@open-mercato/scheduler 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/scheduler",
-  "version": "0.7.0",
+  "version": "0.7.1-develop.7103.1.41ff100d93",
   "license": "MIT",
   "description": "Database-managed scheduled jobs with admin UI",
   "type": "module",
@@ -59,13 +59,13 @@
     "./*/*/*/*/*/*.json": "./src/*/*/*/*/*/*.json"
   },
   "dependencies": {
-    "@open-mercato/events": "0.7.0",
-    "@open-mercato/queue": "0.7.0",
+    "@open-mercato/events": "0.7.1-develop.7103.1.41ff100d93",
+    "@open-mercato/queue": "0.7.1-develop.7103.1.41ff100d93",
     "cron-parser": "^5.6.2"
   },
   "peerDependencies": {
     "@mikro-orm/core": "^7.0.14",
-    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/shared": "0.7.1-develop.7103.1.41ff100d93",
     "bullmq": "^5.0.0 || ^6.0.0",
     "ioredis": "^5.0.0 || ^6.0.0",
     "zod": ">=3.23.0"
@@ -79,7 +79,7 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/shared": "0.7.1-develop.7103.1.41ff100d93",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.1.2",
     "jest": "^30.4.2",
@@ -93,5 +93,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/scheduler"
-  }
+  },
+  "stableVersion": "0.7.0"
 }

package/src/modules/scheduler/__integration__/TC-SCHED-001.spec.ts

@@ -17,8 +17,8 @@ async function createSchedule(request: import('@playwright/test').APIRequestCont
       scheduleType: 'interval',
       scheduleValue: '15m',
       timezone: 'UTC',
-      targetType: 'queue',
-      targetQueue: 'scheduler-execution',
+      targetType: 'command',
+      targetCommand: 'scheduler.test.echo',
       targetPayload: { source: 'integration-test' },
       isEnabled: true,
       sourceType: 'user',

package/src/modules/scheduler/__integration__/TC-SCHED-004.spec.ts

@@ -1,7 +1,10 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from './helpers/scheduler'
+import {
+  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
+  SCHEDULER_TARGETS_PATH,
+} from './helpers/scheduler'
 
 type TargetOption = { value: string; label: string }
 type TargetsResponse = { queues?: TargetOption[]; commands?: TargetOption[] }
@@ -21,12 +24,13 @@ function expectOptionShape(options: TargetOption[], label: string) {
 }
 
 /**
- * TC-SCHED-004: GET /api/scheduler/targets returns available queue names
- * (from module workers) and registered command IDs (from the command
- * registry), both sorted alphabetically by value. Read-only, no fixtures.
+ * TC-SCHED-004: GET /api/scheduler/targets returns scheduler-safe queue names
+ * and registered command IDs (from the command registry), both sorted
+ * alphabetically by value. Internal/system workers must stay undiscoverable.
+ * Read-only, no fixtures.
  */
 test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and commands', () => {
-  test('returns sorted queues (incl. scheduler-execution) and a non-empty command list', async ({ request }) => {
+  test('returns only scheduler-safe queues plus a non-empty sorted command list', async ({ request }) => {
     const token = await getAuthToken(request, 'admin')
 
     const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
@@ -36,12 +40,14 @@ test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and command
     const queues = body?.queues ?? []
     const commands = body?.commands ?? []
 
-    // Queues: non-empty, well-shaped, sorted, and include the known scheduler queue.
+    // Queues: well-shaped, sorted, and free of internal/system worker queues (#5213).
     expect(Array.isArray(body?.queues)).toBe(true)
-    expect(queues.length).toBeGreaterThan(0)
     expectOptionShape(queues, 'queues')
-    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE)
     expectSortedByValue(queues, 'queues')
+    const queueValues = queues.map((queue) => queue.value)
+    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+      expect(queueValues, `internal queue ${forbidden} must not be a scheduler target`).not.toContain(forbidden)
+    }
 
     // Commands: non-empty, well-shaped, and sorted.
     expect(Array.isArray(body?.commands)).toBe(true)

package/src/modules/scheduler/__integration__/TC-SCHED-007.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from './helpers/scheduler'
+import { SCHEDULER_JOBS_PATH, SCHEDULER_TEST_COMMAND, uniqueScheduleName } from './helpers/scheduler'
 
 type ValidationError = { error?: string; details?: Array<{ path?: Array<string | number> }> }
 
