@open-mercato/shared 0.10.1-develop.7601.1.e057b693a8 → 0.10.1-develop.7616.1.51a1f65492

package/.turbo/turbo-build.log

@@ -1,3 +1,3 @@
 [generate-countries] up to date (259 countries)
-[build:shared] found 321 entry points
+[build:shared] found 322 entry points
 [build:shared] built successfully

package/dist/lib/encryption/unresolvedMapEntityIds.js

@@ -0,0 +1,70 @@
+import { createLogger } from "../logger/index.js";
+import { getEntityIds } from "./entityIds.js";
+const logger = createLogger("shared").child({ component: "encryption" });
+function editDistance(left, right) {
+  const distances = Array.from({ length: right.length + 1 }, (_, index) => index);
+  for (let row = 1; row <= left.length; row++) {
+    let diagonal = distances[0];
+    distances[0] = row;
+    for (let column = 1; column <= right.length; column++) {
+      const above = distances[column];
+      distances[column] = Math.min(
+        above + 1,
+        distances[column - 1] + 1,
+        diagonal + (left[row - 1] === right[column - 1] ? 0 : 1)
+      );
+      diagonal = above;
+    }
+  }
+  return distances[right.length];
+}
+function closestEntityId(entityId, candidates) {
+  const rank = (candidate) => [
+    candidate.startsWith(entityId) || entityId.startsWith(candidate) ? 0 : 1,
+    editDistance(entityId, candidate)
+  ];
+  let closest = null;
+  let closestRank = [Number.POSITIVE_INFINITY, Number.POSITIVE_INFINITY];
+  for (const candidate of candidates) {
+    const candidateRank = rank(candidate);
+    if (candidateRank[0] < closestRank[0] || candidateRank[0] === closestRank[0] && candidateRank[1] < closestRank[1]) {
+      closest = candidate;
+      closestRank = candidateRank;
+    }
+  }
+  return closest;
+}
+function findUnresolvedEncryptionMapEntityIds(maps, entityIds) {
+  const registered = new Set(Object.values(entityIds).flatMap((moduleEntityIds) => Object.values(moduleEntityIds ?? {})));
+  const checked = /* @__PURE__ */ new Set();
+  const unresolved = [];
+  for (const { entityId } of maps) {
+    if (registered.has(entityId) || checked.has(entityId)) continue;
+    checked.add(entityId);
+    const moduleId = entityId.split(":")[0];
+    const moduleEntityIds = Object.values(entityIds[moduleId] ?? {});
+    if (!moduleEntityIds.length) continue;
+    unresolved.push({ entityId, suggestion: closestEntityId(entityId, moduleEntityIds) });
+  }
+  return unresolved;
+}
+const warnedEntityIds = /* @__PURE__ */ new Set();
+function warnUnresolvedEncryptionMapEntityIds(maps) {
+  for (const { entityId, suggestion } of findUnresolvedEncryptionMapEntityIds(maps, getEntityIds(false))) {
+    if (warnedEntityIds.has(entityId)) continue;
+    warnedEntityIds.add(entityId);
+    logger.warn("Encryption map entityId matches no registered entity - its fields are stored as plaintext", {
+      entityId,
+      suggestion
+    });
+  }
+}
+function resetUnresolvedEncryptionMapWarnings() {
+  warnedEntityIds.clear();
+}
+export {
+  findUnresolvedEncryptionMapEntityIds,
+  resetUnresolvedEncryptionMapWarnings,
+  warnUnresolvedEncryptionMapEntityIds
+};
+//# sourceMappingURL=unresolvedMapEntityIds.js.map

package/dist/lib/encryption/unresolvedMapEntityIds.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/encryption/unresolvedMapEntityIds.ts"],
