@open-mercato/scheduler 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/scheduler/api/jobs/[id]/executions/route.ts

@@ -5,6 +5,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/core'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { ScheduledJob } from '../../../../data/entities.js'
+import { resolveScheduleAccess } from '../../../../lib/scheduleAccess.js'
 import { getRedisUrlOrThrow, parseRedisUrl } from '@open-mercato/shared/lib/redis/connection'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -40,30 +41,19 @@ export async function GET(
   const scheduleId = params.id
 
   try {
-    // Verify schedule exists and user has access (with tenant/org scope filter)
-    const findFilter: Record<string, unknown> = {
-      id: scheduleId,
-      deletedAt: null,
-    }
-
-    // Apply tenant isolation: scope the query to the user's tenant/org
-    if (auth.tenantId) {
-      findFilter.tenantId = auth.tenantId
-    }
-    if (auth.orgId) {
-      findFilter.organizationId = auth.orgId
-    }
-
-    const schedule = await em.findOne(ScheduledJob, findFilter)
+    // Load by id alone, then apply isolation to the loaded row. Folding the actor's
+    // tenant/org into the lookup would make every system-scoped schedule unmatchable.
+    const schedule = await em.findOne(ScheduledJob, { id: scheduleId, deletedAt: null })
 
     if (!schedule) {
       return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
     }
 
-    // System-scoped schedules (no tenantId/orgId) require super-admin. Use the
-    // immutable `isSuperAdmin` flag — never compare mutable/spoofable role names.
-    const isSuperAdmin = auth.isSuperAdmin === true
-    if (!schedule.tenantId && !schedule.organizationId && !isSuperAdmin) {
+    const access = resolveScheduleAccess(schedule, auth)
+    if (access === 'not_found') {
+      return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
+    }
+    if (access === 'forbidden') {
       return NextResponse.json({ error: translate('scheduler.error.access_denied', 'Access denied') }, { status: 403 })
     }
 

package/src/modules/scheduler/api/targets/__tests__/route.test.ts

@@ -50,8 +50,8 @@ describe('GET /api/scheduler/targets', () => {
       orgId: 'org-1',
     })
     ;(getModules as jest.Mock).mockReturnValue([
-      { workers: [{ queue: 'z-queue' }] },
-      { workers: [{ queue: 'a-queue' }] },
+      { workers: [{ queue: 'z-queue' }, { queue: 'internal-queue' }] },
+      { workers: [{ queue: 'a-queue', schedulerSafe: true }] },
     ])
   })
 
@@ -60,14 +60,13 @@ describe('GET /api/scheduler/targets', () => {
     unregisterCommand(unsafeCommand.id)
   })
 
-  it('lists only scheduler-safe commands', async () => {
+  it('lists only scheduler-safe queues and commands', async () => {
     const response = await GET(new NextRequest('http://localhost/api/scheduler/targets'))
     const body = await response.json()
 
     expect(response.status).toBe(200)
     expect(body.queues).toEqual([
       { value: 'a-queue', label: 'a-queue' },
-      { value: 'z-queue', label: 'z-queue' },
     ])
     expect(body.commands).toEqual([
       { value: safeCommand.id, label: safeCommand.id },

package/src/modules/scheduler/api/targets/route.ts

@@ -1,10 +1,10 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
-import { getModules } from '@open-mercato/shared/lib/modules/registry'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { listSchedulerSafeCommands } from '../../lib/scheduler-safe-commands'
+import { listSchedulerSafeQueueTargets } from '../../lib/safeQueueTargets'
 
 export const metadata = {
   requireAuth: true,
@@ -13,7 +13,9 @@ export const metadata = {
 
