@open-mercato/shared 0.6.8-develop.6889.1.af4501ca97 → 0.6.8-develop.6892.1.f179677788

package/src/lib/encryption/__tests__/likeFilterWarning.test.ts

@@ -0,0 +1,167 @@
+import { collectLikeFilterFields, warnOnEncryptedLikeFilter } from '../likeFilterWarning'
+import { registerEntityIds } from '../entityIds'
+import { resetCiphertextLikeWarnCache } from '../../query/ciphertext-search-warning'
+
+jest.mock('../../logger', () => {
+  const warn = jest.fn()
+  const debug = jest.fn()
+  const child = jest.fn(() => ({ warn, debug }))
+  return { createLogger: jest.fn(() => ({ child })), __warn: warn, __debug: debug }
+})
+
+jest.mock('../customFieldValues', () => ({
+  resolveTenantEncryptionService: jest.fn(() => null),
+}))
+
+const loggerModule = jest.requireMock('../../logger') as { __warn: jest.Mock }
+
+describe('collectLikeFilterFields', () => {
+  it('finds string operators on a top-level property', () => {
+    expect(collectLikeFilterFields({ title: { $ilike: '%q%' } })).toEqual(['title'])
+    expect(collectLikeFilterFields({ title: { $like: 'q%' } })).toEqual(['title'])
+    expect(collectLikeFilterFields({ title: { $re: '^q' } })).toEqual(['title'])
+  })
+
+  it('ignores filters that do not use a string operator', () => {
+    expect(collectLikeFilterFields({ title: 'Renewal', status: { $in: ['open'] } })).toEqual([])
+    expect(collectLikeFilterFields({ createdAt: { $gte: new Date(0) } })).toEqual([])
+  })
+
+  it('descends into $and, $or and $not branches', () => {
+    const where = {
+      $and: [
+        { tenantId: 't1' },
+        { $or: [{ title: { $ilike: '%q%' } }, { subject: { $ilike: '%q%' } }] },
+      ],
+    }
+    expect(collectLikeFilterFields(where).sort()).toEqual(['subject', 'title'])
+    expect(collectLikeFilterFields({ title: { $not: { $ilike: '%q%' } } })).toEqual(['title'])
+  })
+
+  it('does not attribute a nested relation filter to the root entity', () => {
+    expect(collectLikeFilterFields({ customer: { displayName: { $ilike: '%q%' } } })).toEqual([])
+  })
+
+  it('tolerates empty, null and non-object filters', () => {
+    expect(collectLikeFilterFields(undefined)).toEqual([])
+    expect(collectLikeFilterFields(null)).toEqual([])
+    expect(collectLikeFilterFields('id-1')).toEqual([])
+    expect(collectLikeFilterFields({})).toEqual([])
+  })
+
+  it('reports each property once regardless of how many branches match', () => {
+    const where = { $or: [{ title: { $ilike: '%a%' } }, { title: { $ilike: '%b%' } }] }
+    expect(collectLikeFilterFields(where)).toEqual(['title'])
+  })
+})
+
+describe('warnOnEncryptedLikeFilter', () => {
+  const originalNodeEnv = process.env.NODE_ENV
+
+  const makeEm = () => ({
+    getMetadata: () => ({ find: (name: string) => (name === 'MailMessage' ? { className: 'MailMessage' } : undefined) }),
+  })
+
+  const makeService = (encryptedFields: string[]) => ({
+    isEnabled: () => true,
+    getEncryptedFieldNames: jest.fn(async () => encryptedFields),
+  })
+
+  beforeAll(() => {
+    registerEntityIds({ mail: { mail_message: 'mail:mail_message' } })
+  })
+
+  beforeEach(() => {
+    resetCiphertextLikeWarnCache()
+    loggerModule.__warn.mockClear()
+    Object.defineProperty(process.env, 'NODE_ENV', { value: 'test', configurable: true })
+  })
+
+  afterAll(() => {
+    Object.defineProperty(process.env, 'NODE_ENV', { value: originalNodeEnv, configurable: true })
+  })
+
+  it('warns when the filtered property is covered by an encryption map', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      where: { subject: { $ilike: '%invoice%' } },
