@open-mercato/core 0.6.7-develop.6726.1.983ae8a07e → 0.6.7-develop.6749.1.6b54c56dfe

package/src/modules/entities/lib/entityAcl.ts

@@ -1,6 +1,7 @@
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { hasAllFeatures } from '@open-mercato/shared/security/features'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { getModules } from '@open-mercato/shared/lib/i18n/server'
 import { deriveCustomEntityRecordFeature } from './recordFeatures'
 
 export type EntityAclRequirement = {
@@ -65,10 +66,67 @@ const ENTITY_ACL_REQUIREMENTS: Record<string, EntityAclRequirement> = {
   },
 }
 
+let declaredCustomEntityRestrictions: Map<string, boolean> | null = null
+
+function loadDeclaredCustomEntityRestrictions(): Map<string, boolean> {
+  if (declaredCustomEntityRestrictions === null) {
+    try {
+      const modules = getModules() as Array<{
+        customEntities?: Array<{ id?: string; accessRestricted?: boolean }>
+      }>
+      const restrictions = new Map<string, boolean>()
+      for (const moduleEntry of modules ?? []) {
+        for (const spec of moduleEntry.customEntities ?? []) {
+          if (spec.id) restrictions.set(spec.id, spec.accessRestricted === true)
+        }
+      }
+      declaredCustomEntityRestrictions = restrictions
+    } catch {}
+  }
+  return declaredCustomEntityRestrictions ?? new Map<string, boolean>()
+}
+
+export function getDeclaredCustomEntityRestriction(entityId: string): boolean | undefined {
+  return loadDeclaredCustomEntityRestrictions().get(entityId)
+}
+
+export function isDeclaredCustomEntity(entityId: string): boolean {
+  return loadDeclaredCustomEntityRestrictions().has(entityId)
+}
+
 export function resolveEntityAclRequirement(entityId: string): EntityAclRequirement | null {
   return ENTITY_ACL_REQUIREMENTS[entityId] ?? null
 }
 
+export function canReadAllEntityMetadata(acl: {
+  isSuperAdmin?: boolean
+  features?: readonly string[]
+}): boolean {
+  return Boolean(acl.isSuperAdmin) || hasAllFeatures(acl.features, ['entities.definitions.view'])
+}
+
+export function canReadEntityMetadata(args: {
+  entityId: string
+  isCustomEntity: boolean
+  isRestricted?: boolean
+  acl: { isSuperAdmin?: boolean; features?: readonly string[] }
+}): boolean {
+  if (args.acl.isSuperAdmin) return true
+
+  const requirement = resolveEntityAclRequirement(args.entityId)
+  if (requirement?.platformOnly) return false
+  if (canReadAllEntityMetadata(args.acl)) return true
+  if (args.isCustomEntity) {
+    const requiredFeatures = ['entities.records.view']
+    if (args.isRestricted) {
+      requiredFeatures.push(deriveCustomEntityRecordFeature(args.entityId, 'view'))
+    }
+    return hasAllFeatures(args.acl.features, requiredFeatures)
+  }
+  if (!requirement) return false
+  return hasAllFeatures(args.acl.features, requirement.view)
+}
+
 type EntityAclActor = {
   sub?: string | null
   tenantId?: string | null

package/src/modules/messages/api/route.ts

@@ -13,6 +13,7 @@ import { getMessageType } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
 import { attachOperationMetadataHeader } from '../lib/operationMetadata'
 import { canUseMessageEmailFeature, resolveMessageContext } from '../lib/routeHelpers'
+import { applyMessageParticipantScope } from '../lib/participantScope'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from './guards'
 import { findMessageIdsBySearchTokens } from '../lib/searchLookup'
 import { MessageCommandExecuteResult } from '../commands/shared'
@@ -120,11 +121,9 @@ export async function GET(req: Request) {
         joinRecipient()
         break
       case 'all':
-        joinRecipient()
-        q = q.where((eb: any) => eb.or([
-          eb('m.sender_user_id', '=', scope.userId),
-          eb('r.message_id', 'is not', null),
-        ]))
+        // Sender-OR-recipient participant scope shared with the
+        // communication_channels message enricher — see participantScope.ts (#4133).
+        q = applyMessageParticipantScope(q, scope.userId)
         break
       default: {
         const unsupportedFolder: never = input.folder