 /**
  * GET /api/scheduler/targets
- * Returns available queue names and command IDs for schedule target selection.
+ * Returns scheduler-safe queue names and command IDs for schedule target selection.
+ * Only queues whose workers opted into scheduling (`schedulerSafe: true`) are
+ * advertised; internal and system-only workers stay undiscoverable (#5213).
  */
 export async function GET(req: NextRequest) {
   const auth = await getAuthFromRequest(req)
@@ -21,20 +23,8 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  const modules = getModules()
-
-  const queueSet = new Set<string>()
-  for (const mod of modules) {
-    if (mod.workers) {
-      for (const worker of mod.workers) {
-        queueSet.add(worker.queue)
-      }
-    }
-  }
-
-  const queues = Array.from(queueSet)
-    .sort((a, b) => a.localeCompare(b))
-    .map((queue) => ({ value: queue, label: queue }))
+  const queues = listSchedulerSafeQueueTargets()
+    .map((target) => ({ value: target.queue, label: target.queue }))
 
   const commands = listSchedulerSafeCommands()
     .filter((command) => commandRegistry.has(command.commandId))
@@ -66,7 +56,6 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       operationId: 'listScheduleTargets',
       summary: 'List available queues and commands',
-      description: 'Returns all registered queue names (from module workers) and explicitly scheduler-safe command IDs that can be used as schedule targets.',
       responses: [
         {
           status: 200,

package/src/modules/scheduler/api/trigger/route.ts

@@ -7,6 +7,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createQueue } from '@open-mercato/queue'
 import { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'
 import { ScheduledJob } from '../../data/entities.js'
+import { resolveScheduleAccess } from '../../lib/scheduleAccess.js'
 import { scheduleTriggerSchema } from '../../data/validators.js'
 import type { ExecuteSchedulePayload } from '../../workers/execute-schedule.worker.js'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -40,30 +41,19 @@ export async function POST(req: NextRequest) {
     const body = await req.json()
     const input = scheduleTriggerSchema.parse(body)
 
-    // Find the schedule with tenant/org scope filter
-    const findFilter: Record<string, unknown> = {
-      id: input.id,
-      deletedAt: null,
-    }
-
-    // Apply tenant isolation: scope the query to the user's tenant/org
-    if (auth.tenantId) {
-      findFilter.tenantId = auth.tenantId
-    }
-    if (auth.orgId) {
-      findFilter.organizationId = auth.orgId
-    }
-
-    const schedule = await em.findOne(ScheduledJob, findFilter)
+    // Load by id alone, then apply isolation to the loaded row. Folding the actor's
+    // tenant/org into the lookup would make every system-scoped schedule unmatchable.
+    const schedule = await em.findOne(ScheduledJob, { id: input.id, deletedAt: null })
 
     if (!schedule) {
       return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
     }
 
-    // System-scoped schedules (no tenantId/orgId) require super-admin. Use the
-    // immutable `isSuperAdmin` flag — never compare mutable/spoofable role names.
-    const isSuperAdmin = auth.isSuperAdmin === true
-    if (!schedule.tenantId && !schedule.organizationId && !isSuperAdmin) {
+    const access = resolveScheduleAccess(schedule, auth)
+    if (access === 'not_found') {
+      return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
+    }
+    if (access === 'forbidden') {
       return NextResponse.json({ error: translate('scheduler.error.access_denied', 'Access denied') }, { status: 403 })
     }
 

package/src/modules/scheduler/backend/config/scheduled-jobs/page.tsx

@@ -39,6 +39,7 @@ type SchedulesResponse = {
   total?: number
   page?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 function mapApiItem(item: Record<string, unknown>): ScheduleRow | null {
@@ -82,6 +83,7 @@ export default function SchedulerPage() {
   const [pageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [isLoading, setIsLoading] = React.useState(false)
   const scopeVersion = useOrganizationScopeVersion()
@@ -104,6 +106,7 @@ export default function SchedulerPage() {
       setRows(mapped)
       setTotal(result?.total ?? 0)
       setTotalPages(result?.totalPages ?? 1)
+      setTotalIsCapped(result?.totalIsCapped === true)
     } catch (error) {
       flash(t('scheduler.error.fetch_failed', 'Failed to load schedules'), 'error')
       setRows([])
@@ -282,7 +285,7 @@ export default function SchedulerPage() {
               createLabel={t('scheduler.action.create', 'New Schedule')}
             />
           )}
-          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+          pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}
           isLoading={isLoading}
           searchValue={search}
           onSearchChange={(value) => { setSearch(value); setPage(1) }}

package/src/modules/scheduler/cli.ts

@@ -3,6 +3,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/core'
 import { ScheduledJob } from './data/entities.js'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { auditSchedulerModuleQueueRows } from './lib/safeQueueTargets'
 
 const writeLine = (text = '') => {
   process.stdout.write(`${text}\n`)
@@ -225,4 +226,46 @@ const startCommand: ModuleCli = {
   },
 }
 
