@open-mercato/scheduler 0.10.1-develop.7690.1.9d41ec4115 → 0.10.1-develop.7699.1.5236fabda0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:scheduler] found 64 entry points
+[build:scheduler] found 65 entry points
 [build:scheduler] built successfully

package/dist/modules/scheduler/__integration__/TC-SCHED-010-full-export-tenant-scope.spec.js

@@ -0,0 +1,149 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  createOrganizationFixture,
+  createRoleFixture,
+  createUserFixture,
+  deleteOrganizationIfExists,
+  deleteRoleIfExists,
+  deleteUserIfExists,
+  setRoleAclFeatures
+} from "@open-mercato/core/helpers/integration/authFixtures";
+import { expectId, getTokenContext, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob } from "./helpers/scheduler.js";
+const SCHEDULER_FEATURES = ["scheduler.jobs.view", "scheduler.jobs.manage"];
+async function createTenantFixture(request, superadminToken, name) {
+  const response = await apiRequest(request, "POST", "/api/directory/tenants", { token: superadminToken, data: { name } });
+  expect(response.status(), "POST /api/directory/tenants should return 201").toBe(201);
+  return expectId((await readJsonSafe(response))?.id, "tenant fixture should return an id");
+}
+async function deleteTenantIfExists(request, superadminToken, tenantId) {
+  if (!superadminToken || !tenantId) return;
+  await apiRequest(request, "DELETE", `/api/directory/tenants?id=${encodeURIComponent(tenantId)}`, { token: superadminToken }).catch(() => void 0);
+}
+async function createScopedActor(request, superadminToken, input) {
+  const roleId = await createRoleFixture(request, superadminToken, {
+    name: `sched-${input.label}-${input.stamp}`,
+    tenantId: input.tenantId
+  });
+  await setRoleAclFeatures(request, superadminToken, {
+    roleId,
+    features: input.features ?? SCHEDULER_FEATURES,
+    organizations: [input.organizationId]
+  });
+  const email = `sched-${input.label}-${input.stamp}@test.invalid`;
+  const password = "Valid1!Pass";
+  const userId = await createUserFixture(request, superadminToken, {
+    email,
+    password,
+    organizationId: input.organizationId,
+    roles: [roleId]
+  });
+  const token = await getAuthToken(request, email, password);
+  return { organizationId: input.organizationId, roleId, userId, token };
+}
+async function cleanupScopedActor(request, superadminToken, actor) {
+  if (!actor) return;
+  await deleteUserIfExists(request, superadminToken, actor.userId);
+  await deleteRoleIfExists(request, superadminToken, actor.roleId);
+}
+test.describe("TC-SCHED-010: full export stays scoped to the caller tenant/organization (#7806)", () => {
+  test("own-org job survives, other-org and foreign-tenant jobs do not; missing-feature caller is refused", async ({ request }) => {
+    const superadminToken = await getAuthToken(request, "superadmin");
+    const adminToken = await getAuthToken(request, "admin");
+    const { tenantId: homeTenantId, organizationId: homeOrgId } = getTokenContext(adminToken);
+    expect(homeTenantId.length, "admin token should carry a tenant id").toBeGreaterThan(0);
+    expect(homeOrgId.length, "admin token should carry an organization id").toBeGreaterThan(0);
+    const stamp = `${Date.now()}`;
+    let ownOrgActor = null;
+    let otherOrgActor = null;
+    let viewOnlyActor = null;
+    let secondOrgId = null;
+    let foreignTenantId = null;
+    let foreignOrgId = null;
+    let foreignRoleId = null;
+    let foreignUserId = null;
+    let ownOrgJobId = null;
+    let otherOrgJobId = null;
+    let foreignTenantJobId = null;
+    let foreignToken = null;
+    try {
+      ownOrgActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: homeOrgId,
+        stamp,
+        label: "own"
+      });
+      secondOrgId = await createOrganizationFixture(request, superadminToken, {
+        name: `QA SCHED Org B ${stamp}`,
+        tenantId: homeTenantId
+      });
+      otherOrgActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: secondOrgId,
+        stamp,
+        label: "other-org"
+      });
+      foreignTenantId = await createTenantFixture(request, superadminToken, `QA SCHED Tenant B ${stamp}`);
+      foreignOrgId = await createOrganizationFixture(request, superadminToken, {
+        name: `QA SCHED Org C ${stamp}`,
+        tenantId: foreignTenantId
+      });
+      foreignRoleId = await createRoleFixture(request, superadminToken, { name: `sched-foreign-${stamp}`, tenantId: foreignTenantId });
+      await setRoleAclFeatures(request, superadminToken, { roleId: foreignRoleId, features: SCHEDULER_FEATURES, organizations: [foreignOrgId] });
+      const foreignEmail = `sched-foreign-${stamp}@test.invalid`;
+      const foreignPassword = "Valid1!Pass";
+      foreignUserId = await createUserFixture(request, superadminToken, {
+        email: foreignEmail,
+        password: foreignPassword,
+        organizationId: foreignOrgId,
+        roles: [foreignRoleId]
