@open-mercato/scheduler 0.6.8-develop.7066.1.6bfa9ff69f → 0.6.8-develop.7067.1.82e9867ea1

package/src/modules/scheduler/__integration__/helpers/scheduler.ts

@@ -6,9 +6,25 @@ export const SCHEDULER_JOBS_PATH = '/api/scheduler/jobs'
 export const SCHEDULER_TARGETS_PATH = '/api/scheduler/targets'
 export const SCHEDULER_TRIGGER_PATH = '/api/scheduler/trigger'
 
-/** Queue registered by the scheduler module's execute-schedule worker. */
+/** Queue registered by the scheduler module's execute-schedule worker (internal, not schedulable). */
 export const SCHEDULER_EXECUTION_QUEUE = 'scheduler-execution'
 
+/** Deliberately side-effect-free queue whose worker opted into scheduling (#5213). */
+export const SCHEDULER_TEST_QUEUE = 'scheduler-test'
+
+/**
+ * Internal queues that must never be offered as scheduler targets (#5213).
+ * Workers must opt in via `schedulerSafe: true` to become schedulable.
+ */
+export const SCHEDULER_FORBIDDEN_INTERNAL_QUEUES = [
+  SCHEDULER_EXECUTION_QUEUE,
+  'stripe-webhook',
+  'payment-gateways-webhook',
+] as const
+
+/** Always-registered command used by fixtures now that queue targets are restricted. */
+export const SCHEDULER_TEST_COMMAND = 'scheduler.test.echo'
+
 export type SchedulerJob = {
   id: string
   name: string
@@ -51,16 +67,19 @@ export function uniqueScheduleName(prefix: string): string {
 }
 
 /**
- * Create an organization-scoped queue-target schedule via the API and return its id.
+ * Create an organization-scoped schedule via the API and return its id.
  * Org/tenant are derived server-side from the caller's auth context, so the caller
  * only needs an admin (or otherwise scheduler.jobs.manage) token.
+ *
+ * Defaults to a command target: user-authored queue targets are restricted to
+ * scheduler-safe queues (#5213), so fixtures must not assume a queue is allowed.
  */
 export async function createScheduleJob(
   request: APIRequestContext,
   token: string,
   overrides: CreateScheduleOverrides = {},
 ): Promise<string> {
-  const targetType = overrides.targetType ?? 'queue'
+  const targetType = overrides.targetType ?? 'command'
   const data: Record<string, unknown> = {
     name: overrides.name ?? uniqueScheduleName('Integration Scheduler'),
     description: overrides.description ?? 'Created by scheduler integration tests',
@@ -74,9 +93,9 @@ export async function createScheduleJob(
     sourceType: overrides.sourceType ?? 'user',
   }
   if (targetType === 'command') {
-    data.targetCommand = overrides.targetCommand
+    data.targetCommand = overrides.targetCommand ?? SCHEDULER_TEST_COMMAND
   } else {
-    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE
+    data.targetQueue = overrides.targetQueue ?? SCHEDULER_TEST_QUEUE
   }
 
   const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, { token, data })

package/src/modules/scheduler/api/targets/__tests__/route.test.ts

@@ -50,8 +50,8 @@ describe('GET /api/scheduler/targets', () => {
       orgId: 'org-1',
     })
     ;(getModules as jest.Mock).mockReturnValue([
-      { workers: [{ queue: 'z-queue' }] },
-      { workers: [{ queue: 'a-queue' }] },
+      { workers: [{ queue: 'z-queue' }, { queue: 'internal-queue' }] },
+      { workers: [{ queue: 'a-queue', schedulerSafe: true }] },
     ])
   })
 
@@ -60,14 +60,13 @@ describe('GET /api/scheduler/targets', () => {
     unregisterCommand(unsafeCommand.id)
   })
 
