@open-mercato/shared 0.6.7-develop.6788.1.c2a1520a30 → 0.6.7-develop.6795.1.8a3f27921c

package/dist/lib/search/availability.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/search/availability.ts"],
+  "sourcesContent": ["import { sql } from 'kysely'\nimport { parseNumberWithDefault } from '@open-mercato/shared/lib/number'\n\nexport type OrganizationScope = { ids: string[]; includeNull: boolean }\n\nexport type SearchTokenSourceRef = { entity: string; recordIdColumn?: string }\n\ntype ProbeExpression = object | string | readonly string[] | null\n\nexport type SearchTokenProbeQueryBuilder = {\n  select: (selection: ProbeExpression) => SearchTokenProbeQueryBuilder\n  where: (column: ProbeExpression, operator?: string, value?: ProbeExpression) => SearchTokenProbeQueryBuilder\n  limit: (count: number) => SearchTokenProbeQueryBuilder\n  executeTakeFirst: () => Promise<object | undefined>\n}\n\nexport type SearchTokenProbeDb = { selectFrom: (table: string) => SearchTokenProbeQueryBuilder }\n\nexport type SearchTokenAvailabilityDebugPayload = {\n  entity: string\n  tenantId: string | null\n  organizationScope?: OrganizationScope | null\n  recordIdColumn?: string\n  hasTokens?: boolean\n  error?: string\n}\n\nexport type SearchTokenAvailabilityDeps = {\n  getDb: () => SearchTokenProbeDb\n  getConfig: () => { enabled: boolean }\n  applyOrganizationScope: (\n    query: SearchTokenProbeQueryBuilder,\n    column: string,\n    scope: OrganizationScope,\n  ) => SearchTokenProbeQueryBuilder\n  logDebug: (event: string, payload: SearchTokenAvailabilityDebugPayload) => void\n}\n\nexport type SearchTokenAvailability = {\n  /**\n   * The cheap, statically-known half of the decision: search is configured on\n   * AND the `search_tokens` table exists. Safe to resolve eagerly (consumers\n   * like custom-field source attachment need it before any filter is\n   * inspected); the table probe is memoized per instance.\n   */\n  staticEnabled: () => Promise<boolean>\n  /**\n   * The expensive half: does `search_tokens` hold any row for this\n   * (entity, tenant, organization scope)? Historically the `LIMIT 1` probe\n   * could degenerate into a seq scan on a large table (#4723), so callers MUST\n   * only ask when the query actually carries a like/ilike filter \u2014 use\n   * `hasSearchFilter` for the gate. Three layers keep it cheap for the end\n   * user: index-usable predicates (no `IS NOT DISTINCT FROM`) served by the\n   * dedicated `search_tokens_presence_idx (entity_type, tenant_id,\n   * organization_id)` prefix \u2014 which makes the MISS as cheap as the hit \u2014 a\n   * per-request instance memo, and a process-level TTL cache\n   * (`OM_SEARCH_TOKEN_PRESENCE_CACHE_MS`, default 30s) that amortizes the\n   * probe across requests. Probe errors log `search:has-tokens-error`,\n   * resolve to `false`, and are never TTL-cached.\n   */\n  hasTokens: (entity: string, tenantId: string | null, orgScope?: OrganizationScope | null) => Promise<boolean>\n  /** First-hit sweep over token sources; logs `search:source-has-tokens` per probed source. */\n  anySourceHasTokens: (\n    sources: SearchTokenSourceRef[],\n    tenantId: string | null,\n    orgScope?: OrganizationScope | null,\n  ) => Promise<boolean>\n}\n\nexport function isSearchFilterOp(op: string | null | undefined): boolean {\n  return op === 'like' || op === 'ilike'\n}\n\n/**\n * The single definition of \"this query actually searches\". Every consumer of\n * the token-availability answer sits behind a like/ilike guard, so when this\n * returns `false` the `hasTokens` probe's answer would never be read \u2014 gate\n * the probe on it.\n */\nexport function hasSearchFilter(filters: ReadonlyArray<{ op?: string | null }>): boolean {\n  return filters.some((filter) => isSearchFilterOp(filter.op))\n}\n\nfunction orgScopeKey(scope: OrganizationScope | null | undefined): string {\n  if (!scope) return 'none'\n  return `${scope.includeNull ? '1' : '0'}:${[...scope.ids].sort((left, right) => left.localeCompare(right)).join(',')}`\n}\n\nconst PRESENCE_CACHE_DEFAULT_TTL_MS = 30_000\nconst PRESENCE_CACHE_MAX_ENTRIES = 10_000\n\n// Process-level TTL cache for the token-presence answer. Module-level (process-global) on\n// purpose: `createRequestContainer` builds fresh engines \u2014 and with them fresh resolver\n// instances \u2014 per request, so an instance-scoped memo alone re-pays the probe on every\n// request. On a large `search_tokens` one probe can be pathologically expensive (#4723),\n// so the answer is amortized across requests here and only re-checked once per TTL.