@open-mercato/shared 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/lib/di/__tests__/container-app-di.test.ts

@@ -0,0 +1,173 @@
+// Tests for the app-level DI override hook (`src/di.ts` → `@/di`) in
+// `createRequestContainer()`. The hook used to swallow EVERY failure with
+// bare `catch {}` blocks, so a src/di.ts whose register() threw — or a @/di
+// module that failed to load for any reason other than being absent — was
+// skipped without a trace and the documented override point silently did
+// nothing. Absence of the optional module must stay quiet; real failures
+// must be logged.
+
+import { asValue } from 'awilix'
+
+jest.mock(
+  '@open-mercato/shared/lib/db/mikro',
+  () => {
+    const baseEm: any = {
+      fork: () => baseEm,
+      getRepository: () => ({ find: async () => [], findOne: async () => null }),
+    }
+    return {
+      __esModule: true,
+      getOrm: async () => ({ em: baseEm }),
+      getOrmEntities: () => [],
+      registerOrmEntities: () => {},
+    }
+  },
+  { virtual: false },
+)
+
+jest.mock(
+  '@mikro-orm/core',
+  () => ({
+    __esModule: true,
+    RequestContext: { getEntityManager: () => null },
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/query/engine',
+  () => ({ __esModule: true, BasicQueryEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/data/engine',
+  () => ({ __esModule: true, DefaultDataEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/commands',
+  () => ({
+    __esModule: true,
+    commandRegistry: {},
+    CommandBus: class { constructor() {} },
+  }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/modules/overrides',
+  () => ({
+    __esModule: true,
+    applyDiOverridesToContainer: () => {},
+  }),
+  { virtual: false },
+)
+
+// Keep this suite hermetic: without this mock the REAL core bootstrap module
+// loads (and runs its module-level side effects) whenever generated files
+// exist on disk, polluting globalThis state shared with sibling test files.
+jest.mock(
+  '@open-mercato/core/bootstrap',
+  () => ({
+    __esModule: true,
+    bootstrap: async () => {},
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/encryption/subscriber',
+  () => ({
+    __esModule: true,
+    registerTenantEncryptionSubscriber: () => {},
+  }),
+  { virtual: true },
+)
+
+const mockWarn = jest.fn()
+jest.mock('../../logger', () => ({
+  createLogger: () => ({
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: (...args: unknown[]) => mockWarn(...args),
+    error: jest.fn(),
+    child() { return this },
+  }),
+}))
+
+const mockAppDiRegister = jest.fn()
+jest.mock(
+  '@/di',
+  () => ({
+    __esModule: true,
+    register: (...args: unknown[]) => mockAppDiRegister(...args),
+  }),
+  { virtual: true },
+)
+
+const {
+  createRequestContainer,
+  registerAppDiRegistrar,
+  registerDiRegistrars,
+  resetBootstrapCache,
+} = require('@open-mercato/shared/lib/di/container')
+
+describe('app-level DI override hook (@/di)', () => {
+  beforeEach(() => {
+    resetBootstrapCache()
+    registerAppDiRegistrar(null)
+    registerDiRegistrars([])
+    mockWarn.mockClear()
+    mockAppDiRegister.mockReset()
+  })
+
+  it('calls register() with the request container and applies its registrations', async () => {
+    mockAppDiRegister.mockImplementation((container: any) => {
+      container.register({ appOverrideProbe: asValue('from-app-di') })
+    })
+    const container = await createRequestContainer()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(1)
+    expect(mockAppDiRegister).toHaveBeenCalledWith(container)
+    expect(container.resolve('appOverrideProbe')).toBe('from-app-di')
+    expect(mockWarn).not.toHaveBeenCalled()
+  })
+
+  it('awaits an async register()', async () => {
+    mockAppDiRegister.mockImplementation(async (container: any) => {
+      await Promise.resolve()
+      container.register({ appOverrideProbe: asValue('async-app-di') })
+    })
+    const container = await createRequestContainer()
+    expect(container.resolve('appOverrideProbe')).toBe('async-app-di')
+    expect(mockWarn).not.toHaveBeenCalled()
+  })
+
+  it('warns instead of silently swallowing when register() throws', async () => {
+    mockAppDiRegister.mockImplementation(() => {
+      throw new Error('boom from app di')
+    })
+    const firstContainer = await createRequestContainer()
+    const secondContainer = await createRequestContainer()
+    expect(firstContainer).toBeDefined()
+    expect(secondContainer).toBeDefined()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(2)
+    expect(mockWarn).toHaveBeenCalledTimes(1)
+    const [message, fields] = mockWarn.mock.calls[0]
+    expect(String(message)).toContain('register()')
+    expect((fields as { err: Error }).err.message).toBe('boom from app di')
+  })
+
+  it('warns when an async register() rejects', async () => {
+    mockAppDiRegister.mockImplementation(async () => {
+      throw new Error('async boom from app di')
+    })
+    const firstContainer = await createRequestContainer()
+    const secondContainer = await createRequestContainer()
+    expect(firstContainer).toBeDefined()
+    expect(secondContainer).toBeDefined()
+    expect(mockAppDiRegister).toHaveBeenCalledTimes(2)
+    expect(mockWarn).toHaveBeenCalledTimes(1)
+  })
+})

