@open-mercato/shared 0.6.5-develop.5048.1.fd82f4ae17 → 0.6.5-develop.5099.1.85c0aff78c

package/src/lib/commands/scope.ts

@@ -1,44 +1,69 @@
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
+import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
 import { env } from 'process'
 
+function buildScopeLogContext(ctx: CommandRuntimeContext) {
+  const requestInfo =
+    ctx.request && typeof ctx.request === 'object'
+      ? {
+          method: (ctx.request as Request).method ?? undefined,
+          url: (ctx.request as Request).url ?? undefined,
+        }
+      : null
+  const scope = ctx.organizationScope
+    ? {
+        selectedId: ctx.organizationScope.selectedId ?? null,
+        tenantId: ctx.organizationScope.tenantId ?? null,
+        allowedIdsCount: Array.isArray(ctx.organizationScope.allowedIds)
+          ? ctx.organizationScope.allowedIds.length
+          : null,
+        filterIdsCount: Array.isArray(ctx.organizationScope.filterIds)
+          ? ctx.organizationScope.filterIds.length
+          : null,
+      }
+    : null
+  return {
+    userId: ctx.auth?.sub ?? null,
+    actorTenantId: ctx.auth?.tenantId ?? null,
+    actorOrganizationId: ctx.auth?.orgId ?? null,
+    selectedOrganizationId: ctx.selectedOrganizationId ?? null,
+    organizationIdsCount: Array.isArray(ctx.organizationIds) ? ctx.organizationIds.length : null,
+    scope,
+    request: requestInfo,
+  }
+}
+
+function isStrictOrganizationScopeEnforced(): boolean {
+  return parseBooleanWithDefault(env.OM_ENFORCE_ORG_SCOPE_STRICT, false)
+}
+
 function logScopeViolation(
   ctx: CommandRuntimeContext,
   expected: string,
   actual: string | null
 ): void {
   try {
-    const requestInfo =
-      ctx.request && typeof ctx.request === 'object'
-        ? {
-            method: (ctx.request as Request).method ?? undefined,
-            url: (ctx.request as Request).url ?? undefined,
-          }
-        : null
-    const scope = ctx.organizationScope
-      ? {
-          selectedId: ctx.organizationScope.selectedId ?? null,
-          tenantId: ctx.organizationScope.tenantId ?? null,
-          allowedIdsCount: Array.isArray(ctx.organizationScope.allowedIds)
-            ? ctx.organizationScope.allowedIds.length
-            : null,
-          filterIdsCount: Array.isArray(ctx.organizationScope.filterIds)
-            ? ctx.organizationScope.filterIds.length
-            : null,
-        }
-      : null
     if (env.NODE_ENV !== 'test') {
       console.warn('[scope] Forbidden organization scope mismatch detected', {
         expectedId: expected,
         actualId: actual,
-        userId: ctx.auth?.sub ?? null,
-        actorTenantId: ctx.auth?.tenantId ?? null,
-        actorOrganizationId: ctx.auth?.orgId ?? null,
-        selectedOrganizationId: ctx.selectedOrganizationId ?? null,
-        organizationIdsCount: Array.isArray(ctx.organizationIds) ? ctx.organizationIds.length : null,
-        scope,
-        request: requestInfo,
+        ...buildScopeLogContext(ctx),
+      })
+    }
+  } catch {
+    // best-effort logging
+  }
+}
+
+function logUnscopedOrganizationAccess(ctx: CommandRuntimeContext, organizationId: string): void {
+  try {
+    if (env.NODE_ENV !== 'test') {
+      console.warn('[scope] Unscoped organization command executed without organization context', {
+        targetOrganizationId: organizationId,
+        strictEnforcement: isStrictOrganizationScopeEnforced(),
+        ...buildScopeLogContext(ctx),
       })
     }
   } catch {
@@ -52,36 +77,11 @@ function logTenantScopeViolation(
   actualTenantId: string | null
 ): void {
   try {
-    const requestInfo =
-      ctx.request && typeof ctx.request === 'object'
-        ? {
-            method: (ctx.request as Request).method ?? undefined,
-            url: (ctx.request as Request).url ?? undefined,
-          }
-        : null
-    const scope = ctx.organizationScope
-      ? {
-          selectedId: ctx.organizationScope.selectedId ?? null,
-          tenantId: ctx.organizationScope.tenantId ?? null,
-          allowedIdsCount: Array.isArray(ctx.organizationScope.allowedIds)
-            ? ctx.organizationScope.allowedIds.length
-            : null,
-          filterIdsCount: Array.isArray(ctx.organizationScope.filterIds)
-            ? ctx.organizationScope.filterIds.length
-            : null,
-        }
-      : null
     if (env.NODE_ENV !== 'test') {
       console.warn('[scope] Forbidden tenant scope mismatch detected', {
         expectedTenantId,
         actualTenantId,
-        userId: ctx.auth?.sub ?? null,
-        actorTenantId: ctx.auth?.tenantId ?? null,
-        actorOrganizationId: ctx.auth?.orgId ?? null,
-        selectedOrganizationId: ctx.selectedOrganizationId ?? null,
-        organizationIdsCount: Array.isArray(ctx.organizationIds) ? ctx.organizationIds.length : null,
-        scope,
-        request: requestInfo,
+        ...buildScopeLogContext(ctx),
       })
     }
   } catch {
@@ -100,9 +100,24 @@ export function ensureOrganizationScope(ctx: CommandRuntimeContext, organization
   if (!scope) {
     if (isSuperAdmin) return
     const currentOrg = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
-    if (currentOrg && currentOrg !== organizationId) {
-      logScopeViolation(ctx, organizationId, currentOrg)
-      throw new CrudHttpError(403, { error: 'Forbidden' })
+    if (currentOrg) {
+      if (currentOrg !== organizationId) {
+        logScopeViolation(ctx, organizationId, currentOrg)
+        throw new CrudHttpError(403, { error: 'Forbidden' })
+      }
+      return
+    }
+    // No current org could be resolved either. This branch previously returned
+    // with no validation and no signal — a fail-open-by-omission shape (#2441):
+    // a new command path reaching here with `organizationScope: null` would act
+    // on an arbitrary target org silently. Preserve the legacy allow behavior by
+    // default (the path is load-bearing) but make the unscoped access observable,
+    // and let operators harden it into a deny via OM_ENFORCE_ORG_SCOPE_STRICT.
+    if (organizationId) {
+      logUnscopedOrganizationAccess(ctx, organizationId)
+      if (isStrictOrganizationScopeEnforced()) {
+        throw new CrudHttpError(403, { error: 'Forbidden' })
+      }
     }
     return
   }

