@open-mercato/scheduler 0.7.1-develop.7113.1.9d83dca10c → 0.7.1-develop.7121.1.734c263bda

package/src/modules/scheduler/i18n/en.json

@@ -7,6 +7,7 @@
   "scheduler.action.view": "View",
   "scheduler.audit.create": "Create schedule",
   "scheduler.audit.delete": "Delete schedule",
+  "scheduler.audit.trigger": "Trigger schedule",
   "scheduler.audit.update": "Update schedule",
   "scheduler.confirm.delete": "Are you sure you want to delete this schedule?",
   "scheduler.confirm.trigger": "Are you sure you want to trigger \"{name}\" now?\n\nThis will execute the {targetType} immediately.",

package/src/modules/scheduler/i18n/es.json

@@ -7,6 +7,7 @@
   "scheduler.action.view": "Ver",
   "scheduler.audit.create": "Crear programación",
   "scheduler.audit.delete": "Eliminar programación",
+  "scheduler.audit.trigger": "Ejecutar programación",
   "scheduler.audit.update": "Actualizar programación",
   "scheduler.confirm.delete": "¿Está seguro de que desea eliminar esta programación?",
   "scheduler.confirm.trigger": "¿Está seguro de que desea ejecutar \"{name}\" ahora?\n\nEsto ejecutará {targetType} inmediatamente.",

package/src/modules/scheduler/i18n/ko.json

@@ -7,6 +7,7 @@
   "scheduler.action.view": "보기",
   "scheduler.audit.create": "일정 생성",
   "scheduler.audit.delete": "일정 삭제",
+  "scheduler.audit.trigger": "일정 실행",
   "scheduler.audit.update": "일정 수정",
   "scheduler.confirm.delete": "이 일정을 삭제하시겠습니까?",
   "scheduler.confirm.trigger": "지금 \"{name}\"을(를) 실행하시겠습니까?\n\n{targetType}이(가) 즉시 실행됩니다.",

package/src/modules/scheduler/i18n/pl.json

@@ -7,6 +7,7 @@
   "scheduler.action.view": "Podgląd",
   "scheduler.audit.create": "Utwórz harmonogram",
   "scheduler.audit.delete": "Usuń harmonogram",
+  "scheduler.audit.trigger": "Uruchom harmonogram",
   "scheduler.audit.update": "Zaktualizuj harmonogram",
   "scheduler.confirm.delete": "Czy na pewno chcesz usunąć ten harmonogram?",
   "scheduler.confirm.trigger": "Czy na pewno chcesz uruchomić \"{name}\" teraz?\n\nSpowoduje to natychmiastowe wykonanie {targetType}.",

package/src/modules/scheduler/lib/__tests__/commandContext.test.ts

@@ -1,4 +1,6 @@
-import { buildScheduledCommandContext } from '../commandContext'
+import { buildScheduledCommandContext, resolveScheduledCommandActorUserId } from '../commandContext'
+
+const container = {} as Parameters<typeof buildScheduledCommandContext>[1]
 
