@open-mercato/core 0.10.1-develop.7767.2.440f7c2b4c → 0.10.1-develop.7769.1.0e6458bb99

package/src/modules/auth/lib/authorizationStateLocks.ts

@@ -195,7 +195,6 @@ export async function lockAuthorizationState(
   }
 
   const apiKeyIds = uniqueSortedIds(targets.apiKeyIds ?? [])
-  const userIds = uniqueSortedIds(targets.userIds ?? [])
   const explicitRoleIds = uniqueSortedIds(targets.roleIds ?? [])
   const tenantIds = uniqueSortedIds(targets.tenantIds ?? [])
   const explicitApiKeys = apiKeyIds.length
@@ -207,9 +206,16 @@ export async function lockAuthorizationState(
         { tenantId: null, organizationId: null },
       )
     : []
-  const explicitApiKeyRoleIds = uniqueSortedIds(explicitApiKeys.flatMap((apiKey) => (
-    Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : []
-  )))
+  const explicitApiKeySnapshots = new Map(explicitApiKeys.map((apiKey) => [String(apiKey.id), {
+    sessionUserId: apiKey.sessionUserId ?? null,
+    roles: Array.isArray(apiKey.rolesJson) ? [...apiKey.rolesJson] : [],
+  }]))
+  const apiKeySnapshots = [...explicitApiKeySnapshots.values()]
+  const userIds = uniqueSortedIds([
+    ...(targets.userIds ?? []),
+    ...apiKeySnapshots.flatMap((apiKey) => apiKey.sessionUserId ? [apiKey.sessionUserId] : []),
+  ])
+  const explicitApiKeyRoleIds = uniqueSortedIds(apiKeySnapshots.flatMap((apiKey) => apiKey.roles))
   const discoveredBeforeLocks = userIds.length
     ? await findWithDecryption(
         em,
@@ -236,10 +242,10 @@ export async function lockAuthorizationState(
   for (const apiKey of lockedApiKeys) {
     const id = String(apiKey.id)
     if (!apiKeyIds.includes(id)) continue
-    const before = explicitApiKeys.find((candidate) => String(candidate.id) === id)
-    const beforeRoles = Array.isArray(before?.rolesJson) ? before.rolesJson : []
+    const before = explicitApiKeySnapshots.get(id)
+    const beforeRoles = before?.roles ?? []
     const lockedRoles = Array.isArray(apiKey.rolesJson) ? apiKey.rolesJson : []
-    if (!sameIds(beforeRoles, lockedRoles)) {
+    if (!sameIds(beforeRoles, lockedRoles) || (before?.sessionUserId ?? null) !== (apiKey.sessionUserId ?? null)) {
       throw authorizationStateDrift()
     }
   }

package/src/modules/auth/services/rbacService.ts

@@ -13,6 +13,7 @@ import {
   resolveEffectiveFeatures,
 } from '@open-mercato/shared/security/featurePolicy'
 import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import { resolveRoleOrganizationScope, roleAclAllowsOrganization } from './roleOrganizationScope'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -24,6 +25,27 @@ interface AclData {
   organizations: string[] | null
 }
 
+function intersectDelegatedAcl(keyAcl: AclData, ownerAcl: AclData): AclData {
+  const keyFeatures = keyAcl.isSuperAdmin ? ['*'] : keyAcl.features
+  const ownerFeatures = ownerAcl.isSuperAdmin ? ['*'] : ownerAcl.features
+  const features = Array.from(new Set([
+    ...keyFeatures.filter((feature) => hasFeature(ownerFeatures, feature)),
+    ...ownerFeatures.filter((feature) => hasFeature(keyFeatures, feature)),
+  ]))
+  const keyOrganizations = keyAcl.isSuperAdmin || keyAcl.organizations?.includes('__all__')
+    ? null : keyAcl.organizations
+  const ownerOrganizations = ownerAcl.isSuperAdmin || ownerAcl.organizations?.includes('__all__')
+    ? null : ownerAcl.organizations
+  const organizations = keyOrganizations === null ? ownerOrganizations
+    : ownerOrganizations === null ? keyOrganizations
+      : keyOrganizations.filter((organizationId) => ownerOrganizations.includes(organizationId))
+  return {
+    isSuperAdmin: keyAcl.isSuperAdmin && ownerAcl.isSuperAdmin,
+    features: organizations?.length === 0 ? [] : features,
+    organizations,
+  }
+}
+
 async function resolveRoleOrganizationScopeWithEntityManager(
   em: EntityManager,
   tenantId: string | null,
@@ -81,7 +103,7 @@ type FeatureOrganizationRoleGrant = {
 
