@open-mercato/core 0.6.7-develop.6842.1.8cd8a8883c → 0.6.7-develop.6859.1.e4727b568a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.7-develop.6842.1.8cd8a8883c",
+  "version": "0.6.7-develop.6859.1.e4727b568a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6842.1.8cd8a8883c",
-    "@open-mercato/shared": "0.6.7-develop.6842.1.8cd8a8883c",
-    "@open-mercato/ui": "0.6.7-develop.6842.1.8cd8a8883c",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6859.1.e4727b568a",
+    "@open-mercato/shared": "0.6.7-develop.6859.1.e4727b568a",
+    "@open-mercato/ui": "0.6.7-develop.6859.1.e4727b568a",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6842.1.8cd8a8883c",
-    "@open-mercato/shared": "0.6.7-develop.6842.1.8cd8a8883c",
-    "@open-mercato/ui": "0.6.7-develop.6842.1.8cd8a8883c",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6859.1.e4727b568a",
+    "@open-mercato/shared": "0.6.7-develop.6859.1.e4727b568a",
+    "@open-mercato/ui": "0.6.7-develop.6859.1.e4727b568a",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/bootstrap.ts

@@ -1,6 +1,7 @@
 import type { AwilixContainer } from 'awilix'
 import { asValue } from 'awilix'
-import type { ModuleSubscriber } from '@open-mercato/shared/modules/registry'
+import { getDefaultEncryptionMaps, type ModuleSubscriber } from '@open-mercato/shared/modules/registry'
+import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryption'
 import { createEventBus } from '@open-mercato/events/index'
 import { setGlobalEventBus } from '@open-mercato/shared/modules/events'
 import { createCacheService } from '@open-mercato/cache'
@@ -184,12 +185,26 @@ export async function bootstrap(container: AwilixContainer) {
   // KMS + tenant encryption
   const kmsService = createKmsService()
   container.register({ kmsService: asValue(kmsService) })
+  let defaultEncryptionMaps: ModuleEncryptionMap[] = []
+  if (isTenantDataEncryptionEnabled()) {
+    try {
+      const { getModules } = await import('@open-mercato/shared/lib/i18n/server')
+      defaultEncryptionMaps = getDefaultEncryptionMaps(getModules())
+    } catch (err) {
+      logger.error('Failed to load default encryption maps', { component: 'encryption', err })
+      throw err
+    }
+  }
   try {
     const em = container.resolve('em') as EntityManager
     const cacheService = (() => {
       try { return container.resolve('cache') as any } catch { return null }
     })()
-    const tenantEncryptionService = new TenantDataEncryptionService(em, { cache: cacheService, kms: kmsService })
+    const tenantEncryptionService = new TenantDataEncryptionService(em, {
+      cache: cacheService,
+      kms: kmsService,
+      defaultEncryptionMaps,
+    })
     container.register({ tenantEncryptionService: asValue(tenantEncryptionService) })
     if (isTenantDataEncryptionEnabled() && kmsService.isHealthy()) {
       try {

package/src/modules/attachments/api/route.ts

@@ -45,6 +45,7 @@ import {
 } from '../lib/upload-limits'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { AttachmentQuotaService } from '../lib/quota-service'
 
 const logger = createLogger('attachments')
 