@@ -36,8 +36,8 @@ test.describe('TC-SCHED-007: POST /api/scheduler/jobs validates schedule value f
           scheduleType: testCase.scheduleType,
           scheduleValue: testCase.scheduleValue,
           timezone: 'UTC',
-          targetType: 'queue',
-          targetQueue: SCHEDULER_EXECUTION_QUEUE,
+          targetType: 'command',
+          targetCommand: SCHEDULER_TEST_COMMAND,
           isEnabled: true,
           sourceType: 'user',
         },

package/src/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.ts

@@ -0,0 +1,90 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
+  SCHEDULER_JOBS_PATH,
+  SCHEDULER_TARGETS_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  getScheduleJobById,
+  uniqueScheduleName,
+} from './helpers/scheduler'
+
+/**
+ * TC-SCHED-008: Scheduler queue targets are restricted to authorized safe
+ * workers (#5213). A principal holding only `scheduler.jobs.manage` must not be
+ * able to aim a schedule at an internal/system worker queue with an arbitrary
+ * payload — neither at creation, nor by retargeting later.
+ */
+test.describe('TC-SCHED-008: scheduler queue targets restricted to safe workers', () => {
+  for (const forbiddenQueue of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+    test(`rejects creating a schedule targeting the ${forbiddenQueue} worker`, async ({ request }) => {
+      const token = await getAuthToken(request, 'admin')
+
+      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          name: uniqueScheduleName('Forbidden Queue Target'),
+          scopeType: 'organization',
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          timezone: 'UTC',
+          targetType: 'queue',
+          targetQueue: forbiddenQueue,
+          targetPayload: { scope: { tenantId: 'forged', organizationId: 'forged' } },
+          isEnabled: true,
+          sourceType: 'user',
+        },
+      })
+
+      expect(response.status(), `${forbiddenQueue} must not be schedulable`).toBe(400)
+      const body = await readJsonSafe<{ error?: string; details?: Array<{ path?: Array<string | number> }> }>(response)
+      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))
+      expect(issuePaths).toContain('targetQueue')
+    })
+  }
+
+  test('rejects retargeting an existing schedule to an internal worker queue', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+
+    try {
+      scheduleId = await createScheduleJob(request, token, { name: uniqueScheduleName('Retarget Guard') })
+
+      const response = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          id: scheduleId,
+          targetType: 'queue',
+          targetQueue: 'stripe-webhook',
+        },
+      })
+
+      // Enforcement lives in the update command (change-detection vs the stored
+      // row), so an actual retarget lands as 422 with the approval error.
+      expect(response.status()).toBe(422)
+      const body = await readJsonSafe<{ error?: string }>(response)
+      expect(body?.error ?? '').toMatch(/not an approved scheduler target/i)
+
+      const unchanged = await getScheduleJobById(request, token, scheduleId)
+      expect(unchanged).not.toBeNull()
+      expect(unchanged!.targetType).toBe('command')
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId)
+    }
+  })
+
+  test('targets endpoint keeps internal worker queues undiscoverable', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+
+    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
+    expect(response.status()).toBe(200)
+
+    const body = await readJsonSafe<{ queues?: Array<{ value: string }> }>(response)
+    const values = (body?.queues ?? []).map((queue) => queue.value)
+    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+      expect(values).not.toContain(forbidden)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-008.spec.ts

