@open-mercato/shared 0.10.1-develop.7690.1.9d41ec4115 → 0.10.1-develop.7699.1.5236fabda0

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.10.1-develop.7690.1.9d41ec4115";
+const APP_VERSION = "0.10.1-develop.7699.1.5236fabda0";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7690.1.9d41ec4115';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.10.1-develop.7699.1.5236fabda0';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.10.1-develop.7690.1.9d41ec4115",
+  "version": "0.10.1-develop.7699.1.5236fabda0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -126,7 +126,7 @@
     "@mikro-orm/core": "^7.1.14",
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/cache": "0.10.1-develop.7690.1.9d41ec4115",
+    "@open-mercato/cache": "0.10.1-develop.7699.1.5236fabda0",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/auth/__tests__/server.apiKeyCache.test.ts

@@ -20,6 +20,10 @@ jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: (...args: unknown[]) => createRequestContainer(...args),
 }))
 
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: (_manager: unknown, ...args: unknown[]) => emFindOne(...args),
+}))
+
 jest.mock('@open-mercato/core/modules/auth/lib/sessionIntegrity', () => ({
   resolveCanonicalStaffAuthContext: jest.fn(async (_em: unknown, auth: unknown) => auth),
 }))
@@ -234,6 +238,7 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
       lastUsedAt: null,
     })
     emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
       if (where.id === 'creator-1') {
         return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-1' }
       }
@@ -267,6 +272,7 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
       lastUsedAt: null,
     })
     emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
       if (where.id === 'creator-1') {
         return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-2' }
       }
@@ -295,6 +301,7 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
       lastUsedAt: null,
     })
     emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
       if (where.id === 'session-user-1') {
         return { id: 'session-user-1', tenantId: 'tenant-1', organizationId: 'user-org' }
       }
@@ -322,6 +329,10 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
       expiresAt: null,
       lastUsedAt: null,
     })
+    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
+      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
+      return null
+    })
 
     await expect(
       getAuthFromRequest(buildRequest('malformed-session-secret')),
@@ -367,6 +378,105 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
     expect(findApiKeyBySecret).toHaveBeenCalledTimes(2)
   })
 
