@open-mercato/core 0.10.1-develop.7752.1.fd7c06569b → 0.10.1-develop.7756.1.8f5dec1b96

package/dist/modules/entities/lib/rotate-custom-entity-documents.js

@@ -0,0 +1,157 @@
+import {
+  decryptWithAesGcm,
+  TenantDataEncryptionError,
+  TenantDataEncryptionErrorCode
+} from "@open-mercato/shared/lib/encryption/aes";
+import {
+  decryptCustomEntityDocument,
+  encryptCustomEntityDocument,
+  isCustomEntityDocumentCiphertext
+} from "@open-mercato/shared/lib/encryption/customEntityDoc";
+import { CustomFieldDef } from "../data/entities.js";
+import { loadScopedCustomFieldDefs } from "./scoped-field-defs.js";
+const BATCH_SIZE = 100;
+function holdsCiphertext(value) {
+  return Array.isArray(value) ? value.some(isCustomEntityDocumentCiphertext) : isCustomEntityDocumentCiphertext(value);
+}
+function selectHistoricalDefinitions(definitions) {
+  const selected = /* @__PURE__ */ new Map();
+  const scopeScore = (definition) => (definition.tenantId ? 2 : 0) + (definition.organizationId ? 1 : 0);
+  const updatedAt = (definition) => new Date(definition.updatedAt).getTime();
+  for (const definition of definitions) {
+    const previous = selected.get(definition.key);
+    if (!previous || scopeScore(definition) > scopeScore(previous) || scopeScore(definition) === scopeScore(previous) && updatedAt(definition) >= updatedAt(previous)) {
+      selected.set(definition.key, definition);
+    }
+  }
+  return selected;
+}
+async function rotateCustomEntityDocuments(em, options) {
+  const definitionScope = [];
+  if (options.tenantId) definitionScope.push({ $or: [{ tenantId: options.tenantId }, { tenantId: null }] });
+  if (options.organizationId) definitionScope.push({ $or: [{ organizationId: options.organizationId }, { organizationId: null }] });
+  const definitions = await em.find(CustomFieldDef, {
+    ...definitionScope.length ? { $and: definitionScope } : {}
+  });
+  const entityIds = Array.from(new Set(definitions.map((definition) => definition.entityId)));
+  if (!entityIds.length) return 0;
+  const connection = em.getConnection();
+  const fieldsByScope = /* @__PURE__ */ new Map();
+  const oldDeks = /* @__PURE__ */ new Map();
+  let cursor = null;
+  let updated = 0;
+  for (; ; ) {
+    const predicates = [`entity_type in (${entityIds.map(() => "?").join(", ")})`];
+    const parameters = [...entityIds];
+    if (options.tenantId) {
+      predicates.push("tenant_id = ?");
+      parameters.push(options.tenantId);
+    }
+    if (options.organizationId) {
+      predicates.push("organization_id = ?");
+      parameters.push(options.organizationId);
+    }
+    if (cursor) {
+      predicates.push("id > ?");
+      parameters.push(cursor);
+    }
+    const rows = await connection.execute(
+      `select id, entity_type, tenant_id, organization_id, doc from custom_entities_storage where ${predicates.join(" and ")} order by id asc limit ${BATCH_SIZE}`,
+      parameters
+    );
+    if (!rows.length) break;
+    for (const row of rows) {
+      const scopeKey = JSON.stringify([row.entity_type, row.tenant_id, row.organization_id]);
+      let policy = fieldsByScope.get(scopeKey);
+      if (!policy) {
+        const scopedDefinitions = await loadScopedCustomFieldDefs(em, {
+          entityId: row.entity_type,
+          tenantId: row.tenant_id,
+          organizationId: row.organization_id
+        });
+        const visibleDefinitions = definitions.filter((definition) => definition.entityId === row.entity_type && (definition.tenantId == null || definition.tenantId === row.tenant_id) && (definition.organizationId == null || definition.organizationId === row.organization_id));
+        const keys = new Set(visibleDefinitions.map((definition) => definition.key));
+        const historicalDefinitions = selectHistoricalDefinitions(visibleDefinitions);
+        policy = {
+          fields: Array.from(keys, (key) => ({ key, kind: "text", encrypted: true })),
+          protectedKeys: new Set(Array.from(keys).filter((key) => (scopedDefinitions.get(key) ?? historicalDefinitions.get(key))?.configJson?.encrypted === true)),
+          encryptedKeys: new Set(Array.from(scopedDefinitions.values()).filter((definition) => definition.configJson?.encrypted === true).map((definition) => definition.key))
+        };
+        fieldsByScope.set(scopeKey, policy);
+      }
+      const { fields, encryptedKeys, protectedKeys } = policy;
+      const knownKeys = new Set(fields.map((field) => field.key));
+      const entries = Object.entries(row.doc).filter(([key, value]) => {
+        const normalizedKey = key.replace(/^cf[:_]/, "");
+        return value != null && knownKeys.has(normalizedKey) && (encryptedKeys.has(normalizedKey) || holdsCiphertext(value));
+      });
+      if (!entries.length) continue;
+      const tenantId = row.tenant_id;
+      if (!tenantId || !options.encryptionService.isEnabled()) {
+        throw new TenantDataEncryptionError(TenantDataEncryptionErrorCode.KMS_UNAVAILABLE, "[internal] Custom entity encryption requires an available tenant key");
+      }
+      const currentDek = await options.encryptionService.getDek(tenantId);
+      if (options.oldKms && !oldDeks.has(tenantId)) oldDeks.set(tenantId, await options.oldKms.getTenantDek(tenantId));
+      const oldDek = oldDeks.get(tenantId) ?? null;
+      const candidates = {};
+      const arrayMasks = /* @__PURE__ */ new Map();
+      let changed = false;
+      const prepare = (value, encryptPlaintext, requireCiphertextKey) => {