 type FeatureOrganizationGrants =
   | { kind: 'none' }
-  | { kind: 'api_key'; organizationId: string | null; roleGrants: FeatureOrganizationRoleGrant[] }
+  | { kind: 'api_key'; organizationId: string | null; ownerId: string | null; roleGrants: FeatureOrganizationRoleGrant[] }
   | { kind: 'user_acl'; isSuperAdmin: boolean; features: string[]; organizations: string[] | null }
   | { kind: 'roles'; roleGrants: FeatureOrganizationRoleGrant[] }
 
@@ -105,6 +127,7 @@ function isFeatureOrganizationGrants(value: unknown): value is FeatureOrganizati
       return true
     case 'api_key':
       return (record.organizationId === null || typeof record.organizationId === 'string')
+        && (record.ownerId === null || typeof record.ownerId === 'string')
         && Array.isArray(record.roleGrants)
         && record.roleGrants.every(isFeatureOrganizationRoleGrant)
     case 'user_acl':
@@ -260,7 +283,8 @@ export class RbacService {
   }
 
   private getCacheKey(userId: string, scope: { tenantId: string | null; organizationId: string | null }): string {
-    return `rbac:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`
+    const namespace = userId.startsWith('api_key:') ? 'rbac:delegated-v1' : 'rbac'
+    return `${namespace}:${userId}:${scope.tenantId || 'null'}:${scope.organizationId || 'null'}`
   }
 
   private getUserTag(userId: string): string {
@@ -282,12 +306,12 @@ export class RbacService {
     return isAclData(cached) ? cached : null
   }
 
-  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }): Promise<void> {
+  private async setCache(cacheKey: string, data: AclData, userId: string, scope: { tenantId: string | null; organizationId: string | null }, ownerId?: string | null): Promise<void> {
     if (!this.cache) return
 
     await this.cache.set(cacheKey, data, {
       ttl: this.cacheTtlMs,
-      tags: this.buildCacheTags(userId, scope),
+      tags: [...this.buildCacheTags(userId, scope), ...(ownerId ? [this.getUserTag(ownerId)] : [])],
     })
   }
 
@@ -584,8 +608,9 @@ export class RbacService {
       // the key is restricted so downstream super-admin shortcuts cannot
       // bypass the key or role organization bounds.
       if (isSuper && organizations !== null && !features.includes('*')) features.push('*')
-      const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }
-      if (cacheable) await this.setCache(cacheKey, result, userId, scope)
+      const keyAcl = { isSuperAdmin: isSuper && organizations === null, features, organizations }
+      const result = await this.limitDelegatedKeyAcl(em, key, { tenantId, organizationId: evaluatedOrganizationId }, keyAcl)
+      if (cacheable) await this.setCache(cacheKey, result, userId, { tenantId, organizationId: evaluatedOrganizationId }, key.sessionUserId)
       return result
     }
 
@@ -795,7 +820,13 @@ export class RbacService {
           : []
       }
       if (isSuperAdmin && organizations !== null && !features.includes('*')) features.push('*')
-      return { isSuperAdmin: isSuperAdmin && organizations === null, features, organizations }
+      return this.limitDelegatedKeyAcl(
+        em,
+        key,
+        { tenantId, organizationId: evaluatedOrganizationId },
+        { isSuperAdmin: isSuperAdmin && organizations === null, features, organizations },
+        true,
+      )
     }
 
     const user = await findOneWithDecryption(
@@ -997,6 +1028,33 @@ export class RbacService {
     })
   }
 
+  private async limitDelegatedKeyAcl(
+    em: EntityManager,
+    key: ApiKey,
+    scope: { tenantId: string | null; organizationId: string | null },
+    keyAcl: AclData,
+    uncached = false,
+  ): Promise<AclData> {
+    if (!key.sessionUserId) return keyAcl
+    if (!key.tenantId || key.tenantId !== scope.tenantId) {
+      return { isSuperAdmin: false, features: [], organizations: [] }
+    }
+    const owner = await findOneWithDecryption(em, User, {
+      id: key.sessionUserId,
+      tenantId: key.tenantId,
+      deletedAt: null,
+    }, undefined, scope)
+    if (!owner) return { isSuperAdmin: false, features: [], organizations: [] }
+    const ownerAcl = uncached
+      ? await this.loadAclWithEntityManager(em, key.sessionUserId, scope)
+      : await this.loadAcl(key.sessionUserId, scope)
+    const result = intersectDelegatedAcl(keyAcl, ownerAcl)
+    if (scope.organizationId && result.organizations && !result.organizations.includes(scope.organizationId)) {
+      return { ...result, isSuperAdmin: false, features: [] }
+    }
+    return result
+  }
+
   async resolveFeatureOrganizationAccess(
     userId: string,
     required: readonly string[],
@@ -1029,13 +1087,18 @@ export class RbacService {
 
