@open-mercato/scheduler 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/scheduler/data/__tests__/safe-targets.test.ts

@@ -0,0 +1,110 @@
+import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
+import {
+  scheduleCreateSchema,
+  scheduleUpdateSchema,
+} from '../validators'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
+
+const tenantId = '123e4567-e89b-12d3-a456-426614174000'
+const organizationId = '123e4567-e89b-12d3-a456-426614174001'
+const scheduleId = '123e4567-e89b-12d3-a456-426614174002'
+
+const REGISTRY_KEY = '__openMercatoModulesRegistry__'
+
+beforeAll(() => {
+  registerModules([
+    {
+      id: 'test_module',
+      workers: [
+        {
+          id: 'test_module:workers:safe',
+          queue: 'test-module-safe-queue',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+        {
+          id: 'test_module:workers:internal',
+          queue: 'stripe-webhook',
+          concurrency: 1,
+          handler: async () => {},
+        },
+      ],
+    },
+  ] as never)
+})
+
+afterAll(() => {
+  ;(globalThis as Record<string, unknown>)[REGISTRY_KEY] = null
+})
+
+describe('scheduler queue target authorization (#5213)', () => {
+  describe('scheduleCreateSchema', () => {
+    it('accepts a queue target declared scheduler-safe by its worker', () => {
+      const result = scheduleCreateSchema.parse({
+        name: 'Safe queue schedule',
+        scopeType: 'organization',
+        organizationId,
+        tenantId,
+        scheduleType: 'interval',
+        scheduleValue: '15m',
+        targetType: 'queue',
+        targetQueue: 'test-module-safe-queue',
+      })
+
+      expect(result.targetQueue).toBe('test-module-safe-queue')
+    })
+
+    it('rejects a queue target the worker did not declare scheduler-safe', () => {
+      expect(() =>
+        scheduleCreateSchema.parse({
+          name: 'Internal sink schedule',
+          scopeType: 'organization',
+          organizationId,
+          tenantId,
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          targetType: 'queue',
+          targetQueue: 'stripe-webhook',
+        })
+      ).toThrow(/not an approved scheduler target/)
+    })
+
+    it('rejects an unknown queue target', () => {
+      expect(() =>
+        scheduleCreateSchema.parse({
+          name: 'Unknown queue schedule',
+          scopeType: 'organization',
+          organizationId,
+          tenantId,
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          targetType: 'queue',
+          targetQueue: 'no-such-queue-anywhere',
+        })
+      ).toThrow(/not an approved scheduler target/)
+    })
+  })
+
+  describe('scheduleUpdateSchema', () => {
+    // Queue-safety rules for updates live in the scheduler.jobs.update command
+    // (change-detection against the stored row), so unchanged targets resent by
+    // the edit form and legacy remediation stay possible (#5213 N1).
+    // See commands/__tests__/jobs.target-guard.test.ts for that coverage.
+    it('accepts the request shape the edit form sends for an unchanged target', () => {
+      const result = scheduleUpdateSchema.parse({
+        id: scheduleId,
+        targetType: 'queue',
+        targetQueue: 'stripe-webhook',
+        isEnabled: false,
+      })
+      expect(result.isEnabled).toBe(false)
+    })
+
+    it('still rejects changing to a queue without providing the queue value', () => {
+      expect(() =>
+        scheduleUpdateSchema.parse({ id: scheduleId, targetType: 'queue' })
+      ).toThrow(/corresponding targetQueue/)
+    })
+  })
+})

package/src/modules/scheduler/data/__tests__/validators.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeAll } from '@jest/globals'
+import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
 import {
   scheduleCreateSchema,
   scheduleUpdateSchema,
@@ -13,6 +13,7 @@ import {
   clearSchedulerSafeCommandsForTests,
   registerSchedulerSafeCommands,
 } from '../../lib/scheduler-safe-commands'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
 
