@open-mercato/shared 0.6.7-develop.6600.1.49a5df927f → 0.6.7-develop.6604.1.2c49816dff

package/dist/lib/crud/ids.js

@@ -38,8 +38,16 @@ function parseIdsParam(raw, maxIds = MAX_IDS_PER_REQUEST) {
   const parsed = normalizeIdList(raw.split(","));
   return parsed.slice(0, safeMax);
 }
-function mergeIdFilter(existingFilters, parsedIds) {
-  if (parsedIds.length === 0) return existingFilters;
+function isIdsParamProvided(raw) {
+  return typeof raw === "string" && raw.trim().length > 0;
+}
+function mergeIdFilter(existingFilters, parsedIds, options) {
+  if (parsedIds.length === 0) {
+    if (options?.idsParamProvided) {
+      return { ...existingFilters, id: { $in: [] } };
+    }
+    return existingFilters;
+  }
   const existingFilter = existingFilters.id;
   const existingIds = readExistingIds(existingFilter);
   if (!existingIds) {
@@ -57,6 +65,7 @@ function mergeIdFilter(existingFilters, parsedIds) {
 }
 export {
   MAX_IDS_PER_REQUEST,
+  isIdsParamProvided,
   mergeIdFilter,
   parseIdsParam
 };

package/dist/lib/crud/ids.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/ids.ts"],
-  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  if (typeof raw !== 'string' || raw.trim().length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(raw.split(','))\n  return parsed.slice(0, safeMax)\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n): Where<Fields> {\n  if (parsedIds.length === 0) return existingFilters\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
-  "mappings": "AAEO,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,IAAI,MAAM,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AAEO,SAAS,cACd,iBACA,WACe;AACf,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  if (typeof raw !== 'string' || raw.trim().length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(raw.split(','))\n  return parsed.slice(0, safeMax)\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string), regardless\n * of whether any value survived UUID validation. Lets a caller tell \"no ids\n * filter requested\" apart from \"ids filter requested but every value was\n * malformed\" \u2014 the latter must match nothing, not fall back to the full list\n * (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  return typeof raw === 'string' && raw.trim().length > 0\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
+  "mappings": "AAEO,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,IAAI,MAAM,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AASO,SAAS,mBAAmB,KAAuB;AACxD,SAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS;AACxD;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6600.1.49a5df927f";
+const APP_VERSION = "0.6.7-develop.6604.1.2c49816dff";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6600.1.49a5df927f'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6604.1.2c49816dff'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6600.1.49a5df927f",
+  "version": "0.6.7-develop.6604.1.2c49816dff",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -97,7 +97,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6600.1.49a5df927f",
+    "@open-mercato/cache": "0.6.7-develop.6604.1.2c49816dff",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/crud/__tests__/cache.test.ts

@@ -2,7 +2,7 @@ jest.mock('@open-mercato/cache', () => ({
   runWithCacheTenant: async <T>(_tenant: string | null, fn: () => Promise<T> | T) => fn(),
 }))
 
