@open-mercato/shared 0.6.7-develop.6768.1.9d2c4efc43 → 0.6.7-develop.6770.1.b52298cf20

package/dist/lib/crud/factory.js

@@ -38,6 +38,7 @@ import {
   isCrudCacheEnabled,
   normalizeIdentifierValue,
   normalizeTagSegment,
+  pickFirstIdentifier,
   resolveCrudCache
 } from "./cache.js";
 import { deriveCrudSegmentTag } from "./cache-stats.js";
@@ -560,6 +561,12 @@ function buildCrudCacheKey(resource, request, ctx, enricherSignature = "") {
     `tenant:${normalizeTagSegment(ctx.auth?.tenantId ?? null)}`,
     `selectedOrg:${normalizeTagSegment(ctx.selectedOrganizationId ?? null)}`,
     `scope:${scopeSegment}`,
+    // List payloads can vary per caller identity beyond tenant/org scope:
+    // buildFilters may narrow by ctx.auth (e.g. ?mine=true), before-interceptor
+    // query rewrites are feature-gated per user, and afterList/after-interceptor
+    // output is embedded in the stored payload — so entries MUST be partitioned
+    // per actor (API key or user), never shared across identities.
+    `user:${normalizeTagSegment(ctx.auth?.keyId ?? ctx.auth?.sub ?? null)}`,
     `query:${serializeSearchParams(url.searchParams)}`
   ];
   if (enricherSignature) {
@@ -1589,6 +1596,29 @@ function makeCrudRoute(opts) {
             }
           }
         }
+        const createCmdUserFeatures = await resolveUserFeatures(ctx);
+        const { allGuards: createCmdAllGuards } = collectAndRunGuards(ctx.container);
+        let createCmdGuardAfterCallbacks = [];
+        if (createCmdAllGuards.length && ctx.auth.tenantId) {
+          const guardResult = await runMutationGuards(createCmdAllGuards, {
+            tenantId: ctx.auth.tenantId,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null,
+            userId: ctx.auth.sub,
+            resourceKind,
+            resourceId: null,
+            operation: "create",
+            requestMethod: request.method,
+            requestHeaders: request.headers,
+            mutationPayload: input2 && typeof input2 === "object" ? input2 : null
+          }, { userFeatures: createCmdUserFeatures ?? [] });
+          if (!guardResult.ok) {
+            return json(guardResult.errorBody ?? { error: "Operation blocked by guard" }, { status: guardResult.errorStatus ?? 422 });
+          }
+          if (guardResult.modifiedPayload && typeof input2 === "object" && input2) {
+            input2 = { ...input2, ...guardResult.modifiedPayload };
+          }
+          createCmdGuardAfterCallbacks = guardResult.afterSuccessCallbacks;
+        }
         const baseMetadata = {
           tenantId: ctx.auth?.tenantId ?? null,
           organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null,
@@ -1628,6 +1658,22 @@ function makeCrudRoute(opts) {
         const status = action.status ?? 201;
         const response = json(resolvedPayload, { status });
         attachOperationHeader(response, logEntry);
+        const commandResultId = pickFirstIdentifier(
+          result?.id,
+          resolvedPayload?.id
+        );
+        if (createCmdGuardAfterCallbacks.length && ctx.auth.tenantId && commandResultId) {
+          await runGuardAfterSuccessCallbacks(createCmdGuardAfterCallbacks, {
+            tenantId: ctx.auth.tenantId,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null,
+            userId: ctx.auth.sub,
+            resourceKind,
+            resourceId: commandResultId,
+            operation: "create",
+            requestMethod: request.method,
+            requestHeaders: request.headers
+          });
+        }
         return response;
       }
       const createConfig = opts.create;