+  describe.each(['unbound', 'creator-bound', 'session-bound'] as const)('%s tenant liveness', (binding) => {
+    let tenant: { id: string; isActive: boolean; deletedAt: Date | null } | null
+
+    beforeEach(async () => {
+      const [{ Tenant }, { User }] = await Promise.all([
+        import('@open-mercato/core/modules/directory/data/entities'),
+        import('@open-mercato/core/modules/auth/data/entities'),
+      ])
+      tenant = { id: 'tenant-1', isActive: true, deletedAt: null }
+      findApiKeyBySecret.mockResolvedValue({
+        id: 'key-tenant-liveness',
+        name: 'tenant liveness',
+        tenantId: 'tenant-1',
+        organizationId: null,
+        rolesJson: [],
+        sessionToken: binding === 'session-bound' ? 'session-marker' : null,
+        sessionUserId: binding === 'session-bound' ? 'key-owner' : null,
+        sessionSecretEncrypted: null,
+        opencodeSessionId: null,
+        createdBy: binding === 'unbound' ? null : 'key-owner',
+        expiresAt: null,
+        lastUsedAt: null,
+      })
+      emFindOne.mockImplementation(async (entity: unknown, where: Record<string, unknown>) => {
+        if (entity === Tenant) {
+          return tenant && where.id === tenant.id && where.isActive === tenant.isActive && where.deletedAt === tenant.deletedAt
+            ? tenant
+            : null
+        }
+        if (entity === User && where.id === 'key-owner') {
+          return { id: 'key-owner', tenantId: 'tenant-1', organizationId: null }
+        }
+        return null
+      })
+    })
+
+    function setTenantState(state: 'active' | 'inactive' | 'deleted' | 'missing') {
+      tenant = state === 'missing'
+        ? null
+        : { id: 'tenant-1', isActive: state !== 'inactive', deletedAt: state === 'deleted' ? new Date() : null }
+    }
+
+    it.each(['active', 'inactive', 'deleted', 'missing'] as const)('authenticates only an active existing tenant (%s)', async (state) => {
+      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+      setTenantState(state)
+
+      const auth = await getAuthFromRequest(buildRequest('tenant-liveness-secret'))
+
+      if (state === 'active') {
+        expect(auth).toMatchObject({ keyId: 'key-tenant-liveness', tenantId: 'tenant-1' })
+      } else {
+        expect(auth).toBeNull()
+        expect(emPersist).not.toHaveBeenCalled()
+      }
+    })
+
+    it.each(['inactive', 'deleted', 'missing'] as const)('rejects a cached key immediately after its tenant becomes %s', async (state) => {
+      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+      await expect(getAuthFromRequest(buildRequest('tenant-liveness-secret'))).resolves.toMatchObject({
+        keyId: 'key-tenant-liveness',
+      })
+      setTenantState(state)
+
+      await expect(getAuthFromRequest(buildRequest('tenant-liveness-secret'))).resolves.toBeNull()
+
+      expect(findApiKeyBySecret).toHaveBeenCalledTimes(1)
+    })
+
+    it('rechecks an active tenant while retaining the cached secret lookup', async () => {
+      const { Tenant } = await import('@open-mercato/core/modules/directory/data/entities')
+      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
+      const first = await getAuthFromRequest(buildRequest('tenant-liveness-secret'))
+
+      await expect(getAuthFromRequest(buildRequest('tenant-liveness-secret'))).resolves.toEqual(first)
+
+      expect(first).toMatchObject({ keyId: 'key-tenant-liveness' })
+      expect(findApiKeyBySecret).toHaveBeenCalledTimes(1)
+      expect(emFindOne).toHaveBeenCalledWith(Tenant, { id: 'tenant-1', deletedAt: null, isActive: true })
+      expect(emFindOne.mock.calls.filter((call) => call[0] === Tenant)).toHaveLength(2)
+    })
+
+    it('reports cached tenant-check database unavailability without poisoning the cache', async () => {
+      const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
+      await expect(resolveAuthFromRequestDetailed(buildRequest('tenant-liveness-secret'))).resolves.toMatchObject({
+        status: 'authenticated',
+      })
+      emFindOne.mockRejectedValueOnce(Object.assign(new Error('connection unavailable'), { code: '53300' }))
+
+      await expect(resolveAuthFromRequestDetailed(buildRequest('tenant-liveness-secret'))).resolves.toEqual({
+        auth: null,
+        status: 'error',
+      })
+      await expect(resolveAuthFromRequestDetailed(buildRequest('tenant-liveness-secret'))).resolves.toMatchObject({
+        status: 'authenticated',
+      })
+      expect(findApiKeyBySecret).toHaveBeenCalledTimes(1)
+    })
+  })
+
   describe('super-admin bit stays bounded by the effective key scope', () => {
     async function resolveWithSuperAdminRole(input: {
       secret: string

package/src/lib/auth/server.ts

@@ -4,6 +4,7 @@ import { isMfaPendingJwtPayload, verifyJwt } from './jwt'
 import { isMfaPendingAccessAllowed } from './mfaPendingAccess'
 import { getSharedApiKeyAuthCache } from './apiKeyAuthCache'
 import { isTransientDbError } from '@open-mercato/shared/lib/db/pg-errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 function readRequestPathname(req: Request): string | null {
   try {
@@ -190,21 +191,37 @@ function applySuperAdminScope(
 async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
   if (!secret) return null
   const cache = getSharedApiKeyAuthCache()
-  const cached = cache.get(secret)
-  if (cached !== undefined) return cached as AuthContext
+  const cached = cache.get(secret) as AuthContext | undefined
+  if (cached === null) return null
+  if (cached && !cached.tenantId) return cached
   try {
     const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
+    const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')
+    if (cached?.tenantId) {
+      const tenant = await findOneWithDecryption(em, Tenant, { id: cached.tenantId, deletedAt: null, isActive: true })
+      if (!tenant) {
+        cache.setMiss(secret)
+        return null
+      }
+      return cached
+    }
     const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')
     const { Role, RoleAcl, User } = await import('@open-mercato/core/modules/auth/data/entities')
-    const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')
 
