@open-mercato/shared 0.6.6-develop.6385.1.9a81faa5f0 → 0.6.6-develop.6387.1.f4896ad565

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 228 entry points
+[build:shared] found 229 entry points
 [build:shared] built successfully

package/dist/lib/location/coordinates.js

@@ -0,0 +1,31 @@
+const COORDINATE_RANGES = {
+  latitude: { min: -90, max: 90 },
+  longitude: { min: -180, max: 180 }
+};
+const DECIMAL_INPUT_PATTERN = /^[+-]?(\d+([.,]\d+)?|[.,]\d+)$/;
+function parseCoordinate(trimmed) {
+  if (!DECIMAL_INPUT_PATTERN.test(trimmed)) return null;
+  const parsed = Number.parseFloat(trimmed.replace(",", "."));
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function validateCoordinateInput(kind, value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed.length) return { status: "empty" };
+  const parsed = parseCoordinate(trimmed);
+  if (parsed === null) return { status: "invalid" };
+  const { min, max } = COORDINATE_RANGES[kind];
+  if (parsed < min || parsed > max) return { status: "outOfRange", min, max };
+  return { status: "valid", value: parsed };
+}
+function normalizeCoordinateInput(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed.length) return void 0;
+  const parsed = parseCoordinate(trimmed);
+  return parsed === null ? void 0 : parsed;
+}
+export {
+  COORDINATE_RANGES,
+  normalizeCoordinateInput,
+  validateCoordinateInput
+};
+//# sourceMappingURL=coordinates.js.map

package/dist/lib/location/coordinates.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/location/coordinates.ts"],
+  "sourcesContent": ["export const COORDINATE_RANGES = {\n  latitude: { min: -90, max: 90 },\n  longitude: { min: -180, max: 180 },\n} as const\n\nexport type CoordinateFieldKind = keyof typeof COORDINATE_RANGES\n\nexport type CoordinateValidationResult =\n  | { status: 'empty' }\n  | { status: 'invalid' }\n  | { status: 'outOfRange'; min: number; max: number }\n  | { status: 'valid'; value: number }\n\nconst DECIMAL_INPUT_PATTERN = /^[+-]?(\\d+([.,]\\d+)?|[.,]\\d+)$/\n\nfunction parseCoordinate(trimmed: string): number | null {\n  if (!DECIMAL_INPUT_PATTERN.test(trimmed)) return null\n  const parsed = Number.parseFloat(trimmed.replace(',', '.'))\n  return Number.isFinite(parsed) ? parsed : null\n}\n\nexport function validateCoordinateInput(\n  kind: CoordinateFieldKind,\n  value: string | undefined,\n): CoordinateValidationResult {\n  const trimmed = typeof value === 'string' ? value.trim() : ''\n  if (!trimmed.length) return { status: 'empty' }\n  const parsed = parseCoordinate(trimmed)\n  if (parsed === null) return { status: 'invalid' }\n  const { min, max } = COORDINATE_RANGES[kind]\n  if (parsed < min || parsed > max) return { status: 'outOfRange', min, max }\n  return { status: 'valid', value: parsed }\n}\n\nexport function normalizeCoordinateInput(value: string | undefined): number | undefined {\n  const trimmed = typeof value === 'string' ? value.trim() : ''\n  if (!trimmed.length) return undefined\n  const parsed = parseCoordinate(trimmed)\n  return parsed === null ? undefined : parsed\n}\n"],
+  "mappings": "AAAO,MAAM,oBAAoB;AAAA,EAC/B,UAAU,EAAE,KAAK,KAAK,KAAK,GAAG;AAAA,EAC9B,WAAW,EAAE,KAAK,MAAM,KAAK,IAAI;AACnC;AAUA,MAAM,wBAAwB;AAE9B,SAAS,gBAAgB,SAAgC;AACvD,MAAI,CAAC,sBAAsB,KAAK,OAAO,EAAG,QAAO;AACjD,QAAM,SAAS,OAAO,WAAW,QAAQ,QAAQ,KAAK,GAAG,CAAC;AAC1D,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEO,SAAS,wBACd,MACA,OAC4B;AAC5B,QAAM,UAAU,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC3D,MAAI,CAAC,QAAQ,OAAQ,QAAO,EAAE,QAAQ,QAAQ;AAC9C,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,WAAW,KAAM,QAAO,EAAE,QAAQ,UAAU;AAChD,QAAM,EAAE,KAAK,IAAI,IAAI,kBAAkB,IAAI;AAC3C,MAAI,SAAS,OAAO,SAAS,IAAK,QAAO,EAAE,QAAQ,cAAc,KAAK,IAAI;AAC1E,SAAO,EAAE,QAAQ,SAAS,OAAO,OAAO;AAC1C;AAEO,SAAS,yBAAyB,OAA+C;AACtF,QAAM,UAAU,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC3D,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,SAAS,gBAAgB,OAAO;AACtC,SAAO,WAAW,OAAO,SAAY;AACvC;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.6-develop.6385.1.9a81faa5f0";
+const APP_VERSION = "0.6.6-develop.6387.1.f4896ad565";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.6-develop.6385.1.9a81faa5f0'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.6-develop.6387.1.f4896ad565'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.6-develop.6385.1.9a81faa5f0",
+  "version": "0.6.6-develop.6387.1.f4896ad565",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -93,7 +93,7 @@
     "@mikro-orm/core": "^7.1.4",
     "@mikro-orm/decorators": "^7.1.4",
     "@mikro-orm/postgresql": "^7.1.4",
-    "@open-mercato/cache": "0.6.6-develop.6385.1.9a81faa5f0",
+    "@open-mercato/cache": "0.6.6-develop.6387.1.f4896ad565",
     "dotenv": "^17.4.2",
     "rate-limiter-flexible": "^11.2.0",
     "re2js": "2.8.3",

