtection } from './lib/access-protection'
+import { ensureDefaultPartitions } from './lib/partitions'
 
 export const setup: ModuleSetupConfig = {
+  async onTenantCreated({ em }) {
+    await ensureDefaultPartitions(em)
+    await syncAttachmentAccessProtection(em)
+  },
+  async seedDefaults({ em }) {
+    await ensureDefaultPartitions(em)
+    await syncAttachmentAccessProtection(em)
+  },
   defaultRoleFeatures: {
     admin: ['attachments.*', 'attachments.view', 'attachments.manage'],
     employee: ['attachments.view'],

package/src/modules/notifications/api/[id]/action/route.ts

@@ -97,6 +97,14 @@ export const openApi = {
           },
         },
       },
+      403: {
+        description: 'The stored action command is not declared by the notification type with the same action id and command, or the user lacks the features the declared action requires (`code: notification_action_forbidden`)',
+        content: {
+          'application/json': {
+            schema: actionConflictResponseSchema,
+          },
+        },
+      },
       400: {
         description: 'Action not found or failed',
         content: {

package/src/modules/notifications/api/route.ts

@@ -9,6 +9,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
@@ -21,12 +22,14 @@ import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
   notificationValidationErrorResponse,
+  rejectNotificationActionCommands,
   resolveGuardedNotificationContext,
   resolveNotificationContext,
   runGuardedNotificationWrite,
   TENANT_SCOPE_REQUIRED_ERROR_CODE,
 } from '../lib/routeHelpers'
 import {
+  actionConflictResponseSchema,
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
   notificationItemSchema,
@@ -216,6 +219,8 @@ export async function POST(req: Request) {
   if (!parsed.success) {
     return notificationValidationErrorResponse(parsed.error)
   }
+  const commandRejection = await rejectNotificationActionCommands(parsed.data)
+  if (commandRejection) return commandRejection
 
   try {
     const guarded = await runGuardedNotificationWrite(
@@ -251,6 +256,7 @@ const notificationsCrudOpenApi = buildNotificationsCrudOpenApi({
 })
 
 const notificationsCrudGet = notificationsCrudOpenApi.methods?.GET ?? {}
+const notificationsCrudPost = notificationsCrudOpenApi.methods?.POST ?? {}
 
 // The CRUD factory documents errors only for DELETE, and POST already gets an auto-generated 403
 // from its `requireFeatures` metadata. GET is authenticated-only, so its tenant-scope rejection has
@@ -270,5 +276,16 @@ export const openApi: OpenApiRouteDoc = {
         },
       ],
     },
+    POST: {
+      ...notificationsCrudPost,
+      errors: [
+        ...(notificationsCrudPost.errors ?? []),
+        {
+          status: 400,
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          schema: actionConflictResponseSchema,
+        },
+      ],
+    },
   },
 }

package/src/modules/notifications/data/validators.ts

@@ -15,7 +15,7 @@ export const notificationActionSchema = z.object({
   labelKey: z.string().optional(),
   variant: z.enum(['default', 'secondary', 'destructive', 'outline', 'ghost']).optional(),
   icon: z.string().optional(),
-  commandId: z.string().optional(),
+  commandId: z.string().optional().describe('Refused by the HTTP create routes (400 notification_action_command_not_allowed); command actions are attached by server code from the notification type definition'),
   href: safeRelativeHrefSchema.optional(),
   confirmRequired: z.boolean().optional(),
   confirmMessage: z.string().optional(),