@open-mercato/scheduler 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/scheduler/services/__tests__/localSchedulerService.test.ts

@@ -6,6 +6,7 @@ import {
   clearSchedulerSafeCommandsForTests,
   registerSchedulerSafeCommands,
 } from '../../lib/scheduler-safe-commands'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 jest.mock('@open-mercato/shared/lib/logger', () => {
@@ -61,6 +62,40 @@ describe('LocalSchedulerService', () => {
   let mockRbacService: { tenantHasFeature: jest.Mock; userHasAllFeatures: jest.Mock }
   let mockLockStrategy: { runWithLock: jest.Mock }
 
+  beforeAll(() => {
+    // Queue-target dispatch reauthorizes against scheduler-safe queues (#5213);
+    // seed one safe queue and one module-owned internal queue for the guards.
+    registerModules([
+      {
+        id: 'test_module',
+        workers: [
+          {
+            id: 'test_module:workers:test-queue',
+            queue: 'test-queue',
+            concurrency: 1,
+            schedulerSafe: true,
+            handler: async () => {},
+          },
+        ],
+      },
+      {
+        id: 'legacy_module',
+        workers: [
+          {
+            id: 'legacy_module:workers:internal',
+            queue: 'legacy-internal',
+            concurrency: 1,
+            handler: async () => {},
+          },
+        ],
+      },
+    ] as never)
+  })
+
+  afterAll(() => {
+    ;(globalThis as Record<string, unknown>).__openMercatoModulesRegistry__ = null
+  })
+
   beforeEach(() => {
     jest.clearAllMocks()
     jest.useFakeTimers()
@@ -296,8 +331,151 @@ describe('LocalSchedulerService', () => {
           tenantId: null,
           organizationId: null,
           _idempotencyKey: expect.stringMatching(/^scheduler-test-1-/),
+          _jobOrigin: 'scheduler',
+        })
+      )
+    })
+
+    it('should sanitize author-supplied scope and envelope keys from the target payload', async () => {
+      const schedule = createSchedule({
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+        sourceType: 'module',
+        sourceModule: 'test_module',
+        targetQueue: 'test-queue',
+        targetPayload: {
+          scope: { tenantId: 'forged-tenant', organizationId: 'forged-org' },
+          tenantId: 'forged-tenant',
+          _jobOrigin: 'inbound-webhook',
+          payload: { nested: 'data', _idempotencyKey: 'forged' },
+          legit: 'kept',
+        },
+      })
+
+      mockForkedEm.find.mockResolvedValue([schedule])
+      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
+      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
+        await fn()
+        return { acquired: true }
+      })
+      mockQueue.enqueue.mockResolvedValue(undefined as any)
+
+      await service.start()
+
+      expect(mockQueue.enqueue).toHaveBeenCalledWith(
+        expect.objectContaining({
+          tenantId: 'tenant-1',
+          organizationId: 'org-1',
+          payload: { nested: 'data' },
+          legit: 'kept',
+          scope: { tenantId: 'tenant-1', organizationId: 'org-1' },
+          _jobOrigin: 'scheduler',
         })
       )
+      const enqueued = mockQueue.enqueue.mock.calls[0][0] as Record<string, unknown>
+      expect(enqueued.payload).toEqual({ nested: 'data' })
+    })
+
+    it('should refuse user-authored schedules targeting non-safe internal queues', async () => {
+      const schedule = createSchedule({
+        targetQueue: 'stripe-webhook',
+        sourceType: 'user',
+      })
+
+      mockForkedEm.find.mockResolvedValue([schedule])
+      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
+      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
+        await fn()
+        return { acquired: true }
+      })
+
+      await service.start()
+
+      expect(mockQueueFactory).not.toHaveBeenCalled()
+      expect(loggerError).toHaveBeenCalled()
+      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
+        'scheduler.job.failed',
+        expect.objectContaining({
+          id: 'test-1',
+          error: expect.stringContaining('not an approved scheduler target'),
+        })
+      )
+    })
+
+    it('should refuse a pre-upgrade module row whose sourceModule MATCHES the owner but carries an actor stamp (#5213 B1)', async () => {
+      // forged pre-upgrade row: attacker set sourceType/sourceModule to the real
+      // owning module, but API writes always stamp createdByUserId — which
+      // schedulerService.register() never does. The row must fail closed.
+      const schedule = createSchedule({
+        targetQueue: 'legacy-internal',
+        sourceType: 'module',
+        sourceModule: 'legacy_module',
+        createdByUserId: 'attacker-user',
+      })
+
+      mockForkedEm.find.mockResolvedValue([schedule])
+      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
+      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
+        await fn()
+        return { acquired: true }
+      })
+
+      await service.start()
+
+      expect(mockQueueFactory).not.toHaveBeenCalled()
+      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
+        'scheduler.job.failed',
+        expect.objectContaining({
+          id: 'test-1',
+          error: expect.stringContaining('not an approved scheduler target'),
+        })
+      )
+    })
+
+    it('should refuse a pre-upgrade module row whose sourceModule does not own its internal queue (#5213 B1)', async () => {
+      const schedule = createSchedule({
+        targetQueue: 'stripe-webhook',
+        sourceType: 'module',
+        sourceModule: 'legacy_module',
+      })
+
+      mockForkedEm.find.mockResolvedValue([schedule])
+      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
+      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
+        await fn()
+        return { acquired: true }
+      })
+
+      await service.start()
+
+      expect(mockQueueFactory).not.toHaveBeenCalled()
+      expect(mockEmitSchedulerEvent).toHaveBeenCalledWith(
+        'scheduler.job.failed',
+        expect.objectContaining({
+          id: 'test-1',
+          error: expect.stringContaining('not an approved scheduler target'),
+        })
+      )
+    })
+
+    it('should allow module-authored schedules to keep targeting queues their own module owns (#5213 B1)', async () => {
+      const schedule = createSchedule({
+        targetQueue: 'legacy-internal',
+        sourceType: 'module',
+        sourceModule: 'legacy_module',
+      })
+
+      mockForkedEm.find.mockResolvedValue([schedule])
+      mockForkedEm.findOne.mockResolvedValue({ ...schedule })
+      mockLockStrategy.runWithLock.mockImplementation(async (_key: string, fn: () => Promise<unknown>) => {
+        await fn()
+        return { acquired: true }
+      })
+      mockQueue.enqueue.mockResolvedValue(undefined as any)
+
+      await service.start()
+
+      expect(mockQueue.enqueue).toHaveBeenCalled()
     })
 