\n// Staleness contract: a stale `false` keeps like/ilike on the plain-column fallback for up\n// to the TTL after an entity's first tokens are written; a stale `true` routes search\n// through an emptied token set for up to the TTL after a purge. Both converge within the\n// TTL; set OM_SEARCH_TOKEN_PRESENCE_CACHE_MS=0 to disable and probe per request again.\nconst presenceCache = new Map<string, { value: boolean; expiresAt: number }>()\n\nfunction resolvePresenceCacheTtlMs(): number {\n  return parseNumberWithDefault(process.env.OM_SEARCH_TOKEN_PRESENCE_CACHE_MS, PRESENCE_CACHE_DEFAULT_TTL_MS, { integer: true, min: 0 })\n}\n\nfunction storePresence(key: string, value: boolean, ttlMs: number): void {\n  if (presenceCache.size >= PRESENCE_CACHE_MAX_ENTRIES) {\n    const now = Date.now()\n    for (const [entryKey, entry] of presenceCache) {\n      if (entry.expiresAt <= now) presenceCache.delete(entryKey)\n    }\n    if (presenceCache.size >= PRESENCE_CACHE_MAX_ENTRIES) presenceCache.clear()\n  }\n  presenceCache.set(key, { value, expiresAt: Date.now() + ttlMs })\n}\n\nexport function clearSearchTokenPresenceCache(): void {\n  presenceCache.clear()\n}\n\n/**\n * One place that answers \"is token search usable here?\" for both query\n * engines, instead of each hand-assembling config + table-existence +\n * token-presence probes with private duplicate helpers and ad-hoc memo maps.\n *\n * Memoization is per instance; engines are constructed per request\n * (`createRequestContainer`), so entries never outlive a request \u2014 the same\n * staleness contract the engines' previous per-query join maps had. A\n * rejected table probe is evicted so the next call retries instead of\n * observing a poisoned cache entry.\n */\nexport function createSearchTokenAvailability(deps: SearchTokenAvailabilityDeps): SearchTokenAvailability {\n  const tablePresence = new Map<string, Promise<boolean>>()\n  const tokenPresence = new Map<string, Promise<boolean>>()\n\n  const tableExists = (table: string): Promise<boolean> => {\n    const cached = tablePresence.get(table)\n    if (cached) return cached\n    const probe = (async () => {\n      const row = await deps.getDb()\n        .selectFrom('information_schema.tables')\n        .select(sql<number>`1`.as('one'))\n        .where('table_name', '=', table)\n        .limit(1)\n        .executeTakeFirst()\n      return !!row\n    })()\n    tablePresence.set(table, probe)\n    probe.catch(() => tablePresence.delete(table))\n    return probe\n  }\n\n  const probeTokens = async (\n    entity: string,\n    tenantId: string | null,\n    orgScope?: OrganizationScope | null,\n  ): Promise<boolean> => {\n    let query = deps.getDb()\n      .selectFrom('search_tokens')\n      .select(sql<number>`1`.as('one'))\n      .where('entity_type', '=', entity)\n    // Deliberately `= / IS NULL` instead of `IS NOT DISTINCT FROM` (identical semantics\n    // for a string|null tenant): the latter cannot serve as an index condition, which is\n    // part of why the planner degraded this probe to a seq scan on large tables (#4723).\n    // With plain predicates the probe is a pure prefix seek on\n    // `search_tokens_presence_idx (entity_type, tenant_id, organization_id)`, making the\n    // miss as cheap as the hit.\n    query = tenantId == null\n      ? query.where('tenant_id', 'is', null)\n      : query.where('tenant_id', '=', tenantId)\n    if (orgScope) {\n      query = deps.applyOrganizationScope(query, 'search_tokens.organization_id', orgScope)\n    }\n    const row = await query.limit(1).executeTakeFirst()\n    return !!row\n  }\n\n  const hasTokens = (\n    entity: string,\n    tenantId: string | null,\n    orgScope?: OrganizationScope | null,\n  ): Promise<boolean> => {\n    const key = `${entity}|${tenantId ?? '__null__'}|${orgScopeKey(orgScope)}`\n    const ttlMs = resolvePresenceCacheTtlMs()\n    if (ttlMs > 0) {\n      const entry = presenceCache.get(key)\n      if (entry && entry.expiresAt > Date.now()) return Promise.resolve(entry.value)\n    }\n    const cached = tokenPresence.get(key)\n    if (cached) return cached\n    const probe = (async () => {\n      try {\n        const value = await probeTokens(entity, tenantId, orgScope)\n        // Only genuine probe results enter the process-level cache \u2014 caching an\n        // error-driven `false` would pin degraded search for a full TTL after a\n        // transient DB failure.