 // Register test commands for validation tests
 const testCommand: CommandHandler<unknown, { ok: boolean }> = {
@@ -39,6 +40,27 @@ beforeAll(() => {
       requiredFeatures: ['scheduler.jobs.manage'],
     },
   ])
+  // Queue targets are only valid when their worker opted into scheduling
+  // (`schedulerSafe: true`). Seed one safe queue so schema tests can exercise
+  // queue-target validation (#5213).
+  registerModules([
+    {
+      id: 'test_module',
+      workers: [
+        {
+          id: 'test_module:workers:safe',
+          queue: 'test',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+      ],
+    },
+  ] as never)
+})
+
+afterAll(() => {
+  ;(globalThis as Record<string, unknown>).__openMercatoModulesRegistry__ = null
 })
 
 const tenantId = '123e4567-e89b-12d3-a456-426614174000'
@@ -54,7 +76,7 @@ describe('scheduleCreateSchema', () => {
         scheduleValue: '0 0 * * *',
         timezone: 'UTC',
         targetType: 'queue',
-        targetQueue: 'backup-queue',
+        targetQueue: 'test',
         isEnabled: true,
       })
 
@@ -62,7 +84,7 @@ describe('scheduleCreateSchema', () => {
       expect(result.scopeType).toBe('system')
       expect(result.scheduleType).toBe('cron')
       expect(result.targetType).toBe('queue')
-      expect(result.targetQueue).toBe('backup-queue')
+      expect(result.targetQueue).toBe('test')
     })
 
     it('should accept valid organization-scoped interval schedule with command target', () => {
@@ -98,7 +120,7 @@ describe('scheduleCreateSchema', () => {
         scheduleType: 'interval',
         scheduleValue: '15m',
         targetType: 'queue',
-        targetQueue: 'cleanup',
+        targetQueue: 'test',
       })
 
       expect(result.scopeType).toBe('tenant')

package/src/modules/scheduler/data/validators.ts

@@ -4,6 +4,7 @@ import { validateInterval } from '../lib/intervalParser'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { isSchedulerSafeCommandId } from '../lib/scheduler-safe-commands'
+import { isSchedulerSafeQueue, validateSchedulerTargetPayload } from '../lib/safeQueueTargets'
 
 /**
  * Validate that a command exists in the command registry
@@ -16,6 +17,15 @@ function validateCommandIsSchedulable(commandId: string): boolean {
   return isSchedulerSafeCommandId(commandId)
 }
 
+/**
+ * Validate that a queue was declared scheduler-safe by its owning worker.
+ * Internal and system-only workers (webhook processors, indexers, …) stay
+ * undiscoverable as schedule targets — see issue #5213.
+ */
+function validateSchedulerSafeQueue(queue: string | null | undefined): boolean {
+  return isSchedulerSafeQueue(queue)
+}
+
 /**
  * Base schedule fields
  */
@@ -39,8 +49,6 @@ const scheduleBaseSchema = z.object({
   requireFeature: z.string().optional().nullable(),
   
   isEnabled: z.boolean().default(true),
-  sourceType: z.enum(['user', 'module']).default('user'),
-  sourceModule: z.string().optional().nullable(),
 })
 
 /**
@@ -120,6 +128,30 @@ export const scheduleCreateSchema = scheduleBaseSchema
       path: ['targetCommand'],
     }
   )
+  .refine(
+    (data) => {
+      if (data.targetType === 'queue' && data.targetQueue) {
+        return validateSchedulerSafeQueue(data.targetQueue)
+      }
+      return true
+    },
+    {
+      message: 'Target queue is not an approved scheduler target. Only workers that opted into scheduling can be selected.',
+      path: ['targetQueue'],
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.targetType === 'queue' && data.targetQueue) {
+        return validateSchedulerTargetPayload(data.targetQueue, data.targetPayload) === null
+      }
+      return true
+    },
+    {
+      message: 'Invalid target payload for the selected scheduler queue.',
+      path: ['targetPayload'],
+    }
+  )
 
 /**
  * Update schedule schema (all fields optional except id)
@@ -214,6 +246,9 @@ export const scheduleUpdateSchema = z.object({
       path: ['targetCommand'],
     }
   )
+  // Queue-target safety and payload-shape rules for updates are enforced in the
+  // scheduler.jobs.update command against the stored row, so unchanged targets
+  // (always resent by the edit form) and legacy remediation stays possible (#5213).
 