     it('should execute command target', async () => {
@@ -670,6 +848,7 @@ describe('LocalSchedulerService', () => {
           tenantId: schedule.tenantId,
           organizationId: schedule.organizationId,
           _idempotencyKey: expect.stringMatching(new RegExp(`^scheduler-${schedule.id}-`)),
+          _jobOrigin: 'scheduler',
         })
       )
       const enqueued = mockQueue.enqueue.mock.calls[0][0] as Record<string, unknown>

package/src/modules/scheduler/services/localSchedulerService.ts

@@ -11,6 +11,12 @@ import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-comm
 import { buildScheduledCommandContext } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  canDispatchScheduleQueueTarget,
+  getSchedulerQueueRequiredFeatures,
+  sanitizeSchedulerTargetPayload,
+  validateSchedulerTargetPayload,
+} from '../lib/safeQueueTargets'
 
 const logger = createLogger('scheduler').child({ component: 'local' })
 
@@ -261,18 +267,45 @@ export class LocalSchedulerService {
       throw new Error('Target queue is required for queue target type')
     }
 
+    // Dispatch-time reauthorization (#5213): provenance is verified against the
+    // live registry (module rows must own their queue), API rows must target
+    // opted-in queues.
+    if (!canDispatchScheduleQueueTarget(schedule)) {
+      throw new Error(`Queue is not an approved scheduler target: ${schedule.targetQueue}`)
+    }
+
+    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)
+    if (payloadIssue) {
+      throw new Error(`Invalid payload for scheduler queue ${schedule.targetQueue}: ${payloadIssue}`)
+    }
+
+    if (schedule.scopeType !== 'system') {
+      for (const feature of getSchedulerQueueRequiredFeatures(schedule.targetQueue)) {
+        const hasFeature = await this.checkFeature({ ...schedule, requireFeature: feature } as ScheduledJob)
+        if (!hasFeature) {
+          throw new Error(`Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`)
+        }
+      }
+    }
+
     const queue = this.queueFactory(schedule.targetQueue)
 
