@open-mercato/core 0.6.7-develop.6593.1.0ecf630f1e → 0.6.7-develop.6594.1.5581f765f4

package/src/modules/entities/lib/entityAcl.ts

@@ -1,6 +1,7 @@
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { hasAllFeatures } from '@open-mercato/shared/security/features'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { deriveCustomEntityRecordFeature } from './recordFeatures'
 
 export type EntityAclRequirement = {
   view: string[]
@@ -80,6 +81,10 @@ type AssertEntityAclArgs = {
   entityId: string
   action: 'view' | 'manage'
   isCustomEntity: boolean
+  // Set for a custom entity flagged `access_restricted`. When true, the coarse
+  // route-level entities.records.* feature is no longer sufficient — the caller
+  // must additionally hold the synthesized per-entity feature.
+  isRestricted?: boolean
   rbac: RbacService
 }
 
@@ -87,15 +92,32 @@ function forbiddenEntityAccess(): CrudHttpError {
   return new CrudHttpError(403, { error: 'Forbidden' })
 }
 
+async function loadActorAcl(args: AssertEntityAclArgs) {
+  return args.rbac.loadAcl(args.auth.sub ?? '', {
+    tenantId: args.auth.tenantId ?? null,
+    organizationId: args.auth.orgId ?? null,
+  })
+}
+
 export async function assertEntityAclForRequest(args: AssertEntityAclArgs): Promise<void> {
-  if (args.isCustomEntity) return
+  if (args.isCustomEntity) {
+    // Unrestricted custom entities keep the historical behavior: the coarse
+    // entities.records.view/.manage route guard is the whole authorization.
+    if (!args.isRestricted) return
+
+    const acl = await loadActorAcl(args)
+    if (acl?.isSuperAdmin) return
+
+    const required = deriveCustomEntityRecordFeature(args.entityId, args.action)
+    if (!hasAllFeatures(acl?.features, [required])) {
+      throw forbiddenEntityAccess()
+    }
+    return
+  }
 
   const requirement = resolveEntityAclRequirement(args.entityId)
 
-  const acl = await args.rbac.loadAcl(args.auth.sub ?? '', {
-    tenantId: args.auth.tenantId ?? null,
-    organizationId: args.auth.orgId ?? null,
-  })
+  const acl = await loadActorAcl(args)
 
   if (acl?.isSuperAdmin) return
 

package/src/modules/entities/lib/install-from-ce.ts

@@ -148,6 +148,7 @@ function buildChecksumPayload(params: {
     labelField: spec?.labelField ?? null,
     defaultEditor: spec?.defaultEditor ?? null,
     showInSidebar: spec?.showInSidebar ?? false,
+    accessRestricted: spec?.accessRestricted ?? false,
     fields: fields.map((f) => normalizeField(f)),
   }
 }
@@ -244,6 +245,7 @@ export async function installCustomEntitiesFromModules(
           organizationId: null,
           tenantId: scope.tenantId,
           showInSidebar: spec?.showInSidebar ?? false,
+          accessRestricted: spec?.accessRestricted ?? false,
           labelField: spec?.labelField ?? null,
           defaultEditor: spec?.defaultEditor ?? null,
           isActive: true,