package/src/lib/di/__tests__/registrar-error-log.test.ts

@@ -0,0 +1,154 @@
+// A module DI registrar that throws is skipped fail-open (one broken module
+// must not take down every request container), but the failure MUST be logged —
+// a silent catch leaves the module's services missing with no trace until an
+// unrelated Awilix resolution error surfaces much later.
+
+import { asValue } from 'awilix'
+import type { AwilixContainer } from 'awilix'
+
+const mockLoggerError = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/logger', () => {
+  const makeLogger = (): Record<string, unknown> => ({
+    error: (...args: unknown[]) => mockLoggerError(...args),
+    warn: jest.fn(),
+    info: jest.fn(),
+    debug: jest.fn(),
+    trace: jest.fn(),
+    child: () => makeLogger(),
+  })
+  return {
+    __esModule: true,
+    createLogger: () => makeLogger(),
+    getLogLevel: () => 'info',
+    isLevelEnabled: () => false,
+  }
+})
+
+jest.mock(
+  '@open-mercato/shared/lib/db/mikro',
+  () => {
+    const baseEm: any = {
+      fork: () => baseEm,
+      getRepository: () => ({ find: async () => [], findOne: async () => null }),
+    }
+    return {
+      __esModule: true,
+      getOrm: async () => ({ em: baseEm }),
+      getOrmEntities: () => [],
+      registerOrmEntities: () => {},
+    }
+  },
+  { virtual: false },
+)
+
+jest.mock(
+  '@mikro-orm/core',
+  () => ({
+    __esModule: true,
+    RequestContext: { getEntityManager: () => null },
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/query/engine',
+  () => ({ __esModule: true, BasicQueryEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/data/engine',
+  () => ({ __esModule: true, DefaultDataEngine: class {} }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/commands',
+  () => ({
+    __esModule: true,
+    commandRegistry: {},
+    CommandBus: class { constructor() {} },
+  }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/shared/modules/overrides',
+  () => ({
+    __esModule: true,
+    applyDiOverridesToContainer: () => {},
+    applyModuleOverridesToModules: (modules: unknown[]) => modules,
+    applyComponentOverridesToEntries: (entries: unknown[]) => entries,
+  }),
+  { virtual: false },
+)
+
+jest.mock(
+  '@open-mercato/core/bootstrap',
+  () => ({
+    __esModule: true,
+    bootstrap: async () => {},
+  }),
+  { virtual: true },
+)
+
+jest.mock(
+  '@open-mercato/shared/lib/encryption/subscriber',
+  () => ({
+    __esModule: true,
+    registerTenantEncryptionSubscriber: () => {},
+  }),
+  { virtual: true },
+)
+
+const {
+  createRequestContainer,
+  registerAppDiRegistrar,
+  registerDiRegistrars,
+  resetBootstrapCache,
+} = require('@open-mercato/shared/lib/di/container')
+
+describe('createRequestContainer — module DI registrar failures', () => {
+  beforeEach(() => {
+    resetBootstrapCache()
+    registerAppDiRegistrar(null)
+    mockLoggerError.mockClear()
+  })
+
+  afterAll(() => {
+    registerDiRegistrars([])
+  })
+
+  it('logs the error and continues with the remaining registrars', async () => {
+    const boom = new Error('di exploded')
+    const workingRegistrar = jest.fn((container: AwilixContainer) => {
+      container.register({ registrarProbeService: asValue('registered') })
+    })
+    registerDiRegistrars([
+      () => { throw boom },
+      workingRegistrar,
+    ])
+
+    const container = await createRequestContainer()
+
+    expect(workingRegistrar).toHaveBeenCalledTimes(1)
+    expect(container.resolve('registrarProbeService')).toBe('registered')
+    expect(mockLoggerError).toHaveBeenCalledWith('Module DI registrar failed', {
+      registrarIndex: 0,
+      err: boom,
+    })
+  })
+
+  it('does not log when every registrar succeeds', async () => {
+    registerDiRegistrars([
+      (container: AwilixContainer) => {
+        container.register({ registrarProbeService: asValue('ok') })
+      },
+    ])
+
+    await createRequestContainer()
+
+    expect(mockLoggerError).not.toHaveBeenCalled()
+  })
+})

