@open-mercato/core 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7019.1.f4c01c4b5c

package/src/modules/data_sync/lib/abandoned-run.ts

@@ -0,0 +1,56 @@
+import type { AbandonedJobInfo } from '@open-mercato/queue'
+
+/**
+ * Fail the run behind a job the queue gave up on.
+ *
+ * A resumable data_sync job is ONE long-lived job for a whole run — `runImport` is entered once and
+ * stays there for the duration, which for a full backfill is days. Every worker death (a deploy, an
+ * OOM) therefore stalls that job, and BullMQ's stalled counter is cumulative for the job's life:
+ * past `DATA_SYNC_MAX_STALLED_COUNT` it writes a deferred failure and the next worker fails the job
+ * BEFORE calling the processor.
+ *
+ * So `runImport` never runs, never throws, and never finalizes — and `sync_runs` is left saying
+ * `running` for a run nothing is running, forever. That is the residual state `queue-policy.ts`
+ * describes as what remains after a job exhausts its stall budget; this repairs it.
+ *
+ * It only ever moves a non-terminal run: `markStatus` refuses to overwrite `completed` / `failed` /
+ * `cancelled`, so a job abandoned after its run has ended is a no-op. `onJobAbandoned` may deliver
+ * the same job more than once, which for the same reason is also a no-op.
+ *
+ * The run's progress job is failed alongside it, the way the worker's own catch path does in
+ * `workers/sync-import.ts`. Without that the two halves disagree — the run reads `failed` while the
+ * operation still shows as in flight in the top bar — until the progress staleness sweep eventually
+ * fails it with a generic no-heartbeat message instead of the reason the queue recorded.
+ */
+export async function failAbandonedRun(payload: unknown, info: AbandonedJobInfo): Promise<void> {
+  const data = payload as { payload?: { runId?: unknown; scope?: { organizationId?: unknown; tenantId?: unknown } } } | undefined
+  const runId = data?.payload?.runId
+  const scope = data?.payload?.scope
+  // Nothing to repair without both: the run row is keyed by id AND tenant scope.
+  if (typeof runId !== 'string' || typeof scope?.organizationId !== 'string' || typeof scope?.tenantId !== 'string') return
+
+  const runScope = { organizationId: scope.organizationId, tenantId: scope.tenantId }
+  const errorMessage = `the queue abandoned this run's job without running it: ${info.reason}`
+
+  const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+  const container = await createRequestContainer()
+  const runService = container.resolve('dataSyncRunService') as {
+    markStatus(
+      runId: string,
+      status: string,
+      scope: { organizationId: string; tenantId: string },
+      error?: string,
+    ): Promise<{ progressJobId?: string | null } | null>
+  }
+  const run = await runService.markStatus(runId, 'failed', runScope, errorMessage)
+  if (!run?.progressJobId) return
+
+  const progressService = container.resolve('progressService') as {
+    failJob(
+      jobId: string,
+      input: { errorMessage: string },
+      ctx: { organizationId: string; tenantId: string },
+    ): Promise<unknown>
+  }
+  await progressService.failJob(run.progressJobId, { errorMessage }, runScope)
+}

package/src/modules/data_sync/workers/sync-export.ts

@@ -7,6 +7,7 @@ import {
   DATA_SYNC_LOCK_DURATION_MS,
   DATA_SYNC_MAX_STALLED_COUNT,
 } from '../lib/queue-policy'
+import { failAbandonedRun } from '../lib/abandoned-run'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-export' })
@@ -27,6 +28,9 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
   lockDuration: DATA_SYNC_LOCK_DURATION_MS,
   maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
+  // Declared on the worker, not on the enqueueing queue: the abandonment this reports is a worker
+  // restart, and the process that restarts never constructs the producer's queue instance.
+  onJobAbandoned: failAbandonedRun,
 }
 