 describe('buildScheduledCommandContext', () => {
   it('binds organization-scoped scheduled commands to the schedule tenant and organization', () => {
@@ -57,4 +59,84 @@ describe('buildScheduledCommandContext', () => {
     })
     expect(ctx.organizationIds).toBeNull()
   })
+
+  it('acts as the triggering user when a manual run supplies one', () => {
+    const ctx = buildScheduledCommandContext(
+      {
+        id: 'schedule-3',
+        tenantId: 'tenant-a',
+        organizationId: 'org-a',
+        scopeType: 'organization',
+        createdByUserId: 'user-a',
+      },
+      container,
+      { triggeredByUserId: 'user-b' },
+    )
+
+    expect(ctx.auth).toMatchObject({ sub: 'user-b', userId: 'user-b' })
+    // Only the acting identity changes: the run stays bound to the schedule's scope.
+    expect(ctx.auth).toMatchObject({ tenantId: 'tenant-a', orgId: 'org-a', isSuperAdmin: false })
+    expect(ctx.selectedOrganizationId).toBe('org-a')
+  })
+
+  it('falls back to the creator when an unattended run supplies no triggering user', () => {
+    for (const options of [undefined, {}, { triggeredByUserId: null }, { triggeredByUserId: '   ' }]) {
+      const ctx = buildScheduledCommandContext(
+        {
+          id: 'schedule-4',
+          tenantId: 'tenant-a',
+          organizationId: null,
+          scopeType: 'tenant',
+          createdByUserId: 'user-a',
+        },
+        container,
+        options,
+      )
+
+      expect(ctx.auth).toMatchObject({ sub: 'user-a', userId: 'user-a' })
+    }
+  })
+
+  it('falls back to the system actor when neither a triggering user nor a creator is usable', () => {
+    const ctx = buildScheduledCommandContext(
+      {
+        id: 'schedule-5',
+        tenantId: 'tenant-a',
+        organizationId: null,
+        scopeType: 'tenant',
+        createdByUserId: null,
+      },
+      container,
+      { triggeredByUserId: null },
+    )
+
+    expect(ctx.auth).toMatchObject({ sub: '00000000-0000-0000-0000-000000000000' })
+  })
+})
+
+describe('resolveScheduledCommandActorUserId', () => {
+  it('prefers the triggering user over the creator', () => {
+    expect(
+      resolveScheduledCommandActorUserId({ createdByUserId: 'user-a' }, { triggeredByUserId: 'user-b' }),
+    ).toBe('user-b')
+  })
+
+  it('falls back to the creator', () => {
+    expect(resolveScheduledCommandActorUserId({ createdByUserId: 'user-a' })).toBe('user-a')
+    expect(resolveScheduledCommandActorUserId({ createdByUserId: 'user-a' }, { triggeredByUserId: null })).toBe('user-a')
+  })
+
+  it('trims and ignores blank ids', () => {
+    expect(resolveScheduledCommandActorUserId({ createdByUserId: '  user-a  ' })).toBe('user-a')
+    expect(
+      resolveScheduledCommandActorUserId({ createdByUserId: 'user-a' }, { triggeredByUserId: '   ' }),
+    ).toBe('user-a')
+  })
+
+  it('returns null rather than the system actor when no real user is available', () => {
+    // The RBAC gate relies on this: it must reject an actor-less schedule with its
+    // own error instead of authorizing the all-zeros system id.
+    expect(resolveScheduledCommandActorUserId({ createdByUserId: null })).toBeNull()
+    expect(resolveScheduledCommandActorUserId({ createdByUserId: '  ' }, { triggeredByUserId: '' })).toBeNull()
+  })
 })

package/src/modules/scheduler/lib/commandContext.ts

@@ -12,8 +12,43 @@ type ScheduledCommandContextSchedule = {
   createdByUserId?: string | null
 }
 
-function buildScheduledCommandAuth(schedule: ScheduledCommandContextSchedule): Exclude<AuthContext, null> {
-  const actorId = schedule.createdByUserId || SCHEDULER_SYSTEM_ACTOR_ID
+export type ScheduledCommandActorOptions = {
+  /**
+   * The user who manually triggered this run, when there is one. Unattended runs
+   * pass null/undefined and keep falling back to the schedule's creator.
+   */
+  triggeredByUserId?: string | null
+}
+
+/**
+ * Resolve the real user a scheduled run acts as: the person who triggered it,
+ * else the schedule's creator, else nobody.
+ *
+ * This is the single definition of that precedence, and it deliberately returns
+ * `null` rather than the system actor when neither id is usable. Callers that
+ * need an identity for the command context substitute the system actor
+ * themselves; the RBAC gate must instead keep rejecting an actor-less schedule
+ * with its own clear error, rather than running an RBAC lookup against the
+ * all-zeros system id.
+ */
+export function resolveScheduledCommandActorUserId(
+  schedule: Pick<ScheduledCommandContextSchedule, 'createdByUserId'>,
+  options?: ScheduledCommandActorOptions,
+): string | null {
+  const candidates = [options?.triggeredByUserId, schedule.createdByUserId]
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') continue
+    const trimmed = candidate.trim()
+    if (trimmed.length > 0) return trimmed
+  }
+  return null
+}
+
+function buildScheduledCommandAuth(
+  schedule: ScheduledCommandContextSchedule,
+  options?: ScheduledCommandActorOptions,
+): Exclude<AuthContext, null> {
+  const actorId = resolveScheduledCommandActorUserId(schedule, options) || SCHEDULER_SYSTEM_ACTOR_ID
   return {
     sub: actorId,
     userId: actorId,
@@ -26,6 +61,7 @@ function buildScheduledCommandAuth(schedule: ScheduledCommandContextSchedule): E
 export function buildScheduledCommandContext(
   schedule: ScheduledCommandContextSchedule,
   container: AppContainer,
+  options?: ScheduledCommandActorOptions,
 ): CommandRuntimeContext {
   const tenantId = schedule.tenantId ?? null
   const organizationId = schedule.organizationId ?? null
@@ -33,7 +69,7 @@ export function buildScheduledCommandContext(
 
   return {
     container,
-    auth: buildScheduledCommandAuth(schedule),
+    auth: buildScheduledCommandAuth(schedule, options),
     organizationScope:
       schedule.scopeType === 'organization' && organizationId
         ? {

package/src/modules/scheduler/lib/scheduler-safe-commands.ts

@@ -11,6 +11,27 @@ export type SchedulerCommandRbacService = {
   ) => Promise<boolean>
 }
 