@@ -0,0 +1,94 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  SCHEDULER_JOBS_PATH,
+  SCHEDULER_TRIGGER_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  uniqueScheduleName,
+} from './helpers/scheduler'
+
+const isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || 'local') === 'async'
+
+type TriggerBody = { ok?: boolean; jobId?: string; error?: string; message?: string }
+
+/**
+ * TC-SCHED-008: POST /api/scheduler/trigger and GET /api/scheduler/jobs/[id]/executions
+ * resolve the scope of a system-scoped schedule on the loaded row, not in the lookup.
+ *
+ * A system-scoped schedule has `tenantId === null` and `organizationId === null`. When both
+ * routes folded the caller's tenant/org into the `where` clause, no such row could ever match
+ * and every caller — super admins included — got 404, which also masked each route's own
+ * super-admin gate. A super admin must now reach the schedule, and a non-super-admin must be
+ * told 403 rather than 404.
+ *
+ * The super-admin assertions hold under either queue strategy: each route's
+ * `QUEUE_STRATEGY=async` check sits after the lookup, so `local` yields the pre-existing
+ * 400 — never 404.
+ */
+test.describe('TC-SCHED-008: system-scoped schedule access on trigger and executions', () => {
+  test('super admin reaches the schedule on both routes; a non-super-admin is forbidden', async ({ request }) => {
+    const superToken = await getAuthToken(request, 'superadmin')
+    const adminToken = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+
+    try {
+      // Creating a system-scoped schedule is itself super-admin only.
+      scheduleId = await createScheduleJob(request, superToken, {
+        name: uniqueScheduleName('System-Trigger-Test'),
+        scopeType: 'system',
+        scheduleType: 'interval',
+        scheduleValue: '1h',
+      })
+
+      const superResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
+        token: superToken,
+        data: { id: scheduleId },
+      })
+      const superBody = await readJsonSafe<TriggerBody>(superResponse)
+      expect(
+        superResponse.status(),
+        'a super admin must not be told a system-scoped schedule does not exist',
+      ).not.toBe(404)
+
+      if (isAsyncQueueStrategy) {
+        expect(superResponse.status()).toBe(200)
+        expect(superBody?.ok).toBe(true)
+        expect(typeof superBody?.jobId === 'string' && superBody.jobId.length > 0).toBe(true)
+      } else {
+        // The strategy check runs after the scope check, so this 400 is the response the
+        // 404 used to mask.
+        expect(superResponse.status()).toBe(400)
+        expect(superBody?.error ?? '').toMatch(/async/i)
+      }
+
+      // The same schedule is visible enough to be refused, not hidden, from a tenant admin.
+      const adminResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
+        token: adminToken,
+        data: { id: scheduleId },
+      })
+      expect(
+        adminResponse.status(),
+        'a non-super-admin must be forbidden from triggering a system-scoped schedule',
+      ).toBe(403)
+
+      // The execution-history route carried the same lookup and needs the same guarantees.
+      const executionsPath = `${SCHEDULER_JOBS_PATH}/${scheduleId}/executions`
+      const superExecutions = await apiRequest(request, 'GET', executionsPath, { token: superToken })
+      expect(
+        superExecutions.status(),
+        'a super admin must not be told a system-scoped schedule has no execution history route',
+      ).not.toBe(404)
+      expect(superExecutions.status()).toBe(isAsyncQueueStrategy ? 200 : 400)
+
+      const adminExecutions = await apiRequest(request, 'GET', executionsPath, { token: adminToken })
+      expect(
+        adminExecutions.status(),
+        'a non-super-admin must be forbidden from reading a system-scoped execution history',
+      ).toBe(403)
+    } finally {
+      await deleteScheduleJob(request, superToken, scheduleId)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-CRUDFORM-001.spec.ts

@@ -90,7 +90,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetPayload: createPayload,
           isEnabled: true,
           sourceType: 'user',
@@ -105,7 +105,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetCommand: null,
           targetPayload: createPayload,
           isEnabled: true,
@@ -133,7 +133,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '0 0 * * *',
           timezone: 'Europe/Warsaw',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetCommand: null,
           targetPayload: updatePayload,
           isEnabled: false,

package/src/modules/scheduler/__integration__/TC-UNDO-001-scheduler-jobs.spec.ts

@@ -1,86 +1,174 @@
-import { expect, test } from '@playwright/test'
+import { expect, test, type APIRequestContext, type APIResponse } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
-import {
-  extractOperation,
-  runCrudUndoRoundTrip,
-  skipIfUndoTestsDisabled,
-} from '@open-mercato/core/helpers/integration/undoHarness'
-import {
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TRIGGER_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-} from './helpers/scheduler'
 