-export default [listCommand, statusCommand, runCommand, startCommand]
+// Lists every persisted module-authored queue-target row with its current
+// dispatch verdict (#5213). Rows authored before the hardening by a
+// non-user-bound API key are indistinguishable from genuine registrations at
+// rest, so operators review the ALLOWED entries against their known integrations.
+const auditQueueTargetsCommand: ModuleCli = {
+  command: 'audit-queue-targets',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as EntityManager
+
+    const where: Record<string, unknown> = { deletedAt: null, sourceType: 'module' }
+    if (args.tenant || args.tenantId) where.tenantId = args.tenant || args.tenantId
+
+    const rows = await em.find(ScheduledJob, where, {
+      orderBy: { name: 'ASC' },
+    })
+
+    const audits = auditSchedulerModuleQueueRows(rows)
+
+    writeLine(`Module-authored queue-target schedules: ${audits.length}`)
+    let allowedCount = 0
+    for (const audit of audits) {
+      const verdict = audit.dispatchAllowed ? 'ALLOWED' : 'blocked'
+      if (audit.dispatchAllowed) allowedCount += 1
+      writeLine(
+        `[${verdict}] ${audit.scheduleId}${audit.name ? ` — ${audit.name}` : ''}` +
+        ` module=${audit.sourceModule ?? '(none)'} queue=${audit.targetQueue ?? '(none)'}` +
+        ` enabled=${audit.isEnabled ? 'yes' : 'no'}`,
+      )
+    }
+
+    if (allowedCount > 0) {
+      writeLine('')
+      writeLine(`Review the ${allowedCount} ALLOWED row(s) above against your known module integrations.`)
+      writeLine('Pre-upgrade rows created with a non-user-bound API key cannot be distinguished')
+      writeLine('from genuine registrations at rest; disable anything unrecognized:')
+      writeLine('  yarn mercato scheduler list --tenant <tenantId>')
+    }
+  },
+}
+
+export default [listCommand, statusCommand, runCommand, startCommand, auditQueueTargetsCommand]