     if (grants.kind === 'api_key') {
       const keyOrganizationId = grants.organizationId
+      const ownerAccess = grants.ownerId
+        ? await this.resolveFeatureOrganizationAccess(grants.ownerId, required, input)
+        : { unrestricted: true, filterOrganizationIds: allowAll }
       const unrestricted = keyOrganizationId === null
+        && ownerAccess.unrestricted
         && roleAclsAuthorizeFeaturesGlobally(grants.roleGrants, required, true)
       if (unrestricted) return { unrestricted: true, filterOrganizationIds: allowAll }
 
       return {
         unrestricted: false,
         filterOrganizationIds: (candidates) => normalizeFeatureOrganizationCandidates(candidates)
+          .filter((organization) => ownerAccess.filterOrganizationIds([organization]).length > 0)
           .filter((organization) => (
             (!keyOrganizationId || organization.id === keyOrganizationId)
             && roleAclsAuthorizeFeatures(grants.roleGrants, required, organization, true)
@@ -1091,7 +1154,7 @@ export class RbacService {
     userId: string,
     tenantId: string,
   ): Promise<FeatureOrganizationGrants> {
-    const cacheKey = `rbac:feature-organizations:${userId}:${tenantId}`
+    const cacheKey = `rbac:feature-organizations:delegated-v1:${userId}:${tenantId}`
     const key = userId.startsWith('api_key:')
       ? await this.em.fork().findOne(ApiKey, { id: userId.slice('api_key:'.length), deletedAt: null })
       : undefined
@@ -1104,7 +1167,10 @@ export class RbacService {
     if (this.cache && cacheable) {
       await this.cache.set(cacheKey, grants, {
         ttl: this.cacheTtlMs,
-        tags: this.buildCacheTags(userId, { tenantId, organizationId: null }),
+        tags: [
+          ...this.buildCacheTags(userId, { tenantId, organizationId: null }),
+          ...(grants.kind === 'api_key' && grants.ownerId ? [this.getUserTag(grants.ownerId)] : []),
+        ],
       })
     }
     return grants
@@ -1129,6 +1195,16 @@ export class RbacService {
         return { kind: 'none' }
       }
 
+      if (key.sessionUserId) {
+        if (key.tenantId !== tenantId) return { kind: 'none' }
+        const owner = await findOneWithDecryption(em, User, {
+          id: key.sessionUserId,
+          tenantId,
+          deletedAt: null,
+        }, undefined, { tenantId, organizationId: null })
+        if (!owner) return { kind: 'none' }
+      }
+
       const roleIds = await resolveApiKeyRoleIds(em, key, tenantId)
       if (!roleIds.length) return { kind: 'none' }
       const roleAcls = await em.find(RoleAcl, {
@@ -1142,6 +1218,7 @@ export class RbacService {
       return {
         kind: 'api_key',
         organizationId: keyOrganizationId,
+        ownerId: key.sessionUserId ?? null,
         roleGrants: roleAcls.map(toFeatureOrganizationRoleGrant),
       }
     }

package/src/modules/directory/utils/organizationScope.ts

@@ -49,7 +49,8 @@ function buildOrgScopeCacheKey(parts: {
 }): string {
   const selected = parts.selectedOrgId ?? 'none'
   const requested = parts.requestedTenantId ?? 'none'
-  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:${parts.userId}:${parts.effectiveTenantId}:${selected}:${requested}`
+  const namespace = parts.userId.startsWith('api_key:') ? `${ORG_SCOPE_CACHE_KEY_PREFIX}:delegated-v1` : ORG_SCOPE_CACHE_KEY_PREFIX
+  return `${namespace}:${parts.userId}:${parts.effectiveTenantId}:${selected}:${requested}`
 }
 