-  it('lists only scheduler-safe commands', async () => {
+  it('lists only scheduler-safe queues and commands', async () => {
     const response = await GET(new NextRequest('http://localhost/api/scheduler/targets'))
     const body = await response.json()
 
     expect(response.status).toBe(200)
     expect(body.queues).toEqual([
       { value: 'a-queue', label: 'a-queue' },
-      { value: 'z-queue', label: 'z-queue' },
     ])
     expect(body.commands).toEqual([
       { value: safeCommand.id, label: safeCommand.id },

package/src/modules/scheduler/api/targets/route.ts

@@ -1,10 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
-import { getModules } from '@open-mercato/shared/lib/modules/registry'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { listSchedulerSafeCommands } from '../../lib/scheduler-safe-commands'
+import { listSchedulerSafeQueueTargets } from '../../lib/safeQueueTargets'
 
 export const metadata = {
   requireAuth: true,
@@ -13,7 +13,9 @@ export const metadata = {
 
 /**
  * GET /api/scheduler/targets
- * Returns available queue names and command IDs for schedule target selection.
+ * Returns scheduler-safe queue names and command IDs for schedule target selection.
+ * Only queues whose workers opted into scheduling (`schedulerSafe: true`) are
+ * advertised; internal and system-only workers stay undiscoverable (#5213).
  */
 export async function GET(req: NextRequest) {
   const auth = await getAuthFromRequest(req)
@@ -21,20 +23,8 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  const modules = getModules()
-
-  const queueSet = new Set<string>()
-  for (const mod of modules) {
-    if (mod.workers) {
-      for (const worker of mod.workers) {
-        queueSet.add(worker.queue)
-      }
-    }
-  }
-
-  const queues = Array.from(queueSet)
-    .sort((a, b) => a.localeCompare(b))
-    .map((queue) => ({ value: queue, label: queue }))
+  const queues = listSchedulerSafeQueueTargets()
+    .map((target) => ({ value: target.queue, label: target.queue }))
 
   const commands = listSchedulerSafeCommands()
     .filter((command) => commandRegistry.has(command.commandId))
@@ -66,7 +56,6 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       operationId: 'listScheduleTargets',
       summary: 'List available queues and commands',
-      description: 'Returns all registered queue names (from module workers) and explicitly scheduler-safe command IDs that can be used as schedule targets.',
       responses: [
         {
           status: 200,

package/src/modules/scheduler/cli.ts

@@ -3,6 +3,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/core'
 import { ScheduledJob } from './data/entities.js'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { auditSchedulerModuleQueueRows } from './lib/safeQueueTargets'
 
 const writeLine = (text = '') => {
   process.stdout.write(`${text}\n`)
@@ -225,4 +226,46 @@ const startCommand: ModuleCli = {
   },
 }
 
-export default [listCommand, statusCommand, runCommand, startCommand]
+// Lists every persisted module-authored queue-target row with its current
+// dispatch verdict (#5213). Rows authored before the hardening by a
+// non-user-bound API key are indistinguishable from genuine registrations at
+// rest, so operators review the ALLOWED entries against their known integrations.
+const auditQueueTargetsCommand: ModuleCli = {
+  command: 'audit-queue-targets',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as EntityManager
+
+    const where: Record<string, unknown> = { deletedAt: null, sourceType: 'module' }
+    if (args.tenant || args.tenantId) where.tenantId = args.tenant || args.tenantId
+
+    const rows = await em.find(ScheduledJob, where, {
+      orderBy: { name: 'ASC' },
+    })
+
+    const audits = auditSchedulerModuleQueueRows(rows)
+
+    writeLine(`Module-authored queue-target schedules: ${audits.length}`)
+    let allowedCount = 0
+    for (const audit of audits) {
+      const verdict = audit.dispatchAllowed ? 'ALLOWED' : 'blocked'
+      if (audit.dispatchAllowed) allowedCount += 1
+      writeLine(
+        `[${verdict}] ${audit.scheduleId}${audit.name ? ` — ${audit.name}` : ''}` +
+        ` module=${audit.sourceModule ?? '(none)'} queue=${audit.targetQueue ?? '(none)'}` +
+        ` enabled=${audit.isEnabled ? 'yes' : 'no'}`,
+      )
+    }
+
+    if (allowedCount > 0) {
+      writeLine('')
+      writeLine(`Review the ${allowedCount} ALLOWED row(s) above against your known module integrations.`)
+      writeLine('Pre-upgrade rows created with a non-user-bound API key cannot be distinguished')
+      writeLine('from genuine registrations at rest; disable anything unrecognized:')
+      writeLine('  yarn mercato scheduler list --tenant <tenantId>')
+    }
+  },
+}
+
+export default [listCommand, statusCommand, runCommand, startCommand, auditQueueTargetsCommand]

