@open-mercato/shared 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -196,6 +196,64 @@ describe('TenantDataEncryptionService.encryptFields (issue #2720)', () => {
   })
 })
 
+describe('TenantDataEncryptionService system-scoped maps', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  it('encrypts tenant-less payloads with a stable entity-scoped KMS key', async () => {
+    const entityId = 'onboarding:onboarding_request'
+    const systemKeyId = `system:${entityId}`
+    const getTenantDek = jest.fn(async (keyId: string) => (
+      keyId === systemKeyId
+        ? { tenantId: keyId, key: fixedKey, fetchedAt: new Date() }
+        : null
+    ))
+    const service = new TenantDataEncryptionService(
+      {
+        getConnection: () => ({ execute: jest.fn(async () => []) }),
+      } as never,
+      {
+        kms: {
+          getTenantDek,
+          createTenantDek: jest.fn(async () => null),
+          isHealthy: () => true,
+        },
+        defaultEncryptionMaps: [
+          {
+            entityId,
+            keyScope: 'system',
+            fields: [
+              { field: 'email', hashField: 'email_hash' },
+              { field: 'password_hash' },
+            ],
+          },
+        ],
+      } as never,
+    )
+
+    const encrypted = await service.encryptEntityPayload(entityId, {
+      email: 'person@example.com',
+      email_hash: null,
+      password_hash: 'bcrypt-value',
+    }, null, null)
+
+    expect(getTenantDek).toHaveBeenCalledWith(systemKeyId)
+    expect(encrypted.email).not.toBe('person@example.com')
+    expect(encrypted.password_hash).not.toBe('bcrypt-value')
+    expect(encrypted.email_hash).toBe(hashForLookup('person@example.com'))
+    expect(decryptWithAesGcm(encrypted.email as string, fixedKey)).toBe('person@example.com')
+    expect(decryptWithAesGcm(encrypted.password_hash as string, fixedKey)).toBe('bcrypt-value')
+  })
+})
+
 describe('TenantDataEncryptionService.getEncryptedFieldNames', () => {
   it('returns active encryption-map field names for query planning', async () => {
     const service = new TenantDataEncryptionService({} as never)

package/src/lib/encryption/subscriber.ts

@@ -6,6 +6,7 @@ import { isTenantDataEncryptionEnabled } from './toggles'
 import { isEncryptionDebugEnabled } from './toggles'
 import { resolveTenantEncryptionService } from './customFieldValues'
 import { createLogger } from '../logger'
+import { listEntityMetadataFromRegistry } from '../db/entityMetadata'
 
 const logger = createLogger('shared').child({ component: 'encryption' })
 
@@ -85,13 +86,8 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     try { return registry.find?.(ctor) } catch {}
     try { return registry.get?.(name) } catch {}
     try { return registry.get?.(ctor) } catch {}
-    const all =
-      (typeof registry.getAll === 'function' && registry.getAll()) ||
-      (Array.isArray((registry as any).metadata) ? (registry as any).metadata : undefined) ||
-      (registry as any).metadata ||
-      {}
     try {
-      const entries = Array.isArray(all) ? all : Object.values<any>(all)
+      const entries = listEntityMetadataFromRegistry(registry)
       const match = entries.find(
         (m: any) =>
           m?.className === name ||
@@ -224,10 +220,6 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
       return
     }
     const { tenantId, organizationId } = resolveScope(target)
-    if (!tenantId) {
-      debug('⚪️ subscriber.skip', { reason: 'no-tenant', entityId })
-      return
-    }
     const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId)
     const metaProps: Record<string, unknown> = resolvedMeta?.properties && typeof resolvedMeta.properties === 'object'
       ? resolvedMeta.properties
@@ -325,10 +317,6 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     const { tenantId, organizationId } = resolveScope(target)
     const scopedTenantId = tenantId ?? fallbackScope?.tenantId ?? null
     const scopedOrgId = organizationId ?? fallbackScope?.organizationId ?? null
-    if (!scopedTenantId) {
-      debug('⚪️ subscriber.skip', { reason: 'no-tenant', entityId })
-      return
-    }
     // Capture pending (un-flushed) changes BEFORE decrypt mutates the target. Re-baselining a
     // managed entity that a command already mutated would clear its dirty changeset and silently
     // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -4,6 +4,7 @@ import { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'
 import { createKmsService, type KmsService, type TenantDek } from './kms'
 import { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'
 import { createLogger } from '../logger'
+import type { EncryptionKeyScope, ModuleEncryptionMap } from '../../modules/encryption'
 