     // Deliver the same flat contract as the asynchronous execute-schedule
     // worker: targetPayload fields on the root, scheduler-owned scope and
     // idempotency fields applied last. Local mode runs each firing exactly
     // once, so the firing timestamp is a valid logical execution key.
-    await queue.enqueue(buildQueueTargetPayload({
-      targetPayload: schedule.targetPayload,
-      tenantId: schedule.tenantId,
-      organizationId: schedule.organizationId,
-      idempotencyKey: buildSchedulerIdempotencyKey(schedule.id, Date.now()),
-    }))
+    // Author-supplied scope/envelope keys never survive dispatch (#5213).
+    const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)
+
+    await queue.enqueue({
+      ...buildQueueTargetPayload({
+        targetPayload: sanitizedPayload,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        idempotencyKey: buildSchedulerIdempotencyKey(schedule.id, Date.now()),
+      }),
+      _jobOrigin: 'scheduler' as const,
+    })
 
     logger.info('Enqueued job to target queue', { scheduleId: schedule.id, targetQueue: schedule.targetQueue })
   }

package/src/modules/scheduler/workers/__tests__/execute-schedule.worker.test.ts

@@ -3,8 +3,25 @@ import { ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'
 import { createQueue } from '@open-mercato/queue'
 import { ScheduledJob } from '../../data/entities'
 import { registerSchedulerSafeCommands } from '../../lib/scheduler-safe-commands'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
 import executeScheduleWorker from '../execute-schedule.worker'
 
+// Queue-target dispatch verifies module provenance against the live registry
+// (#5213 B1): register the module that owns the fixture queue.
+registerModules([
+  {
+    id: 'worker_test_module',
+    workers: [
+      {
+        id: 'worker_test_module:workers:example',
+        queue: 'example',
+        concurrency: 1,
+        handler: async () => {},
+      },
+    ],
+  },
+] as never)
+
 const mockCommandExecute = jest.fn()
 
 jest.mock('@open-mercato/shared/lib/commands', () => ({
@@ -127,7 +144,11 @@ describe('executeScheduleWorker queue target payload contract', () => {
       targetType: 'queue',
       targetQueue: 'example',
       targetCommand: null,
-      targetPayload: { connectionId: 'connection-id', scope: 'organization' },
+      sourceType: 'module',
+      // module registration never stamps an acting user (#5213 B1)
+      createdByUserId: null,
+      sourceModule: 'worker_test_module',
+      targetPayload: { connectionId: 'connection-id' },
       ...overrides,
     })
   }
@@ -157,7 +178,7 @@ describe('executeScheduleWorker queue target payload contract', () => {
     ;(createQueue as jest.Mock).mockReturnValue({ enqueue, close })
   })
 
-  it('delivers the flat targetPayload contract with scheduler-owned fields applied last', async () => {
+  it('delivers the flat targetPayload contract with scheduler-owned fields applied last (#5213)', async () => {
     const schedule = buildQueueSchedule({
       targetPayload: {
         connectionId: 'connection-id',
@@ -171,11 +192,12 @@ describe('executeScheduleWorker queue target payload contract', () => {
 
     expect(enqueue).toHaveBeenCalledWith({
       connectionId: 'connection-id',
-      scope: 'organization',
+      scope: { tenantId: 'tenant-a', organizationId: 'org-a' },
       payload: { nested: true },
       tenantId: 'tenant-a',
       organizationId: 'org-a',
       _idempotencyKey: `scheduler-${scheduleId}-worker-job-1`,
+      _jobOrigin: 'scheduler',
     })
     expect(close).toHaveBeenCalledTimes(1)
   })

package/src/modules/scheduler/workers/execute-schedule.worker.ts

@@ -10,6 +10,12 @@ import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-comm
 import { buildScheduledCommandContext } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  canDispatchScheduleQueueTarget,
+  getSchedulerQueueRequiredFeatures,
+  sanitizeSchedulerTargetPayload,
+  validateSchedulerTargetPayload,
+} from '../lib/safeQueueTargets'
 
 const logger = createLogger('scheduler').child({ component: 'worker' })
 