package/src/modules/scheduler/commands/__tests__/jobs.target-guard.test.ts

@@ -0,0 +1,177 @@
+export {}
+
+const registerCommand = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/commands', () => ({
+  registerCommand,
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: jest.fn().mockResolvedValue({
+    translate: (_key: string, fallback?: string) => fallback ?? _key,
+  }),
+}))
+
+function loadCommands() {
+  let update: any
+  jest.isolateModules(() => {
+    require('../jobs')
+    update = registerCommand.mock.calls.find(([cmd]) => cmd.id === 'scheduler.jobs.update')?.[0]
+  })
+  return update
+}
+
+const safeQueueRow = {
+  id: 'job-1',
+  name: 'QA queue schedule',
+  scopeType: 'organization',
+  tenantId: 'tenant-a',
+  organizationId: 'org-a',
+  isEnabled: true,
+  scheduleType: 'interval',
+  scheduleValue: '15m',
+  timezone: 'UTC',
+  targetType: 'queue',
+  targetQueue: 'scheduler-test',
+  targetCommand: null,
+  // nested payload the UI round-trips verbatim
+  targetPayload: { source: 'integration-test', retries: { max: 5 } },
+  sourceType: 'user',
+  sourceModule: null,
+}
+
+const moduleOwnedRow = {
+  ...safeQueueRow,
+  id: 'job-module',
+  name: 'Module-owned schedule',
+  sourceType: 'module',
+  sourceModule: 'legacy_module',
+  createdByUserId: null,
+}
+
+function makeEm(schedule: Record<string, unknown>) {
+  return {
+    fork: jest.fn().mockReturnThis(),
+    findOne: jest.fn().mockResolvedValue(schedule),
+    persist: jest.fn(),
+    flush: jest.fn().mockResolvedValue(undefined),
+    count: jest.fn().mockResolvedValue(0),
+  }
+}
+
+describe('scheduler.jobs.update target-change detection (#5213 N1)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetModules()
+  })
+
+  it('allows an operational-only save of a module-authored schedule whose form resends the unchanged target', async () => {
+    const update = loadCommands()
+    const em = makeEm(moduleOwnedRow)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    const result = await update.execute(
+      {
+        id: moduleOwnedRow.id,
+        // the shipped edit form always resends every field…
+        targetType: moduleOwnedRow.targetType,
+        targetQueue: moduleOwnedRow.targetQueue,
+        targetPayload: moduleOwnedRow.targetPayload,
+        // …while the operator only changed operational values
+        name: 'Renamed by ops',
+        scheduleValue: '30m',
+        scheduleType: 'interval',
+        isEnabled: false,
+      },
+      ctx,
+    )
+
+    expect(result).toEqual({ ok: true })
+    expect(em.flush).toHaveBeenCalled()
+  })
+
+  it('still blocks an actual target or payload change on a module-authored schedule', async () => {
+    const update = loadCommands()
+    const em = makeEm(moduleOwnedRow)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    await expect(
+      update.execute({ id: moduleOwnedRow.id, targetQueue: 'stripe-webhook' }, ctx),
+    ).rejects.toMatchObject({ status: 403 })
+    await expect(
+      update.execute({ id: moduleOwnedRow.id, targetPayload: { forged: true } }, ctx),
+    ).rejects.toMatchObject({ status: 403 })
+    expect(em.flush).not.toHaveBeenCalled()
+  })
+
+  it('lets admins disable a legacy user-authored row whose stored queue is no longer approved (#5213 N1)', async () => {
+    const update = loadCommands()
+    const legacyUnsafe = {
+      ...safeQueueRow,
+      id: 'job-legacy',
+      targetQueue: 'stripe-webhook',
+      targetPayload: null as unknown,
+    }
+    const em = makeEm(legacyUnsafe)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    // the shipped edit form resends every field — target fields included —
+    // while only flipping the switch
+    const result = await update.execute(
+      {
+        id: legacyUnsafe.id,
+        targetType: legacyUnsafe.targetType,
+        targetQueue: legacyUnsafe.targetQueue,
+        isEnabled: false,
+      },
+      ctx,
+    )
+    expect(result).toEqual({ ok: true })
+
+    // retargeting onto another unapproved queue is still rejected
+    await expect(
+      update.execute({ id: legacyUnsafe.id, targetQueue: 'payment-gateways-webhook' }, ctx),
+    ).rejects.toMatchObject({ status: 422 })
+  })
+
+  it('treats an empty-object stored payload as equal to the null the form submits (#5213 N1-residual)', async () => {
+    const update = loadCommands()
+    const emptyPayloadRow = {
+      ...moduleOwnedRow,
+      id: 'job-module-empty-payload',
+      targetPayload: {},
+    }
+    const em = makeEm(emptyPayloadRow)
+    const ctx = {
+      auth: { isSuperAdmin: true, tenantId: null, orgId: null, sub: 'super-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    // ai_assistant-style registration stores `targetPayload: {}`; the edit form
+    // normalizes that to `targetPayload: null` on submit. An operational save
+    // must not trip the module-owned-target guard over the shape difference.
+    const result = await update.execute(
+      {
+        id: emptyPayloadRow.id,
+        targetType: emptyPayloadRow.targetType,
+        targetQueue: emptyPayloadRow.targetQueue,
+        targetPayload: null,
+        name: 'Renamed by ops',
+        isEnabled: true,
+      },
+      ctx,
+    )
+
+    expect(result).toEqual({ ok: true })
+    expect(em.flush).toHaveBeenCalled()
+  })
+})