package/src/modules/messages/lib/participantScope.ts

@@ -0,0 +1,64 @@
+import type { SelectQueryBuilder } from 'kysely'
+
+/**
+ * Minimal Kysely schema contract the message participant-scope predicate depends
+ * on. Both the messages list route (`api/route.ts`, `all` folder) and the
+ * `communication_channels.message-channel` response enricher build their
+ * sender-OR-recipient access filter from {@link applyMessageParticipantScope},
+ * so a column rename (`sender_user_id`, `recipient_user_id`, `deleted_at`) or a
+ * change to the recipient-visibility rules updates both call sites at once
+ * instead of silently desyncing the enricher's security boundary from the list
+ * route (#4133, follow-up to #4099).
+ */
+export type MessagesParticipantScopeDatabase = {
+  messages: {
+    id: string
+    tenant_id: string
+    organization_id: string | null
+    sender_user_id: string
+    deleted_at: Date | null
+  }
+  message_recipients: {
+    message_id: string
+    recipient_user_id: string
+    deleted_at: Date | null
+  }
+}
+
+type MessagesTable = MessagesParticipantScopeDatabase['messages']
+type MessageRecipientsTable = MessagesParticipantScopeDatabase['message_recipients']
+
+type MessagesFrom = MessagesParticipantScopeDatabase & { m: MessagesTable }
+type MessagesJoinedFrom = MessagesFrom & { r: MessageRecipientsTable }
+
+/**
+ * Apply the shared message participant-scope predicate to a query already built
+ * from `messages as m`. A message is visible to `userId` when they are the
+ * sender OR a non-deleted recipient. The recipient soft-delete rule
+ * (`r.deleted_at is null`) lives inside the recipient join, so it is part of the
+ * single source of truth — the recipient-visibility boundary cannot drift
+ * between the list route and the enricher.
+ *
+ * Message-level tenant / organization / soft-delete scoping stays with the
+ * caller (both call sites already apply it uniformly to every query), but the
+ * shared {@link MessagesParticipantScopeDatabase} type keeps those column names
+ * coupled at compile time as well.
+ */
+export function applyMessageParticipantScope<O>(
+  query: SelectQueryBuilder<MessagesFrom, 'm', O>,
+  userId: string,
+): SelectQueryBuilder<MessagesJoinedFrom, 'm' | 'r', O> {
+  return query
+    .leftJoin('message_recipients as r', (join) =>
+      join
+        .onRef('m.id', '=', 'r.message_id')
+        .on('r.recipient_user_id', '=', userId)
+        .on('r.deleted_at', 'is', null),
+    )
+    .where((eb) =>
+      eb.or([
+        eb('m.sender_user_id', '=', userId),
+        eb('r.message_id', 'is not', null),
+      ]),
+    ) as unknown as SelectQueryBuilder<MessagesJoinedFrom, 'm' | 'r', O>
+}

package/src/modules/notifications/api/route.ts

@@ -3,6 +3,7 @@ import type { EntityManager } from '@mikro-orm/core'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
+import { buildNotificationReadScopeWhere } from '../lib/notificationScope'
 import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
@@ -32,6 +33,7 @@ export async function GET(req: Request) {
   const filters: Record<string, unknown> = {
     recipientUserId: scope.userId,
     tenantId: scope.tenantId,
+    ...buildNotificationReadScopeWhere(scope),
   }
 
   if (input.status) {

package/src/modules/notifications/api/unread-count/route.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/core'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import {
@@ -8,6 +9,10 @@ import {
 import { Notification } from '../../data/entities'
 import { unreadCountResponseSchema } from '../openapi'
 import { resolveNotificationContext } from '../../lib/routeHelpers'
+import {
+  buildNotificationReadScopeWhere,
+  getNotificationReadScopeTagOrganizationIds,
+} from '../../lib/notificationScope'
 
 export const metadata = {
   GET: { requireAuth: true },
@@ -16,8 +21,21 @@ export const metadata = {
 const UNREAD_COUNT_RESOURCE = 'notifications.notification'
 const UNREAD_COUNT_TTL_MS = 10_000
 