package/src/lib/encryption/__tests__/dek-lifecycle.test.ts

@@ -0,0 +1,194 @@
+import { decryptWithAesGcm, generateDek } from '../aes'
+import { HashicorpVaultKmsService, type KmsService, type TenantDek } from '../kms'
+import { TenantDataEncryptionService } from '../tenantDataEncryptionService'
+
+const originalEnv = { ...process.env }
+
+type DuckResponse = { ok: boolean; status: number; json: () => Promise<unknown> }
+
+function jsonResponse(status: number, body: Record<string, unknown>): DuckResponse {
+  return { ok: status >= 200 && status < 300, status, json: async () => body }
+}
+
+// Minimal in-memory Vault KV v2 simulator: GET reads the stored key, POST writes
+// it unless a `cas: 0` write loses to an existing version (concurrent create).
+function makeVaultSim() {
+  const store = new Map<string, string>()
+  const counts = { reads: 0, posts: 0, persisted: 0 }
+  const fetchMock = jest.fn(async (input: unknown, init?: RequestInit): Promise<DuckResponse> => {
+    const url = String(input)
+    const path = url.slice(url.indexOf('/v1/') + '/v1/'.length)
+    const method = (init?.method || 'GET').toUpperCase()
+    if (method === 'GET') {
+      counts.reads++
+      const key = store.get(path)
+      if (!key) return jsonResponse(404, { errors: [] })
+      return jsonResponse(200, { data: { data: { key } } })
+    }
+    counts.posts++
+    const body = init?.body ? (JSON.parse(String(init.body)) as { data?: { key?: string }; options?: { cas?: number } }) : {}
+    const cas = body.options?.cas
+    if (cas === 0 && store.has(path)) {
+      return jsonResponse(400, { errors: ['check-and-set parameter did not match the current version'] })
+    }
+    store.set(path, body.data?.key ?? '')
+    counts.persisted++
+    return jsonResponse(200, { data: { version: 1 } })
+  })
+  return { store, counts, fetchMock }
+}
+
+function installFetch(fetchMock: jest.Mock) {
+  ;(globalThis as { fetch?: typeof fetch }).fetch = fetchMock as unknown as typeof fetch
+}
+
+const fixedKey = (fill: number) => Buffer.alloc(32, fill).toString('base64')
+
+describe('HashicorpVaultKmsService DEK creation race (issue #2746)', () => {
+  afterEach(() => {
+    process.env = { ...originalEnv }
+    jest.restoreAllMocks()
+  })
+
+  it('reuses an existing Vault DEK instead of overwriting it (read-before-write)', async () => {
+    const { store, counts, fetchMock } = makeVaultSim()
+    installFetch(fetchMock)
+    const service = new HashicorpVaultKmsService({ vaultAddr: 'http://vault.test', vaultToken: 'token' })
+    const existingKey = fixedKey(7)
+    store.set('secret/data/tenant_key_tenant-existing', existingKey)
+
+    const dek = await service.createTenantDek('tenant-existing')
+
+    expect(dek?.key).toBe(existingKey)
+    expect(counts.persisted).toBe(0) // never overwrote the active key
+  })
+
+  it('converges concurrent createTenantDek calls on a single key via CAS', async () => {
+    const { counts, fetchMock } = makeVaultSim()
+    installFetch(fetchMock)
+    const service = new HashicorpVaultKmsService({ vaultAddr: 'http://vault.test', vaultToken: 'token' })
+
+    const [a, b] = await Promise.all([
+      service.createTenantDek('tenant-cas'),
+      service.createTenantDek('tenant-cas'),
+    ])
+
+    expect(a?.key).toBeTruthy()
+    expect(a?.key).toBe(b?.key) // both adopt the same winning key — no orphaned rows
+    expect(counts.persisted).toBe(1) // exactly one key persisted, last-write-wins eliminated
+  })
+
+  it('invalidateDek forces a re-read from Vault', async () => {
+    const { store, counts, fetchMock } = makeVaultSim()
+    installFetch(fetchMock)
+    const service = new HashicorpVaultKmsService({ vaultAddr: 'http://vault.test', vaultToken: 'token' })
+    const path = 'secret/data/tenant_key_tenant-inv'
+    store.set(path, fixedKey(3))
+
+    const first = await service.getTenantDek('tenant-inv')
