@open-mercato/scheduler 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/scheduler/data/__tests__/safe-targets.test.ts

@@ -1,110 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
-import {
-  scheduleCreateSchema,
-  scheduleUpdateSchema,
-} from '../validators'
-import { registerModules } from '@open-mercato/shared/lib/modules/registry'
-
-const tenantId = '123e4567-e89b-12d3-a456-426614174000'
-const organizationId = '123e4567-e89b-12d3-a456-426614174001'
-const scheduleId = '123e4567-e89b-12d3-a456-426614174002'
-
-const REGISTRY_KEY = '__openMercatoModulesRegistry__'
-
-beforeAll(() => {
-  registerModules([
-    {
-      id: 'test_module',
-      workers: [
-        {
-          id: 'test_module:workers:safe',
-          queue: 'test-module-safe-queue',
-          concurrency: 1,
-          schedulerSafe: true,
-          handler: async () => {},
-        },
-        {
-          id: 'test_module:workers:internal',
-          queue: 'stripe-webhook',
-          concurrency: 1,
-          handler: async () => {},
-        },
-      ],
-    },
-  ] as never)
-})
-
-afterAll(() => {
-  ;(globalThis as Record<string, unknown>)[REGISTRY_KEY] = null
-})
-
-describe('scheduler queue target authorization (#5213)', () => {
-  describe('scheduleCreateSchema', () => {
-    it('accepts a queue target declared scheduler-safe by its worker', () => {
-      const result = scheduleCreateSchema.parse({
-        name: 'Safe queue schedule',
-        scopeType: 'organization',
-        organizationId,
-        tenantId,
-        scheduleType: 'interval',
-        scheduleValue: '15m',
-        targetType: 'queue',
-        targetQueue: 'test-module-safe-queue',
-      })
-
-      expect(result.targetQueue).toBe('test-module-safe-queue')
-    })
-
-    it('rejects a queue target the worker did not declare scheduler-safe', () => {
-      expect(() =>
-        scheduleCreateSchema.parse({
-          name: 'Internal sink schedule',
-          scopeType: 'organization',
-          organizationId,
-          tenantId,
-          scheduleType: 'interval',
-          scheduleValue: '15m',
-          targetType: 'queue',
-          targetQueue: 'stripe-webhook',
-        })
-      ).toThrow(/not an approved scheduler target/)
-    })
-
-    it('rejects an unknown queue target', () => {
-      expect(() =>
-        scheduleCreateSchema.parse({
-          name: 'Unknown queue schedule',
-          scopeType: 'organization',
-          organizationId,
-          tenantId,
-          scheduleType: 'interval',
-          scheduleValue: '15m',
-          targetType: 'queue',
-          targetQueue: 'no-such-queue-anywhere',
-        })
-      ).toThrow(/not an approved scheduler target/)
-    })
-  })
-
-  describe('scheduleUpdateSchema', () => {
-    // Queue-safety rules for updates live in the scheduler.jobs.update command
-    // (change-detection against the stored row), so unchanged targets resent by
-    // the edit form and legacy remediation stay possible (#5213 N1).
-    // See commands/__tests__/jobs.target-guard.test.ts for that coverage.