     const record = await findApiKeyBySecret(em, secret)
     if (!record) {
       cache.setMiss(secret)
       return null
     }
+    if (record.tenantId) {
+      const tenant = await findOneWithDecryption(em, Tenant, { id: record.tenantId, deletedAt: null, isActive: true })
+      if (!tenant) {
+        cache.setMiss(secret)
+        return null
+      }
+    }
 
     const roleIds = Array.isArray(record.rolesJson)
       ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)
@@ -288,13 +305,6 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
         return null
       }
     } else {
-      if (record.tenantId) {
-        const tenant = await em.findOne(Tenant, { id: record.tenantId, deletedAt: null, isActive: true })
-        if (!tenant) {
-          cache.setMiss(secret)
-          return null
-        }
-      }
       if (record.organizationId) {
         const organization = await em.findOne(Organization, { id: record.organizationId, deletedAt: null, isActive: true })
         if (!organization) {

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -12,7 +12,7 @@ jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
   resolveTranslations: async () => ({ t: mockTranslate, translate: mockTranslate }),
 }))
 
-import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { registerApiInterceptors } from '@open-mercato/shared/lib/crud/interceptor-registry'
 import {
@@ -789,6 +789,41 @@ describe('CRUD Factory', () => {
     expect(ids).toContain(otherTenant.id)
   })
 
+  it('GET ORM fallback still applies buildFilters scope on a full export when omitAutomaticTenantOrgScope is set', async () => {
+    // Regression test for #7806 — the ORM-fallback counterpart of the query-engine
+    // case covered elsewhere in this file: a full export must not drop the route's
+    // own scope just because it owns visibility itself via omitAutomaticTenantOrgScope.
+    const scopedBuildFilters = jest.fn((_query: z.infer<typeof querySchema>, ctx: CrudCtx) => ({
+      organizationId: ctx.auth?.orgId ?? null,
+    }))
+    const fallbackRoute = makeCrudRoute({
+      metadata: { GET: { requireAuth: true } },
+      orm: { entity: Todo, idField: 'id', orgField: 'organizationId', tenantField: 'tenantId', softDeleteField: 'deletedAt' },
+      list: {
+        schema: querySchema,
+        omitAutomaticTenantOrgScope: true,
+        buildFilters: scopedBuildFilters,
+      },
+    })
+
+    const mine = em.create(Todo, { title: 'Mine', organizationId: defaultOrganizationId, tenantId: defaultTenantId }) as Rec
+    mine.id = '550e8400-e29b-41d4-a716-446655440033'
+    await em.persist(mine).flush()
+    const other = em.create(Todo, { title: 'Other', organizationId: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb', tenantId: defaultTenantId }) as Rec
+    other.id = '550e8400-e29b-41d4-a716-446655440034'
+    await em.persist(other).flush()
+
+    const res = await fallbackRoute.GET(new Request('http://x/api/example/todos?format=json&exportScope=full'))
+    expect(res.status).toBe(200)
+
+    expect(scopedBuildFilters).toHaveBeenCalledWith({}, expect.objectContaining({
+      auth: expect.objectContaining({ orgId: defaultOrganizationId }),
+    }))
+    const text = await res.text()
+    expect(text).toContain(mine.id)
+    expect(text).not.toContain(other.id)
+  })
+
   it('GET resolves function-form CSV headers and rows per request', async () => {
     // Regression coverage for the additive `(query, ctx)` form of `ListConfig.csv`.
     // A route whose export columns depend on per-request discovery (custom-field keys,
@@ -884,6 +919,43 @@ describe('CRUD Factory', () => {
     })
   })
 