@@ -167,12 +173,69 @@ export default async function executeScheduleWorker(
 
   // Enqueue target job or execute command
   if (schedule.targetType === 'queue' && schedule.targetQueue) {
+    // Dispatch-time reauthorization (#5213): provenance is verified, never
+    // trusted — module-authored rows must still be owned by their recorded
+    // sourceModule and carry no acting-user stamp; API-authored rows may only
+    // target workers that opted into scheduling.
+    if (!canDispatchScheduleQueueTarget(schedule)) {
+      logger.error('Refusing non-safe queue target for schedule', {
+        scheduleId,
+        targetQueue: schedule.targetQueue,
+        sourceType: schedule.sourceType,
+        sourceModule: schedule.sourceType === 'module' ? schedule.sourceModule : undefined,
+      })
+      await emitSchedulerEvent('scheduler.job.skipped', {
+        id: schedule.id,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        reason: `Queue is not an approved scheduler target: ${schedule.targetQueue}`,
+      })
+      return
+    }
+
+    // Re-validate the stored payload against the target's registered schema and
+    // the tenant-level features the target requires (#5213, defense in depth).
+    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)
+    if (payloadIssue) {
+      logger.error('Refusing schedule with invalid payload for queue target', {
+        scheduleId,
+        targetQueue: schedule.targetQueue,
+        issue: payloadIssue,
+      })
+      await emitSchedulerEvent('scheduler.job.skipped', {
+        id: schedule.id,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        reason: `Invalid payload for scheduler queue ${schedule.targetQueue}`,
+      })
+      return
+    }
+
+    const requiredQueueFeatures = getSchedulerQueueRequiredFeatures(schedule.targetQueue)
+    if (schedule.scopeType !== 'system' && requiredQueueFeatures.length > 0) {
+      for (const feature of requiredQueueFeatures) {
+        if (await rbacService.tenantHasFeature(schedule.tenantId, feature, { organizationId: schedule.organizationId })) continue
+        logger.error('Refusing schedule whose tenant lacks a required feature of the queue target', {
+          scheduleId,
+          targetQueue: schedule.targetQueue,
+          feature,
+        })
+        await emitSchedulerEvent('scheduler.job.skipped', {
+          id: schedule.id,
+          tenantId: schedule.tenantId,
+          organizationId: schedule.organizationId,
+          reason: `Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`,
+        })
+        return
+      }
+    }
+
     // Determine queue strategy from environment
     const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'
     const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {
       connection: { url: getRedisUrlOrThrow('QUEUE') },
     })
-    
+
     let targetJobId: string | undefined
     try {
       // The execute-schedule job id is stable across BullMQ retries, so if
@@ -180,12 +243,18 @@ export default async function executeScheduleWorker(
       // reuses the same idempotency key and downstream workers can dedupe.
       const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())
 
-      targetJobId = await targetQueue.enqueue(buildQueueTargetPayload({
-        targetPayload: schedule.targetPayload,
-        tenantId: schedule.tenantId,
-        organizationId: schedule.organizationId,
-        idempotencyKey,
-      }))
+      // Rebuild tenant/org authority context and the trusted dispatch origin
+      // server-side; author-supplied scope/envelope keys never survive (#5213).
+      const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)
+      targetJobId = await targetQueue.enqueue({
+        ...buildQueueTargetPayload({
+          targetPayload: sanitizedPayload,
+          tenantId: schedule.tenantId,
+          organizationId: schedule.organizationId,
+          idempotencyKey,
+        }),
+        _jobOrigin: 'scheduler' as const,
+      })
     } finally {
       // Always close the queue instance to free Redis connections
       await targetQueue.close()

package/src/modules/scheduler/workers/test-echo-queue.worker.ts

@@ -0,0 +1,25 @@
+import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('scheduler').child({ component: 'test-echo-queue' })
+
+export const metadata: WorkerMeta = {
+  queue: 'scheduler-test',
+  id: 'scheduler:test-echo-queue',
+  concurrency: 1,
+  /**
+   * Deliberate scheduler-safe target for QA fixtures and manual experiments,
+   * mirroring the `scheduler.test.echo` command. The handler is side-effect
+   * free: it only logs that a delivery arrived.
+   */
+  schedulerSafe: true,
+}
+
+type TestEchoPayload = {
+  message?: unknown
+}
+
+export default async function handle(job: QueuedJob<TestEchoPayload>, _ctx: JobContext): Promise<void> {
+  const message = typeof job.payload?.message === 'string' ? job.payload.message : ''
+  logger.info('Test queue target received a scheduled delivery', { messageId: message.slice(0, 80) })
+}