@open-mercato/shared 0.6.2-develop.3467.1.2a1818709d → 0.6.2

package/src/modules/__tests__/route-overrides.test.ts

@@ -0,0 +1,441 @@
+/**
+ * Phase 2/3 — unified `entry.overrides.routes.*` wiring.
+ *
+ * Covers:
+ *   - The dispatcher routes `overrides.routes.api` to the wired applier
+ *     (no "Domain routes not yet wired" warning).
+ *   - The dispatcher routes `overrides.routes.pages` to the page-route
+ *     composer and the manifest registries apply it.
+ *   - `applyApiOverridesToManifests` drops disabled methods, drops fully
+ *     disabled entries, and wraps `load()` for replacement handlers.
+ *   - Programmatic overrides supersede `modules.ts` overrides.
+ *   - `registerApiRouteManifests` consults the override composer.
+ *   - Stale override keys emit a warning so operators notice.
+ *
+ * Spec: `.ai/specs/2026-05-04-modules-ts-unified-overrides.md`.
+ */
+import {
+  applyApiOverridesToManifests,
+  applyApiRouteOverrides,
+  applyModuleOverridesFromEnabledModules,
+  applyPageOverridesToManifests,
+  applyPageRouteOverrides,
+  composeApiRouteOverrides,
+  composePageRouteOverrides,
+  resetApiRouteOverridesForTests,
+  resetModuleContractOverridesForTests,
+  type ApiRouteOverridesMap,
+} from '../overrides'
+import {
+  getApiRouteManifests,
+  getBackendRouteManifests,
+  getFrontendRouteManifests,
+  registerApiRouteManifests,
+  registerBackendRouteManifests,
+  registerFrontendRouteManifests,
+  type ApiHandler,
+  type ApiRouteManifestEntry,
+  type BackendRouteManifestEntry,
+  type FrontendRouteManifestEntry,
+  type HttpMethod,
+} from '../registry'
+
+function makeEntry(
+  moduleId: string,
+  path: string,
+  methods: HttpMethod[],
+  loadResult: Record<string, unknown> = {},
+): ApiRouteManifestEntry {
+  return {
+    moduleId,
+    kind: 'route-file',
+    path,
+    methods,
+    load: jest.fn(async () => ({ ...loadResult })),
+  }
+}
+
+function makeHandler(label: string): ApiHandler {
+  return () => new Response(label)
+}
+
+function makeBackendPage(path: string): BackendRouteManifestEntry {
+  return {
+    moduleId: 'example',
+    path,
+    pattern: path,
+    title: 'Original',
+    load: jest.fn(async () => function OriginalPage() { return null }),
+  }
+}
+
+function makeFrontendPage(path: string): FrontendRouteManifestEntry {
+  return {
+    moduleId: 'example',
+    path,
+    pattern: path,
+    title: 'Original',
+    load: jest.fn(async () => function OriginalPage() { return null }),
+  }
+}
+
+beforeEach(() => {
+  resetModuleContractOverridesForTests()
+  resetApiRouteOverridesForTests()
+  registerApiRouteManifests([])
+  registerBackendRouteManifests([])
+  registerFrontendRouteManifests([])
+})
+
+afterEach(() => {
+  registerApiRouteManifests([])
+  registerBackendRouteManifests([])
+  registerFrontendRouteManifests([])
+})
+
+describe('applyApiOverridesToManifests', () => {
+  it('returns input unchanged when overrides map is empty', () => {
+    const entries = [makeEntry('a', '/api/foo', ['GET'])]
+    const result = applyApiOverridesToManifests(entries, {})
+    expect(result).toHaveLength(1)
+    expect(result[0]).toBe(entries[0])
+  })
+
+  it('drops a single method when override is null', () => {
+    const entries = [makeEntry('a', '/api/foo', ['GET', 'POST'])]
+    const result = applyApiOverridesToManifests(entries, {
+      'GET /api/foo': null,
+    })
+    expect(result).toHaveLength(1)
+    expect(result[0].methods).toEqual(['POST'])
+  })
+
+  it('matches public /api override keys against generated manifest paths', () => {
+    const entries = [makeEntry('a', '/example/override-probe', ['GET', 'POST'])]
+    const result = applyApiOverridesToManifests(entries, {
