@open-mercato/scheduler 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/scheduler/services/__tests__/localSchedulerService.test.ts

@@ -6,7 +6,6 @@ import {
   clearSchedulerSafeCommandsForTests,
   registerSchedulerSafeCommands,
 } from '../../lib/scheduler-safe-commands'
-import { registerModules } from '@open-mercato/shared/lib/modules/registry'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 jest.mock('@open-mercato/shared/lib/logger', () => {
@@ -62,40 +61,6 @@ describe('LocalSchedulerService', () => {
   let mockRbacService: { tenantHasFeature: jest.Mock; userHasAllFeatures: jest.Mock }
   let mockLockStrategy: { runWithLock: jest.Mock }
 
-  beforeAll(() => {
-    // Queue-target dispatch reauthorizes against scheduler-safe queues (#5213);
-    // seed one safe queue and one module-owned internal queue for the guards.
-    registerModules([
-      {
-        id: 'test_module',
-        workers: [
-          {
-            id: 'test_module:workers:test-queue',
-            queue: 'test-queue',
-            concurrency: 1,
-            schedulerSafe: true,
-            handler: async () => {},
-          },
-        ],
-      },
-      {
-        id: 'legacy_module',
-        workers: [
-          {
-            id: 'legacy_module:workers:internal',
-            queue: 'legacy-internal',
-            concurrency: 1,
-            handler: async () => {},
-          },
-        ],
-      },
-    ] as never)
-  })
-
-  afterAll(() => {
-    ;(globalThis as Record<string, unknown>).__openMercatoModulesRegistry__ = null
-  })
-
   beforeEach(() => {
     jest.clearAllMocks()
     jest.useFakeTimers()
@@ -331,151 +296,8 @@ describe('LocalSchedulerService', () => {
           tenantId: null,
           organizationId: null,
           _idempotencyKey: expect.stringMatching(/^scheduler-test-1-/),
-          _jobOrigin: 'scheduler',
-        })
-      )
-    })
-
-    it('should sanitize author-supplied scope and envelope keys from the target payload', async () => {
-      const schedule = createSchedule({
-        tenantId: 'tenant-1',
-        organizationId: 'org-1',
-        sourceType: 'module',
-        sourceModule: 'test_module',
-        targetQueue: 'test-queue',
-        targetPayload: {
-          scope: { tenantId: 'forged-tenant', organizationId: 'forged-org' },
-          tenantId: 'forged-tenant',
-          _jobOrigin: 'inbound-webhook',
-          payload: { nested: 'data', _idempotencyKey: 'forged' },
-          legit: 'kept',
-        },
-      })
-
-      mockForkedEm.find.mockResolvedValue([schedule])
-      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
-      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
-        await fn()
-        return { acquired: true }
-      })
-      mockQueue.enqueue.mockResolvedValue(undefined as any)
-
-      await service.start()
-
-      expect(mockQueue.enqueue).toHaveBeenCalledWith(
-        expect.objectContaining({
-          tenantId: 'tenant-1',
-          organizationId: 'org-1',
-          payload: { nested: 'data' },
-          legit: 'kept',
-          scope: { tenantId: 'tenant-1', organizationId: 'org-1' },
-          _jobOrigin: 'scheduler',
         })
       )
-      const enqueued = mockQueue.enqueue.mock.calls[0][0] as Record<string, unknown>
-      expect(enqueued.payload).toEqual({ nested: 'data' })
-    })
-
-    it('should refuse user-authored schedules targeting non-safe internal queues', async () => {
-      const schedule = createSchedule({
-        targetQueue: 'stripe-webhook',
-        sourceType: 'user',
-      })
-
-      mockForkedEm.find.mockResolvedValue([schedule])
-      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
-      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
-        await fn()
-        return { acquired: true }
-      })
-
-      await service.start()
-
-      expect(mockQueueFactory).not.toHaveBeenCalled()
-      expect(loggerError).toHaveBeenCalled()
-      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
-        'scheduler.job.failed',
-        expect.objectContaining({
-          id: 'test-1',
-          error: expect.stringContaining('not an approved scheduler target'),
-        })
-      )
-    })
-
-    it('should refuse a pre-upgrade module row whose sourceModule MATCHES the owner but carries an actor stamp (#5213 B1)', async () => {
-      // forged pre-upgrade row: attacker set sourceType/sourceModule to the real
-      // owning module, but API writes always stamp createdByUserId — which
-      // schedulerService.register() never does. The row must fail closed.
-      const schedule = createSchedule({
-        targetQueue: 'legacy-internal',
-        sourceType: 'module',
-        sourceModule: 'legacy_module',
-        createdByUserId: 'attacker-user',
-      })
-
-      mockForkedEm.find.mockResolvedValue([schedule])
-      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
-      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
-        await fn()
-        return { acquired: true }
-      })
-
-      await service.start()
-
-      expect(mockQueueFactory).not.toHaveBeenCalled()
-      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
-        'scheduler.job.failed',
-        expect.objectContaining({
-          id: 'test-1',
-          error: expect.stringContaining('not an approved scheduler target'),
-        })
-      )
-    })
-
-    it('should refuse a pre-upgrade module row whose sourceModule does not own its internal queue (#5213 B1)', async () => {
-      const schedule = createSchedule({
-        targetQueue: 'stripe-webhook',
-        sourceType: 'module',
-        sourceModule: 'legacy_module',
-      })
-
-      mockForkedEm.find.mockResolvedValue([schedule])
-      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
-      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
-        await fn()
-        return { acquired: true }
-      })
-
-      await service.start()
-
-      expect(mockQueueFactory).not.toHaveBeenCalled()
-      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
-        'scheduler.job.failed',
-        expect.objectContaining({
-          id: 'test-1',
-          error: expect.stringContaining('not an approved scheduler target'),
-        })
-      )
-    })
-
-    it('should allow module-authored schedules to keep targeting queues their own module owns (#5213 B1)', async () => {
-      const schedule = createSchedule({
-        targetQueue: 'legacy-internal',
-        sourceType: 'module',
-        sourceModule: 'legacy_module',
-      })
-
-      mockForkedEm.find.mockResolvedValue([schedule])
-      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
-      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
-        await fn()
-        return { acquired: true }
-      })
-      mockQueue.enqueue.mockResolvedValue(undefined as any)
-
-      await service.start()
-
-      expect(mockQueue.enqueue).toHaveBeenCalled()
     })
 