@@ -319,6 +320,20 @@ export async function POST(req: Request) {
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   const dataEngine = container.resolve('dataEngine')
+  let attachmentQuotaService: AttachmentQuotaService | null = null
+  let attachmentQuotaRecoveryScheduler: ((
+    payload: { reservationId: string; tenantId: string; organizationId: string },
+    delayMs: number,
+  ) => Promise<void>) | null = null
+  try {
+    attachmentQuotaService = container.resolve('attachmentQuotaService') as AttachmentQuotaService
+    attachmentQuotaRecoveryScheduler = container.resolve('attachmentQuotaRecoveryScheduler') as (
+      payload: { reservationId: string; tenantId: string; organizationId: string },
+      delayMs: number,
+    ) => Promise<void>
+  } catch {
+    // Legacy fallback below when the quota service is not registered in this container.
+  }
   const storageDriverFactory =
     (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
   const orgId = await resolveAttachmentOrganizationId(container, auth, req)
@@ -363,11 +378,20 @@ export async function POST(req: Request) {
       error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
     }, { status: 413 })
   }
-  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)
-  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {
-    return NextResponse.json({
-      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
-    }, { status: 413 })
+  if (!attachmentQuotaService) {
+    try {
+      const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)
+      if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {
+        return NextResponse.json({
+          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
+        }, { status: 413 })
+      }
+    } catch (error) {
+      logger.error('Attachment quota accounting failed', { err: error })
+      return NextResponse.json({
+        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),
+      }, { status: 500 })
+    }
   }
   const buf = Buffer.from(await file.arrayBuffer())
   const safeName = sanitizeUploadedFileName(file.name)
@@ -409,6 +433,62 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })
   }
   const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })
+  const preparedStoragePath = attachmentQuotaService
+    ? uploadDriver.prepareStoragePath?.({
+        partitionCode: partition.code,
+        orgId,
+        tenantId,
+        fileName: safeName,
+      })
+    : undefined
+  if (attachmentQuotaService && !preparedStoragePath) {
+    return NextResponse.json({
+      error: t('attachments.errors.quotaRecoveryUnsupported', 'Storage driver cannot participate in quota recovery.'),
+    }, { status: 500 })
+  }
+  let quotaReservation: { id: string; leaseToken: string; expiresAt: Date } | null = null
+  if (attachmentQuotaService) {
+    try {
+      quotaReservation = await attachmentQuotaService.reserve({
+        tenantId,
+        organizationId: orgId,
+        bytes: buf.length,
+        source: 'attachment',
+        storageDriver: uploadDriver.key,
+        storagePath: preparedStoragePath!,
+        partitionCode: partition.code,
+      })
+      if (!attachmentQuotaRecoveryScheduler) throw new Error('Attachment quota recovery is unavailable.')
+      await attachmentQuotaRecoveryScheduler({
+        reservationId: quotaReservation.id,
+        tenantId,
+        organizationId: orgId,
+      }, Math.max(1_000, quotaReservation.expiresAt.getTime() - Date.now()))
+      if (typeof attachmentQuotaService.beginStorage === 'function') {
+        await attachmentQuotaService.beginStorage(quotaReservation.id, quotaReservation.leaseToken)
+      }
+    } catch (error) {
+      if (quotaReservation) {
+        await attachmentQuotaService.release(quotaReservation.id, quotaReservation.leaseToken).catch(() => {})
+        quotaReservation = null
+      }
+      const code = (error as { code?: unknown })?.code
+      if (code === 'quota_exceeded') {
+        return NextResponse.json({
+          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
+        }, { status: 413 })
+      }
+      if (code === 'quota_target_exists') {
+        return NextResponse.json({
+          error: t('attachments.errors.storagePathExists', 'The target storage path already exists.'),
+        }, { status: 409 })
+      }
+      logger.error('Attachment quota reservation failed', { err: error })
+      return NextResponse.json({
+        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),
+      }, { status: 500 })
+    }
+  }
   let storedPath: string
   try {
     const stored = await uploadDriver.store({
@@ -417,10 +497,25 @@ export async function POST(req: Request) {
       tenantId,
       fileName: safeName,
       buffer: buf,
+      storagePath: preparedStoragePath,
     })
     storedPath = stored.storagePath
+    if (quotaReservation) {
+      await attachmentQuotaService!.markStored(quotaReservation.id, quotaReservation.leaseToken)
+    }
   } catch (error) {
     logger.error('Failed to persist file', { err: error })
+    if (preparedStoragePath) {
+      try {
+        await (uploadDriver.deleteStrict?.(partition.code, preparedStoragePath)
+          ?? uploadDriver.delete(partition.code, preparedStoragePath))
+        if (quotaReservation) {
+          await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)
+        }
+      } catch (cleanupError) {
+        logger.error('Failed to compensate attachment storage', { err: cleanupError })
+      }
+    }
     return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
   }
 
