@open-mercato/shared 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6784.1.f80b9afce5

package/src/lib/data/engine.ts

@@ -6,11 +6,12 @@ import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/h
 import { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'
 import { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'
 import type { EventBus } from '@open-mercato/events/types'
-import type {
-  CrudEventAction,
-  CrudEventsConfig,
-  CrudIndexerConfig,
-  CrudEntityIdentifiers,
+import {
+  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+  type CrudEventAction,
+  type CrudEventsConfig,
+  type CrudIndexerConfig,
+  type CrudEntityIdentifiers,
 } from '../crud/types'
 import type { BulkImportSuppression } from '../commands/types'
 import { CrudHttpError } from '../crud/errors'
@@ -18,6 +19,7 @@ import { resolveRegisteredEntityTableName } from '../query/engine'
 import { getEntityIds } from '../encryption/entityIds'
 import { normalizeCustomFieldValues } from '../custom-fields/normalize'
 import { parseBooleanToken } from '../boolean'
+import { isReadProjectionAlwaysConsistent } from './consistency'
 import { isEventDeclared } from '../../modules/events'
 import { createLogger } from '../logger'
 
@@ -598,7 +600,7 @@ export class DefaultDataEngine implements DataEngine {
     if (events && !suppress?.skipEvents) {
       const eventName = `${events.module}.${events.entity}.${action}`
       warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')
-      const payload = events.buildPayload
+      const builtPayload = events.buildPayload
         ? events.buildPayload(ctx)
         : {
             id: ctx.identifiers.id,
@@ -606,6 +608,20 @@ export class DefaultDataEngine implements DataEngine {
             tenantId: ctx.identifiers.tenantId,
             ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),
           }
+      // A configured indexer means this data-engine call owns the query-index
+      // decision, including an explicit skipReindex suppression. Mark object
+      // payloads so the legacy domain-event bridge does not enqueue the same
+      // record a second time. Keep the marker non-enumerable so client broadcasts
+      // and persisted domain payloads retain their existing public shape.
+      // Primitive custom payloads cannot be bridged in any case because they do
+      // not expose the record id.
+      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)
+        ? Object.defineProperty(
+            { ...(builtPayload as Record<string, unknown>) },
+            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+            { value: true, enumerable: false },
+          )
+        : builtPayload
       try {
         await bus.emitEvent(eventName, payload, {
           persistent: !!events.persistent,
@@ -618,6 +634,7 @@ export class DefaultDataEngine implements DataEngine {
     }
 
     if (indexer && !suppress?.skipReindex) {
+      const alwaysConsistent = isReadProjectionAlwaysConsistent()
       const resolveCoverageBaseDelta = (): number | undefined => {
         if (action === 'created') return 1
         if (action === 'deleted') return -1
@@ -643,9 +660,14 @@ export class DefaultDataEngine implements DataEngine {
         // returns. The subscriber removes the projection row + tokens synchronously and
         // defers the coverage recompute + fulltext delete, so this stays bounded.
         // Errors are logged, not thrown — index drift never fails the originating write.
-        await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
-          logger.error('query_index.delete_one emit failed', { err })
-        })
+        // Always-consistent mode rethrows so drift is loud and retryable.
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })
+        } else {
+          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
+            logger.error('query_index.delete_one emit failed', { err })
+          })
+        }
       } else {
         const payload = indexer.buildUpsertPayload
           ? indexer.buildUpsertPayload(ctx)
@@ -663,18 +685,27 @@ export class DefaultDataEngine implements DataEngine {
         // (see delete_one above). The subscriber updates `entity_indexes` synchronously
         // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +
         // tokenize + DELETE + chunked INSERT) so write latency stays bounded.
-        await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
-          logger.error('query_index.upsert_one emit failed', { err })
-        })
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })
+        } else {
+          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
+            logger.error('query_index.upsert_one emit failed', { err })
+          })
+        }
       }
 
