@open-mercato/onboarding 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/onboarding/lib/service.ts

@@ -1,6 +1,8 @@
 import { randomBytes, createHash } from 'node:crypto'
 import { hash } from 'bcryptjs'
 import { EntityManager } from '@mikro-orm/postgresql'
+import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { OnboardingRequest } from '../data/entities'
 import type { OnboardingStartInput } from '../data/validators'
 
@@ -18,8 +20,14 @@ export class OnboardingService {
     const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)
     const now = new Date()
     const passwordHash = await hash(input.password, 10)
+    const emailHash = hashForLookup(input.email)
 
-    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })
+    const existing = await findOneWithDecryption(this.em, OnboardingRequest, {
+      $or: [
+        { emailHash: { $in: lookupHashCandidates(input.email) } },
+        { email: input.email, emailHash: null },
+      ],
+    })
     if (existing) {
       const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt
       if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {
@@ -36,6 +44,7 @@ export class OnboardingService {
       existing.termsAccepted = true
       existing.marketingConsent = input.marketingConsent ?? false
       existing.passwordHash = passwordHash
+      existing.emailHash = emailHash
       existing.expiresAt = expiresAt
       existing.completedAt = null
       existing.processingStartedAt = null
@@ -52,6 +61,7 @@ export class OnboardingService {
 
     const request = this.em.create(OnboardingRequest, {
       email: input.email,
+      emailHash,
       tokenHash,
       status: 'pending',
       firstName: input.firstName,
@@ -74,7 +84,7 @@ export class OnboardingService {
   async findPendingByToken(token: string) {
     const tokenHash = hashToken(token)
     const now = new Date()
-    return this.em.findOne(OnboardingRequest, {
+    return findOneWithDecryption(this.em, OnboardingRequest, {
       tokenHash,
       status: 'pending',
       expiresAt: { $gt: now } as any,
@@ -83,18 +93,20 @@ export class OnboardingService {
 
   async findByToken(token: string) {
     const tokenHash = hashToken(token)
-    return this.em.findOne(OnboardingRequest, { tokenHash })
+    return findOneWithDecryption(this.em, OnboardingRequest, { tokenHash })
   }
 
   async findById(id: string) {
-    return this.em.findOne(OnboardingRequest, { id })
+    return findOneWithDecryption(this.em, OnboardingRequest, { id })
   }
 
   async findLatestByTenantId(tenantId: string) {
-    return this.em.findOne(
+    return findOneWithDecryption(
+      this.em,
       OnboardingRequest,
       { tenantId, deletedAt: null },
       { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },
+      { tenantId, organizationId: null },
     )
   }
 

package/src/modules/onboarding/migrations/.snapshot-open-mercato.json

@@ -25,6 +25,15 @@
           "nullable": false,
           "mappedType": "text"
         },
+        "email_hash": {
+          "name": "email_hash",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
         "token_hash": {
           "name": "token_hash",
           "type": "text",
@@ -260,6 +269,16 @@
           "primary": false,
           "unique": true
         },
+        {
+          "keyName": "onboarding_requests_email_hash_unique",
+          "columnNames": [
+            "email_hash"
+          ],
+          "composite": false,
+          "constraint": true,
+          "primary": false,
+          "unique": true
+        },
         {
           "keyName": "onboarding_requests_pkey",
           "columnNames": [

package/src/modules/onboarding/migrations/Migration20260710133207_onboarding.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260710133207_onboarding extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "onboarding_requests" add "email_hash" text null;`);
+    this.addSql(`alter table "onboarding_requests" add constraint "onboarding_requests_email_hash_unique" unique ("email_hash");`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`alter table "onboarding_requests" drop constraint if exists "onboarding_requests_email_hash_unique";`);
+    this.addSql(`alter table "onboarding_requests" drop column "email_hash";`);
+  }
+
+}