 /**
  * Delete schedule schema

package/src/modules/scheduler/i18n/de.json

@@ -48,6 +48,8 @@
   "scheduler.error.unauthorized": "Nicht autorisiert",
   "scheduler.error.update_failed": "Fehler beim Aktualisieren des Zeitplans",
   "scheduler.errors.id_required": "Zeitplankennung ist erforderlich.",
+  "scheduler.errors.module_target_immutable": "Von Modulen erstellte Zeitpläne besitzen ihr Ziel; nur operative Felder können hier geändert werden.",
+  "scheduler.errors.queue_not_approved": "Ziel-Queue ist kein genehmigtes Scheduler-Ziel. Nur Worker, die sich angemeldet haben, können ausgewählt werden.",
   "scheduler.execution.actions": "Aktionen",
   "scheduler.execution.completed_message": "Diese Ausführung wurde erfolgreich ohne Fehler abgeschlossen.",
   "scheduler.execution.details_title": "Ausführungsdetails",

package/src/modules/scheduler/i18n/en.json

@@ -48,6 +48,8 @@
   "scheduler.error.unauthorized": "Unauthorized",
   "scheduler.error.update_failed": "Failed to update schedule",
   "scheduler.errors.id_required": "Schedule identifier is required.",
+  "scheduler.errors.module_target_immutable": "Module-authored schedules own their target; only operational fields can be updated here.",
+  "scheduler.errors.queue_not_approved": "Target queue is not an approved scheduler target. Only workers that opted into scheduling can be selected.",
   "scheduler.execution.actions": "Actions",
   "scheduler.execution.completed_message": "This execution completed successfully without errors.",
   "scheduler.execution.details_title": "Execution Details",

package/src/modules/scheduler/i18n/es.json

@@ -48,6 +48,8 @@
   "scheduler.error.unauthorized": "No autorizado",
   "scheduler.error.update_failed": "Error al actualizar la programación",
   "scheduler.errors.id_required": "El identificador de programación es obligatorio.",
+  "scheduler.errors.module_target_immutable": "Los programados creados por módulos poseen su destino; solo los campos operativos pueden modificarse aquí.",
+  "scheduler.errors.queue_not_approved": "La cola de destino no es un destino aprobado del planificador. Solo se pueden seleccionar workers que hayan optado.",
   "scheduler.execution.actions": "Acciones",
   "scheduler.execution.completed_message": "Esta ejecución se completó con éxito sin errores.",
   "scheduler.execution.details_title": "Detalles de ejecución",

package/src/modules/scheduler/i18n/ko.json

@@ -48,6 +48,8 @@
   "scheduler.error.unauthorized": "권한이 없습니다",
   "scheduler.error.update_failed": "일정 수정에 실패했습니다",
   "scheduler.errors.id_required": "일정 식별자는 필수입니다.",
+  "scheduler.errors.module_target_immutable": "모듈이 생성한 일정은 대상을 소유하므로 여기서는 운영 필드만 수정할 수 있습니다.",
+  "scheduler.errors.queue_not_approved": "대상 큐는 승인된 스케줄러 대상이 아닙니다. 옵트인한 워커만 선택할 수 있습니다.",
   "scheduler.execution.actions": "작업",
   "scheduler.execution.completed_message": "이 실행은 오류 없이 성공적으로 완료되었습니다.",
   "scheduler.execution.details_title": "실행 상세 정보",

package/src/modules/scheduler/i18n/pl.json

@@ -48,6 +48,8 @@
   "scheduler.error.unauthorized": "Brak autoryzacji",
   "scheduler.error.update_failed": "Nie udało się zaktualizować harmonogramu",
   "scheduler.errors.id_required": "Identyfikator harmonogramu jest wymagany.",
+  "scheduler.errors.module_target_immutable": "Harmonogramy utworzone przez moduły są właścicielami swojego celu; tutaj można zmieniać wyłącznie pola operacyjne.",
+  "scheduler.errors.queue_not_approved": "Kolejka docelowa nie jest zatwierdzonym celem harmonogramu. Można wybrać tylko workery, które się zadeklarowały.",
   "scheduler.execution.actions": "Akcje",
   "scheduler.execution.completed_message": "To wykonanie zakończyło się pomyślnie bez błędów.",
   "scheduler.execution.details_title": "Szczegóły wykonania",