 const logger = createLogger('shared').child({ component: 'tenant-encryption' })
 
@@ -14,6 +15,7 @@ export type EncryptedFieldRule = {
 
 export type EncryptionMapRecord = {
   entityId: string
+  keyScope?: EncryptionKeyScope
   fields: EncryptedFieldRule[]
 }
 
@@ -154,13 +156,23 @@ export class TenantDataEncryptionService {
   private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks
   private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps
   private readonly missCache = TenantDataEncryptionService.globalMissCache
+  private readonly systemDefaultMaps: Map<string, ModuleEncryptionMap>
 
   constructor(
     private em: EntityManager,
-    opts?: { cache?: CacheStrategy; kms?: KmsService }
+    opts?: {
+      cache?: CacheStrategy
+      kms?: KmsService
+      defaultEncryptionMaps?: readonly ModuleEncryptionMap[]
+    }
   ) {
     this.cache = opts?.cache
     this.kms = opts?.kms ?? createKmsService()
+    this.systemDefaultMaps = new Map(
+      (opts?.defaultEncryptionMaps ?? [])
+        .filter((map) => map.keyScope === 'system')
+        .map((map) => [map.entityId, map]),
+    )
   }
 
   isEnabled(): boolean {
@@ -239,6 +251,24 @@ export class TenantDataEncryptionService {
     }
   }
 
+  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {
+    const declared = this.systemDefaultMaps.get(entityId)
+    if (!declared) return record
+    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({
+      field: field.field,
+      hashField: field.hashField ?? null,
+    }))
+    const declaredFields = new Set(fields.map((field) => field.field))
+    for (const field of record?.fields ?? []) {
+      if (!declaredFields.has(field.field)) fields.push(field)
+    }
+    return {
+      entityId,
+      keyScope: 'system',
+      fields,
+    }
+  }
+
   private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {
     const shouldSkipLookup = (tag: string) => {
       const expiresAt = this.missCache.get(tag)
@@ -262,13 +292,13 @@ export class TenantDataEncryptionService {
       if (this.inflightMaps.has(tag)) {
         const pending = this.inflightMaps.get(tag)!
         const resolved = await pending
-        if (resolved) return resolved
+        if (resolved) return this.applySystemDefault(resolved, key.entityId)
       }
       const mem = this.memoryCache.get(tag)
-      if (mem) return mem
+      if (mem) return this.applySystemDefault(mem, key.entityId)
       if (this.cache && typeof this.cache.get === 'function') {
         const cached = await this.cache.get(tag)
-        if (cached) return cached as EncryptionMapRecord
+        if (cached) return this.applySystemDefault(cached as EncryptionMapRecord, key.entityId)
       }
       const pending = this.fetchMap(candidate)
       this.inflightMaps.set(tag, pending)
@@ -288,9 +318,9 @@ export class TenantDataEncryptionService {
       if (this.cache && typeof this.cache.set === 'function') {
         await this.cache.set(tag, loaded, { ttl: 300 })
       }
-      return loaded
+      return this.applySystemDefault(loaded, key.entityId)
     }
-    return null
+    return this.applySystemDefault(null, key.entityId)
   }
 
   private async fetchAllOrganizationFieldNames(entityId: string, tenantId: string | null): Promise<string[]> {
@@ -336,12 +366,26 @@ export class TenantDataEncryptionService {
     this.kms.invalidateDek?.(tenantId)
   }
 
