@open-mercato/core 0.6.7-develop.6726.1.983ae8a07e → 0.6.7-develop.6744.1.0483b18565

package/src/modules/entities/api/sidebar-entities.ts

@@ -5,9 +5,11 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { EntityManager } from '@mikro-orm/core'
 import { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'
 
 export const metadata = {
-  GET: { requireAuth: true },
+  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },
 }
 
 export async function GET(req: Request) {
@@ -17,6 +19,11 @@ export async function GET(req: Request) {
   const { resolve } = await createRequestContainer()
   const em = resolve('em') as EntityManager
   const cache = resolve('cache') as any
+  const rbac = resolve('rbacService') as RbacService
+  const acl = await rbac.loadAcl(auth.sub ?? '', {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+  })
 
   const where: any = { 
     isActive: true,
@@ -27,27 +34,49 @@ export async function GET(req: Request) {
     { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },
   ]
   
-  // Try cache first to avoid repeated queries on focus refreshes
-  const cacheKey = `entities:sidebar:${auth.tenantId || 'null'}`
+  const cacheKey = `entities:sidebar:v2:${auth.tenantId || 'null'}`
+  let candidates: Array<{
+    entityId: string
+    label: string
+    href: string
+    accessRestricted: boolean
+  }> | null = null
   try {
     if (cache) {
       const cached = await cache.get(cacheKey)
-      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached)
+      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates
     }
   } catch {}
 
-  const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
-  
-  const items = (entities as any[]).map((e) => ({
-    entityId: e.entityId,
-    label: e.label,
-    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`
-  }))
+  if (!candidates) {
+    const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })
+    candidates = (entities as any[]).map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,
+      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId)
+        ?? entity.accessRestricted === true,
+    }))
+    try {
+      if (cache) {
+        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
+      }
+    } catch {}
+  }
 
+  const items = candidates
+    .filter((entity) => canReadEntityMetadata({
+      entityId: entity.entityId,
+      isCustomEntity: true,
+      isRestricted: entity.accessRestricted,
+      acl,
+    }))
+    .map((entity) => ({
+      entityId: entity.entityId,
+      label: entity.label,
+      href: entity.href,
+    }))
   const payload = { items }
-  try {
-    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })
-  } catch {}
   return NextResponse.json(payload)
 }
 

package/src/modules/entities/lib/entityAcl.ts

@@ -1,6 +1,7 @@
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { hasAllFeatures } from '@open-mercato/shared/security/features'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { getModules } from '@open-mercato/shared/lib/i18n/server'
 import { deriveCustomEntityRecordFeature } from './recordFeatures'
 
 export type EntityAclRequirement = {
@@ -65,10 +66,67 @@ const ENTITY_ACL_REQUIREMENTS: Record<string, EntityAclRequirement> = {
   },
 }
 
+let declaredCustomEntityRestrictions: Map<string, boolean> | null = null
+
+function loadDeclaredCustomEntityRestrictions(): Map<string, boolean> {
+  if (declaredCustomEntityRestrictions === null) {
+    try {
+      const modules = getModules() as Array<{
+        customEntities?: Array<{ id?: string; accessRestricted?: boolean }>
+      }>
+      const restrictions = new Map<string, boolean>()
+      for (const moduleEntry of modules ?? []) {
+        for (const spec of moduleEntry.customEntities ?? []) {
+          if (spec.id) restrictions.set(spec.id, spec.accessRestricted === true)
+        }
+      }
+      declaredCustomEntityRestrictions = restrictions
+    } catch {}
+  }
+  return declaredCustomEntityRestrictions ?? new Map<string, boolean>()
+}
+
+export function getDeclaredCustomEntityRestriction(entityId: string): boolean | undefined {
+  return loadDeclaredCustomEntityRestrictions().get(entityId)
+}
+
+export function isDeclaredCustomEntity(entityId: string): boolean {
+  return loadDeclaredCustomEntityRestrictions().has(entityId)
+}
+
 export function resolveEntityAclRequirement(entityId: string): EntityAclRequirement | null {
   return ENTITY_ACL_REQUIREMENTS[entityId] ?? null
 }
 