-function buildUnreadCountCacheKey(userId: string): string {
-  return `notifications:unread-count:u=${userId}`
+function buildUnreadCountCacheKey(params: {
+  userId: string
+  organizationId: string | null
+  organizationIds: string[]
+}): string {
+  const normalizedIds = Array.from(new Set(
+    params.organizationIds.filter((value) => value.trim().length > 0),
+  )).sort((left, right) => left.localeCompare(right))
+  const scopeKey = normalizedIds.length === 0
+    ? 'no-access'
+    : `${params.organizationId ?? 'none'}:scope=${createHash('sha256')
+        .update(normalizedIds.join('\0'))
+        .digest('hex')
+        .slice(0, 16)}`
+  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`
 }
 
 export async function GET(req: Request) {
@@ -25,8 +43,22 @@ export async function GET(req: Request) {
   const em = ctx.container.resolve('em') as EntityManager
 
   const userId = scope.userId
-  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null
-  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null
+  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)
+    ? scope.organizationIds
+    : null
+  // Unrestricted and omitted legacy scopes cannot be safely tagged for invalidation:
+  // org-specific writes only invalidate their own collection tag. Keep those scopes
+  // uncached rather than serving a stale tenant-wide total until the TTL expires.
+  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()
+    ? resolveCrudCache(ctx.container)
+    : null
+  const cacheKey = cache && userId && cacheableOrganizationIds
+    ? buildUnreadCountCacheKey({
+        userId,
+        organizationId: scope.organizationId,
+        organizationIds: cacheableOrganizationIds,
+      })
+    : null
 
   if (cache && cacheKey) {
     try {
@@ -41,6 +73,7 @@ export async function GET(req: Request) {
     recipientUserId: userId,
     tenantId: scope.tenantId,
     status: 'unread',
+    ...buildNotificationReadScopeWhere(scope),
   })
 
   if (cache && cacheKey) {
@@ -48,7 +81,11 @@ export async function GET(req: Request) {
       await runWithCacheTenant(scope.tenantId, () =>
         cache.set(cacheKey, count, {
           ttl: UNREAD_COUNT_TTL_MS,
-          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null]),
+          tags: buildCollectionTags(
+            UNREAD_COUNT_RESOURCE,
+            scope.tenantId,
+            getNotificationReadScopeTagOrganizationIds(scope),
+          ),
         }),
       )
     } catch {}

package/src/modules/notifications/lib/notificationScope.ts

@@ -0,0 +1,40 @@
+export type NotificationReadOrganizationScope = {
+  organizationId?: string | null
+  organizationIds?: string[] | null
+}
+
+type NotificationReadScopeWhere = {
+  organizationId?: null
+  $or?: Array<
+    | { organizationId: { $in: string[] } }
+    | { organizationId: null }
+  >
+}
+
+function resolveOrganizationIds(scope: NotificationReadOrganizationScope): string[] | null {
+  if (scope.organizationIds === null) return null
+  if (scope.organizationIds === undefined) return null
+  const candidates = scope.organizationIds
+  return Array.from(new Set(candidates.filter((value) => value.trim().length > 0)))
+}
+
+export function buildNotificationReadScopeWhere(
+  scope: NotificationReadOrganizationScope,
+): NotificationReadScopeWhere {
+  const organizationIds = resolveOrganizationIds(scope)
+  if (organizationIds === null) return {}
+  if (organizationIds.length === 0) return { organizationId: null }
+  return {
+    $or: [
+      { organizationId: { $in: organizationIds } },
+      { organizationId: null },
+    ],
+  }
+}
+
+export function getNotificationReadScopeTagOrganizationIds(
+  scope: NotificationReadOrganizationScope,
+): Array<string | null> {
+  const organizationIds = resolveOrganizationIds(scope)
+  return organizationIds === null ? [null] : [...organizationIds, null]
+}