+  it('GET still applies buildFilters scope on a full export when omitAutomaticTenantOrgScope is set', async () => {
+    // Regression test for #7806: a full export used to drop straight to `{}` as
+    // baseFilters, skipping buildFilters entirely. For a route that owns its own
+    // scope via omitAutomaticTenantOrgScope, neither the query engine nor the ORM
+    // fallback add a tenant/org predicate of their own, so that leaked every
+    // tenant's rows on `exportScope=full`.
+    const scopedBuildFilters = jest.fn((_query: z.infer<typeof querySchema>, ctx: CrudCtx) => ({
+      tenant_id: { $eq: ctx.auth?.tenantId ?? null },
+    }))
+    const scopedRoute = makeCrudRoute({
+      metadata: { GET: { requireAuth: true } },
+      orm: { entity: Todo, idField: 'id', orgField: 'organizationId', tenantField: 'tenantId', softDeleteField: 'deletedAt' },
+      indexer: { entityType: 'example.todo' },
+      list: {
+        schema: querySchema,
+        entityId: 'example.todo',
+        fields: ['id', 'title', 'is_done'],
+        sortFieldMap: { id: 'id' },
+        omitAutomaticTenantOrgScope: true,
+        buildFilters: scopedBuildFilters,
+        transformItem: (item: Record<string, unknown>) => ({ id: item.id, title: item.title }),
+      },
+    })
+
+    const res = await scopedRoute.GET(new Request('http://x/api/example/todos?format=json&exportScope=full'))
+    expect(res.status).toBe(200)
+
+    // buildFilters runs with an empty query — the caller's own UI filters are
+    // dropped on a full export — but still receives the real ctx, so its scope
+    // predicate (derived from ctx.auth.tenantId here) is preserved.
+    expect(scopedBuildFilters).toHaveBeenCalledWith({}, expect.objectContaining({
+      auth: expect.objectContaining({ tenantId: '123e4567-e89b-12d3-a456-426614174000' }),
+    }))
+    const lastQueryCall = queryEngine.query.mock.calls.at(-1)
+    expect(lastQueryCall?.[1]?.filters).toEqual({ tenant_id: { $eq: '123e4567-e89b-12d3-a456-426614174000' } })
+  })
+
   describe('afterList hook ordering on the export paths', () => {
     // Issue #5969: both export branches used to call serializeExport() before awaiting
     // hooks.afterList, so a hook that patches values the base query cannot compute reached

package/src/lib/crud/factory.ts

@@ -1702,6 +1702,18 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       const exportFullRequested = exportRequested && (exportScope === 'full' || parseBooleanToken((queryParams as any).full) === true)
       profiler.mark('export_configured', { exportRequested, exportFullRequested })
 
+      // A full export still owes the route's own visibility predicate. Routes with
+      // `omitAutomaticTenantOrgScope` own their entire scope inside `buildFilters` — the
+      // query engine/ORM fallback add no tenant/org predicate of their own for them — so
+      // dropping to `{}` here would leak every tenant's rows (#7806). Re-run `buildFilters`
+      // with an empty query so only its scope branches apply, not the caller's UI filters.
+      const resolveFullExportBaseFilters = async () => {
+        if (opts.list?.omitAutomaticTenantOrgScope && opts.list.buildFilters) {
+          return opts.list.buildFilters({} as TList, ctx)
+        }
+        return {} as Where<Record<string, unknown>>
+      }
+
       const cacheEnabled =
         isCrudCacheEnabled() && !exportRequested && !opts.list?.disableListCache
       const cacheTimerStart = cacheEnabled && isCrudCacheDebugEnabled()
@@ -1913,7 +1925,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
           ? { page: 1, pageSize: exportPageSize }
           : { page: requestedPage, pageSize: requestedPageSize }
         const baseFilters = exportFullRequested
-          ? ({} as Where<any>)
+          ? await resolveFullExportBaseFilters()
           : (opts.list.buildFilters ? await opts.list.buildFilters(validated as any, ctx) : ({} as Where<any>))
         const filters = exportFullRequested
           ? baseFilters
@@ -2219,7 +2231,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         return response
       }
       const fallbackBaseFilters = exportFullRequested
-        ? ({} as Where<any>)
+        ? await resolveFullExportBaseFilters()
         : (opts.list.buildFilters ? await opts.list.buildFilters(validated as any, ctx) : ({} as Where<any>))
       const fallbackFilters = exportFullRequested
         ? fallbackBaseFilters