+    await service.getTenantDek('tenant-inv') // served from the KMS TTL cache
+    expect(counts.reads).toBe(1)
+
+    store.set(path, fixedKey(9)) // operator rotates the key in Vault
+    service.invalidateDek('tenant-inv')
+    const rotated = await service.getTenantDek('tenant-inv')
+
+    expect(counts.reads).toBe(2)
+    expect(rotated?.key).not.toBe(first?.key)
+  })
+})
+
+describe('TenantDataEncryptionService DEK lifecycle (issue #2746)', () => {
+  const entityId = 'customers:person'
+  let tenantSeq = 0
+  const uniqueTenant = (label: string) => `tenant-${label}-2746-${tenantSeq++}`
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  function makeCreatingKms() {
+    const created: string[] = []
+    const kms: KmsService = {
+      isHealthy: () => true,
+      getTenantDek: jest.fn(async (): Promise<TenantDek | null> => null),
+      createTenantDek: jest.fn(async (tenantId: string): Promise<TenantDek | null> => {
+        const key = generateDek()
+        created.push(key)
+        return { tenantId, key, fetchedAt: Date.now() }
+      }),
+    }
+    return { kms, created }
+  }
+
+  function makeFetchingKms() {
+    const kms: KmsService = {
+      isHealthy: () => true,
+      getTenantDek: jest.fn(async (tenantId: string): Promise<TenantDek | null> => ({
+        tenantId,
+        key: generateDek(),
+        fetchedAt: Date.now(),
+      })),
+      createTenantDek: jest.fn(async (): Promise<TenantDek | null> => null),
+    }
+    return { kms }
+  }
+
+  it('dedupes concurrent first-time DEK creation so no row is orphaned', async () => {
+    const { kms, created } = makeCreatingKms()
+    const service = new TenantDataEncryptionService({} as never, { kms })
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+    ;(service as unknown as { getMap: () => Promise<{ entityId: string; fields: { field: string }[] }> }).getMap =
+      jest.fn(async () => ({ entityId, fields: [{ field: 'secret' }] }))
+    const tenantId = uniqueTenant('race')
+
+    const rows = await Promise.all(
+      Array.from({ length: 12 }, (_, i) =>
+        service.encryptEntityPayload(entityId, { secret: `value-${i}` }, tenantId),
+      ),
+    )
+
+    expect((kms.createTenantDek as jest.Mock)).toHaveBeenCalledTimes(1)
+    expect(new Set(created).size).toBe(1)
+
+    const dek = await service.getDek(tenantId)
+    expect(dek).not.toBeNull()
+    rows.forEach((row, i) => {
+      expect(decryptWithAesGcm(String(row.secret), (dek as TenantDek).key)).toBe(`value-${i}`)
+    })
+  })
+
+  it('re-fetches a cached DEK after the TTL elapses (no stale key after rotation)', async () => {
+    const { kms } = makeFetchingKms()
+    const service = new TenantDataEncryptionService({} as never, { kms })
+    const tenantId = uniqueTenant('ttl')
+    let now = 1_700_000_000_000
+    jest.spyOn(Date, 'now').mockImplementation(() => now)
+
+    await service.getDek(tenantId)
+    await service.getDek(tenantId)
+    expect((kms.getTenantDek as jest.Mock)).toHaveBeenCalledTimes(1) // cached within TTL
+
+    now += 15 * 60 * 1000 + 1
+    await service.getDek(tenantId)
+    expect((kms.getTenantDek as jest.Mock)).toHaveBeenCalledTimes(2) // expired → re-fetch
+  })
+
+  it('invalidateDek clears both the service cache and the KMS cache', async () => {
+    const { kms } = makeFetchingKms()
+    const kmsInvalidate = jest.fn()
+    ;(kms as KmsService).invalidateDek = kmsInvalidate
+    const service = new TenantDataEncryptionService({} as never, { kms })
+    const tenantId = uniqueTenant('invalidate')
+
+    await service.getDek(tenantId)
+    await service.getDek(tenantId)
+    expect((kms.getTenantDek as jest.Mock)).toHaveBeenCalledTimes(1)
+
+    service.invalidateDek(tenantId)
+    expect(kmsInvalidate).toHaveBeenCalledWith(tenantId)
+
+    await service.getDek(tenantId)
+    expect((kms.getTenantDek as jest.Mock)).toHaveBeenCalledTimes(2)
+  })
+})