-    it('accepts the request shape the edit form sends for an unchanged target', () => {
-      const result = scheduleUpdateSchema.parse({
-        id: scheduleId,
-        targetType: 'queue',
-        targetQueue: 'stripe-webhook',
-        isEnabled: false,
-      })
-      expect(result.isEnabled).toBe(false)
-    })
-
-    it('still rejects changing to a queue without providing the queue value', () => {
-      expect(() =>
-        scheduleUpdateSchema.parse({ id: scheduleId, targetType: 'queue' })
-      ).toThrow(/corresponding targetQueue/)
-    })
-  })
-})

package/src/modules/scheduler/lib/__tests__/safeQueueTargets.test.ts

@@ -1,311 +0,0 @@
-import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
-import {
-  buildTrustedScheduleScope,
-  sanitizeSchedulerTargetPayload,
-  listSchedulerSafeQueueTargets,
-  isSchedulerSafeQueue,
-  canDispatchScheduleQueueTarget,
-  getSchedulerQueueRequiredFeatures,
-  assertSchedulerQueueTargetAuthorized,
-  validateSchedulerTargetPayload,
-  auditSchedulerModuleQueueRows,
-} from '../safeQueueTargets'
-import { registerModules } from '@open-mercato/shared/lib/modules/registry'
-
-const REGISTRY_KEY = '__openMercatoModulesRegistry__'
-
-beforeAll(() => {
-  registerModules([
-    {
-      id: 'alpha',
-      workers: [
-        {
-          id: 'alpha:workers:safe',
-          queue: 'alpha-safe',
-          concurrency: 1,
-          schedulerSafe: true,
-          handler: async () => {},
-        },
-        {
-          id: 'alpha:workers:internal',
-          queue: 'alpha-internal',
-          concurrency: 1,
-          handler: async () => {},
-        },
-        {
-          id: 'alpha:workers:mixed-safe',
-          queue: 'mixed-queue',
-          concurrency: 1,
-          schedulerSafe: true,
-          handler: async () => {},
-        },
-        {
-          id: 'alpha:workers:gated',
-          queue: 'gated-queue',
-          concurrency: 1,
-          schedulerSafe: true,
-          schedulerRequiredFeatures: ['orders.export'],
-          handler: async () => {},
-        },
-      ],
-    },
-    {
-      id: 'beta',
-      workers: [
-        {
-          id: 'beta:workers:safe',
-          queue: 'alpha-safe',
-          concurrency: 1,
-          schedulerSafe: true,
-          handler: async () => {},
-        },
-        {
-          id: 'beta:workers:freeloader',
-          queue: 'mixed-queue',
-          concurrency: 1,
-          handler: async () => {},
-        },
-      ],
-    },
-  ] as never)
-})
-
-afterAll(() => {
-  ;(globalThis as Record<string, unknown>)[REGISTRY_KEY] = null
-})
-
-describe('listSchedulerSafeQueueTargets', () => {
-  it('returns only queues whose workers ALL opted into scheduling, deduplicated and sorted', () => {
-    expect(listSchedulerSafeQueueTargets()).toEqual([
-      { queue: 'alpha-safe', moduleId: 'alpha', requiredFeatures: [] },
-      { queue: 'gated-queue', moduleId: 'alpha', requiredFeatures: ['orders.export'] },
-    ])
-  })
-
-  it('hides a queue when even one consumer did not opt in (#5213 M2)', () => {
-    // mixed-queue: alpha opts in, beta does not — the whole queue must stay hidden
-    expect(isSchedulerSafeQueue('mixed-queue')).toBe(false)
-  })
-})
-
-describe('target descriptors', () => {
-  it('surfaces required creator features from opted-in workers (#5213 M3)', () => {
-    expect(getSchedulerQueueRequiredFeatures('alpha-safe')).toEqual([])
-    expect(getSchedulerQueueRequiredFeatures('gated-queue')).toEqual(['orders.export'])
-    expect(getSchedulerQueueRequiredFeatures('unknown')).toEqual([])
-  })
-})
-
-describe('assertSchedulerQueueTargetAuthorized (#5213 M3)', () => {
-  const base = { queue: 'gated-queue' } as const
-
-  it('passes when the creator holds every required feature', async () => {
