@open-mercato/shared 0.6.7-develop.6785.1.1dd7cfac55 → 0.6.7-develop.6795.1.8a3f27921c

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 251 entry points
+[build:shared] found 253 entry points
 [build:shared] built successfully

package/AGENTS.md

@@ -34,6 +34,7 @@ yarn workspace @open-mercato/shared build
 |-----------|-------------|-------------|
 | `api/` | When building scoped API payloads | `@open-mercato/shared/lib/api/scoped` |
 | `auth/` | When you need wildcard-aware feature matching or shared auth helpers | `@open-mercato/shared/lib/auth/featureMatch` |
+| `auth/organizationScope` | When an organization-scoped API route must resolve the caller's organization — falls back to `actorOrgId` for an "all organizations" selection, but only while the effective tenant is still the actor's tenant. On `null` for an authenticated caller answer with `organizationScopeRequiredResponse()` (400, code `organization_scope_required`) — never 401 | `@open-mercato/shared/lib/auth/organizationScope` — `resolveActiveOrganizationId(auth)`, `organizationScopeRequiredResponse()` |
 | `boolean/` | When parsing boolean strings from env/query params | `@open-mercato/shared/lib/boolean` |
 | `browser/` | When persisting client UI state to `localStorage` — use the safe wrappers and the versioned-envelope helper instead of raw `localStorage` reads/writes | `@open-mercato/shared/lib/browser/safeLocalStorage`, `@open-mercato/shared/lib/browser/versionedPreference` |
 | `commands/` | When implementing undo/redo command pattern | `@open-mercato/shared/lib/commands` |

package/build.mjs

@@ -2,6 +2,7 @@ import { readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { buildPackage } from '../../scripts/build-package.mjs'
+import { buildVersionSource } from './scripts/versionSource.cjs'
 
 const packageDir = dirname(fileURLToPath(import.meta.url))
 const packageJson = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf-8'))
@@ -12,10 +13,7 @@ const injectVersion = {
   name: 'inject-version',
   setup(build) {
     build.onLoad({ filter: /lib\/version\.ts$/ }, async () => ({
-      contents: `// Build-time generated version
-export const APP_VERSION = '${packageVersion}'
-export const appVersion = APP_VERSION
-`,
+      contents: buildVersionSource(packageVersion),
       loader: 'ts',
     }))
   },

package/dist/lib/auth/organizationScope.js

@@ -0,0 +1,34 @@
+function normalizeId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function resolveActiveOrganizationId(auth) {
+  if (!auth) return null;
+  const selected = normalizeId(auth.orgId);
+  if (selected) return selected;
+  const actorOrgId = normalizeId(auth.actorOrgId);
+  if (!actorOrgId) return null;
+  if ("actorTenantId" in auth) {
+    const actorTenantId = normalizeId(auth.actorTenantId);
+    const effectiveTenantId = normalizeId(auth.tenantId);
+    if (!actorTenantId || actorTenantId !== effectiveTenantId) return null;
+  }
+  return actorOrgId;
+}
+const ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE = "organization_scope_required";
+function organizationScopeRequiredResponse() {
+  return Response.json(
+    {
+      error: "Select an organization to access this resource",
+      code: ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE
+    },
+    { status: 400 }
+  );
+}
+export {
+  ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId
+};
+//# sourceMappingURL=organizationScope.js.map