package/src/lib/di/container.ts

@@ -24,6 +24,13 @@ export type AppDiRegistrar = (container: AppContainer) => void | Promise<void>
 // file can be loaded as multiple module instances when mixing dynamic and static imports
 const GLOBAL_KEY = '__openMercatoDiRegistrars__'
 const APP_DI_REGISTRAR_KEY = '__openMercatoAppDiRegistrar__'
+const APP_DI_LOAD_WARNING_KEY = '__openMercatoAppDiLoadWarningEmitted__'
+const APP_DI_REGISTER_WARNING_KEY = '__openMercatoAppDiRegisterWarningEmitted__'
+// Set once the legacy `@/di` fallback proves the specifier is unresolvable in this process.
+// Worker/CLI processes run against built package output where the app's `@/` alias does not
+// exist, so retrying the import per request container only repeats a failed module resolution
+// (and its log line) once per job.
+const APP_DI_MODULE_UNRESOLVABLE_KEY = '__openMercatoAppDiModuleUnresolvable__'
 // Phase 5 — process-scoped bootstrap cache. The cache/event-bus/encryption
 // services bootstrap() creates are inherently process-scoped (they hold
 // state across requests). Caching them on globalThis after the first
@@ -118,6 +125,9 @@ export function registerDiRegistrars(registrars: DiRegistrar[]) {
   // Force re-bootstrap on HMR — module subscribers may have changed.
   ;(globalThis as any)[BOOTSTRAP_CACHE_KEY] = null
   ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined
+  // An app that gains a src/di.ts mid-session reloads through here, so the negative
+  // resolution result must not outlive the reload.
+  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined
 }
 
 export function getDiRegistrars(): DiRegistrar[] {
@@ -137,10 +147,44 @@ export function registerAppDiRegistrar(registrar: AppDiRegistrar | null): void {
   ;(globalThis as Record<string, unknown>)[APP_DI_REGISTRAR_KEY] = registrar
 }
 