-import { deriveResourceFromCommandId } from '@open-mercato/shared/lib/crud/cache'
+import { deriveResourceFromCommandId, invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 
 describe('deriveResourceFromCommandId — irregular plurals (#2072)', () => {
   it('singularises "people" to "person"', () => {
@@ -62,3 +62,55 @@ describe('deriveResourceFromCommandId — irregular plurals (#2072)', () => {
     expect(deriveResourceFromCommandId('singletonly')).toBeNull()
   })
 })
+
+describe('invalidateCrudCache — tenant-level (org:null) collection flush (#2919)', () => {
+  const ORIGINAL_FLAG = process.env.ENABLE_CRUD_API_CACHE
+
+  beforeAll(() => {
+    process.env.ENABLE_CRUD_API_CACHE = 'true'
+  })
+
+  afterAll(() => {
+    if (ORIGINAL_FLAG === undefined) delete process.env.ENABLE_CRUD_API_CACHE
+    else process.env.ENABLE_CRUD_API_CACHE = ORIGINAL_FLAG
+  })
+
+  function makeContainer(deleteByTags: jest.Mock) {
+    const cache = { get: jest.fn(), set: jest.fn(), deleteByTags }
+    return { resolve: (name: string) => (name === 'cache' ? cache : null) } as never
+  }
+
+  it('flushes the org:null collection tag even when the write carries an actor org', async () => {
+    // Roles (orgField: null) cache their list under org:null, but the command bus
+    // resolves a write's organizationId from the actor's auth context. Without the
+    // org:null tag the cache would only expire on TTL — see TC-UNDO-001 / #2919.
+    const deleteByTags = jest.fn(async () => 0)
+    await invalidateCrudCache(
+      makeContainer(deleteByTags),
+      'auth.role',
+      { id: 'role-1', organizationId: 'org-9', tenantId: 'tenant-1' },
+      'tenant-1',
+      'test:org-mismatch',
+    )
+
+    expect(deleteByTags).toHaveBeenCalledTimes(1)
+    const tags = deleteByTags.mock.calls[0][0] as string[]
+    expect(tags).toContain('crud:auth.role:tenant:tenant-1:org:null:collection')
+    expect(tags).toContain('crud:auth.role:tenant:tenant-1:org:org-9:collection')
+    expect(tags).toContain('crud:auth.role:tenant:tenant-1:record:role-1')
+  })
+
+  it('still flushes the org:null collection tag for org-agnostic writes', async () => {
+    const deleteByTags = jest.fn(async () => 0)
+    await invalidateCrudCache(
+      makeContainer(deleteByTags),
+      'auth.role',
+      { id: 'role-2', organizationId: null, tenantId: 'tenant-1' },
+      'tenant-1',
+      'test:org-null',
+    )
+
+    const tags = deleteByTags.mock.calls[0][0] as string[]
+    expect(tags).toContain('crud:auth.role:tenant:tenant-1:org:null:collection')
+  })
+})

package/src/lib/crud/__tests__/ids.test.ts

@@ -1,4 +1,4 @@
-import { MAX_IDS_PER_REQUEST, mergeIdFilter, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'
+import { MAX_IDS_PER_REQUEST, mergeIdFilter, parseIdsParam, isIdsParamProvided } from '@open-mercato/shared/lib/crud/ids'
 
 describe('crud ids helpers', () => {
   const idA = '550e8400-e29b-41d4-a716-446655440001'
@@ -109,4 +109,34 @@ describe('crud ids helpers', () => {
       id: { $in: [idA] },
     })
   })
+
+  // #4143 Finding 3: `?ids=<garbage>` parsed to [] and silently dropped the
+  // filter, returning the full list — a record-count side channel. A supplied
+  // but fully-invalid ids param must match nothing, like a valid-unknown UUID.
+  it('isIdsParamProvided distinguishes a supplied param from an absent one', () => {
+    expect(isIdsParamProvided('not-a-uuid')).toBe(true)
+    expect(isIdsParamProvided(`${idA}`)).toBe(true)
+    expect(isIdsParamProvided('')).toBe(false)
+    expect(isIdsParamProvided('   ')).toBe(false)
+    expect(isIdsParamProvided(undefined)).toBe(false)
+    expect(isIdsParamProvided(null)).toBe(false)
+  })
+
+  it('mergeIdFilter matches nothing when ids param was provided but all invalid', () => {
+    // Malformed input: parseIdsParam yields [], but the param WAS provided.
+    expect(mergeIdFilter({}, parseIdsParam('not-a-uuid'), { idsParamProvided: true })).toEqual({
+      id: { $in: [] },
+    })
+    // Preserves any existing filters alongside the match-nothing id clause.
+    expect(
+      mergeIdFilter({ tenantId: 't1' } as any, [], { idsParamProvided: true }),
+    ).toEqual({ tenantId: 't1', id: { $in: [] } })
+  })
+
+  it('mergeIdFilter still no-ops on empty ids when the param was absent (BC)', () => {
+    expect(mergeIdFilter({ tenantId: 't1' } as any, [])).toEqual({ tenantId: 't1' })
+    expect(mergeIdFilter({ tenantId: 't1' } as any, [], { idsParamProvided: false })).toEqual({
+      tenantId: 't1',
+    })
+  })
 })