@@ -485,9 +580,21 @@ export async function POST(req: Request) {
           values: customFieldValues,
         })
       }
+      if (quotaReservation) {
+        await attachmentQuotaService!.completeAttachment(quotaReservation.id, quotaReservation.leaseToken, tx)
+      }
     })
   } catch (error) {
     logger.error('Failed to persist attachment with custom attributes', { err: error })
+    try {
+      await (uploadDriver.deleteStrict?.(partition.code, storedPath)
+        ?? uploadDriver.delete(partition.code, storedPath))
+      if (quotaReservation) {
+        await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)
+      }
+    } catch (cleanupError) {
+      logger.error('Failed to compensate attachment persistence', { err: cleanupError })
+    }
     return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
   }
 
@@ -551,8 +658,8 @@ async function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: strin
       return Number.isFinite(parsed) ? parsed : 0
     }
     return 0
-  } catch {
-    return 0
+  } catch (error) {
+    throw new Error('Attachment quota accounting is unavailable.', { cause: error })
   }
 }
 

package/src/modules/attachments/data/entities.ts

@@ -99,3 +99,62 @@ export class Attachment {
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 }
+
+@Entity({ tableName: 'attachment_quota_reservations' })
+@Unique({
+  name: 'attachment_quota_reservations_scope_path_unique',
+  properties: ['tenantId', 'storageDriver', 'storagePath'],
+})
+@Index({
+  name: 'attachment_quota_reservations_tenant_status_idx',
+  properties: ['tenantId', 'status'],
+})
+export class AttachmentQuotaReservation {
+  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'
+
+  @PrimaryKey({ type: 'uuid' })
+  id!: string
+
+  @Property({ name: 'tenant_id', type: 'uuid' })
+  tenantId!: string
+
+  @Property({ name: 'organization_id', type: 'uuid' })
+  organizationId!: string
+
+  @Property({ name: 'reserved_bytes', type: 'bigint' })
+  reservedBytes!: number
+
+  @Property({ name: 'actual_bytes', type: 'bigint', nullable: true })
+  actualBytes?: number | null
+
+  @Property({ type: 'text', default: 'reserved' })
+  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'
+
+  @Property({ type: 'text' })
+  source!: string
+
+  @Property({ name: 'storage_driver', type: 'text' })
+  storageDriver!: string
+
+  @Property({ name: 'partition_code', type: 'text', nullable: true })
+  partitionCode?: string | null
+
+  @Property({ name: 'storage_path', type: 'text' })
+  storagePath!: string
+
+  @Property({ name: 'lease_token', type: 'uuid' })
+  leaseToken!: string
+
+  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })
+  uploadTokenHash?: string | null
+
+  @Property({ name: 'expires_at', type: Date, nullable: true })
+  @Index({ name: 'attachment_quota_reservations_expires_idx' })
+  expiresAt?: Date | null
+
+  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
+  createdAt: Date = new Date()
+
+  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })
+  updatedAt: Date = new Date()
+}

package/src/modules/attachments/di.ts

@@ -1,9 +1,17 @@
-import { asFunction } from 'awilix'
+import { asFunction, asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { StorageDriverFactory } from './lib/drivers/driverFactory'
+import { createAttachmentQuotaService } from './lib/quota-service'
+import { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'
 
 export function register(container: AppContainer) {
   container.register({
+    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),
+    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>
+      createAttachmentQuotaService(em),
+    )
+      .scoped()
+      .proxy(),
     storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>
       new StorageDriverFactory(em),
     )