-      if (shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
-        void bus.emitEvent('query_index.coverage.refresh', {
+      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
+        const coveragePayload = {
           entityType: indexer.entityType,
           tenantId: ctx.identifiers.tenantId ?? null,
           organizationId: null,
           delayMs: 0,
-        }).catch(() => undefined)
+        }
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })
+        } else {
+          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)
+        }
       }
     }
   }
@@ -739,7 +770,10 @@ export class DefaultDataEngine implements DataEngine {
           indexer: entry.indexer as CrudIndexerConfig<unknown>,
           suppress,
         })
-      } catch {
+      } catch (error) {
+        if (isReadProjectionAlwaysConsistent()) {
+          throw error
+        }
         // best-effort; continue with remaining side effects
       }
     }

package/src/modules/customer-auth.ts

@@ -20,6 +20,7 @@ export interface CustomerAuthContext {
   customerEntityId?: string | null
   personEntityId?: string | null
   resolvedFeatures: string[]
+  isPortalAdmin?: boolean
 }
 
 export type CustomerUser = {

package/src/modules/navigation/backendChrome.ts

@@ -44,6 +44,7 @@ export type BackendChromeBrand = {
   logo?: {
     src: string
     alt?: string
+    preserveAspectRatio?: boolean
   } | null
 }
 