package/src/modules/notifications/lib/notificationService.ts

@@ -14,6 +14,7 @@ import {
   type NotificationTenantContext,
 } from './notificationFactory'
 import { toNotificationDto } from './notificationMapper'
+import { buildNotificationReadScopeWhere } from './notificationScope'
 import {
   getRecipientUserIdsForFeature,
   getRecipientUserIdsForRole,
@@ -184,6 +185,7 @@ async function createOrRefreshNotification(
 export interface NotificationServiceContext {
   tenantId: string
   organizationId?: string | null
+  organizationIds?: string[] | null
   userId?: string | null
 }
 
@@ -594,6 +596,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         recipientUserId: ctx.userId,
         tenantId: ctx.tenantId,
         status: 'unread',
+        ...buildNotificationReadScopeWhere(ctx),
       })
     },
 
@@ -602,6 +605,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       const filters: Record<string, unknown> = {
         recipientUserId: ctx.userId,
         tenantId: ctx.tenantId,
+        ...buildNotificationReadScopeWhere(ctx),
       }
 
       if (since) {
@@ -617,6 +621,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
           recipientUserId: ctx.userId,
           tenantId: ctx.tenantId,
           status: 'unread',
+          ...buildNotificationReadScopeWhere(ctx),
         }),
       ])
 

package/src/modules/notifications/lib/routeHelpers.ts

@@ -4,6 +4,7 @@ import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { resolveNotificationService, type NotificationService } from './notificationService'
 
 /**
@@ -22,6 +23,7 @@ export const NOTIFICATION_SETTINGS_RESOURCE_KIND = 'notifications.settings'
 export interface NotificationScope {
   tenantId: string
   organizationId: string | null
+  organizationIds?: string[] | null
   userId: string | null
 }
 
@@ -64,11 +66,26 @@ export function notificationCrudErrorResponse(error: unknown): Response | null {
  */
 export async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {
   const { ctx } = await resolveRequestContext(req)
+  const organizationScope = await resolveOrganizationScopeForRequest({
+    container: ctx.container,
+    auth: ctx.auth,
+    request: req,
+    ...(ctx.selectedOrganizationId === undefined
+      ? {}
+      : { selectedId: ctx.selectedOrganizationId }),
+  })
+  const tenantId = organizationScope.tenantId ?? ctx.auth?.tenantId ?? ''
+  const organizationId = organizationScope.selectedId
+  const organizationIds = organizationScope.filterIds
+  ctx.organizationScope = organizationScope
+  ctx.selectedOrganizationId = organizationId
+  ctx.organizationIds = organizationIds
   return {
     service: resolveNotificationService(ctx.container),
     scope: {
-      tenantId: ctx.auth?.tenantId ?? '',
-      organizationId: ctx.selectedOrganizationId ?? null,
+      tenantId,
+      organizationId,
+      organizationIds,
       userId: ctx.auth?.sub ?? null,
     },
     ctx,

package/src/modules/planner/components/unavailabilityReasons.ts

@@ -1,6 +1,7 @@
 "use client"
 