package/src/modules/scheduler/commands/jobs.ts

@@ -14,7 +14,12 @@ import type {
 } from '../data/validators.js'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { BullMQSchedulerService } from '../services/bullmqSchedulerService.js'
-
+import {
+  assertSchedulerQueueTargetAuthorized,
+  isSchedulerSafeQueue,
+  validateSchedulerTargetPayload,
+} from '../lib/safeQueueTargets.js'
+import type { SchedulerTargetRbacService } from '../lib/safeQueueTargets.js'
 /**
  * Snapshot of a schedule for undo/redo
  */
@@ -83,6 +88,64 @@ function toDate(value: Date | string | null | undefined): Date | null {
   return value instanceof Date ? value : new Date(value)
 }
 
+function canonicalJson(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value ?? null)
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, v]) => v !== undefined)
+    .sort(([a], [b]) => a.localeCompare(b))
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`
+}
+
+function normalizeTargetPayloadValue(value: unknown): unknown {
+  // `schedulerService.register()` persists `{}` as-is while the edit form sends
+  // `null` for an empty payload — treat the three empty shapes as equal (#5213).
+  if (value !== null && typeof value === 'object' && !Array.isArray(value)
+      && Object.keys(value as Record<string, unknown>).length === 0) return null
+  return value
+}
+
+function targetPayloadChanged(inputValue: unknown, storedValue: unknown): boolean {
+  return targetValueChanged(
+    normalizeTargetPayloadValue(inputValue),
+    normalizeTargetPayloadValue(storedValue),
+  )
+}
+
+function targetValueChanged(inputValue: unknown, storedValue: unknown): boolean {
+  if (inputValue === undefined) return false
+  return canonicalJson(inputValue ?? null) !== canonicalJson(storedValue ?? null)
+}
+
+type QueueTargetAuthorizationContext = CommandRuntimeContext
+
+async function assertQueueTargetAuthorizedForActor(
+  ctx: QueueTargetAuthorizationContext,
+  queue: string,
+): Promise<void> {
+  const rbacService = (() => {
+    try {
+      return ctx.container?.resolve<SchedulerTargetRbacService>('rbacService') ?? null
+    } catch {
+      return null
+    }
+  })()
+  const reason = await assertSchedulerQueueTargetAuthorized({
+    queue,
+    actorUserId: resolveCommandActorUserId(ctx),
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.auth?.orgId ?? null,
+    isSuperAdmin: ctx.auth?.isSuperAdmin === true,
+    rbacService,
+  })
+  if (reason) throw new CrudHttpError(403, { error: reason })
+}
+
+async function assertQueueTargetPayloadAllowed(queue: string, targetPayload: Record<string, unknown> | null | undefined): Promise<void> {
+  const reason = validateSchedulerTargetPayload(queue, targetPayload)
+  if (reason) throw new CrudHttpError(422, { error: `Invalid target payload for queue ${queue}: ${reason}` })
+}
+
 function resolveCommandActorUserId(ctx: CommandRuntimeContext): string | null {
   const auth = ctx.auth
   if (!auth) return null
@@ -212,6 +275,11 @@ const createScheduleCommand: CommandHandler<ScheduleCreateInput, { id: string }>
       throw new Error('Failed to calculate next run time')
     }
 