package/src/security/__tests__/featurePolicy.test.ts

@@ -0,0 +1,166 @@
+import type { Module } from '../../modules/registry'
+import { getModules } from '../../lib/modules/registry'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '../../modules/overrides'
+import {
+  authorizeFeatures,
+  getRemovedAclFeatureIds,
+  isAclFeatureRemoved,
+  resolveEffectiveFeatures,
+} from '../featurePolicy'
+
+jest.mock('../../lib/modules/registry', () => ({
+  getModules: jest.fn(),
+}))
+
+const mockGetModules = jest.mocked(getModules)
+
+const modules: Module[] = [
+  {
+    id: 'auth',
+    features: [
+      { id: 'auth.users.view', title: 'View users', module: 'auth' },
+      { id: 'auth.users.manage', title: 'Manage users', module: 'auth' },
+    ],
+  },
+  {
+    id: 'dashboards',
+    features: [
+      { id: 'analytics.view', title: 'View analytics', module: 'dashboards' },
+    ],
+  },
+  {
+    id: 'customer_accounts',
+    setup: {
+      defaultCustomerRoleFeatures: {
+        portal_admin: ['portal.*'],
+        buyer: ['portal.orders.view', 'portal.account.manage'],
+      },
+    },
+    frontendRoutes: [
+      {
+        Component: () => null,
+        requireCustomerFeatures: ['portal.quotes.view'],
+      },
+    ],
+  },
+]
+
+describe('featurePolicy', () => {
+  beforeEach(() => {
+    mockGetModules.mockReturnValue(modules)
+    resetModuleContractOverridesForTests()
+  })
+
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+    jest.resetAllMocks()
+  })
+
+  it('reports exact removals and lets a later replacement restore the feature', () => {
+    applyAclFeatureOverrides({
+      'auth.users.manage': null,
+      'legacy.feature': null,
+    })
+
+    expect(getRemovedAclFeatureIds()).toEqual(['auth.users.manage', 'legacy.feature'])
+    expect(isAclFeatureRemoved('auth.users.manage')).toBe(true)
+
+    applyAclFeatureOverrides({
+      'auth.users.manage': {
+        id: 'auth.users.manage',
+        title: 'Manage users',
+        module: 'auth',
+      },
+    })
+
+    expect(isAclFeatureRemoved('auth.users.manage')).toBe(false)
+    expect(getRemovedAclFeatureIds()).toEqual(['legacy.feature'])
+  })
+
+  it.each([
+    { grantedFeatures: ['auth.users.manage'], unrestricted: false, siblingAllowed: false },
+    { grantedFeatures: ['auth.*'], unrestricted: false, siblingAllowed: true },
+    { grantedFeatures: ['*'], unrestricted: false, siblingAllowed: true },
+    { grantedFeatures: [], unrestricted: true, siblingAllowed: true },
+  ])('denies a removed requirement before grants or unrestricted access', ({
+    siblingAllowed,
+    ...subject
+  }) => {
+    applyAclFeatureOverrides({ 'auth.users.manage': null })
+
+    expect(authorizeFeatures(['auth.users.manage'], subject)).toBe(false)
+    expect(authorizeFeatures(['auth.users.view'], subject)).toBe(siblingAllowed)
+  })
+
+  it('enforces invalid scope before unrestricted access', () => {
+    expect(authorizeFeatures(['auth.users.view'], {
+      grantedFeatures: ['*'],
+      unrestricted: true,
+      scopeAllowed: false,
+    })).toBe(false)
+  })
+
+  it('denies requirements owned by disabled modules', () => {
+    expect(authorizeFeatures(['search.global'], {
+      grantedFeatures: ['*'],
+      unrestricted: true,
+    })).toBe(false)
+  })
+
+  it('expands wildcards into a deterministic concrete set including portal sources', () => {
+    expect(resolveEffectiveFeatures(['*'])).toEqual([
+      'auth.users.view',
+      'auth.users.manage',
+      'analytics.view',
+      'portal.orders.view',
+      'portal.account.manage',
+      'portal.quotes.view',
+    ])
+    expect(resolveEffectiveFeatures(['portal.*'])).toEqual([
+      'portal.orders.view',
+      'portal.account.manage',
+      'portal.quotes.view',
+    ])
+  })
+
+  it('removes nulled features while preserving siblings and explicit custom grants', () => {
+    applyAclFeatureOverrides({
+      'auth.users.manage': null,
+      'auth.custom.audit': null,
+    })
+
+    expect(resolveEffectiveFeatures([
+      'auth.*',
+      'auth.custom.export',
+      'auth.custom.audit',
+    ])).toEqual([
+      'auth.users.view',
+      'auth.custom.export',
+    ])
+  })
+
+  it('uses declared ownership for off-convention features', () => {
+    expect(resolveEffectiveFeatures(['analytics.*'])).toEqual(['analytics.view'])
+    expect(authorizeFeatures(['analytics.view'], {
+      grantedFeatures: ['analytics.*'],
+    })).toBe(true)
+  })
+
+  it('fails closed for wildcards when the module registry is unavailable', () => {
+    mockGetModules.mockImplementation(() => {
+      throw new Error('registry unavailable')
+    })
+    applyAclFeatureOverrides({ 'legacy.removed': null })
+
+    expect(resolveEffectiveFeatures([
+      '*',
+      'legacy.*',
+      'legacy.explicit',
+      'legacy.removed',
+      'legacy.explicit',
+    ])).toEqual(['legacy.explicit'])
+  })
+})

package/src/security/enabledModulesRegistry.ts

@@ -31,6 +31,7 @@ type FeatureRegistry = {
   enabledModuleSet: Set<string>
   featureToModule: Map<string, string>
   prefixToModule: Map<string, string>
+  concreteFeatureIds: string[]
 }
 
 let cachedRegistry: FeatureRegistry | null = null
@@ -41,23 +42,63 @@ function buildRegistry(modules: readonly Module[]): FeatureRegistry {
   const enabledModuleSet = new Set(enabledModuleIds)
   const featureToModule = new Map<string, string>()
   const prefixToModule = new Map<string, string>()
+  const concreteFeatureIds: string[] = []
+  const concreteFeatureSet = new Set<string>()
+
+  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {
+    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId)
+      concreteFeatureIds.push(featureId)
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule)
+    }
+    const dot = featureId.indexOf('.')
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot)
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)
+    }
+  }
+
   for (const mod of modules) {
     const features = mod.features
-    if (!Array.isArray(features)) continue
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== 'string' || !feature.id) continue
-      const declared = typeof feature.module === 'string' && feature.module.length > 0
-        ? feature.module
-        : mod.id
-      featureToModule.set(feature.id, declared)
-      const dot = feature.id.indexOf('.')
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot)
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== 'string' || !feature.id) continue
+        const declared = typeof feature.module === 'string' && feature.module.length > 0
+          ? feature.module
+          : mod.id
+        addConcreteFeature(feature.id, declared, true)
+      }
+    }
+
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
       }
     }
+
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
+      }
+    }
+  }
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds,
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }
 }
 