+export function canReadAllEntityMetadata(acl: {
+  isSuperAdmin?: boolean
+  features?: readonly string[]
+}): boolean {
+  return Boolean(acl.isSuperAdmin) || hasAllFeatures(acl.features, ['entities.definitions.view'])
+}
+
+export function canReadEntityMetadata(args: {
+  entityId: string
+  isCustomEntity: boolean
+  isRestricted?: boolean
+  acl: { isSuperAdmin?: boolean; features?: readonly string[] }
+}): boolean {
+  if (args.acl.isSuperAdmin) return true
+
+  const requirement = resolveEntityAclRequirement(args.entityId)
+  if (requirement?.platformOnly) return false
+  if (canReadAllEntityMetadata(args.acl)) return true
+  if (args.isCustomEntity) {
+    const requiredFeatures = ['entities.records.view']
+    if (args.isRestricted) {
+      requiredFeatures.push(deriveCustomEntityRecordFeature(args.entityId, 'view'))
+    }
+    return hasAllFeatures(args.acl.features, requiredFeatures)
+  }
+  if (!requirement) return false
+  return hasAllFeatures(args.acl.features, requirement.view)
+}
+
 type EntityAclActor = {
   sub?: string | null
   tenantId?: string | null

package/src/modules/messages/api/route.ts

@@ -13,6 +13,7 @@ import { getMessageType } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
 import { attachOperationMetadataHeader } from '../lib/operationMetadata'
 import { canUseMessageEmailFeature, resolveMessageContext } from '../lib/routeHelpers'
+import { applyMessageParticipantScope } from '../lib/participantScope'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from './guards'
 import { findMessageIdsBySearchTokens } from '../lib/searchLookup'
 import { MessageCommandExecuteResult } from '../commands/shared'
@@ -120,11 +121,9 @@ export async function GET(req: Request) {
         joinRecipient()
         break
       case 'all':
-        joinRecipient()
-        q = q.where((eb: any) => eb.or([
-          eb('m.sender_user_id', '=', scope.userId),
-          eb('r.message_id', 'is not', null),
-        ]))
+        // Sender-OR-recipient participant scope shared with the
+        // communication_channels message enricher — see participantScope.ts (#4133).
+        q = applyMessageParticipantScope(q, scope.userId)
         break
       default: {
         const unsupportedFolder: never = input.folder

package/src/modules/messages/lib/participantScope.ts

@@ -0,0 +1,64 @@
+import type { SelectQueryBuilder } from 'kysely'
+
+/**
+ * Minimal Kysely schema contract the message participant-scope predicate depends
+ * on. Both the messages list route (`api/route.ts`, `all` folder) and the
+ * `communication_channels.message-channel` response enricher build their
+ * sender-OR-recipient access filter from {@link applyMessageParticipantScope},
+ * so a column rename (`sender_user_id`, `recipient_user_id`, `deleted_at`) or a
+ * change to the recipient-visibility rules updates both call sites at once
+ * instead of silently desyncing the enricher's security boundary from the list
+ * route (#4133, follow-up to #4099).
+ */
+export type MessagesParticipantScopeDatabase = {
+  messages: {
+    id: string
+    tenant_id: string
+    organization_id: string | null
+    sender_user_id: string
+    deleted_at: Date | null
+  }
+  message_recipients: {
+    message_id: string
+    recipient_user_id: string
+    deleted_at: Date | null
+  }
+}
+
+type MessagesTable = MessagesParticipantScopeDatabase['messages']
+type MessageRecipientsTable = MessagesParticipantScopeDatabase['message_recipients']
+
+type MessagesFrom = MessagesParticipantScopeDatabase & { m: MessagesTable }
+type MessagesJoinedFrom = MessagesFrom & { r: MessageRecipientsTable }
+
+/**
+ * Apply the shared message participant-scope predicate to a query already built
+ * from `messages as m`. A message is visible to `userId` when they are the
+ * sender OR a non-deleted recipient. The recipient soft-delete rule
+ * (`r.deleted_at is null`) lives inside the recipient join, so it is part of the
+ * single source of truth — the recipient-visibility boundary cannot drift
+ * between the list route and the enricher.
+ *
+ * Message-level tenant / organization / soft-delete scoping stays with the
+ * caller (both call sites already apply it uniformly to every query), but the
+ * shared {@link MessagesParticipantScopeDatabase} type keeps those column names
+ * coupled at compile time as well.
+ */
+export function applyMessageParticipantScope<O>(
+  query: SelectQueryBuilder<MessagesFrom, 'm', O>,
+  userId: string,
+): SelectQueryBuilder<MessagesJoinedFrom, 'm' | 'r', O> {
+  return query
+    .leftJoin('message_recipients as r', (join) =>
+      join
+        .onRef('m.id', '=', 'r.message_id')
+        .on('r.recipient_user_id', '=', userId)
+        .on('r.deleted_at', 'is', null),
+    )
+    .where((eb) =>
+      eb.or([
+        eb('m.sender_user_id', '=', userId),
+        eb('r.message_id', 'is not', null),
+      ]),
+    ) as unknown as SelectQueryBuilder<MessagesJoinedFrom, 'm' | 'r', O>
+}

