@open-mercato/shared 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/lib/ai/safety-identifier.ts

@@ -1,73 +0,0 @@
-/**
- * End-user safety identifiers for AI provider calls.
- *
- * Providers such as OpenAI let developers attach an opaque per-end-user
- * identifier to each request so abuse enforcement can target one user instead
- * of suspending the whole API-key organization. We never send a reversible id:
- * the value is a tenant-salted HMAC computed from the platform's existing auth
- * secret, so no PII or internal id leaves the platform and the same end user in
- * two tenants produces two unrelated hashes.
- *
- * The per-process secret derivation mirrors `deriveJwtAudienceSecret`
- * (`@open-mercato/shared/lib/auth/jwt`): one HMAC from the base `JWT_SECRET`
- * under a versioned purpose label, memoized for the process lifetime. No new
- * secret to provision.
- *
- * @see .ai/specs/2026-06-04-ai-input-moderation-and-safety-identifiers.md
- */
-
-import crypto from 'node:crypto'
-
-const SAFETY_IDENTIFIER_SECRET_LABEL = 'open-mercato:ai-safety-identifier:v1'
-
-const derivedSecretCache = new Map<string, string>()
-
-function readBaseSecret(explicit?: string): string {
-  const secret = explicit ?? process.env.JWT_SECRET
-  if (!secret) {
-    throw new Error('[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret')
-  }
-  return secret
-}
-
-/**
- * Derive the per-process safety-identifier HMAC key from the base auth secret.
- *
- * Deterministic HMAC-SHA256 of a versioned purpose label keyed by the base
- * secret, memoized per base secret. Rotating the base secret rotates every
- * derived identifier — documented as accepted (identifiers are advisory
- * provider-side metadata, not an in-platform security control).
- */
-export function deriveAiSafetyIdentifierSecret(baseSecret?: string): string {
-  const base = readBaseSecret(baseSecret)
-  const cached = derivedSecretCache.get(base)
-  if (cached !== undefined) return cached
-  const derived = crypto
-    .createHmac('sha256', base)
-    .update(SAFETY_IDENTIFIER_SECRET_LABEL)
-    .digest('hex')
-  derivedSecretCache.set(base, derived)
-  return derived
-}
-
-/**
- * Compute the opaque end-user safety identifier for a (tenant, user) pair.
- *
- * Returns a 64-char lowercase hex HMAC-SHA256 of `${tenantId}:${userId}` keyed
- * by the derived secret. Throws (with an `[internal]` message) when the base
- * secret is missing or `userId` is empty — callers in the runtime wrap this in
- * a best-effort try/catch so identifier-derivation failures never break chat.
- */
-export function computeEndUserIdentifier(
-  tenantId: string | null | undefined,
-  userId: string,
-  options?: { baseSecret?: string },
-): string {
-  const normalizedUser = (userId ?? '').trim()
-  if (!normalizedUser) {
-    throw new Error('[internal] computeEndUserIdentifier requires a non-empty userId')
-  }
-  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret)
-  const salt = (tenantId ?? '').trim()
-  return crypto.createHmac('sha256', key).update(`${salt}:${normalizedUser}`).digest('hex')
-}