-    const reason = await assertSchedulerQueueTargetAuthorized({
-      ...base,
-      actorUserId: 'user-1',
-      tenantId: 't-1',
-      organizationId: 'o-1',
-      rbacService: { userHasAllFeatures: async () => true },
-    })
-    expect(reason).toBeNull()
-  })
-
-  it('rejects when the creator lacks a target-specific feature', async () => {
-    const reason = await assertSchedulerQueueTargetAuthorized({
-      ...base,
-      actorUserId: 'user-1',
-      tenantId: 't-1',
-      organizationId: 'o-1',
-      rbacService: { userHasAllFeatures: async () => false },
-    })
-    expect(reason).toContain('orders.export')
-  })
-
-  it('bypasses for super admins and feature-less targets', async () => {
-    expect(await assertSchedulerQueueTargetAuthorized({
-      ...base,
-      isSuperAdmin: true,
-      rbacService: { userHasAllFeatures: async () => false },
-    })).toBeNull()
-    expect(await assertSchedulerQueueTargetAuthorized({
-      queue: 'alpha-safe',
-      actorUserId: null,
-    })).toBeNull()
-  })
-})
-
-describe('isSchedulerSafeQueue', () => {
-  it('accepts opted-in queues', () => {
-    expect(isSchedulerSafeQueue('alpha-safe')).toBe(true)
-  })
-
-  it('rejects internal worker queues', () => {
-    expect(isSchedulerSafeQueue('alpha-internal')).toBe(false)
-  })
-
-  it('rejects unknown, empty, and missing queues', () => {
-    expect(isSchedulerSafeQueue('nope')).toBe(false)
-    expect(isSchedulerSafeQueue('')).toBe(false)
-    expect(isSchedulerSafeQueue(null)).toBe(false)
-    expect(isSchedulerSafeQueue(undefined)).toBe(false)
-  })
-})
-
-describe('canDispatchScheduleQueueTarget', () => {
-  it('allows module-authored schedules to target queues their own module owns', () => {
-    expect(canDispatchScheduleQueueTarget({
-      targetQueue: 'alpha-internal',
-      sourceType: 'module',
-      sourceModule: 'alpha',
-    })).toBe(true)
-  })
-
-  it('fails closed on pre-upgrade/forged module rows (#5213 B1)', () => {
-    // legacy row without any recorded owner
-    expect(canDispatchScheduleQueueTarget({ targetQueue: 'alpha-internal', sourceType: 'module' })).toBe(false)
-    // row claiming a module that does not own the queue — e.g. data_sync → stripe-webhook
-    expect(canDispatchScheduleQueueTarget({
-      targetQueue: 'stripe-webhook',
-      sourceType: 'module',
-      sourceModule: 'data_sync',
-    })).toBe(false)
-    expect(canDispatchScheduleQueueTarget({
-      targetQueue: 'alpha-internal',
-      sourceType: 'module',
-      sourceModule: 'beta',
-    })).toBe(false)
-  })
-
-  it('restricts user-authored schedules to scheduler-safe queues', () => {
-    expect(canDispatchScheduleQueueTarget({ targetQueue: 'alpha-safe', sourceType: 'user' })).toBe(true)
-    expect(canDispatchScheduleQueueTarget({ targetQueue: 'stripe-webhook', sourceType: 'user' })).toBe(false)
-  })
-
-  it('rejects schedules without a queue', () => {
-    expect(canDispatchScheduleQueueTarget({ targetQueue: null })).toBe(false)
-    expect(canDispatchScheduleQueueTarget({})).toBe(false)
-  })
-})
-
-describe('validateSchedulerTargetPayload (#5213 M3)', () => {
-  it('enforces registered schemas for known targets', async () => {
-    expect(validateSchedulerTargetPayload('scheduler-test', { message: 'hi' })).toBeNull()
-    expect(validateSchedulerTargetPayload('scheduler-test', { message: 123 })).toMatch(/message/)
-    expect(validateSchedulerTargetPayload('unregistered-queue', { anything: true })).toBeNull()
-  })
-})
-
-describe('buildTrustedScheduleScope', () => {
-  it('derives scope exclusively from the stored schedule row', () => {
-    expect(buildTrustedScheduleScope({ tenantId: 't1', organizationId: 'o1' }))
-      .toEqual({ tenantId: 't1', organizationId: 'o1' })
-    expect(buildTrustedScheduleScope({}))
-      .toEqual({ tenantId: null, organizationId: null })
-  })