package/dist/lib/auth/organizationScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/auth/organizationScope.ts"],
+  "sourcesContent": ["type OrganizationScopedAuth = {\n  orgId?: string | null\n  actorOrgId?: unknown\n  tenantId?: string | null\n  actorTenantId?: unknown\n} | null | undefined\n\nfunction normalizeId(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed.length > 0 ? trimmed : null\n}\n\n/**\n * Resolves the organization a request is scoped to when the caller may be viewing\n * \"all organizations\".\n *\n * Organization-scoped configuration modules (integrations credentials/state, data sync\n * mappings/schedules/runs) all require a non-null `organization_id`, so there is no\n * meaningful \"all organizations\" view of them. When an operator selects that option the\n * super-admin cookie override clears `auth.orgId` and preserves the actor's own\n * organization in `actorOrgId`; fall back to it so those modules keep showing the\n * operator's own configuration instead of failing.\n *\n * The fallback is only valid while the effective tenant is still the actor's own tenant.\n * When the super-admin cookie override also switched tenants (`actorTenantId` is present\n * and differs from `auth.tenantId`), the actor's organization belongs to another tenant \u2014\n * scoping to it would persist a cross-tenant `{ organizationId, tenantId }` pair. Return\n * `null` instead and let the route answer with `organizationScopeRequiredResponse()`.\n *\n * Answering 401 for an unresolvable scope is not merely wrong but self-perpetuating:\n * `apiFetch` reads 401 as an expired session and redirects through\n * `/api/auth/session/refresh`, which succeeds and returns to the same page, reloading\n * forever. That is why the missing-scope answer is a 400, never a 401.\n */\nexport function resolveActiveOrganizationId(auth: OrganizationScopedAuth): string | null {\n  if (!auth) return null\n  const selected = normalizeId(auth.orgId)\n  if (selected) return selected\n  const actorOrgId = normalizeId(auth.actorOrgId)\n  if (!actorOrgId) return null\n  if ('actorTenantId' in auth) {\n    const actorTenantId = normalizeId(auth.actorTenantId)\n    const effectiveTenantId = normalizeId(auth.tenantId)\n    if (!actorTenantId || actorTenantId !== effectiveTenantId) return null\n  }\n  return actorOrgId\n}\n\nexport const ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE = 'organization_scope_required'\n\n/**\n * 400 response for an authenticated caller whose organization scope cannot be resolved\n * (e.g. a super-admin viewing a foreign tenant with \"all organizations\" selected).\n * Deliberately not a 401: the session is valid, so refreshing it would loop.\n */\nexport function organizationScopeRequiredResponse(): Response {\n  return Response.json(\n    {\n      error: 'Select an organization to access this resource',\n      code: ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,\n    },\n    { status: 400 },\n  )\n}\n"],
+  "mappings": "AAOA,SAAS,YAAY,OAA+B;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAwBO,SAAS,4BAA4B,MAA6C;AACvF,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,WAAW,YAAY,KAAK,KAAK;AACvC,MAAI,SAAU,QAAO;AACrB,QAAM,aAAa,YAAY,KAAK,UAAU;AAC9C,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,mBAAmB,MAAM;AAC3B,UAAM,gBAAgB,YAAY,KAAK,aAAa;AACpD,UAAM,oBAAoB,YAAY,KAAK,QAAQ;AACnD,QAAI,CAAC,iBAAiB,kBAAkB,kBAAmB,QAAO;AAAA,EACpE;AACA,SAAO;AACT;AAEO,MAAM,yCAAyC;AAO/C,SAAS,oCAA8C;AAC5D,SAAO,SAAS;AAAA,IACd;AAAA,MACE,OAAO;AAAA,MACP,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;",
+  "names": []
+}