package/src/modules/scheduler/lib/__tests__/safeQueueTargets.test.ts

@@ -0,0 +1,311 @@
+import { describe, it, expect, beforeAll, afterAll } from '@jest/globals'
+import {
+  buildTrustedScheduleScope,
+  sanitizeSchedulerTargetPayload,
+  listSchedulerSafeQueueTargets,
+  isSchedulerSafeQueue,
+  canDispatchScheduleQueueTarget,
+  getSchedulerQueueRequiredFeatures,
+  assertSchedulerQueueTargetAuthorized,
+  validateSchedulerTargetPayload,
+  auditSchedulerModuleQueueRows,
+} from '../safeQueueTargets'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
+
+const REGISTRY_KEY = '__openMercatoModulesRegistry__'
+
+beforeAll(() => {
+  registerModules([
+    {
+      id: 'alpha',
+      workers: [
+        {
+          id: 'alpha:workers:safe',
+          queue: 'alpha-safe',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+        {
+          id: 'alpha:workers:internal',
+          queue: 'alpha-internal',
+          concurrency: 1,
+          handler: async () => {},
+        },
+        {
+          id: 'alpha:workers:mixed-safe',
+          queue: 'mixed-queue',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+        {
+          id: 'alpha:workers:gated',
+          queue: 'gated-queue',
+          concurrency: 1,
+          schedulerSafe: true,
+          schedulerRequiredFeatures: ['orders.export'],
+          handler: async () => {},
+        },
+      ],
+    },
+    {
+      id: 'beta',
+      workers: [
+        {
+          id: 'beta:workers:safe',
+          queue: 'alpha-safe',
+          concurrency: 1,
+          schedulerSafe: true,
+          handler: async () => {},
+        },
+        {
+          id: 'beta:workers:freeloader',
+          queue: 'mixed-queue',
+          concurrency: 1,
+          handler: async () => {},
+        },
+      ],
+    },
+  ] as never)
+})
+
+afterAll(() => {
+  ;(globalThis as Record<string, unknown>)[REGISTRY_KEY] = null
+})
+
+describe('listSchedulerSafeQueueTargets', () => {
+  it('returns only queues whose workers ALL opted into scheduling, deduplicated and sorted', () => {
+    expect(listSchedulerSafeQueueTargets()).toEqual([
+      { queue: 'alpha-safe', moduleId: 'alpha', requiredFeatures: [] },
+      { queue: 'gated-queue', moduleId: 'alpha', requiredFeatures: ['orders.export'] },
+    ])
+  })
+
+  it('hides a queue when even one consumer did not opt in (#5213 M2)', () => {
+    // mixed-queue: alpha opts in, beta does not — the whole queue must stay hidden
+    expect(isSchedulerSafeQueue('mixed-queue')).toBe(false)
+  })
+})
+
+describe('target descriptors', () => {
+  it('surfaces required creator features from opted-in workers (#5213 M3)', () => {
+    expect(getSchedulerQueueRequiredFeatures('alpha-safe')).toEqual([])
+    expect(getSchedulerQueueRequiredFeatures('gated-queue')).toEqual(['orders.export'])
+    expect(getSchedulerQueueRequiredFeatures('unknown')).toEqual([])
+  })
+})
+
+describe('assertSchedulerQueueTargetAuthorized (#5213 M3)', () => {
+  const base = { queue: 'gated-queue' } as const
+
+  it('passes when the creator holds every required feature', async () => {
+    const reason = await assertSchedulerQueueTargetAuthorized({
+      ...base,
+      actorUserId: 'user-1',
+      tenantId: 't-1',
+      organizationId: 'o-1',
+      rbacService: { userHasAllFeatures: async () => true },
+    })
+    expect(reason).toBeNull()
+  })
+
+  it('rejects when the creator lacks a target-specific feature', async () => {
+    const reason = await assertSchedulerQueueTargetAuthorized({
+      ...base,
