@open-mercato/search 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/search/api/__tests__/global-search.routes.test.ts

@@ -198,6 +198,113 @@ describe('GET /api/search/search/global presenter localization', () => {
       expect(result.links?.[0]?.label).toBe('Otwórz osobę')
     }
   })
+
+  // Covers OM_SEARCH_CUSTOMERS_INDEX_BASE_ENTITY=true, where base customer rows are tokenized and
+  // the route can therefore receive both halves of a pair. Under the default the token strategy
+  // never returns the base rows at all (see token-strategy-entity-exclusion.test.ts); the strategy
+  // here is a stub that yields them regardless, so this pins the merge itself.
+  it('merges a customer entity and profile pair into one navigable result when both are indexed', async () => {
+    const rows = [
+      {
+        entity_type: 'customers:customer_entity',
+        entity_id: 'person-entity',
+        doc: { id: 'person-entity', display_name: 'Ada Lovelace', kind: 'person' },
+      },
+      {
+        entity_type: 'customers:customer_person_profile',
+        entity_id: 'person-profile',
+        doc: { id: 'person-profile', entity_id: 'person-entity', display_name: 'Ada Lovelace' },
+      },
+      {
+        entity_type: 'customers:customer_entity',
+        entity_id: 'company-entity',
+        doc: { id: 'company-entity', display_name: 'Analytical Engines', kind: 'company' },
+      },
+      {
+        entity_type: 'customers:customer_company_profile',
+        entity_id: 'company-profile',
+        doc: { id: 'company-profile', entity_id: 'company-entity', display_name: 'Analytical Engines' },
+      },
+      {
+        entity_type: 'orders:order',
+        entity_id: 'order-1',
+        doc: { id: 'order-1', title: 'Order 1' },
+      },
+    ]
+    const personEntityId = 'customers:customer_person_profile' as EntityId
+    const companyEntityId = 'customers:customer_company_profile' as EntityId
+    const configMap = new Map<EntityId, SearchEntityConfig>([
+      [personEntityId, {
+        entityId: personEntityId,
+        formatResult: async (context) => ({ title: String(context.record.display_name) }),
+        resolveUrl: async (context) => `/backend/customers/people-v2/${String(context.record.entity_id)}`,
+      }],
+      [companyEntityId, {
+        entityId: companyEntityId,
+        formatResult: async (context) => ({ title: String(context.record.display_name) }),
+        resolveUrl: async (context) => `/backend/customers/companies-v2/${String(context.record.entity_id)}`,
+      }],
+    ])
+    const scoresByRecordId: Record<string, number> = {
+      'person-profile': 0.95,
+      'company-profile': 0.85,
+      'order-1': 0.5,
+      'person-entity': 0.2,
+      'company-entity': 0.1,
+    }
+    const results: SearchResult[] = rows
+      .map((row) => ({
+        entityId: row.entity_type as EntityId,
+        recordId: row.entity_id,
+        organizationId: 'org-1',
+        score: scoresByRecordId[row.entity_id] ?? 0,
+        source: 'tokens' as const,
+      }))
+      .sort((left, right) => right.score - left.score)
+    const strategy: SearchStrategy = {
+      id: 'tokens',
+      name: 'tokens',
+      priority: 10,
+      isAvailable: async () => true,
+      ensureReady: async () => undefined,
+      search: async () => results,
+      index: async () => undefined,
+      delete: async () => undefined,
+    }
+    const searchService = new SearchService({
+      strategies: [strategy],
+      defaultStrategies: ['tokens'],
+      presenterEnricher: createPresenterEnricher(createDatabase(rows), configMap),
+    })
+    mockCreateRequestContainer.mockResolvedValue(
+      createContainer(searchService, configMap, { features: ['search.global'], isSuperAdmin: true }),
+    )
+
+    const response = await GET(new Request('http://localhost/api/search/search/global?q=customer'))
+    const body = await response.json() as { results: SearchResult[] }
+
+    expect(response.status).toBe(200)
+    expect(body.results).toEqual([
+      expect.objectContaining({
+        entityId: 'customers:customer_entity',
+        recordId: 'person-entity',
+        presenter: expect.objectContaining({ title: 'Ada Lovelace' }),
+        url: '/backend/customers/people-v2/person-entity',
+      }),
+      expect.objectContaining({
+        entityId: 'customers:customer_entity',
+        recordId: 'company-entity',
+        presenter: expect.objectContaining({ title: 'Analytical Engines' }),
+        url: '/backend/customers/companies-v2/company-entity',
+      }),
+      expect.objectContaining({
+        entityId: 'orders:order',
+        recordId: 'order-1',
+      }),
+    ])
+    expect(body.results[0]?.score).toBeGreaterThan(body.results[1]?.score ?? 0)
+    expect(body.results[1]?.score).toBeGreaterThan(body.results[2]?.score ?? 0)
+  })
 })
 