-/** Test-only helper to drop the process-scoped bootstrap cache. */
+/** Test-only helper to drop process-scoped request-container state. */
 export function resetBootstrapCache(): void {
   (globalThis as any)[BOOTSTRAP_CACHE_KEY] = null
   ;(globalThis as any)[ENCRYPTION_ENABLED_KEY] = undefined
+  ;(globalThis as Record<string, unknown>)[APP_DI_LOAD_WARNING_KEY] = undefined
+  ;(globalThis as Record<string, unknown>)[APP_DI_REGISTER_WARNING_KEY] = undefined
+  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = undefined
+}
+
+function isAppDiModuleUnresolvable(): boolean {
+  return (globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] === true
+}
+
+function markAppDiModuleUnresolvable(): void {
+  ;(globalThis as Record<string, unknown>)[APP_DI_MODULE_UNRESOLVABLE_KEY] = true
+}
+
+function isAppDiModuleNotFound(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false
+  const { code, message } = error as { code?: unknown; message?: unknown }
+  const text = typeof message === 'string' ? message : ''
+  const moduleNotFound =
+    code === 'MODULE_NOT_FOUND'
+    || code === 'ERR_MODULE_NOT_FOUND'
+    || text.startsWith('Cannot find module')
+    || text.startsWith('Cannot find package')
+  return moduleNotFound && /(?:module|package) ['"]@\/di['"]/.test(text)
+}
+
+function warnAppDiFailureOnce(
+  key: typeof APP_DI_LOAD_WARNING_KEY | typeof APP_DI_REGISTER_WARNING_KEY,
+  message: string,
+  error: unknown,
+): void {
+  const globalScope = globalThis as Record<string, unknown>
+  if (globalScope[key] === true) return
+  globalScope[key] = true
+  logger.warn(message, { err: error })
 }
 
 function isAwilixResolver(value: unknown): value is Resolver<unknown> {
@@ -197,9 +241,14 @@ export async function createRequestContainer(): Promise<AppContainer> {
       createCommandOptimisticLockGuardService(),
     ).scoped(),
   })
-  // Allow modules to override/extend
-  for (const reg of diRegistrars) {
-    try { reg?.(container) } catch {}
+  // Allow modules to override/extend. Fail-open by design (one broken module's
+  // di.ts must not take down every request container), but never silently: the
+  // module's services would otherwise vanish with no trace until an unrelated
+  // Awilix resolution error surfaces much later.
+  for (const [registrarIndex, reg] of diRegistrars.entries()) {
+    try { reg?.(container) } catch (error) {
+      logger.error('Module DI registrar failed', { registrarIndex, err: error })
+    }
   }
   // Core bootstrap (cache, event bus, encryption subscriber/KMS, module subscribers)
   // Phase 5 — process-scoped once-guard. The first request runs the full
@@ -235,7 +284,7 @@ export async function createRequestContainer(): Promise<AppContainer> {
     } catch (error) {
       logger.error('App-level DI registrar failed', { err: error })
     }
-  } else {
+  } else if (!isAppDiModuleUnresolvable()) {
     // Backward-compatible fallback for apps that have not adopted explicit wiring.
     try {
       // @ts-ignore - @/di only exists in app context, not in packages
@@ -244,11 +293,26 @@ export async function createRequestContainer(): Promise<AppContainer> {
         try {
           const maybe = appDi.register(container)
           if (maybe && typeof maybe.then === 'function') await maybe
-        } catch (error) {
-          logger.error('App-level DI registrar failed', { err: error })
+        } catch (err) {
+          warnAppDiFailureOnce(
+            APP_DI_REGISTER_WARNING_KEY,
+            'App-level DI override (src/di.ts register()) threw; its registrations are skipped',
+            err,
+          )
         }
       }
-    } catch {}
+    } catch (err) {
+      if (isAppDiModuleNotFound(err)) {
+        markAppDiModuleUnresolvable()
+        logger.debug('App-level DI override module (@/di) not resolvable; skipping', { err })
+      } else {
+        warnAppDiFailureOnce(
+          APP_DI_LOAD_WARNING_KEY,
+          'App-level DI override module (@/di) failed to load; its registrations are skipped',
+          err,
+        )
+      }
+    }
   }
   applyDiOverridesToContainer({
     register: (registrations) => container.register(toAwilixRegistrations(registrations)),

package/src/lib/email/__tests__/send.test.ts

@@ -1,4 +1,7 @@
 import React from 'react'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
 import { sendEmail } from '../send'
 
 var sendMock: jest.Mock
@@ -15,6 +18,7 @@ jest.mock('resend', () => {
 
 describe('sendEmail', () => {
   const originalEnv = process.env
+  let tempDir: string | null = null
 
   beforeEach(() => {
     process.env = {
@@ -26,7 +30,11 @@ describe('sendEmail', () => {
     ResendMock.mockClear()
   })
 