+  "sourcesContent": ["import type { ModuleEncryptionMap } from '../../modules/encryption'\nimport { createLogger } from '../logger'\nimport { getEntityIds, type EntityIds } from './entityIds'\n\nconst logger = createLogger('shared').child({ component: 'encryption' })\n\nexport type UnresolvedEncryptionMapEntityId = {\n  entityId: string\n  suggestion: string | null\n}\n\nfunction editDistance(left: string, right: string): number {\n  const distances = Array.from({ length: right.length + 1 }, (_, index) => index)\n  for (let row = 1; row <= left.length; row++) {\n    let diagonal = distances[0]\n    distances[0] = row\n    for (let column = 1; column <= right.length; column++) {\n      const above = distances[column]\n      distances[column] = Math.min(\n        above + 1,\n        distances[column - 1] + 1,\n        diagonal + (left[row - 1] === right[column - 1] ? 0 : 1),\n      )\n      diagonal = above\n    }\n  }\n  return distances[right.length]\n}\n\nfunction closestEntityId(entityId: string, candidates: string[]): string | null {\n  const rank = (candidate: string): [number, number] => [\n    candidate.startsWith(entityId) || entityId.startsWith(candidate) ? 0 : 1,\n    editDistance(entityId, candidate),\n  ]\n  let closest: string | null = null\n  let closestRank: [number, number] = [Number.POSITIVE_INFINITY, Number.POSITIVE_INFINITY]\n  for (const candidate of candidates) {\n    const candidateRank = rank(candidate)\n    if (candidateRank[0] < closestRank[0] || (candidateRank[0] === closestRank[0] && candidateRank[1] < closestRank[1])) {\n      closest = candidate\n      closestRank = candidateRank\n    }\n  }\n  return closest\n}\n\n/**\n * Lists encryption maps whose `entityId` names a module that registers ORM entities but matches\n * none of them. The encryption subscriber derives the entity id from the entity class, so such a\n * map is never consulted and the fields it declares are stored as plaintext.\n *\n * Ids outside an entity-registering module are left alone: `vector:vector_search`, for example,\n * is encrypted explicitly by the search module rather than through an ORM entity.\n */\nexport function findUnresolvedEncryptionMapEntityIds(\n  maps: ReadonlyArray<Pick<ModuleEncryptionMap, 'entityId'>>,\n  entityIds: EntityIds,\n): UnresolvedEncryptionMapEntityId[] {\n  const registered = new Set(Object.values(entityIds).flatMap((moduleEntityIds) => Object.values(moduleEntityIds ?? {})))\n  const checked = new Set<string>()\n  const unresolved: UnresolvedEncryptionMapEntityId[] = []\n  for (const { entityId } of maps) {\n    if (registered.has(entityId) || checked.has(entityId)) continue\n    checked.add(entityId)\n    const moduleId = entityId.split(':')[0]\n    const moduleEntityIds = Object.values(entityIds[moduleId] ?? {})\n    if (!moduleEntityIds.length) continue\n    unresolved.push({ entityId, suggestion: closestEntityId(entityId, moduleEntityIds) })\n  }\n  return unresolved\n}\n\nconst warnedEntityIds = new Set<string>()\n\n/**\n * Warns about every unresolved map once per process. The core DI bootstrap that loads the maps\n * can run once per request container, so repeated calls stay quiet.