package/src/lib/auth/__tests__/organizationScope.test.ts

@@ -1,107 +0,0 @@
-/** @jest-environment node */
-
-import {
-  ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,
-  organizationScopeRequiredResponse,
-  resolveActiveOrganizationId,
-} from '../organizationScope'
-
-const accountOrgId = '22222222-2222-4222-8222-222222222222'
-const selectedOrgId = '33333333-3333-4333-8333-333333333333'
-const actorTenantId = '44444444-4444-4444-8444-444444444444'
-const foreignTenantId = '55555555-5555-4555-8555-555555555555'
-
-describe('resolveActiveOrganizationId', () => {
-  it('uses the selected organization when one is set', () => {
-    expect(
-      resolveActiveOrganizationId({ orgId: selectedOrgId, actorOrgId: accountOrgId }),
-    ).toBe(selectedOrgId)
-  })
-
-  // `orgId: null` + `actorOrgId` set is exactly the shape `applySuperAdminScope` produces for an
-  // all-organizations selection. Answering 401 for it sent `apiFetch` into a refresh loop.
-  it('falls back to the actor organization for an all-organizations selection', () => {
-    expect(
-      resolveActiveOrganizationId({ orgId: null, actorOrgId: accountOrgId }),
-    ).toBe(accountOrgId)
-  })
-
-  // `actorTenantId` is only present when the super-admin cookie override switched tenants.
-  // Selecting the actor's own tenant explicitly keeps the fallback valid.
-  it('keeps the fallback when the tenant override selects the actor tenant', () => {
-    expect(
-      resolveActiveOrganizationId({
-        orgId: null,
-        actorOrgId: accountOrgId,
-        tenantId: actorTenantId,
-        actorTenantId,
-      }),
-    ).toBe(accountOrgId)
-  })
-
-  // The reviewed blocker: tenant B + "all organizations" must not pair the actor's
-  // tenant-A organization with tenant B. No fallback — the route answers 400 instead.
-  it('refuses the fallback when the effective tenant is not the actor tenant', () => {
-    expect(
-      resolveActiveOrganizationId({
-        orgId: null,
-        actorOrgId: accountOrgId,
-        tenantId: foreignTenantId,
-        actorTenantId,
-      }),
-    ).toBeNull()
-  })
-
-  it('refuses the fallback when the tenant override cleared the tenant entirely', () => {
-    expect(
-      resolveActiveOrganizationId({
-        orgId: null,
-        actorOrgId: accountOrgId,
-        tenantId: null,
-        actorTenantId,
-      }),
-    ).toBeNull()
-    expect(
-      resolveActiveOrganizationId({
-        orgId: null,
-        actorOrgId: accountOrgId,
-        tenantId: foreignTenantId,
-        actorTenantId: null,
-      }),
-    ).toBeNull()
-  })
-
-  it('returns null when the caller has no organization at all', () => {
-    expect(resolveActiveOrganizationId({ orgId: null })).toBeNull()
-    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: null })).toBeNull()
-    expect(resolveActiveOrganizationId(null)).toBeNull()
-  })
-
-  it('ignores blank and non-string values rather than scoping to them', () => {
-    expect(resolveActiveOrganizationId({ orgId: '   ', actorOrgId: accountOrgId })).toBe(accountOrgId)
-    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: '  ' })).toBeNull()
-    expect(resolveActiveOrganizationId({ orgId: null, actorOrgId: 42 })).toBeNull()
-  })
-
-  it('still honours an explicit organization selection across tenants', () => {
-    expect(
-      resolveActiveOrganizationId({
-        orgId: selectedOrgId,
-        actorOrgId: accountOrgId,
-        tenantId: foreignTenantId,
-        actorTenantId,
-      }),
-    ).toBe(selectedOrgId)
-  })
-})
-
-describe('organizationScopeRequiredResponse', () => {
-  // 401 would send `apiFetch` back into the session-refresh loop; the scope error must not.
-  it('answers 400 with a machine-readable code', async () => {
-    const response = organizationScopeRequiredResponse()
-    expect(response.status).toBe(400)
-    const body = await response.json()
-    expect(body.code).toBe(ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE)
-    expect(typeof body.error).toBe('string')
-  })
-})

package/src/lib/auth/organizationScope.ts

@@ -1,65 +0,0 @@
-type OrganizationScopedAuth = {
-  orgId?: string | null
-  actorOrgId?: unknown
-  tenantId?: string | null
-  actorTenantId?: unknown
-} | null | undefined
-
-function normalizeId(value: unknown): string | null {
-  if (typeof value !== 'string') return null
-  const trimmed = value.trim()
-  return trimmed.length > 0 ? trimmed : null
-}
-
-/**
- * Resolves the organization a request is scoped to when the caller may be viewing
- * "all organizations".
- *
- * Organization-scoped configuration modules (integrations credentials/state, data sync
- * mappings/schedules/runs) all require a non-null `organization_id`, so there is no
- * meaningful "all organizations" view of them. When an operator selects that option the
- * super-admin cookie override clears `auth.orgId` and preserves the actor's own
- * organization in `actorOrgId`; fall back to it so those modules keep showing the
- * operator's own configuration instead of failing.
- *
- * The fallback is only valid while the effective tenant is still the actor's own tenant.
- * When the super-admin cookie override also switched tenants (`actorTenantId` is present
- * and differs from `auth.tenantId`), the actor's organization belongs to another tenant —
- * scoping to it would persist a cross-tenant `{ organizationId, tenantId }` pair. Return
- * `null` instead and let the route answer with `organizationScopeRequiredResponse()`.
- *
- * Answering 401 for an unresolvable scope is not merely wrong but self-perpetuating:
- * `apiFetch` reads 401 as an expired session and redirects through
- * `/api/auth/session/refresh`, which succeeds and returns to the same page, reloading
- * forever. That is why the missing-scope answer is a 400, never a 401.
- */
-export function resolveActiveOrganizationId(auth: OrganizationScopedAuth): string | null {
-  if (!auth) return null
-  const selected = normalizeId(auth.orgId)
-  if (selected) return selected
-  const actorOrgId = normalizeId(auth.actorOrgId)
-  if (!actorOrgId) return null
-  if ('actorTenantId' in auth) {
-    const actorTenantId = normalizeId(auth.actorTenantId)
-    const effectiveTenantId = normalizeId(auth.tenantId)
-    if (!actorTenantId || actorTenantId !== effectiveTenantId) return null
-  }
-  return actorOrgId
-}
-
-export const ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE = 'organization_scope_required'
-
-/**
- * 400 response for an authenticated caller whose organization scope cannot be resolved
- * (e.g. a super-admin viewing a foreign tenant with "all organizations" selected).
- * Deliberately not a 401: the session is valid, so refreshing it would loop.
- */
-export function organizationScopeRequiredResponse(): Response {
-  return Response.json(
-    {
-      error: 'Select an organization to access this resource',
-      code: ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE,
-    },
-    { status: 400 },
-  )
-}