\n        if (ttlMs > 0) storePresence(key, value, ttlMs)\n        return value\n      } catch (err) {\n        deps.logDebug('search:has-tokens-error', {\n          entity,\n          tenantId,\n          organizationScope: orgScope,\n          error: err instanceof Error ? err.message : String(err),\n        })\n        return false\n      }\n    })()\n    tokenPresence.set(key, probe)\n    return probe\n  }\n\n  return {\n    staticEnabled: async () => deps.getConfig().enabled && await tableExists('search_tokens'),\n    hasTokens,\n    anySourceHasTokens: async (sources, tenantId, orgScope) => {\n      for (const source of sources) {\n        const ok = await hasTokens(source.entity, tenantId, orgScope)\n        deps.logDebug('search:source-has-tokens', {\n          entity: source.entity,\n          recordIdColumn: source.recordIdColumn,\n          tenantId,\n          organizationScope: orgScope,\n          hasTokens: ok,\n        })\n        if (ok) return true\n      }\n      return false\n    },\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,WAAW;AACpB,SAAS,8BAA8B;AAoEhC,SAAS,iBAAiB,IAAwC;AACvE,SAAO,OAAO,UAAU,OAAO;AACjC;AAQO,SAAS,gBAAgB,SAAyD;AACvF,SAAO,QAAQ,KAAK,CAAC,WAAW,iBAAiB,OAAO,EAAE,CAAC;AAC7D;AAEA,SAAS,YAAY,OAAqD;AACxE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,GAAG,MAAM,cAAc,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC;AACtH;AAEA,MAAM,gCAAgC;AACtC,MAAM,6BAA6B;AAWnC,MAAM,gBAAgB,oBAAI,IAAmD;AAE7E,SAAS,4BAAoC;AAC3C,SAAO,uBAAuB,QAAQ,IAAI,mCAAmC,+BAA+B,EAAE,SAAS,MAAM,KAAK,EAAE,CAAC;AACvI;AAEA,SAAS,cAAc,KAAa,OAAgB,OAAqB;AACvE,MAAI,cAAc,QAAQ,4BAA4B;AACpD,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,CAAC,UAAU,KAAK,KAAK,eAAe;AAC7C,UAAI,MAAM,aAAa,IAAK,eAAc,OAAO,QAAQ;AAAA,IAC3D;AACA,QAAI,cAAc,QAAQ,2BAA4B,eAAc,MAAM;AAAA,EAC5E;AACA,gBAAc,IAAI,KAAK,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC;AACjE;AAEO,SAAS,gCAAsC;AACpD,gBAAc,MAAM;AACtB;AAaO,SAAS,8BAA8B,MAA4D;AACxG,QAAM,gBAAgB,oBAAI,IAA8B;AACxD,QAAM,gBAAgB,oBAAI,IAA8B;AAExD,QAAM,cAAc,CAAC,UAAoC;AACvD,UAAM,SAAS,cAAc,IAAI,KAAK;AACtC,QAAI,OAAQ,QAAO;AACnB,UAAM,SAAS,YAAY;AACzB,YAAM,MAAM,MAAM,KAAK,MAAM,EAC1B,WAAW,2BAA2B,EACtC,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,cAAc,KAAK,KAAK,EAC9B,MAAM,CAAC,EACP,iBAAiB;AACpB,aAAO,CAAC,CAAC;AAAA,IACX,GAAG;AACH,kBAAc,IAAI,OAAO,KAAK;AAC9B,UAAM,MAAM,MAAM,cAAc,OAAO,KAAK,CAAC;AAC7C,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,OAClB,QACA,UACA,aACqB;AACrB,QAAI,QAAQ,KAAK,MAAM,EACpB,WAAW,eAAe,EAC1B,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,eAAe,KAAK,MAAM;AAOnC,YAAQ,YAAY,OAChB,MAAM,MAAM,aAAa,MAAM,IAAI,IACnC,MAAM,MAAM,aAAa,KAAK,QAAQ;AAC1C,QAAI,UAAU;AACZ,cAAQ,KAAK,uBAAuB,OAAO,iCAAiC,QAAQ;AAAA,IACtF;AACA,UAAM,MAAM,MAAM,MAAM,MAAM,CAAC,EAAE,iBAAiB;AAClD,WAAO,CAAC,CAAC;AAAA,EACX;AAEA,QAAM,YAAY,CAChB,QACA,UACA,aACqB;AACrB,UAAM,MAAM,GAAG,MAAM,IAAI,YAAY,UAAU,IAAI,YAAY,QAAQ,CAAC;AACxE,UAAM,QAAQ,0BAA0B;AACxC,QAAI,QAAQ,GAAG;AACb,YAAM,QAAQ,cAAc,IAAI,GAAG;AACnC,UAAI,SAAS,MAAM,YAAY,KAAK,IAAI,EAAG,QAAO,QAAQ,QAAQ,MAAM,KAAK;AAAA,IAC/E;AACA,UAAM,SAAS,cAAc,IAAI,GAAG;AACpC,QAAI,OAAQ,QAAO;AACnB,UAAM,SAAS,YAAY;AACzB,UAAI;AACF,cAAM,QAAQ,MAAM,YAAY,QAAQ,UAAU,QAAQ;AAI1D,YAAI,QAAQ,EAAG,eAAc,KAAK,OAAO,KAAK;AAC9C,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,aAAK,SAAS,2BAA2B;AAAA,UACvC;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,CAAC;AACD,eAAO;AAAA,MACT;AAAA,IACF,GAAG;AACH,kBAAc,IAAI,KAAK,KAAK;AAC5B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,eAAe,YAAY,KAAK,UAAU,EAAE,WAAW,MAAM,YAAY,eAAe;AAAA,IACxF;AAAA,IACA,oBAAoB,OAAO,SAAS,UAAU,aAAa;AACzD,iBAAW,UAAU,SAAS;AAC5B,cAAM,KAAK,MAAM,UAAU,OAAO,QAAQ,UAAU,QAAQ;AAC5D,aAAK,SAAS,4BAA4B;AAAA,UACxC,QAAQ,OAAO;AAAA,UACf,gBAAgB,OAAO;AAAA,UACvB;AAAA,UACA,mBAAmB;AAAA,UACnB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,GAAI,QAAO;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6788.1.c2a1520a30";
+const APP_VERSION = "0.6.7-develop.6795.1.8a3f27921c";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6788.1.c2a1520a30';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6795.1.8a3f27921c';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6788.1.c2a1520a30",
+  "version": "0.6.7-develop.6795.1.8a3f27921c",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -102,23 +102,23 @@
     }
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.1.5",
-    "@mikro-orm/decorators": "^7.1.5",
-    "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6788.1.c2a1520a30",
+    "@mikro-orm/core": "^7.1.8",
+    "@mikro-orm/decorators": "^7.1.8",
+    "@mikro-orm/postgresql": "^7.1.8",
+    "@open-mercato/cache": "0.6.7-develop.6795.1.8a3f27921c",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",
     "rate-limiter-flexible": "^11.2.0",
     "re2js": "2.8.6",
     "reflect-metadata": "^0.2.2",
-    "sanitize-html": "^2.17.5",
-    "undici": "^8.7.0"
+    "sanitize-html": "2.17.5",
+    "undici": "^8.9.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
     "ts-morph": "^28.0.0",
     "typescript": "7.0.2"
   },