+      });
+      foreignToken = await getAuthToken(request, foreignEmail, foreignPassword);
+      viewOnlyActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: homeOrgId,
+        stamp,
+        label: "nofeat",
+        features: []
+      });
+      ownOrgJobId = await createScheduleJob(request, ownOrgActor.token, { name: `QA SCHED Own Org Job ${stamp}` });
+      otherOrgJobId = await createScheduleJob(request, otherOrgActor.token, { name: `QA SCHED Other Org Job ${stamp}` });
+      foreignTenantJobId = await createScheduleJob(request, foreignToken, { name: `QA SCHED Foreign Tenant Job ${stamp}` });
+      const exportResponse = await apiRequest(
+        request,
+        "GET",
+        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,
+        { token: ownOrgActor.token }
+      );
+      expect(exportResponse.status(), "full export should return 200 for an authorized caller").toBe(200);
+      const exported = await readJsonSafe(exportResponse);
+      const exportedIds = new Set((exported ?? []).map((item) => item.Id));
+      expect(exportedIds.has(ownOrgJobId), "own-org job must survive the full export").toBe(true);
+      expect(exportedIds.has(otherOrgJobId), "another organization's job (same tenant) must not leak into the export").toBe(false);
+      expect(exportedIds.has(foreignTenantJobId), "a foreign tenant's job must not leak into the export (#7806)").toBe(false);
+      const forbiddenResponse = await apiRequest(
+        request,
+        "GET",
+        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,
+        { token: viewOnlyActor.token }
+      );
+      expect(forbiddenResponse.status(), "full export must be refused without scheduler.jobs.view").toBe(403);
+      const forbiddenBody = await readJsonSafe(forbiddenResponse);
+      expect(forbiddenBody?.requiredFeatures ?? []).toContain("scheduler.jobs.view");
+    } finally {
+      await deleteScheduleJob(request, superadminToken, ownOrgJobId);
+      await deleteScheduleJob(request, otherOrgActor?.token ?? superadminToken, otherOrgJobId);
+      await deleteScheduleJob(request, foreignToken ?? superadminToken, foreignTenantJobId);
+      await cleanupScopedActor(request, superadminToken, ownOrgActor);
+      await cleanupScopedActor(request, superadminToken, otherOrgActor);
+      await cleanupScopedActor(request, superadminToken, viewOnlyActor);
+      await deleteUserIfExists(request, superadminToken, foreignUserId);
+      await deleteRoleIfExists(request, superadminToken, foreignRoleId);
+      await deleteOrganizationIfExists(request, superadminToken, secondOrgId);
+      await deleteOrganizationIfExists(request, superadminToken, foreignOrgId);
+      await deleteTenantIfExists(request, superadminToken, foreignTenantId);
+    }
+  });
+});
+//# sourceMappingURL=TC-SCHED-010-full-export-tenant-scope.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-010-full-export-tenant-scope.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-010-full-export-tenant-scope.spec.ts"],
+  "sourcesContent": ["import { expect, test, type APIRequestContext } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport {\n  createOrganizationFixture,\n  createRoleFixture,\n  createUserFixture,\n  deleteOrganizationIfExists,\n  deleteRoleIfExists,\n  deleteUserIfExists,\n  setRoleAclFeatures,\n} from '@open-mercato/core/helpers/integration/authFixtures'\nimport { expectId, getTokenContext, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob } from './helpers/scheduler'\n\n/**\n * TC-SCHED-010: real-world regression for #7806 \u2014 `GET /api/scheduler/jobs?format=json&exportScope=full`\n * must keep applying the route's own `buildFilters` visibility predicate (own-org, own-tenant-scope,\n * superadmin-only system-scope) instead of dropping to `{}`, which would leak every tenant's jobs on a\n * full export (scheduler jobs opt out of the factory's automatic tenant/org scope via\n * `omitAutomaticTenantOrgScope`, so it owns 100% of the visibility logic). Unlike the existing mocked\n * unit coverage in `api/jobs/__tests__/route.scope.test.ts`, this exercises the real authenticated route,\n * real ACL resolution, and a real Postgres-backed query engine.