@open-mercato/core 0.10.1-develop.8004.1.a8a79ee43f → 0.10.1-develop.8022.1.b6753de892

package/dist/modules/entities/cli.js

@@ -406,6 +406,18 @@ function formatValueForColumn(prop, value) {
   if (!isJson) return value;
   return JSON.stringify(value);
 }
+async function updateEncryptionColumns(connection, table, primaryKey, row, updates, scope) {
+  const columns = Object.keys(updates);
+  const assignments = columns.map((column) => `"${column}" = ?`).join(", ");
+  const unchanged = columns.map((column) => `"${column}" IS NOT DISTINCT FROM ?`).join(" AND ");
+  const result = await connection.execute(
+    `UPDATE ${table} SET ${assignments} WHERE "${primaryKey}" = ? AND tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? AND ${unchanged} RETURNING "${primaryKey}"`,
+    [...Object.values(updates), row[primaryKey], scope.tenantId, scope.organizationId, ...columns.map((column) => row[column])]
+  );
+  if (!Array.isArray(result) || result.length !== 1) {
+    failCli("[internal] A row changed concurrently during encryption maintenance. No stale values were written; retry after stopping writers.");
+  }
+}
 const rotateEncryptionKey = {
   command: "rotate-encryption-key",
   async run(rest) {
@@ -417,6 +429,9 @@ const rotateEncryptionKey = {
     if (oldKeyArgument && oldKeyEnvironment && normalizeKeyInput(oldKeyArgument) !== oldKeyEnvironment) {
       failCli(`--old-key and ${OLD_ENCRYPTION_KEY_ENV} contain different values. Remove --old-key and retry.`);
     }
+    if (oldKeyArgument && parseBooleanToken(String(args["allow-unsafe-old-key"])) !== true) {
+      failCli(`--old-key is deprecated because process listings expose it. Use ${OLD_ENCRYPTION_KEY_ENV}; the compatibility bridge requires --allow-unsafe-old-key.`);
+    }
     if (oldKeyArgument) {
       console.warn(
         `Passing key material through --old-key can expose it in shell history and process listings. Set ${OLD_ENCRYPTION_KEY_ENV} through your secret manager instead.`
@@ -613,11 +628,7 @@ const rotateEncryptionKey = {
         }
         if (!Object.keys(updates).length) continue;
         if (!dryRun) {
-          const setSql = Object.keys(updates).map((col) => `"${col}" = ?`).join(", ");
-          await conn.execute(
-            `update ${qualifiedTable} set ${setSql} where "${pk}" = ?`,
-            [...Object.values(updates), row[pk]]
-          );
+          await updateEncryptionColumns(conn, qualifiedTable, pk, row, updates, scope);
         }
         updated += 1;
       }
@@ -685,6 +696,9 @@ const decryptDatabase = {
         failCli(`--confirm value "${confirm}" does not match --tenant "${tenantIdArg}". Aborting.`);
       }
     }
+    if (deactivateMaps && !dryRun && args["confirm-offline-maintenance"] !== tenantIdArg) {
+      failCli("--deactivate-maps requires all application and worker writers stopped. Confirm offline maintenance with --confirm-offline-maintenance <tenantUuid>; restart every replica before resuming writes.");
+    }
     const { resolve } = await createRequestContainer();
     const em = resolve("em");
     const conn = em?.getConnection?.();
@@ -695,23 +709,10 @@ const decryptDatabase = {
       failCli("TENANT_DATA_ENCRYPTION is disabled; aborting. Data may already be decrypted.");
     }
     const metaByEntityId = buildEntityMetaRegistry(em);
-    const resolveDecryptScopes = async (tenantId, organizationId) => {
-      if (organizationId) return [{ tenantId, organizationId }];
-      const rows = await conn.execute(
-        `SELECT DISTINCT organization_id FROM encryption_maps WHERE tenant_id = ? AND deleted_at IS NULL`,
-        [tenantId]
-      );
-      const orgIds = /* @__PURE__ */ new Set();
-      for (const row of Array.isArray(rows) ? rows : []) {
-        orgIds.add(row.organization_id ?? null);
-      }
-      orgIds.add(null);
-      return Array.from(orgIds).map((orgId) => ({ tenantId, organizationId: orgId }));
-    };
     const mapWhere = { tenantId: tenantIdArg, deletedAt: null, isActive: true };