+      'GET /api/example/override-probe': null,
+    })
+    expect(result).toHaveLength(1)
+    expect(result[0].methods).toEqual(['POST'])
+  })
+
+  it('drops the entry entirely when every method is disabled', () => {
+    const entries = [makeEntry('a', '/api/foo', ['GET', 'POST'])]
+    const result = applyApiOverridesToManifests(entries, {
+      'GET /api/foo': null,
+      'POST /api/foo': null,
+    })
+    expect(result).toHaveLength(0)
+  })
+
+  it('wraps load() to swap the handler for replaced methods', async () => {
+    const originalHandler = makeHandler('original')
+    const overrideHandler = makeHandler('override')
+    const entries = [
+      makeEntry('a', '/api/foo', ['GET', 'POST'], {
+        GET: originalHandler,
+        POST: originalHandler,
+        metadata: { GET: { requireAuth: true } },
+      }),
+    ]
+    const result = applyApiOverridesToManifests(entries, {
+      'GET /api/foo': { handler: overrideHandler, metadata: { requireAuth: false } },
+    })
+    expect(result).toHaveLength(1)
+    expect(result[0].methods).toEqual(['GET', 'POST'])
+
+    const loaded = (await result[0].load()) as Record<string, unknown>
+    expect(loaded.GET).toBe(overrideHandler)
+    expect(loaded.POST).toBe(originalHandler)
+    expect(loaded.metadata).toEqual({
+      GET: { requireAuth: false },
+      // POST untouched.
+    })
+  })
+
+  it('does not mutate the input array or entries', () => {
+    const entry = makeEntry('a', '/api/foo', ['GET'])
+    const original = entry.methods
+    const result = applyApiOverridesToManifests([entry], {
+      'GET /api/foo': null,
+    })
+    expect(entry.methods).toBe(original)
+    expect(entry.methods).toEqual(['GET'])
+    expect(result).toHaveLength(0)
+  })
+
+  it('warns when an override key does not match any manifest entry', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    applyApiOverridesToManifests([makeEntry('a', '/api/foo', ['GET'])], {
+      'GET /api/missing': null,
+    })
+    const staleCalls = warnSpy.mock.calls.filter((args) =>
+      typeof args[0] === 'string' && args[0].includes('did not match any registered API route'),
+    )
+    expect(staleCalls).toHaveLength(1)
+    expect(staleCalls[0][0]).toContain('GET /api/missing')
+    warnSpy.mockRestore()
+  })
+
+  it('skips malformed override values (not null and not a definition)', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    const entries = [makeEntry('a', '/api/foo', ['GET'])]
+    const result = applyApiOverridesToManifests(entries, {
+      // @ts-expect-error intentionally malformed
+      'GET /api/foo': { metadata: { requireAuth: false } },
+    })
+    expect(result).toHaveLength(1)
+    expect(result[0].methods).toEqual(['GET'])
+    expect(warnSpy).toHaveBeenCalled()
+    warnSpy.mockRestore()
+  })
+})
+
+describe('applyApiRouteOverrides (programmatic)', () => {
+  it('normalizes the key format (case-insensitive method, leading-slash optional)', () => {
+    applyApiRouteOverrides({
+      'get  api/foo': null,
+      'Post /api/bar/': null,
+    })
+    const composed = composeApiRouteOverrides()
+    expect(composed['GET /api/foo']).toBeNull()
+    expect(composed['POST /api/bar']).toBeNull()
+  })
+
+  it('warns on malformed keys and skips them', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    applyApiRouteOverrides({
+      'NOT_A_METHOD /api/foo': null,
+      'GET': null,
+      '': null,
+    })
+    expect(Object.keys(composeApiRouteOverrides())).toHaveLength(0)
+    expect(warnSpy.mock.calls.filter((c) =>
+      typeof c[0] === 'string' && c[0].includes('malformed routes.api key'),
+    )).toHaveLength(3)
+    warnSpy.mockRestore()
+  })
+