\n */\n\nconst SCHEDULER_FEATURES = ['scheduler.jobs.view', 'scheduler.jobs.manage']\n\nasync function createTenantFixture(request: APIRequestContext, superadminToken: string, name: string): Promise<string> {\n  const response = await apiRequest(request, 'POST', '/api/directory/tenants', { token: superadminToken, data: { name } })\n  expect(response.status(), 'POST /api/directory/tenants should return 201').toBe(201)\n  return expectId((await readJsonSafe<{ id?: string }>(response))?.id, 'tenant fixture should return an id')\n}\n\nasync function deleteTenantIfExists(request: APIRequestContext, superadminToken: string | null, tenantId: string | null): Promise<void> {\n  if (!superadminToken || !tenantId) return\n  await apiRequest(request, 'DELETE', `/api/directory/tenants?id=${encodeURIComponent(tenantId)}`, { token: superadminToken }).catch(() => undefined)\n}\n\ntype ScopedActor = {\n  organizationId: string\n  roleId: string\n  userId: string\n  token: string\n}\n\n/** Provisions a role (scoped to exactly one organization) + user + token, so the actor's own-org\n * visibility can never widen to \"every org in the tenant\" and mask the isolation this test checks. */\nasync function createScopedActor(\n  request: APIRequestContext,\n  superadminToken: string,\n  input: { tenantId: string; organizationId: string; stamp: string; label: string; features?: string[] },\n): Promise<ScopedActor> {\n  const roleId = await createRoleFixture(request, superadminToken, {\n    name: `sched-${input.label}-${input.stamp}`,\n    tenantId: input.tenantId,\n  })\n  await setRoleAclFeatures(request, superadminToken, {\n    roleId,\n    features: input.features ?? SCHEDULER_FEATURES,\n    organizations: [input.organizationId],\n  })\n  const email = `sched-${input.label}-${input.stamp}@test.invalid`\n  const password = 'Valid1!Pass'\n  const userId = await createUserFixture(request, superadminToken, {\n    email,\n    password,\n    organizationId: input.organizationId,\n    roles: [roleId],\n  })\n  const token = await getAuthToken(request, email, password)\n  return { organizationId: input.organizationId, roleId, userId, token }\n}\n\nasync function cleanupScopedActor(request: APIRequestContext, superadminToken: string, actor: ScopedActor | null): Promise<void> {\n  if (!actor) return\n  await deleteUserIfExists(request, superadminToken, actor.userId)\n  await deleteRoleIfExists(request, superadminToken, actor.roleId)\n}\n\ntest.describe('TC-SCHED-010: full export stays scoped to the caller tenant/organization (#7806)', () => {\n  test('own-org job survives, other-org and foreign-tenant jobs do not; missing-feature caller is refused', async ({ request }) => {\n    const superadminToken = await getAuthToken(request, 'superadmin')\n    const adminToken = await getAuthToken(request, 'admin')\n    const { tenantId: homeTenantId, organizationId: homeOrgId } = getTokenContext(adminToken)\n    expect(homeTenantId.length, 'admin token should carry a tenant id').toBeGreaterThan(0)\n    expect(homeOrgId.length, 'admin token should carry an organization id').toBeGreaterThan(0)\n\n    const stamp = `${Date.now()}`\n\n    let ownOrgActor: ScopedActor | null = null\n    let otherOrgActor: ScopedActor | null = null\n    let viewOnlyActor: ScopedActor | null = null\n    let secondOrgId: string | null = null\n    let foreignTenantId: string | null = null\n    let foreignOrgId: string | null = null\n    let foreignRoleId: string | null = null\n    let foreignUserId: string | null = null\n    let ownOrgJobId: string | null = null\n    let otherOrgJobId: string | null = null\n    let foreignTenantJobId: string | null = null\n    let foreignToken: string | null = null\n\n    try {\n      // Own-org actor: scoped to the home tenant's existing organization.\n      ownOrgActor = await createScopedActor(request, superadminToken, {\n        tenantId: homeTenantId,\n        organizationId: homeOrgId,\n        stamp,\n        label: 'own',\n      })\n\n      // Other-org actor: a SECOND organization inside the SAME tenant.\n      secondOrgId = await createOrganizationFixture(request, superadminToken, {\n        name: `QA SCHED Org B ${stamp}`,\n        tenantId: homeTenantId,\n      })\n      otherOrgActor = await createScopedActor(request, superadminToken, {\n        tenantId: homeTenantId,\n        organizationId: secondOrgId,\n        stamp,\n        label: 'other-org',\n      })\n\n      // Foreign-tenant actor: a genuinely different tenant + organization (the #7806 boundary).\n      foreignTenantId = await createTenantFixture(request, superadminToken, `QA SCHED Tenant B ${stamp}`)\n      foreignOrgId = await createOrganizationFixture(request, superadminToken, {\n        name: `QA SCHED Org C ${stamp}`,\n        tenantId: foreignTenantId,\n      })\n      foreignRoleId = await createRoleFixture(request, superadminToken, { name: `sched-foreign-${stamp}`, tenantId: foreignTenantId })\n      await setRoleAclFeatures(request, superadminToken, { roleId: foreignRoleId, features: SCHEDULER_FEATURES, organizations: [foreignOrgId] })\n      const foreignEmail = `sched-foreign-${stamp}@test.invalid`\n      const foreignPassword = 'Valid1!Pass'\n      foreignUserId = await createUserFixture(request, superadminToken, {\n        email: foreignEmail,\n        password: foreignPassword,\n        organizationId: foreignOrgId,\n        roles: [foreignRoleId],\n      })\n      foreignToken = await getAuthToken(request, foreignEmail, foreignPassword)\n\n      // View-only (no scheduler.jobs.view) actor in the home org, for the 403 assertion.