+/**
+ * A scheduled command run was refused, and no retry can change that.
+ *
+ * Every rejection `assertSchedulerSafeCommandAuthorized` raises is a decision
+ * about the actor and the command, not a transient failure: the command is off
+ * the allowlist, there is no actor to authorize, the RBAC service is missing, or
+ * the actor lacks the required features. A `userHasAllFeatures` implementation
+ * whose store is down throws straight through instead, so callers can tell a
+ * refusal from an outage.
+ *
+ * Branch on this type, never on the message text: the wording is diagnostic and
+ * changes with the code — this release alone renamed `creator` to `actor` in two
+ * of the four — which is the fragility this type exists to remove.
+ */
+export class SchedulerCommandAuthorizationError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'SchedulerCommandAuthorizationError'
+  }
+}
+
 const schedulerSafeCommands = new Map<string, SchedulerSafeCommandDefinition>()
 
 function normalizeCommandId(commandId: unknown): string | null {
@@ -60,16 +81,16 @@ export async function assertSchedulerSafeCommandAuthorized(params: {
 }): Promise<SchedulerSafeCommandDefinition> {
   const command = getSchedulerSafeCommand(params.commandId)
   if (!command) {
-    throw new Error('Scheduled command is not allowed')
+    throw new SchedulerCommandAuthorizationError('Scheduled command is not allowed')
   }
 
   const actorUserId = normalizeCommandId(params.actorUserId)
   if (!actorUserId) {
-    throw new Error('Scheduled command requires an authenticated creator')
+    throw new SchedulerCommandAuthorizationError('Scheduled command requires an authenticated actor')
   }
 
   if (typeof params.rbacService.userHasAllFeatures !== 'function') {
-    throw new Error('Scheduled command authorization is unavailable')
+    throw new SchedulerCommandAuthorizationError('Scheduled command authorization is unavailable')
   }
 
   const authorized = await params.rbacService.userHasAllFeatures(actorUserId, command.requiredFeatures, {
@@ -77,7 +98,7 @@ export async function assertSchedulerSafeCommandAuthorized(params: {
     organizationId: params.organizationId ?? null,
   })
   if (!authorized) {
-    throw new Error('Scheduled command creator is not authorized')
+    throw new SchedulerCommandAuthorizationError('Scheduled command actor is not authorized')
   }
 
   return command

package/src/modules/scheduler/services/__tests__/localSchedulerService.test.ts

@@ -578,7 +578,7 @@ describe('LocalSchedulerService', () => {
         'scheduler.job.failed',
         expect.objectContaining({
           id: 'test-1',
-          error: 'Scheduled command creator is not authorized',
+          error: 'Scheduled command actor is not authorized',
         })
       )
       consoleErrorSpy.mockRestore()

package/src/modules/scheduler/services/localSchedulerService.ts

@@ -8,7 +8,7 @@ import { recalculateNextRun } from '../lib/nextRunCalculator'
 import { emitSchedulerEvent } from '../events.js'
 import { getGlobalEventBus } from '@open-mercato/shared/modules/events'
 import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'
-import { buildScheduledCommandContext } from '../lib/commandContext.js'
+import { buildScheduledCommandContext, resolveScheduledCommandActorUserId } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import {
@@ -319,7 +319,7 @@ export class LocalSchedulerService {
     }
 
     const commandBus = new CommandBus()
-    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''
+    const actorUserId = resolveScheduledCommandActorUserId(schedule)
     await assertSchedulerSafeCommandAuthorized({
       commandId: schedule.targetCommand,
       actorUserId,

package/src/modules/scheduler/workers/__tests__/execute-schedule.worker.test.ts

@@ -38,8 +38,10 @@ jest.mock('@open-mercato/shared/lib/redis/connection', () => ({
   getRedisUrlOrThrow: jest.fn(() => 'redis://localhost:6379'),
 }))
 