 function getRegistry(): FeatureRegistry | null {
@@ -93,6 +134,17 @@ export function getEnabledModuleIds(): string[] {
   return registry ? [...registry.enabledModuleIds] : []
 }
 
+/** @internal Infrastructure input for concrete feature-policy projection. */
+export function getConcreteFeatureIds(): string[] {
+  const registry = getRegistry()
+  return registry ? [...registry.concreteFeatureIds] : []
+}
+
+/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */
+export function hasEnabledModulesRegistry(): boolean {
+  return getRegistry() !== null
+}
+
 /**
  * Filters a raw granted-features list down to the grants whose owning
  * module is currently enabled. Expands `*` (superadmin) into one wildcard

package/src/security/featurePolicy.ts

@@ -0,0 +1,89 @@
+import { hasAllFeatures as matchesAllFeatures } from './features'
+import {
+  filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
+  getEnabledModuleIds,
+  getOwningModuleId,
+  hasEnabledModulesRegistry,
+} from './enabledModulesRegistry'
+import { composeAclFeatureOverrides } from '../modules/overrides'
+
+export type FeaturePolicySubject = {
+  grantedFeatures: readonly string[]
+  unrestricted?: boolean
+  scopeAllowed?: boolean
+}
+
+export function getRemovedAclFeatureIds(): string[] {
+  return Object.entries(composeAclFeatureOverrides())
+    .filter(([, override]) => override === null)
+    .map(([featureId]) => featureId)
+}
+
+export function isAclFeatureRemoved(featureId: string): boolean {
+  return composeAclFeatureOverrides()[featureId] === null
+}
+
+function isFeatureEnabled(featureId: string): boolean {
+  if (!hasEnabledModulesRegistry()) return true
+  const enabledModuleIds = getEnabledModuleIds()
+  return enabledModuleIds.includes(getOwningModuleId(featureId))
+}
+
+export function authorizeFeatures(
+  required: readonly string[],
+  subject: FeaturePolicySubject,
+): boolean {
+  if (required.length === 0) return true
+  if (subject.scopeAllowed === false) return false
+  if (required.some((featureId) => (
+    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)
+  ))) {
+    return false
+  }
+  if (subject.unrestricted === true) return true
+  return matchesAllFeatures(
+    filterGrantsByEnabledModules(subject.grantedFeatures),
+    required,
+  )
+}
+
+export function resolveEffectiveFeatures(
+  grantedFeatures: readonly string[],
+): string[] {
+  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)
+    .filter((featureId) => !isAclFeatureRemoved(featureId))
+
+  if (!hasEnabledModulesRegistry()) {
+    return filteredGrants.filter((featureId, index, features) => (
+      featureId !== '*'
+      && !featureId.endsWith('.*')
+      && features.indexOf(featureId) === index
+    ))
+  }
+
+  const result: string[] = []
+  const seen = new Set<string>()
+  const addFeature = (featureId: string) => {
+    if (
+      seen.has(featureId)
+      || isAclFeatureRemoved(featureId)
+      || !isFeatureEnabled(featureId)
+    ) {
+      return
+    }
+    seen.add(featureId)
+    result.push(featureId)
+  }
+
+  for (const featureId of getConcreteFeatureIds()) {
+    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)
+  }
+
+  for (const featureId of filteredGrants) {
+    if (featureId === '*' || featureId.endsWith('.*')) continue
+    addFeature(featureId)
+  }
+
+  return result
+}