     it('should execute command target', async () => {
@@ -848,7 +670,6 @@ describe('LocalSchedulerService', () => {
           tenantId: schedule.tenantId,
           organizationId: schedule.organizationId,
           _idempotencyKey: expect.stringMatching(new RegExp(`^scheduler-${schedule.id}-`)),
-          _jobOrigin: 'scheduler',
         })
       )
       const enqueued = mockQueue.enqueue.mock.calls[0][0] as Record<string, unknown>

package/src/modules/scheduler/services/localSchedulerService.ts

@@ -11,12 +11,6 @@ import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-comm
 import { buildScheduledCommandContext } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import {
-  canDispatchScheduleQueueTarget,
-  getSchedulerQueueRequiredFeatures,
-  sanitizeSchedulerTargetPayload,
-  validateSchedulerTargetPayload,
-} from '../lib/safeQueueTargets'
 
 const logger = createLogger('scheduler').child({ component: 'local' })
 
@@ -267,45 +261,18 @@ export class LocalSchedulerService {
       throw new Error('Target queue is required for queue target type')
     }
 
-    // Dispatch-time reauthorization (#5213): provenance is verified against the
-    // live registry (module rows must own their queue), API rows must target
-    // opted-in queues.
-    if (!canDispatchScheduleQueueTarget(schedule)) {
-      throw new Error(`Queue is not an approved scheduler target: ${schedule.targetQueue}`)
-    }
-
-    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)
-    if (payloadIssue) {
-      throw new Error(`Invalid payload for scheduler queue ${schedule.targetQueue}: ${payloadIssue}`)
-    }
-
-    if (schedule.scopeType !== 'system') {
-      for (const feature of getSchedulerQueueRequiredFeatures(schedule.targetQueue)) {
-        const hasFeature = await this.checkFeature({ ...schedule, requireFeature: feature } as ScheduledJob)
-        if (!hasFeature) {
-          throw new Error(`Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`)
-        }
-      }
-    }
-
     const queue = this.queueFactory(schedule.targetQueue)
 