package/src/lib/crud/cache.ts

@@ -191,11 +191,14 @@ export async function invalidateCrudCache(
     if (recordId) {
       tags.add(buildRecordTag(key, tenantId, recordId))
     }
-    const organizationIds: Array<string | null> = []
-    if (identifiers.organizationId !== undefined) {
-      organizationIds.push(identifiers.organizationId ?? null)
-    }
-    if (!organizationIds.length) organizationIds.push(null)
+    // Always flush the tenant-level (org:null) collection tag alongside the
+    // write's own org. Tenant-scoped entities (orgField: null — e.g. auth roles)
+    // cache their collections under org:null, but the command bus resolves a
+    // write's organizationId from the actor's auth context, so the org-specific
+    // tag alone never matches those entries and they only expire on TTL (#2919).
+    const organizationIds: Array<string | null> = [null]
+    const recordOrganizationId = identifiers.organizationId ?? null
+    if (recordOrganizationId) organizationIds.push(recordOrganizationId)
     for (const tag of buildCollectionTags(key, tenantId, organizationIds)) {
       tags.add(tag)
     }

package/src/lib/crud/factory.ts

@@ -66,7 +66,7 @@ import { applyResponseEnrichers, applyResponseEnricherToRecord, resolveListCache
 import type { EnricherContext } from './response-enricher'
 import type { ApiInterceptorMethod, InterceptorRequest, InterceptorResponse } from './api-interceptor'
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from './interceptor-runner'
-import { mergeIdFilter, parseIdsParam } from './ids'
+import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from './ids'
 import { mergeAdvancedFilters } from './advanced-filter-integration'
 import { parseExtensionHeaders } from '../umes/extension-headers'
 import { createGenericOptimisticLockReader } from './optimistic-lock'
@@ -1445,6 +1445,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         ...(interceptorRequest.query ?? {}),
       } as Record<string, unknown>
       const parsedIds = parseIdsParam(queryParams.ids)
+      const idsParamProvided = isIdsParamProvided(queryParams.ids)
 
       await opts.hooks?.beforeList?.(validated as any, ctx)
       profiler.mark('before_list_hook')
@@ -1664,7 +1665,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         const filters = exportFullRequested
           ? baseFilters
           : mergeAdvancedFilters(baseFilters as Record<string, unknown>, validated as Record<string, unknown>) as Where<any>
-        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds)
+        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds, { idsParamProvided })
         const withDeleted = parseBooleanToken((queryParams as any).withDeleted) === true
         profiler.mark('filters_ready', { withDeleted })
         if (
@@ -1951,7 +1952,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         : mergeAdvancedFilters(fallbackBaseFilters as Record<string, unknown>, validated as Record<string, unknown>) as Where<any>
       const mergedFallbackFilters = exportFullRequested
         ? fallbackFilters
-        : mergeIdFilter(fallbackFilters, parsedIds)
+        : mergeIdFilter(fallbackFilters, parsedIds, { idsParamProvided })
       const ormFilters = translateFiltersForOrm(
         mergedFallbackFilters as Record<string, any>,
         em,

package/src/lib/crud/ids.ts

@@ -49,11 +49,32 @@ export function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST
   return parsed.slice(0, safeMax)
 }
 
+/**
+ * Whether an `?ids=` param was supplied at all (a non-empty string), regardless
+ * of whether any value survived UUID validation. Lets a caller tell "no ids
+ * filter requested" apart from "ids filter requested but every value was
+ * malformed" — the latter must match nothing, not fall back to the full list
+ * (#4143 Finding 3).
+ */
+export function isIdsParamProvided(raw: unknown): boolean {
+  return typeof raw === 'string' && raw.trim().length > 0
+}
+
 export function mergeIdFilter<Fields extends Record<string, unknown>>(
   existingFilters: Where<Fields>,
   parsedIds: string[],
+  options?: { idsParamProvided?: boolean },
 ): Where<Fields> {
-  if (parsedIds.length === 0) return existingFilters
+  if (parsedIds.length === 0) {
+    // The `?ids=` param was supplied but nothing survived UUID validation.
+    // Match nothing, mirroring a valid-but-unknown id returning zero rows,
+    // rather than silently dropping the filter and returning the full list
+    // (record-count side channel — #4143 Finding 3).
+    if (options?.idsParamProvided) {
+      return { ...existingFilters, id: { $in: [] } }
+    }
+    return existingFilters
+  }
 
   const existingFilter = (existingFilters as Record<string, unknown>).id
   const existingIds = readExistingIds(existingFilter)