@open-mercato/scheduler 0.6.8-develop.7066.1.6bfa9ff69f → 0.6.8-develop.7068.1.c55b52e1a1

package/src/modules/scheduler/workers/execute-schedule.worker.ts

@@ -10,6 +10,12 @@ import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-comm
 import { buildScheduledCommandContext } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  canDispatchScheduleQueueTarget,
+  getSchedulerQueueRequiredFeatures,
+  sanitizeSchedulerTargetPayload,
+  validateSchedulerTargetPayload,
+} from '../lib/safeQueueTargets'
 
 const logger = createLogger('scheduler').child({ component: 'worker' })
 
@@ -167,12 +173,69 @@ export default async function executeScheduleWorker(
 
   // Enqueue target job or execute command
   if (schedule.targetType === 'queue' && schedule.targetQueue) {
+    // Dispatch-time reauthorization (#5213): provenance is verified, never
+    // trusted — module-authored rows must still be owned by their recorded
+    // sourceModule and carry no acting-user stamp; API-authored rows may only
+    // target workers that opted into scheduling.
+    if (!canDispatchScheduleQueueTarget(schedule)) {
+      logger.error('Refusing non-safe queue target for schedule', {
+        scheduleId,
+        targetQueue: schedule.targetQueue,
+        sourceType: schedule.sourceType,
+        sourceModule: schedule.sourceType === 'module' ? schedule.sourceModule : undefined,
+      })
+      await emitSchedulerEvent('scheduler.job.skipped', {
+        id: schedule.id,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        reason: `Queue is not an approved scheduler target: ${schedule.targetQueue}`,
+      })
+      return
+    }
+
+    // Re-validate the stored payload against the target's registered schema and
+    // the tenant-level features the target requires (#5213, defense in depth).
+    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)
+    if (payloadIssue) {
+      logger.error('Refusing schedule with invalid payload for queue target', {
+        scheduleId,
+        targetQueue: schedule.targetQueue,
+        issue: payloadIssue,
+      })
+      await emitSchedulerEvent('scheduler.job.skipped', {
+        id: schedule.id,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        reason: `Invalid payload for scheduler queue ${schedule.targetQueue}`,
+      })
+      return
+    }
+
+    const requiredQueueFeatures = getSchedulerQueueRequiredFeatures(schedule.targetQueue)
+    if (schedule.scopeType !== 'system' && requiredQueueFeatures.length > 0) {
+      for (const feature of requiredQueueFeatures) {
+        if (await rbacService.tenantHasFeature(schedule.tenantId, feature, { organizationId: schedule.organizationId })) continue
+        logger.error('Refusing schedule whose tenant lacks a required feature of the queue target', {
+          scheduleId,
+          targetQueue: schedule.targetQueue,
+          feature,
+        })
+        await emitSchedulerEvent('scheduler.job.skipped', {
+          id: schedule.id,
+          tenantId: schedule.tenantId,
+          organizationId: schedule.organizationId,
+          reason: `Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`,
+        })
+        return
+      }
+    }
+
     // Determine queue strategy from environment
     const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'
     const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {
       connection: { url: getRedisUrlOrThrow('QUEUE') },
     })
-    
+
     let targetJobId: string | undefined
     try {
       // The execute-schedule job id is stable across BullMQ retries, so if
@@ -180,12 +243,18 @@ export default async function executeScheduleWorker(
       // reuses the same idempotency key and downstream workers can dedupe.
       const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())
 
-      targetJobId = await targetQueue.enqueue(buildQueueTargetPayload({
-        targetPayload: schedule.targetPayload,
-        tenantId: schedule.tenantId,
-        organizationId: schedule.organizationId,
-        idempotencyKey,
-      }))
+      // Rebuild tenant/org authority context and the trusted dispatch origin
+      // server-side; author-supplied scope/envelope keys never survive (#5213).
+      const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)
+      targetJobId = await targetQueue.enqueue({
+        ...buildQueueTargetPayload({
+          targetPayload: sanitizedPayload,
+          tenantId: schedule.tenantId,
+          organizationId: schedule.organizationId,
+          idempotencyKey,
+        }),
+        _jobOrigin: 'scheduler' as const,
+      })
     } finally {
       // Always close the queue instance to free Redis connections
       await targetQueue.close()

package/src/modules/scheduler/workers/test-echo-queue.worker.ts

@@ -0,0 +1,25 @@
+import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('scheduler').child({ component: 'test-echo-queue' })
+
+export const metadata: WorkerMeta = {
+  queue: 'scheduler-test',
+  id: 'scheduler:test-echo-queue',
+  concurrency: 1,
+  /**
+   * Deliberate scheduler-safe target for QA fixtures and manual experiments,
+   * mirroring the `scheduler.test.echo` command. The handler is side-effect
+   * free: it only logs that a delivery arrived.
+   */
+  schedulerSafe: true,
+}
+
+type TestEchoPayload = {
+  message?: unknown
+}
+
+export default async function handle(job: QueuedJob<TestEchoPayload>, _ctx: JobContext): Promise<void> {
+  const message = typeof job.payload?.message === 'string' ? job.payload.message : ''
+  logger.info('Test queue target received a scheduled delivery', { messageId: message.slice(0, 80) })
+}