package/src/modules/scheduler/commands/__tests__/jobs.target-guard.test.ts

@@ -0,0 +1,177 @@
+export {}
+
+const registerCommand = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/commands', () => ({
+  registerCommand,
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: jest.fn().mockResolvedValue({
+    translate: (_key: string, fallback?: string) => fallback ?? _key,
+  }),
+}))
+
+function loadCommands() {
+  let update: any
+  jest.isolateModules(() => {
+    require('../jobs')
+    update = registerCommand.mock.calls.find(([cmd]) => cmd.id === 'scheduler.jobs.update')?.[0]
+  })
+  return update
+}
+
+const safeQueueRow = {
+  id: 'job-1',
+  name: 'QA queue schedule',
+  scopeType: 'organization',
+  tenantId: 'tenant-a',
+  organizationId: 'org-a',
+  isEnabled: true,
+  scheduleType: 'interval',
+  scheduleValue: '15m',
+  timezone: 'UTC',
+  targetType: 'queue',
+  targetQueue: 'scheduler-test',
+  targetCommand: null,
+  // nested payload the UI round-trips verbatim
+  targetPayload: { source: 'integration-test', retries: { max: 5 } },
+  sourceType: 'user',
+  sourceModule: null,
+}
+
+const moduleOwnedRow = {
+  ...safeQueueRow,
+  id: 'job-module',
+  name: 'Module-owned schedule',
+  sourceType: 'module',
+  sourceModule: 'legacy_module',
+  createdByUserId: null,
+}
+
+function makeEm(schedule: Record<string, unknown>) {
+  return {
+    fork: jest.fn().mockReturnThis(),
+    findOne: jest.fn().mockResolvedValue(schedule),
+    persist: jest.fn(),
+    flush: jest.fn().mockResolvedValue(undefined),
+    count: jest.fn().mockResolvedValue(0),
+  }
+}
+
+describe('scheduler.jobs.update target-change detection (#5213 N1)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.resetModules()
+  })
+
+  it('allows an operational-only save of a module-authored schedule whose form resends the unchanged target', async () => {
+    const update = loadCommands()
+    const em = makeEm(moduleOwnedRow)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    const result = await update.execute(
+      {
+        id: moduleOwnedRow.id,
+        // the shipped edit form always resends every field…
+        targetType: moduleOwnedRow.targetType,
+        targetQueue: moduleOwnedRow.targetQueue,
+        targetPayload: moduleOwnedRow.targetPayload,
+        // …while the operator only changed operational values
+        name: 'Renamed by ops',
+        scheduleValue: '30m',
+        scheduleType: 'interval',
+        isEnabled: false,
+      },
+      ctx,
+    )
+
+    expect(result).toEqual({ ok: true })
+    expect(em.flush).toHaveBeenCalled()
+  })
+
+  it('still blocks an actual target or payload change on a module-authored schedule', async () => {
+    const update = loadCommands()
+    const em = makeEm(moduleOwnedRow)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    await expect(
+      update.execute({ id: moduleOwnedRow.id, targetQueue: 'stripe-webhook' }, ctx),
+    ).rejects.toMatchObject({ status: 403 })
+    await expect(
+      update.execute({ id: moduleOwnedRow.id, targetPayload: { forged: true } }, ctx),
+    ).rejects.toMatchObject({ status: 403 })
+    expect(em.flush).not.toHaveBeenCalled()
+  })
+
+  it('lets admins disable a legacy user-authored row whose stored queue is no longer approved (#5213 N1)', async () => {
+    const update = loadCommands()
+    const legacyUnsafe = {
+      ...safeQueueRow,
+      id: 'job-legacy',
+      targetQueue: 'stripe-webhook',
+      targetPayload: null as unknown,
+    }
+    const em = makeEm(legacyUnsafe)
+    const ctx = {
+      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    // the shipped edit form resends every field — target fields included —
+    // while only flipping the switch
+    const result = await update.execute(
+      {
+        id: legacyUnsafe.id,
+        targetType: legacyUnsafe.targetType,
+        targetQueue: legacyUnsafe.targetQueue,
+        isEnabled: false,
+      },
+      ctx,
+    )
+    expect(result).toEqual({ ok: true })
+
+    // retargeting onto another unapproved queue is still rejected
+    await expect(
+      update.execute({ id: legacyUnsafe.id, targetQueue: 'payment-gateways-webhook' }, ctx),
+    ).rejects.toMatchObject({ status: 422 })
+  })
+
+  it('treats an empty-object stored payload as equal to the null the form submits (#5213 N1-residual)', async () => {
+    const update = loadCommands()
+    const emptyPayloadRow = {
+      ...moduleOwnedRow,
+      id: 'job-module-empty-payload',
+      targetPayload: {},
+    }
+    const em = makeEm(emptyPayloadRow)
+    const ctx = {
+      auth: { isSuperAdmin: true, tenantId: null, orgId: null, sub: 'super-1' },
+      container: { resolve: jest.fn(() => em) },
+    }
+
+    // ai_assistant-style registration stores `targetPayload: {}`; the edit form
+    // normalizes that to `targetPayload: null` on submit. An operational save
+    // must not trip the module-owned-target guard over the shape difference.
+    const result = await update.execute(
+      {
+        id: emptyPayloadRow.id,
+        targetType: emptyPayloadRow.targetType,
+        targetQueue: emptyPayloadRow.targetQueue,
+        targetPayload: null,
+        name: 'Renamed by ops',
+        isEnabled: true,
+      },
+      ctx,
+    )
+
+    expect(result).toEqual({ ok: true })
+    expect(em.flush).toHaveBeenCalled()
+  })
+})