package/src/lib/encryption/__tests__/kms.test.ts

@@ -10,11 +10,17 @@ describe('kms timeout handling', () => {
   })
 
   it('marks Vault unhealthy after a timed out write', async () => {
-    const fetchMock = jest.fn((_url: string, init?: RequestInit) =>
-      new Promise((_resolve, reject) => {
+    // createTenantDek now reads-before-write (#2746): the read probe answers fast
+    // with no existing key so the flow reaches the write, which then times out.
+    const fetchMock = jest.fn((_url: string, init?: RequestInit) => {
+      const method = (init?.method || 'GET').toUpperCase()
+      if (method === 'GET') {
+        return Promise.resolve({ ok: true, status: 200, json: async () => ({ data: { data: {} } }) })
+      }
+      return new Promise((_resolve, reject) => {
         init?.signal?.addEventListener('abort', () => reject(new Error('aborted')))
-      }),
-    )
+      })
+    })
     ;(globalThis as { fetch?: typeof fetch }).fetch = fetchMock as typeof fetch
 
     const service = new HashicorpVaultKmsService({
@@ -25,7 +31,7 @@ describe('kms timeout handling', () => {
 
     await expect(service.createTenantDek('tenant-1')).resolves.toBeNull()
     expect(service.isHealthy()).toBe(false)
-    expect(fetchMock).toHaveBeenCalledTimes(1)
+    expect(fetchMock).toHaveBeenCalledTimes(2) // read probe + the timed-out write
   })
 
   it('falls back to derived keys after the primary Vault call times out', async () => {

package/src/lib/encryption/kms.ts

@@ -22,6 +22,7 @@ export interface KmsService {
   getTenantDek(tenantId: string): Promise<TenantDek | null>
   createTenantDek(tenantId: string): Promise<TenantDek | null>
   isHealthy(): boolean
+  invalidateDek?(tenantId: string): void
 }
 
 class FallbackKmsService implements KmsService {
@@ -76,6 +77,11 @@ class FallbackKmsService implements KmsService {
     }
     return null
   }
+
+  invalidateDek(tenantId: string): void {
+    this.primary.invalidateDek?.(tenantId)
+    this.fallback?.invalidateDek?.(tenantId)
+  }
 }
 
 type VaultClientOpts = {
@@ -90,6 +96,10 @@ type VaultReadResponse = {
   data?: { data?: { key?: string; version?: number }; metadata?: Record<string, unknown> }
 }
 