 /**
- * TC-UNDO-001 (#2582, refs #2468) — scheduler.jobs undo/redo correctness.
+ * TC-UNDO-001: scheduler.jobs undo round-trip (regression for issue #2504).
  *
- * Regression lock for #2504: scheduler.jobs undo was a silent no-op because every
- * undo handler read `logEntry.payload` (always undefined — the command bus persists
- * the undo snapshot under `commandPayload`), so undo returned `{ ok: true }` while
- * changing nothing. Fixed in PR #2514 via `extractUndoPayload`. This spec asserts the
- * corrected behavior (full restoration), driving the real command bus through the
- * public API + the audit-log undo/redo endpoints.
+ * Before the fix, every scheduler.jobs undo handler read `logEntry.payload`
+ * (always undefined — the command bus persists the undo snapshot under
+ * `commandPayload`), so undo returned `{ ok: true }` while silently changing
+ * nothing. This spec exercises the real HTTP path end-to-end:
+ *   - CREATE -> undo  => job is soft-deleted (no longer listed)
+ *   - UPDATE -> undo  => renamed field is restored to its prior value
+ *   - DELETE -> undo  => soft-deleted job is re-materialized
  *
- * scheduler.jobs is a standard `makeCrudRoute` entity (POST/PUT/DELETE on the
- * collection, `?id=` read-back, camelCase serializer, no custom fields), so the shared
- * `runCrudUndoRoundTrip` harness covers the full round-trip in one pass:
- *   - I1 update → undo restores every scalar (and bumps `updatedAt`)
- *   - I2 delete → undo re-materializes the soft-deleted job
- *   - I3 create → undo soft-deletes (never hard-deletes)
- *   - I5 a consumed undo token is rejected on a second undo
- *   - I6 redo re-applies the command's after-snapshot
- *
- * I4 (custom fields) is N/A — `scheduled_job` declares no `ce.ts`, so it has no `cf_*`.
+ * Endpoints covered:
+ *   - POST   /api/scheduler/jobs                       (create)
+ *   - GET    /api/scheduler/jobs?id=                   (read)
+ *   - PUT    /api/scheduler/jobs                       (update)
+ *   - DELETE /api/scheduler/jobs                       (delete, cleanup)
+ *   - POST   /api/audit_logs/audit-logs/actions/undo   (undo)
  */
-function jobCreatePayload(stamp: string): Record<string, unknown> {
-  return {
-    name: `TC-UNDO-001 Scheduler ${stamp}`,
-    description: 'TC-UNDO-001 undo/redo probe',
-    scopeType: 'organization',
-    scheduleType: 'interval',
-    scheduleValue: '15m',
-    timezone: 'UTC',
-    targetType: 'queue',
-    targetQueue: 'scheduler-execution',
-    isEnabled: true,
-    sourceType: 'user',
-  }
+
+type ScheduleRow = {
+  id: string
+  name: string
+  description: string | null
+  scheduleValue: string
+}
+
+// The undo endpoint only honors the *latest* undoable log for a resource, and
+// `latestUndoableForResource` orders by `created_at` alone. Audit `created_at` is
+// millisecond-precision (`new Date()` at log time), so a create + a follow-up
+// mutation issued within the same millisecond tie and the lookup may resolve to
+// the wrong log. A short settle guarantees the operation under undo is strictly
+// the most recent, keeping the round-trip deterministic.
+async function settleAuditClock(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 50))
+}
+
+function readUndoToken(res: APIResponse): string {
+  const header = res.headers()['x-om-operation'] ?? ''
+  const enc = header.startsWith('omop:') ? header.slice(5) : ''
+  expect(enc, 'x-om-operation header should carry an omop: payload').not.toBe('')
+  const payload = JSON.parse(decodeURIComponent(enc)) as { undoToken?: string }
+  expect(typeof payload.undoToken, 'undoToken present in operation payload').toBe('string')
+  return payload.undoToken as string
+}
+
+async function getById(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<ScheduleRow | undefined> {
+  const res = await apiRequest(request, 'GET', `/api/scheduler/jobs?id=${encodeURIComponent(id)}`, { token })
+  expect(res.status()).toBe(200)
+  const body = (await res.json()) as { items?: ScheduleRow[] }
+  return (body.items ?? [])[0]
 }
 