package/src/lib/encryption/__tests__/subscriber.test.ts

@@ -4,6 +4,11 @@ import {
 } from '../subscriber'
 import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
 
+// Give every entity a resolvable id so the real decrypt() path proceeds to decryptEntityPayload.
+jest.mock('../entityIds', () => ({
+  resolveEntityIdFromMetadata: jest.fn(() => 'customers:customer_address'),
+}))
+
 describe('decryptEntitiesWithFallbackScope subscriber memoization (issue #2235)', () => {
   const originalToggle = process.env.TENANT_DATA_ENCRYPTION
 
@@ -77,3 +82,71 @@ describe('decryptEntitiesWithFallbackScope subscriber memoization (issue #2235)'
     expect(spy).not.toHaveBeenCalled()
   })
 })
+
+describe('decryptEntitiesWithFallbackScope per-row scope (multi-org safety)', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+    jest.restoreAllMocks()
+  })
+
+  // Records the (tenantId, organizationId) each row is decrypted with. `decryptEntityPayload` is the
+  // exact seam where the row's resolved scope is applied, so capturing its args proves which org key
+  // each row decrypts under.
+  function makeRecordingService(): {
+    service: TenantDataEncryptionService
+    calls: Array<{ tenantId: string | null; organizationId: string | null; row: Record<string, unknown> }>
+  } {
+    const calls: Array<{ tenantId: string | null; organizationId: string | null; row: Record<string, unknown> }> = []
+    const service = {
+      isEnabled: () => true,
+      decryptEntityPayload: jest.fn(
+        async (_entityId: string, target: Record<string, unknown>, tenantId: string | null, organizationId: string | null) => {
+          calls.push({ tenantId, organizationId, row: target })
+          return {}
+        },
+      ),
+    } as unknown as TenantDataEncryptionService
+    return { service, calls }
+  }
+
+  // A bare entity carrying its own scope + empty metadata (so the deep-decrypt prop loop is a no-op).
+  const row = (organizationId: string | null) => ({
+    organizationId,
+    tenantId: 'tenant-1',
+    __meta: { properties: {} },
+  })
+
+  it('decrypts each row with the row’s OWN organization, using the fallback org only when a row lacks one', async () => {
+    const { service, calls } = makeRecordingService()
+    const orgA = 'org-a'
+    const orgB = 'org-b'
+    const fallbackOrg = 'org-fallback'
+
+    const rowA = row(orgA)
+    const rowB = row(orgB)
+    const rowNoOrg = row(null)
+
+    // Mirrors the deals-map route under an "All organizations" scope: a single fallback org
+    // (orgFilterIds[0]) is passed, but the rows span multiple orgs.
+    await decryptEntitiesWithFallbackScope([rowA, rowB, rowNoOrg], {
+      em: {} as { getMetadata?: () => unknown; getComparator?: () => unknown },
+      tenantId: 'tenant-1',
+      organizationId: fallbackOrg,
+      encryptionService: service,
+    })
+
+    const orgFor = (target: Record<string, unknown>) =>
+      calls.find((call) => call.row === target)?.organizationId
+
+    // Each scoped row decrypts with its OWN org — NOT the orgFilterIds[0] fallback. This is what makes
+    // the route's single-fallback decryptionScope safe across a multi-org page.
+    expect(orgFor(rowA)).toBe(orgA)
+    expect(orgFor(rowB)).toBe(orgB)
+    // Only a row that carries no org of its own falls back to orgFilterIds[0].
+    expect(orgFor(rowNoOrg)).toBe(fallbackOrg)
+    expect(calls).toHaveLength(3)
+  })
+})