+      actorUserId: 'user-1',
+      tenantId: 't-1',
+      organizationId: 'o-1',
+      rbacService: { userHasAllFeatures: async () => false },
+    })
+    expect(reason).toContain('orders.export')
+  })
+
+  it('bypasses for super admins and feature-less targets', async () => {
+    expect(await assertSchedulerQueueTargetAuthorized({
+      ...base,
+      isSuperAdmin: true,
+      rbacService: { userHasAllFeatures: async () => false },
+    })).toBeNull()
+    expect(await assertSchedulerQueueTargetAuthorized({
+      queue: 'alpha-safe',
+      actorUserId: null,
+    })).toBeNull()
+  })
+})
+
+describe('isSchedulerSafeQueue', () => {
+  it('accepts opted-in queues', () => {
+    expect(isSchedulerSafeQueue('alpha-safe')).toBe(true)
+  })
+
+  it('rejects internal worker queues', () => {
+    expect(isSchedulerSafeQueue('alpha-internal')).toBe(false)
+  })
+
+  it('rejects unknown, empty, and missing queues', () => {
+    expect(isSchedulerSafeQueue('nope')).toBe(false)
+    expect(isSchedulerSafeQueue('')).toBe(false)
+    expect(isSchedulerSafeQueue(null)).toBe(false)
+    expect(isSchedulerSafeQueue(undefined)).toBe(false)
+  })
+})
+
+describe('canDispatchScheduleQueueTarget', () => {
+  it('allows module-authored schedules to target queues their own module owns', () => {
+    expect(canDispatchScheduleQueueTarget({
+      targetQueue: 'alpha-internal',
+      sourceType: 'module',
+      sourceModule: 'alpha',
+    })).toBe(true)
+  })
+
+  it('fails closed on pre-upgrade/forged module rows (#5213 B1)', () => {
+    // legacy row without any recorded owner
+    expect(canDispatchScheduleQueueTarget({ targetQueue: 'alpha-internal', sourceType: 'module' })).toBe(false)
+    // row claiming a module that does not own the queue — e.g. data_sync → stripe-webhook
+    expect(canDispatchScheduleQueueTarget({
+      targetQueue: 'stripe-webhook',
+      sourceType: 'module',
+      sourceModule: 'data_sync',
+    })).toBe(false)
+    expect(canDispatchScheduleQueueTarget({
+      targetQueue: 'alpha-internal',
+      sourceType: 'module',
+      sourceModule: 'beta',
+    })).toBe(false)
+  })
+
+  it('restricts user-authored schedules to scheduler-safe queues', () => {
+    expect(canDispatchScheduleQueueTarget({ targetQueue: 'alpha-safe', sourceType: 'user' })).toBe(true)
+    expect(canDispatchScheduleQueueTarget({ targetQueue: 'stripe-webhook', sourceType: 'user' })).toBe(false)
+  })
+
+  it('rejects schedules without a queue', () => {
+    expect(canDispatchScheduleQueueTarget({ targetQueue: null })).toBe(false)
+    expect(canDispatchScheduleQueueTarget({})).toBe(false)
+  })
+})
+
+describe('validateSchedulerTargetPayload (#5213 M3)', () => {
+  it('enforces registered schemas for known targets', async () => {
+    expect(validateSchedulerTargetPayload('scheduler-test', { message: 'hi' })).toBeNull()
+    expect(validateSchedulerTargetPayload('scheduler-test', { message: 123 })).toMatch(/message/)
+    expect(validateSchedulerTargetPayload('unregistered-queue', { anything: true })).toBeNull()
+  })
+})
+
+describe('buildTrustedScheduleScope', () => {
+  it('derives scope exclusively from the stored schedule row', () => {
+    expect(buildTrustedScheduleScope({ tenantId: 't1', organizationId: 'o1' }))
+      .toEqual({ tenantId: 't1', organizationId: 'o1' })
+    expect(buildTrustedScheduleScope({}))
+      .toEqual({ tenantId: null, organizationId: null })
+  })
+})
+
+describe('sanitizeSchedulerTargetPayload', () => {
+  const schedule = { tenantId: 't-1', organizationId: 'o-1' }