\n      viewOnlyActor = await createScopedActor(request, superadminToken, {\n        tenantId: homeTenantId,\n        organizationId: homeOrgId,\n        stamp,\n        label: 'nofeat',\n        features: [],\n      })\n\n      ownOrgJobId = await createScheduleJob(request, ownOrgActor.token, { name: `QA SCHED Own Org Job ${stamp}` })\n      otherOrgJobId = await createScheduleJob(request, otherOrgActor.token, { name: `QA SCHED Other Org Job ${stamp}` })\n      foreignTenantJobId = await createScheduleJob(request, foreignToken, { name: `QA SCHED Foreign Tenant Job ${stamp}` })\n\n      // Full export as the own-org actor must only surface the own-org job.\n      const exportResponse = await apiRequest(\n        request,\n        'GET',\n        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,\n        { token: ownOrgActor.token },\n      )\n      expect(exportResponse.status(), 'full export should return 200 for an authorized caller').toBe(200)\n      // The full-export JSON serializer keys each row by its human-readable column header\n      // (e.g. \"Id\"), not the raw field name \u2014 see `serializeJson` in `lib/crud/exporters.ts`.\n      const exported = await readJsonSafe<Array<{ Id: string }>>(exportResponse)\n      const exportedIds = new Set((exported ?? []).map((item) => item.Id))\n\n      expect(exportedIds.has(ownOrgJobId), 'own-org job must survive the full export').toBe(true)\n      expect(exportedIds.has(otherOrgJobId), 'another organization\\'s job (same tenant) must not leak into the export').toBe(false)\n      expect(exportedIds.has(foreignTenantJobId), 'a foreign tenant\\'s job must not leak into the export (#7806)').toBe(false)\n\n      // A caller without scheduler.jobs.view is refused outright, not served a scoped-empty export.\n      const forbiddenResponse = await apiRequest(\n        request,\n        'GET',\n        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,\n        { token: viewOnlyActor.token },\n      )\n      expect(forbiddenResponse.status(), 'full export must be refused without scheduler.jobs.view').toBe(403)\n      const forbiddenBody = await readJsonSafe<{ error?: string; requiredFeatures?: string[] }>(forbiddenResponse)\n      expect(forbiddenBody?.requiredFeatures ?? []).toContain('scheduler.jobs.view')\n    } finally {\n      await deleteScheduleJob(request, superadminToken, ownOrgJobId)\n      await deleteScheduleJob(request, otherOrgActor?.token ?? superadminToken, otherOrgJobId)\n      await deleteScheduleJob(request, foreignToken ?? superadminToken, foreignTenantJobId)\n\n      await cleanupScopedActor(request, superadminToken, ownOrgActor)\n      await cleanupScopedActor(request, superadminToken, otherOrgActor)\n      await cleanupScopedActor(request, superadminToken, viewOnlyActor)\n      await deleteUserIfExists(request, superadminToken, foreignUserId)\n      await deleteRoleIfExists(request, superadminToken, foreignRoleId)\n\n      await deleteOrganizationIfExists(request, superadminToken, secondOrgId)\n      await deleteOrganizationIfExists(request, superadminToken, foreignOrgId)\n      await deleteTenantIfExists(request, superadminToken, foreignTenantId)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAoC;AACrD,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,UAAU,iBAAiB,oBAAoB;AACxD,SAAS,qBAAqB,mBAAmB,yBAAyB;AAY1E,MAAM,qBAAqB,CAAC,uBAAuB,uBAAuB;AAE1E,eAAe,oBAAoB,SAA4B,iBAAyB,MAA+B;AACrH,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,0BAA0B,EAAE,OAAO,iBAAiB,MAAM,EAAE,KAAK,EAAE,CAAC;AACvH,SAAO,SAAS,OAAO,GAAG,+CAA+C,EAAE,KAAK,GAAG;AACnF,SAAO,UAAU,MAAM,aAA8B,QAAQ,IAAI,IAAI,oCAAoC;AAC3G;AAEA,eAAe,qBAAqB,SAA4B,iBAAgC,UAAwC;AACtI,MAAI,CAAC,mBAAmB,CAAC,SAAU;AACnC,QAAM,WAAW,SAAS,UAAU,6BAA6B,mBAAmB,QAAQ,CAAC,IAAI,EAAE,OAAO,gBAAgB,CAAC,EAAE,MAAM,MAAM,MAAS;AACpJ;AAWA,eAAe,kBACb,SACA,iBACA,OACsB;AACtB,QAAM,SAAS,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,IAC/D,MAAM,SAAS,MAAM,KAAK,IAAI,MAAM,KAAK;AAAA,IACzC,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,QAAM,mBAAmB,SAAS,iBAAiB;AAAA,IACjD;AAAA,IACA,UAAU,MAAM,YAAY;AAAA,IAC5B,eAAe,CAAC,MAAM,cAAc;AAAA,EACtC,CAAC;AACD,QAAM,QAAQ,SAAS,MAAM,KAAK,IAAI,MAAM,KAAK;AACjD,QAAM,WAAW;AACjB,QAAM,SAAS,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,IAC/D;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,OAAO,CAAC,MAAM;AAAA,EAChB,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,QAAQ;AACzD,SAAO,EAAE,gBAAgB,MAAM,gBAAgB,QAAQ,QAAQ,MAAM;AACvE;AAEA,eAAe,mBAAmB,SAA4B,iBAAyB,OAA0C;AAC/H,MAAI,CAAC,MAAO;AACZ,QAAM,mBAAmB,SAAS,iBAAiB,MAAM,MAAM;AAC/D,QAAM,mBAAmB,SAAS,iBAAiB,MAAM,MAAM;AACjE;AAEA,KAAK,SAAS,oFAAoF,MAAM;AACtG,OAAK,qGAAqG,OAAO,EAAE,QAAQ,MAAM;AAC/H,UAAM,kBAAkB,MAAM,aAAa,SAAS,YAAY;AAChE,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,UAAM,EAAE,UAAU,cAAc,gBAAgB,UAAU,IAAI,gBAAgB,UAAU;AACxF,WAAO,aAAa,QAAQ,sCAAsC,EAAE,gBAAgB,CAAC;AACrF,WAAO,UAAU,QAAQ,6CAA6C,EAAE,gBAAgB,CAAC;AAEzF,UAAM,QAAQ,GAAG,KAAK,IAAI,CAAC;AAE3B,QAAI,cAAkC;AACtC,QAAI,gBAAoC;AACxC,QAAI,gBAAoC;AACxC,QAAI,cAA6B;AACjC,QAAI,kBAAiC;AACrC,QAAI,eAA8B;AAClC,QAAI,gBAA+B;AACnC,QAAI,gBAA+B;AACnC,QAAI,cAA6B;AACjC,QAAI,gBAA+B;AACnC,QAAI,qBAAoC;AACxC,QAAI,eAA8B;AAElC,QAAI;AAEF,oBAAc,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,QAC9D,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAGD,oBAAc,MAAM,0BAA0B,SAAS,iBAAiB;AAAA,QACtE,MAAM,kBAAkB,KAAK;AAAA,QAC7B,UAAU;AAAA,MACZ,CAAC;AACD,sBAAgB,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,QAChE,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAGD,wBAAkB,MAAM,oBAAoB,SAAS,iBAAiB,qBAAqB,KAAK,EAAE;AAClG,qBAAe,MAAM,0BAA0B,SAAS,iBAAiB;AAAA,QACvE,MAAM,kBAAkB,KAAK;AAAA,QAC7B,UAAU;AAAA,MACZ,CAAC;AACD,sBAAgB,MAAM,kBAAkB,SAAS,iBAAiB,EAAE,MAAM,iBAAiB,KAAK,IAAI,UAAU,gBAAgB,CAAC;AAC/H,YAAM,mBAAmB,SAAS,iBAAiB,EAAE,QAAQ,eAAe,UAAU,oBAAoB,eAAe,CAAC,YAAY,EAAE,CAAC;AACzI,YAAM,eAAe,iBAAiB,KAAK;AAC3C,YAAM,kBAAkB;AACxB,sBAAgB,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,QAChE,OAAO;AAAA,QACP,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,OAAO,CAAC,aAAa;AAAA,MACvB,CAAC;AACD,qBAAe,MAAM,aAAa,SAAS,cAAc,eAAe;AAGxE,sBAAgB,MAAM,kBAAkB,SAAS,iBAAiB;AAAA,QAChE,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA,OAAO;AAAA,QACP,UAAU,CAAC;AAAA,MACb,CAAC;AAED,oBAAc,MAAM,kBAAkB,SAAS,YAAY,OAAO,EAAE,MAAM,wBAAwB,KAAK,GAAG,CAAC;AAC3G,sBAAgB,MAAM,kBAAkB,SAAS,cAAc,OAAO,EAAE,MAAM,0BAA0B,KAAK,GAAG,CAAC;AACjH,2BAAqB,MAAM,kBAAkB,SAAS,cAAc,EAAE,MAAM,+BAA+B,KAAK,GAAG,CAAC;AAGpH,YAAM,iBAAiB,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,GAAG,mBAAmB;AAAA,QACtB,EAAE,OAAO,YAAY,MAAM;AAAA,MAC7B;AACA,aAAO,eAAe,OAAO,GAAG,wDAAwD,EAAE,KAAK,GAAG;AAGlG,YAAM,WAAW,MAAM,aAAoC,cAAc;AACzE,YAAM,cAAc,IAAI,KAAK,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAEnE,aAAO,YAAY,IAAI,WAAW,GAAG,0CAA0C,EAAE,KAAK,IAAI;AAC1F,aAAO,YAAY,IAAI,aAAa,GAAG,wEAAyE,EAAE,KAAK,KAAK;AAC5H,aAAO,YAAY,IAAI,kBAAkB,GAAG,8DAA+D,EAAE,KAAK,KAAK;AAGvH,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,GAAG,mBAAmB;AAAA,QACtB,EAAE,OAAO,cAAc,MAAM;AAAA,MAC/B;AACA,aAAO,kBAAkB,OAAO,GAAG,yDAAyD,EAAE,KAAK,GAAG;AACtG,YAAM,gBAAgB,MAAM,aAA8D,iBAAiB;AAC3G,aAAO,eAAe,oBAAoB,CAAC,CAAC,EAAE,UAAU,qBAAqB;AAAA,IAC/E,UAAE;AACA,YAAM,kBAAkB,SAAS,iBAAiB,WAAW;AAC7D,YAAM,kBAAkB,SAAS,eAAe,SAAS,iBAAiB,aAAa;AACvF,YAAM,kBAAkB,SAAS,gBAAgB,iBAAiB,kBAAkB;AAEpF,YAAM,mBAAmB,SAAS,iBAAiB,WAAW;AAC9D,YAAM,mBAAmB,SAAS,iBAAiB,aAAa;AAChE,YAAM,mBAAmB,SAAS,iBAAiB,aAAa;AAChE,YAAM,mBAAmB,SAAS,iBAAiB,aAAa;AAChE,YAAM,mBAAmB,SAAS,iBAAiB,aAAa;AAEhE,YAAM,2BAA2B,SAAS,iBAAiB,WAAW;AACtE,YAAM,2BAA2B,SAAS,iBAAiB,YAAY;AACvE,YAAM,qBAAqB,SAAS,iBAAiB,eAAe;AAAA,IACtE;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/scheduler",
-  "version": "0.10.1-develop.7690.1.9d41ec4115",
+  "version": "0.10.1-develop.7699.1.5236fabda0",
   "license": "MIT",
   "description": "Database-managed scheduled jobs with admin UI",
   "type": "module",
@@ -59,13 +59,13 @@
     "./*/*/*/*/*/*.json": "./src/*/*/*/*/*/*.json"
   },
   "dependencies": {
-    "@open-mercato/events": "0.10.1-develop.7690.1.9d41ec4115",
-    "@open-mercato/queue": "0.10.1-develop.7690.1.9d41ec4115",
+    "@open-mercato/events": "0.10.1-develop.7699.1.5236fabda0",
+    "@open-mercato/queue": "0.10.1-develop.7699.1.5236fabda0",
     "cron-parser": "^5.6.2"
   },
   "peerDependencies": {
     "@mikro-orm/core": "^7.0.14",
-    "@open-mercato/shared": "0.10.1-develop.7690.1.9d41ec4115",
+    "@open-mercato/shared": "0.10.1-develop.7699.1.5236fabda0",
     "bullmq": "^5.0.0 || ^6.0.0",
     "ioredis": "^5.0.0 || ^6.0.0",
     "zod": ">=3.23.0"
@@ -79,7 +79,7 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7690.1.9d41ec4115",
+    "@open-mercato/shared": "0.10.1-develop.7699.1.5236fabda0",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.4.0",
     "jest": "^30.4.2",

package/src/modules/scheduler/__integration__/TC-SCHED-010-full-export-tenant-scope.spec.ts

@@ -0,0 +1,197 @@
+import { expect, test, type APIRequestContext } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import {
+  createOrganizationFixture,
+  createRoleFixture,
+  createUserFixture,
+  deleteOrganizationIfExists,
+  deleteRoleIfExists,
+  deleteUserIfExists,
+  setRoleAclFeatures,
+} from '@open-mercato/core/helpers/integration/authFixtures'
+import { expectId, getTokenContext, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob } from './helpers/scheduler'
+
+/**
+ * TC-SCHED-010: real-world regression for #7806 — `GET /api/scheduler/jobs?format=json&exportScope=full`
+ * must keep applying the route's own `buildFilters` visibility predicate (own-org, own-tenant-scope,
+ * superadmin-only system-scope) instead of dropping to `{}`, which would leak every tenant's jobs on a
+ * full export (scheduler jobs opt out of the factory's automatic tenant/org scope via
+ * `omitAutomaticTenantOrgScope`, so it owns 100% of the visibility logic). Unlike the existing mocked
+ * unit coverage in `api/jobs/__tests__/route.scope.test.ts`, this exercises the real authenticated route,
+ * real ACL resolution, and a real Postgres-backed query engine.