package/src/lib/bootstrap/__tests__/clientOnlyModules.test.ts

@@ -1,189 +0,0 @@
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-import {
-  createClientOnlyStubPlugin,
-  encodeJsStringLiteral,
-  isClientOnlyModulePath,
-  renderClientOnlyModuleStub,
-} from '../clientOnlyModules'
-import { createCliBundlePlugins } from '../dynamicLoader'
-
-const CHART_IMPORT = '@open-mercato/ui/backend/charts'
-
-function createServerHelperFixture(tempDir: string): string {
-  const moduleDir = path.join(tempDir, 'src', 'modules', 'demo')
-  fs.mkdirSync(moduleDir, { recursive: true })
-
-  fs.writeFileSync(
-    path.join(moduleDir, 'http.client.ts'),
-    ['export const httpClient = { fetchOrders: async () => [] }', ''].join('\n'),
-  )
-
-  const entry = path.join(tempDir, 'modules.cli.generated.ts')
-  fs.writeFileSync(
-    entry,
-    [
-      "import { httpClient } from './src/modules/demo/http.client'",
-      'export const modules = [{',
-      "  id: 'demo',",
-      '  workers: [{ handler: () => httpClient.fetchOrders() }],',
-      '}]',
-      '',
-    ].join('\n'),
-  )
-
-  return entry
-}
-
-function createAppModuleFixture(tempDir: string): string {
-  const widgetDir = path.join(tempDir, 'src', 'modules', 'demo', 'widgets', 'dashboard', 'sales')
-  fs.mkdirSync(widgetDir, { recursive: true })
-
-  fs.writeFileSync(
-    path.join(widgetDir, 'widget.client.tsx'),
-    [
-      '"use client"',
-      `import { BarChart } from '${CHART_IMPORT}'`,
-      'export default function DemoWidget() { return BarChart }',
-      '',
-    ].join('\n'),
-  )
-
-  const entry = path.join(tempDir, 'modules.cli.generated.ts')
-  fs.writeFileSync(
-    entry,
-    [
-      'export const modules = [{',
-      "  id: 'demo',",
-      '  dashboardWidgets: [{',
-      "    moduleId: 'demo',",
-      "    key: 'demo:sales:widget',",
-      "    loader: () => import('./src/modules/demo/widgets/dashboard/sales/widget.client').then((mod) => mod.default ?? mod),",
-      '  }],',
-      '}]',
-      '',
-    ].join('\n'),
-  )
-
-  return entry
-}
-
-async function bundle(entry: string, outfile: string, withStubPlugin: boolean): Promise<string> {
-  const esbuild = await import('esbuild')
-  await esbuild.build({
-    entryPoints: [entry],
-    outfile,
-    bundle: true,
-    format: 'esm',
-    platform: 'node',
-    target: 'node18',
-    external: ['@open-mercato/*'],
-    plugins: withStubPlugin ? [createClientOnlyStubPlugin()] : [],
-  })
-  return fs.readFileSync(outfile, 'utf8')
-}
-
-describe('isClientOnlyModulePath', () => {
-  it('matches local client modules with and without an extension', () => {
-    expect(isClientOnlyModulePath('./widget.client')).toBe(true)
-    expect(isClientOnlyModulePath('./widget.client.tsx')).toBe(true)
-    expect(isClientOnlyModulePath('../dashboard/sales/widget.client.ts')).toBe(true)
-    expect(isClientOnlyModulePath('@/modules/demo/widgets/dashboard/sales/widget.client')).toBe(true)
-    expect(isClientOnlyModulePath('./notifications.client.ts')).toBe(true)
-  })
-
-  it('leaves bare package specifiers to the external-import plugin', () => {
-    expect(isClientOnlyModulePath('@open-mercato/ui/backend/charts')).toBe(false)
-    expect(isClientOnlyModulePath('@open-mercato/core/modules/demo/widget.client')).toBe(false)
-    expect(isClientOnlyModulePath('react')).toBe(false)
-  })
-
-  it('does not match server modules that merely mention client', () => {