+const emitSchedulerEvent = jest.fn(async () => undefined)
+
 jest.mock('../../events', () => ({
-  emitSchedulerEvent: jest.fn(async () => undefined),
+  emitSchedulerEvent: (...args: unknown[]) => emitSchedulerEvent(...(args as [])),
 }))
 
 const scheduleId = '11111111-1111-4111-8111-111111111111'
@@ -135,6 +137,135 @@ describe('executeScheduleWorker command scope', () => {
   })
 })
 
+describe('executeScheduleWorker command actor attribution', () => {
+  function runWorker(
+    schedule: ScheduledJob,
+    payloadOverrides: Record<string, unknown> = {},
+    context = buildWorkerContext(schedule),
+  ) {
+    return {
+      context,
+      promise: executeScheduleWorker(
+        {
+          id: 'queued-job-1',
+          queue: 'scheduler-execution',
+          payload: {
+            scheduleId,
+            tenantId: schedule.tenantId,
+            organizationId: schedule.organizationId,
+            scopeType: schedule.scopeType,
+            ...payloadOverrides,
+          },
+          attempts: 0,
+          createdAt: Date.now(),
+        },
+        context.context,
+      ),
+    }
+  }
+
+  beforeEach(() => {
+    mockCommandExecute.mockReset()
+    emitSchedulerEvent.mockClear()
+    mockCommandExecute.mockResolvedValue({ result: { ok: true }, logEntry: null })
+  })
+
+  it('runs a manual trigger as the user who triggered it, not the creator', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const { context, promise } = runWorker(schedule, {
+      triggerType: 'manual',
+      triggeredByUserId: 'user-b',
+    })
+    await promise
+
+    // The gate authorizes the identity that will execute...
+    expect(context.rbacService.userHasAllFeatures).toHaveBeenCalledWith(
+      'user-b',
+      ['scheduler.jobs.manage'],
+      { tenantId: 'tenant-a', organizationId: 'org-a' },
+    )
+    // ...and the command context carries that same identity.
+    const [, { ctx }] = mockCommandExecute.mock.calls[0]
+    expect(ctx.auth).toMatchObject({ sub: 'user-b', userId: 'user-b' })
+  })
+
+  it('keeps running an unattended run as the schedule creator', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const { context, promise } = runWorker(schedule)
+    await promise
+
+    expect(context.rbacService.userHasAllFeatures).toHaveBeenCalledWith(
+      'user-a',
+      ['scheduler.jobs.manage'],
+      { tenantId: 'tenant-a', organizationId: 'org-a' },
+    )
+    const [, { ctx }] = mockCommandExecute.mock.calls[0]
+    expect(ctx.auth).toMatchObject({ sub: 'user-a', userId: 'user-a' })
+  })
+
+  it('ignores a triggering user carried on a scheduled (non-manual) run', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const { context, promise } = runWorker(schedule, {
+      triggerType: 'scheduled',
+      triggeredByUserId: 'user-b',
+    })
+    await promise
+
+    expect(context.rbacService.userHasAllFeatures).toHaveBeenCalledWith(
+      'user-a',
+      expect.anything(),
+      expect.anything(),
+    )
+  })
+
+  it('refuses a manual trigger whose triggering user lacks the target features, even when the creator holds them', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const context = buildWorkerContext(schedule)
+    context.rbacService.userHasAllFeatures.mockImplementation(async (userId: string) => userId === 'user-a')
+
+    const { promise } = runWorker(schedule, { triggerType: 'manual', triggeredByUserId: 'user-b' }, context)
+
+    // The refusal is permanent, so it ends the job rather than throwing: a throw
+    // is indistinguishable from an outage and BullMQ would retry a decision no
+    // attempt can change, leaving no trace but a log line.
+    await expect(promise).resolves.toBeUndefined()
+    expect(mockCommandExecute).not.toHaveBeenCalled()
+    expect(schedule.lastRunAt).toBeUndefined()
+    expect(emitSchedulerEvent).toHaveBeenCalledWith(
+      'scheduler.job.failed',
+      expect.objectContaining({ id: scheduleId, error: 'Scheduled command actor is not authorized' }),
+    )
+  })
+
+  it('still throws when the authorization lookup itself fails, so a genuine outage is retried', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const context = buildWorkerContext(schedule)
+    context.rbacService.userHasAllFeatures.mockRejectedValue(new Error('rbac store unavailable'))
+
+    const { promise } = runWorker(schedule, {}, context)
+
+    await expect(promise).rejects.toThrow('rbac store unavailable')
+    expect(emitSchedulerEvent).not.toHaveBeenCalledWith('scheduler.job.failed', expect.anything())
+  })
+
+  it('falls back to the creator when a manual trigger carries no user (API-key caller)', async () => {
+    const schedule = buildCommandSchedule({ createdByUserId: 'user-a' })
+    const { context, promise } = runWorker(schedule, {
+      triggerType: 'manual',
+      triggeredByUserId: null,
+    })
+    await promise
+
+    expect(context.rbacService.userHasAllFeatures).toHaveBeenCalledWith(
+      'user-a',
+      expect.anything(),
+      expect.anything(),
+    )
+    const [, { ctx }] = mockCommandExecute.mock.calls[0]
+    expect(ctx.auth).toMatchObject({ sub: 'user-a' })
+  })
+})
+
 describe('executeScheduleWorker queue target payload contract', () => {
   const enqueue = jest.fn(async () => 'target-job-1')
   const close = jest.fn(async () => undefined)