-  afterEach(() => {
+  afterEach(async () => {
+    if (tempDir) {
+      await rm(tempDir, { recursive: true, force: true })
+      tempDir = null
+    }
     process.env = originalEnv
   })
 
@@ -158,4 +166,32 @@ describe('sendEmail', () => {
     expect(ResendMock).not.toHaveBeenCalled()
     expect(sendMock).not.toHaveBeenCalled()
   })
+
+  it('captures email links in OM_TEST_MODE without external delivery', async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'om-email-capture-'))
+    const capturePath = join(tempDir, 'emails.jsonl')
+    process.env.OM_TEST_MODE = '1'
+    process.env.OM_TEST_EMAIL_CAPTURE_PATH = capturePath
+    delete process.env.RESEND_API_KEY
+
+    await sendEmail({
+      to: 'user@example.com',
+      subject: 'Invite',
+      react: React.createElement('div', null, [
+        React.createElement('p', { key: 'text' }, 'Accept your invite'),
+        React.createElement('a', { key: 'link', href: 'https://example.com/portal/invite?token=raw' }, 'Accept'),
+      ]),
+    })
+
+    const rows = (await readFile(capturePath, 'utf8')).trim().split('\n')
+    expect(rows).toHaveLength(1)
+    expect(JSON.parse(rows[0])).toEqual(expect.objectContaining({
+      to: 'user@example.com',
+      subject: 'Invite',
+      links: ['https://example.com/portal/invite?token=raw'],
+      text: 'Accept your invite Accept',
+    }))
+    expect(ResendMock).not.toHaveBeenCalled()
+    expect(sendMock).not.toHaveBeenCalled()
+  })
 })

package/src/lib/email/send.ts

@@ -1,5 +1,8 @@
 import { Resend } from 'resend'
 import React from 'react'
+import { appendFile, mkdir } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
 import { parseBooleanWithDefault } from '../boolean'
 import { resolveDefaultEmailFromAddress } from './config'
 