-    expect(isClientOnlyModulePath('./widget.ts')).toBe(false)
-    expect(isClientOnlyModulePath('./clientFactory.ts')).toBe(false)
-    expect(isClientOnlyModulePath('./client/index.ts')).toBe(false)
-  })
-
-  it('does not match the generated notification-renderer registry', () => {
-    expect(isClientOnlyModulePath('@/.mercato/generated/notifications.client.generated')).toBe(false)
-    expect(isClientOnlyModulePath('@/.mercato/generated/notifications.client.generated.ts')).toBe(false)
-  })
-})
-
-describe('encodeJsStringLiteral', () => {
-  it('escapes quotes and backslashes so the literal cannot be terminated early', () => {
-    expect(encodeJsStringLiteral('say "hi"')).toBe('"say \\"hi\\""')
-    expect(encodeJsStringLiteral('a\\b')).toBe('"a\\\\b"')
-  })
-
-  it('escapes every character outside printable ASCII, including the separators JSON leaves raw', () => {
-    expect(encodeJsStringLiteral('a\u2028b')).toBe('"a\\u2028b"')
-    expect(encodeJsStringLiteral('a\u2029b')).toBe('"a\\u2029b"')
-    expect(encodeJsStringLiteral('a\nb')).toBe('"a\\u000ab"')
-  })
-
-  it('leaves no unescaped delimiter that could break out of the literal', () => {
-    const hostile = './widget.client"); globalThis.pwned = true; ("'
-    const encoded = encodeJsStringLiteral(hostile)
-
-    expect(encoded.startsWith('"')).toBe(true)
-    expect(encoded.endsWith('"')).toBe(true)
-    expect(encoded.slice(1, -1)).not.toMatch(/(^|[^\\])"/)
-    expect(JSON.parse(encoded)).toBe(hostile)
-  })
-})
-
-describe('renderClientOnlyModuleStub', () => {
-  it('exports a default that throws when the browser component is actually used', () => {
-    const stub = renderClientOnlyModuleStub('./widget.client')
-    expect(stub).toContain('export default clientOnlyModuleUnavailable')
-    expect(stub).toContain('./widget.client')
-  })
-})
-
-describe('createCliBundlePlugins', () => {
-  it('registers the client-only stub ahead of the alias and external plugins', () => {
-    expect(createCliBundlePlugins('/tmp/app-root').map((plugin) => plugin.name)).toEqual([
-      'client-only-stub',
-      'alias-resolver',
-      'external-non-json',
-    ])
-  })
-})
-
-describe('CLI bundle graph', () => {
-  let tempDir: string
-
-  beforeEach(() => {
-    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'open-mercato-client-only-'))
-  })
-
-  afterEach(() => {
-    fs.rmSync(tempDir, { recursive: true, force: true })
-  })
-
-  it('keeps browser-only widget imports out of the CLI bundle', async () => {
-    const entry = createAppModuleFixture(tempDir)
-    const output = await bundle(entry, path.join(tempDir, 'stubbed.mjs'), true)
-
-    expect(output).not.toContain(CHART_IMPORT)
-    expect(output).toContain('clientOnlyModuleUnavailable')
-  })
-
-  it('without the plugin the same fixture hoists the browser-only import (regression guard)', async () => {
-    const entry = createAppModuleFixture(tempDir)
-    const output = await bundle(entry, path.join(tempDir, 'plain.mjs'), false)
-
-    expect(output).toContain(CHART_IMPORT)
-  })
-
-  it('leaves statically imported server helpers alone even when they are named *.client', async () => {
-    const entry = createServerHelperFixture(tempDir)
-    const output = await bundle(entry, path.join(tempDir, 'server-helper.mjs'), true)
-
-    expect(output).toContain('fetchOrders')
-    expect(output).not.toContain('clientOnlyModuleUnavailable')
-  })
-})