package/src/lib/auth/__tests__/organizationScope.test.ts

@@ -0,0 +1,107 @@
+/** @jest-environment node */
+
+import {
+  ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,
+  organizationScopeRequiredResponse,
+  resolveActiveOrganizationId,
+} from '../organizationScope'
+
+const accountOrgId = '22222222-2222-4222-8222-222222222222'
+const selectedOrgId = '33333333-3333-4333-8333-333333333333'
+const actorTenantId = '44444444-4444-4444-8444-444444444444'
+const foreignTenantId = '55555555-5555-4555-8555-555555555555'
+
+describe('resolveActiveOrganizationId', () => {
+  it('uses the selected organization when one is set', () => {
+    expect(
+      resolveActiveOrganizationId({ orgId: selectedOrgId, actorOrgId: accountOrgId }),
+    ).toBe(selectedOrgId)
+  })
+
+  // `orgId: null` + `actorOrgId` set is exactly the shape `applySuperAdminScope` produces for an
+  // all-organizations selection. Answering 401 for it sent `apiFetch` into a refresh loop.
+  it('falls back to the actor organization for an all-organizations selection', () => {
+    expect(
+      resolveActiveOrganizationId({ orgId: null, actorOrgId: accountOrgId }),
+    ).toBe(accountOrgId)
+  })
+
+  // `actorTenantId` is only present when the super-admin cookie override switched tenants.
+  // Selecting the actor's own tenant explicitly keeps the fallback valid.
+  it('keeps the fallback when the tenant override selects the actor tenant', () => {
+    expect(
+      resolveActiveOrganizationId({
+        orgId: null,
+        actorOrgId: accountOrgId,
+        tenantId: actorTenantId,
+        actorTenantId,
+      }),
+    ).toBe(accountOrgId)
+  })
+
+  // The reviewed blocker: tenant B + "all organizations" must not pair the actor's
+  // tenant-A organization with tenant B. No fallback — the route answers 400 instead.
+  it('refuses the fallback when the effective tenant is not the actor tenant', () => {
+    expect(
+      resolveActiveOrganizationId({
+        orgId: null,
+        actorOrgId: accountOrgId,
+        tenantId: foreignTenantId,
+        actorTenantId,
+      }),
+    ).toBeNull()
+  })
+
+  it('refuses the fallback when the tenant override cleared the tenant entirely', () => {
+    expect(
+      resolveActiveOrganizationId({
+        orgId: null,
+        actorOrgId: accountOrgId,
+        tenantId: null,
+        actorTenantId,
+      }),
+    ).toBeNull()
+    expect(
+      resolveActiveOrganizationId({
+        orgId: null,
+        actorOrgId: accountOrgId,
+        tenantId: foreignTenantId,
+        actorTenantId: null,
+      }),
+    ).toBeNull()
+  })
+
+  it('returns null when the caller has no organization at all', () => {
+    expect(resolveActiveOrganizationId({ orgId: null })).toBeNull()
+    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: null })).toBeNull()
+    expect(resolveActiveOrganizationId(null)).toBeNull()
+  })
+
+  it('ignores blank and non-string values rather than scoping to them', () => {
+    expect(resolveActiveOrganizationId({ orgId: '   ', actorOrgId: accountOrgId })).toBe(accountOrgId)
+    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: '  ' })).toBeNull()
+    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: 42 })).toBeNull()
+  })
+
+  it('still honours an explicit organization selection across tenants', () => {
+    expect(
+      resolveActiveOrganizationId({
+        orgId: selectedOrgId,
+        actorOrgId: accountOrgId,
+        tenantId: foreignTenantId,
+        actorTenantId,
+      }),
+    ).toBe(selectedOrgId)
+  })
+})
+
+describe('organizationScopeRequiredResponse', () => {
+  // 401 would send `apiFetch` back into the session-refresh loop; the scope error must not.
+  it('answers 400 with a machine-readable code', async () => {
+    const response = organizationScopeRequiredResponse()
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.code).toBe(ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE)
+    expect(typeof body.error).toBe('string')
+  })
+})