+  it('supersedes modules.ts inline overrides for the same key', () => {
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: { routes: { api: { 'GET /api/foo': null } } },
+      },
+    ])
+    const override = { handler: makeHandler('replacement') }
+    applyApiRouteOverrides({ 'GET /api/foo': override })
+    expect(composeApiRouteOverrides()['GET /api/foo']).toBe(override)
+  })
+})
+
+describe('dispatcher → routes applier', () => {
+  it('routes `overrides.routes.api` to the wired applier without the "not yet wired" warning', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: { routes: { api: { 'GET /api/foo': null } } },
+      },
+    ])
+    const unwiredCalls = warnSpy.mock.calls.filter((args) =>
+      typeof args[0] === 'string' && args[0].includes('Domain "routes" not yet wired'),
+    )
+    expect(unwiredCalls).toHaveLength(0)
+    expect(composeApiRouteOverrides()['GET /api/foo']).toBeNull()
+    warnSpy.mockRestore()
+  })
+
+  it('routes `overrides.routes.pages` to the page override composer', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'first',
+        overrides: {
+          routes: {
+            pages: {
+              '/backend/foo': null,
+              '/frontend/store': { metadata: { title: 'Store Override' } },
+            },
+          },
+        },
+      },
+      {
+        id: 'second',
+        overrides: {
+          routes: {
+            pages: {
+              '/backend/bar/': null,
+            },
+          },
+        },
+      },
+    ])
+    const unwiredCalls = warnSpy.mock.calls.filter((args) =>
+      typeof args[0] === 'string' && args[0].includes('not yet wired'),
+    )
+    expect(unwiredCalls).toHaveLength(0)
+    expect(composePageRouteOverrides()).toMatchObject({
+      'backend:/backend/foo': null,
+      'backend:/backend/bar': null,
+      'frontend:/store': { metadata: { title: 'Store Override' } },
+    })
+    warnSpy.mockRestore()
+  })
+
+  it('preserves module load order when multiple entries override the same key (last wins)', () => {
+    const firstHandler = makeHandler('first')
+    const secondHandler = makeHandler('second')
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'first',
+        overrides: { routes: { api: { 'GET /api/foo': { handler: firstHandler } } } },
+      },
+      {
+        id: 'second',
+        overrides: { routes: { api: { 'GET /api/foo': { handler: secondHandler } } } },
+      },
+    ])
+    const composed = composeApiRouteOverrides()
+    expect(composed['GET /api/foo']).toEqual({ handler: secondHandler })
+  })
+
+  it('ignores malformed sub-keys but still processes well-formed ones', () => {
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    const handler = makeHandler('ok')
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: {
+          routes: {
+            api: {
+              'GET /api/ok': { handler },
+              'BADMETHOD /api/x': null,
+            },
+          },
+        },
+      },
+    ])
+    expect(composeApiRouteOverrides()['GET /api/ok']).toEqual({ handler })
+    expect(warnSpy.mock.calls.filter((c) =>
+      typeof c[0] === 'string' && c[0].includes('malformed routes.api key'),
+    )).toHaveLength(1)
+    warnSpy.mockRestore()
+  })
+})
+
+describe('applyPageOverridesToManifests', () => {
+  it('drops disabled backend pages and replaces metadata/loader for frontend pages', async () => {
+    const Replacement = function ReplacementPage() { return null }
+    const backendEntries = [
+      makeBackendPage('/backend/example'),
+      makeBackendPage('/backend/keep'),
+    ]
+    const frontendEntries = [
+      makeFrontendPage('/store'),
+    ]
+
+    const backendResult = applyPageOverridesToManifests(backendEntries, {