+  /**
+   * Lists the fields an encryption map marks as encrypted at rest.
+   *
+   * `isEnabled()` folds the environment toggle together with KMS health, so by default an
+   * unhealthy KMS reports "nothing is encrypted" — which is safe for write paths but wrong for
+   * readers that must decide whether a stored column holds ciphertext. `ignoreRuntimeHealth`
+   * answers the on-disk question instead: it consults the map even when the KMS cannot currently
+   * resolve a DEK, so callers can fail closed rather than treat ciphertext as plaintext (#4622).
+   */
   async getEncryptedFieldNames(
     entityId: string,
     tenantId: string | null | undefined,
-    organizationId?: string | null
+    organizationId?: string | null,
+    options?: { ignoreRuntimeHealth?: boolean }
   ): Promise<string[]> {
-    if (!this.isEnabled()) return []
+    if (options?.ignoreRuntimeHealth) {
+      if (!isTenantDataEncryptionEnabled()) return []
+    } else if (!this.isEnabled()) {
+      return []
+    }
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     const fields = new Set(normalizeEncryptedFieldNames(map?.fields))
     if (organizationId == null) {
@@ -421,16 +465,17 @@ export class TenantDataEncryptionService {
       debug('⚪️ encrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
-    const dek = await this.resolveDekForEncrypt(tenantId ?? null)
-    if (!dek) {
-      debug('⚠️ encrypt.skip.no-dek', { entityId, tenantId })
-      return payload
-    }
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     if (!map || !map.fields?.length) {
       debug('⚪️ encrypt.skip.no-map', { entityId, tenantId })
       return payload
     }
+    const keyId = map.keyScope === 'system' ? `system:${entityId}` : tenantId ?? null
+    const dek = await this.resolveDekForEncrypt(keyId)
+    if (!dek) {
+      debug('⚠️ encrypt.skip.no-dek', { entityId, tenantId, keyScope: map.keyScope ?? 'tenant' })
+      return payload
+    }
     debug('🔒 encrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })
     return this.encryptFields(payload, map.fields, dek)
   }
@@ -445,16 +490,17 @@ export class TenantDataEncryptionService {
       debug('⚪️ decrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
-    const dek = await this.getDek(tenantId ?? null)
-    if (!dek) {
-      debug('⚠️ decrypt.skip.no-dek', { entityId, tenantId })
-      return payload
-    }
     const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
     if (!map || !map.fields?.length) {
       debug('⚪️ decrypt.skip.no-map', { entityId, tenantId })
       return payload
     }
+    const keyId = map.keyScope === 'system' ? `system:${entityId}` : tenantId ?? null
+    const dek = await this.getDek(keyId)
+    if (!dek) {
+      debug('⚠️ decrypt.skip.no-dek', { entityId, tenantId, keyScope: map.keyScope ?? 'tenant' })
+      return payload
+    }
     debug('🔓 decrypt_entity', { entityId, tenantId, organizationId, fields: map.fields.length })
     return this.decryptFields(payload, map.fields, dek)
   }

package/src/lib/i18n/__tests__/config.test.ts

@@ -0,0 +1,8 @@
+import { defaultLocale, locales, type Locale } from '../config'
+
+describe('supported application locales', () => {
+  it('registers Korean without changing the default locale', () => {
+    expect(locales).toEqual<Locale[]>(['en', 'pl', 'es', 'de', 'ko'])
+    expect(defaultLocale).toBe('en')
+  })
+})

