@open-mercato/core 0.6.6-develop.6429.1.2fba7258d1 → 0.6.6-develop.6450.1.b493fb430c

package/src/modules/staff/commands/timesheets-entries.ts

@@ -22,7 +22,15 @@ import {
   type StaffTimeEntryUpdateInput,
 } from '../data/validators'
 import { staffTimeEntryCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 import { getStaffMemberByUserId } from '../lib/staffMemberResolver'
 
 type RbacServiceLike = {
@@ -174,6 +182,7 @@ const createTimeEntryCommand: CommandHandler<StaffTimeEntryCreateInput, { timeEn
     const parsed = staffTimeEntryCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
 
@@ -290,6 +299,7 @@ const startTimerCommand: CommandHandler<StaffTimeEntryStartTimerInput, { timeEnt
     const parsed = staffTimeEntryStartTimerSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
 
@@ -457,12 +467,13 @@ const updateTimeEntryCommand: CommandHandler<StaffTimeEntryUpdateInput, { timeEn
   async execute(rawInput, ctx) {
     const parsed = staffTimeEntryUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const entry = await findOneWithDecryption(
       em,
       StaffTimeEntry,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<StaffTimeEntry>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!entry) throw new CrudHttpError(404, { error: 'Time entry not found.' })
     ensureTenantScope(ctx, entry.tenantId)
@@ -583,12 +594,13 @@ const deleteTimeEntryCommand: CommandHandler<{ id?: string }, { timeEntryId: str
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Time entry id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const entry = await findOneWithDecryption(
       em,
       StaffTimeEntry,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTimeEntry>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!entry) throw new CrudHttpError(404, { error: 'Time entry not found.' })
     ensureTenantScope(ctx, entry.tenantId)

package/src/modules/staff/commands/timesheets-projects.ts

@@ -27,7 +27,15 @@ import {
   type StaffTimeProjectMemberUpdateInput,
 } from '../data/validators'
 import { staffTimeProjectCrudEvents, staffTimeProjectMemberCrudEvents } from '../lib/crud'
-import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
+import {
+  applyScopeToWhere,
+  commandActorScope,
+  commandInputScope,
+  ensureOrganizationScope,
+  ensureTenantScope,
+  extractUndoPayload,
+  scopeForDecryption,
+} from './shared'
 
 function isUniqueViolation(error: unknown): boolean {
   if (error instanceof UniqueConstraintViolationException) return true
@@ -163,6 +171,7 @@ const createTimeProjectCommand: CommandHandler<StaffTimeProjectCreateInput, { ti
     const parsed = staffTimeProjectCreateSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const now = new Date()
@@ -282,12 +291,13 @@ const updateTimeProjectCommand: CommandHandler<StaffTimeProjectUpdateInput, { ti
   async execute(rawInput, ctx) {
     const parsed = staffTimeProjectUpdateSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const project = await findOneWithDecryption(
       em,
       StaffTimeProject,
-      { id: parsed.id, deletedAt: null },
+      applyScopeToWhere<StaffTimeProject>({ id: parsed.id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!project) throw new CrudHttpError(404, { error: 'Time project not found.' })
     ensureTenantScope(ctx, project.tenantId)
@@ -419,12 +429,13 @@ const deleteTimeProjectCommand: CommandHandler<{ id?: string }, { timeProjectId:
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Time project id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const project = await findOneWithDecryption(
       em,
       StaffTimeProject,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTimeProject>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!project) throw new CrudHttpError(404, { error: 'Time project not found.' })
     ensureTenantScope(ctx, project.tenantId)
@@ -527,6 +538,7 @@ const assignTimeProjectMemberCommand: CommandHandler<StaffTimeProjectMemberAssig
     const parsed = staffTimeProjectMemberAssignSchema.parse(rawInput)
     ensureTenantScope(ctx, parsed.tenantId)
     ensureOrganizationScope(ctx, parsed.organizationId)
+    const scope = commandInputScope(ctx, parsed.tenantId, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
 
