@open-mercato/shared 0.6.4-develop.4038.1.91ce075c8a → 0.6.4-develop.4106.1.12c205a613

package/src/lib/query/__tests__/engine.test.ts

@@ -516,4 +516,90 @@ describe('BasicQueryEngine (Kysely)', () => {
       : false
     expect(hasInFilter).toBe(true)
   })
+
+  test('sorts encrypted base fields after decryption before pagination', async () => {
+    const fakeDb = createFakeKysely({
+      customer_entities: [
+        { id: '3', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-c' },
+        { id: '1', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-a' },
+        { id: '5', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-e' },
+        { id: '2', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-b' },
+        { id: '4', tenant_id: 't1', organization_id: 'org1', display_name: 'cipher-d' },
+      ],
+      'information_schema.columns': [
+        { table_name: 'customer_entities', column_name: 'id' },
+        { table_name: 'customer_entities', column_name: 'tenant_id' },
+        { table_name: 'customer_entities', column_name: 'organization_id' },
+        { table_name: 'customer_entities', column_name: 'deleted_at' },
+        { table_name: 'customer_entities', column_name: 'display_name' },
+      ],
+    })
+    const namesById: Record<string, string> = {
+      '1': 'Alice',
+      '2': 'Bob',
+      '3': 'Charlie',
+      '4': 'Dave',
+      '5': 'Eve',
+    }
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({
+        isEnabled: () => true,
+        getEncryptedFieldNames: async () => ['display_name'],
+        decryptEntityPayload: async (_entityId, payload) => ({
+          display_name: namesById[String(payload.id)],
+        }),
+      }),
+    )
+
+    const result = await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      organizationId: 'org1',
+      fields: ['id', 'display_name'],
+      sort: [{ field: 'display_name', dir: SortDir.Asc }],
+      page: { page: 2, pageSize: 2 },
+    })
+
+    expect(result.items.map((item: any) => item.display_name)).toEqual(['Charlie', 'Dave'])
+    const baseCall = fakeDb._calls.find((call: any) => call._ops.table === 'customer_entities')
+    expect(baseCall._ops.orderBys).toEqual([])
+    expect(baseCall._ops.limits).toBe(0)
+  })
+
+  test('keeps SQL ordering and pagination for unencrypted base fields', async () => {
+    const fakeDb = createFakeKysely({
+      customer_entities: [
+        { id: '1', tenant_id: 't1', organization_id: 'org1', display_name: 'Alice' },
+      ],
+      'information_schema.columns': [
+        { table_name: 'customer_entities', column_name: 'id' },
+        { table_name: 'customer_entities', column_name: 'tenant_id' },
+        { table_name: 'customer_entities', column_name: 'organization_id' },
+        { table_name: 'customer_entities', column_name: 'deleted_at' },
+        { table_name: 'customer_entities', column_name: 'display_name' },
+      ],
+    })
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({
+        isEnabled: () => true,
+        getEncryptedFieldNames: async () => [],
+      }),
+    )
+
+    await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      organizationId: 'org1',
+      fields: ['id', 'display_name'],
+      sort: [{ field: 'display_name', dir: SortDir.Asc }],
+      page: { page: 2, pageSize: 10 },
+    })
+
+    const baseCall = fakeDb._calls.find((call: any) => call._ops.table === 'customer_entities')
+    expect(baseCall._ops.orderBys).toEqual([['customer_entities.display_name', 'asc']])
+    expect(baseCall._ops.limits).toBe(10)
+    expect(baseCall._ops.offsets).toBe(10)
+  })
 })