package/src/lib/i18n/__tests__/server-dictionary-cache.test.ts

@@ -0,0 +1,30 @@
+import { loadDictionary, registerModules } from '../server'
+import type { Module } from '../../../modules/registry'
+
+describe('loadDictionary memoization', () => {
+  it('returns a cached dictionary for repeated calls with the same locale', async () => {
+    registerModules([
+      { id: 'demo', translations: { en: { 'demo.hello': 'Hello' } } },
+    ] satisfies Module[])
+
+    const first = await loadDictionary('en')
+    const second = await loadDictionary('en')
+
+    expect(second).toBe(first)
+    expect(first['demo.hello']).toBe('Hello')
+  })
+
+  it('busts the cache when the registered module set changes', async () => {
+    registerModules([{ id: 'a', translations: { en: { 'a.k': 'A' } } }] satisfies Module[])
+    const before = await loadDictionary('en')
+
+    registerModules([
+      { id: 'a', translations: { en: { 'a.k': 'A' } } },
+      { id: 'b', translations: { en: { 'b.k': 'B' } } },
+    ] satisfies Module[])
+    const after = await loadDictionary('en')
+
+    expect(after).not.toBe(before)
+    expect(after['b.k']).toBe('B')
+  })
+})

package/src/lib/i18n/__tests__/server-unbootstrapped.test.ts

@@ -0,0 +1,29 @@
+import { invalidateDictionaryCache, loadDictionary, registerModules, resolveTranslations } from '../server'
+import type { Module } from '../../../modules/registry'
+
+const REGISTRY_GLOBAL_KEY = '__openMercatoModulesRegistry__'
+
+describe('loadDictionary without a bootstrapped module registry', () => {
+  beforeEach(() => {
+    delete (globalThis as Record<string, unknown>)[REGISTRY_GLOBAL_KEY]
+    invalidateDictionaryCache()
+  })
+
+  it('resolves the app dictionary instead of throwing a bootstrap error', async () => {
+    await expect(loadDictionary('en')).resolves.toEqual(expect.any(Object))
+  })
+
+  it('lets a route handler translate its response before bootstrap runs', async () => {
+    const { translate } = await resolveTranslations()
+
+    expect(translate('storage_s3.upload.errors.unsupported', 'Unsupported file type')).toBe('Unsupported file type')
+  })
+
+  it('picks up module translations once bootstrap registers them', async () => {
+    await loadDictionary('en')
+
+    registerModules([{ id: 'demo', translations: { en: { 'demo.hello': 'Hello' } } }] satisfies Module[])
+
+    await expect(loadDictionary('en')).resolves.toMatchObject({ 'demo.hello': 'Hello' })
+  })
+})

package/src/lib/i18n/config.ts

@@ -1,4 +1,4 @@
-export type Locale = 'en' | 'pl' | 'es' | 'de'
+export type Locale = 'en' | 'pl' | 'es' | 'de' | 'ko'
 
-export const locales: Locale[] = ['en', 'pl', 'es', 'de']
+export const locales: Locale[] = ['en', 'pl', 'es', 'de', 'ko']
 export const defaultLocale: Locale = 'en'

package/src/lib/i18n/server.ts

@@ -2,7 +2,7 @@ import { defaultLocale, locales, type Locale } from './config'
 import type { Dict } from './context'
 import { resolveForcedLocale, resolveLocaleFromAcceptLanguage } from './locale'
 import { createFallbackTranslator, createTranslator } from './translate'
-import { getModules } from '../modules/registry'
+import { tryGetModules } from '../modules/registry'
 import { loadAppDictionary } from './app-dictionaries'
 import { getCachedDictionary, setCachedDictionary } from './dictionary-cache'
 
@@ -61,7 +61,11 @@ export async function loadDictionary(locale: Locale): Promise<Dict> {
   // Load from registry instead of @/ import (works in standalone packages)
   const baseRaw = await loadAppDictionary(locale)
   const merged: Dict = { ...flattenDictionary(baseRaw) }
-  const modules = getModules()
+  // Route handlers translate their responses, so they resolve a dictionary even
+  // when they are exercised in isolation without a bootstrapped registry. The
+  // app dictionary alone is the right degraded answer there — `registerModules`
+  // invalidates this cache, so a later bootstrap still gets the merged result.
+  const modules = tryGetModules() ?? []
   for (const m of modules) {
     const dict = m.translations?.[locale]
     if (dict) Object.assign(merged, flattenDictionary(dict))