@@ -534,7 +546,7 @@ const assignTimeProjectMemberCommand: CommandHandler<StaffTimeProjectMemberAssig
     // Without this check a foreign or stale UUID would produce a dangling reference.
     const projectExists = await em.findOne(
       StaffTimeProject,
-      { id: parsed.timeProjectId, tenantId: parsed.tenantId, organizationId: parsed.organizationId, deletedAt: null },
+      applyScopeToWhere<StaffTimeProject>({ id: parsed.timeProjectId, deletedAt: null }, scope),
       { fields: ['id'] },
     )
     if (!projectExists) {
@@ -548,7 +560,7 @@ const assignTimeProjectMemberCommand: CommandHandler<StaffTimeProjectMemberAssig
     }
     const memberExists = await em.findOne(
       StaffTeamMember,
-      { id: parsed.staffMemberId, tenantId: parsed.tenantId, organizationId: parsed.organizationId, deletedAt: null },
+      applyScopeToWhere<StaffTeamMember>({ id: parsed.staffMemberId, deletedAt: null }, scope),
       { fields: ['id'] },
     )
     if (!memberExists) {
@@ -658,12 +670,13 @@ const unassignTimeProjectMemberCommand: CommandHandler<{ id?: string }, { timePr
     const id = input?.id
     if (!id) throw new CrudHttpError(400, { error: 'Time project member id is required.' })
     const em = (ctx.container.resolve('em') as EntityManager).fork()
+    const scope = commandActorScope(ctx)
     const member = await findOneWithDecryption(
       em,
       StaffTimeProjectMember,
-      { id, deletedAt: null },
+      applyScopeToWhere<StaffTimeProjectMember>({ id, deletedAt: null }, scope),
       undefined,
-      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.auth?.orgId ?? null },
+      scopeForDecryption(scope),
     )
     if (!member) throw new CrudHttpError(404, { error: 'Time project member not found.' })
     ensureTenantScope(ctx, member.tenantId)

package/src/modules/sync_excel/lib/upload-storage.ts

@@ -52,7 +52,6 @@ export async function createSyncExcelUploadAttachment(input: {
       module: 'sync_excel',
       temporary: true,
       uploadId: input.uploadId,
-      inlineCsvBase64: input.buffer.toString('base64'),
     },
   })
 
@@ -66,14 +65,17 @@ export async function readSyncExcelUploadBuffer(
   attachment: Pick<Attachment, 'partitionCode' | 'storagePath' | 'storageDriver' | 'storageMetadata'>,
 ): Promise<Buffer> {
   const inlineCsvBase64 = attachment.storageMetadata?.inlineCsvBase64
-  if (typeof inlineCsvBase64 === 'string' && inlineCsvBase64.length > 0) {
-    return Buffer.from(inlineCsvBase64, 'base64')
-  }
-
   const absolutePath = resolveAttachmentAbsolutePath(
     attachment.partitionCode,
     attachment.storagePath,
     attachment.storageDriver,
   )
-  return fs.readFile(absolutePath)
+  try {
+    return await fs.readFile(absolutePath)
+  } catch (error) {
+    if (typeof inlineCsvBase64 === 'string' && inlineCsvBase64.length > 0) {
+      return Buffer.from(inlineCsvBase64, 'base64')
+    }
+    throw error
+  }
 }

package/src/modules/translations/api/get/locales.ts

@@ -18,6 +18,7 @@ async function GET(req: Request) {
     const configService = context.container.resolve('moduleConfigService') as ModuleConfigService
     const locales = await configService.getValue<string[]>('translations', 'supported_locales', {
       defaultValue: [...defaultLocales],
+      scope: { tenantId: context.tenantId },
     })
 
     return NextResponse.json({ locales: Array.isArray(locales) ? locales : [...defaultLocales] })

package/src/modules/translations/api/put/locales.ts

@@ -44,7 +44,7 @@ async function PUT(req: Request) {
     }
 
     const configService = context.container.resolve('moduleConfigService') as ModuleConfigService
-    await configService.setValue('translations', 'supported_locales', uniqueLocales)
+    await configService.setValue('translations', 'supported_locales', uniqueLocales, { tenantId: context.tenantId })
 