package/src/modules/planner/components/unavailabilityReasons.ts

@@ -1,6 +1,7 @@
 "use client"
 
 import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { fetchAllDictionaryEntries } from '@open-mercato/core/modules/dictionaries/lib/fetchAllEntries'
 import {
   resolveUnavailabilityReasonDictionary,
   type UnavailabilityReasonSubjectType,
@@ -45,10 +46,9 @@ export async function loadUnavailabilityReasonEntries(
   const dictionary = resolveUnavailabilityReasonDictionary(subjectType)
   const resolved = await ensureDictionary(dictionary.key, dictionary.name)
   if (!resolved) return []
-  const entriesCall = await apiCall<{ items?: Record<string, unknown>[] }>(`/api/dictionaries/${resolved.id}/entries`)
+  const entriesCall = await fetchAllDictionaryEntries(resolved.id)
   if (!entriesCall.ok) return []
-  const items = Array.isArray(entriesCall.result?.items) ? entriesCall.result?.items ?? [] : []
-  return items
+  return entriesCall.items
     .map((entry) => {
       if (!entry || typeof entry !== 'object') return null
       const record = entry as Record<string, unknown>

package/src/modules/progress/AGENTS.md

@@ -86,7 +86,17 @@ Use stable, grep-friendly ids:
 
 | Variable | Effect | Default |
 |----------|--------|---------|
-| `OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS` | Coalesces intermediate `progress.job.updated` flush+broadcasts per job: the service flushes and emits only when this many ms elapsed since the last broadcast **or** `progressPercent` advanced by ≥1; sub-threshold updates buffer in memory. Keeps bulk workers from firing one serialized `pg_notify` roundtrip + tenant-wide SSE fan-out per record. Terminal events (`created`/`started`/`completed`/`failed`/`cancelled`) are never throttled, so `ProgressTopBar` still converges and the 60s `STALE_JOB_TIMEOUT_SECONDS` heartbeat window is never exceeded. Set to `0` to restore per-record emission (tests/debugging). | `250` |
+| `OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS` | Coalesces intermediate `progress.job.updated` broadcasts per job: the service emits only when this many ms elapsed since the last broadcast **or** `progressPercent` advanced by ≥1; sub-threshold updates buffer in memory. Keeps bulk workers from firing one serialized `pg_notify` roundtrip + tenant-wide SSE fan-out per record. Persistence is throttled independently: heartbeats reach the database at least every `HEARTBEAT_INTERVAL_MS` (5s) regardless of this knob, so no value can starve the 60s `STALE_JOB_TIMEOUT_SECONDS` sweep. Terminal events (`created`/`started`/`completed`/`failed`/`cancelled`) are never throttled. Set to `0` to restore per-record emission (tests/debugging). | `250` |
+
+## Concurrency Semantics (multi-instance safe)
+
+`progressService` is safe to run across many app/worker instances. Do not reintroduce read-modify-write transitions:
+
+- **Every status transition is a status-guarded `nativeUpdate` (CAS).** An update that matches zero rows lost the race — it MUST NOT emit events or overwrite the row. Allowed transitions: start from `pending|failed` (an already-running start is an idempotent no-op; `failed` allows queue retries and recovery from a wrong stale sweep), complete from `pending|running|failed`, fail from `pending|running`, cancel from `pending|running|failed`.
+- **Progress writes are guarded on `status IN ('pending','running')`** — once another process finishes/cancels a job, buffered updaters stop writing to it.
+- **`incrementProgress` deltas persist as atomic SQL increments** (`processed_count + n`), and the service reloads the database winner before returning or emitting, so concurrent writers never lose or report stale counts.
+- **Update-path reads use `disableIdentityMap: true`** — `isCancellationRequested` and lifecycle reads must always see fresh cross-process state, never a stale managed entity.
+- **The stale sweep (`markStaleJobsFailed`) re-checks staleness per row inside the CAS**, so concurrent sweepers emit exactly one `JOB_FAILED` per job, and it also fails `pending` jobs that never started within `STALE_PENDING_TIMEOUT_SECONDS` (a late queue delivery recovers them via `startJob`'s `failed → running` transition).
 
 ## Cross-References
 

package/src/modules/progress/lib/progressService.ts

@@ -25,6 +25,7 @@ export interface ProgressService {
 
 export const HEARTBEAT_INTERVAL_MS = 5000
 export const STALE_JOB_TIMEOUT_SECONDS = 60
+export const STALE_PENDING_TIMEOUT_SECONDS = 900
 
 export function calculateEta(
   processedCount: number,