 describe('GET /api/search/search/global per-entity access control', () => {

package/src/modules/search/lib/entity-access.ts

@@ -1,132 +1,6 @@
-import type { SearchEntityConfig } from '@open-mercato/shared/modules/search'
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
-
 /**
- * Minimal shape of the `searchIndexer` DI service consumed by per-entity ACL
- * resolution. Kept structural so callers and tests can pass a plain object
- * instead of constructing a full `SearchIndexer`.
+ * Re-export shared entity-access helpers so existing imports keep working.
+ * The canonical implementation lives in @open-mercato/shared to be reusable
+ * from ai-assistant without introducing a search↔ai-assistant dependency cycle.
  */
-export type SearchEntityConfigLookup = {
-  getEntityConfig: (entityId: string) => SearchEntityConfig | undefined
-  getAllEntityConfigs: () => SearchEntityConfig[]
-}
-
-export type SearchEntityAccessSubject = {
-  grantedFeatures: readonly string[]
-  isSuperAdmin?: boolean
-}
-
-export type SearchEntityDenyReason =
-  /** No module declares this entity in a `search.ts` config. */
-  | 'unconfigured'
-  /** The entity is configured for search but declares no `aclFeatures`. */
-  | 'no-acl-features'
-  /** The caller does not hold the entity's declared view feature(s). */
-  | 'insufficient-features'
-
-export type SearchEntityAccessOptions = {
-  /**
-   * Called once per denied entity type. Exists so a silent drop is diagnosable:
-   * results disappearing because a module forgot to declare `aclFeatures` looks
-   * identical, from the palette, to results that simply did not match.
-   */
-  onDeny?: (entityId: string, reason: SearchEntityDenyReason) => void
-}
-
-/**
- * Decide whether a caller may see results for one entity type.
- *
- * The single `search.global` gate on the palette only says "this user may use
- * global search"; it says nothing about which records they may read. Each entity
- * declares the owning module's view feature(s) in `aclFeatures`, and those are
- * what actually authorize the read — the same rule the `search_get` /
- * `search_aggregate` AI tools already apply.
- *
- * Fails closed: an entity that is not registered for search, or that declares no
- * `aclFeatures`, is never exposed to a non-superadmin caller.
- */
-export function canReadSearchEntity(
-  entityId: string,
-  lookup: SearchEntityConfigLookup,
-  subject: SearchEntityAccessSubject,
-  options: SearchEntityAccessOptions = {},
-): boolean {
-  if (subject.isSuperAdmin) return true
-
-  const config = lookup.getEntityConfig(entityId)
-  if (!config) {
-    options.onDeny?.(entityId, 'unconfigured')
-    return false
-  }
-
-  const required = config.aclFeatures
-  if (!required || required.length === 0) {
-    options.onDeny?.(entityId, 'no-acl-features')
-    return false
-  }
-
-  const allowed = authorizeFeatures(required, {
-    grantedFeatures: subject.grantedFeatures,
-    unrestricted: false,
-  })
-  if (!allowed) options.onDeny?.(entityId, 'insufficient-features')
-  return allowed
-}
-
-/**
- * The entity types this caller may read, narrowed to `requestedEntityTypes` when
- * the caller asked for specific ones.
- *
- * Restricting the query up front is what keeps `limit` meaningful. Filtering only
- * after the search would spend the whole result budget on records the caller
- * cannot see: an employee granted just `customers.people.view` would get the top
- * 50 hits across every entity type, then watch most of them be dropped, and the
- * palette would look empty even with hundreds of matching people behind it.
- *
- * Returns `undefined` when no restriction applies (superadmin with no explicit
- * request), and an empty array when nothing is readable — callers should
- * short-circuit on that rather than pass it down as "no filter".
- */
-export function resolveReadableEntityTypes(
-  lookup: SearchEntityConfigLookup,
-  subject: SearchEntityAccessSubject,
-  requestedEntityTypes?: string[],
-): string[] | undefined {
-  if (subject.isSuperAdmin) return requestedEntityTypes
-
-  const readable = lookup
-    .getAllEntityConfigs()
-    .filter((config) => config.enabled !== false)
-    .map((config) => config.entityId)
-    .filter((entityId) => canReadSearchEntity(entityId, lookup, subject))
-
-  if (!requestedEntityTypes) return readable
-  const requested = new Set(requestedEntityTypes)
-  return readable.filter((entityId) => requested.has(entityId))
-}
-
-/**
- * Drop the results whose entity type the caller is not allowed to read.
- *
- * Filtering happens server-side so an under-privileged caller never receives the
- * presenter title, subtitle or deep link of a record they cannot open. Decisions
- * are memoized per entity type because a single response commonly mixes dozens of
- * results across a handful of types.
- */
-export function filterSearchResultsByEntityAccess<T extends { entityId: string }>(
-  results: readonly T[],
-  lookup: SearchEntityConfigLookup,
-  subject: SearchEntityAccessSubject,
-  options: SearchEntityAccessOptions = {},
-): T[] {
-  if (subject.isSuperAdmin) return [...results]
-
-  const decisions = new Map<string, boolean>()
-  return results.filter((result) => {
-    const cached = decisions.get(result.entityId)
-    if (cached !== undefined) return cached
-    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options)
-    decisions.set(result.entityId, allowed)
-    return allowed
-  })
-}
+export * from '@open-mercato/shared/lib/search/entityAccess'