-})
-
-describe('sanitizeSchedulerTargetPayload', () => {
-  const schedule = { tenantId: 't-1', organizationId: 'o-1' }
-
-  it('strips caller-supplied authority keys at the payload root', () => {
-    const result = sanitizeSchedulerTargetPayload({
-      scope: { tenantId: 'forged', organizationId: 'forged' },
-      tenantId: 'forged',
-      organizationId: 'forged',
-      keep: 'me',
-    }, schedule)
-
-    expect(result).toEqual({
-      keep: 'me',
-      scope: { tenantId: 't-1', organizationId: 'o-1' },
-    })
-  })
-
-  it('strips reserved keys inside the local-strategy payload wrapper level', () => {
-    const result = sanitizeSchedulerTargetPayload({
-      payload: {
-        nested: 'data',
-        scope: { tenantId: 'forged' },
-        _jobOrigin: 'inbound-webhook',
-      },
-    }, schedule)
-
-    expect(result).toEqual({
-      payload: { nested: 'data' },
-      scope: { tenantId: 't-1', organizationId: 'o-1' },
-    })
-  })
-
-  it('strips the reserved underscore-prefixed envelope namespace', () => {
-    const result = sanitizeSchedulerTargetPayload({
-      _idempotencyKey: 'forged',
-      _jobOrigin: 'inbound-webhook',
-      data: 1,
-    }, schedule)
-
-    expect(result).toEqual({
-      data: 1,
-      scope: { tenantId: 't-1', organizationId: 'o-1' },
-    })
-  })
-
-  it('does not mutate the input payload', () => {
-    const input = {
-      scope: { tenantId: 'forged' },
-      deep: { value: { x: 1 } },
-    }
-    const snapshot = structuredClone(input)
-
-    sanitizeSchedulerTargetPayload(input, schedule)
-
-    expect(input).toEqual(snapshot)
-  })
-
-  it('injects trusted scope for empty and missing payloads', () => {
-    expect(sanitizeSchedulerTargetPayload(null, schedule))
-      .toEqual({ scope: { tenantId: 't-1', organizationId: 'o-1' } })
-    expect(sanitizeSchedulerTargetPayload({}, schedule))
-      .toEqual({ scope: { tenantId: 't-1', organizationId: 'o-1' } })
-  })
-})
-
-describe('auditSchedulerModuleQueueRows (#5213 B1-residual-2)', () => {
-  it('flags API-key-authored forgeries that the runtime guard cannot distinguish', () => {
-    // A non-user-bound API key stamps no actor: at rest this row is
-    // indistinguishable from a genuine registration even though it was forged
-    // pre-upgrade. The runtime guard must keep allowing it (it cannot know),
-    // and the audit must surface it for operator review.
-    const apiKeyForged = {
-      id: 'row-forged',
-      name: 'Looks legitimate',
-      targetQueue: 'alpha-internal',
-      sourceType: 'module',
-      sourceModule: 'alpha',
-      createdByUserId: null,
-      isEnabled: true,
-    }
-    const genuine = { ...apiKeyForged, id: 'row-genuine', name: 'Real registration' }
-    const mismatched = {
-      ...apiKeyForged,
-      id: 'row-mismatched',
-      targetQueue: 'stripe-webhook',
-      sourceModule: 'alpha',
-    }
-
-    const audits = auditSchedulerModuleQueueRows([apiKeyForged, genuine, mismatched])
-
-    expect(audits).toHaveLength(3)
-    const forged = audits.find((a) => a.scheduleId === 'row-forged')
-    expect(forged?.dispatchAllowed).toBe(true)
-    // the mismatched-name row fails closed and is reported as blocked
-    expect(audits.find((a) => a.scheduleId === 'row-mismatched')?.dispatchAllowed).toBe(false)
-    expect(audits.find((a) => a.scheduleId === 'row-genuine')?.dispatchAllowed).toBe(true)
-  })
-
-  it('ignores user-authored rows entirely', () => {
-    const audits = auditSchedulerModuleQueueRows([
-      { id: 'row-user', targetQueue: 'alpha-internal', sourceType: 'user', sourceModule: null },
-    ])
-    expect(audits).toHaveLength(0)
-  })
-})

package/src/modules/scheduler/lib/__tests__/scheduleAccess.test.ts

@@ -1,164 +0,0 @@
-/**
- * Regression test for the manual-trigger 404 on system-scoped schedules.