+      '/backend/example': null,
+    }, 'backend')
+    const frontendResult = applyPageOverridesToManifests(frontendEntries, {
+      '/frontend/store': {
+        Component: Replacement,
+        metadata: { title: 'Store Override', navHidden: true },
+      },
+    }, 'frontend')
+
+    expect(backendResult.map((entry) => entry.path)).toEqual(['/backend/keep'])
+    expect(frontendResult).toHaveLength(1)
+    expect(frontendResult[0].title).toBe('Store Override')
+    expect(frontendResult[0].navHidden).toBe(true)
+    await expect(frontendResult[0].load()).resolves.toBe(Replacement)
+  })
+
+  it('lets programmatic page overrides supersede modules.ts inline overrides', () => {
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: { routes: { pages: { '/backend/foo': null } } },
+      },
+    ])
+    const loader = async () => function RestoredPage() { return null }
+    applyPageRouteOverrides({
+      '/backend/foo': { load: loader, metadata: { title: 'Restored' } },
+    })
+
+    const result = applyPageOverridesToManifests([makeBackendPage('/backend/foo')], composePageRouteOverrides(), 'backend')
+    expect(result).toHaveLength(1)
+    expect(result[0].title).toBe('Restored')
+    expect(result[0].load).toBe(loader)
+  })
+})
+
+describe('registerApiRouteManifests consults overrides', () => {
+  it('drops disabled methods at registration time', () => {
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: { routes: { api: { 'GET /api/foo': null } } },
+      },
+    ])
+    registerApiRouteManifests([makeEntry('a', '/api/foo', ['GET', 'POST'])])
+    const registered = getApiRouteManifests()
+    expect(registered).toHaveLength(1)
+    expect(registered[0].methods).toEqual(['POST'])
+  })
+
+  it('returns an unmodified manifest when no overrides are registered', () => {
+    const entries = [makeEntry('a', '/api/foo', ['GET'])]
+    registerApiRouteManifests(entries)
+    const registered = getApiRouteManifests()
+    expect(registered).toHaveLength(1)
+    expect(registered[0]).toBe(entries[0])
+  })
+
+  it('replaces the handler via the wrapped load() when override is a definition', async () => {
+    const originalHandler = makeHandler('original')
+    const overrideHandler = makeHandler('override')
+    applyApiRouteOverrides({
+      'GET /api/foo': { handler: overrideHandler, metadata: { requireAuth: false } },
+    })
+    registerApiRouteManifests([
+      makeEntry('a', '/api/foo', ['GET'], { GET: originalHandler }),
+    ])
+    const registered = getApiRouteManifests()
+    expect(registered).toHaveLength(1)
+    const loaded = (await registered[0].load()) as Record<string, unknown>
+    expect(loaded.GET).toBe(overrideHandler)
+    expect(loaded.metadata).toEqual({ GET: { requireAuth: false } })
+  })
+})
+
+describe('page manifest registries consult overrides', () => {
+  it('applies backend and frontend page overrides at registration time', () => {
+    applyModuleOverridesFromEnabledModules([
+      {
+        id: 'app',
+        overrides: {
+          routes: {
+            pages: {
+              '/backend/example': null,
+              '/frontend/store': { metadata: { title: 'Store Override' } },
+            },
+          },
+        },
+      },
+    ])
+
+    registerBackendRouteManifests([
+      makeBackendPage('/backend/example'),
+      makeBackendPage('/backend/keep'),
+    ])
+    registerFrontendRouteManifests([
+      makeFrontendPage('/store'),
+    ])
+
+    expect(getBackendRouteManifests().map((entry) => entry.path)).toEqual(['/backend/keep'])
+    expect(getFrontendRouteManifests()).toHaveLength(1)
+    expect(getFrontendRouteManifests()[0].title).toBe('Store Override')
+  })
+})