+        if (value == null) return { value, selected: false };
+        if (typeof value === "string") {
+          if (currentDek && decryptWithAesGcm(value, currentDek.key) !== null) return { value, selected: true };
+          if (oldDek && decryptWithAesGcm(value, oldDek.key) !== null) {
+            changed = true;
+            return { value, selected: true };
+          }
+        }
+        if (!isCustomEntityDocumentCiphertext(value)) {
+          if (options.oldKms || !encryptPlaintext) return { value: null, selected: false };
+          changed = true;
+          return { value, selected: true };
+        }
+        if (!requireCiphertextKey) return { value: null, selected: false };
+        throw new TenantDataEncryptionError(TenantDataEncryptionErrorCode.WRONG_KEY, "[internal] Custom entity ciphertext does not decrypt under the supplied tenant keys");
+      };
+      for (const [key, value] of entries) {
+        const normalizedKey = key.replace(/^cf[:_]/, "");
+        const encryptPlaintext = encryptedKeys.has(normalizedKey);
+        const requireCiphertextKey = protectedKeys.has(normalizedKey);
+        if (Array.isArray(value)) {
+          const prepared = value.map((entry) => prepare(entry, encryptPlaintext, requireCiphertextKey));
+          candidates[key] = prepared.map((entry) => entry.value);
+          arrayMasks.set(key, prepared.map((entry) => entry.selected));
+        } else {
+          const prepared = prepare(value, encryptPlaintext, requireCiphertextKey);
+          if (prepared.selected) candidates[key] = prepared.value;
+        }
+      }
+      if (!changed) continue;
+      if (options.dryRun) {
+        updated += 1;
+        continue;
+      }
+      const plaintext = options.oldKms && oldDek ? await decryptCustomEntityDocument(candidates, fields, tenantId, options.encryptionService, /* @__PURE__ */ new Map([[tenantId, oldDek.key]])) : candidates;
+      const encrypted = await encryptCustomEntityDocument(plaintext, fields, tenantId, options.encryptionService);
+      const nextDoc = { ...row.doc };
+      for (const [key, value] of Object.entries(encrypted)) {
+        const mask = arrayMasks.get(key);
+        const previous = row.doc[key];
+        nextDoc[key] = mask && Array.isArray(value) && Array.isArray(previous) ? value.map((entry, index) => mask[index] ? entry : previous[index]) : value;
+      }
+      const written = await connection.execute(
+        "update custom_entities_storage set doc = ?::jsonb, updated_at = now() where id = ? and entity_type = ? and tenant_id is not distinct from ? and organization_id is not distinct from ? and doc = ?::jsonb returning id",
+        [JSON.stringify(nextDoc), row.id, row.entity_type, tenantId, row.organization_id, JSON.stringify(row.doc)]
+      );
+      if (!written.length) throw new Error("[internal] Custom entity document changed during encryption; retry the operation");
+      updated += 1;
+    }
+    cursor = rows[rows.length - 1].id;
+    if (rows.length < BATCH_SIZE) break;
+  }
+  return updated;
+}
+export {
+  rotateCustomEntityDocuments
+};
+//# sourceMappingURL=rotate-custom-entity-documents.js.map

package/dist/modules/entities/lib/rotate-custom-entity-documents.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/entities/lib/rotate-custom-entity-documents.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport {\n  decryptWithAesGcm,\n  TenantDataEncryptionError,\n  TenantDataEncryptionErrorCode,\n} from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  decryptCustomEntityDocument,\n  encryptCustomEntityDocument,\n  isCustomEntityDocumentCiphertext,\n  type CustomEntityDocumentField,\n} from '@open-mercato/shared/lib/encryption/customEntityDoc'\nimport type { KmsService, TenantDek } from '@open-mercato/shared/lib/encryption/kms'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { CustomFieldDef } from '../data/entities'\nimport { loadScopedCustomFieldDefs } from './scoped-field-defs'\n\ntype RotationOptions = {\n  encryptionService: TenantDataEncryptionService\n  oldKms: KmsService | null\n  tenantId: string | null\n  organizationId: string | null\n  dryRun: boolean\n}\n\ntype DocumentRow = {\n  id: string\n  entity_type: string\n  tenant_id: string | null\n  organization_id: string | null\n  doc: Record<string, unknown>\n}\n\ntype DocumentFieldPolicy = {\n  fields: CustomEntityDocumentField[]\n  encryptedKeys: Set<string>\n  protectedKeys: Set<string>\n}\n\nconst BATCH_SIZE = 100\n\nfunction holdsCiphertext(value: unknown): boolean {\n  return Array.isArray(value) ? value.some(isCustomEntityDocumentCiphertext) : isCustomEntityDocumentCiphertext(value)\n}\n\nfunction selectHistoricalDefinitions(definitions: CustomFieldDef[]): Map<string, CustomFieldDef> {\n  const selected = new Map<string, CustomFieldDef>()\n  const scopeScore = (definition: CustomFieldDef) => (definition.tenantId ? 2 : 0) + (definition.organizationId ? 1 : 0)\n  const updatedAt = (definition: CustomFieldDef) => new Date(definition.updatedAt).getTime()\n  for (const definition of definitions) {\n    const previous = selected.get(definition.key)\n    if (!previous || scopeScore(definition) > scopeScore(previous)\n      || (scopeScore(definition) === scopeScore(previous) && updatedAt(definition) >= updatedAt(previous))) {\n      selected.set(definition.key, definition)\n    }\n  }\n  return selected\n}\n\n/** @internal */\nexport async function rotateCustomEntityDocuments(\n  em: EntityManager,\n  options: RotationOptions,\n): Promise<number> {\n  const definitionScope: FilterQuery<CustomFieldDef>[] = []\n  if (options.tenantId) definitionScope.push({ $or: [{ tenantId: options.tenantId }, { tenantId: null }] })\n  if (options.organizationId) definitionScope.push({ $or: [{ organizationId: options.organizationId }, { organizationId: null }] })\n  const definitions = await em.find(CustomFieldDef, {\n    ...