     // Deliver the same flat contract as the asynchronous execute-schedule
     // worker: targetPayload fields on the root, scheduler-owned scope and
     // idempotency fields applied last. Local mode runs each firing exactly
     // once, so the firing timestamp is a valid logical execution key.
-    // Author-supplied scope/envelope keys never survive dispatch (#5213).
-    const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)
-
-    await queue.enqueue({
-      ...buildQueueTargetPayload({
-        targetPayload: sanitizedPayload,
-        tenantId: schedule.tenantId,
-        organizationId: schedule.organizationId,
-        idempotencyKey: buildSchedulerIdempotencyKey(schedule.id, Date.now()),
-      }),
-      _jobOrigin: 'scheduler' as const,
-    })
+    await queue.enqueue(buildQueueTargetPayload({
+      targetPayload: schedule.targetPayload,
+      tenantId: schedule.tenantId,
+      organizationId: schedule.organizationId,
+      idempotencyKey: buildSchedulerIdempotencyKey(schedule.id, Date.now()),
+    }))
 
     logger.info('Enqueued job to target queue', { scheduleId: schedule.id, targetQueue: schedule.targetQueue })
   }

package/src/modules/scheduler/workers/__tests__/execute-schedule.worker.test.ts

@@ -3,25 +3,8 @@ import { ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { createQueue } from '@open-mercato/queue'
 import { ScheduledJob } from '../../data/entities'
 import { registerSchedulerSafeCommands } from '../../lib/scheduler-safe-commands'
-import { registerModules } from '@open-mercato/shared/lib/modules/registry'
 import executeScheduleWorker from '../execute-schedule.worker'
 
-// Queue-target dispatch verifies module provenance against the live registry
-// (#5213 B1): register the module that owns the fixture queue.
-registerModules([
-  {
-    id: 'worker_test_module',
-    workers: [
-      {
-        id: 'worker_test_module:workers:example',
-        queue: 'example',
-        concurrency: 1,
-        handler: async () => {},
-      },
-    ],
-  },
-] as never)
-
 const mockCommandExecute = jest.fn()
 
 jest.mock('@open-mercato/shared/lib/commands', () => ({
@@ -144,11 +127,7 @@ describe('executeScheduleWorker queue target payload contract', () => {
       targetType: 'queue',
       targetQueue: 'example',
       targetCommand: null,
-      sourceType: 'module',
-      // module registration never stamps an acting user (#5213 B1)
-      createdByUserId: null,
-      sourceModule: 'worker_test_module',
-      targetPayload: { connectionId: 'connection-id' },
+      targetPayload: { connectionId: 'connection-id', scope: 'organization' },
       ...overrides,
     })
   }
@@ -178,7 +157,7 @@ describe('executeScheduleWorker queue target payload contract', () => {
     ;(createQueue as jest.Mock).mockReturnValue({ enqueue, close })
   })
 
-  it('delivers the flat targetPayload contract with scheduler-owned fields applied last (#5213)', async () => {
+  it('delivers the flat targetPayload contract with scheduler-owned fields applied last', async () => {
     const schedule = buildQueueSchedule({
       targetPayload: {
         connectionId: 'connection-id',
@@ -192,12 +171,11 @@ describe('executeScheduleWorker queue target payload contract', () => {
 
     expect(enqueue).toHaveBeenCalledWith({
       connectionId: 'connection-id',
-      scope: { tenantId: 'tenant-a', organizationId: 'org-a' },
+      scope: 'organization',
       payload: { nested: true },
       tenantId: 'tenant-a',
       organizationId: 'org-a',
       _idempotencyKey: `scheduler-${scheduleId}-worker-job-1`,
-      _jobOrigin: 'scheduler',
     })
     expect(close).toHaveBeenCalledTimes(1)
   })

package/src/modules/scheduler/workers/execute-schedule.worker.ts

@@ -10,12 +10,6 @@ import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-comm
 import { buildScheduledCommandContext } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import {
-  canDispatchScheduleQueueTarget,
-  getSchedulerQueueRequiredFeatures,
-  sanitizeSchedulerTargetPayload,
-  validateSchedulerTargetPayload,
-} from '../lib/safeQueueTargets'
 
 const logger = createLogger('scheduler').child({ component: 'worker' })
 