+// 'conflict' = a check-and-set write lost to a concurrent writer (normal race
+// outcome, Vault still healthy); 'error' = the write genuinely failed.
+type VaultWriteOutcome = 'ok' | 'conflict' | 'error'
+
 function normalizeEnv(value: string | undefined): string {
   if (!value) return ''
   return value.trim().replace(/(?:^['"]|['"]$)/g, '')
@@ -230,11 +240,13 @@ export class HashicorpVaultKmsService implements KmsService {
     }
   }
 
-  private async writeVault(path: string, key: string): Promise<boolean> {
+  private async writeVault(path: string, key: string, opts?: { cas?: number }): Promise<VaultWriteOutcome> {
     if (!this.vaultAddr || !this.vaultToken) {
       this.healthy = false
-      return false
+      return 'error'
     }
+    const body: { data: { key: string }; options?: { cas: number } } = { data: { key } }
+    if (typeof opts?.cas === 'number') body.options = { cas: opts.cas }
     try {
       const res = await fetchWithTimeout(`${this.vaultAddr}/v1/${path}`, {
         method: 'POST',
@@ -242,14 +254,23 @@ export class HashicorpVaultKmsService implements KmsService {
           'X-Vault-Token': this.vaultToken,
           'Content-Type': 'application/json',
         },
-        body: JSON.stringify({ data: { key } }),
+        body: JSON.stringify(body),
         timeoutMs: this.requestTimeoutMs,
       })
-      this.healthy = res.ok
-      if (!res.ok) {
-        console.warn('⚠️ [encryption][kms] Vault write failed', { path, status: res.status })
+      if (res.ok) {
+        this.healthy = true
+        return 'ok'
       }
-      return res.ok
+      // KV v2 returns 400 when a check-and-set write loses to a concurrent
+      // writer (path already at a newer version). That is a normal race outcome,
+      // not an unhealthy Vault — don't flip `healthy`.
+      if (typeof opts?.cas === 'number' && res.status === 400) {
+        console.warn('⚠️ [encryption][kms] Vault write CAS conflict (concurrent DEK create)', { path, status: res.status })
+        return 'conflict'
+      }
+      this.healthy = false
+      console.warn('⚠️ [encryption][kms] Vault write failed', { path, status: res.status })
+      return 'error'
     } catch (err) {
       this.healthy = false
       console.warn('⚠️ [encryption][kms] Vault write error', {
@@ -257,7 +278,7 @@ export class HashicorpVaultKmsService implements KmsService {
         error: (err as Error)?.message || String(err),
         timeoutMs: this.requestTimeoutMs,
       })
-      return false
+      return 'error'
     }
   }
 
@@ -287,16 +308,40 @@ export class HashicorpVaultKmsService implements KmsService {
   }
 
   async createTenantDek(tenantId: string): Promise<TenantDek | null> {
-    const key = generateDek()
     const path = this.buildKeyPath(tenantId)
-    const ok = await this.writeVault(path, key)
-    if (ok) {
+    // Read-before-write: if a DEK already exists for this tenant (another request
+    // or process created it first), adopt it instead of overwriting the active
+    // key — overwriting orphans every row already encrypted under it (#2746).
+    const existing = await this.readVault(path)
+    const existingKey = existing?.data?.data?.key
+    if (existingKey) {
+      return this.remember({ tenantId, key: existingKey, fetchedAt: this.now() })
+    }
+    // A read failure (timeout / 5xx) flips `healthy` off; don't blind-write a new
+    // key over a possibly-existing one we just couldn't read — let the caller fall back.
+    if (!this.healthy) return null
+    const key = generateDek()
+    const outcome = await this.writeVault(path, key, { cas: 0 })
+    if (outcome === 'ok') {
       console.info('🔑 [encryption][kms] Stored tenant DEK in Vault', { tenantId, path })
-    } else {
-      console.warn('⚠️ [encryption][kms] Failed to store tenant DEK in Vault', { tenantId, path })
+      return this.remember({ tenantId, key, fetchedAt: this.now() })
+    }
+    if (outcome === 'conflict') {
+      // A concurrent create won the CAS race — adopt the winner's key so both
+      // callers encrypt under the same DEK.
+      const winner = await this.readVault(path)
+      const winnerKey = winner?.data?.data?.key
+      if (winnerKey) {
+        console.info('🔑 [encryption][kms] Adopted concurrently-created tenant DEK', { tenantId, path })
+        return this.remember({ tenantId, key: winnerKey, fetchedAt: this.now() })
+      }
     }
-    if (!ok) return null
-    return this.remember({ tenantId, key, fetchedAt: this.now() })
+    console.warn('⚠️ [encryption][kms] Failed to store tenant DEK in Vault', { tenantId, path })
+    return null
+  }
+
+  invalidateDek(tenantId: string): void {
+    this.cache.delete(tenantId)
   }
 }
 