(definitionScope.length ? { $and: definitionScope } : {}),\n  })\n  const entityIds = Array.from(new Set(definitions.map((definition) => definition.entityId)))\n  if (!entityIds.length) return 0\n\n  const connection = em.getConnection()\n  const fieldsByScope = new Map<string, DocumentFieldPolicy>()\n  const oldDeks = new Map<string, TenantDek | null>()\n  let cursor: string | null = null\n  let updated = 0\n  for (;;) {\n    const predicates = [`entity_type in (${entityIds.map(() => '?').join(', ')})`]\n    const parameters: unknown[] = [...entityIds]\n    if (options.tenantId) {\n      predicates.push('tenant_id = ?')\n      parameters.push(options.tenantId)\n    }\n    if (options.organizationId) {\n      predicates.push('organization_id = ?')\n      parameters.push(options.organizationId)\n    }\n    if (cursor) {\n      predicates.push('id > ?')\n      parameters.push(cursor)\n    }\n    const rows = await connection.execute<DocumentRow[]>(\n      `select id, entity_type, tenant_id, organization_id, doc from custom_entities_storage where ${predicates.join(' and ')} order by id asc limit ${BATCH_SIZE}`,\n      parameters,\n    )\n    if (!rows.length) break\n    for (const row of rows) {\n      const scopeKey = JSON.stringify([row.entity_type, row.tenant_id, row.organization_id])\n      let policy = fieldsByScope.get(scopeKey)\n      if (!policy) {\n        const scopedDefinitions = await loadScopedCustomFieldDefs(em, {\n          entityId: row.entity_type,\n          tenantId: row.tenant_id,\n          organizationId: row.organization_id,\n        })\n        const visibleDefinitions = definitions\n          .filter((definition) => definition.entityId === row.entity_type\n            && (definition.tenantId == null || definition.tenantId === row.tenant_id)\n            && (definition.organizationId == null || definition.organizationId === row.organization_id))\n        const keys = new Set(visibleDefinitions.map((definition) => definition.key))\n        const historicalDefinitions = selectHistoricalDefinitions(visibleDefinitions)\n        policy = {\n          fields: Array.from(keys, (key) => ({ key, kind: 'text', encrypted: true })),\n          protectedKeys: new Set(Array.from(keys)\n            .filter((key) => (scopedDefinitions.get(key) ?? historicalDefinitions.get(key))?.configJson?.encrypted === true)),\n          encryptedKeys: new Set(Array.from(scopedDefinitions.values())\n            .filter((definition) => definition.configJson?.encrypted === true)\n            .map((definition) => definition.key)),\n        }\n        fieldsByScope.set(scopeKey, policy)\n      }\n      const { fields, encryptedKeys, protectedKeys } = policy\n      const knownKeys = new Set(fields.map((field) => field.key))\n      const entries = Object.entries(row.doc).filter(([key, value]) => {\n        const normalizedKey = key.replace(/^cf[:_]/, '')\n        return value != null && knownKeys.has(normalizedKey) && (encryptedKeys.has(normalizedKey) || holdsCiphertext(value))\n      })\n      if (!entries.length) continue\n      const tenantId = row.tenant_id\n      if (!tenantId || !options.encryptionService.isEnabled()) {\n        throw new TenantDataEncryptionError(TenantDataEncryptionErrorCode.KMS_UNAVAILABLE, '[internal] Custom entity encryption requires an available tenant key')\n      }\n      const currentDek = await options.encryptionService.getDek(tenantId)\n      if (options.oldKms && !oldDeks.has(tenantId)) oldDeks.set(tenantId, await options.oldKms.getTenantDek(tenantId))\n      const oldDek = oldDeks.get(tenantId) ?? null\n      const candidates: Record<string, unknown> = {}\n      const arrayMasks = new Map<string, boolean[]>()\n      let changed = false\n      const prepare = (value: unknown, encryptPlaintext: boolean, requireCiphertextKey: boolean): { value: unknown; selected: boolean } => {\n        if (value == null) return { value, selected: false }\n        if (typeof value === 'string') {\n          if (currentDek && decryptWithAesGcm(value, currentDek.key) !== null) return { value, selected: true }\n          if (oldDek && decryptWithAesGcm(value, oldDek.key) !== null) {\n            changed = true\n            return { value, selected: true }\n          }\n        }\n        if (!isCustomEntityDocumentCiphertext(value)) {\n          if (options.oldKms || !encryptPlaintext) return { value: null, selected: false }\n          changed = true\n          return { value, selected: true }\n        }\n        if (!requireCiphertextKey) return { value: null, selected: false }\n        throw new TenantDataEncryptionError(TenantDataEncryptionErrorCode.WRONG_KEY, '[internal] Custom entity ciphertext does not decrypt under the supplied tenant keys')\n      }\n      for (const [key, value] of entries) {\n        const normalizedKey = key.replace(/^cf[:_]/, '')\n        const encryptPlaintext = encryptedKeys.has(normalizedKey)\n        const requireCiphertextKey = protectedKeys.has(normalizedKey)\n        if (Array.isArray(value)) {\n          const prepared = value.map((entry) => prepare(entry, encryptPlaintext, requireCiphertextKey))\n          