+    if (input.targetType === 'queue' && input.targetQueue) {
+      await assertQueueTargetAuthorizedForActor(ctx, input.targetQueue)
+      await assertQueueTargetPayloadAllowed(input.targetQueue, input.targetPayload)
+    }
+
     // Create schedule
     const schedule = em.create(ScheduledJob, {
       name: input.name,
@@ -228,8 +296,8 @@ const createScheduleCommand: CommandHandler<ScheduleCreateInput, { id: string }>
       targetPayload: input.targetPayload ?? null,
       requireFeature: input.requireFeature ?? null,
       isEnabled: input.isEnabled ?? true,
-      sourceType: input.sourceType ?? 'user',
-      sourceModule: input.sourceModule ?? null,
+      sourceType: 'user',
+      sourceModule: null,
       nextRunAt,
       createdByUserId: resolveCommandActorUserId(ctx),
       createdAt: new Date(),
@@ -310,10 +378,76 @@ const updateScheduleCommand: CommandHandler<ScheduleUpdateInput, { ok: boolean }
     if (schedule.organizationId) ensureOrganizationScope(ctx, schedule.organizationId)
     ensureCanManageSystemScopedJob(ctx, schedule)
 
+    // Module-authored schedules are trusted infrastructure wiring (#5213): their
+    // target and payload are owned by the registering module. Submitting them
+    // unchanged is a no-op (the edit form always resends every field) — only an
+    // actual change to provenance-relevant values is rejected.
+    const touchesModuleOwnedTarget =
+      schedule.sourceType === 'module'
+      && (
+        targetValueChanged(input.targetType, schedule.targetType)
+        || targetValueChanged(input.targetQueue, schedule.targetQueue)
+        || targetValueChanged(input.targetCommand, schedule.targetCommand)
+        || targetPayloadChanged(input.targetPayload, schedule.targetPayload)
+      )
+    if (touchesModuleOwnedTarget) {
+      const { translate } = await resolveTranslations()
+      throw new CrudHttpError(403, {
+        error: translate(
+          'scheduler.errors.module_target_immutable',
+          'Module-authored schedules own their target; only operational fields can be updated here.',
+        ),
+      })
+    }
+
     if (input.isEnabled === true && schedule.isEnabled !== true) {
       await enforceTenantActiveScheduleLimit(em, schedule.tenantId)
     }
 
+    const effectiveTargetType = input.targetType ?? schedule.targetType
+    const effectiveQueue = input.targetQueue ?? schedule.targetQueue
+    const queueChanged =
+      effectiveTargetType === 'queue'
+      && (
+        targetValueChanged(input.targetQueue, schedule.targetQueue)
+        || targetValueChanged(input.targetType, schedule.targetType)
+        || targetPayloadChanged(input.targetPayload, schedule.targetPayload)
+      )
+    if (effectiveTargetType === 'queue' && effectiveQueue) {
+      const retargetedToUnapprovedQueue =
+        input.targetQueue !== undefined
+        && input.targetQueue !== schedule.targetQueue
+        && !isSchedulerSafeQueue(input.targetQueue)
+      // A save that leaves a user-authored row ACTIVE on an unapproved queue
+      // restores the invariant the update schema used to enforce; disabling the
+      // row stays allowed so admins can remediate legacy targets from the UI.
+      // (Dispatch-time re-verification remains the backstop either way.)
+      const keepsUnapprovedQueueActive =
+        effectiveQueue != null
+        && !isSchedulerSafeQueue(effectiveQueue)
+        && input.isEnabled !== false
+        && schedule.isEnabled !== false
+      if (
+        (retargetedToUnapprovedQueue || keepsUnapprovedQueueActive)
+        && schedule.sourceType !== 'module'
+      ) {
+        const { translate } = await resolveTranslations()
+        throw new CrudHttpError(422, {
+          error: translate(
+            'scheduler.errors.queue_not_approved',
+            'Target queue is not an approved scheduler target. Only workers that opted into scheduling can be selected.',
+          ),
+        })
+      }
+      if (queueChanged) {
+        await assertQueueTargetAuthorizedForActor(ctx, effectiveQueue)
+        const effectivePayload = input.targetPayload !== undefined
+          ? input.targetPayload
+          : schedule.targetPayload
+        await assertQueueTargetPayloadAllowed(effectiveQueue, effectivePayload)
+      }
+    }
+
     const scheduleChanged = input.scheduleType !== undefined || input.scheduleValue !== undefined || input.timezone !== undefined
     const nextRunAt = scheduleChanged
       ? calculateNextRunForWrite(