package/src/modules/scheduler/workers/execute-schedule.worker.ts

@@ -6,8 +6,11 @@ import { ScheduledJob } from '../data/entities.js'
 import { CommandBus } from '@open-mercato/shared/lib/commands'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { emitSchedulerEvent } from '../events.js'
-import { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'
-import { buildScheduledCommandContext } from '../lib/commandContext.js'
+import {
+  assertSchedulerSafeCommandAuthorized,
+  SchedulerCommandAuthorizationError,
+} from '../lib/scheduler-safe-commands.js'
+import { buildScheduledCommandContext, resolveScheduledCommandActorUserId } from '../lib/commandContext.js'
 import { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import {
@@ -280,23 +283,65 @@ export default async function executeScheduleWorker(
 
   } else if (schedule.targetType === 'command' && schedule.targetCommand) {
     const commandBus = new CommandBus()
-    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''
-    await assertSchedulerSafeCommandAuthorized({
-      commandId: schedule.targetCommand,
-      actorUserId,
-      tenantId: schedule.tenantId,
-      organizationId: schedule.organizationId,
-      rbacService,
-    })
-    
+    // A manual run acts as whoever pressed the button; an unattended run keeps
+    // acting as the schedule's creator. The gate below and the context built
+    // afterwards must agree on that identity, so it is resolved once, by the same
+    // helper the context itself uses.
+    const triggeredByUserId = payload.triggerType === 'manual' ? payload.triggeredByUserId ?? null : null
+    const actorUserId = resolveScheduledCommandActorUserId(schedule, { triggeredByUserId })
+    try {
+      await assertSchedulerSafeCommandAuthorized({
+        commandId: schedule.targetCommand,
+        actorUserId,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        rbacService,
+      })
+    } catch (error) {
+      // A refusal is permanent, so it must not be thrown: throwing hands BullMQ an
+      // error it cannot tell from an outage and it retries a decision that no
+      // attempt can change, while the run leaves no trace beyond a log line. The
+      // queue branch above already ends its equivalent conditions with an event and
+      // a return; this does the same, and records the refusal as a failure rather
+      // than a skip because a schedule whose actor may no longer run its command is
+      // a state an operator has to act on.
+      //
+      // Only the authorization decision is swallowed. Anything else — an RBAC
+      // lookup that fails because its store is down — is genuinely transient and
+      // still propagates so BullMQ retries it.
+      if (!(error instanceof SchedulerCommandAuthorizationError)) throw error
+
+      const reason = error.message
+      await emitSchedulerEvent('scheduler.job.failed', {
+        id: schedule.id,
+        tenantId: schedule.tenantId,
+        organizationId: schedule.organizationId,
+        scheduleName: schedule.name,
+        scopeType: schedule.scopeType,
+        error: reason,
+        failedAt: new Date(),
+      })
+
+      logger.warn('Schedule refused: scheduled command is not authorized', {
+        scheduleId: schedule.id,
+        commandId: schedule.targetCommand,
+        triggerType: payload.triggerType ?? 'scheduled',
+        reason,
+      })
+      return
+    }
+
     const commandInput = {
       ...((schedule.targetPayload as Record<string, unknown>) || {}),
       tenantId: schedule.tenantId,
       organizationId: schedule.organizationId,
     }
-    
+
     // Build the schedule-scoped command context after the allowlist/RBAC gate.
-    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer)
+    // The gate authorized `actorUserId`; this must execute as that same identity.
+    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer, {
+      triggeredByUserId,
+    })
     
     const commandResult = await commandBus.execute(schedule.targetCommand, {
       input: commandInput,