candidates[key] = prepared.map((entry) => entry.value)\n          arrayMasks.set(key, prepared.map((entry) => entry.selected))\n        } else {\n          const prepared = prepare(value, encryptPlaintext, requireCiphertextKey)\n          if (prepared.selected) candidates[key] = prepared.value\n        }\n      }\n      if (!changed) continue\n      if (options.dryRun) {\n        updated += 1\n        continue\n      }\n      const plaintext = options.oldKms && oldDek\n        ? await decryptCustomEntityDocument(candidates, fields, tenantId, options.encryptionService, new Map([[tenantId, oldDek.key]]))\n        : candidates\n      const encrypted = await encryptCustomEntityDocument(plaintext, fields, tenantId, options.encryptionService)\n      const nextDoc = { ...row.doc }\n      for (const [key, value] of Object.entries(encrypted)) {\n        const mask = arrayMasks.get(key)\n        const previous = row.doc[key]\n        nextDoc[key] = mask && Array.isArray(value) && Array.isArray(previous)\n          ? value.map((entry, index) => mask[index] ? entry : previous[index])\n          : value\n      }\n      const written = await connection.execute<Array<{ id: string }>>(\n        'update custom_entities_storage set doc = ?::jsonb, updated_at = now() where id = ? and entity_type = ? and tenant_id is not distinct from ? and organization_id is not distinct from ? and doc = ?::jsonb returning id',\n        [JSON.stringify(nextDoc), row.id, row.entity_type, tenantId, row.organization_id, JSON.stringify(row.doc)],\n      )\n      if (!written.length) throw new Error('[internal] Custom entity document changed during encryption; retry the operation')\n      updated += 1\n    }\n    cursor = rows[rows.length - 1]!.id\n    if (rows.length < BATCH_SIZE) break\n  }\n  return updated\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAGP,SAAS,sBAAsB;AAC/B,SAAS,iCAAiC;AAwB1C,MAAM,aAAa;AAEnB,SAAS,gBAAgB,OAAyB;AAChD,SAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,gCAAgC,IAAI,iCAAiC,KAAK;AACrH;AAEA,SAAS,4BAA4B,aAA4D;AAC/F,QAAM,WAAW,oBAAI,IAA4B;AACjD,QAAM,aAAa,CAAC,gBAAgC,WAAW,WAAW,IAAI,MAAM,WAAW,iBAAiB,IAAI;AACpH,QAAM,YAAY,CAAC,eAA+B,IAAI,KAAK,WAAW,SAAS,EAAE,QAAQ;AACzF,aAAW,cAAc,aAAa;AACpC,UAAM,WAAW,SAAS,IAAI,WAAW,GAAG;AAC5C,QAAI,CAAC,YAAY,WAAW,UAAU,IAAI,WAAW,QAAQ,KACvD,WAAW,UAAU,MAAM,WAAW,QAAQ,KAAK,UAAU,UAAU,KAAK,UAAU,QAAQ,GAAI;AACtG,eAAS,IAAI,WAAW,KAAK,UAAU;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAsB,4BACpB,IACA,SACiB;AACjB,QAAM,kBAAiD,CAAC;AACxD,MAAI,QAAQ,SAAU,iBAAgB,KAAK,EAAE,KAAK,CAAC,EAAE,UAAU,QAAQ,SAAS,GAAG,EAAE,UAAU,KAAK,CAAC,EAAE,CAAC;AACxG,MAAI,QAAQ,eAAgB,iBAAgB,KAAK,EAAE,KAAK,CAAC,EAAE,gBAAgB,QAAQ,eAAe,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE,CAAC;AAChI,QAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,IAChD,GAAI,gBAAgB,SAAS,EAAE,MAAM,gBAAgB,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,YAAY,MAAM,KAAK,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,QAAQ,CAAC,CAAC;AAC1F,MAAI,CAAC,UAAU,OAAQ,QAAO;AAE9B,QAAM,aAAa,GAAG,cAAc;AACpC,QAAM,gBAAgB,oBAAI,IAAiC;AAC3D,QAAM,UAAU,oBAAI,IAA8B;AAClD,MAAI,SAAwB;AAC5B,MAAI,UAAU;AACd,aAAS;AACP,UAAM,aAAa,CAAC,mBAAmB,UAAU,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG;AAC7E,UAAM,aAAwB,CAAC,GAAG,SAAS;AAC3C,QAAI,QAAQ,UAAU;AACpB,iBAAW,KAAK,eAAe;AAC/B,iBAAW,KAAK,QAAQ,QAAQ;AAAA,IAClC;AACA,QAAI,QAAQ,gBAAgB;AAC1B,iBAAW,KAAK,qBAAqB;AACrC,iBAAW,KAAK,QAAQ,cAAc;AAAA,IACxC;AACA,QAAI,QAAQ;AACV,iBAAW,KAAK,QAAQ;AACxB,iBAAW,KAAK,MAAM;AAAA,IACxB;AACA,UAAM,OAAO,MAAM,WAAW;AAAA,MAC5B,8FAA8F,WAAW,KAAK,OAAO,CAAC,0BAA0B,UAAU;AAAA,MAC1J;AAAA,IACF;AACA,QAAI,CAAC,KAAK,OAAQ;AAClB,eAAW,OAAO,MAAM;AACtB,YAAM,WAAW,KAAK,UAAU,CAAC,IAAI,aAAa,IAAI,WAAW,IAAI,eAAe,CAAC;AACrF,UAAI,SAAS,cAAc,IAAI,QAAQ;AACvC,UAAI,CAAC,QAAQ;AACX,cAAM,oBAAoB,MAAM,0BAA0B,IAAI;AAAA,UAC5D,UAAU,IAAI;AAAA,UACd,UAAU,IAAI;AAAA,UACd,gBAAgB,IAAI;AAAA,QACtB,CAAC;AACD,cAAM,qBAAqB,YACxB,OAAO,CAAC,eAAe,WAAW,aAAa,IAAI,gBAC9C,WAAW,YAAY,QAAQ,WAAW,aAAa,IAAI,eAC3D,WAAW,kBAAkB,QAAQ,WAAW,mBAAmB,IAAI,gBAAgB;AAC/F,cAAM,OAAO,IAAI,IAAI,mBAAmB,IAAI,CAAC,eAAe,WAAW,GAAG,CAAC;AAC3E,cAAM,wBAAwB,4BAA4B,kBAAkB;AAC5E,iBAAS;AAAA,UACP,QAAQ,MAAM,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,MAAM,QAAQ,WAAW,KAAK,EAAE;AAAA,UAC1E,eAAe,IAAI,IAAI,MAAM,KAAK,IAAI,EACnC,OAAO,CAAC,SAAS,kBAAkB,IAAI,GAAG,KAAK,sBAAsB,IAAI,GAAG,IAAI,YAAY,cAAc,IAAI,CAAC;AAAA,UAClH,eAAe,IAAI,IAAI,MAAM,KAAK,kBAAkB,OAAO,CAAC,EACzD,OAAO,CAAC,eAAe,WAAW,YAAY,cAAc,IAAI,EAChE,IAAI,CAAC,eAAe,WAAW,GAAG,CAAC;AAAA,QACxC;AACA,sBAAc,IAAI,UAAU,MAAM;AAAA,MACpC;AACA,YAAM,EAAE,QAAQ,eAAe,cAAc,IAAI;AACjD,YAAM,YAAY,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;AAC1D,YAAM,UAAU,OAAO,QAAQ,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM;AAC/D,cAAM,gBAAgB,IAAI,QAAQ,WAAW,EAAE;AAC/C,eAAO,SAAS,QAAQ,UAAU,IAAI,aAAa,MAAM,cAAc,IAAI,aAAa,KAAK,gBAAgB,KAAK;AAAA,MACpH,CAAC;AACD,UAAI,CAAC,QAAQ,OAAQ;AACrB,YAAM,WAAW,IAAI;AACrB,UAAI,CAAC,YAAY,CAAC,QAAQ,kBAAkB,UAAU,GAAG;AACvD,cAAM,IAAI,0BAA0B,8BAA8B,iBAAiB,sEAAsE;AAAA,MAC3J;AACA,YAAM,aAAa,MAAM,QAAQ,kBAAkB,OAAO,QAAQ;AAClE,UAAI,QAAQ,UAAU,CAAC,QAAQ,IAAI,QAAQ,EAAG,SAAQ,IAAI,UAAU,MAAM,QAAQ,OAAO,aAAa,QAAQ,CAAC;AAC/G,YAAM,SAAS,QAAQ,IAAI,QAAQ,KAAK;AACxC,YAAM,aAAsC,CAAC;AAC7C,YAAM,aAAa,oBAAI,IAAuB;AAC9C,UAAI,UAAU;AACd,YAAM,UAAU,CAAC,OAAgB,kBAA2B,yBAAyE;AACnI,YAAI,SAAS,KAAM,QAAO,EAAE,OAAO,UAAU,MAAM;AACnD,YAAI,OAAO,UAAU,UAAU;AAC7B,cAAI,cAAc,kBAAkB,OAAO,WAAW,GAAG,MAAM,KAAM,QAAO,EAAE,OAAO,UAAU,KAAK;AACpG,cAAI,UAAU,kBAAkB,OAAO,OAAO,GAAG,MAAM,MAAM;AAC3D,sBAAU;AACV,mBAAO,EAAE,OAAO,UAAU,KAAK;AAAA,UACjC;AAAA,QACF;AACA,YAAI,CAAC,iCAAiC,KAAK,GAAG;AAC5C,cAAI,QAAQ,UAAU,CAAC,iBAAkB,QAAO,EAAE,OAAO,MAAM,UAAU,MAAM;AAC/E,oBAAU;AACV,iBAAO,EAAE,OAAO,UAAU,KAAK;AAAA,QACjC;AACA,YAAI,CAAC,qBAAsB,QAAO,EAAE,OAAO,MAAM,UAAU,MAAM;AACjE,cAAM,IAAI,0BAA0B,8BAA8B,WAAW,qFAAqF;AAAA,MACpK;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,cAAM,gBAAgB,IAAI,QAAQ,WAAW,EAAE;AAC/C,cAAM,mBAAmB,cAAc,IAAI,aAAa;AACxD,cAAM,uBAAuB,cAAc,IAAI,aAAa;AAC5D,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,gBAAM,WAAW,MAAM,IAAI,CAAC,UAAU,QAAQ,OAAO,kBAAkB,oBAAoB,CAAC;AAC5F,qBAAW,GAAG,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,KAAK;AACrD,qBAAW,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC;AAAA,QAC7D,OAAO;AACL,gBAAM,WAAW,QAAQ,OAAO,kBAAkB,oBAAoB;AACtE,cAAI,SAAS,SAAU,YAAW,GAAG,IAAI,SAAS;AAAA,QACpD;AAAA,MACF;AACA,UAAI,CAAC,QAAS;AACd,UAAI,QAAQ,QAAQ;AAClB,mBAAW;AACX;AAAA,MACF;AACA,YAAM,YAAY,QAAQ,UAAU,SAChC,MAAM,4BAA4B,YAAY,QAAQ,UAAU,QAAQ,mBAAmB,oBAAI,IAAI,CAAC,CAAC,UAAU,OAAO,GAAG,CAAC,CAAC,CAAC,IAC5H;AACJ,YAAM,YAAY,MAAM,4BAA4B,WAAW,QAAQ,UAAU,QAAQ,iBAAiB;AAC1G,YAAM,UAAU,EAAE,GAAG,IAAI,IAAI;AAC7B,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,SAAS,GAAG;AACpD,cAAM,OAAO,WAAW,IAAI,GAAG;AAC/B,cAAM,WAAW,IAAI,IAAI,GAAG;AAC5B,gBAAQ,GAAG,IAAI,QAAQ,MAAM,QAAQ,KAAK,KAAK,MAAM,QAAQ,QAAQ,IACjE,MAAM,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,IAAI,QAAQ,SAAS,KAAK,CAAC,IACjE;AAAA,MACN;AACA,YAAM,UAAU,MAAM,WAAW;AAAA,QAC/B;AAAA,QACA,CAAC,KAAK,UAAU,OAAO,GAAG,IAAI,IAAI,IAAI,aAAa,UAAU,IAAI,iBAAiB,KAAK,UAAU,IAAI,GAAG,CAAC;AAAA,MAC3G;AACA,UAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,kFAAkF;AACvH,iBAAW;AAAA,IACb;AACA,aAAS,KAAK,KAAK,SAAS,CAAC,EAAG;AAChC,QAAI,KAAK,SAAS,WAAY;AAAA,EAChC;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/notifications/lib/notificationRecipients.js

@@ -26,7 +26,7 @@ async function getScopedNotificationRecipientUserIds(db, tenantId, organizationI
 }
 async function getRecipientUserIdsForRole(db, tenantId, roleId) {
   const builder = db;
-  const userRoles = await builder.selectFrom("user_roles").innerJoin("users", "user_roles.user_id", "users.id").where("user_roles.role_id", "=", roleId).where("user_roles.deleted_at", "is", null).where("users.deleted_at", "is", null).where("users.tenant_id", "=", tenantId).select("users.id as user_id").execute();
+  const userRoles = await builder.selectFrom("user_roles").innerJoin("roles", "user_roles.role_id", "roles.id").innerJoin("users", "user_roles.user_id", "users.id").where("user_roles.role_id", "=", roleId).where("user_roles.deleted_at", "is", null).where("roles.deleted_at", "is", null).where("roles.tenant_id", "=", tenantId).where("users.deleted_at", "is", null).where("users.tenant_id", "=", tenantId).select("users.id as user_id").execute();
   return userRoles.map((row) => row.user_id);
 }
 async function getRecipientUserIdsForFeature(db, tenantId, requiredFeature) {
@@ -38,7 +38,7 @@ async function getRecipientUserIdsForFeature(db, tenantId, requiredFeature) {
     "user_acls.is_super_admin"
   ]).execute();
   collectUsersWithFeature(userIdsSet, userAcls, requiredFeature);
-  const roleAcls = await builder.selectFrom("role_acls").innerJoin("user_roles", "role_acls.role_id", "user_roles.role_id").innerJoin("users", "user_roles.user_id", "users.id").where("role_acls.tenant_id", "=", tenantId).where("role_acls.deleted_at", "is", null).where("user_roles.deleted_at", "is", null).where("users.deleted_at", "is", null).where("users.tenant_id", "=", tenantId).select([
+  const roleAcls = await builder.selectFrom("role_acls").innerJoin("roles", "role_acls.role_id", "roles.id").innerJoin("user_roles", "role_acls.role_id", "user_roles.role_id").innerJoin("users", "user_roles.user_id", "users.id").where("role_acls.tenant_id", "=", tenantId).where("role_acls.deleted_at", "is", null).where("roles.deleted_at", "is", null).where("roles.tenant_id", "=", tenantId).where("user_roles.deleted_at", "is", null).where("users.deleted_at", "is", null).where("users.tenant_id", "=", tenantId).select([
     "users.id as user_id",
     "role_acls.features_json",
     "role_acls.is_super_admin"

package/dist/modules/notifications/lib/notificationRecipients.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/lib/notificationRecipients.ts"],
-  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    const features = normalizeFeatures(row.features_json) ?? []\n    if (authorizeFeatures([requiredFeature], {\n      grantedFeatures: features,\n      unrestricted: row.is_super_admin,\n    })) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
-  "mappings": "AACA,SAAS,yBAAyB;AAQlC,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,kBAAkB,IAAI,aAAa,KAAK,CAAC;AAC1D,QAAI,kBAAkB,CAAC,eAAe,GAAG;AAAA,MACvC,iBAAiB;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB,CAAC,GAAG;AACF,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
+  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    const features = normalizeFeatures(row.features_json) ?? []\n    if (authorizeFeatures([requiredFeature], {\n      grantedFeatures: features,\n      unrestricted: row.is_super_admin,\n    })) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('roles', 'user_roles.role_id', 'roles.id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('roles.deleted_at', 'is', null)\n    .where('roles.tenant_id', '=', tenantId)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('roles', 'role_acls.role_id', 'roles.id')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('roles.deleted_at', 'is', null)\n    .where('roles.tenant_id', '=', tenantId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AAQlC,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,kBAAkB,IAAI,aAAa,KAAK,CAAC;AAC1D,QAAI,kBAAkB,CAAC,eAAe,GAAG;AAAA,MACvC,iBAAiB;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB,CAAC,GAAG;AACF,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