 type HandlerContext = JobContext & {

package/src/modules/data_sync/workers/sync-import.ts

@@ -7,6 +7,7 @@ import {
   DATA_SYNC_LOCK_DURATION_MS,
   DATA_SYNC_MAX_STALLED_COUNT,
 } from '../lib/queue-policy'
+import { failAbandonedRun } from '../lib/abandoned-run'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('data_sync').child({ component: 'sync-import' })
@@ -27,6 +28,9 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
   lockDuration: DATA_SYNC_LOCK_DURATION_MS,
   maxStalledCount: DATA_SYNC_MAX_STALLED_COUNT,
+  // Declared on the worker, not on the enqueueing queue: the abandonment this reports is a worker
+  // restart, and the process that restarts never constructs the producer's queue instance.
+  onJobAbandoned: failAbandonedRun,
 }
 
 type HandlerContext = JobContext & {

package/src/modules/directory/di.ts

@@ -1,6 +1,18 @@
+import { asClass, asFunction } from 'awilix'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { DefaultOrganizationScopeService } from './services/organizationScopeService'
+import { DefaultOrganizationHierarchyService } from './services/organizationHierarchyService'
+
+type OrganizationScopeRbac = ConstructorParameters<typeof DefaultOrganizationScopeService>[1]
 
 export function register(container: AppContainer) {
-  // Directory module has no services yet; placeholder for future overrides
+  container.register({
+    organizationHierarchyService: asClass(DefaultOrganizationHierarchyService).scoped(),
+    organizationScopeService: asFunction((cradle: { em: EntityManager; rbacService: OrganizationScopeRbac }) =>
+      new DefaultOrganizationScopeService(cradle.em, cradle.rbacService, container),
+    )
+      .scoped()
+      .proxy(),
+  })
 }
-

package/src/modules/directory/services/organizationHierarchyService.ts

@@ -0,0 +1,34 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Organization } from '../data/entities'
+
+function normalizeIds(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  return Array.from(new Set(values
+    .map((value) => typeof value === 'string' ? value.trim() : '')
+    .filter(Boolean)))
+}
+
+export class DefaultOrganizationHierarchyService implements OrganizationHierarchyService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveAncestorIds(input: {
+    tenantId: string
+    organizationId: string
+  }): Promise<string[] | null> {
+    const organization = await findOneWithDecryption(
+      this.em,
+      Organization,
+      {
+        id: input.organizationId,
+        tenant: input.tenantId,
+        deletedAt: null,
+      } as FilterQuery<Organization>,
+      { fields: ['id', 'ancestorIds'] },
+      { tenantId: input.tenantId, organizationId: input.organizationId },
+    )
+    return organization ? normalizeIds(organization.ancestorIds) : null
+  }
+}

package/src/modules/directory/services/organizationScopeService.ts

@@ -0,0 +1,85 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import type {
+  OrganizationScopeService,
+  OrganizationScopeRequest,
+} from '@open-mercato/shared/lib/auth/principal-service'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScope, resolveOrganizationScopeForRequest } from '../utils/organizationScope'
+
+type OrganizationScopeRbac = {
+  invalidateUserCache(userId: string): Promise<void>
+  loadAcl(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
+}
+
+export class DefaultOrganizationScopeService implements OrganizationScopeService {
+  constructor(
+    private readonly em: EntityManager,
+    private readonly rbac: OrganizationScopeRbac,
+    private readonly container: AwilixContainer,
+  ) {}
+
+  resolve(input: {
+    auth: AuthContext | null | undefined
+    selectedId?: string | null
+    tenantId?: string | null
+    freshAcl?: boolean
+  }) {
+    const auth = input.auth
+    if (input.freshAcl && auth?.sub) {
+      return this.resolveFresh({
+        auth,
+        selectedId: input.selectedId,
+        tenantId: input.tenantId,
+      }).then((result) => result.scope)
+    }
+    return resolveOrganizationScope({
+      em: this.em,
+      rbac: this.rbac as Parameters<typeof resolveOrganizationScope>[0]['rbac'],
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+
+  async resolveFresh(input: {
+    auth: NonNullable<AuthContext>
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    await this.rbac.invalidateUserCache(input.auth.sub)
+    const acl = await this.rbac.loadAcl(input.auth.sub, {
+      tenantId: input.tenantId ?? input.auth.tenantId ?? null,
+      organizationId: input.selectedId ?? input.auth.orgId ?? null,
+    })
+    const freshRbac: Parameters<typeof resolveOrganizationScope>[0]['rbac'] = {
+      loadAcl: async () => acl,
+    }
+    const scope = await resolveOrganizationScope({
+      em: this.em,
+      rbac: freshRbac,
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+    return { scope, acl }
+  }
+
+  resolveForRequest(input: {
+    auth: AuthContext | null | undefined
+    request?: OrganizationScopeRequest
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    return resolveOrganizationScopeForRequest({
+      container: this.container,
+      auth: input.auth,
+      request: input.request,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+}