package/src/lib/auth/organizationScope.ts

@@ -0,0 +1,65 @@
+type OrganizationScopedAuth = {
+  orgId?: string | null
+  actorOrgId?: unknown
+  tenantId?: string | null
+  actorTenantId?: unknown
+} | null | undefined
+
+function normalizeId(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  return trimmed.length > 0 ? trimmed : null
+}
+
+/**
+ * Resolves the organization a request is scoped to when the caller may be viewing
+ * "all organizations".
+ *
+ * Organization-scoped configuration modules (integrations credentials/state, data sync
+ * mappings/schedules/runs) all require a non-null `organization_id`, so there is no
+ * meaningful "all organizations" view of them. When an operator selects that option the
+ * super-admin cookie override clears `auth.orgId` and preserves the actor's own
+ * organization in `actorOrgId`; fall back to it so those modules keep showing the
+ * operator's own configuration instead of failing.
+ *
+ * The fallback is only valid while the effective tenant is still the actor's own tenant.
+ * When the super-admin cookie override also switched tenants (`actorTenantId` is present
+ * and differs from `auth.tenantId`), the actor's organization belongs to another tenant —
+ * scoping to it would persist a cross-tenant `{ organizationId, tenantId }` pair. Return
+ * `null` instead and let the route answer with `organizationScopeRequiredResponse()`.
+ *
+ * Answering 401 for an unresolvable scope is not merely wrong but self-perpetuating:
+ * `apiFetch` reads 401 as an expired session and redirects through
+ * `/api/auth/session/refresh`, which succeeds and returns to the same page, reloading
+ * forever. That is why the missing-scope answer is a 400, never a 401.
+ */
+export function resolveActiveOrganizationId(auth: OrganizationScopedAuth): string | null {
+  if (!auth) return null
+  const selected = normalizeId(auth.orgId)
+  if (selected) return selected
+  const actorOrgId = normalizeId(auth.actorOrgId)
+  if (!actorOrgId) return null
+  if ('actorTenantId' in auth) {
+    const actorTenantId = normalizeId(auth.actorTenantId)
+    const effectiveTenantId = normalizeId(auth.tenantId)
+    if (!actorTenantId || actorTenantId !== effectiveTenantId) return null
+  }
+  return actorOrgId
+}
+
+export const ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE = 'organization_scope_required'
+
+/**
+ * 400 response for an authenticated caller whose organization scope cannot be resolved
+ * (e.g. a super-admin viewing a foreign tenant with "all organizations" selected).
+ * Deliberately not a 401: the session is valid, so refreshing it would loop.
+ */
+export function organizationScopeRequiredResponse(): Response {
+  return Response.json(
+    {
+      error: 'Select an organization to access this resource',
+      code: ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,
+    },
+    { status: 400 },
+  )
+}