\n */\nexport function warnUnresolvedEncryptionMapEntityIds(maps: ReadonlyArray<Pick<ModuleEncryptionMap, 'entityId'>>): void {\n  for (const { entityId, suggestion } of findUnresolvedEncryptionMapEntityIds(maps, getEntityIds(false))) {\n    if (warnedEntityIds.has(entityId)) continue\n    warnedEntityIds.add(entityId)\n    logger.warn('Encryption map entityId matches no registered entity - its fields are stored as plaintext', {\n      entityId,\n      suggestion,\n    })\n  }\n}\n\nexport function resetUnresolvedEncryptionMapWarnings(): void {\n  warnedEntityIds.clear()\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoC;AAE7C,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,aAAa,CAAC;AAOvE,SAAS,aAAa,MAAc,OAAuB;AACzD,QAAM,YAAY,MAAM,KAAK,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,UAAU,KAAK;AAC9E,WAAS,MAAM,GAAG,OAAO,KAAK,QAAQ,OAAO;AAC3C,QAAI,WAAW,UAAU,CAAC;AAC1B,cAAU,CAAC,IAAI;AACf,aAAS,SAAS,GAAG,UAAU,MAAM,QAAQ,UAAU;AACrD,YAAM,QAAQ,UAAU,MAAM;AAC9B,gBAAU,MAAM,IAAI,KAAK;AAAA,QACvB,QAAQ;AAAA,QACR,UAAU,SAAS,CAAC,IAAI;AAAA,QACxB,YAAY,KAAK,MAAM,CAAC,MAAM,MAAM,SAAS,CAAC,IAAI,IAAI;AAAA,MACxD;AACA,iBAAW;AAAA,IACb;AAAA,EACF;AACA,SAAO,UAAU,MAAM,MAAM;AAC/B;AAEA,SAAS,gBAAgB,UAAkB,YAAqC;AAC9E,QAAM,OAAO,CAAC,cAAwC;AAAA,IACpD,UAAU,WAAW,QAAQ,KAAK,SAAS,WAAW,SAAS,IAAI,IAAI;AAAA,IACvE,aAAa,UAAU,SAAS;AAAA,EAClC;AACA,MAAI,UAAyB;AAC7B,MAAI,cAAgC,CAAC,OAAO,mBAAmB,OAAO,iBAAiB;AACvF,aAAW,aAAa,YAAY;AAClC,UAAM,gBAAgB,KAAK,SAAS;AACpC,QAAI,cAAc,CAAC,IAAI,YAAY,CAAC,KAAM,cAAc,CAAC,MAAM,YAAY,CAAC,KAAK,cAAc,CAAC,IAAI,YAAY,CAAC,GAAI;AACnH,gBAAU;AACV,oBAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,qCACd,MACA,WACmC;AACnC,QAAM,aAAa,IAAI,IAAI,OAAO,OAAO,SAAS,EAAE,QAAQ,CAAC,oBAAoB,OAAO,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC;AACtH,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,aAAgD,CAAC;AACvD,aAAW,EAAE,SAAS,KAAK,MAAM;AAC/B,QAAI,WAAW,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAG;AACvD,YAAQ,IAAI,QAAQ;AACpB,UAAM,WAAW,SAAS,MAAM,GAAG,EAAE,CAAC;AACtC,UAAM,kBAAkB,OAAO,OAAO,UAAU,QAAQ,KAAK,CAAC,CAAC;AAC/D,QAAI,CAAC,gBAAgB,OAAQ;AAC7B,eAAW,KAAK,EAAE,UAAU,YAAY,gBAAgB,UAAU,eAAe,EAAE,CAAC;AAAA,EACtF;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,oBAAI,IAAY;AAMjC,SAAS,qCAAqC,MAAkE;AACrH,aAAW,EAAE,UAAU,WAAW,KAAK,qCAAqC,MAAM,aAAa,KAAK,CAAC,GAAG;AACtG,QAAI,gBAAgB,IAAI,QAAQ,EAAG;AACnC,oBAAgB,IAAI,QAAQ;AAC5B,WAAO,KAAK,6FAA6F;AAAA,MACvG;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEO,SAAS,uCAA6C;AAC3D,kBAAgB,MAAM;AACxB;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.10.1-develop.7601.1.e057b693a8";
+const APP_VERSION = "0.10.1-develop.7616.1.51a1f65492";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7601.1.e057b693a8';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7616.1.51a1f65492';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.10.1-develop.7601.1.e057b693a8",
+  "version": "0.10.1-develop.7616.1.51a1f65492",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -126,7 +126,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.10.1-develop.7601.1.e057b693a8",
+    "@open-mercato/cache": "0.10.1-develop.7616.1.51a1f65492",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/encryption/__tests__/unresolvedMapEntityIds.test.ts

@@ -0,0 +1,92 @@
+const mockWarn = jest.fn()
+
+jest.mock('../../logger', () => ({
+  createLogger: () => ({ child: () => ({ warn: mockWarn }) }),
+}))
+
+import { registerEntityIds } from '../entityIds'
+import {
+  findUnresolvedEncryptionMapEntityIds,
+  resetUnresolvedEncryptionMapWarnings,