   "names": []
 }

package/dist/modules/query_index/lib/engine.js

@@ -12,6 +12,7 @@ import { sql } from "kysely";
 import { readCoverageSnapshot, refreshCoverageSnapshot } from "./coverage.js";
 import { createProfiler, shouldEnableProfiler } from "@open-mercato/shared/lib/profiler";
 import { decryptIndexDocCustomFields } from "@open-mercato/shared/lib/encryption/indexDoc";
+import { decryptCustomEntityDocument, isCustomEntityDocumentCiphertext } from "@open-mercato/shared/lib/encryption/customEntityDoc";
 import {
   DECLINED_ENCRYPTED_SORT_LOG_MESSAGE,
   DECRYPT_REFUSAL_LOG_MESSAGE,
@@ -58,6 +59,91 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 import { parseNumberWithDefault } from "@open-mercato/shared/lib/number";
 import { createBoundedTtlMemo } from "@open-mercato/shared/lib/query/bounded-ttl-memo";
 const logger = createLogger("query_index").child({ component: "engine" });
+function customDocumentValue(row, field) {
+  const bare = field.replace(/^cf[:_]/, "");
+  return row[field] ?? row[`cf_${bare.replace(/[^a-zA-Z0-9_]/g, "_")}`] ?? row[`cf:${bare}`] ?? row[bare];
+}
+function assertCustomDocumentPlaintext(actual) {
+  if (isCustomEntityDocumentCiphertext(actual) || Array.isArray(actual) && actual.some(isCustomEntityDocumentCiphertext)) {
+    throw new Error("[internal] Cannot compare custom entity ciphertext without its tenant key");
+  }
+}
+function matchesCustomDocumentPattern(value, pattern, ignoreCase) {
+  const source = Array.from(value);
+  const authored = Array.from(pattern);
+  const normalize = (character) => ignoreCase ? character.toLowerCase() : character;
+  const tokens = [];
+  for (let index = 0; index < authored.length; index += 1) {
+    const character = authored[index];
+    if (character === "\\") {
+      const literal = authored[++index];
+      if (literal === void 0) throw new Error("[internal] Invalid custom entity LIKE escape");
+      tokens.push({ kind: "literal", value: normalize(literal) });
+    } else {
+      tokens.push({ kind: character === "%" ? "many" : character === "_" ? "one" : "literal", value: normalize(character) });
+    }
+  }
+  let sourceIndex = 0;
+  let tokenIndex = 0;
+  let wildcardIndex = -1;
+  let retryIndex = 0;
+  while (sourceIndex < source.length) {
+    const token = tokens[tokenIndex];
+    if (token?.kind === "one" || token?.kind === "literal" && token.value === normalize(source[sourceIndex])) {
+      sourceIndex += 1;
+      tokenIndex += 1;
+    } else if (token?.kind === "many") {
+      wildcardIndex = tokenIndex++;
+      retryIndex = sourceIndex;
+    } else if (wildcardIndex >= 0) {
+      tokenIndex = wildcardIndex + 1;
+      sourceIndex = ++retryIndex;
+    } else {
+      return false;
+    }
+  }
+  while (tokens[tokenIndex]?.kind === "many") tokenIndex += 1;
+  return tokenIndex === tokens.length;
+}
+function matchesCustomDocumentFilter(row, filter, actual = customDocumentValue(row, filter.field)) {
+  const expected = filter.value;
+  assertCustomDocumentPlaintext(actual);
+  const equal = (left, right) => left == null || right == null ? left == null && right == null : String(left) === String(right);
+  const values = filter.field.startsWith("cf:") && Array.isArray(actual) ? actual : [actual];
+  const included = (candidates) => values.some((value) => candidates.some((candidate) => equal(value, candidate)));
+  switch (filter.op) {
+    case "exists":
+      return Boolean(expected) === (actual != null);
+    case "eq":
+      return values.some((value) => equal(value, expected));
+    case "ne":
+      return actual != null && !values.some((value) => equal(value, expected));
+    case "in":
+      return included(Array.isArray(expected) ? expected : []);
+    case "nin":
+      return actual != null && !included(Array.isArray(expected) ? expected : []);
+    case "overlap":
+      return Array.isArray(actual) && normalizeOverlapValues(expected).some((value) => actual.map(String).includes(value));
+    case "noverlap":
+      return Array.isArray(actual) && !normalizeOverlapValues(expected).some((value) => actual.map(String).includes(value));
+    case "gt":
+    case "gte":
+    case "lt":
+    case "lte": {
+      if (actual == null || expected == null) return false;
+      const left = typeof actual === "number" ? actual : String(actual);
+      const right = typeof actual === "number" ? Number(expected) : String(expected);
+      const order = typeof left === "number" && typeof right === "number" ? left - right : String(left).localeCompare(String(right));
+      return filter.op === "gt" ? order > 0 : filter.op === "gte" ? order >= 0 : filter.op === "lt" ? order < 0 : order <= 0;
+    }
+    case "like":
+    case "ilike": {
+      return values.some((value) => value != null && matchesCustomDocumentPattern(String(value), String(expected ?? ""), filter.op === "ilike"));
+    }
+    default:
+      throw new Error("[internal] Unsupported custom entity filter operator");
+  }
+}
 const CF_FILTER_SUPPORTED_OPS = /* @__PURE__ */ new Set([
   "eq",
   "ne",
@@ -1752,6 +1838,20 @@ class HybridQueryEngine {
     const orgScope = this.resolveOrganizationScope(opts);