-    if (organizationIdArg) mapWhere.organizationId = organizationIdArg;
+    if (organizationIdArg) mapWhere.$or = [{ organizationId: organizationIdArg }, { organizationId: null }];
     if (entityIdArg) mapWhere.entityId = entityIdArg;
-    const allMaps = await em.find(EncryptionMap, mapWhere);
+    const allMaps = await em.find(EncryptionMap, mapWhere, { orderBy: { organizationId: "asc", createdAt: "asc", id: "asc" } });
     const systemScopedEntityIds = await getSystemScopedEntityIds();
     const maps = allMaps.filter((map) => {
       if (!systemScopedEntityIds.has(String(map.entityId))) return true;
@@ -725,6 +726,38 @@ const decryptDatabase = {
       return;
     }
     const resolvedMaps = resolveMapsOrFail(maps, metaByEntityId);
+    const resolveProcessingMaps = async (executeQuery = (query, parameters) => conn.execute(query, parameters)) => {
+      const groups = /* @__PURE__ */ new Map();
+      for (const entry of resolvedMaps) {
+        const key = JSON.stringify([entry.mapMeta.tenantId, entry.mapMeta.entityId]);
+        groups.set(key, [...groups.get(key) ?? [], entry]);
+      }
+      const result = [];
+      for (const entries of groups.values()) {
+        const template = entries[0];
+        const { entityId, tenantId, meta } = template.mapMeta;
+        const table = meta.schema ? `"${meta.schema}"."${meta.tableName}"` : `"${meta.tableName}"`;
+        const scopes = new Set(organizationIdArg ? [organizationIdArg] : [null]);
+        if (!organizationIdArg) {
+          const rows = await executeQuery(`SELECT DISTINCT organization_id FROM ${table} WHERE tenant_id = ?`, [tenantId]);
+          for (const row of Array.isArray(rows) ? rows : []) scopes.add(row.organization_id ?? null);
+        }
+        for (const organizationId of scopes) {
+          const hasExactPolicy = organizationId !== null && allMaps.some((map) => map.entityId === entityId && map.tenantId === tenantId && map.organizationId === organizationId);
+          const applicable = organizationId === null ? [...entries].sort((left, right) => Number(Boolean(left.map.organizationId)) - Number(Boolean(right.map.organizationId))) : entries.filter(({ map }) => hasExactPolicy ? map.organizationId === organizationId : !map.organizationId);
+          const fields = /* @__PURE__ */ new Map();
+          for (const entry of applicable) {
+            for (const field of entry.mapMeta.fields) {
+              const existing = fields.get(field.field);
+              fields.set(field.field, existing ? { ...existing, hashField: existing.hashField ?? field.hashField } : field);
+            }
+          }
+          if (fields.size) result.push({ mapMeta: { ...template.mapMeta, fields: [...fields.values()] }, scope: { tenantId, organizationId } });
+        }
+      }
+      return result;
+    };
+    const processingMaps = await resolveProcessingMaps();
     const kms = createKmsService();
     const dekCache = /* @__PURE__ */ new Map();
     const getDek = async (tenantId) => {
@@ -741,7 +774,7 @@ const decryptDatabase = {
       let malformedPayloadCountSampled = 0;
       const uninspectableEntityIds = [];
       const failedSampleScopes = [];
-      for (const { map, mapMeta } of resolvedMaps) {
+      for (const { mapMeta, scope } of processingMaps) {
         const { entityId, meta, fields, tenantId } = mapMeta;
         const dek = await getDek(tenantId).catch(() => null);
         if (!dek) {
@@ -749,25 +782,25 @@ const decryptDatabase = {
           uninspectableEntityIds.push(entityId);
           continue;
         }
-        const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null);
         const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : "id";
         const tableName = meta.tableName;
         const schema = meta?.schema;
         const qualifiedTable = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
-        const fieldCols = fields.flatMap((f) => {
-          const r = resolveProperty(meta, f.field);
-          return r.columnName ? [r.columnName] : [];
-        });