package/src/modules/search/workers/fulltext-index.worker.ts

@@ -78,8 +78,9 @@ async function advanceFulltextReindexProgress(params: {
  * This handler processes single record indexing, batch indexing, deletion, and purge
  * operations for the fulltext search strategy.
  *
- * All indexing operations (single and batch) use searchIndexer.indexRecordById() to load
- * fresh data, ensuring consistency with the vector worker pattern.
+ * Single-record jobs load fresh data via searchIndexer.indexRecordById(). Batch jobs load
+ * fresh data per record via searchIndexer.indexRecordsById(), which flushes the whole batch
+ * through a single bulk write instead of one write per record.
  *
  * @param job - The queued job containing payload
  * @param jobCtx - Queue job context with job ID and attempt info
@@ -202,7 +203,7 @@ export async function handleFulltextIndexJob(
       return
     }
 
-    // ========== BATCH-INDEX: Use searchIndexer.indexRecordById() for fresh data ==========
+    // ========== BATCH-INDEX: Load fresh data, write the whole batch in one call ==========
     if (jobType === 'batch-index') {
       const { records, organizationId } = job.payload
       if (!records || records.length === 0) {
@@ -216,30 +217,13 @@ export async function handleFulltextIndexJob(
         throw new Error('searchIndexer not available for batch indexing')
       }
 
-      // Process each record using indexRecordById (same pattern as vector worker)
-      let successCount = 0
-      let failCount = 0
-
-      for (const { entityId, recordId } of records) {
-        try {
-          const result = await searchIndexer.indexRecordById({
-            entityId: entityId as EntityId,
-            recordId,
-            tenantId,
-            organizationId,
-          })
-          if (result.action === 'indexed') {
-            successCount++
-          }
-        } catch (error) {
-          failCount++
-          searchDebugWarn('fulltext-index.worker', 'Failed to index record in batch', {
-            entityId,
-            recordId,
-            error: error instanceof Error ? error.message : error,
-          })
-        }
-      }
+      // Load and index the whole batch through a single bulk write instead of
+      // one indexRecordById() call per record.
+      const { indexed: successCount, skipped: skippedCount } = await searchIndexer.indexRecordsById({
+        items: records.map(({ entityId, recordId }) => ({ entityId: entityId as EntityId, recordId })),
+        tenantId,
+        organizationId,
+      })
 
       await advanceFulltextReindexProgress({
         db,
@@ -255,7 +239,7 @@ export async function handleFulltextIndexJob(
         tenantId,
         requestedCount: records.length,
         successCount,
-        failCount,
+        skippedCount,
       })
 
       await recordIndexerLog(
@@ -265,7 +249,7 @@ export async function handleFulltextIndexJob(
           handler: 'worker:fulltext:batch-index',
           message: `Indexed ${successCount}/${records.length} records to fulltext`,
           tenantId,
-          details: { jobId: jobCtx.jobId, requestedCount: records.length, successCount, failCount },
+          details: { jobId: jobCtx.jobId, requestedCount: records.length, successCount, skippedCount },
         },
       )
       return

package/src/service.ts

@@ -25,6 +25,38 @@ const DEFAULT_MERGE_CONFIG: ResultMergeConfig = {
  */
 const STRATEGY_AVAILABILITY_CACHE_TTL_MS = 2_000
 