package/src/modules/attachments/i18n/de.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
   "attachments.errors.publicPartitionBlocked": "Öffentliche Speicherpartitionen können für diesen Upload nicht explizit ausgewählt werden.",
   "attachments.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
+  "attachments.errors.quotaRecoveryUnsupported": "Der Speichertreiber kann nicht an der Kontingent-Wiederherstellung teilnehmen.",
+  "attachments.errors.quotaUnavailable": "Die Speicherkontingent-Abrechnung ist nicht verfügbar.",
   "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
+  "attachments.errors.storagePathExists": "Der Zielspeicherpfad existiert bereits.",
   "attachments.library.actions.copied": "Link kopiert.",
   "attachments.library.actions.copyError": "Link konnte nicht kopiert werden.",
   "attachments.library.actions.copyUrl": "URL kopieren",

package/src/modules/attachments/i18n/en.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
   "attachments.errors.publicPartitionBlocked": "Public storage partitions cannot be selected explicitly for this upload.",
   "attachments.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
+  "attachments.errors.quotaRecoveryUnsupported": "Storage driver cannot participate in quota recovery.",
+  "attachments.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
   "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
+  "attachments.errors.storagePathExists": "The target storage path already exists.",
   "attachments.library.actions.copied": "Link copied.",
   "attachments.library.actions.copyError": "Unable to copy link.",
   "attachments.library.actions.copyUrl": "Copy URL",

package/src/modules/attachments/i18n/es.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
   "attachments.errors.publicPartitionBlocked": "No se pueden seleccionar explícitamente particiones de almacenamiento públicas para esta carga.",
   "attachments.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
+  "attachments.errors.quotaRecoveryUnsupported": "El controlador de almacenamiento no puede participar en la recuperación de cuota.",
+  "attachments.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
   "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
+  "attachments.errors.storagePathExists": "La ruta de almacenamiento de destino ya existe.",
   "attachments.library.actions.copied": "Enlace copiado.",
   "attachments.library.actions.copyError": "No se pudo copiar el enlace.",
   "attachments.library.actions.copyUrl": "Copiar URL",

package/src/modules/attachments/i18n/pl.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
   "attachments.errors.publicPartitionBlocked": "Nie można jawnie wybrać publicznej partycji do tego przesyłania.",
   "attachments.errors.quotaExceeded": "Przekroczono limit miejsca na załączniki dla tego tenantu.",
+  "attachments.errors.quotaRecoveryUnsupported": "Sterownik przechowywania nie może uczestniczyć w odzyskiwaniu limitu.",
+  "attachments.errors.quotaUnavailable": "Rozliczanie limitu przestrzeni dyskowej jest niedostępne.",
   "attachments.errors.selectOrganization": "Wybierz konkretną organizację przed przesłaniem załącznika.",
+  "attachments.errors.storagePathExists": "Docelowa ścieżka przechowywania już istnieje.",
   "attachments.library.actions.copied": "Link skopiowany.",
   "attachments.library.actions.copyError": "Nie można skopiować linku.",
   "attachments.library.actions.copyUrl": "Kopiuj URL",

package/src/modules/attachments/lib/drivers/index.ts

@@ -1,4 +1,4 @@
-export type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'
+export type { PrepareFilePayload, StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'
 export { LocalStorageDriver } from './localDriver'
 export { LegacyPublicStorageDriver } from './legacyPublicDriver'
 export { StorageDriverFactory, registerExternalStorageDriver, registerExternalCredentialEnhancer } from './driverFactory'

package/src/modules/attachments/lib/drivers/localDriver.ts

@@ -3,7 +3,7 @@ import path from 'path'
 import { randomUUID } from 'crypto'
 import { resolvePartitionRoot } from '../storage'
 import { resolveContainedPath } from '../pathContainment'
-import type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'
+import type { PrepareFilePayload, StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'
 
 function sanitizeFileName(fileName: string): string {
   if (!fileName) return 'file'
@@ -23,17 +23,21 @@ function resolveTenantSegment(tenantId: string | null | undefined): string {
 export class LocalStorageDriver implements StorageDriver {
   readonly key = 'local'
 