@@ -173,69 +167,12 @@ export default async function executeScheduleWorker(
 
   // Enqueue target job or execute command
   if (schedule.targetType === 'queue' && schedule.targetQueue) {
-    // Dispatch-time reauthorization (#5213): provenance is verified, never
-    // trusted — module-authored rows must still be owned by their recorded
-    // sourceModule and carry no acting-user stamp; API-authored rows may only
-    // target workers that opted into scheduling.
-    if (!canDispatchScheduleQueueTarget(schedule)) {
-      logger.error('Refusing non-safe queue target for schedule', {
-        scheduleId,
-        targetQueue: schedule.targetQueue,
-        sourceType: schedule.sourceType,
-        sourceModule: schedule.sourceType === 'module' ? schedule.sourceModule : undefined,
-      })
-      await emitSchedulerEvent('scheduler.job.skipped', {
-        id: schedule.id,
-        tenantId: schedule.tenantId,
-        organizationId: schedule.organizationId,
-        reason: `Queue is not an approved scheduler target: ${schedule.targetQueue}`,
-      })
-      return
-    }
-
-    // Re-validate the stored payload against the target's registered schema and
-    // the tenant-level features the target requires (#5213, defense in depth).
-    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)
-    if (payloadIssue) {
-      logger.error('Refusing schedule with invalid payload for queue target', {
-        scheduleId,
-        targetQueue: schedule.targetQueue,
-        issue: payloadIssue,
-      })
-      await emitSchedulerEvent('scheduler.job.skipped', {
-        id: schedule.id,
-        tenantId: schedule.tenantId,
-        organizationId: schedule.organizationId,
-        reason: `Invalid payload for scheduler queue ${schedule.targetQueue}`,
-      })
-      return
-    }
-
-    const requiredQueueFeatures = getSchedulerQueueRequiredFeatures(schedule.targetQueue)
-    if (schedule.scopeType !== 'system' && requiredQueueFeatures.length > 0) {
-      for (const feature of requiredQueueFeatures) {
-        if (await rbacService.tenantHasFeature(schedule.tenantId, feature, { organizationId: schedule.organizationId })) continue
-        logger.error('Refusing schedule whose tenant lacks a required feature of the queue target', {
-          scheduleId,
-          targetQueue: schedule.targetQueue,
-          feature,
-        })
-        await emitSchedulerEvent('scheduler.job.skipped', {
-          id: schedule.id,
-          tenantId: schedule.tenantId,
-          organizationId: schedule.organizationId,
-          reason: `Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`,
-        })
-        return
-      }
-    }
-
     // Determine queue strategy from environment
     const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'
     const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {
       connection: { url: getRedisUrlOrThrow('QUEUE') },
     })
-
+    
     let targetJobId: string | undefined
     try {
       // The execute-schedule job id is stable across BullMQ retries, so if
@@ -243,18 +180,12 @@ export default async function executeScheduleWorker(
       // reuses the same idempotency key and downstream workers can dedupe.
       const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())
 
-      // Rebuild tenant/org authority context and the trusted dispatch origin
-      // server-side; author-supplied scope/envelope keys never survive (#5213).
-      const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)
-      targetJobId = await targetQueue.enqueue({
-        ...buildQueueTargetPayload({
-          targetPayload: sanitizedPayload,
-          tenantId: schedule.tenantId,
-          organizationId: schedule.organizationId,
-          idempotencyKey,
-        }),
-        _jobOrigin: 'scheduler' as const,
-      })
+      targetJobId = await targetQueue.enqueue(buildQueueTargetPayload({
+        targetPayload: schedule.targetPayload,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        idempotencyKey,
+      }))
     } finally {
       // Always close the queue instance to free Redis connections
       await targetQueue.close()