     if (!opts.tenantId) throw new Error("QueryEngine: tenantId is required");
     const normalizedFilters = normalizeFilters(opts.filters);
+    const encryptionService = resolveDecryptEnabled(opts) ? this.getEncryptionService() : null;
+    const documentEncryptionService = encryptionService && "getDek" in encryptionService && typeof encryptionService.getDek === "function" && typeof encryptionService.isEnabled === "function" ? encryptionService : null;
+    const definitions = encryptionService ? await this.resolveCustomFieldDefs([entity], opts.tenantId, true) : [];
+    const resolveKinds = createCustomFieldKindMapResolver(buildCustomFieldKindIndex(definitions));
+    const encryptedKeys = new Set(definitions.filter((definition) => {
+      const config = definition.configJson;
+      return config != null && typeof config === "object" && "encrypted" in config && Boolean(config.encrypted);
+    }).map((definition) => definition.key));
+    const isProtected = (field) => encryptedKeys.has(field.replace(/^cf[:_]/, ""));
+    const plaintextFilters = normalizedFilters.some((filter) => isProtected(filter.field));
+    const plaintextSort = (opts.sort ?? []).some((sort) => isProtected(sort.field));
+    const scanPlaintext = plaintextFilters || plaintextSort;
+    const deferredFilters = plaintextFilters ? normalizedFilters.filter((filter) => filter.orGroup || isProtected(filter.field)) : [];
+    const jsonComparisonAliases = new Map(Array.from(new Set(deferredFilters.filter((filter) => !isProtected(filter.field) && !filter.field.startsWith("cf:") && !this.resolveCustomEntityColumn(alias, filter.field) && (filter.op === "overlap" || filter.op === "noverlap")).map((filter) => filter.field)), (field, index) => [field, `__om_ce_filter_${index}`]));
     const searchConfig = resolveSearchConfig();
     const searchEnabled = await this.searchAvailability().staticEnabled();
     const hasSearchTokens = searchEnabled && hasSearchFilter(normalizedFilters) ? await this.searchAvailability().hasTokens(entity, opts.tenantId ?? null, orgScope) : false;
@@ -1769,6 +1869,7 @@ class HybridQueryEngine {
       }
       if (!opts.withDeleted) next = next.where(`${alias}.deleted_at`, "is", null);
       for (const filter of normalizedFilters) {
+        if (plaintextFilters && (filter.orGroup || isProtected(filter.field))) continue;
         if (filter.field.startsWith("cf:")) {
           next = this.applyCfFilterFromAlias(next, alias, entity, filter.field, filter.op, filter.value, searchRuntime);
           continue;
@@ -1812,8 +1913,8 @@ class HybridQueryEngine {
     }
     if (opts.includeCustomFields === true) {
       try {
-        const rows = await db.selectFrom("custom_field_defs").select("key").where("entity_id", "=", entity).where("is_active", "=", true).where("tenant_id", "=", opts.tenantId).execute();
-        for (const row of rows) {
+        const rows2 = await db.selectFrom("custom_field_defs").select("key").where("entity_id", "=", entity).where("is_active", "=", true).where("tenant_id", "=", opts.tenantId).execute();
+        for (const row of rows2) {
           const key = row.key;
           if (typeof key === "string") cfKeys.add(key);
           else if (key != null) cfKeys.add(String(key));
@@ -1823,20 +1924,26 @@ class HybridQueryEngine {
     } else if (Array.isArray(opts.includeCustomFields)) {
       for (const k of opts.includeCustomFields) cfKeys.add(k);
     }
+    const projectedFields = new Set((opts.fields?.length ? opts.fields : ["id"]).map((field) => field.startsWith("cf:") ? this.sanitize(field) : field));
+    for (const key of cfKeys) projectedFields.add(this.sanitize(`cf:${key}`));
+    const hiddenFields = /* @__PURE__ */ new Set();
+    const comparisonFields = scanPlaintext ? Array.from(/* @__PURE__ */ new Set([...deferredFilters.map((filter) => filter.field), ...(opts.sort ?? []).map((sort) => sort.field)])) : [];
+    for (const field of comparisonFields) {
+      const outputKey = field.startsWith("cf:") ? this.sanitize(field) : field;
+      if (!projectedFields.has(outputKey)) hiddenFields.add(outputKey);
+    }
     const applySelection = (q) => {
       let next = q;
-      const requested = opts.fields && opts.fields.length ? opts.fields : ["id"];
+      const requested = Array.from(/* @__PURE__ */ new Set([...opts.fields?.length ? opts.fields : ["id"], ...comparisonFields]));
       for (const field of requested) {
         const f = String(field);
         if (f.startsWith("cf:")) {
           const aliasName = this.sanitize(f);
           next = next.select(this.jsonbSqlAlias(alias, f).as(aliasName));
-        } else if (f === "id") {
-          next = next.select(`${alias}.entity_id as id`);
-        } else if (f === "created_at" || f === "updated_at" || f === "deleted_at") {
-          next = next.select(`${alias}.${f} as ${f}`);
+        } else if (this.resolveCustomEntityColumn(alias, f)) {
+          next = next.select(`${this.resolveCustomEntityColumn(alias, f)} as ${f}`);
         } else {
-          const expr = sql`(${sql.ref(alias + ".doc")} ->> ${f})`;
+          const expr = isProtected(f) ? sql`(${sql.ref(alias + ".doc")} -> ${f})` : sql`(${sql.ref(alias + ".doc")} ->> ${f})`;
           next = next.select(expr.as(f));
         }
       }
@@ -1844,6 +1951,12 @@ class HybridQueryEngine {
         const aliasName = this.sanitize(`cf:${key}`);
         next = next.select(this.jsonbSqlAlias(alias, `cf:${key}`).as(aliasName));
       }
+      for (const [field, comparisonAlias] of jsonComparisonAliases) {