-test.describe('TC-UNDO-001 scheduler.jobs undo/redo (#2504)', () => {
-  test.beforeAll(() => {
-    skipIfUndoTestsDisabled()
+async function createJob(request: APIRequestContext, token: string, name: string): Promise<{ id: string; res: APIResponse }> {
+  const res = await apiRequest(request, 'POST', '/api/scheduler/jobs', {
+    token,
+    data: {
+      name,
+      description: 'TC-UNDO-001 probe',
+      scopeType: 'tenant',
+      scheduleType: 'cron',
+      scheduleValue: '0 0 * * *',
+      timezone: 'UTC',
+      targetType: 'command',
+      targetCommand: 'scheduler.test.echo',
+      isEnabled: true,
+      sourceType: 'user',
+    },
   })
+  expect(res.status(), 'create returns 201').toBe(201)
+  const id = ((await res.json()) as { id: string }).id
+  expect(id, 'create returns an id').toBeTruthy()
+  return { id, res }
+}
+
+async function undo(request: APIRequestContext, token: string, undoToken: string): Promise<void> {
+  const res = await apiRequest(request, 'POST', '/api/audit_logs/audit-logs/actions/undo', {
+    token,
+    data: { undoToken },
+  })
+  const raw = await res.text()
+  expect(res.status(), `undo returns 200 (body: ${raw})`).toBe(200)
+  const body = JSON.parse(raw) as { ok?: boolean }
+  expect(body.ok, 'undo body is { ok: true }').toBe(true)
+}
+
+async function cleanup(request: APIRequestContext, token: string | null, id: string | null): Promise<void> {
+  if (!token || !id) return
+  try {
+    await apiRequest(request, 'DELETE', '/api/scheduler/jobs', { token, data: { id } })
+  } catch {
+    /* ignore */
+  }
+}
+
+test.describe('TC-UNDO-001: scheduler.jobs undo actually restores state (#2504)', () => {
+  test('UPDATE -> undo restores the prior name', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const originalName = `TC-UNDO-001 Update ${Date.now()}`
+      ;({ id } = await createJob(request, token, originalName))
+      await settleAuditClock()
 
-  test('jobs CRUD commands restore scalar state on undo/redo (I1/I2/I3/I5/I6)', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
+      const updateRes = await apiRequest(request, 'PUT', '/api/scheduler/jobs', {
+        token,
+        data: { id, name: `${originalName} RENAMED` },
+      })
+      expect(updateRes.status(), 'update returns 200').toBe(200)
+      expect((await getById(request, token, id))?.name).toBe(`${originalName} RENAMED`)
 
-    await runCrudUndoRoundTrip(request, token, {
-      label: 'scheduler.jobs',
-      collectionPath: SCHEDULER_JOBS_PATH,
-      field: 'name',
-      createPayload: jobCreatePayload,
-      updatePayload: (id, stamp) => ({ id, name: `TC-UNDO-001 Scheduler Renamed ${stamp}` }),
-    })
+      await undo(request, token, readUndoToken(updateRes))
+
+      const restored = await getById(request, token, id)
+      expect(restored, 'job still exists after update-undo').toBeTruthy()
+      expect(restored!.name, 'name restored to original by undo').toBe(originalName)
+    } finally {
+      await cleanup(request, token, id)
+    }
   })
 