package/src/lib/i18n/__tests__/server-dictionary-cache.test.ts

@@ -0,0 +1,30 @@
+import { loadDictionary, registerModules } from '../server'
+import type { Module } from '../../../modules/registry'
+
+describe('loadDictionary memoization', () => {
+  it('returns a cached dictionary for repeated calls with the same locale', async () => {
+    registerModules([
+      { id: 'demo', translations: { en: { 'demo.hello': 'Hello' } } },
+    ] satisfies Module[])
+
+    const first = await loadDictionary('en')
+    const second = await loadDictionary('en')
+
+    expect(second).toBe(first)
+    expect(first['demo.hello']).toBe('Hello')
+  })
+
+  it('busts the cache when the registered module set changes', async () => {
+    registerModules([{ id: 'a', translations: { en: { 'a.k': 'A' } } }] satisfies Module[])
+    const before = await loadDictionary('en')
+
+    registerModules([
+      { id: 'a', translations: { en: { 'a.k': 'A' } } },
+      { id: 'b', translations: { en: { 'b.k': 'B' } } },
+    ] satisfies Module[])
+    const after = await loadDictionary('en')
+
+    expect(after).not.toBe(before)
+    expect(after['b.k']).toBe('B')
+  })
+})

package/src/lib/query/__tests__/engine.test.ts

@@ -1,6 +1,13 @@
 import { BasicQueryEngine } from '../engine'
 import { SortDir } from '../types'
 import { registerModules } from '../../i18n/server'
+import { clearSearchTokenPresenceCache } from '../../search/availability'
+
+// The token-presence answer is cached process-wide (TTL); without clearing it,
+// probe-count assertions would observe hits from earlier tests in this file.
+beforeEach(() => {
+  clearSearchTokenPresenceCache()
+})
 
 // Mock modules with one entity extension
 const mockModules = [
@@ -355,6 +362,8 @@ describe('BasicQueryEngine (Kysely)', () => {
     const fakeDb = createFakeKysely({
       customer_entities: [],
       customer_people: [],
+      search_tokens: [{ one: 1 }],
+      'information_schema.tables': [{ table_name: 'search_tokens' }],
       'information_schema.columns': [
         { table_name: 'customer_entities', column_name: 'tenant_id' },
         { table_name: 'customer_people', column_name: 'id' },
@@ -362,8 +371,6 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
-    jest.spyOn(engine as any, 'tableExists').mockResolvedValue(true)
-    jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('customers:customer_entity', {
@@ -409,7 +416,6 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
-    jest.spyOn(engine as any, 'tableExists').mockResolvedValue(false)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('customers:customer_entity', {
@@ -445,10 +451,10 @@ describe('BasicQueryEngine (Kysely)', () => {
   test('uses search tokens for index document fields on base entities', async () => {
     const fakeDb = createFakeKysely({
       todos: [],
+      search_tokens: [{ one: 1 }],
+      'information_schema.tables': [{ table_name: 'search_tokens' }],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
-    const tableExistsSpy = jest.spyOn(engine as any, 'tableExists').mockResolvedValue(true)
-    const hasSearchTokensSpy = jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('example:todo', {
@@ -461,12 +467,15 @@ describe('BasicQueryEngine (Kysely)', () => {
       page: { page: 1, pageSize: 10 },
     })
 
-    expect(tableExistsSpy).toHaveBeenCalledWith('search_tokens')
-    expect(hasSearchTokensSpy).toHaveBeenCalledWith(
-      'example:todo',
-      't1',
-      expect.objectContaining({ ids: ['org1'] }),
-    )
+    const calls = fakeDb._calls as Array<{ _ops: { table: string; wheres: unknown[][] } }>
+    const tableProbe = calls.find((call) =>
+      call._ops.table === 'information_schema.tables' &&
+      call._ops.wheres.some((where) => where[0] === 'table_name' && where[2] === 'search_tokens'))
+    expect(tableProbe).toBeTruthy()
+    const tokenProbe = calls.find((call) =>
+      call._ops.table === 'search_tokens' &&
+      call._ops.wheres.some((where) => where[0] === 'entity_type' && where[2] === 'example:todo'))
+    expect(tokenProbe).toBeTruthy()
     expect(applySearchTokensSpy).toHaveBeenCalledWith(
       expect.anything(),
       expect.objectContaining({
@@ -488,7 +497,6 @@ describe('BasicQueryEngine (Kysely)', () => {
       ],
     })
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
-    const hasSearchTokensSpy = jest.spyOn(engine as any, 'hasSearchTokens').mockResolvedValue(true)
     const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
 
     await engine.query('example:todo', {
@@ -501,7 +509,8 @@ describe('BasicQueryEngine (Kysely)', () => {
       page: { page: 1, pageSize: 10 },
     })
 