+        const scopes = [scope];
+        const fieldCols = fields.flatMap((field) => [
+          resolveProperty(meta, field.field).columnName,
+          field.hashField ? resolveProperty(meta, field.hashField).columnName : null
+        ].filter((column) => Boolean(column)));
         const colList = Array.from(/* @__PURE__ */ new Set([pk, ...fieldCols]));
-        for (const scope of scopes) {
+        for (const scope2 of scopes) {
           let sampleRows;
           try {
             sampleRows = await conn.execute(
               `SELECT ${colList.map((c) => `"${c}"`).join(", ")} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? LIMIT 100`,
-              [scope.tenantId, scope.organizationId]
+              [scope2.tenantId, scope2.organizationId]
             );
           } catch (error) {
-            const scopeLabel = scope.organizationId ?? "global";
+            const scopeLabel = scope2.organizationId ?? "global";
             const errorMessage = error instanceof Error ? error.message : String(error);
             console.warn(`\u26A0 Could not sample ${entityId} for organization ${scopeLabel}: ${errorMessage}`);
             failedSampleScopes.push(`${entityId} (organization_id=${scopeLabel})`);
@@ -784,8 +817,9 @@ const decryptDatabase = {
               try {
                 decryptWithAesGcmStrict(String(rawValue), dek.key);
                 rowHasEncrypted = true;
-              } catch (e) {
-                if (e instanceof TenantDataEncryptionError && e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {
+              } catch (error) {
+                if (isEncryptedPayloadShape(rawValue)) throw error;
+                if (error instanceof TenantDataEncryptionError && error.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {
                   malformedPayloadCountSampled++;
                 }
               }
@@ -826,26 +860,26 @@ const decryptDatabase = {
       }
       deksByTenantId.set(mapMeta.tenantId, dek);
     }
-    for (const { map, mapMeta } of resolvedMaps) {
+    for (const { mapMeta, scope } of processingMaps) {
       const { entityId, meta, fields, tenantId } = mapMeta;
       const dek = deksByTenantId.get(tenantId);
       const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : "id";
       const tableName = meta.tableName;
       const schema = meta?.schema;
       const qualifiedTable = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
-      const fieldCols = fields.flatMap((f) => {
-        const r = resolveProperty(meta, f.field);
-        return r.columnName ? [r.columnName] : [];
-      });
+      const fieldCols = fields.flatMap((field) => [
+        resolveProperty(meta, field.field).columnName,
+        field.hashField ? resolveProperty(meta, field.hashField).columnName : null
+      ].filter((column) => Boolean(column)));
       const colList = Array.from(/* @__PURE__ */ new Set([pk, ...fieldCols]));
       totalEntitiesProcessed++;
-      const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null);
-      for (const scope of scopes) {
+      const scopes = [scope];
+      for (const scope2 of scopes) {
         let lastId = null;
         let scopeMalformedCount = 0;
         while (true) {
           let selectSql = `SELECT ${colList.map((c) => `"${c}"`).join(", ")} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ?`;
-          const selectParams = [scope.tenantId, scope.organizationId];
+          const selectParams = [scope2.tenantId, scope2.organizationId];
           if (lastId !== null) {
             selectSql += ` AND "${pk}" > ?`;
             selectParams.push(lastId);
@@ -881,19 +915,20 @@ const decryptDatabase = {
                   }
                   updates[col] = valueToWrite;
                   rowDecrypted = true;
-                } catch (e) {
-                  if (e instanceof TenantDataEncryptionError) {
-                    if (e.code === TenantDataEncryptionErrorCode.AUTH_FAILED) {
-                    } else if (e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {
+                } catch (error) {
+                  if (error instanceof TenantDataEncryptionError) {
+                    if (error.code === TenantDataEncryptionErrorCode.AUTH_FAILED) {
+                      if (isEncryptedPayloadShape(rawValue)) throw error;
+                    } else if (error.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {
                       scopeMalformedCount++;
                       const locationKey = `${tableName}:${col}`;
                       malformedByLocation.set(locationKey, (malformedByLocation.get(locationKey) ?? 0) + 1);
                       console.warn(`\u26A0 MALFORMED_PAYLOAD for ${entityId} field "${col}" row ${row[pk]}; skipping field.`);
                     } else {
-                      throw e;
+                      throw error;
                     }
                   } else {
-                    throw e;
+                    throw error;
                   }
                 }
               }
@@ -916,11 +951,7 @@ const decryptDatabase = {
               }
               if (Object.keys(updates).length > 0) {
                 if (!dryRun) {
-                  const setSql = Object.keys(updates).map((col) => `"${col}" = ?`).join(", ");
-                  await conn.execute(
-                    `UPDATE ${qualifiedTable} SET ${setSql} WHERE "${pk}" = ?`,
-                    [...Object.values(updates), row[pk]]
-                  );
+                  await updateEncryptionColumns(conn, qualifiedTable, pk, row, updates, scope2);
                 }
                 totalRowsUpdated++;
               }
@@ -940,7 +971,7 @@ const decryptDatabase = {
           const batchDurationMs = Date.now() - batchStart;
           if (debug) {
             console.log(
-              `[debug] Batch ${entityId} org=${scope.organizationId ?? "null"}: ${batch.length} rows in ${batchDurationMs}ms, scopeMalformed=${scopeMalformedCount}`
+              `[debug] Batch ${entityId} org=${scope2.organizationId ?? "null"}: ${batch.length} rows in ${batchDurationMs}ms, scopeMalformed=${scopeMalformedCount}`
             );
             if (batchDurationMs > 3e4) {
               console.warn("\u26A0 Batch took >30s; consider reducing --batch-size.");
@@ -978,27 +1009,68 @@ ${prefix}Decryption summary:`);
         `${totalMalformedPayloadCount} field value(s) could not be decrypted because their ciphertext was malformed. Encryption maps were left active.`
       );
     }
+    const retiring = resolvedMaps.filter(({ map }) => !organizationIdArg || Boolean(map.organizationId));
     if (deactivateMaps && !dryRun) {
-      let deactivateSql = `UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND deleted_at IS NULL`;
-      const deactivateParams = [tenantIdArg];
-      if (organizationIdArg) {
-        deactivateSql += ` AND (organization_id = ? OR organization_id IS NULL)`;
-        deactivateParams.push(organizationIdArg);
-      }
-      if (entityIdArg) {
-        deactivateSql += ` AND entity_id = ?`;
-        deactivateParams.push(entityIdArg);
+      if (retiring.length) {
+        const policySignature = (policies) => JSON.stringify(policies.map((map) => [map.id, map.entityId, map.tenantId, map.organizationId, map.fieldsJson]).sort((left, right) => String(left[0]).localeCompare(String(right[0]))));
+        const selectedPolicySignature = policySignature(allMaps);
+        await em.transactional(async (transaction) => {
+          const executeProtected = (query, parameters = []) => transaction.getConnection().execute(query, parameters, "all", transaction.getTransactionContext());
+          const tables = Array.from(new Set(resolvedMaps.map(({ mapMeta }) => {
+            const { meta } = mapMeta;
+            return meta.schema ? `"${meta.schema}"."${meta.tableName}"` : `"${meta.tableName}"`;
+          }))).sort((left, right) => left.localeCompare(right));
+          await executeProtected(`LOCK TABLE encryption_maps, ${tables.join(", ")} IN SHARE ROW EXCLUSIVE MODE`);