package/src/modules/directory/utils/organizationScope.ts

@@ -5,6 +5,7 @@ import { Organization } from '@open-mercato/core/modules/directory/data/entities
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import { getCurrentCacheTenant, runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -13,19 +14,7 @@ const logger = createLogger('directory').child({ component: 'org-scope-cache' })
 
 export { parseSelectedOrganizationCookie, parseSelectedTenantCookie }
 
-export type OrganizationScope = {
-  selectedId: string | null
-  filterIds: string[] | null
-  allowedIds: string[] | null
-  tenantId: string | null
-  // True when the caller explicitly selected a concrete organization (cookie /
-  // selectedId param) that could not be honored — it does not exist for the
-  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
-  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
-  // this so a record never lands under an org the caller did not intend. Absent
-  // (undefined) means the selection — if any — was honored.
-  selectionRejected?: boolean
-}
+export type { OrganizationScope }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
 // OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,
@@ -249,8 +238,8 @@ export async function resolveOrganizationScope({
   tenantId: tenantIdOverride,
 }: {
   em: EntityManager
-  rbac: RbacService
-  auth: AuthContext
+  rbac: Pick<RbacService, 'loadAcl'>
+  auth: AuthContext | null | undefined
   selectedId?: string | null
   tenantId?: string | null
 }): Promise<OrganizationScope> {

package/src/modules/warranty_claims/api/portal/attachments/route.ts

@@ -19,7 +19,7 @@ import { readAttachmentMetadata } from '@open-mercato/core/modules/attachments/l
 import { clearAttachmentThumbnailCache } from '@open-mercato/core/modules/attachments/lib/thumbnailCache'
 import { isMultipartRequestWithinUploadLimit } from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import {
-  ScopedAttachmentUploadError,
+  isScopedAttachmentUploadError,
   type ScopedAttachmentUploadErrorCode,
 } from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -413,7 +413,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
       tags: [CUSTOMER_VISIBLE_ATTACHMENT_TAG],
     })
   } catch (error) {
-    if (error instanceof ScopedAttachmentUploadError) {
+    if (isScopedAttachmentUploadError(error)) {
       const { t } = await resolveTranslations()
       const [key, fallback] = ATTACHMENT_ERROR_TRANSLATIONS[error.code]
         ?? ['warranty_claims.portal.detail.attachmentError', 'Attachment upload failed.']

package/src/modules/workflows/lib/activity-executor.ts

@@ -22,6 +22,7 @@ import {
   type HostLookup,
 } from '@open-mercato/shared/lib/url-safety'
 import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'
 import { callWebhookConfigSchema } from '../data/validators'
 import { WorkflowActivityJob, WORKFLOW_ACTIVITIES_QUEUE_NAME } from './activity-queue-types'
 import { logWorkflowEvent } from './event-logger'
@@ -578,6 +579,14 @@ export async function executeEmitEvent(
     throw new Error('EMIT_EVENT requires "eventName" field')
   }
 
+  // Workflow definitions are tenant-managed input. Private cross-process
+  // events coordinate trusted server state (for example closing an in-memory
+  // collaboration room), so allowing a workflow to name one would turn a
+  // regular event activity into a cross-process invalidation primitive.
+  if (isPrivateCrossProcessBroadcastEvent(eventName)) {
+    throw new Error(`EMIT_EVENT cannot emit private cross-process event "${eventName}"`)
+  }
+
   // Emissions are fire-and-forget and no subscriber validates the payload shape,
   // so an unresolved `{{context.x}}` here is even quieter than on the command
   // path — it ships the literal template to every consumer. Fail loudly instead.