-  // §4 — manual trigger is a fire-and-forget enqueue that never goes through the
-  // command bus, so it exposes no undo affordance. The assertion holds regardless of
-  // QUEUE_STRATEGY: async returns 200 (enqueued), local returns 400 (rejected) — neither
-  // issues an `x-om-operation` undo token.
-  test('§4 trigger exposes no undo token', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
-    let jobId: string | null = null
+  test('DELETE -> undo re-lists the soft-deleted job', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
     try {
-      jobId = await createScheduleJob(request, token)
-      const triggerRes = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
+      token = await getAuthToken(request, 'admin')
+      const name = `TC-UNDO-001 Delete ${Date.now()}`
+      ;({ id } = await createJob(request, token, name))
+      await settleAuditClock()
+
+      const deleteRes = await apiRequest(request, 'DELETE', '/api/scheduler/jobs', {
         token,
-        data: { id: jobId },
+        data: { id },
       })
-      expect(extractOperation(triggerRes), 'trigger response carries no undo token (§4)').toBeNull()
+      expect(deleteRes.status(), 'delete returns 200').toBe(200)
+      expect(await getById(request, token, id), 'job is gone after delete').toBeFalsy()
+
+      await undo(request, token, readUndoToken(deleteRes))
+
+      const restored = await getById(request, token, id)
+      expect(restored, 'job re-materialized by delete-undo').toBeTruthy()
+      expect(restored!.name).toBe(name)
+    } finally {
+      await cleanup(request, token, id)
+    }
+  })
+
+  test('CREATE -> undo removes the created job', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const name = `TC-UNDO-001 Create ${Date.now()}`
+      const created = await createJob(request, token, name)
+      id = created.id
+
+      expect(await getById(request, token, id), 'job exists after create').toBeTruthy()
+
+      await undo(request, token, readUndoToken(created.res))
+
+      expect(await getById(request, token, id), 'job removed by create-undo').toBeFalsy()
+      id = null // already undone; nothing to clean up
     } finally {
-      await deleteScheduleJob(request, token, jobId)
+      await cleanup(request, token, id)
     }
   })
 })

package/src/modules/scheduler/__integration__/helpers/scheduler.ts

@@ -6,9 +6,25 @@ export const SCHEDULER_JOBS_PATH = '/api/scheduler/jobs'
 export const SCHEDULER_TARGETS_PATH = '/api/scheduler/targets'
 export const SCHEDULER_TRIGGER_PATH = '/api/scheduler/trigger'
 
-/** Queue registered by the scheduler module's execute-schedule worker. */
+/** Queue registered by the scheduler module's execute-schedule worker (internal, not schedulable). */
 export const SCHEDULER_EXECUTION_QUEUE = 'scheduler-execution'
 
+/** Deliberately side-effect-free queue whose worker opted into scheduling (#5213). */
+export const SCHEDULER_TEST_QUEUE = 'scheduler-test'
+
+/**
+ * Internal queues that must never be offered as scheduler targets (#5213).
+ * Workers must opt in via `schedulerSafe: true` to become schedulable.
+ */
+export const SCHEDULER_FORBIDDEN_INTERNAL_QUEUES = [
+  SCHEDULER_EXECUTION_QUEUE,
+  'stripe-webhook',
+  'payment-gateways-webhook',
+] as const
+
+/** Always-registered command used by fixtures now that queue targets are restricted. */
+export const SCHEDULER_TEST_COMMAND = 'scheduler.test.echo'
+
 export type SchedulerJob = {
   id: string
   name: string
@@ -51,16 +67,19 @@ export function uniqueScheduleName(prefix: string): string {
 }
 
 /**
- * Create an organization-scoped queue-target schedule via the API and return its id.
+ * Create an organization-scoped schedule via the API and return its id.
  * Org/tenant are derived server-side from the caller's auth context, so the caller
  * only needs an admin (or otherwise scheduler.jobs.manage) token.
+ *
+ * Defaults to a command target: user-authored queue targets are restricted to
+ * scheduler-safe queues (#5213), so fixtures must not assume a queue is allowed.
  */
 export async function createScheduleJob(
   request: APIRequestContext,
   token: string,
   overrides: CreateScheduleOverrides = {},
 ): Promise<string> {
-  const targetType = overrides.targetType ?? 'queue'
+  const targetType = overrides.targetType ?? 'command'
   const data: Record<string, unknown> = {
     name: overrides.name ?? uniqueScheduleName('Integration Scheduler'),
     description: overrides.description ?? 'Created by scheduler integration tests',
@@ -74,9 +93,9 @@ export async function createScheduleJob(
     sourceType: overrides.sourceType ?? 'user',
   }
   if (targetType === 'command') {
-    data.targetCommand = overrides.targetCommand
+    data.targetCommand = overrides.targetCommand ?? SCHEDULER_TEST_COMMAND
   } else {
-    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE
+    data.targetQueue = overrides.targetQueue ?? SCHEDULER_TEST_QUEUE
   }
 
   const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, { token, data })