-    expect(hasSearchTokensSpy).not.toHaveBeenCalled()
+    const calls = fakeDb._calls as Array<{ _ops: { table: string } }>
+    expect(calls.some((call) => call._ops.table === 'search_tokens')).toBe(false)
     expect(applySearchTokensSpy).not.toHaveBeenCalled()
     const baseCall = fakeDb._calls.find((builder: any) => builder._ops.table === 'todos')
     expect(baseCall?._ops.wheres).toContainEqual(['todos.search_text', 'ilike', '%avision%'])
@@ -933,4 +942,47 @@ describe('BasicQueryEngine (Kysely)', () => {
     expect(baseCall._ops.limits).toBe(10)
     expect(baseCall._ops.offsets).toBe(10)
   })
+
+  describe('search_tokens coverage probe (#4723 parity)', () => {
+    type ProbeDbLog = { _calls: Array<{ _ops: { table: string } }> }
+
+    const countProbes = (fakeDb: ProbeDbLog): number =>
+      fakeDb._calls.filter((call) => call._ops.table === 'search_tokens').length
+
+    const buildEngine = (fakeDb: unknown): BasicQueryEngine => new BasicQueryEngine(
+      {} as ConstructorParameters<typeof BasicQueryEngine>[0],
+      (() => fakeDb) as unknown as NonNullable<ConstructorParameters<typeof BasicQueryEngine>[1]>,
+    )
+
+    const buildDb = () => createFakeKysely({
+      users: [],
+      'information_schema.tables': [{ table_name: 'search_tokens' }],
+    })
+
+    test('is skipped when the query carries no like/ilike filter', async () => {
+      const fakeDb = buildDb()
+      const engine = buildEngine(fakeDb)
+
+      await engine.query('auth:user', {
+        tenantId: 't1',
+        organizationId: 'org1',
+        filters: { is_active: { $eq: true } },
+      })
+
+      expect(countProbes(fakeDb)).toBe(0)
+    })
+
+    test('still runs when the query actually searches', async () => {
+      const fakeDb = buildDb()
+      const engine = buildEngine(fakeDb)
+
+      await engine.query('auth:user', {
+        tenantId: 't1',
+        organizationId: 'org1',
+        filters: { email: { $ilike: '%abc%' } },
+      })
+
+      expect(countProbes(fakeDb)).toBeGreaterThan(0)
+    })
+  })
 })

package/src/lib/query/engine.ts

@@ -12,6 +12,13 @@ import {
   type ResolvedJoin,
 } from './join-utils'
 import { resolveSearchConfig } from '../search/config'
+import {
+  createSearchTokenAvailability,
+  isSearchFilterOp,
+  type SearchTokenAvailability,
+  type SearchTokenProbeDb,
+  type SearchTokenProbeQueryBuilder,
+} from '../search/availability'
 import { tokenizeText } from '../search/tokenize'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'
 import {
@@ -207,8 +214,8 @@ function computeCustomFieldScore(cfg: Record<string, unknown>, kind: string, ent
  */
 export class BasicQueryEngine implements QueryEngine {
   private columnCache = new Map<string, boolean>()
-  private tableCache = new Map<string, boolean>()
   private searchAliasSeq = 0
+  private searchAvailabilityInstance: SearchTokenAvailability | null = null
 
   constructor(
     private em: EntityManager,
@@ -231,6 +238,22 @@ export class BasicQueryEngine implements QueryEngine {
     throw new Error('BasicQueryEngine requires an EntityManager exposing getKysely() (MikroORM v7)')
   }
 
+  private searchAvailability(): SearchTokenAvailability {
+    if (!this.searchAvailabilityInstance) {
+      this.searchAvailabilityInstance = createSearchTokenAvailability({
+        getDb: () => this.getDb() as unknown as SearchTokenProbeDb,
+        getConfig: resolveSearchConfig,
+        applyOrganizationScope: (query, column, scope) => this.applyOrganizationScope(
+          query as unknown as AnyBuilder,
+          column,
+          scope,
+        ) as unknown as SearchTokenProbeQueryBuilder,
+        logDebug: (event, payload) => this.logSearchDebug(event, payload),
+      })
+    }
+    return this.searchAvailabilityInstance
+  }
+
   async query<T = any>(entity: EntityId, opts: QueryOptions = {}): Promise<QueryResult<T>> {
     // --- UMES query extension: before-query pipeline ---
     const ext = opts.extensions
@@ -294,17 +317,20 @@ export class BasicQueryEngine implements QueryEngine {
     const { baseFilters, joinFilters } = partitionFilters(table, normalizedFilters, joinMap)
     const cfFilters = normalizedFilters.filter((filter) => String(filter.field).startsWith('cf:'))
     const searchConfig = resolveSearchConfig()
+    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => isSearchFilterOp(filter.op))
     // Callers that opt out of automatic tenant/org scoping own the full
     // visibility predicate. Search-token filtering has its own tenant/org
     // guards, so it must be disabled on this direct-query path as documented
     // by QueryOptions.omitAutomaticTenantOrgScope.
-    const searchEnabled = !skipAutoScope && searchConfig.enabled && await this.tableExists('search_tokens')
-    const hasSearchTokens = searchEnabled
-      ? await this.hasSearchTokens(String(entity), opts.tenantId ?? null, orgScope)
+    const searchEnabled = !skipAutoScope && await this.searchAvailability().staticEnabled()
+    // Probe `search_tokens` only when this query actually searches (#4723): every consumer of
+    // `searchActive` sits behind a like/ilike guard, so on a plain list load the answer is never
+    // read — and the probe is a `LIMIT 1` the planner can resolve as a seq scan over a large
+    // `search_tokens`. The join path below already probes lazily for the same reason.
+    const hasSearchTokens = searchEnabled && searchFilters.length
+      ? await this.searchAvailability().hasTokens(String(entity), opts.tenantId ?? null, orgScope)
       : false
     const searchActive = searchEnabled && hasSearchTokens
-    const joinSearchAvailability = new Map<string, boolean>()
-    const searchFilters = [...baseFilters, ...cfFilters].filter((filter) => filter.op === 'like' || filter.op === 'ilike')
     if (searchFilters.length) {
       const fields = searchFilters.map((filter) => String(filter.field))
       this.logSearchDebug('search:init', {
@@ -358,9 +384,8 @@ export class BasicQueryEngine implements QueryEngine {
       const join = joinMap.get(alias)
       if (!join?.entityId) continue
       const hasJoinedTokens = searchEnabled
-        ? await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope)
+        ? await this.searchAvailability().hasTokens(join.entityId, opts.tenantId ?? null, orgScope)
         : false
-      joinSearchAvailability.set(join.entityId, hasJoinedTokens)
       const fallbackFields = filters
         .filter((filter) => !hasJoinedTokens || typeof filter.value !== 'string' || tokenizeText(filter.value, searchConfig).hashes.length === 0)
         .map((filter) => filter.column)
@@ -437,11 +462,7 @@ export class BasicQueryEngine implements QueryEngine {
       if (!['like', 'ilike'].includes(filter.op)) return { applied: false, builder }
       if (typeof filter.value !== 'string' || filter.value.trim().length === 0) return { applied: false, builder }
 
