@open-mercato/core 0.6.3-develop.3562.1.71049275ff → 0.6.3-develop.3574.1.f3c5dcf345

package/src/modules/auth/lib/grantChecks.ts

@@ -1,8 +1,8 @@
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { hasFeature } from '@open-mercato/shared/security/features'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Role, RoleAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Role, RoleAcl, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 type ActorAcl = {
@@ -33,6 +33,16 @@ type FeatureGrantCheckInput = GrantCheckContext & {
   organizations?: string[] | null
 }
 
+type SuperAdminUserTargetInput = GrantCheckContext & {
+  targetUserId: string
+  actorIsSuperAdmin?: boolean
+}
+
+type SuperAdminRoleTargetInput = GrantCheckContext & {
+  targetRoleId: string
+  actorIsSuperAdmin?: boolean
+}
+
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 export async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {
@@ -99,6 +109,110 @@ export function normalizeGrantFeatureList(features: unknown): string[] {
   return normalizeStringList(features)
 }
 
+export async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator accounts.')
+  }
+}
+
+export async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator roles.')
+  }
+}
+
+async function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {
+  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin
+  const acl = await loadActorAcl(input)
+  return acl.isSuperAdmin
+}
+
+export async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {
+  const directGrant = await em.findOne(
+    UserAcl,
+    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,
+  )
+  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId as unknown } as FilterQuery<UserRole>,
+    { populate: ['role'] },
+    { tenantId: null, organizationId: null },
+  )
+  const roleIds = (Array.isArray(links) ? links : [])
+    .map((link) => {
+      const role = (link as { role?: { id?: unknown } | string | null }).role
+      if (!role) return null
+      if (typeof role === 'string') return role
+      return role.id ? String(role.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (!roleIds.length) return false
+  const roleGrant = await em.findOne(
+    RoleAcl,
+    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {
+  const grant = await em.findOne(
+    RoleAcl,
+    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {
+  const ids = new Set<string>()
+  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }
+  if (tenantId) userAclFilter.tenantId = tenantId
+  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)
+  for (const acl of userAcls) {
+    const userRef = (acl as { user?: { id?: unknown } | string | null }).user
+    const userId = userRef && typeof userRef === 'object'
+      ? userRef.id
+      : userRef
+    if (userId) ids.add(String(userId))
+  }
+  const roleAcls = await em.find(
+    RoleAcl,
+    { isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  const roleIds = roleAcls
+    .map((acl) => {
+      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role
+      if (!roleRef) return null
+      if (typeof roleRef === 'string') return roleRef
+      return roleRef.id ? String(roleRef.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (roleIds.length) {
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,
+      {},
+      { tenantId: null, organizationId: null },
+    )
+    for (const link of Array.isArray(links) ? links : []) {
+      const userRef = (link as { user?: { id?: unknown } | string | null }).user
+      const userId = userRef && typeof userRef === 'object'
+        ? userRef.id
+        : userRef
+      if (userId) ids.add(String(userId))
+    }
+  }
+  return ids
+}
+
 async function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {
   const actorUserId = normalizeNullableString(input.actorUserId)
   if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')

package/src/modules/business_rules/lib/expression-evaluator.ts

@@ -1,4 +1,5 @@
 import type { ComparisonOperator, LogicalOperator } from '../data/validators'
+import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import { getNestedValue, resolveSpecialValue } from './value-resolver'
 
 /**
@@ -319,11 +320,8 @@ function endsWith(str: any, suffix: any): boolean {
   return String(str).endsWith(String(suffix))
 }
 
-/**
- * Security limits for regex operations
- */
-const REGEX_TIMEOUT_MS = 100
 const MAX_REGEX_LENGTH = 200
+const MAX_REGEX_INPUT_LENGTH = 10_000
 
 /**
  * Check if string matches regex pattern (with ReDoS protection)
@@ -345,18 +343,16 @@ function matches(str: any, pattern: any): boolean {
       return false
     }
 
-    const regex = new RegExp(patternStr)
     const testStr = String(str)
-
-    // Use a simple timeout mechanism
-    const startTime = Date.now()
-    const result = regex.test(testStr)
-
-    if (Date.now() - startTime > REGEX_TIMEOUT_MS) {
-      throw new Error('Regex execution timeout - potential ReDoS pattern detected')
+    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {
+      return false
     }
 
-    return result
+    const result = testLinearRegex(patternStr, testStr, {
+      maxPatternLength: MAX_REGEX_LENGTH,
+      maxInputLength: MAX_REGEX_INPUT_LENGTH,
+    })
+    return result.ok ? result.matched : false
   } catch (error) {
     // Log the error for debugging but don't expose to user
     const message = error instanceof Error ? error.message : 'Unknown error'

package/src/modules/translations/components/TranslationManager.tsx

@@ -69,6 +69,7 @@ export function TranslationManager({
   const [editedTranslations, setEditedTranslations] = React.useState<Record<string, Record<string, string>>>({})
   const editedTranslationsRef = React.useRef<Record<string, Record<string, string>>>({})
   const [hasUserEdited, setHasUserEdited] = React.useState(false)
+  const hasUserEditedRef = React.useRef(false)
 
   const entityType = isEmbedded ? (propEntityType ?? '') : selectedEntityType
   const recordId = isEmbedded ? (propRecordId ?? '') : selectedRecordId
@@ -191,11 +192,11 @@ export function TranslationManager({
 