package/src/modules/scheduler/commands/jobs.ts

@@ -14,7 +14,12 @@ import type {
 } from '../data/validators.js'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { BullMQSchedulerService } from '../services/bullmqSchedulerService.js'
-
+import {
+  assertSchedulerQueueTargetAuthorized,
+  isSchedulerSafeQueue,
+  validateSchedulerTargetPayload,
+} from '../lib/safeQueueTargets.js'
+import type { SchedulerTargetRbacService } from '../lib/safeQueueTargets.js'
 /**
  * Snapshot of a schedule for undo/redo
  */
@@ -83,6 +88,64 @@ function toDate(value: Date | string | null | undefined): Date | null {
   return value instanceof Date ? value : new Date(value)
 }
 
+function canonicalJson(value: unknown): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value ?? null)
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, v]) => v !== undefined)
+    .sort(([a], [b]) => a.localeCompare(b))
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`
+}
+
+function normalizeTargetPayloadValue(value: unknown): unknown {
+  // `schedulerService.register()` persists `{}` as-is while the edit form sends
+  // `null` for an empty payload — treat the three empty shapes as equal (#5213).
+  if (value !== null && typeof value === 'object' && !Array.isArray(value)
+      && Object.keys(value as Record<string, unknown>).length === 0) return null
+  return value
+}
+
+function targetPayloadChanged(inputValue: unknown, storedValue: unknown): boolean {
+  return targetValueChanged(
+    normalizeTargetPayloadValue(inputValue),
+    normalizeTargetPayloadValue(storedValue),
+  )
+}
+
+function targetValueChanged(inputValue: unknown, storedValue: unknown): boolean {
+  if (inputValue === undefined) return false
+  return canonicalJson(inputValue ?? null) !== canonicalJson(storedValue ?? null)
+}
+
+type QueueTargetAuthorizationContext = CommandRuntimeContext
+
+async function assertQueueTargetAuthorizedForActor(
+  ctx: QueueTargetAuthorizationContext,
+  queue: string,
+): Promise<void> {
+  const rbacService = (() => {
+    try {
+      return ctx.container?.resolve<SchedulerTargetRbacService>('rbacService') ?? null
+    } catch {
+      return null
+    }
+  })()
+  const reason = await assertSchedulerQueueTargetAuthorized({
+    queue,
+    actorUserId: resolveCommandActorUserId(ctx),
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: ctx.auth?.orgId ?? null,
+    isSuperAdmin: ctx.auth?.isSuperAdmin === true,
+    rbacService,
+  })
+  if (reason) throw new CrudHttpError(403, { error: reason })
+}
+
+async function assertQueueTargetPayloadAllowed(queue: string, targetPayload: Record<string, unknown> | null | undefined): Promise<void> {
+  const reason = validateSchedulerTargetPayload(queue, targetPayload)
+  if (reason) throw new CrudHttpError(422, { error: `Invalid target payload for queue ${queue}: ${reason}` })
+}
+
 function resolveCommandActorUserId(ctx: CommandRuntimeContext): string | null {
   const auth = ctx.auth
   if (!auth) return null
@@ -212,6 +275,11 @@ const createScheduleCommand: CommandHandler<ScheduleCreateInput, { id: string }>
       throw new Error('Failed to calculate next run time')
     }
 