package/dist/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.js

@@ -1,72 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
-import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
-import {
-  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TARGETS_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-  getScheduleJobById,
-  uniqueScheduleName
-} from "./helpers/scheduler.js";
-test.describe("TC-SCHED-008: scheduler queue targets restricted to safe workers", () => {
-  for (const forbiddenQueue of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
-    test(`rejects creating a schedule targeting the ${forbiddenQueue} worker`, async ({ request }) => {
-      const token = await getAuthToken(request, "admin");
-      const response = await apiRequest(request, "POST", SCHEDULER_JOBS_PATH, {
-        token,
-        data: {
-          name: uniqueScheduleName("Forbidden Queue Target"),
-          scopeType: "organization",
-          scheduleType: "interval",
-          scheduleValue: "15m",
-          timezone: "UTC",
-          targetType: "queue",
-          targetQueue: forbiddenQueue,
-          targetPayload: { scope: { tenantId: "forged", organizationId: "forged" } },
-          isEnabled: true,
-          sourceType: "user"
-        }
-      });
-      expect(response.status(), `${forbiddenQueue} must not be schedulable`).toBe(400);
-      const body = await readJsonSafe(response);
-      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join("."));
-      expect(issuePaths).toContain("targetQueue");
-    });
-  }
-  test("rejects retargeting an existing schedule to an internal worker queue", async ({ request }) => {
-    const token = await getAuthToken(request, "admin");
-    let scheduleId = null;
-    try {
-      scheduleId = await createScheduleJob(request, token, { name: uniqueScheduleName("Retarget Guard") });
-      const response = await apiRequest(request, "PUT", SCHEDULER_JOBS_PATH, {
-        token,
-        data: {
-          id: scheduleId,
-          targetType: "queue",
-          targetQueue: "stripe-webhook"
-        }
-      });
-      expect(response.status()).toBe(422);
-      const body = await readJsonSafe(response);
-      expect(body?.error ?? "").toMatch(/not an approved scheduler target/i);
-      const unchanged = await getScheduleJobById(request, token, scheduleId);
-      expect(unchanged).not.toBeNull();
-      expect(unchanged.targetType).toBe("command");
-    } finally {
-      await deleteScheduleJob(request, token, scheduleId);
-    }
-  });
-  test("targets endpoint keeps internal worker queues undiscoverable", async ({ request }) => {
-    const token = await getAuthToken(request, "admin");
-    const response = await apiRequest(request, "GET", SCHEDULER_TARGETS_PATH, { token });
-    expect(response.status()).toBe(200);
-    const body = await readJsonSafe(response);
-    const values = (body?.queues ?? []).map((queue) => queue.value);
-    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
-      expect(values).not.toContain(forbidden);
-    }
-  });
-});
-//# sourceMappingURL=TC-SCHED-008-safe-targets.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport {\n  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,\n  SCHEDULER_JOBS_PATH,\n  SCHEDULER_TARGETS_PATH,\n  createScheduleJob,\n  deleteScheduleJob,\n  getScheduleJobById,\n  uniqueScheduleName,\n} from './helpers/scheduler'\n\n/**\n * TC-SCHED-008: Scheduler queue targets are restricted to authorized safe\n * workers (#5213). A principal holding only `scheduler.jobs.manage` must not be\n * able to aim a schedule at an internal/system worker queue with an arbitrary\n * payload \u2014 neither at creation, nor by retargeting later.