+        next = next.select(sql`(${sql.ref(alias + ".doc")} -> ${field})`.as(comparisonAlias));
+      }
+      if (encryptionService) {
+        next = next.select([`${alias}.tenant_id as __om_ce_tenant_id`, `${alias}.organization_id as __om_ce_organization_id`]);
+      }
       return next;
     };
     const applySort = (q) => {
@@ -1866,6 +1979,60 @@ class HybridQueryEngine {
     };
     const page = opts.page?.page ?? 1;
     const pageSize = opts.page?.pageSize ?? 20;
+    const decryptRow = async (item) => {
+      let next = item;
+      if (encryptionService) {
+        const hasOrganizationScope = Object.prototype.hasOwnProperty.call(item, "__om_ce_organization_id");
+        const decision = resolveDecryptScope({
+          rowTenantId: Object.prototype.hasOwnProperty.call(item, "__om_ce_tenant_id") ? item.__om_ce_tenant_id : item.tenant_id ?? null,
+          rowOrganizationId: hasOrganizationScope ? item.__om_ce_organization_id : item.organization_id ?? null,
+          callerTenantId: opts.tenantId,
+          callerOrganizationId: hasOrganizationScope ? null : opts.organizationId ?? null
+        });
+        if (decision.decrypt) {
+          const fields = Object.entries(resolveKinds(decision.organizationId, decision.tenantId)).map(([key, kind]) => ({ key, kind, encrypted: encryptedKeys.has(key) }));
+          next = await decryptCustomEntityDocument(item, fields, decision.tenantId, documentEncryptionService);
+        }
+      }
+      const projected = { ...next };
+      delete projected.__om_ce_tenant_id;
+      delete projected.__om_ce_organization_id;
+      return projected;
+    };
+    if (scanPlaintext) {
+      const maxRows = resolveEncryptedSortMaxRows();
+      let candidateQuery = applySelection(applyScope(db.selectFrom(`custom_entities_storage as ${alias}`)));
+      if (maxRows !== null) candidateQuery = candidateQuery.limit(maxRows + 1);
+      const rows2 = await candidateQuery.execute();
+      if (maxRows !== null && rows2.length > maxRows) throw new Error("[internal] Custom entity encrypted query exceeds the candidate row limit");
+      let candidates = await mapWithConcurrency(rows2, DECRYPT_CONCURRENCY, decryptRow);
+      if (plaintextFilters) {
+        const common = deferredFilters.filter((filter) => !filter.orGroup);
+        const groups = /* @__PURE__ */ new Map();
+        for (const filter of normalizedFilters) {
+          if (filter.orGroup) groups.set(filter.orGroup, [...groups.get(filter.orGroup) ?? [], filter]);
+        }
+        const matches = (row, filter) => {
+          const comparisonAlias = jsonComparisonAliases.get(filter.field);
+          return matchesCustomDocumentFilter(row, filter, comparisonAlias ? row[comparisonAlias] : customDocumentValue(row, filter.field));
+        };
+        candidates = candidates.filter((row) => common.every((filter) => matches(row, filter)) && (!groups.size || Array.from(groups.values()).some((group) => group.every((filter) => matches(row, filter)))));
+      }
+      for (const row of candidates) {
+        for (const sort of opts.sort ?? []) {
+          if (isProtected(sort.field)) assertCustomDocumentPlaintext(customDocumentValue(row, sort.field));
+        }
+      }
+      candidates = sortRowsInMemory(candidates, (opts.sort ?? []).map((sort) => ({ ...sort, field: sort.field.startsWith("cf:") ? this.sanitize(sort.field) : sort.field })));
+      const total2 = candidates.length;
+      const items2 = candidates.slice((page - 1) * pageSize, page * pageSize).map((row) => {
+        const projected = { ...row };
+        for (const field of hiddenFields) delete projected[field];
+        for (const comparisonAlias of jsonComparisonAliases.values()) delete projected[comparisonAlias];
+        return projected;
+      });
+      return { items: items2, page, pageSize, total: total2 };
+    }
     const countCap = resolveListCountCap();
     const root = db.selectFrom(`custom_entities_storage as ${alias}`);
     const countShape = applyScope(root);
@@ -1882,7 +2049,8 @@ class HybridQueryEngine {
     dataQuery = applySelection(dataQuery);
     dataQuery = applySort(dataQuery);
     dataQuery = dataQuery.limit(pageSize).offset((page - 1) * pageSize);
-    const items = await dataQuery.execute();
+    const rows = await dataQuery.execute();
+    const items = encryptionService ? await mapWithConcurrency(rows, DECRYPT_CONCURRENCY, decryptRow) : rows;
     const result = { items, page, pageSize, total };
     if (listCountCapWarning) result.meta = { listCountCapWarning };
     return result;
@@ -1895,12 +2063,12 @@ class HybridQueryEngine {
     if (present) baseTableExistsCache.set(table, true);
     return present;
   }
-  async resolveCustomFieldDefs(entityIds, tenantId) {
+  async resolveCustomFieldDefs(entityIds, tenantId, fresh = false) {
     if (!entityIds.length) return [];
     const cacheKey = this.customFieldKeysCacheKey(entityIds, tenantId);
     const now = Date.now();
     const cached = this.customFieldDefsCache.get(cacheKey);
-    if (cached && cached.expiresAt > now) return cached.value.slice();
+    if (!fresh && cached && cached.expiresAt > now) return cached.value.slice();
     const db = this.getDb();
     const rows = await db.selectFrom("custom_field_defs").select(["entity_id", "key", "kind", "organization_id", "tenant_id", "config_json", "updated_at"]).where("entity_id", "in", entityIds).where("is_active", "=", true).where((eb) => eb.or([
       eb("tenant_id", "=", tenantId),