   React.useEffect(() => {
     const sig = translationSignature
-    if (sig === lastTranslationSignatureRef.current && hasUserEdited) return
+    if (sig === lastTranslationSignatureRef.current && hasUserEditedRef.current) return
     lastTranslationSignatureRef.current = sig
 
     if (!translationData?.translations) {
-      if (!hasUserEdited) {
+      if (!hasUserEditedRef.current) {
         editedTranslationsRef.current = {}
         setEditedTranslations({})
       }
@@ -210,11 +211,11 @@ export function TranslationManager({
         parsed[locale][key] = typeof val === 'string' ? val : ''
       }
     }
-    if (!hasUserEdited) {
+    if (!hasUserEditedRef.current) {
       editedTranslationsRef.current = parsed
       setEditedTranslations(parsed)
     }
-  }, [translationSignature, translationData, hasUserEdited])
+  }, [translationSignature, translationData])
 
   const mutation = useMutation({
     mutationFn: async () => {
@@ -252,6 +253,7 @@ export function TranslationManager({
     },
     onSuccess: () => {
       flash(t('translations.manager.flash.saved', 'Translations saved'), 'success')
+      hasUserEditedRef.current = false
       setHasUserEdited(false)
       void refetchTranslation()
     },
@@ -262,6 +264,7 @@ export function TranslationManager({
   })
 
   const updateFieldValue = (locale: string, fieldKey: string, value: string) => {
+    hasUserEditedRef.current = true
     setHasUserEdited(true)
     const next = {
       ...editedTranslationsRef.current,
@@ -288,6 +291,7 @@ export function TranslationManager({
           value={selectedRecordId}
           onChange={(next) => {
             setSelectedRecordId(next)
+            hasUserEditedRef.current = false
             setHasUserEdited(false)
           }}
           placeholder={t('translations.manager.searchRecords', 'Search records...')}
@@ -482,6 +486,7 @@ export function TranslationManager({
                     onChange={(next) => {
                       setSelectedEntityType(next)
                       setSelectedRecordId('')
+                      hasUserEditedRef.current = false
                       setHasUserEdited(false)
                     }}
                     placeholder={t('translations.manager.placeholder', 'Select an entity')}

package/src/modules/workflows/lib/event-trigger-service.ts

@@ -6,9 +6,12 @@
  */
 
 import type { EntityManager } from '@mikro-orm/core'
+import type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'
 import type { AwilixContainer } from 'awilix'
 import type { CacheService } from '@open-mercato/cache'
 import { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import {
   WorkflowEventTrigger,
   WorkflowDefinition,
@@ -257,11 +260,12 @@ function evaluateCondition(condition: TriggerFilterCondition, payload: Record<st
       if (typeof value !== 'string' || typeof expected !== 'string') return false
       if (value.length > MAX_WORKFLOW_REGEX_INPUT_LENGTH) return false
       if (!isSafeWorkflowRegexPattern(expected)) return false
-      try {
-        const regex = new RegExp(expected)
-        return regex.test(value)
-      } catch {
-        return false
+      {
+        const result = testLinearRegex(expected, value, {
+          maxPatternLength: MAX_WORKFLOW_REGEX_PATTERN_LENGTH,
+          maxInputLength: MAX_WORKFLOW_REGEX_INPUT_LENGTH,
+        })
+        return result.ok ? result.matched : false
       }
 
     default:
@@ -325,7 +329,9 @@ async function loadLegacyTriggers(
   tenantId: string,
   organizationId: string
 ): Promise<UnifiedTrigger[]> {
-  const legacyTriggers = await em.find(
+  const postgresEm = em as unknown as PostgreSqlEntityManager
+  const legacyTriggers = await findWithDecryption(
+    postgresEm,
     WorkflowEventTrigger,
     {
       tenantId,
@@ -335,16 +341,19 @@ async function loadLegacyTriggers(
     },
     {
       orderBy: { priority: 'DESC', createdAt: 'ASC' },
-    }
+    },
+    { tenantId, organizationId },
   )
 
   // Get definitions for these triggers to get workflowId
   const definitionIds = [...new Set(legacyTriggers.map(t => t.workflowDefinitionId))]
-  const definitions = definitionIds.length > 0 ? await em.find(WorkflowDefinition, {
+  const definitions = definitionIds.length > 0 ? await findWithDecryption(postgresEm, WorkflowDefinition, {
     id: { $in: definitionIds },
+    tenantId,
+    organizationId,
     enabled: true,
     deletedAt: null,
-  }) : []
+  }, {}, { tenantId, organizationId }) : []
   const definitionMap = new Map(definitions.map(d => [d.id, d]))
 
   return legacyTriggers
@@ -379,15 +388,19 @@ async function loadEmbeddedTriggers(
   tenantId: string,
   organizationId: string
 ): Promise<UnifiedTrigger[]> {
+  const postgresEm = em as unknown as PostgreSqlEntityManager
   // Load all enabled definitions that may have triggers
-  const definitions = await em.find(
+  const definitions = await findWithDecryption(
+    postgresEm,
     WorkflowDefinition,
     {
       tenantId,
       organizationId,
       enabled: true,
       deletedAt: null,
-    }
+    },
+    {},
+    { tenantId, organizationId },
   )
 
   const triggers: UnifiedTrigger[] = []