-      let searchAvailable = joinSearchAvailability.get(join.entityId)
-      if (searchAvailable === undefined) {
-        searchAvailable = await this.hasSearchTokens(join.entityId, opts.tenantId ?? null, orgScope)
-        joinSearchAvailability.set(join.entityId, searchAvailable)
-      }
+      const searchAvailable = await this.searchAvailability().hasTokens(join.entityId, opts.tenantId ?? null, orgScope)
       if (!searchAvailable) return { applied: false, builder }
 
       const tokens = tokenizeText(String(filter.value), searchConfig)
@@ -512,8 +533,8 @@ export class BasicQueryEngine implements QueryEngine {
     // today's complete selection (base fields + CF projections + extension joins).
     // `projection: 'sortKeys'` selects only `id` + the sort columns — the slim phase-1
     // candidate scan used when `requiresPlaintextSort`. Re-running the WHERE/JOIN logic
-    // twice is cheap: every `columnExists`/`tableExists` check is memoized on
-    // `this.columnCache`/`this.tableCache`, so the second pass hits no extra DB calls.
+    // twice is cheap: every `columnExists` check is memoized on `this.columnCache`,
+    // so the second pass hits no extra DB calls.
     const buildQuery = async (projection: 'full' | 'sortKeys'): Promise<BuiltQuery> => {
       const isSortKeysProjection = projection === 'sortKeys'
       let q: AnyBuilder = db.selectFrom(table as any)
@@ -1177,51 +1198,6 @@ export class BasicQueryEngine implements QueryEngine {
     return present
   }
 
-  private async tableExists(table: string): Promise<boolean> {
-    if (this.tableCache.has(table)) return this.tableCache.get(table) ?? false
-    const db = this.getDb()
-    const exists = await db
-      .selectFrom('information_schema.tables' as any)
-      .select(sql<number>`1`.as('one'))
-      .where('table_name' as any, '=', table)
-      .limit(1)
-      .executeTakeFirst()
-    const present = !!exists
-    this.tableCache.set(table, present)
-    return present
-  }
-
-  private async hasSearchTokens(
-    entity: string,
-    tenantId: string | null,
-    orgScope?: { ids: string[]; includeNull: boolean } | null
-  ): Promise<boolean> {
-    try {
-      const db = this.getDb()
-      let query: AnyBuilder = db
-        .selectFrom('search_tokens' as any)
-        .select(sql<number>`1`.as('one'))
-        .where('entity_type' as any, '=', entity)
-        .limit(1)
-      if (tenantId !== undefined) {
-        query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantId}`)
-      }
-      if (orgScope) {
-        query = this.applyOrganizationScope(query, 'search_tokens.organization_id', orgScope)
-      }
-      const row = await query.executeTakeFirst()
-      return !!row
-    } catch (err) {
-      this.logSearchDebug('search:has-tokens-error', {
-        entity,
-        tenantId,
-        organizationScope: orgScope,
-        error: err instanceof Error ? err.message : String(err),
-      })
-      return false
-    }
-  }
-
   private applySearchTokens(
     q: AnyBuilder,
     opts: {