@open-mercato/core 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7019.1.f4c01c4b5c

package/src/modules/api_keys/di.ts

@@ -0,0 +1,7 @@
+import { asClass } from 'awilix'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { DefaultApiKeyPrincipalService } from './services/principalService'
+
+export function register(container: AppContainer) {
+  container.register({ apiKeyPrincipalService: asClass(DefaultApiKeyPrincipalService).scoped() })
+}

package/src/modules/api_keys/services/principalService.ts

@@ -0,0 +1,33 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { ApiKeyPrincipalService, PrincipalScope } from '@open-mercato/shared/lib/auth/principal-service'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { ApiKey } from '../data/entities'
+
+function normalizeIds(ids: unknown): string[] {
+  if (!Array.isArray(ids)) return []
+  return Array.from(new Set(ids
+    .map((id) => typeof id === 'string' ? id.trim() : '')
+    .filter(Boolean)))
+}
+
+export class DefaultApiKeyPrincipalService implements ApiKeyPrincipalService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveAssignedRoleIds(apiKeyId: string, scope: PrincipalScope): Promise<string[]> {
+    const apiKey = await findOneWithDecryption(
+      this.em,
+      ApiKey,
+      {
+        id: apiKeyId,
+        tenantId: scope.tenantId,
+        deletedAt: null,
+        $or: [{ organizationId: null }, { organizationId: scope.organizationId }],
+      } as FilterQuery<ApiKey>,
+      { fields: ['rolesJson', 'expiresAt'] as const },
+      scope,
+    )
+    if (!apiKey || (apiKey.expiresAt && apiKey.expiresAt.getTime() <= Date.now())) return []
+    return normalizeIds(apiKey.rolesJson)
+  }
+}

package/src/modules/attachments/AGENTS.md

@@ -34,6 +34,18 @@ write time.
 
 ## Always
 
+- Cross-module consumers MUST resolve the public `attachmentService` DI contract
+  and import its type from `@open-mercato/core/modules/attachments`. Keep
+  attachment entities, partitions, storage drivers, quota accounting, file
+  security, and `checkAttachmentAccess` behind that boundary.
+- Cross-module multipart uploads MUST use `attachmentService.readUploadForm()` so
+  the raw request stream is bounded before `FormData` decoding, including when
+  `Content-Length` is missing or the request is chunked.
+- Cross-module permanent deletion MUST use `attachmentService.releaseScoped()`
+  with the exact owner, assignment, partition, and tenant/organization scope. In
+  an ambient transaction pass `{ flush: false }`, commit the returned database
+  removal first, and invoke the returned provider cleanup only after commit;
+  never delete provider bytes before a transaction can still roll back.
 - **MUST call `assertAttachmentScopeInvariant({ tenantId, organizationId })` from
   `lib/access.ts` before persisting any new `Attachment` row.** It throws on a
   partial-null scope and accepts both fully-scoped and fully-global rows. The
@@ -46,6 +58,9 @@ write time.
 
 ## Never
 
+- Never make a peer module construct `StorageDriverFactory` or read Attachment /
+  AttachmentPartition entities directly as a fallback. Missing service wiring
+  must fail closed.
 - **Never create a partial-null attachment** (one scope column set, the other null).
 - **Never read or expose attachment rows without `checkAttachmentAccess`** — bypassing
   it reintroduces the cross-tenant fail-open class.

package/src/modules/attachments/di.ts

@@ -2,6 +2,7 @@ import { asFunction, asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { StorageDriverFactory } from './lib/drivers/driverFactory'
+import { DefaultAttachmentService } from './lib/attachment-service'
 import { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'
 import { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'
 import { AttachmentTargetAccessService } from './lib/target-access-service'
@@ -46,5 +47,20 @@ export function register(container: AppContainer) {
     )
       .singleton()
       .proxy(),
+    // The scoped upload service is handed over as a lazy resolver so module
+    // uploads share the public attachment route's single fenced reservation
+    // ledger, without dragging that service's own dependencies into every
+    // container that merely constructs an `attachmentService`.
+    attachmentService: asFunction((cradle: {
+      em: ConstructorParameters<typeof DefaultAttachmentService>[0]
+      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]
+      attachmentScopedUploadService: ScopedAttachmentUploadService
+    }) => new DefaultAttachmentService(
+      cradle.em,
+      cradle.storageDriverFactory,
+      () => cradle.attachmentScopedUploadService ?? null,
+    ))
+      .scoped()
+      .proxy(),
   })
 }