package/src/lib/query/encrypted-sort.ts

@@ -0,0 +1,86 @@
+import type { EntityId } from '@open-mercato/shared/modules/entities'
+import { SortDir, type Sort } from './types'
+
+export type QueryEncryptionService = {
+  getEncryptedFieldNames?: (
+    entityId: EntityId,
+    tenantId?: string | null,
+    organizationId?: string | null,
+  ) => Promise<readonly string[]>
+  isEnabled?: () => boolean
+}
+
+const toSnakeCase = (value: string): string =>
+  value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()
+
+const toCamelCase = (value: string): string =>
+  value.replace(/_([a-z])/g, (_, c) => c.toUpperCase())
+
+export function fieldNameCandidates(field: string): string[] {
+  const raw = String(field || '').trim()
+  if (!raw) return []
+  const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)]
+  if (raw.startsWith('cf:')) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, '_'))
+  return Array.from(new Set(candidates))
+}
+
+export async function resolveEncryptedSortFields(
+  service: QueryEncryptionService | null | undefined,
+  entity: EntityId,
+  sortFields: readonly string[],
+  tenantId?: string | null,
+  organizationId?: string | null,
+): Promise<Set<string>> {
+  if (!service?.getEncryptedFieldNames) return new Set()
+  if (service.isEnabled && !service.isEnabled()) return new Set()
+  const encrypted = await service.getEncryptedFieldNames(entity, tenantId ?? null, organizationId ?? null)
+  const encryptedCandidates = new Set<string>()
+  for (const field of encrypted) {
+    for (const candidate of fieldNameCandidates(field)) encryptedCandidates.add(candidate)
+  }
+  const result = new Set<string>()
+  for (const field of sortFields) {
+    if (field.startsWith('cf:')) continue
+    const matches = fieldNameCandidates(field).some((candidate) => encryptedCandidates.has(candidate))
+    if (matches) result.add(field)
+  }
+  return result
+}
+
+function readField(row: Record<string, unknown>, field: string): unknown {
+  for (const candidate of fieldNameCandidates(field)) {
+    if (Object.prototype.hasOwnProperty.call(row, candidate)) return row[candidate]
+  }
+  return undefined
+}
+
+function compareValues(left: unknown, right: unknown): number {
+  const leftMissing = left === null || left === undefined
+  const rightMissing = right === null || right === undefined
+  if (leftMissing && rightMissing) return 0
+  if (leftMissing) return 1
+  if (rightMissing) return -1
+  if (left instanceof Date && right instanceof Date) return left.getTime() - right.getTime()
+  if (typeof left === 'number' && typeof right === 'number') return left - right
+  if (typeof left === 'boolean' && typeof right === 'boolean') return Number(left) - Number(right)
+  return String(left).localeCompare(String(right), undefined, {
+    sensitivity: 'base',
+    numeric: true,
+  })
+}
+
+export function sortRowsInMemory<T extends Record<string, unknown>>(
+  rows: readonly T[],
+  sorts: readonly Sort[],
+): T[] {
+  return [...rows].sort((left, right) => {
+    for (const sort of sorts) {
+      const direction = sort.dir === SortDir.Desc ? -1 : 1
+      const compared = compareValues(readField(left, sort.field), readField(right, sort.field))
+      if (compared !== 0) return compared * direction
+    }
+    const leftId = readField(left, 'id')
+    const rightId = readField(right, 'id')
+    return compareValues(leftId, rightId)
+  })
+}

package/src/lib/query/engine.ts

@@ -1,4 +1,4 @@
-import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig } from './types'
+import type { QueryEngine, QueryOptions, QueryResult, QueryCustomFieldSource, QueryExtensionsConfig, Sort } from './types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql, type RawBuilder } from 'kysely'
@@ -14,6 +14,7 @@ import {
 import { resolveSearchConfig } from '../search/config'
 import { tokenizeText } from '../search/tokenize'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'
+import { resolveEncryptedSortFields, sortRowsInMemory } from './encrypted-sort'
 
 type AnyDb = Kysely<any>
 type AnyBuilder = any
@@ -22,6 +23,7 @@ const entityTableCache = new Map<string, string>()
 
 type EncryptionResolver = () => {
   decryptEntityPayload?: (entityId: EntityId, payload: Record<string, unknown>, tenantId?: string | null, organizationId?: string | null) => Promise<Record<string, unknown>>
+  getEncryptedFieldNames?: (entityId: EntityId, tenantId?: string | null, organizationId?: string | null) => Promise<readonly string[]>
   isEnabled?: () => boolean
 } | null
 