+          const lockedPolicies = await transaction.find(EncryptionMap, mapWhere, { refresh: true });
+          if (policySignature(lockedPolicies) !== selectedPolicySignature) {
+            failCli("[internal] Encryption policies changed during maintenance. Maps remain active; retry against the current policies.");
+          }
+          for (const { mapMeta, scope } of await resolveProcessingMaps(executeProtected)) {
+            const { meta, fields, entityId, tenantId } = mapMeta;
+            const table = meta.schema ? `"${meta.schema}"."${meta.tableName}"` : `"${meta.tableName}"`;
+            const columns = fields.map((field) => resolveProperty(meta, field.field).columnName).filter((column) => Boolean(column));
+            const scopes = [scope];
+            for (const scope2 of scopes) {
+              const primaryKey = meta.primaryKeys?.[0] ?? "id";
+              const selectedColumns = [.../* @__PURE__ */ new Set([primaryKey, ...columns])];
+              let lastVerifiedId = null;
+              while (true) {
+                let query = `SELECT ${selectedColumns.map((column) => `"${column}"`).join(", ")} FROM ${table} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ?`;
+                const parameters = [scope2.tenantId, scope2.organizationId];
+                if (lastVerifiedId !== null) {
+                  query += ` AND "${primaryKey}" > ?`;
+                  parameters.push(lastVerifiedId);
+                }
+                query += ` ORDER BY "${primaryKey}" LIMIT ?`;
+                parameters.push(batchSize);
+                const rows = await executeProtected(query, parameters);
+                const batch = Array.isArray(rows) ? rows : [];
+                if (!batch.length) break;
+                if (batch.some((row) => columns.some((column) => isEncryptedPayloadShape(row[column])))) {
+                  failCli("[internal] Encrypted values remain during the protected final sweep. Encryption maps remain active; stop writers and retry.");
+                }
+                lastVerifiedId = String(batch[batch.length - 1][primaryKey]);
+              }
+            }
+          }
+          const ids = retiring.map(({ map }) => map.id);
+          if (ids.some((id) => typeof id !== "string" || !id)) failCli("[internal] Cannot retire an encryption map without its identifier.");
+          await executeProtected(`UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND id IN (${ids.map(() => "?").join(", ")}) AND deleted_at IS NULL`, [tenantIdArg, ...ids]);
+        });
+        console.warn("\u26A0 Restart all application replicas before resuming writes \u2014 in-process map caches may still be active.");
       }
-      await conn.execute(deactivateSql, deactivateParams);
-      console.warn("\u26A0 Restart all application replicas \u2014 in-process map caches may still be active.");
-      if (isTenantDataEncryptionEnabled()) {
-        console.warn("\u26A0 Env TENANT_DATA_ENCRYPTION is still true \u2014 new writes will be re-encrypted until env is updated and replicas restarted.");
+      if (organizationIdArg && resolvedMaps.some(({ map }) => !map.organizationId)) {
+        console.warn("\u26A0 Tenant-wide fallback encryption maps remain active after organization-only decryption. Run a complete tenant sweep before retiring them.");
       }
     }
     if (deactivateMaps && dryRun) {
-      console.log(`[dry-run] Would deactivate ${maps.length} EncryptionMap record(s).`);
+      console.log(`[dry-run] Would deactivate ${retiring.length} EncryptionMap record(s).`);
+    }
+    if (!dryRun && organizationIdArg) {
+      console.log(`
+\u2705 Organization-scoped decryption complete. Keep tenant encryption enabled; tenant-wide fallback policies may still protect other organizations. Restart replicas before resuming writes.`);
     }
-    if (!dryRun) {
+    if (!dryRun && !organizationIdArg) {
       console.log(`
 \u2705 Decryption complete. Required next steps:`);
       console.log(`   1. Set TENANT_DATA_ENCRYPTION=false in your environment / secrets`);