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -22,6 +22,10 @@ type MapCacheKey = {
 }
 
 const MAP_MISS_TTL_MS = 5 * 60 * 1000
+// Mirror the Vault KMS default DEK TTL so a rotated/revoked tenant key is picked
+// up by long-lived processes without a restart (#2746). The service-level cache
+// previously had no TTL and shadowed the KMS's own 15-minute expiry.
+const DEK_CACHE_TTL_MS = 15 * 60 * 1000
 
 function cacheKey(key: MapCacheKey): string {
   return [
@@ -106,11 +110,13 @@ export class TenantDataEncryptionService {
   private static globalMemoryCache = new Map<string, EncryptionMapRecord>()
   private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()
   private static globalDekCache = new Map<string, TenantDek>()
+  private static globalInflightDeks = new Map<string, Promise<TenantDek | null>>()
   private static globalMissCache = new Map<string, number>()
   private readonly kms: KmsService
   private readonly cache?: CacheStrategy
   private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache
   private readonly dekCache = TenantDataEncryptionService.globalDekCache
+  private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks
   private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps
   private readonly missCache = TenantDataEncryptionService.globalMissCache
 
@@ -126,10 +132,15 @@ export class TenantDataEncryptionService {
     return isTenantDataEncryptionEnabled() && this.kms.isHealthy()
   }
 
+  private isDekExpired(dek: TenantDek): boolean {
+    return Date.now() - dek.fetchedAt > DEK_CACHE_TTL_MS
+  }
+
   async getDek(tenantId: string | null | undefined): Promise<TenantDek | null> {
     if (!tenantId) return null
     const cached = this.dekCache.get(tenantId)
-    if (cached) return cached
+    if (cached && !this.isDekExpired(cached)) return cached
+    if (cached) this.dekCache.delete(tenantId)
     const dek = await this.kms.getTenantDek(tenantId)
     if (!dek) {
       debug('🔎 dek.miss', { tenantId })
@@ -144,9 +155,22 @@ export class TenantDataEncryptionService {
     const existing = await this.getDek(tenantId)
     if (existing || !tenantId) return existing ?? null
     if (typeof this.kms.createTenantDek !== 'function') return existing ?? null
-    const created = await this.kms.createTenantDek(tenantId)
-    if (created) this.dekCache.set(tenantId, created)
-    return created ?? null
+    // Dedupe concurrent first-time creation within this process so two callers
+    // can't each generate a distinct DEK and overwrite one another (#2746).
+    // Mirrors the encryption-map inflight dedupe (`globalInflightMaps`).
+    const pending = this.inflightDeks.get(tenantId)
+    if (pending) return pending
+    const creation = (async () => {
+      const created = await this.kms.createTenantDek(tenantId)
+      if (created) this.dekCache.set(tenantId, created)
+      return created ?? null
+    })()
+    this.inflightDeks.set(tenantId, creation)
+    try {
+      return await creation
+    } finally {
+      this.inflightDeks.delete(tenantId)
+    }
   }
 
   async createDek(tenantId: string): Promise<TenantDek | null> {
@@ -246,6 +270,15 @@ export class TenantDataEncryptionService {
     }
   }
 
+  // Force a flush of a tenant's cached DEK across the service-level cache and the
+  // underlying KMS cache so an operator can pick up a rotated/revoked key without
+  // a process restart (#2746).
+  invalidateDek(tenantId: string): void {
+    this.dekCache.delete(tenantId)
+    this.inflightDeks.delete(tenantId)
+    this.kms.invalidateDek?.(tenantId)
+  }
+
   async getEncryptedFieldNames(
     entityId: string,
     tenantId: string | null | undefined,