+
+  it('strips caller-supplied authority keys at the payload root', () => {
+    const result = sanitizeSchedulerTargetPayload({
+      scope: { tenantId: 'forged', organizationId: 'forged' },
+      tenantId: 'forged',
+      organizationId: 'forged',
+      keep: 'me',
+    }, schedule)
+
+    expect(result).toEqual({
+      keep: 'me',
+      scope: { tenantId: 't-1', organizationId: 'o-1' },
+    })
+  })
+
+  it('strips reserved keys inside the local-strategy payload wrapper level', () => {
+    const result = sanitizeSchedulerTargetPayload({
+      payload: {
+        nested: 'data',
+        scope: { tenantId: 'forged' },
+        _jobOrigin: 'inbound-webhook',
+      },
+    }, schedule)
+
+    expect(result).toEqual({
+      payload: { nested: 'data' },
+      scope: { tenantId: 't-1', organizationId: 'o-1' },
+    })
+  })
+
+  it('strips the reserved underscore-prefixed envelope namespace', () => {
+    const result = sanitizeSchedulerTargetPayload({
+      _idempotencyKey: 'forged',
+      _jobOrigin: 'inbound-webhook',
+      data: 1,
+    }, schedule)
+
+    expect(result).toEqual({
+      data: 1,
+      scope: { tenantId: 't-1', organizationId: 'o-1' },
+    })
+  })
+
+  it('does not mutate the input payload', () => {
+    const input = {
+      scope: { tenantId: 'forged' },
+      deep: { value: { x: 1 } },
+    }
+    const snapshot = structuredClone(input)
+
+    sanitizeSchedulerTargetPayload(input, schedule)
+
+    expect(input).toEqual(snapshot)
+  })
+
+  it('injects trusted scope for empty and missing payloads', () => {
+    expect(sanitizeSchedulerTargetPayload(null, schedule))
+      .toEqual({ scope: { tenantId: 't-1', organizationId: 'o-1' } })
+    expect(sanitizeSchedulerTargetPayload({}, schedule))
+      .toEqual({ scope: { tenantId: 't-1', organizationId: 'o-1' } })
+  })
+})
+
+describe('auditSchedulerModuleQueueRows (#5213 B1-residual-2)', () => {
+  it('flags API-key-authored forgeries that the runtime guard cannot distinguish', () => {
+    // A non-user-bound API key stamps no actor: at rest this row is
+    // indistinguishable from a genuine registration even though it was forged
+    // pre-upgrade. The runtime guard must keep allowing it (it cannot know),
+    // and the audit must surface it for operator review.
+    const apiKeyForged = {
+      id: 'row-forged',
+      name: 'Looks legitimate',
+      targetQueue: 'alpha-internal',
+      sourceType: 'module',
+      sourceModule: 'alpha',
+      createdByUserId: null,
+      isEnabled: true,
+    }
+    const genuine = { ...apiKeyForged, id: 'row-genuine', name: 'Real registration' }
+    const mismatched = {
+      ...apiKeyForged,
+      id: 'row-mismatched',
+      targetQueue: 'stripe-webhook',
+      sourceModule: 'alpha',
+    }
+
+    const audits = auditSchedulerModuleQueueRows([apiKeyForged, genuine, mismatched])
+
+    expect(audits).toHaveLength(3)
+    const forged = audits.find((a) => a.scheduleId === 'row-forged')
+    expect(forged?.dispatchAllowed).toBe(true)
+    // the mismatched-name row fails closed and is reported as blocked
+    expect(audits.find((a) => a.scheduleId === 'row-mismatched')?.dispatchAllowed).toBe(false)
+    expect(audits.find((a) => a.scheduleId === 'row-genuine')?.dispatchAllowed).toBe(true)
+  })
+
+  it('ignores user-authored rows entirely', () => {
+    const audits = auditSchedulerModuleQueueRows([
+      { id: 'row-user', targetQueue: 'alpha-internal', sourceType: 'user', sourceModule: null },
+    ])
+    expect(audits).toHaveLength(0)
+  })
+})