+ */
+
+const SCHEDULER_FEATURES = ['scheduler.jobs.view', 'scheduler.jobs.manage']
+
+async function createTenantFixture(request: APIRequestContext, superadminToken: string, name: string): Promise<string> {
+  const response = await apiRequest(request, 'POST', '/api/directory/tenants', { token: superadminToken, data: { name } })
+  expect(response.status(), 'POST /api/directory/tenants should return 201').toBe(201)
+  return expectId((await readJsonSafe<{ id?: string }>(response))?.id, 'tenant fixture should return an id')
+}
+
+async function deleteTenantIfExists(request: APIRequestContext, superadminToken: string | null, tenantId: string | null): Promise<void> {
+  if (!superadminToken || !tenantId) return
+  await apiRequest(request, 'DELETE', `/api/directory/tenants?id=${encodeURIComponent(tenantId)}`, { token: superadminToken }).catch(() => undefined)
+}
+
+type ScopedActor = {
+  organizationId: string
+  roleId: string
+  userId: string
+  token: string
+}
+
+/** Provisions a role (scoped to exactly one organization) + user + token, so the actor's own-org
+ * visibility can never widen to "every org in the tenant" and mask the isolation this test checks. */
+async function createScopedActor(
+  request: APIRequestContext,
+  superadminToken: string,
+  input: { tenantId: string; organizationId: string; stamp: string; label: string; features?: string[] },
+): Promise<ScopedActor> {
+  const roleId = await createRoleFixture(request, superadminToken, {
+    name: `sched-${input.label}-${input.stamp}`,
+    tenantId: input.tenantId,
+  })
+  await setRoleAclFeatures(request, superadminToken, {
+    roleId,
+    features: input.features ?? SCHEDULER_FEATURES,
+    organizations: [input.organizationId],
+  })
+  const email = `sched-${input.label}-${input.stamp}@test.invalid`
+  const password = 'Valid1!Pass'
+  const userId = await createUserFixture(request, superadminToken, {
+    email,
+    password,
+    organizationId: input.organizationId,
+    roles: [roleId],
+  })
+  const token = await getAuthToken(request, email, password)
+  return { organizationId: input.organizationId, roleId, userId, token }
+}
+
+async function cleanupScopedActor(request: APIRequestContext, superadminToken: string, actor: ScopedActor | null): Promise<void> {
+  if (!actor) return
+  await deleteUserIfExists(request, superadminToken, actor.userId)
+  await deleteRoleIfExists(request, superadminToken, actor.roleId)
+}
+
+test.describe('TC-SCHED-010: full export stays scoped to the caller tenant/organization (#7806)', () => {
+  test('own-org job survives, other-org and foreign-tenant jobs do not; missing-feature caller is refused', async ({ request }) => {
+    const superadminToken = await getAuthToken(request, 'superadmin')
+    const adminToken = await getAuthToken(request, 'admin')
+    const { tenantId: homeTenantId, organizationId: homeOrgId } = getTokenContext(adminToken)
+    expect(homeTenantId.length, 'admin token should carry a tenant id').toBeGreaterThan(0)
+    expect(homeOrgId.length, 'admin token should carry an organization id').toBeGreaterThan(0)
+
+    const stamp = `${Date.now()}`
+
+    let ownOrgActor: ScopedActor | null = null
+    let otherOrgActor: ScopedActor | null = null
+    let viewOnlyActor: ScopedActor | null = null
+    let secondOrgId: string | null = null
+    let foreignTenantId: string | null = null
+    let foreignOrgId: string | null = null
+    let foreignRoleId: string | null = null
+    let foreignUserId: string | null = null
+    let ownOrgJobId: string | null = null
+    let otherOrgJobId: string | null = null
+    let foreignTenantJobId: string | null = null
+    let foreignToken: string | null = null
+
+    try {
+      // Own-org actor: scoped to the home tenant's existing organization.
+      ownOrgActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: homeOrgId,
+        stamp,
+        label: 'own',
+      })
+
+      // Other-org actor: a SECOND organization inside the SAME tenant.