package/src/modules/scheduler/data/__tests__/safe-targets.test.ts

@@ -0,0 +1,110 @@
+import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
+import {
+  scheduleCreateSchema,
+  scheduleUpdateSchema,
+} from '../validators'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
+
+const tenantId = '123e4567-e89b-12d3-a456-426614174000'
+const organizationId = '123e4567-e89b-12d3-a456-426614174001'
+const scheduleId = '123e4567-e89b-12d3-a456-426614174002'
+
+const REGISTRY_KEY = '__openMercatoModulesRegistry__'
+
+beforeAll(() => {
+  registerModules([
+    {
+      id: 'test_module',
+      workers: [
+        {
+          id: 'test_module:workers:safe',
+          queue: 'test-module-safe-queue',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+        {
+          id: 'test_module:workers:internal',
+          queue: 'stripe-webhook',
+          concurrency: 1,
+          handler: async () => {},
+        },
+      ],
+    },
+  ] as never)
+})
+
+afterAll(() => {
+  ;(globalThis as Record<string, unknown>)[REGISTRY_KEY] = null
+})
+
+describe('scheduler queue target authorization (#5213)', () => {
+  describe('scheduleCreateSchema', () => {
+    it('accepts a queue target declared scheduler-safe by its worker', () => {
+      const result = scheduleCreateSchema.parse({
+        name: 'Safe queue schedule',
+        scopeType: 'organization',
+        organizationId,
+        tenantId,
+        scheduleType: 'interval',
+        scheduleValue: '15m',
+        targetType: 'queue',
+        targetQueue: 'test-module-safe-queue',
+      })
+
+      expect(result.targetQueue).toBe('test-module-safe-queue')
+    })
+
+    it('rejects a queue target the worker did not declare scheduler-safe', () => {
+      expect(() =>
+        scheduleCreateSchema.parse({
+          name: 'Internal sink schedule',
+          scopeType: 'organization',
+          organizationId,
+          tenantId,
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          targetType: 'queue',
+          targetQueue: 'stripe-webhook',
+        })
+      ).toThrow(/not an approved scheduler target/)
+    })
+
+    it('rejects an unknown queue target', () => {
+      expect(() =>
+        scheduleCreateSchema.parse({
+          name: 'Unknown queue schedule',
+          scopeType: 'organization',
+          organizationId,
+          tenantId,
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          targetType: 'queue',
+          targetQueue: 'no-such-queue-anywhere',
+        })
+      ).toThrow(/not an approved scheduler target/)
+    })
+  })
+
+  describe('scheduleUpdateSchema', () => {
+    // Queue-safety rules for updates live in the scheduler.jobs.update command
+    // (change-detection against the stored row), so unchanged targets resent by
+    // the edit form and legacy remediation stay possible (#5213 N1).
+    // See commands/__tests__/jobs.target-guard.test.ts for that coverage.
+    it('accepts the request shape the edit form sends for an unchanged target', () => {
+      const result = scheduleUpdateSchema.parse({
+        id: scheduleId,
+        targetType: 'queue',
+        targetQueue: 'stripe-webhook',
+        isEnabled: false,
+      })
+      expect(result.isEnabled).toBe(false)
+    })
+
+    it('still rejects changing to a queue without providing the queue value', () => {
+      expect(() =>
+        scheduleUpdateSchema.parse({ id: scheduleId, targetType: 'queue' })
+      ).toThrow(/corresponding targetQueue/)
+    })
+  })
+})