     if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(context.container, {

package/src/modules/workflows/AGENTS.md

@@ -10,7 +10,7 @@ Use the workflows module for business process automation: defining step-based wo
 4. **MUST follow the instance state machine** — instances transition `RUNNING → COMPLETED|FAILED|CANCELLED`; intermediate states include `PAUSED`, `WAITING_FOR_ACTIVITIES`, `COMPENSATING`
 5. **MUST keep activity handlers idempotent** — check state before mutating; activities may be retried on failure
 6. **MUST use event sourcing** — log all workflow events via `eventLogger.logWorkflowEvent()`; never mutate instance state without a corresponding event
-7. **MUST use variable interpolation** for dynamic activity config — use `{{context.*}}`, `{{workflow.*}}`, `{{env.*}}`, `{{now}}`; never hardcode values
+7. **MUST use variable interpolation** for dynamic activity config — use `{{context.*}}`, `{{workflow.*}}`, server-allowlisted non-secret `{{env.*}}` keys such as `{{env.APP_URL}}`, and `{{now}}`; never hardcode values or read secrets from `{{env.*}}`
 8. **MUST use event triggers, signals, and widget injection** for cross-module integration.
 9. **MUST declare new events in `events.ts`** with `as const` — undeclared events trigger TypeScript errors and runtime warnings
 10. **MUST scope all queries by `organization_id`** — workflow data is tenant-scoped; never expose cross-tenant instances or tasks
@@ -99,6 +99,7 @@ Definition → startWorkflow() → Instance → executeWorkflow() loop
 | Variable | Effect | Default |
 |----------|--------|---------|
 | `OM_WORKFLOWS_ALLOW_PRIVATE_URLS` | When `1`/`true`/`yes`, bypasses the SSRF guard in `CALL_WEBHOOK` so workflow authors can hit `localhost`, RFC1918, and `.internal` targets. For dev only — MUST remain unset in production. | unset (guard enforced) |
+| `OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST` | Comma-separated non-secret process env keys allowed for `{{env.*}}` interpolation in workflow activity config. `APP_URL` is always allowed. Never include secrets. | unset (`APP_URL` only) |
 
 ## DI Services
 

package/src/modules/workflows/examples/sales-pipeline-definition.json

@@ -262,10 +262,10 @@
             "activityType": "CALL_API",
             "config": {
               "method": "POST",
-              "url": "{{env.CONTRACT_SERVICE_URL}}/api/contracts/generate",
+              "url": "{{context.integration.contractServiceUrl}}/api/contracts/generate",
               "headers": {
                 "Content-Type": "application/json",
-                "Authorization": "Bearer {{env.SERVICE_TOKEN}}"
+                "Authorization": "Bearer {{context.integration.serviceToken}}"
               },
               "body": {
                 "orderId": "{{context.order.id}}",
@@ -331,7 +331,7 @@
             "activityType": "CALL_API",
             "config": {
               "method": "POST",
-              "url": "{{env.CONTRACT_SERVICE_URL}}/api/contracts/verify",
+              "url": "{{context.integration.contractServiceUrl}}/api/contracts/verify",
               "body": {
                 "contractId": "{{context.contract.id}}",
                 "signatureId": "{{task.result.signatureId}}"
@@ -393,10 +393,10 @@
             "activityType": "CALL_API",
             "config": {
               "method": "POST",
-              "url": "{{env.BILLING_SERVICE_URL}}/api/invoices",
+              "url": "{{context.integration.billingServiceUrl}}/api/invoices",
               "headers": {
                 "Content-Type": "application/json",
-                "Authorization": "Bearer {{env.SERVICE_TOKEN}}"
+                "Authorization": "Bearer {{context.integration.serviceToken}}"
               },
               "body": {
                 "orderId": "{{context.order.id}}",
@@ -486,10 +486,10 @@
             "activityType": "CALL_API",
             "config": {
               "method": "POST",
-              "url": "{{env.WAREHOUSE_SERVICE_URL}}/api/fulfillment/orders",
+              "url": "{{context.integration.warehouseServiceUrl}}/api/fulfillment/orders",
               "headers": {
                 "Content-Type": "application/json",
-                "Authorization": "Bearer {{env.SERVICE_TOKEN}}"
+                "Authorization": "Bearer {{context.integration.serviceToken}}"
               },
               "body": {
                 "orderId": "{{context.order.id}}",
@@ -607,4 +607,4 @@
       }
     ]
   }
-}
+}