@@ -475,9 +477,35 @@ export class BasicQueryEngine implements QueryEngine {
       applyJoinFilterOp,
       columnExists: (tbl, column) => this.columnExists(tbl, column),
     })
+
+    const fallbackOrgId =
+      opts.organizationId
+      ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)
+    const encryptionService = this.getEncryptionService()
+    const resolvedSorts: Sort[] = []
+    for (const s of opts.sort || []) {
+      if (s.field.startsWith('cf:')) {
+        resolvedSorts.push(s)
+      } else {
+        const column = await this.resolveBaseColumn(table, s.field)
+        if (column) resolvedSorts.push({ ...s, field: column })
+      }
+    }
+    const encryptedSortFields = await resolveEncryptedSortFields(
+      encryptionService,
+      entity,
+      resolvedSorts.filter((sort) => !sort.field.startsWith('cf:')).map((sort) => sort.field),
+      opts.tenantId ?? null,
+      fallbackOrgId,
+    )
+    const requiresPlaintextSort = encryptedSortFields.size > 0
+
     // Selection (base columns only here; cf:* handled later)
     if (opts.fields && opts.fields.length) {
-      const cols = opts.fields.filter((f) => !f.startsWith('cf:'))
+      const cols = new Set(opts.fields.filter((f) => !f.startsWith('cf:')))
+      if (requiresPlaintextSort) {
+        for (const field of encryptedSortFields) cols.add(field)
+      }
       for (const c of cols) {
         // Qualify and alias to base names to avoid ambiguity
         q = q.select(sql.ref(qualify(c)).as(c))
@@ -714,7 +742,7 @@ export class BasicQueryEngine implements QueryEngine {
     }
 
     // Sorting: base fields and cf:* (use aggregated alias for cf)
-    for (const s of opts.sort || []) {
+    for (const s of resolvedSorts) {
       if (s.field.startsWith('cf:')) {
         const key = s.field.slice(3)
         const alias = sanitize(`cf:${key}`)
@@ -726,11 +754,9 @@ export class BasicQueryEngine implements QueryEngine {
             cfSelectedAliases.push(alias)
           }
         }
-        q = q.orderBy(alias, (s.dir ?? 'asc') as any)
+        if (!requiresPlaintextSort) q = q.orderBy(alias, (s.dir ?? 'asc') as any)
       } else {
-        const column = await this.resolveBaseColumn(table, s.field)
-        if (!column) continue
-        q = q.orderBy(qualify(column), (s.dir ?? 'asc') as any)
+        if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), (s.dir ?? 'asc') as any)
       }
     }
 
@@ -747,7 +773,10 @@ export class BasicQueryEngine implements QueryEngine {
       : q.clearSelect().clearOrderBy().select(sql<string>`count(distinct ${sql.ref(`${table}.id`)})`.as('count'))
     const countRow = await countBuilder.executeTakeFirst() as { count: unknown } | undefined
     const total = Number((countRow as any)?.count ?? 0)
-    const items = await q.limit(pageSize).offset((page - 1) * pageSize).execute() as any[]
+    const dataQuery = requiresPlaintextSort
+      ? q
+      : q.limit(pageSize).offset((page - 1) * pageSize)
+    const items = await dataQuery.execute() as any[]
 
     if (cfJsonAliases.size > 0) {
       for (const row of items) {
@@ -771,7 +800,7 @@ export class BasicQueryEngine implements QueryEngine {
       }
     }
 
-    const svc = this.getEncryptionService()
+    const svc = encryptionService
     const decryptPayload =
       svc?.decryptEntityPayload?.bind(svc) as
         | ((
@@ -783,9 +812,6 @@ export class BasicQueryEngine implements QueryEngine {
         | null
     let decryptedItems = items
     if (decryptPayload) {
-      const fallbackOrgId =
-        opts.organizationId
-        ?? (Array.isArray(opts.organizationIds) && opts.organizationIds.length === 1 ? opts.organizationIds[0] : null)
       decryptedItems = await Promise.all(
         (items as any[]).map(async (item) => {
           try {
@@ -804,7 +830,12 @@ export class BasicQueryEngine implements QueryEngine {
       )
     }
 
-    let queryResult: QueryResult<T> = { items: decryptedItems, page, pageSize, total }
+    const pagedItems = requiresPlaintextSort
+      ? sortRowsInMemory(decryptedItems as Record<string, unknown>[], resolvedSorts)
+          .slice((page - 1) * pageSize, page * pageSize)
+      : decryptedItems
+
+    let queryResult: QueryResult<T> = { items: pagedItems, page, pageSize, total }
 
     // --- UMES query extension: after-query pipeline ---
     if (ext && extensionCtx) {