package/src/lib/logger/__tests__/logger.test.ts

@@ -3,7 +3,9 @@ import {
   createLogger,
   getLogLevel,
   isLevelEnabled,
+  registerLoggerExtension,
   resetLogLevelCache,
+  resetLoggerExtension,
   resetLoggerRegistry,
 } from '../index'
 import { resolveLevel, type LogLevel } from '../level'
@@ -65,6 +67,7 @@ function resetLoggerState(): void {
   resetLoggerRegistry()
   resetServerLoggerCache()
   resetLogPrettyCache()
+  resetLoggerExtension()
 }
 
 function forcePinoTransport(): void {
@@ -241,6 +244,80 @@ describe('structured logging facade', () => {
     })
   })
 
+  describe('process-wide logger extension', () => {
+    beforeEach(() => {
+      forcePinoTransport()
+    })
+
+    it('keeps one local line and observes one correlated record with child bindings', () => {
+      const fake = createFakePinoHarness()
+      mockPinoLoader(fake.factory)
+      const records: unknown[] = []
+      registerLoggerExtension({
+        enrich: () => ({ trace_id: 'trace-1', span_id: 'span-1' }),
+        emit: (record) => records.push(record),
+      })
+
+      createLogger('orders')
+        .child({ module: 'sales' })
+        .info('Order placed', { orderId: 'o-1' })
+
+      expect(fake.calls).toEqual([{
+        level: 'info',
+        args: [{
+          orderId: 'o-1',
+          trace_id: 'trace-1',
+          span_id: 'span-1',
+        }, 'Order placed'],
+      }])
+      expect(records).toHaveLength(1)
+      expect(records[0]).toMatchObject({
+        level: 'info',
+        namespace: 'orders',
+        message: 'Order placed',
+        fields: {
+          module: 'sales',
+          orderId: 'o-1',
+          trace_id: 'trace-1',
+          span_id: 'span-1',
+        },
+      })
+    })
+
+    it('applies the shared level gate to local and remote output', () => {
+      process.env.OM_LOG_LEVEL = 'warn'
+      resetLogLevelCache()
+      const fake = createFakePinoHarness()
+      mockPinoLoader(fake.factory)
+      const emit = jest.fn()
+      registerLoggerExtension({ emit })
+      const logger = createLogger('gated-extension')
+
+      logger.info('quiet')
+      logger.warn('visible')
+
+      expect(fake.calls.map((call) => call.level)).toEqual(['warn'])
+      expect(emit).toHaveBeenCalledTimes(1)
+      expect(emit.mock.calls[0][0]).toMatchObject({ level: 'warn', message: 'visible' })
+    })
+
+    it('isolates extension failures from application logging', () => {
+      const fake = createFakePinoHarness()
+      mockPinoLoader(fake.factory)
+      registerLoggerExtension({
+        enrich: () => {
+          throw new Error('context failed')
+        },
+        emit: () => {
+          throw new Error('sink failed')
+        },
+      })
+
+      expect(() => createLogger('resilient-extension').error('Still local')).not.toThrow()
+      expect(fake.calls).toEqual([{ level: 'error', args: [{}, 'Still local'] }])
+    })
+  })
+
   describe('isomorphism', () => {
     beforeEach(() => {
       forcePinoTransport()