package/src/modules/attachments/i18n/de.json

@@ -2,12 +2,17 @@
   "attachments.errors.activeContentBlocked": "Das Hochladen aktiver Inhalte ist nicht erlaubt.",
   "attachments.errors.dangerousExecutable": "Ausführbare Dateitypen sind als Anhänge nicht erlaubt.",
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
+  "attachments.errors.partitionUnavailable": "Die Anhang-Partition ist für diesen Bereich nicht verfügbar.",
+  "attachments.errors.persistenceFailed": "Der Anhang konnte nicht gespeichert werden.",
   "attachments.errors.publicPartitionBlocked": "Öffentliche Speicherpartitionen können für diesen Upload nicht explizit ausgewählt werden.",
   "attachments.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
   "attachments.errors.quotaRecoveryUnsupported": "Der Speichertreiber kann nicht an der Kontingent-Wiederherstellung teilnehmen.",
   "attachments.errors.quotaUnavailable": "Die Speicherkontingent-Abrechnung ist nicht verfügbar.",
   "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
+  "attachments.errors.storageFailed": "Die Anhangsdatei konnte nicht im Speicher abgelegt werden.",
   "attachments.errors.storagePathExists": "Der Zielspeicherpfad existiert bereits.",
+  "attachments.errors.uploadFailed": "Das Hochladen des Anhangs ist fehlgeschlagen.",
+  "attachments.errors.uploadServiceUnavailable": "Der Anhang-Upload-Dienst ist nicht verfügbar.",
   "attachments.library.actions.chooseReplacement": "Ersatzdatei auswählen",
   "attachments.library.actions.copied": "Link kopiert.",
   "attachments.library.actions.copyError": "Link konnte nicht kopiert werden.",

package/src/modules/attachments/i18n/en.json

@@ -2,12 +2,17 @@
   "attachments.errors.activeContentBlocked": "Active content uploads are not allowed.",
   "attachments.errors.dangerousExecutable": "Executable file types are not allowed as attachments.",
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
+  "attachments.errors.partitionUnavailable": "Attachment partition is not available for this scope.",
+  "attachments.errors.persistenceFailed": "Failed to persist attachment.",
   "attachments.errors.publicPartitionBlocked": "Public storage partitions cannot be selected explicitly for this upload.",
   "attachments.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
   "attachments.errors.quotaRecoveryUnsupported": "Storage driver cannot participate in quota recovery.",
   "attachments.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
   "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
+  "attachments.errors.storageFailed": "Failed to store the attachment file.",
   "attachments.errors.storagePathExists": "The target storage path already exists.",
+  "attachments.errors.uploadFailed": "Attachment upload failed.",
+  "attachments.errors.uploadServiceUnavailable": "The attachment upload service is not available.",
   "attachments.library.actions.chooseReplacement": "Choose replacement file",
   "attachments.library.actions.copied": "Link copied.",
   "attachments.library.actions.copyError": "Unable to copy link.",

package/src/modules/attachments/i18n/es.json

@@ -2,12 +2,17 @@
   "attachments.errors.activeContentBlocked": "No se permite la carga de contenido activo.",
   "attachments.errors.dangerousExecutable": "No se permiten archivos ejecutables como adjuntos.",
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
+  "attachments.errors.partitionUnavailable": "La partición de adjuntos no está disponible para este ámbito.",
+  "attachments.errors.persistenceFailed": "No se pudo guardar el archivo adjunto.",
   "attachments.errors.publicPartitionBlocked": "No se pueden seleccionar explícitamente particiones de almacenamiento públicas para esta carga.",
   "attachments.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
   "attachments.errors.quotaRecoveryUnsupported": "El controlador de almacenamiento no puede participar en la recuperación de cuota.",
   "attachments.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
   "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
+  "attachments.errors.storageFailed": "No se pudo almacenar el archivo adjunto.",
   "attachments.errors.storagePathExists": "La ruta de almacenamiento de destino ya existe.",
+  "attachments.errors.uploadFailed": "Error al subir el archivo adjunto.",
+  "attachments.errors.uploadServiceUnavailable": "El servicio de carga de adjuntos no está disponible.",
   "attachments.library.actions.chooseReplacement": "Elegir archivo de reemplazo",
   "attachments.library.actions.copied": "Enlace copiado.",
   "attachments.library.actions.copyError": "No se pudo copiar el enlace.",