\n */\ntest.describe('TC-SCHED-008: scheduler queue targets restricted to safe workers', () => {\n  for (const forbiddenQueue of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {\n    test(`rejects creating a schedule targeting the ${forbiddenQueue} worker`, async ({ request }) => {\n      const token = await getAuthToken(request, 'admin')\n\n      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {\n        token,\n        data: {\n          name: uniqueScheduleName('Forbidden Queue Target'),\n          scopeType: 'organization',\n          scheduleType: 'interval',\n          scheduleValue: '15m',\n          timezone: 'UTC',\n          targetType: 'queue',\n          targetQueue: forbiddenQueue,\n          targetPayload: { scope: { tenantId: 'forged', organizationId: 'forged' } },\n          isEnabled: true,\n          sourceType: 'user',\n        },\n      })\n\n      expect(response.status(), `${forbiddenQueue} must not be schedulable`).toBe(400)\n      const body = await readJsonSafe<{ error?: string; details?: Array<{ path?: Array<string | number> }> }>(response)\n      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))\n      expect(issuePaths).toContain('targetQueue')\n    })\n  }\n\n  test('rejects retargeting an existing schedule to an internal worker queue', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n    let scheduleId: string | null = null\n\n    try {\n      scheduleId = await createScheduleJob(request, token, { name: uniqueScheduleName('Retarget Guard') })\n\n      const response = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {\n        token,\n        data: {\n          id: scheduleId,\n          targetType: 'queue',\n          targetQueue: 'stripe-webhook',\n        },\n      })\n\n      // Enforcement lives in the update command (change-detection vs the stored\n      // row), so an actual retarget lands as 422 with the approval error.\n      expect(response.status()).toBe(422)\n      const body = await readJsonSafe<{ error?: string }>(response)\n      expect(body?.error ?? '').toMatch(/not an approved scheduler target/i)\n\n      const unchanged = await getScheduleJobById(request, token, scheduleId)\n      expect(unchanged).not.toBeNull()\n      expect(unchanged!.targetType).toBe('command')\n    } finally {\n      await deleteScheduleJob(request, token, scheduleId)\n    }\n  })\n\n  test('targets endpoint keeps internal worker queues undiscoverable', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n\n    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })\n    expect(response.status()).toBe(200)\n\n    const body = await readJsonSafe<{ queues?: Array<{ value: string }> }>(response)\n    const values = (body?.queues ?? []).map((queue) => queue.value)\n    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {\n      expect(values).not.toContain(forbidden)\n    }\n  })\n})\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,KAAK,SAAS,oEAAoE,MAAM;AACtF,aAAW,kBAAkB,qCAAqC;AAChE,SAAK,6CAA6C,cAAc,WAAW,OAAO,EAAE,QAAQ,MAAM;AAChG,YAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AAEjD,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,qBAAqB;AAAA,QACtE;AAAA,QACA,MAAM;AAAA,UACJ,MAAM,mBAAmB,wBAAwB;AAAA,UACjD,WAAW;AAAA,UACX,cAAc;AAAA,UACd,eAAe;AAAA,UACf,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,eAAe,EAAE,OAAO,EAAE,UAAU,UAAU,gBAAgB,SAAS,EAAE;AAAA,UACzE,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF,CAAC;AAED,aAAO,SAAS,OAAO,GAAG,GAAG,cAAc,0BAA0B,EAAE,KAAK,GAAG;AAC/E,YAAM,OAAO,MAAM,aAAqF,QAAQ;AAChH,YAAM,cAAc,MAAM,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,MAAM,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC;AACpF,aAAO,UAAU,EAAE,UAAU,aAAa;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,OAAK,wEAAwE,OAAO,EAAE,QAAQ,MAAM;AAClG,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAI,aAA4B;AAEhC,QAAI;AACF,mBAAa,MAAM,kBAAkB,SAAS,OAAO,EAAE,MAAM,mBAAmB,gBAAgB,EAAE,CAAC;AAEnG,YAAM,WAAW,MAAM,WAAW,SAAS,OAAO,qBAAqB;AAAA,QACrE;AAAA,QACA,MAAM;AAAA,UACJ,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,aAAa;AAAA,QACf;AAAA,MACF,CAAC;AAID,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,YAAM,OAAO,MAAM,aAAiC,QAAQ;AAC5D,aAAO,MAAM,SAAS,EAAE,EAAE,QAAQ,mCAAmC;AAErE,YAAM,YAAY,MAAM,mBAAmB,SAAS,OAAO,UAAU;AACrE,aAAO,SAAS,EAAE,IAAI,SAAS;AAC/B,aAAO,UAAW,UAAU,EAAE,KAAK,SAAS;AAAA,IAC9C,UAAE;AACA,YAAM,kBAAkB,SAAS,OAAO,UAAU;AAAA,IACpD;AAAA,EACF,CAAC;AAED,OAAK,gEAAgE,OAAO,EAAE,QAAQ,MAAM;AAC1F,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AAEjD,UAAM,WAAW,MAAM,WAAW,SAAS,OAAO,wBAAwB,EAAE,MAAM,CAAC;AACnF,WAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAElC,UAAM,OAAO,MAAM,aAAoD,QAAQ;AAC/E,UAAM,UAAU,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,KAAK;AAC9D,eAAW,aAAa,qCAAqC;AAC3D,aAAO,MAAM,EAAE,IAAI,UAAU,SAAS;AAAA,IACxC;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/scheduler/__integration__/TC-SCHED-008.spec.js