package/src/lib/bootstrap/__tests__/dynamicLoader.aliasResolver.test.ts

@@ -1,98 +0,0 @@
-/**
- * @jest-environment node
- *
- * The CLI bundle's `@/` alias must mirror what the app tsconfig maps, because the dynamic
- * bootstrap path compiles app sources (`src/di.ts`) and generated registries that import app
- * modules through the alias. The tsconfig maps `@/.mercato/*` to the app root and every other
- * `@/*` to the app's `src/` directory; resolving everything against the app root silently sends
- * `@/lib/x` to a path that does not exist.
- */
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-import { createCliBundlePlugins } from '../dynamicLoader'
-
-async function bundleWithCliPlugins(appRoot: string, entry: string): Promise<string> {
-  const esbuild = await import('esbuild')
-  const outfile = path.join(appRoot, 'bundle.mjs')
-  await esbuild.build({
-    entryPoints: [entry],
-    outfile,
-    absWorkingDir: appRoot,
-    bundle: true,
-    format: 'esm',
-    platform: 'node',
-    target: 'node18',
-    plugins: createCliBundlePlugins(appRoot),
-  })
-  return fs.readFileSync(outfile, 'utf8')
-}
-
-describe('createCliBundlePlugins — @/ alias resolution', () => {
-  let appRoot: string
-
-  beforeEach(() => {
-    appRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'om-alias-resolver-'))
-    fs.mkdirSync(path.join(appRoot, 'src', 'lib'), { recursive: true })
-    fs.mkdirSync(path.join(appRoot, 'src', 'modules', 'demo'), { recursive: true })
-    fs.mkdirSync(path.join(appRoot, '.mercato', 'generated'), { recursive: true })
-
-    fs.writeFileSync(
-      path.join(appRoot, 'src', 'lib', 'marker.ts'),
-      "export const srcLibMarker = 'resolved-from-src-lib'\n",
-    )
-    fs.writeFileSync(
-      path.join(appRoot, 'src', 'modules', 'demo', 'index.ts'),
-      "export const srcModuleMarker = 'resolved-from-src-module-index'\n",
-    )
-    fs.writeFileSync(
-      path.join(appRoot, '.mercato', 'generated', 'registry.generated.ts'),
-      "export const generatedMarker = 'resolved-from-generated'\n",
-    )
-  })
-
-  afterEach(() => {
-    fs.rmSync(appRoot, { recursive: true, force: true })
-  })
-
-  it('resolves @/* against the app src directory and @/.mercato/* against the app root', async () => {
-    const entry = path.join(appRoot, '.mercato', 'generated', 'entry.ts')
-    fs.writeFileSync(
-      entry,
-      [
-        "import { srcLibMarker } from '@/lib/marker'",
-        "import { srcModuleMarker } from '@/modules/demo'",
-        "import { generatedMarker } from '@/.mercato/generated/registry.generated'",
-        'export const markers = [srcLibMarker, srcModuleMarker, generatedMarker]',
-        '',
-      ].join('\n'),
-    )
-
-    const output = await bundleWithCliPlugins(appRoot, entry)
-
-    expect(output).toContain('resolved-from-src-lib')
-    expect(output).toContain('resolved-from-src-module-index')
-    expect(output).toContain('resolved-from-generated')
-  })
-
-  it('prefers an app-root match when the specifier has no src counterpart', async () => {
-    fs.writeFileSync(
-      path.join(appRoot, 'root-only.ts'),
-      "export const rootOnlyMarker = 'resolved-from-app-root'\n",
-    )
-    const entry = path.join(appRoot, '.mercato', 'generated', 'entry.ts')
-    fs.writeFileSync(
-      entry,
-      [
-        "import { rootOnlyMarker } from '@/root-only'",
-        'export const markers = [rootOnlyMarker]',
-        '',
-      ].join('\n'),
-    )
-
-    const output = await bundleWithCliPlugins(appRoot, entry)
-
-    expect(output).toContain('resolved-from-app-root')
-  })
-})