+      secondOrgId = await createOrganizationFixture(request, superadminToken, {
+        name: `QA SCHED Org B ${stamp}`,
+        tenantId: homeTenantId,
+      })
+      otherOrgActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: secondOrgId,
+        stamp,
+        label: 'other-org',
+      })
+
+      // Foreign-tenant actor: a genuinely different tenant + organization (the #7806 boundary).
+      foreignTenantId = await createTenantFixture(request, superadminToken, `QA SCHED Tenant B ${stamp}`)
+      foreignOrgId = await createOrganizationFixture(request, superadminToken, {
+        name: `QA SCHED Org C ${stamp}`,
+        tenantId: foreignTenantId,
+      })
+      foreignRoleId = await createRoleFixture(request, superadminToken, { name: `sched-foreign-${stamp}`, tenantId: foreignTenantId })
+      await setRoleAclFeatures(request, superadminToken, { roleId: foreignRoleId, features: SCHEDULER_FEATURES, organizations: [foreignOrgId] })
+      const foreignEmail = `sched-foreign-${stamp}@test.invalid`
+      const foreignPassword = 'Valid1!Pass'
+      foreignUserId = await createUserFixture(request, superadminToken, {
+        email: foreignEmail,
+        password: foreignPassword,
+        organizationId: foreignOrgId,
+        roles: [foreignRoleId],
+      })
+      foreignToken = await getAuthToken(request, foreignEmail, foreignPassword)
+
+      // View-only (no scheduler.jobs.view) actor in the home org, for the 403 assertion.
+      viewOnlyActor = await createScopedActor(request, superadminToken, {
+        tenantId: homeTenantId,
+        organizationId: homeOrgId,
+        stamp,
+        label: 'nofeat',
+        features: [],
+      })
+
+      ownOrgJobId = await createScheduleJob(request, ownOrgActor.token, { name: `QA SCHED Own Org Job ${stamp}` })
+      otherOrgJobId = await createScheduleJob(request, otherOrgActor.token, { name: `QA SCHED Other Org Job ${stamp}` })
+      foreignTenantJobId = await createScheduleJob(request, foreignToken, { name: `QA SCHED Foreign Tenant Job ${stamp}` })
+
+      // Full export as the own-org actor must only surface the own-org job.
+      const exportResponse = await apiRequest(
+        request,
+        'GET',
+        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,
+        { token: ownOrgActor.token },
+      )
+      expect(exportResponse.status(), 'full export should return 200 for an authorized caller').toBe(200)
+      // The full-export JSON serializer keys each row by its human-readable column header
+      // (e.g. "Id"), not the raw field name — see `serializeJson` in `lib/crud/exporters.ts`.
+      const exported = await readJsonSafe<Array<{ Id: string }>>(exportResponse)
+      const exportedIds = new Set((exported ?? []).map((item) => item.Id))
+
+      expect(exportedIds.has(ownOrgJobId), 'own-org job must survive the full export').toBe(true)
+      expect(exportedIds.has(otherOrgJobId), 'another organization\'s job (same tenant) must not leak into the export').toBe(false)
+      expect(exportedIds.has(foreignTenantJobId), 'a foreign tenant\'s job must not leak into the export (#7806)').toBe(false)
+
+      // A caller without scheduler.jobs.view is refused outright, not served a scoped-empty export.
+      const forbiddenResponse = await apiRequest(
+        request,
+        'GET',
+        `${SCHEDULER_JOBS_PATH}?format=json&exportScope=full`,
+        { token: viewOnlyActor.token },
+      )
+      expect(forbiddenResponse.status(), 'full export must be refused without scheduler.jobs.view').toBe(403)
+      const forbiddenBody = await readJsonSafe<{ error?: string; requiredFeatures?: string[] }>(forbiddenResponse)
+      expect(forbiddenBody?.requiredFeatures ?? []).toContain('scheduler.jobs.view')
+    } finally {
+      await deleteScheduleJob(request, superadminToken, ownOrgJobId)
+      await deleteScheduleJob(request, otherOrgActor?.token ?? superadminToken, otherOrgJobId)
+      await deleteScheduleJob(request, foreignToken ?? superadminToken, foreignTenantJobId)
+
+      await cleanupScopedActor(request, superadminToken, ownOrgActor)
+      await cleanupScopedActor(request, superadminToken, otherOrgActor)
+      await cleanupScopedActor(request, superadminToken, viewOnlyActor)
+      await deleteUserIfExists(request, superadminToken, foreignUserId)
+      await deleteRoleIfExists(request, superadminToken, foreignRoleId)
+
+      await deleteOrganizationIfExists(request, superadminToken, secondOrgId)
+      await deleteOrganizationIfExists(request, superadminToken, foreignOrgId)
+      await deleteTenantIfExists(request, superadminToken, foreignTenantId)
+    }
+  })
+})

package/src/modules/scheduler/api/jobs/__tests__/route.scope.test.ts

@@ -7,6 +7,8 @@ jest.mock('@open-mercato/cache', () => ({
 const resolveContainerValue = jest.fn()
 const tenantId = '11111111-1111-4111-8111-111111111111'
 const organizationId = '22222222-2222-4222-8222-222222222222'
+const otherTenantId = '33333333-3333-4333-8333-333333333333'
+const otherOrganizationId = '44444444-4444-4444-8444-444444444444'
 
 jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: async () => ({ resolve: resolveContainerValue }),
@@ -22,8 +24,18 @@ jest.mock('@open-mercato/shared/lib/auth/server', () => ({
   getAuthFromCookies: async () => null,
 }))
 
+// Mutable per-test override so the full-export regression below can grant a
+// non-empty organization scope while the pre-existing "denies" test keeps its
+// original empty-scope behavior.