package/src/lib/logger/extension.ts

@@ -0,0 +1,59 @@
+import type { LogLevel } from './level'
+
+export type LoggerExtensionRecord = {
+  level: LogLevel
+  namespace: string
+  message: string
+  fields: Record<string, unknown>
+  time: number
+}
+
+export type LoggerExtension = {
+  /**
+   * Add process-local context (for example trace/span ids) to both the local
+   * line and the optional remote sink.
+   */
+  enrich?(): Record<string, unknown> | undefined
+  /**
+   * Observe a record after the local transport writes it. Implementations must
+   * never throw into application code.
+   */
+  emit?(record: LoggerExtensionRecord): void
+}
+
+const GLOBAL_KEY = Symbol.for('@open-mercato/shared.loggerExtension')
+
+type LoggerExtensionStore = {
+  active?: LoggerExtension
+}
+
+function store(): LoggerExtensionStore {
+  const globalStore = globalThis as unknown as Record<symbol, LoggerExtensionStore | undefined>
+  let current = globalStore[GLOBAL_KEY]
+  if (!current) {
+    current = {}
+    globalStore[GLOBAL_KEY] = current
+  }
+  return current
+}
+
+/**
+ * Register the single process-wide logger extension. The returned disposer only
+ * clears the extension when it is still the active registration.
+ */
+export function registerLoggerExtension(extension: LoggerExtension): () => void {
+  store().active = extension
+  return () => {
+    const current = store()
+    if (current.active === extension) current.active = undefined
+  }
+}
+
+export function getLoggerExtension(): LoggerExtension | undefined {
+  return store().active
+}
+
+/** Test-only: clear the process-wide extension. */
+export function resetLoggerExtension(): void {
+  store().active = undefined
+}

package/src/lib/logger/index.ts

@@ -1,9 +1,17 @@
 import { selectTransport } from './transport'
+import { getLoggerExtension } from './extension'
+import { isLevelEnabled, type LogLevel } from './level'
 
 export type { LogLevel } from './level'
 export { getLogLevel, isLevelEnabled, resetLogLevelCache, OM_LOG_LEVEL_ENV } from './level'
 export { resetServerLoggerCache, OM_LOG_DESTINATION_ENV } from './transport.server'
 export { resetLogPrettyCache, OM_LOG_PRETTY_ENV } from './transport.pretty'
+export {
+  getLoggerExtension,
+  registerLoggerExtension,
+  resetLoggerExtension,
+} from './extension'
+export type { LoggerExtension, LoggerExtensionRecord } from './extension'
 
 export type LogBindings = Record<string, unknown>
 
@@ -18,11 +26,61 @@ export interface Logger {
 
 const loggerRegistry = new Map<string, Logger>()
 
+function createExtendedLogger(
+  namespace: string,
+  transport: Logger,
+  bindings: LogBindings = {},
+): Logger {
+  const emit = (
+    level: LogLevel,
+    msg: string,
+    fields?: LogBindings,
+  ): void => {
+    if (!isLevelEnabled(level)) return
+
+    const extension = getLoggerExtension()
+    let context: LogBindings = {}
+    try {
+      context = extension?.enrich?.() ?? {}
+    } catch {
+      // Observability must never alter application behavior.
+    }
+
+    const mergedFields = { ...fields, ...context }
+    transport[level](msg, mergedFields)
+
+    try {
+      extension?.emit?.({
+        level,
+        namespace,
+        message: msg,
+        fields: { ...bindings, ...mergedFields },
+        time: Date.now(),
+      })
+    } catch {
+      // Remote logging is best-effort; the local line has already been written.
+    }
+  }
+
+  return {
+    debug: (msg, fields) => emit('debug', msg, fields),
+    info: (msg, fields) => emit('info', msg, fields),
+    warn: (msg, fields) => emit('warn', msg, fields),
+    error: (msg, fields) => emit('error', msg, fields),
+    child: (childBindings) =>
+      createExtendedLogger(
+        namespace,
+        transport.child(childBindings),
+        { ...bindings, ...childBindings },
+      ),
+  }
+}
+
 /** Create (or reuse) a namespaced logger. `namespace` is attached as `name`. */
 export function createLogger(namespace: string): Logger {
   const existing = loggerRegistry.get(namespace)
   if (existing) return existing
-  const created = selectTransport(namespace)
+  const created = createExtendedLogger(namespace, selectTransport(namespace))
   loggerRegistry.set(namespace, created)
   return created
 }