package/dist/lib/query/engine.js

@@ -6,6 +6,10 @@ import {
   resolveJoins
 } from "./join-utils.js";
 import { resolveSearchConfig } from "../search/config.js";
+import {
+  createSearchTokenAvailability,
+  isSearchFilterOp
+} from "../search/availability.js";
 import { tokenizeText } from "../search/tokenize.js";
 import { runBeforeQueryPipeline, runAfterQueryPipeline } from "./query-extension-runner.js";
 import {
@@ -134,8 +138,8 @@ class BasicQueryEngine {
     this.getDbFn = getDbFn;
     this.resolveEncryptionService = resolveEncryptionService;
     this.columnCache = /* @__PURE__ */ new Map();
-    this.tableCache = /* @__PURE__ */ new Map();
     this.searchAliasSeq = 0;
+    this.searchAvailabilityInstance = null;
   }
   getEncryptionService() {
     try {
@@ -150,6 +154,21 @@ class BasicQueryEngine {
     if (typeof emAny?.getKysely === "function") return emAny.getKysely();
     throw new Error("BasicQueryEngine requires an EntityManager exposing getKysely() (MikroORM v7)");
   }
+  searchAvailability() {
+    if (!this.searchAvailabilityInstance) {
+      this.searchAvailabilityInstance = createSearchTokenAvailability({
+        getDb: () => this.getDb(),
+        getConfig: resolveSearchConfig,
+        applyOrganizationScope: (query, column, scope) => this.applyOrganizationScope(
+          query,
+          column,
+          scope
+        ),
+        logDebug: (event, payload) => this.logSearchDebug(event, payload)
+      });
+    }
+    return this.searchAvailabilityInstance;
+  }
   async query(entity, opts = {}) {
     const ext = opts.extensions;
     let effectiveOpts = opts;
@@ -205,11 +224,10 @@ class BasicQueryEngine {
     const { baseFilters, joinFilters } = partitionFilters(table, normalizedFilters, joinMap);
     const cfFilters = normalizedFilters.filter((filter) => String(filter.field).startsWith("cf:"));
     const searchConfig = resolveSearchConfig();
-    const searchEnabled = !skipAutoScope && searchConfig.enabled && await this.tableExists("search_tokens");
-    const hasSearchTokens = searchEnabled ? await this.hasSearchTokens(String(entity), opts.tenantId ?? null, orgScope) : false;
+    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => isSearchFilterOp(filter.op));
+    const searchEnabled = !skipAutoScope && await this.searchAvailability().staticEnabled();
+    const hasSearchTokens = searchEnabled && searchFilters.length ? await this.searchAvailability().hasTokens(String(entity), opts.tenantId ?? null, orgScope) : false;
     const searchActive = searchEnabled && hasSearchTokens;
-    const joinSearchAvailability = /* @__PURE__ */ new Map();
-    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => filter.op === "like" || filter.op === "ilike");
     if (searchFilters.length) {
       const fields = searchFilters.map((filter) => String(filter.field));
       this.logSearchDebug("search:init", {
@@ -258,8 +276,7 @@ class BasicQueryEngine {
       if (!filters.length) continue;
       const join = joinMap.get(alias);
       if (!join?.entityId) continue;
-      const hasJoinedTokens = searchEnabled ? await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope) : false;
-      joinSearchAvailability.set(join.entityId, hasJoinedTokens);
+      const hasJoinedTokens = searchEnabled ? await this.searchAvailability().hasTokens(join.entityId, opts.tenantId ?? null, orgScope) : false;
       const fallbackFields = filters.filter((filter) => !hasJoinedTokens || typeof filter.value !== "string" || tokenizeText(filter.value, searchConfig).hashes.length === 0).map((filter) => filter.column);
       if (!fallbackFields.length) continue;
       await warnOnCiphertextLikeFallback({
@@ -309,11 +326,7 @@ class BasicQueryEngine {
       if (!searchEnabled || !join.entityId) return { applied: false, builder };
       if (!["like", "ilike"].includes(filter.op)) return { applied: false, builder };
       if (typeof filter.value !== "string" || filter.value.trim().length === 0) return { applied: false, builder };
-      let searchAvailable = joinSearchAvailability.get(join.entityId);
-      if (searchAvailable === void 0) {
-        searchAvailable = await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope);
-        joinSearchAvailability.set(join.entityId, searchAvailable);
-      }
+      const searchAvailable = await this.searchAvailability().hasTokens(join.entityId, opts.tenantId ?? null, orgScope);
       if (!searchAvailable) return { applied: false, builder };
       const tokens = tokenizeText(String(filter.value), searchConfig);
       if (!tokens.hashes.length) return { applied: false, builder };
@@ -898,36 +911,6 @@ class BasicQueryEngine {
     else this.columnCache.delete(key);
     return present;
   }
-  async tableExists(table) {
-    if (this.tableCache.has(table)) return this.tableCache.get(table) ?? false;
-    const db = this.getDb();
-    const exists = await db.selectFrom("information_schema.tables").select(sql`1`.as("one")).where("table_name", "=", table).limit(1).executeTakeFirst();
-    const present = !!exists;
-    this.tableCache.set(table, present);
-    return present;
-  }
-  async hasSearchTokens(entity, tenantId, orgScope) {
-    try {
-      const db = this.getDb();
-      let query = db.selectFrom("search_tokens").select(sql`1`.as("one")).where("entity_type", "=", entity).limit(1);
-      if (tenantId !== void 0) {
-        query = query.where(sql`tenant_id is not distinct from ${tenantId}`);
-      }
-      if (orgScope) {
-        query = this.applyOrganizationScope(query, "search_tokens.organization_id", orgScope);
-      }
-      const row = await query.executeTakeFirst();
-      return !!row;
-    } catch (err) {
-      this.logSearchDebug("search:has-tokens-error", {
-        entity,
-        tenantId,
-        organizationScope: orgScope,
-        error: err instanceof Error ? err.message : String(err)
-      });
-      return false;
-    }
-  }
   applySearchTokens(q, opts) {
     if (!opts.hashes.length) {
       this.logSearchDebug("search:skip-no-hashes", {