package/src/modules/entities/__tests__/validation.test.ts

@@ -1,5 +1,9 @@
 /** @jest-environment node */
-import { validateValuesAgainstDefs } from '../validation'
+import {
+  MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
+  MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,
+  validateValuesAgainstDefs,
+} from '../validation'
 
 describe('validateValuesAgainstDefs', () => {
   it('validates required and integer/float comparisons', () => {
@@ -48,5 +52,96 @@ describe('validateValuesAgainstDefs', () => {
     r = validateValuesAgainstDefs({ code: 'ok', status: 'open' }, defs as any)
     expect(r.ok).toBe(true)
   })
-})
 
+  it('evaluates dangerous backtracking regex rules in bounded time', () => {
+    const defs = [
+      {
+        key: 'eu_vat_number',
+        kind: 'text',
+        configJson: {
+          validation: [
+            {
+              rule: 'regex',
+              param: '^(GB|FR|DE|IT|ES|PL|NL|BE|SE|AT|DK|FI|PT|IE|GR|CZ|RO|HU|SK|BG|HR|SI|LT|LV|EE|LU|MT|CY)?([0-9A-Za-z]+)*$',
+              message: 'bad vat',
+            },
+          ],
+        },
+      },
+    ]
+
+    const startedAt = Date.now()
+    const result = validateValuesAgainstDefs(
+      { eu_vat_number: `${'A'.repeat(64)}!` },
+      defs as any,
+    )
+
+    expect(Date.now() - startedAt).toBeLessThan(2_000)
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_eu_vat_number']).toBe('bad vat')
+  })
+
+  it('fails closed for unsupported regex syntax', () => {
+    const defs = [
+      {
+        key: 'code',
+        kind: 'text',
+        configJson: {
+          validation: [
+            { rule: 'regex', param: '(?=safe)safe', message: 'unsupported regex' },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs({ code: 'safe' }, defs as any)
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_code']).toBe('unsupported regex')
+  })
+
+  it('fails closed before testing oversized regex input values', () => {
+    const defs = [
+      {
+        key: 'body',
+        kind: 'multiline',
+        configJson: {
+          validation: [
+            { rule: 'regex', param: '^a+$', message: 'body too large' },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs(
+      { body: 'a'.repeat(MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH + 1) },
+      defs as any,
+    )
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_body']).toBe('body too large')
+  })
+
+  it('fails closed before testing oversized regex patterns', () => {
+    const defs = [
+      {
+        key: 'code',
+        kind: 'text',
+        configJson: {
+          validation: [
+            {
+              rule: 'regex',
+              param: `^${'a'.repeat(MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH)}$`,
+              message: 'pattern too large',
+            },
+          ],
+        },
+      },
+    ]
+
+    const result = validateValuesAgainstDefs({ code: 'a' }, defs as any)
+
+    expect(result.ok).toBe(false)
+    expect(result.fieldErrors['cf_code']).toBe('pattern too large')
+  })
+})

package/src/modules/entities/validation.ts

@@ -1,4 +1,8 @@
 import { z } from 'zod'
+import { testLinearRegex } from '../../lib/regex/linear'
+
+export const MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH = 500
+export const MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH = 10_000
 
 // Supported rule types for custom fields validation
 export const VALIDATION_RULES = [
@@ -28,7 +32,11 @@ export const validationRuleSchema = z.discriminatedUnion('rule', [
   z.object({ rule: z.literal('gte'), param: z.number(), message: z.string().min(1) }),
   z.object({ rule: z.literal('eq'), param: z.any(), message: z.string().min(1) }),
   z.object({ rule: z.literal('ne'), param: z.any(), message: z.string().min(1) }),
-  z.object({ rule: z.literal('regex'), param: z.string().min(1), message: z.string().min(1) }),
+  z.object({
+    rule: z.literal('regex'),
+    param: z.string().min(1),
+    message: z.string().min(1),
+  }),
 ])
 
 export type ValidationRule = z.infer<typeof validationRuleSchema>
@@ -83,13 +91,11 @@ function evalRule(rule: ValidationRule, value: any, kind: string): string | null
       return value !== (rule as any).param ? null : rule.message
     case 'regex':
       if (isEmpty(value)) return null
-      try {
-        const re = new RegExp((rule as any).param)
-        return re.test(String(value)) ? null : rule.message
-      } catch {
-        // Invalid regex in definition: consider it failed safe and return message
-        return rule.message
-      }
+      const regexResult = testLinearRegex(String((rule as any).param), String(value), {
+        maxPatternLength: MAX_CUSTOM_FIELD_REGEX_PATTERN_LENGTH,
+        maxInputLength: MAX_CUSTOM_FIELD_REGEX_INPUT_LENGTH,
+      })
+      return regexResult.ok && regexResult.matched ? null : rule.message
     default:
       return null
   }
@@ -115,4 +121,3 @@ export function validateValuesAgainstDefs(
   }
   return { ok: Object.keys(errors).length === 0, fieldErrors: errors }
 }
-