+/**
+ * Maximum records indexed at once when bulkIndex falls back to per-record writes
+ * for a strategy that has no bulkIndex implementation (currently the vector
+ * strategy, whose index() performs an embedding-provider round trip per record).
+ * A whole reindex page arrives in one bulkIndex call, so an unbounded fan-out
+ * would burst hundreds of concurrent provider requests from a single job.
+ */
+const BULK_INDEX_FALLBACK_CONCURRENCY = 4
+
+/**
+ * Map items through an async worker with a fixed number of in-flight calls.
+ * Rejects with the first error, matching Promise.all semantics.
+ */
+async function mapWithConcurrency<T>(
+  items: T[],
+  limit: number,
+  worker: (item: T) => Promise<void>,
+): Promise<void> {
+  if (items.length === 0) return
+
+  let nextIndex = 0
+  const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    for (;;) {
+      const currentIndex = nextIndex++
+      if (currentIndex >= items.length) return
+      await worker(items[currentIndex])
+    }
+  })
+
+  await Promise.all(runners)
+}
+
 function normalizeOrganizationFilter(options: SearchOptions): string[] | null {
   const single = typeof options.organizationId === 'string' ? options.organizationId.trim() : ''
   if (single) return [single]
@@ -235,8 +267,11 @@ export class SearchService {
         if (strategy.bulkIndex) {
           return strategy.bulkIndex(records)
         }
-        // Fallback to individual indexing
-        return Promise.all(records.map((record) => this.executeStrategyIndex(strategy, record)))
+        // Fallback to individual indexing, bounded so a strategy without a batch
+        // implementation cannot turn one batch job into hundreds of concurrent writes.
+        return mapWithConcurrency(records, BULK_INDEX_FALLBACK_CONCURRENCY, (record) =>
+          this.executeStrategyIndex(strategy, record),
+        )
       }),
     )
 

package/src/strategies/token.strategy.ts

@@ -67,10 +67,21 @@ export class TokenSearchStrategy implements SearchStrategy {
     // Dynamically import tokenization to avoid circular dependencies
     const { tokenizeText } = await import('@open-mercato/shared/lib/search/tokenize')
     const { resolveSearchConfig } = await import('@open-mercato/shared/lib/search/config')
+    const { listSearchTokenExcludedEntityTypes } = await import(
+      '@open-mercato/core/modules/query_index/lib/search-entity-policy'
+    )
 
     const config = resolveSearchConfig()
     if (!config.enabled) return []
 
+    // The rows themselves stay in `search_tokens` — list routes and the query engines' encrypted
+    // like/ilike rewrite depend on them — so the exclusion is enforced here, at read time.
+    const excludedEntityTypes = listSearchTokenExcludedEntityTypes()
+    const requestedEntityTypes = options.entityTypes?.length
+      ? options.entityTypes.filter((entityType) => !excludedEntityTypes.includes(entityType))
+      : undefined
+    if (options.entityTypes?.length && !requestedEntityTypes?.length) return []
+
     const { hashes } = tokenizeText(query, config)
     if (hashes.length === 0) return []
 
@@ -96,8 +107,10 @@ export class TokenSearchStrategy implements SearchStrategy {
       queryBuilder = queryBuilder.where('organization_id' as any, 'in', organizationIds)
     }
 
-    if (options.entityTypes?.length) {
-      queryBuilder = queryBuilder.where('entity_type' as any, 'in', options.entityTypes)
+    if (requestedEntityTypes?.length) {
+      queryBuilder = queryBuilder.where('entity_type' as any, 'in', requestedEntityTypes)
+    } else if (excludedEntityTypes.length) {
+      queryBuilder = queryBuilder.where('entity_type' as any, 'not in', excludedEntityTypes)
     }
 
     const rows = await queryBuilder.execute() as Array<{