package/src/modules/attachments/i18n/ko.json

@@ -2,12 +2,17 @@
   "attachments.errors.activeContentBlocked": "활성 콘텐츠 업로드는 허용되지 않습니다.",
   "attachments.errors.dangerousExecutable": "실행 파일 형식은 첨부 파일로 허용되지 않습니다.",
   "attachments.errors.maxUploadSize": "첨부 파일이 최대 업로드 크기를 초과합니다.",
+  "attachments.errors.partitionUnavailable": "이 범위에서는 첨부 파일 파티션을 사용할 수 없습니다.",
+  "attachments.errors.persistenceFailed": "첨부 파일을 저장하지 못했습니다.",
   "attachments.errors.publicPartitionBlocked": "이 업로드에는 공개 저장소 파티션을 명시적으로 선택할 수 없습니다.",
   "attachments.errors.quotaExceeded": "이 테넌트의 첨부 파일 저장소 할당량을 초과했습니다.",
   "attachments.errors.quotaRecoveryUnsupported": "저장 용량 복구가 지원되지 않습니다.",
   "attachments.errors.quotaUnavailable": "첨부파일 저장 용량 정보를 확인할 수 없습니다.",
   "attachments.errors.selectOrganization": "첨부파일을 업로드하기 전에 특정 조직을 선택하세요.",
+  "attachments.errors.storageFailed": "첨부 파일을 저장소에 기록하지 못했습니다.",
   "attachments.errors.storagePathExists": "대상 저장 경로가 이미 존재합니다.",
+  "attachments.errors.uploadFailed": "첨부 파일 업로드에 실패했습니다.",
+  "attachments.errors.uploadServiceUnavailable": "첨부 파일 업로드 서비스를 사용할 수 없습니다.",
   "attachments.library.actions.chooseReplacement": "교체 파일 선택",
   "attachments.library.actions.copied": "링크가 복사되었습니다.",
   "attachments.library.actions.copyError": "링크를 복사할 수 없습니다.",

package/src/modules/attachments/i18n/pl.json

@@ -2,12 +2,17 @@
   "attachments.errors.activeContentBlocked": "Przesyłanie treści aktywnych nie jest dozwolone.",
   "attachments.errors.dangerousExecutable": "Pliki wykonywalne nie są dozwolone jako załączniki.",
   "attachments.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
+  "attachments.errors.partitionUnavailable": "Partycja załączników nie jest dostępna w tym zakresie.",
+  "attachments.errors.persistenceFailed": "Nie udało się zapisać załącznika.",
   "attachments.errors.publicPartitionBlocked": "Nie można jawnie wybrać publicznej partycji do tego przesyłania.",
   "attachments.errors.quotaExceeded": "Przekroczono limit miejsca na załączniki dla tego tenantu.",
   "attachments.errors.quotaRecoveryUnsupported": "Sterownik przechowywania nie może uczestniczyć w odzyskiwaniu limitu.",
   "attachments.errors.quotaUnavailable": "Rozliczanie limitu przestrzeni dyskowej jest niedostępne.",
   "attachments.errors.selectOrganization": "Wybierz konkretną organizację przed przesłaniem załącznika.",
+  "attachments.errors.storageFailed": "Nie udało się zapisać pliku załącznika w magazynie.",
   "attachments.errors.storagePathExists": "Docelowa ścieżka przechowywania już istnieje.",
+  "attachments.errors.uploadFailed": "Przesyłanie załącznika nie powiodło się.",
+  "attachments.errors.uploadServiceUnavailable": "Usługa przesyłania załączników jest niedostępna.",
   "attachments.library.actions.chooseReplacement": "Wybierz plik zastępczy",
   "attachments.library.actions.copied": "Link skopiowany.",
   "attachments.library.actions.copyError": "Nie można skopiować linku.",

package/src/modules/attachments/index.ts

@@ -9,3 +9,13 @@ export const metadata: ModuleInfo = {
   license: 'MIT',
 }
 
+export {
+  type AttachmentOwner,
+  type AttachmentProviderCleanup,
+  type AttachmentService,
+  type CreatedScopedAttachment,
+  type CreateScopedAttachmentInput,
+  type ReadScopedAttachmentInput,
+  type ReadScopedAttachmentResult,
+  type ReleaseScopedAttachmentInput,
+} from './lib/attachment-service'