package/src/modules/entities/lib/recordFeatures.ts

@@ -0,0 +1,48 @@
+// Pure, dependency-free helpers describing the ACL features that gate
+// custom-entity records. Kept import-free so both the enforcement path
+// (`entityAcl.ts`) and the feature catalog (`auth/api/features.ts`) can derive
+// the SAME feature id without coupling to each other or to the ORM.
+//
+// Coarse (route-level) features stay entity-agnostic:
+//   entities.records.view   — read any non-restricted custom entity's records
+//   entities.records.manage — write any non-restricted custom entity's records
+//
+// A custom entity flagged `access_restricted` ALSO requires a synthesized
+// per-entity feature keyed on its immutable entityId:
+//   entities.records.<entityId>.view
+//   entities.records.<entityId>.manage
+//
+// entityId always matches `^[a-z0-9_]+:[a-z0-9_]+$` (it contains a `:` and no
+// `.`), so it can never collide with the coarse `view`/`manage` segments and
+// stays a single dotted segment for the wildcard matcher.
+
+export type RecordsAction = 'view' | 'manage'
+
+export const RECORDS_VIEW_FEATURE = 'entities.records.view'
+export const RECORDS_MANAGE_FEATURE = 'entities.records.manage'
+
+export function coarseRecordFeature(action: RecordsAction): string {
+  return action === 'manage' ? RECORDS_MANAGE_FEATURE : RECORDS_VIEW_FEATURE
+}
+
+export function deriveCustomEntityRecordFeature(entityId: string, action: RecordsAction): string {
+  return `entities.records.${entityId}.${action}`
+}
+
+export type SynthesizedRecordFeature = {
+  id: string
+  action: RecordsAction
+  dependsOn: string[]
+}
+
+// The per-entity features an admin can grant for a restricted custom entity.
+// `dependsOn` mirrors the coarse prerequisite composition: the per-entity grant
+// is meaningful only alongside the coarse route-level feature.
+export function synthesizedRecordFeatures(entityId: string): SynthesizedRecordFeature[] {
+  const view = deriveCustomEntityRecordFeature(entityId, 'view')
+  const manage = deriveCustomEntityRecordFeature(entityId, 'manage')
+  return [
+    { id: view, action: 'view', dependsOn: [RECORDS_VIEW_FEATURE] },
+    { id: manage, action: 'manage', dependsOn: [view, RECORDS_MANAGE_FEATURE] },
+  ]
+}

package/src/modules/entities/lib/register.ts

@@ -7,6 +7,7 @@ export type UpsertEntityOptions = {
   organizationId?: string | null
   tenantId?: string | null
   showInSidebar?: boolean
+  accessRestricted?: boolean
   labelField?: string | null
   defaultEditor?: string | null
   isActive?: boolean
@@ -29,6 +30,7 @@ export async function upsertCustomEntity(em: EntityManager, entityId: string, op
     description: opts.description ?? null,
     isActive: opts.isActive ?? true,
     showInSidebar: !!opts.showInSidebar,
+    accessRestricted: !!opts.accessRestricted,
     labelField: opts.labelField ?? null,
     defaultEditor: opts.defaultEditor ?? null,
   }
@@ -40,6 +42,7 @@ export async function upsertCustomEntity(em: EntityManager, entityId: string, op
     ent.description = desired.description
     ent.isActive = desired.isActive
     ent.showInSidebar = desired.showInSidebar
+    ent.accessRestricted = desired.accessRestricted
     ent.labelField = desired.labelField
     ent.defaultEditor = desired.defaultEditor
     ent.updatedAt = new Date()
@@ -51,6 +54,7 @@ export async function upsertCustomEntity(em: EntityManager, entityId: string, op
     if ((ent.description ?? null) !== desired.description) return true
     if ((ent.isActive ?? true) !== desired.isActive) return true
     if ((ent.showInSidebar ?? false) !== desired.showInSidebar) return true
+    if ((ent.accessRestricted ?? false) !== desired.accessRestricted) return true
     if ((ent.labelField ?? null) !== desired.labelField) return true
     if ((ent.defaultEditor ?? null) !== desired.defaultEditor) return true
     if (ent.deletedAt != null) return true