- *
- * `POST /api/scheduler/trigger` and `GET /api/scheduler/jobs/[id]/executions` used to fold
- * the actor's tenant/org into the lookup, so a schedule with `tenantId === null` and
- * `organizationId === null` never matched and both routes answered 404 — for a super admin
- * too — leaving their own system-scope branch unreachable. This exercises the real
- * `resolveScheduleAccess` both routes now call.
- */
-
-import { describe, it, expect } from '@jest/globals'
-import { resolveScheduleAccess, type ScheduleScopeSubject } from '../scheduleAccess'
-
-const systemSchedule: ScheduleScopeSubject = { scopeType: 'system', tenantId: null, organizationId: null }
-const tenantSchedule: ScheduleScopeSubject = { scopeType: 'tenant', tenantId: 't1', organizationId: null }
-const orgSchedule: ScheduleScopeSubject = { scopeType: 'organization', tenantId: 't1', organizationId: 'o1' }
-
-describe('resolveScheduleAccess — system-scoped schedules', () => {
-  it('allows a super admin whose session carries a tenant and an organization', () => {
-    expect(
-      resolveScheduleAccess(systemSchedule, { tenantId: 't1', orgId: 'o1', isSuperAdmin: true }),
-    ).toBe('allowed')
-  })
-
-  it('allows a super admin whose session carries no tenant', () => {
-    expect(
-      resolveScheduleAccess(systemSchedule, { tenantId: null, orgId: null, isSuperAdmin: true }),
-    ).toBe('allowed')
-  })
-
-  it('forbids a non-super-admin instead of hiding the schedule behind a 404', () => {
-    expect(
-      resolveScheduleAccess(systemSchedule, { tenantId: 't1', orgId: 'o1', isSuperAdmin: false }),
-    ).toBe('forbidden')
-  })
-
-  it('forbids an actor missing the isSuperAdmin flag even when a role is named "superadmin"', () => {
-    expect(
-      resolveScheduleAccess(systemSchedule, { tenantId: 't1', orgId: 'o1' }),
-    ).toBe('forbidden')
-  })
-
-  it('forbids an unauthenticated-shaped actor', () => {
-    expect(resolveScheduleAccess(systemSchedule, null)).toBe('forbidden')
-  })
-})
-
-/**
- * `ensureCanManageSystemScopedJob` in commands/jobs.ts treats a row as system-scoped when
- * `scopeType === 'system' || tenantId == null`. Update, delete, trigger and executions must
- * not disagree about what a system-scoped row is, so the same test is applied here — including
- * for the inconsistent rows the create validator's scope refinement should never produce.
- */
-describe('resolveScheduleAccess — system-scope classification matches commands/jobs.ts', () => {
-  it('treats a null tenant as system-scoped even when an organization is set', () => {
-    expect(
-      resolveScheduleAccess(
-        { scopeType: 'organization', tenantId: null, organizationId: 'o1' },
-        { tenantId: 't1', orgId: 'o1', isSuperAdmin: false },
-      ),
-    ).toBe('forbidden')
-  })
-
-  it('treats scopeType "system" as system-scoped even when a tenant is set', () => {
-    expect(
-      resolveScheduleAccess(
-        { scopeType: 'system', tenantId: 't1', organizationId: null },
-        { tenantId: 't1', orgId: 'o1', isSuperAdmin: false },
-      ),
-    ).toBe('forbidden')
-  })
-
-  // 403 here would tell an actor in t1 that the id exists in t2. Only a genuinely
-  // tenant-less row is allowed to answer `forbidden`.