 // Tag builders are exported so the modules that own the "this user's scope
@@ -65,10 +66,11 @@ export function buildOrgScopeTenantCacheTag(tenantId: string): string {
   return `${ORG_SCOPE_CACHE_KEY_PREFIX}:tenant:${tenantId}`
 }
 
-function buildOrgScopeCacheTags(parts: { userId: string; effectiveTenantId: string }): string[] {
+function buildOrgScopeCacheTags(parts: { userId: string; effectiveTenantId: string; ownerUserId: string | null }): string[] {
   return [
     buildOrgScopeUserCacheTag(parts.userId),
     buildOrgScopeTenantCacheTag(parts.effectiveTenantId),
+    ...(parts.ownerUserId ? [buildOrgScopeUserCacheTag(parts.ownerUserId)] : []),
   ]
 }
 
@@ -488,6 +490,7 @@ export async function resolveOrganizationScopeForRequest({
     : null
 
   const userId = typeof auth.sub === 'string' && auth.sub.length > 0 ? auth.sub : null
+  const ownerUserId = auth.isApiKey && typeof auth.userId === 'string' && auth.userId.length > 0 ? auth.userId : null
   const ttlMs = resolveOrgScopeTtlMs()
   const cache = ttlMs > 0 ? resolveCacheFromContainer(container) : null
   const cacheKey = userId
@@ -532,7 +535,7 @@ export async function resolveOrganizationScopeForRequest({
       try {
         await crossRequestCache.set(cacheKey, baseScope, {
           ttl: ttlMs,
-          tags: buildOrgScopeCacheTags({ userId, effectiveTenantId }),
+          tags: buildOrgScopeCacheTags({ userId, effectiveTenantId, ownerUserId }),
         })
       } catch (err) {
         logger.warn('Cache write failed', { err })

package/src/modules/notifications/lib/notificationService.ts

@@ -268,9 +268,13 @@ export type CreateFeatureNotificationServiceInput = CreateFeatureNotificationInp
   restrictRecipientsToOrganization?: boolean
 }
 
+export type CreateBatchNotificationOptions = {
+  skipExistingGroup?: boolean
+}
+
 export interface NotificationService {
   create(input: CreateNotificationInput, ctx: NotificationServiceContext): Promise<Notification>
-  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>
+  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext, options?: CreateBatchNotificationOptions): Promise<Notification[]>
   createForRole(input: CreateRoleNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>
   createForFeature(input: CreateFeatureNotificationServiceInput, ctx: NotificationServiceContext): Promise<Notification[]>
   markAsRead(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>
@@ -436,8 +440,12 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       return notification
     },
 
-    async createBatch(input, ctx) {
+    async createBatch(input, ctx, options) {
+      if (options?.skipExistingGroup && !input.groupKey?.trim()) {
+        throw new Error('[internal] Notification group key is required for deduplicated batch delivery')
+      }
       const recipientUserIds = Array.from(new Set(input.recipientUserIds))
+      if (options?.skipExistingGroup) recipientUserIds.sort((left, right) => left.localeCompare(right))
       const { recipientUserIds: _recipientUserIds, ...content } = input
       const notifications: Notification[] = []
       const resolved = await resolveChannelsForRecipients(content, recipientUserIds, ctx)
@@ -446,12 +454,26 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       await writeEm.transactional(async (tx) => {
         await assertNotificationRecipientsInScope(tx, recipientUserIds, ctx)
         for (const { recipientUserId, channels } of resolved) {
+          if (options?.skipExistingGroup) {
+            const organizationId = normalizeOrgScope(ctx.organizationId)
+            const lockKey = `notifications:${ctx.tenantId}:${organizationId ?? 'global'}:${recipientUserId}:${content.type}:${content.groupKey}`
+            await sql`select pg_advisory_xact_lock(hashtext(${lockKey}))`.execute(getDb(tx))
+            const existing = await tx.findOne(Notification, {
+              recipientUserId,
+              tenantId: ctx.tenantId,
+              organizationId,
+              type: content.type,
+              groupKey: content.groupKey,
+            })
+            if (existing) continue
+          }
           const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx, channels)
           notifications.push(notification)
         }
         await tx.flush()
       })
 
+      if (options?.skipExistingGroup && notifications.length === 0) return []
       await invalidateNotificationCache(container, ctx, 'created')
       await emitNotificationCreatedBatch(eventBus, notifications, ctx)
       await emitNotificationSseEvents(eventBus, notifications, ctx)