 import { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { fetchAllDictionaryEntries } from '@open-mercato/core/modules/dictionaries/lib/fetchAllEntries'
 import {
   resolveUnavailabilityReasonDictionary,
   type UnavailabilityReasonSubjectType,
@@ -45,10 +46,9 @@ export async function loadUnavailabilityReasonEntries(
   const dictionary = resolveUnavailabilityReasonDictionary(subjectType)
   const resolved = await ensureDictionary(dictionary.key, dictionary.name)
   if (!resolved) return []
-  const entriesCall = await apiCall<{ items?: Record<string, unknown>[] }>(`/api/dictionaries/${resolved.id}/entries`)
+  const entriesCall = await fetchAllDictionaryEntries(resolved.id)
   if (!entriesCall.ok) return []
-  const items = Array.isArray(entriesCall.result?.items) ? entriesCall.result?.items ?? [] : []
-  return items
+  return entriesCall.items
     .map((entry) => {
       if (!entry || typeof entry !== 'object') return null
       const record = entry as Record<string, unknown>

package/src/modules/progress/AGENTS.md

@@ -86,7 +86,17 @@ Use stable, grep-friendly ids:
 
 | Variable | Effect | Default |
 |----------|--------|---------|
-| `OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS` | Coalesces intermediate `progress.job.updated` flush+broadcasts per job: the service flushes and emits only when this many ms elapsed since the last broadcast **or** `progressPercent` advanced by ≥1; sub-threshold updates buffer in memory. Keeps bulk workers from firing one serialized `pg_notify` roundtrip + tenant-wide SSE fan-out per record. Terminal events (`created`/`started`/`completed`/`failed`/`cancelled`) are never throttled, so `ProgressTopBar` still converges and the 60s `STALE_JOB_TIMEOUT_SECONDS` heartbeat window is never exceeded. Set to `0` to restore per-record emission (tests/debugging). | `250` |
+| `OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS` | Coalesces intermediate `progress.job.updated` broadcasts per job: the service emits only when this many ms elapsed since the last broadcast **or** `progressPercent` advanced by ≥1; sub-threshold updates buffer in memory. Keeps bulk workers from firing one serialized `pg_notify` roundtrip + tenant-wide SSE fan-out per record. Persistence is throttled independently: heartbeats reach the database at least every `HEARTBEAT_INTERVAL_MS` (5s) regardless of this knob, so no value can starve the 60s `STALE_JOB_TIMEOUT_SECONDS` sweep. Terminal events (`created`/`started`/`completed`/`failed`/`cancelled`) are never throttled. Set to `0` to restore per-record emission (tests/debugging). | `250` |
+
+## Concurrency Semantics (multi-instance safe)
+
+`progressService` is safe to run across many app/worker instances. Do not reintroduce read-modify-write transitions:
+
+- **Every status transition is a status-guarded `nativeUpdate` (CAS).** An update that matches zero rows lost the race — it MUST NOT emit events or overwrite the row. Allowed transitions: start from `pending|failed` (an already-running start is an idempotent no-op; `failed` allows queue retries and recovery from a wrong stale sweep), complete from `pending|running|failed`, fail from `pending|running`, cancel from `pending|running|failed`.
+- **Progress writes are guarded on `status IN ('pending','running')`** — once another process finishes/cancels a job, buffered updaters stop writing to it.
+- **`incrementProgress` deltas persist as atomic SQL increments** (`processed_count + n`), and the service reloads the database winner before returning or emitting, so concurrent writers never lose or report stale counts.
+- **Update-path reads use `disableIdentityMap: true`** — `isCancellationRequested` and lifecycle reads must always see fresh cross-process state, never a stale managed entity.
+- **The stale sweep (`markStaleJobsFailed`) re-checks staleness per row inside the CAS**, so concurrent sweepers emit exactly one `JOB_FAILED` per job, and it also fails `pending` jobs that never started within `STALE_PENDING_TIMEOUT_SECONDS` (a late queue delivery recovers them via `startJob`'s `failed → running` transition).
 
 ## Cross-References
 

package/src/modules/progress/lib/progressService.ts

@@ -25,6 +25,7 @@ export interface ProgressService {
 
 export const HEARTBEAT_INTERVAL_MS = 5000
 export const STALE_JOB_TIMEOUT_SECONDS = 60
+export const STALE_PENDING_TIMEOUT_SECONDS = 900
 
 export function calculateEta(
   processedCount: number,