+  warnUnresolvedEncryptionMapEntityIds,
+} from '../unresolvedMapEntityIds'
+
+const entityIds = {
+  customers: {
+    customer_entity: 'customers:customer_entity',
+    customer_deal: 'customers:customer_deal',
+  },
+  fleet: {
+    vehicle_profile: 'fleet:vehicle_profile',
+    vehicle_trip: 'fleet:vehicle_trip',
+  },
+}
+
+describe('findUnresolvedEncryptionMapEntityIds', () => {
+  it('accepts maps whose entityId is a registered entity', () => {
+    expect(
+      findUnresolvedEncryptionMapEntityIds(
+        [{ entityId: 'customers:customer_entity' }, { entityId: 'fleet:vehicle_trip' }],
+        entityIds,
+      ),
+    ).toEqual([])
+  })
+
+  it('reports a map that names no entity of a module that registers entities, with the closest match', () => {
+    expect(
+      findUnresolvedEncryptionMapEntityIds([{ entityId: 'fleet:vehicle' }, { entityId: 'fleet:vehicle' }], entityIds),
+    ).toEqual([{ entityId: 'fleet:vehicle', suggestion: 'fleet:vehicle_trip' }])
+    expect(findUnresolvedEncryptionMapEntityIds([{ entityId: 'fleet:vehicle_profiles' }], entityIds)).toEqual([
+      { entityId: 'fleet:vehicle_profiles', suggestion: 'fleet:vehicle_profile' },
+    ])
+  })
+
+  it('prefers an entity that shares the declared prefix over a merely shorter edit', () => {
+    const registry = {
+      customers: {
+        customer_deal: 'customers:customer_deal',
+        customer_person_profile: 'customers:customer_person_profile',
+      },
+    }
+
+    expect(findUnresolvedEncryptionMapEntityIds([{ entityId: 'customers:customer_person' }], registry)).toEqual([
+      { entityId: 'customers:customer_person', suggestion: 'customers:customer_person_profile' },
+    ])
+  })
+
+  it('leaves ids outside an entity-registering module alone', () => {
+    expect(
+      findUnresolvedEncryptionMapEntityIds(
+        [{ entityId: 'vector:vector_search' }, { entityId: 'no_colon_id' }],
+        entityIds,
+      ),
+    ).toEqual([])
+  })
+})
+
+describe('warnUnresolvedEncryptionMapEntityIds', () => {
+  beforeEach(() => {
+    mockWarn.mockClear()
+    resetUnresolvedEncryptionMapWarnings()
+    registerEntityIds(entityIds)
+  })
+
+  it('warns once per unresolved map, however often bootstrap runs', () => {
+    const maps = [{ entityId: 'fleet:vehicle_profiles' }, { entityId: 'customers:customer_entity' }]
+
+    warnUnresolvedEncryptionMapEntityIds(maps)
+    warnUnresolvedEncryptionMapEntityIds(maps)
+
+    expect(mockWarn).toHaveBeenCalledTimes(1)
+    expect(mockWarn).toHaveBeenCalledWith(expect.stringContaining('stored as plaintext'), {
+      entityId: 'fleet:vehicle_profiles',
+      suggestion: 'fleet:vehicle_profile',
+    })
+  })
+
+  it('stays quiet when every map resolves', () => {
+    warnUnresolvedEncryptionMapEntityIds([{ entityId: 'customers:customer_deal' }])
+
+    expect(mockWarn).not.toHaveBeenCalled()
+  })
+})

package/src/lib/encryption/unresolvedMapEntityIds.ts

@@ -0,0 +1,92 @@
+import type { ModuleEncryptionMap } from '../../modules/encryption'
+import { createLogger } from '../logger'
+import { getEntityIds, type EntityIds } from './entityIds'
+
+const logger = createLogger('shared').child({ component: 'encryption' })
+
+export type UnresolvedEncryptionMapEntityId = {
+  entityId: string
+  suggestion: string | null
+}
+
+function editDistance(left: string, right: string): number {