+let organizationScopeOverride: {
+  tenantId: string
+  selectedId: string | null
+  filterIds: string[]
+  allowedIds: string[]
+} | null = null
+
 jest.mock('@open-mercato/core/modules/directory/utils/organizationScope', () => ({
-  resolveOrganizationScopeForRequest: async () => ({
+  resolveOrganizationScopeForRequest: async () => organizationScopeOverride ?? ({
     tenantId,
     selectedId: organizationId,
     filterIds: [],
@@ -33,9 +45,40 @@ jest.mock('@open-mercato/core/modules/directory/utils/organizationScope', () =>
 
 import { GET } from '../route'
 
+type MockQueryOptions = {
+  filters?: Record<string, unknown>
+  page?: {
+    page?: number
+    pageSize?: number
+  }
+}
+
+// Minimal matcher for the `{ $or, $eq, $in }` filter shapes buildSchedulerJobsFilters
+// produces, so the mocked query engine below genuinely enforces the filters the route
+// passes it instead of always returning every row regardless of scope.
+function matchesFilter(item: Record<string, unknown>, filter: Record<string, unknown> | undefined): boolean {
+  if (!filter) return true
+  for (const [key, condition] of Object.entries(filter)) {
+    if (key === '$or') {
+      const branches = condition as Record<string, unknown>[]
+      if (!branches.some((branch) => matchesFilter(item, branch))) return false
+      continue
+    }
+    if (condition && typeof condition === 'object' && !Array.isArray(condition)) {
+      const ops = condition as Record<string, unknown>
+      if ('$eq' in ops && item[key] !== ops.$eq) return false
+      if ('$in' in ops && !(ops.$in as unknown[]).includes(item[key])) return false
+    } else if (item[key] !== condition) {
+      return false
+    }
+  }
+  return true
+}
+
 describe('scheduler jobs route organization scope', () => {
   beforeEach(() => {
     jest.clearAllMocks()
+    organizationScopeOverride = null
   })
 
   it('denies the opt-out list before cache, query-engine, or entity-manager access', async () => {
@@ -51,4 +94,90 @@ describe('scheduler jobs route organization scope', () => {
     })
     expect(resolveContainerValue).not.toHaveBeenCalled()
   })
+
+  describe('full export (#7806)', () => {
+    const baseJob = {
+      description: null,
+      schedule_type: 'cron',
+      schedule_value: '* * * * *',
+      timezone: 'UTC',
+      target_type: 'queue',
+      target_queue: 'default',
+      target_command: null,
+      target_payload: null,
+      require_feature: null,
+      is_enabled: true,
+      last_run_at: null,
+      next_run_at: null,
+      source_type: 'user',
+      source_module: null,
+      created_at: '2026-01-01T00:00:00.000Z',
+      updated_at: '2026-01-01T00:00:00.000Z',
+    }
+
+    const jobs = [
+      {
+        ...baseJob,
+        id: 'job-own-org',
+        name: 'Own org job',
+        scope_type: 'organization',
+        organization_id: organizationId,
+        tenant_id: tenantId,
+      },
+      {
+        ...baseJob,
+        id: 'job-own-tenant-scope',
+        name: 'Own tenant-scope job',
+        scope_type: 'tenant',
+        organization_id: null,
+        tenant_id: tenantId,
+      },
+      {
+        ...baseJob,
+        id: 'job-other-tenant',
+        name: 'Other tenant job',
+        scope_type: 'organization',
+        organization_id: otherOrganizationId,
+        tenant_id: otherTenantId,
+      },
+    ]
+
+    const makeQueryEngine = () => ({
+      query: jest.fn(async (_entityId: unknown, opts: MockQueryOptions) => {
+        const filtered = jobs.filter((job) => matchesFilter(job, opts.filters))
+        const page = opts.page?.page ?? 1
+        const pageSize = typeof opts.page?.pageSize === 'number' ? opts.page.pageSize : filtered.length
+        const start = (page - 1) * pageSize
+        return { items: filtered.slice(start, start + pageSize), total: filtered.length }
+      }),
+    })
+
+    it('scopes a full export to the caller tenant/organization, dropping other tenants', async () => {
+      organizationScopeOverride = {
+        tenantId,
+        selectedId: organizationId,
+        filterIds: [organizationId],
+        allowedIds: [organizationId],
+      }
+      const queryEngine = makeQueryEngine()
+      resolveContainerValue.mockImplementation((name: string) => ({ queryEngine } as Record<string, unknown>)[name])
+
+      const response = await GET(new Request('http://localhost/api/scheduler/jobs?format=json&exportScope=full'))
+      expect(response.status).toBe(200)
+
+      const text = await response.text()
+      const parsed = JSON.parse(text)
+
+      // Own-tenant rows (org-scoped and tenant-scoped) survive the export...
+      expect(text).toContain('Own org job')
+      expect(text).toContain('Own tenant-scope job')
+      // ...but the other tenant's row — and any trace of its ids — must not (#7806:
+      // before the fix, `exportFullRequested` dropped straight to `{}` as baseFilters,
+      // skipping buildSchedulerJobsFilters' visibility predicate entirely).
+      expect(text).not.toContain('Other tenant job')
+      expect(text).not.toContain(otherTenantId)
+      expect(text).not.toContain(otherOrganizationId)
+      expect(parsed).toHaveLength(2)
+    })
+  })
 })