@@ -1,66 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
-import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
-import {
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TRIGGER_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-  uniqueScheduleName
-} from "./helpers/scheduler.js";
-const isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || "local") === "async";
-test.describe("TC-SCHED-008: system-scoped schedule access on trigger and executions", () => {
-  test("super admin reaches the schedule on both routes; a non-super-admin is forbidden", async ({ request }) => {
-    const superToken = await getAuthToken(request, "superadmin");
-    const adminToken = await getAuthToken(request, "admin");
-    let scheduleId = null;
-    try {
-      scheduleId = await createScheduleJob(request, superToken, {
-        name: uniqueScheduleName("System-Trigger-Test"),
-        scopeType: "system",
-        scheduleType: "interval",
-        scheduleValue: "1h"
-      });
-      const superResponse = await apiRequest(request, "POST", SCHEDULER_TRIGGER_PATH, {
-        token: superToken,
-        data: { id: scheduleId }
-      });
-      const superBody = await readJsonSafe(superResponse);
-      expect(
-        superResponse.status(),
-        "a super admin must not be told a system-scoped schedule does not exist"
-      ).not.toBe(404);
-      if (isAsyncQueueStrategy) {
-        expect(superResponse.status()).toBe(200);
-        expect(superBody?.ok).toBe(true);
-        expect(typeof superBody?.jobId === "string" && superBody.jobId.length > 0).toBe(true);
-      } else {
-        expect(superResponse.status()).toBe(400);
-        expect(superBody?.error ?? "").toMatch(/async/i);
-      }
-      const adminResponse = await apiRequest(request, "POST", SCHEDULER_TRIGGER_PATH, {
-        token: adminToken,
-        data: { id: scheduleId }
-      });
-      expect(
-        adminResponse.status(),
-        "a non-super-admin must be forbidden from triggering a system-scoped schedule"
-      ).toBe(403);
-      const executionsPath = `${SCHEDULER_JOBS_PATH}/${scheduleId}/executions`;
-      const superExecutions = await apiRequest(request, "GET", executionsPath, { token: superToken });
-      expect(
-        superExecutions.status(),
-        "a super admin must not be told a system-scoped schedule has no execution history route"
-      ).not.toBe(404);
-      expect(superExecutions.status()).toBe(isAsyncQueueStrategy ? 200 : 400);
-      const adminExecutions = await apiRequest(request, "GET", executionsPath, { token: adminToken });
-      expect(
-        adminExecutions.status(),
-        "a non-super-admin must be forbidden from reading a system-scoped execution history"
-      ).toBe(403);
-    } finally {
-      await deleteScheduleJob(request, superToken, scheduleId);
-    }
-  });
-});
-//# sourceMappingURL=TC-SCHED-008.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-008.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-008.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport {\n  SCHEDULER_JOBS_PATH,\n  SCHEDULER_TRIGGER_PATH,\n  createScheduleJob,\n  deleteScheduleJob,\n  uniqueScheduleName,\n} from './helpers/scheduler'\n\nconst isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || 'local') === 'async'\n\ntype TriggerBody = { ok?: boolean; jobId?: string; error?: string; message?: string }\n\n/**\n * TC-SCHED-008: POST /api/scheduler/trigger and GET /api/scheduler/jobs/[id]/executions\n * resolve the scope of a system-scoped schedule on the loaded row, not in the lookup.\n *\n * A system-scoped schedule has `tenantId === null` and `organizationId === null`. When both\n * routes folded the caller's tenant/org into the `where` clause, no such row could ever match\n * and every caller \u2014 super admins included \u2014 got 404, which also masked each route's own\n * super-admin gate. A super admin must now reach the schedule, and a non-super-admin must be\n * told 403 rather than 404.\n *\n * The super-admin assertions hold under either queue strategy: each route's\n * `QUEUE_STRATEGY=async` check sits after the lookup, so `local` yields the pre-existing\n * 400 \u2014 never 404.