-  it('does not disclose a tenant-bound "system" row across a tenant boundary', () => {
-    expect(
-      resolveScheduleAccess(
-        { scopeType: 'system', tenantId: 't2', organizationId: null },
-        { tenantId: 't1', orgId: 'o1', isSuperAdmin: false },
-      ),
-    ).toBe('not_found')
-  })
-
-  it('still classifies by nullability when scopeType is absent', () => {
-    expect(
-      resolveScheduleAccess({ tenantId: null, organizationId: null }, { tenantId: 't1', isSuperAdmin: false }),
-    ).toBe('forbidden')
-  })
-})
-
-describe('resolveScheduleAccess — tenant isolation', () => {
-  it('reports another tenant\'s schedule as not_found, never forbidden', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: 't2', orgId: 'o2', isSuperAdmin: false }),
-    ).toBe('not_found')
-  })
-
-  it('hides another tenant\'s schedule from a super admin scoped to a different tenant', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: 't2', orgId: 'o2', isSuperAdmin: true }),
-    ).toBe('not_found')
-  })
-
-  it('fails closed for a non-super-admin whose tenant could not be resolved', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: null, orgId: null, isSuperAdmin: false }),
-    ).toBe('not_found')
-  })
-
-  // The exact shape the replaced lookup leaked: with no tenant clause applied, the filter
-  // `{ id, deletedAt: null, organizationId: 'o1' }` matched org-bound rows in ANY tenant.
-  it('closes the cross-tenant leak for an actor with an org but no resolvable tenant', () => {
-    expect(
-      resolveScheduleAccess(
-        { scopeType: 'organization', tenantId: 't2', organizationId: 'o1' },
-        { tenantId: null, orgId: 'o1', isSuperAdmin: false },
-      ),
-    ).toBe('not_found')
-  })
-
-  // buildSchedulerJobsFilters returns an unmatchable filter when the tenant is falsy, for
-  // super admins too, so such an actor cannot see this row in the list either.
-  it('fails closed for a super admin whose tenant could not be resolved', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: null, orgId: null, isSuperAdmin: true }),
-    ).toBe('not_found')
-  })
-})
-
-describe('resolveScheduleAccess — organization isolation', () => {
-  it('reports another organization\'s schedule in the same tenant as not_found', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: 't1', orgId: 'o2', isSuperAdmin: false }),
-    ).toBe('not_found')
-  })
-
-  it('allows the owning organization', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: 't1', orgId: 'o1', isSuperAdmin: false }),
-    ).toBe('allowed')
-  })
-
-  // Inherited from the lookup this helper replaces, which omitted the organization clause
-  // entirely when the actor carried no orgId. The list endpoint hides the row in this case
-  // (its organization branch needs at least one id), so the two paths disagree. Pinned here
-  // to document the divergence, not to endorse it — narrowing it is a separate change.
-  it('allows an actor with no selected organization to reach an org-bound schedule in its tenant', () => {
-    expect(
-      resolveScheduleAccess(orgSchedule, { tenantId: 't1', orgId: null, isSuperAdmin: false }),
-    ).toBe('allowed')
-  })
-
-  it('keeps a tenant-scoped schedule visible to an org-bound actor in that tenant', () => {
-    expect(
-      resolveScheduleAccess(tenantSchedule, { tenantId: 't1', orgId: 'o1', isSuperAdmin: false }),
-    ).toBe('allowed')
-  })
-
-  it('does not treat an undefined organizationId as a distinct organization', () => {
-    expect(
-      resolveScheduleAccess({ scopeType: 'tenant', tenantId: 't1' }, { tenantId: 't1', orgId: 'o1', isSuperAdmin: false }),
-    ).toBe('allowed')
-  })
-})