package/src/modules/entities/lib/restrictedEntityFeatures.ts

@@ -0,0 +1,98 @@
+import { getModules } from '@open-mercato/shared/lib/i18n/server'
+import { synthesizedRecordFeatures } from './recordFeatures'
+
+export type SynthesizedFeatureItem = {
+  id: string
+  title: string
+  module: string
+  dependsOn?: string[]
+}
+
+type RestrictedEntity = { entityId: string; label: string }
+
+type DeclaredEntities = { restricted: RestrictedEntity[]; ids: Set<string> }
+
+// Reads module-declared (ce.ts) custom entities. `restricted` holds those flagged
+// accessRestricted; `ids` holds ALL declared ids so the DB path can defer to the
+// declaration — the declared registry is authoritative for its own ids, matching
+// the records-route enforcement precedence (declared wins over the DB row).
+function declaredEntities(): DeclaredEntities {
+  const restricted: RestrictedEntity[] = []
+  const ids = new Set<string>()
+  try {
+    const mods = getModules() as Array<{
+      customEntities?: Array<{ id?: string; label?: string; accessRestricted?: boolean }>
+    }>
+    for (const mod of mods || []) {
+      for (const spec of mod?.customEntities ?? []) {
+        if (!spec?.id) continue
+        ids.add(spec.id)
+        if (spec.accessRestricted === true) restricted.push({ entityId: spec.id, label: spec.label || spec.id })
+      }
+    }
+  } catch {}
+  return { restricted, ids }
+}
+
+// Reads user-registered custom entities flagged access_restricted for the given
+// tenant scope. Uses the raw table (not the ORM class) to keep this helper cheap
+// and avoid pulling entity metadata into unrelated callers.
+async function registeredRestrictedEntities(em: any, tenantId: string): Promise<RestrictedEntity[]> {
+  try {
+    const db = em.getKysely()
+    const rows = await db
+      .selectFrom('custom_entities' as any)
+      .select(['entity_id' as any, 'label' as any])
+      .where('access_restricted' as any, '=', true)
+      .where('deleted_at' as any, 'is', null as any)
+      .where((eb: any) =>
+        eb.or([
+          eb('tenant_id' as any, '=', tenantId),
+          eb('tenant_id' as any, 'is', null as any),
+        ]),
+      )
+      .execute()
+    return (rows as Array<{ entity_id?: unknown; label?: unknown }>).map((row) => ({
+      entityId: String(row.entity_id ?? ''),
+      label: typeof row.label === 'string' && row.label.length ? row.label : String(row.entity_id ?? ''),
+    })).filter((row) => row.entityId.length > 0)
+  } catch {
+    return []
+  }
+}
+
+/**
+ * Feature-catalog contribution for restricted custom entities: two synthesized
+ * per-entity features (view/manage) per restricted entity in the tenant scope,
+ * so admins can grant them in the Role/User ACL editor. Fails safe (returns what
+ * it can) — never throws — so the static feature catalog is unaffected on error.
+ */
+export async function synthesizeRestrictedEntityFeatures(
+  em: any,
+  tenantId: string | null | undefined,
+): Promise<SynthesizedFeatureItem[]> {
+  if (!tenantId) return []
+  const declared = declaredEntities()
+  const byEntityId = new Map<string, RestrictedEntity>()
+  for (const entity of declared.restricted) byEntityId.set(entity.entityId, entity)
+  // DB rows are authoritative only for ids the declared registry does not own, so
+  // the catalog and the records-route enforcement agree on the same source.
+  for (const entity of await registeredRestrictedEntities(em, tenantId)) {
+    if (declared.ids.has(entity.entityId)) continue
+    byEntityId.set(entity.entityId, entity)
+  }
+
+  const items: SynthesizedFeatureItem[] = []
+  for (const { entityId, label } of byEntityId.values()) {
+    for (const feature of synthesizedRecordFeatures(entityId)) {
+      const verb = feature.action === 'manage' ? 'Manage records' : 'View records'
+      items.push({
+        id: feature.id,
+        title: `${verb}: ${label}`,
+        module: 'entities',
+        dependsOn: feature.dependsOn,
+      })
+    }
+  }
+  return items
+}

package/src/modules/entities/migrations/.snapshot-open-mercato.json

@@ -71,6 +71,16 @@
           "default": "false",
           "mappedType": "boolean"
         },
+        "access_restricted": {
+          "name": "access_restricted",
+          "type": "boolean",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "default": "false",
+          "mappedType": "boolean"
+        },
         "organization_id": {
           "name": "organization_id",
           "type": "uuid",

package/src/modules/entities/migrations/Migration20260716120000.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260716120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "custom_entities" add column "access_restricted" boolean not null default false;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`alter table "custom_entities" drop column "access_restricted";`);
+  }
+
+}