\n */\ntest.describe('TC-SCHED-008: system-scoped schedule access on trigger and executions', () => {\n  test('super admin reaches the schedule on both routes; a non-super-admin is forbidden', async ({ request }) => {\n    const superToken = await getAuthToken(request, 'superadmin')\n    const adminToken = await getAuthToken(request, 'admin')\n    let scheduleId: string | null = null\n\n    try {\n      // Creating a system-scoped schedule is itself super-admin only.\n      scheduleId = await createScheduleJob(request, superToken, {\n        name: uniqueScheduleName('System-Trigger-Test'),\n        scopeType: 'system',\n        scheduleType: 'interval',\n        scheduleValue: '1h',\n      })\n\n      const superResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {\n        token: superToken,\n        data: { id: scheduleId },\n      })\n      const superBody = await readJsonSafe<TriggerBody>(superResponse)\n      expect(\n        superResponse.status(),\n        'a super admin must not be told a system-scoped schedule does not exist',\n      ).not.toBe(404)\n\n      if (isAsyncQueueStrategy) {\n        expect(superResponse.status()).toBe(200)\n        expect(superBody?.ok).toBe(true)\n        expect(typeof superBody?.jobId === 'string' && superBody.jobId.length > 0).toBe(true)\n      } else {\n        // The strategy check runs after the scope check, so this 400 is the response the\n        // 404 used to mask.\n        expect(superResponse.status()).toBe(400)\n        expect(superBody?.error ?? '').toMatch(/async/i)\n      }\n\n      // The same schedule is visible enough to be refused, not hidden, from a tenant admin.\n      const adminResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {\n        token: adminToken,\n        data: { id: scheduleId },\n      })\n      expect(\n        adminResponse.status(),\n        'a non-super-admin must be forbidden from triggering a system-scoped schedule',\n      ).toBe(403)\n\n      // The execution-history route carried the same lookup and needs the same guarantees.\n      const executionsPath = `${SCHEDULER_JOBS_PATH}/${scheduleId}/executions`\n      const superExecutions = await apiRequest(request, 'GET', executionsPath, { token: superToken })\n      expect(\n        superExecutions.status(),\n        'a super admin must not be told a system-scoped schedule has no execution history route',\n      ).not.toBe(404)\n      expect(superExecutions.status()).toBe(isAsyncQueueStrategy ? 200 : 400)\n\n      const adminExecutions = await apiRequest(request, 'GET', executionsPath, { token: adminToken })\n      expect(\n        adminExecutions.status(),\n        'a non-super-admin must be forbidden from reading a system-scoped execution history',\n      ).toBe(403)\n    } finally {\n      await deleteScheduleJob(request, superToken, scheduleId)\n    }\n  })\n})\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,wBAAwB,QAAQ,IAAI,kBAAkB,aAAa;AAkBzE,KAAK,SAAS,yEAAyE,MAAM;AAC3F,OAAK,mFAAmF,OAAO,EAAE,QAAQ,MAAM;AAC7G,UAAM,aAAa,MAAM,aAAa,SAAS,YAAY;AAC3D,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,QAAI,aAA4B;AAEhC,QAAI;AAEF,mBAAa,MAAM,kBAAkB,SAAS,YAAY;AAAA,QACxD,MAAM,mBAAmB,qBAAqB;AAAA,QAC9C,WAAW;AAAA,QACX,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAED,YAAM,gBAAgB,MAAM,WAAW,SAAS,QAAQ,wBAAwB;AAAA,QAC9E,OAAO;AAAA,QACP,MAAM,EAAE,IAAI,WAAW;AAAA,MACzB,CAAC;AACD,YAAM,YAAY,MAAM,aAA0B,aAAa;AAC/D;AAAA,QACE,cAAc,OAAO;AAAA,QACrB;AAAA,MACF,EAAE,IAAI,KAAK,GAAG;AAEd,UAAI,sBAAsB;AACxB,eAAO,cAAc,OAAO,CAAC,EAAE,KAAK,GAAG;AACvC,eAAO,WAAW,EAAE,EAAE,KAAK,IAAI;AAC/B,eAAO,OAAO,WAAW,UAAU,YAAY,UAAU,MAAM,SAAS,CAAC,EAAE,KAAK,IAAI;AAAA,MACtF,OAAO;AAGL,eAAO,cAAc,OAAO,CAAC,EAAE,KAAK,GAAG;AACvC,eAAO,WAAW,SAAS,EAAE,EAAE,QAAQ,QAAQ;AAAA,MACjD;AAGA,YAAM,gBAAgB,MAAM,WAAW,SAAS,QAAQ,wBAAwB;AAAA,QAC9E,OAAO;AAAA,QACP,MAAM,EAAE,IAAI,WAAW;AAAA,MACzB,CAAC;AACD;AAAA,QACE,cAAc,OAAO;AAAA,QACrB;AAAA,MACF,EAAE,KAAK,GAAG;AAGV,YAAM,iBAAiB,GAAG,mBAAmB,IAAI,UAAU;AAC3D,YAAM,kBAAkB,MAAM,WAAW,SAAS,OAAO,gBAAgB,EAAE,OAAO,WAAW,CAAC;AAC9F;AAAA,QACE,gBAAgB,OAAO;AAAA,QACvB;AAAA,MACF,EAAE,IAAI,KAAK,GAAG;AACd,aAAO,gBAAgB,OAAO,CAAC,EAAE,KAAK,uBAAuB,MAAM,GAAG;AAEtE,YAAM,kBAAkB,MAAM,WAAW,SAAS,OAAO,gBAAgB,EAAE,OAAO,WAAW,CAAC;AAC9F;AAAA,QACE,gBAAgB,OAAO;AAAA,QACvB;AAAA,MACF,EAAE,KAAK,GAAG;AAAA,IACZ,UAAE;AACA,YAAM,kBAAkB,SAAS,YAAY,UAAU;AAAA,IACzD;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}