@@ -16,10 +19,86 @@ export type SendEmailOptions = {
   }>
 }
 
+type CapturedEmail = {
+  to: string
+  subject: string
+  from: string | null
+  replyTo: string | null
+  links: string[]
+  text: string
+  capturedAt: string
+}
+
+type ReactElementProps = {
+  href?: unknown
+  children?: unknown
+}
+
+const DEFAULT_TEST_EMAIL_CAPTURE_PATH = join(tmpdir(), 'open-mercato-email-capture.jsonl')
+
+function resolveTestEmailCapturePath(): string {
+  return process.env.OM_TEST_EMAIL_CAPTURE_PATH?.trim() || DEFAULT_TEST_EMAIL_CAPTURE_PATH
+}
+
+function readElementProps(node: React.ReactElement): ReactElementProps {
+  return node.props as ReactElementProps
+}
+
+function collectEmailLinks(node: unknown, links: string[] = []): string[] {
+  if (node == null || typeof node === 'boolean') return links
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailLinks(child, links)
+    return links
+  }
+  if (React.isValidElement(node)) {
+    const props = readElementProps(node)
+    if (typeof props.href === 'string' && props.href.length > 0) links.push(props.href)
+    collectEmailLinks(props.children, links)
+  }
+  return links
+}
+
+function collectEmailText(node: unknown, parts: string[] = []): string[] {
+  if (node == null || typeof node === 'boolean') return parts
+  if (typeof node === 'string' || typeof node === 'number') {
+    parts.push(String(node))
+    return parts
+  }
+  if (Array.isArray(node)) {
+    for (const child of node) collectEmailText(child, parts)
+    return parts
+  }
+  if (React.isValidElement(node)) {
+    collectEmailText(readElementProps(node).children, parts)
+  }
+  return parts
+}
+
+async function captureEmailForTests(options: SendEmailOptions): Promise<void> {
+  if (!parseBooleanWithDefault(process.env.OM_TEST_MODE, false)) return
+
+  const capturePath = resolveTestEmailCapturePath()
+  const record: CapturedEmail = {
+    to: options.to,
+    subject: options.subject,
+    from: options.from ?? resolveDefaultEmailFromAddress() ?? null,
+    replyTo: options.replyTo ?? null,
+    links: collectEmailLinks(options.react),
+    text: collectEmailText(options.react).join(' ').replace(/\s+/g, ' ').trim(),
+    capturedAt: new Date().toISOString(),
+  }
+
+  await mkdir(dirname(capturePath), { recursive: true })
+  await appendFile(capturePath, `${JSON.stringify(record)}\n`, 'utf8')
+}
+
 export async function sendEmail({ to, subject, react, from, replyTo, attachments }: SendEmailOptions) {
   const emailDisabled =
     parseBooleanWithDefault(process.env.OM_DISABLE_EMAIL_DELIVERY, false) ||
     parseBooleanWithDefault(process.env.OM_TEST_MODE, false)
+
+  await captureEmailForTests({ to, subject, react, from, replyTo, attachments })
+
   if (emailDisabled) return
 
   const apiKey = process.env.RESEND_API_KEY

package/src/lib/encryption/__tests__/subscriber.test.ts

@@ -4,9 +4,11 @@ import {
 } from '../subscriber'
 import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
 
-// Give every entity a resolvable id so the real decrypt() path proceeds to decryptEntityPayload.
+// Give every entity a resolvable id so the real decrypt() path proceeds to decryptEntityPayload,
+// keying off the class name so a test's fixture and its assertion describe the same entity.
 jest.mock('../entityIds', () => ({
-  resolveEntityIdFromMetadata: jest.fn(() => 'customers:customer_address'),
+  resolveEntityIdFromMetadata: jest.fn((meta?: { className?: string }) =>
+    meta?.className === 'OnboardingRequest' ? 'onboarding:onboarding_request' : 'customers:customer_address'),
 }))
 
 describe('decryptEntitiesWithFallbackScope subscriber memoization (issue #2235)', () => {
@@ -150,3 +152,53 @@ describe('decryptEntitiesWithFallbackScope per-row scope (multi-org safety)', ()
     expect(calls).toHaveLength(3)
   })
 })
+
+describe('tenant-less entity encryption delegation', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  it('lets the encryption service resolve an explicit system-scoped map', async () => {
+    const encryptEntityPayload = jest.fn(async (
+      _entityId: string,
+      target: Record<string, unknown>,
+    ) => ({ ...target, secret: 'encrypted' }))
+    const service = {
+      isEnabled: () => true,
+      encryptEntityPayload,
+    } as unknown as TenantDataEncryptionService
+    const subscriber = new TenantEncryptionSubscriber(service)
+    const entity = { secret: 'plaintext' }
+    const meta = {
+      className: 'OnboardingRequest',
+      tableName: 'onboarding_requests',
+      properties: {
+        secret: { name: 'secret', fieldName: 'secret' },
+      },
+    }
+    const changeSet = { payload: { secret: 'plaintext' } }
+
+    await subscriber.beforeCreate({
+      entity,
+      meta,
+      em: {},
+      changeSet,
+    } as never)
+
+    expect(encryptEntityPayload).toHaveBeenCalledWith(
+      'onboarding:onboarding_request',
+      expect.any(Object),
+      null,
+      null,
+    )
+    expect(entity.secret).toBe('encrypted')
+    expect(changeSet.payload.secret).toBe('encrypted')
+  })
+})