-  async store(payload: StoreFilePayload): Promise<StoredFile> {
-    const root = resolvePartitionRoot(payload.partitionCode)
+  prepareStoragePath(payload: PrepareFilePayload): string {
     const orgSegment = resolveOrgSegment(payload.orgId ?? null)
     const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)
     const safeName = sanitizeFileName(payload.fileName || 'file')
     const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)
     const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`
-    const relativePath = path.join(orgSegment, tenantSegment, storedName)
+    return path.join(orgSegment, tenantSegment, storedName).replace(/\\/g, '/')
+  }
+
+  async store(payload: StoreFilePayload): Promise<StoredFile> {
+    const root = resolvePartitionRoot(payload.partitionCode)
+    const relativePath = payload.storagePath ?? this.prepareStoragePath(payload)
     const absolutePath = path.join(root, relativePath)
     await fs.mkdir(path.dirname(absolutePath), { recursive: true })
-    await fs.writeFile(absolutePath, payload.buffer)
+    await fs.writeFile(absolutePath, payload.buffer, { flag: 'wx' })
     return {
       storagePath: relativePath.replace(/\\/g, '/'),
     }
@@ -46,11 +50,22 @@ export class LocalStorageDriver implements StorageDriver {
   }
 
   async delete(partitionCode: string, storagePath: string): Promise<void> {
-    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)
     try {
-      await fs.unlink(absolutePath)
+      await this.deleteStrict(partitionCode, storagePath)
     } catch {
-      // best-effort removal
+      // Backward-compatible best-effort removal.
+    }
+  }
+
+  async deleteStrict(partitionCode: string, storagePath: string): Promise<void> {
+    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)
+    try {
+      if (typeof fs.rm === 'function') await fs.rm(absolutePath, { force: true })
+      else await fs.unlink(absolutePath)
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException)?.code
+      const message = error instanceof Error ? error.message : ''
+      if (code !== 'ENOENT' && !message.includes('ENOENT')) throw error
     }
   }
 

package/src/modules/attachments/lib/drivers/types.ts

@@ -4,8 +4,11 @@ export type StoreFilePayload = {
   tenantId: string | null | undefined
   fileName: string
   buffer: Buffer
+  storagePath?: string
 }
 
+export type PrepareFilePayload = Omit<StoreFilePayload, 'buffer' | 'storagePath'>
+
 export type StoredFile = {
   storagePath: string
   driverMeta?: Record<string, unknown> | null
@@ -18,9 +21,11 @@ export type ReadFileResult = {
 
 export interface StorageDriver {
   readonly key: string
+  prepareStoragePath?(payload: PrepareFilePayload): string
   store(payload: StoreFilePayload): Promise<StoredFile>
   read(partitionCode: string, storagePath: string): Promise<ReadFileResult>
   delete(partitionCode: string, storagePath: string): Promise<void>
+  deleteStrict?(partitionCode: string, storagePath: string): Promise<void>
   toLocalPath(
     partitionCode: string,
     storagePath: string,

package/src/modules/attachments/lib/quota-recovery-queue.ts

@@ -0,0 +1,16 @@
+import { createModuleQueue } from '@open-mercato/queue'
+
+export type AttachmentQuotaRecoveryJob = {
+  reservationId: string
+  tenantId: string
+  organizationId: string
+}
+
+const queue = createModuleQueue<AttachmentQuotaRecoveryJob>('attachments-quota-recovery', { concurrency: 2 })
+
+export async function scheduleAttachmentQuotaRecovery(
+  payload: AttachmentQuotaRecoveryJob,
+  delayMs: number,
+): Promise<void> {
+  await queue.enqueue(payload, { delayMs: Math.max(1_000, delayMs) })
+}