+    if (input.targetType === 'queue' && input.targetQueue) {
+      await assertQueueTargetAuthorizedForActor(ctx, input.targetQueue)
+      await assertQueueTargetPayloadAllowed(input.targetQueue, input.targetPayload)
+    }
+
     // Create schedule
     const schedule = em.create(ScheduledJob, {
       name: input.name,
@@ -228,8 +296,8 @@ const createScheduleCommand: CommandHandler<ScheduleCreateInput, { id: string }>
       targetPayload: input.targetPayload ?? null,
       requireFeature: input.requireFeature ?? null,
       isEnabled: input.isEnabled ?? true,
-      sourceType: input.sourceType ?? 'user',
-      sourceModule: input.sourceModule ?? null,
+      sourceType: 'user',
+      sourceModule: null,
       nextRunAt,
       createdByUserId: resolveCommandActorUserId(ctx),
       createdAt: new Date(),
@@ -310,10 +378,76 @@ const updateScheduleCommand: CommandHandler<ScheduleUpdateInput, { ok: boolean }
     if (schedule.organizationId) ensureOrganizationScope(ctx, schedule.organizationId)
     ensureCanManageSystemScopedJob(ctx, schedule)
 
+    // Module-authored schedules are trusted infrastructure wiring (#5213): their
+    // target and payload are owned by the registering module. Submitting them
+    // unchanged is a no-op (the edit form always resends every field) — only an
+    // actual change to provenance-relevant values is rejected.
+    const touchesModuleOwnedTarget =
+      schedule.sourceType === 'module'
+      && (
+        targetValueChanged(input.targetType, schedule.targetType)
+        || targetValueChanged(input.targetQueue, schedule.targetQueue)
+        || targetValueChanged(input.targetCommand, schedule.targetCommand)
+        || targetPayloadChanged(input.targetPayload, schedule.targetPayload)
+      )
+    if (touchesModuleOwnedTarget) {
+      const { translate } = await resolveTranslations()
+      throw new CrudHttpError(403, {
+        error: translate(
+          'scheduler.errors.module_target_immutable',
+          'Module-authored schedules own their target; only operational fields can be updated here.',
+        ),
+      })
+    }
+
     if (input.isEnabled === true && schedule.isEnabled !== true) {
       await enforceTenantActiveScheduleLimit(em, schedule.tenantId)
     }
 
+    const effectiveTargetType = input.targetType ?? schedule.targetType
+    const effectiveQueue = input.targetQueue ?? schedule.targetQueue
+    const queueChanged =
+      effectiveTargetType === 'queue'
+      && (
+        targetValueChanged(input.targetQueue, schedule.targetQueue)
+        || targetValueChanged(input.targetType, schedule.targetType)
+        || targetPayloadChanged(input.targetPayload, schedule.targetPayload)
+      )
+    if (effectiveTargetType === 'queue' && effectiveQueue) {
+      const retargetedToUnapprovedQueue =
+        input.targetQueue !== undefined
+        && input.targetQueue !== schedule.targetQueue
+        && !isSchedulerSafeQueue(input.targetQueue)
+      // A save that leaves a user-authored row ACTIVE on an unapproved queue
+      // restores the invariant the update schema used to enforce; disabling the
+      // row stays allowed so admins can remediate legacy targets from the UI.
+      // (Dispatch-time re-verification remains the backstop either way.)
+      const keepsUnapprovedQueueActive =
+        effectiveQueue != null
+        && !isSchedulerSafeQueue(effectiveQueue)
+        && input.isEnabled !== false
+        && schedule.isEnabled !== false
+      if (
+        (retargetedToUnapprovedQueue || keepsUnapprovedQueueActive)
+        && schedule.sourceType !== 'module'
+      ) {
+        const { translate } = await resolveTranslations()
+        throw new CrudHttpError(422, {
+          error: translate(
+            'scheduler.errors.queue_not_approved',
+            'Target queue is not an approved scheduler target. Only workers that opted into scheduling can be selected.',
+          ),
+        })
+      }
+      if (queueChanged) {
+        await assertQueueTargetAuthorizedForActor(ctx, effectiveQueue)
+        const effectivePayload = input.targetPayload !== undefined
+          ? input.targetPayload
+          : schedule.targetPayload
+        await assertQueueTargetPayloadAllowed(effectiveQueue, effectivePayload)
+      }
+    }
+
     const scheduleChanged = input.scheduleType !== undefined || input.scheduleValue !== undefined || input.timezone !== undefined
     const nextRunAt = scheduleChanged
       ? calculateNextRunForWrite(