package/src/lib/location/__tests__/coordinates.test.ts

@@ -0,0 +1,84 @@
+import {
+  normalizeCoordinateInput,
+  validateCoordinateInput,
+} from '../coordinates'
+
+describe('normalizeCoordinateInput', () => {
+  it('returns undefined for undefined input', () => {
+    expect(normalizeCoordinateInput(undefined)).toBeUndefined()
+  })
+
+  it('returns undefined for empty string', () => {
+    expect(normalizeCoordinateInput('')).toBeUndefined()
+  })
+
+  it('returns undefined for whitespace-only input', () => {
+    expect(normalizeCoordinateInput('   ')).toBeUndefined()
+  })
+
+  it('parses a decimal value', () => {
+    expect(normalizeCoordinateInput('52.5')).toBe(52.5)
+  })
+
+  it('parses a negative value with surrounding whitespace', () => {
+    expect(normalizeCoordinateInput(' -13.37 ')).toBe(-13.37)
+  })
+
+  it('parses an integer value', () => {
+    expect(normalizeCoordinateInput('21')).toBe(21)
+  })
+
+  it('normalizes comma decimal separators', () => {
+    expect(normalizeCoordinateInput('52,5')).toBe(52.5)
+  })
+
+  it('returns undefined for non-numeric input', () => {
+    expect(normalizeCoordinateInput('abc')).toBeUndefined()
+  })
+
+  it('returns undefined for trailing junk after a number', () => {
+    expect(normalizeCoordinateInput('52.5abc')).toBeUndefined()
+  })
+
+  it('returns undefined for multiple separators', () => {
+    expect(normalizeCoordinateInput('52,5,5')).toBeUndefined()
+  })
+})
+
+describe('validateCoordinateInput', () => {
+  it('reports empty for undefined, empty, and whitespace values', () => {
+    expect(validateCoordinateInput('latitude', undefined)).toEqual({ status: 'empty' })
+    expect(validateCoordinateInput('latitude', '')).toEqual({ status: 'empty' })
+    expect(validateCoordinateInput('longitude', '  ')).toEqual({ status: 'empty' })
+  })
+
+  it('accepts valid latitude values including boundaries', () => {
+    expect(validateCoordinateInput('latitude', '52.5')).toEqual({ status: 'valid', value: 52.5 })
+    expect(validateCoordinateInput('latitude', '-90')).toEqual({ status: 'valid', value: -90 })
+    expect(validateCoordinateInput('latitude', '90')).toEqual({ status: 'valid', value: 90 })
+  })
+
+  it('accepts valid longitude values including boundaries', () => {
+    expect(validateCoordinateInput('longitude', '-180')).toEqual({ status: 'valid', value: -180 })
+    expect(validateCoordinateInput('longitude', '180')).toEqual({ status: 'valid', value: 180 })
+  })
+
+  it('accepts comma decimal separators', () => {
+    expect(validateCoordinateInput('latitude', '52,5')).toEqual({ status: 'valid', value: 52.5 })
+  })
+
+  it('flags latitude outside -90..90 as out of range', () => {
+    expect(validateCoordinateInput('latitude', '-91')).toEqual({ status: 'outOfRange', min: -90, max: 90 })
+    expect(validateCoordinateInput('latitude', '90.1')).toEqual({ status: 'outOfRange', min: -90, max: 90 })
+  })
+
+  it('flags longitude outside -180..180 as out of range', () => {
+    expect(validateCoordinateInput('longitude', '200')).toEqual({ status: 'outOfRange', min: -180, max: 180 })
+    expect(validateCoordinateInput('longitude', '-180.5')).toEqual({ status: 'outOfRange', min: -180, max: 180 })
+  })
+
+  it('flags non-numeric input as invalid', () => {
+    expect(validateCoordinateInput('latitude', 'abc')).toEqual({ status: 'invalid' })
+    expect(validateCoordinateInput('longitude', '12.3.4')).toEqual({ status: 'invalid' })
+  })
+})

package/src/lib/location/coordinates.ts

@@ -0,0 +1,40 @@
+export const COORDINATE_RANGES = {
+  latitude: { min: -90, max: 90 },
+  longitude: { min: -180, max: 180 },
+} as const
+
+export type CoordinateFieldKind = keyof typeof COORDINATE_RANGES
+
+export type CoordinateValidationResult =
+  | { status: 'empty' }
+  | { status: 'invalid' }
+  | { status: 'outOfRange'; min: number; max: number }
+  | { status: 'valid'; value: number }
+
+const DECIMAL_INPUT_PATTERN = /^[+-]?(\d+([.,]\d+)?|[.,]\d+)$/
+
+function parseCoordinate(trimmed: string): number | null {
+  if (!DECIMAL_INPUT_PATTERN.test(trimmed)) return null
+  const parsed = Number.parseFloat(trimmed.replace(',', '.'))
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+export function validateCoordinateInput(
+  kind: CoordinateFieldKind,
+  value: string | undefined,
+): CoordinateValidationResult {
+  const trimmed = typeof value === 'string' ? value.trim() : ''
+  if (!trimmed.length) return { status: 'empty' }
+  const parsed = parseCoordinate(trimmed)
+  if (parsed === null) return { status: 'invalid' }
+  const { min, max } = COORDINATE_RANGES[kind]
+  if (parsed < min || parsed > max) return { status: 'outOfRange', min, max }
+  return { status: 'valid', value: parsed }
+}
+
+export function normalizeCoordinateInput(value: string | undefined): number | undefined {
+  const trimmed = typeof value === 'string' ? value.trim() : ''
+  if (!trimmed.length) return undefined
+  const parsed = parseCoordinate(trimmed)
+  return parsed === null ? undefined : parsed
+}