+  const distances = Array.from({ length: right.length + 1 }, (_, index) => index)
+  for (let row = 1; row <= left.length; row++) {
+    let diagonal = distances[0]
+    distances[0] = row
+    for (let column = 1; column <= right.length; column++) {
+      const above = distances[column]
+      distances[column] = Math.min(
+        above + 1,
+        distances[column - 1] + 1,
+        diagonal + (left[row - 1] === right[column - 1] ? 0 : 1),
+      )
+      diagonal = above
+    }
+  }
+  return distances[right.length]
+}
+
+function closestEntityId(entityId: string, candidates: string[]): string | null {
+  const rank = (candidate: string): [number, number] => [
+    candidate.startsWith(entityId) || entityId.startsWith(candidate) ? 0 : 1,
+    editDistance(entityId, candidate),
+  ]
+  let closest: string | null = null
+  let closestRank: [number, number] = [Number.POSITIVE_INFINITY, Number.POSITIVE_INFINITY]
+  for (const candidate of candidates) {
+    const candidateRank = rank(candidate)
+    if (candidateRank[0] < closestRank[0] || (candidateRank[0] === closestRank[0] && candidateRank[1] < closestRank[1])) {
+      closest = candidate
+      closestRank = candidateRank
+    }
+  }
+  return closest
+}
+
+/**
+ * Lists encryption maps whose `entityId` names a module that registers ORM entities but matches
+ * none of them. The encryption subscriber derives the entity id from the entity class, so such a
+ * map is never consulted and the fields it declares are stored as plaintext.
+ *
+ * Ids outside an entity-registering module are left alone: `vector:vector_search`, for example,
+ * is encrypted explicitly by the search module rather than through an ORM entity.
+ */
+export function findUnresolvedEncryptionMapEntityIds(
+  maps: ReadonlyArray<Pick<ModuleEncryptionMap, 'entityId'>>,
+  entityIds: EntityIds,
+): UnresolvedEncryptionMapEntityId[] {
+  const registered = new Set(Object.values(entityIds).flatMap((moduleEntityIds) => Object.values(moduleEntityIds ?? {})))
+  const checked = new Set<string>()
+  const unresolved: UnresolvedEncryptionMapEntityId[] = []
+  for (const { entityId } of maps) {
+    if (registered.has(entityId) || checked.has(entityId)) continue
+    checked.add(entityId)
+    const moduleId = entityId.split(':')[0]
+    const moduleEntityIds = Object.values(entityIds[moduleId] ?? {})
+    if (!moduleEntityIds.length) continue
+    unresolved.push({ entityId, suggestion: closestEntityId(entityId, moduleEntityIds) })
+  }
+  return unresolved
+}
+
+const warnedEntityIds = new Set<string>()
+
+/**
+ * Warns about every unresolved map once per process. The core DI bootstrap that loads the maps
+ * can run once per request container, so repeated calls stay quiet.
+ */
+export function warnUnresolvedEncryptionMapEntityIds(maps: ReadonlyArray<Pick<ModuleEncryptionMap, 'entityId'>>): void {
+  for (const { entityId, suggestion } of findUnresolvedEncryptionMapEntityIds(maps, getEntityIds(false))) {
+    if (warnedEntityIds.has(entityId)) continue
+    warnedEntityIds.add(entityId)
+    logger.warn('Encryption map entityId matches no registered entity - its fields are stored as plaintext', {
+      entityId,
+      suggestion,
+    })
+  }
+}
+
+export function resetUnresolvedEncryptionMapWarnings(): void {
+  warnedEntityIds.clear()
+}