@open-mercato/core 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/directory/services/organizationScopeService.ts

@@ -0,0 +1,85 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import type {
+  OrganizationScopeService,
+  OrganizationScopeRequest,
+} from '@open-mercato/shared/lib/auth/principal-service'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScope, resolveOrganizationScopeForRequest } from '../utils/organizationScope'
+
+type OrganizationScopeRbac = {
+  invalidateUserCache(userId: string): Promise<void>
+  loadAcl(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
+}
+
+export class DefaultOrganizationScopeService implements OrganizationScopeService {
+  constructor(
+    private readonly em: EntityManager,
+    private readonly rbac: OrganizationScopeRbac,
+    private readonly container: AwilixContainer,
+  ) {}
+
+  resolve(input: {
+    auth: AuthContext | null | undefined
+    selectedId?: string | null
+    tenantId?: string | null
+    freshAcl?: boolean
+  }) {
+    const auth = input.auth
+    if (input.freshAcl && auth?.sub) {
+      return this.resolveFresh({
+        auth,
+        selectedId: input.selectedId,
+        tenantId: input.tenantId,
+      }).then((result) => result.scope)
+    }
+    return resolveOrganizationScope({
+      em: this.em,
+      rbac: this.rbac as Parameters<typeof resolveOrganizationScope>[0]['rbac'],
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+
+  async resolveFresh(input: {
+    auth: NonNullable<AuthContext>
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    await this.rbac.invalidateUserCache(input.auth.sub)
+    const acl = await this.rbac.loadAcl(input.auth.sub, {
+      tenantId: input.tenantId ?? input.auth.tenantId ?? null,
+      organizationId: input.selectedId ?? input.auth.orgId ?? null,
+    })
+    const freshRbac: Parameters<typeof resolveOrganizationScope>[0]['rbac'] = {
+      loadAcl: async () => acl,
+    }
+    const scope = await resolveOrganizationScope({
+      em: this.em,
+      rbac: freshRbac,
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+    return { scope, acl }
+  }
+
+  resolveForRequest(input: {
+    auth: AuthContext | null | undefined
+    request?: OrganizationScopeRequest
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    return resolveOrganizationScopeForRequest({
+      container: this.container,
+      auth: input.auth,
+      request: input.request,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+}

package/src/modules/directory/utils/organizationScope.ts

@@ -5,6 +5,7 @@ import { Organization } from '@open-mercato/core/modules/directory/data/entities
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import { getCurrentCacheTenant, runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -13,19 +14,7 @@ const logger = createLogger('directory').child({ component: 'org-scope-cache' })
 
 export { parseSelectedOrganizationCookie, parseSelectedTenantCookie }
 
-export type OrganizationScope = {
-  selectedId: string | null
-  filterIds: string[] | null
-  allowedIds: string[] | null
-  tenantId: string | null
-  // True when the caller explicitly selected a concrete organization (cookie /
-  // selectedId param) that could not be honored — it does not exist for the
-  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
-  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
-  // this so a record never lands under an org the caller did not intend. Absent
-  // (undefined) means the selection — if any — was honored.
-  selectionRejected?: boolean
-}
+export type { OrganizationScope }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
 // OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,
@@ -249,8 +238,8 @@ export async function resolveOrganizationScope({
   tenantId: tenantIdOverride,
 }: {
   em: EntityManager
-  rbac: RbacService
-  auth: AuthContext
+  rbac: Pick<RbacService, 'loadAcl'>
+  auth: AuthContext | null | undefined
   selectedId?: string | null
   tenantId?: string | null
 }): Promise<OrganizationScope> {

package/src/modules/warranty_claims/api/portal/attachments/route.ts

@@ -19,7 +19,7 @@ import { readAttachmentMetadata } from '@open-mercato/core/modules/attachments/l
 import { clearAttachmentThumbnailCache } from '@open-mercato/core/modules/attachments/lib/thumbnailCache'
 import { isMultipartRequestWithinUploadLimit } from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import {
-  ScopedAttachmentUploadError,
+  isScopedAttachmentUploadError,
   type ScopedAttachmentUploadErrorCode,
 } from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -413,7 +413,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
       tags: [CUSTOMER_VISIBLE_ATTACHMENT_TAG],
     })
   } catch (error) {
-    if (error instanceof ScopedAttachmentUploadError) {
+    if (isScopedAttachmentUploadError(error)) {
       const { t } = await resolveTranslations()
       const [key, fallback] = ATTACHMENT_ERROR_TRANSLATIONS[error.code]
         ?? ['warranty_claims.portal.detail.attachmentError', 'Attachment upload failed.']

package/src/modules/workflows/lib/activity-executor.ts

@@ -22,6 +22,7 @@ import {
   type HostLookup,
 } from '@open-mercato/shared/lib/url-safety'
 import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'
 import { callWebhookConfigSchema } from '../data/validators'
 import { WorkflowActivityJob, WORKFLOW_ACTIVITIES_QUEUE_NAME } from './activity-queue-types'
 import { logWorkflowEvent } from './event-logger'
@@ -578,6 +579,14 @@ export async function executeEmitEvent(
     throw new Error('EMIT_EVENT requires "eventName" field')
   }
 
+  // Workflow definitions are tenant-managed input. Private cross-process
+  // events coordinate trusted server state (for example closing an in-memory
+  // collaboration room), so allowing a workflow to name one would turn a
+  // regular event activity into a cross-process invalidation primitive.
+  if (isPrivateCrossProcessBroadcastEvent(eventName)) {
+    throw new Error(`EMIT_EVENT cannot emit private cross-process event "${eventName}"`)
+  }
+
   // Emissions are fire-and-forget and no subscriber validates the payload shape,
   // so an unresolved `{{context.x}}` here is even quieter than on the command
   // path — it ships the literal template to every consumer. Fail loudly instead.