package/src/modules/workflows/lib/activity-executor.ts

@@ -31,10 +31,27 @@ export { isPrivateUrl } from '@open-mercato/shared/lib/network'
 
 function isAllowPrivateWorkflowWebhookUrlsEnabled(): boolean {
   if (parseBooleanWithDefault(process.env.OM_WORKFLOWS_ALLOW_PRIVATE_URLS, false)) {
+    if (process.env.NODE_ENV === 'production') {
+      console.warn(
+        '[CALL_WEBHOOK] OM_WORKFLOWS_ALLOW_PRIVATE_URLS is set but ignored in production. SSRF protection remains enabled.'
+      )
+      return false
+    }
+
+    console.warn(
+      '[CALL_WEBHOOK] OM_WORKFLOWS_ALLOW_PRIVATE_URLS is enabled. SSRF protection is bypassed for workflow webhooks; use only in development.'
+    )
     return true
   }
 
   if (parseBooleanWithDefault(process.env.WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS, false)) {
+    if (process.env.NODE_ENV === 'production') {
+      console.warn(
+        '[CALL_WEBHOOK] WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated and ignored in production. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS for development only. SSRF protection remains enabled.'
+      )
+      return false
+    }
+
     console.warn(
       '[CALL_WEBHOOK] WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS instead. SSRF protection is bypassed.'
     )
@@ -44,6 +61,34 @@ function isAllowPrivateWorkflowWebhookUrlsEnabled(): boolean {
   return false
 }
 
+const DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST = new Set(['APP_URL'])
+const WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY = 'OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST'
+
+function getWorkflowEnvInterpolationAllowlist(): Set<string> {
+  const allowlist = new Set(DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST)
+  const configuredKeys = process.env[WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY]
+  if (!configuredKeys) {
+    return allowlist
+  }
+
+  for (const key of configuredKeys.split(',')) {
+    const trimmedKey = key.trim()
+    if (trimmedKey) {
+      allowlist.add(trimmedKey)
+    }
+  }
+
+  return allowlist
+}
+
+function resolveWorkflowEnvInterpolation(envKey: string): string {
+  if (!getWorkflowEnvInterpolationAllowlist().has(envKey)) {
+    return ''
+  }
+
+  return process.env[envKey] ?? ''
+}
+
 // ============================================================================
 // Types and Interfaces
 // ============================================================================
@@ -857,7 +902,7 @@ export async function executeCallApi(
   container: AwilixContainer,
   signal?: AbortSignal
 ): Promise<any> {
-  // 1. Interpolate variables in config (including {{workflow.*}}, {{context.*}}, {{env.*}}, {{now}})
+  // 1. Interpolate variables in config (including {{workflow.*}}, {{context.*}}, allowlisted {{env.*}}, {{now}})
   const interpolatedConfig = interpolateVariables(config, context.workflowContext, context.workflowInstance)
 
   const {
@@ -1145,7 +1190,7 @@ function classifyAndThrowError(status: number, body: any, url: string): never {
  * - {{workflow.tenantId}} - tenant ID
  * - {{workflow.organizationId}} - organization ID
  * - {{workflow.currentStepId}} - current step ID
- * - {{env.VAR_NAME}} - environment variables
+ * - {{env.VAR_NAME}} - server-allowlisted environment variables
  * - {{now}} - current ISO timestamp
  */
 function interpolateVariables(
@@ -1185,7 +1230,7 @@ function interpolateVariables(
       // Handle {{env.*}} variables
       if (trimmedPath.startsWith('env.')) {
         const envKey = trimmedPath.substring('env.'.length)
-        return process.env[envKey] ?? config
+        return resolveWorkflowEnvInterpolation(envKey)
       }
 
       // Handle {{now}} - current timestamp
@@ -1230,8 +1275,7 @@ function interpolateVariables(
       // Handle {{env.*}} variables
       if (trimmedPath.startsWith('env.')) {
         const envKey = trimmedPath.substring('env.'.length)
-        const envValue = process.env[envKey]
-        return envValue !== undefined ? envValue : match
+        return resolveWorkflowEnvInterpolation(envKey)
       }
 
       // Handle {{now}} - current timestamp