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['subject']) as any,
+    })
+
+    expect(loggerModule.__warn).toHaveBeenCalledTimes(1)
+    expect(loggerModule.__warn.mock.calls[0][1]).toMatchObject({
+      entity: 'mail:mail_message',
+      field: 'subject',
+      reason: 'raw-orm-filter',
+    })
+    expect(loggerModule.__warn.mock.calls[0][1].hint).toContain('findEntityIdsBySearchTokens')
+  })
+
+  it('stays quiet for properties outside the encryption map', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      where: { subject: { $ilike: '%invoice%' } },
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['body']) as any,
+    })
+    expect(loggerModule.__warn).not.toHaveBeenCalled()
+  })
+
+  it('skips the encryption lookup entirely in production', async () => {
+    Object.defineProperty(process.env, 'NODE_ENV', { value: 'production', configurable: true })
+    const service = makeService(['subject'])
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      where: { subject: { $ilike: '%invoice%' } },
+      tenantId: 'tenant-1',
+      encryptionService: service as any,
+    })
+    expect(service.getEncryptedFieldNames).not.toHaveBeenCalled()
+    expect(loggerModule.__warn).not.toHaveBeenCalled()
+  })
+
+  it('skips the encryption lookup when no string operator is present', async () => {
+    const service = makeService(['subject'])
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      where: { subject: 'Invoice' },
+      tenantId: 'tenant-1',
+      encryptionService: service as any,
+    })
+    expect(service.getEncryptedFieldNames).not.toHaveBeenCalled()
+  })
+
+  it('stays quiet when the entity id cannot be resolved', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'UnknownEntity',
+      where: { subject: { $ilike: '%invoice%' } },
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['subject']) as any,
+    })
+    expect(loggerModule.__warn).not.toHaveBeenCalled()
+  })
+
+  it('never rethrows when metadata access fails', async () => {
+    const em = {
+      getMetadata: () => {
+        throw new Error('orm not initialized')
+      },
+    }
+    await expect(
+      warnOnEncryptedLikeFilter({
+        em: em as any,
+        entityName: 'MailMessage',
+        where: { subject: { $ilike: '%invoice%' } },
+        tenantId: 'tenant-1',
+        encryptionService: makeService(['subject']) as any,
+      }),
+    ).resolves.toBeUndefined()
+    expect(loggerModule.__warn).not.toHaveBeenCalled()
+  })
+})

package/src/lib/encryption/find.ts

@@ -5,6 +5,7 @@ import type {
   FindOneOptions,
   FindOptions,
 } from '@mikro-orm/postgresql'
+import { warnOnEncryptedLikeFilter } from './likeFilterWarning'
 import { decryptEntitiesWithFallbackScope } from './subscriber'
 import type { TenantDataEncryptionService } from './tenantDataEncryptionService'
 
@@ -24,6 +25,13 @@ export async function findWithDecryption<Entity extends object, Hint extends str
   options?: AnyFindOptions<Entity, Hint>,
   scope?: DecryptionScope,
 ): Promise<Entity[]> {
+  await warnOnEncryptedLikeFilter({
+    em,
+    entityName,
+    where,
+    tenantId: scope?.tenantId,
+    encryptionService: scope?.encryptionService,
+  })
   const records = (await em.find<Entity, Hint, any, any>(entityName as any, where as any, options as any)) as any as
     | Entity[]
     | undefined
@@ -44,6 +52,13 @@ export async function findOneWithDecryption<Entity extends object, Hint extends
   options?: AnyFindOneOptions<Entity, Hint>,
   scope?: DecryptionScope,
 ): Promise<Entity | null> {
+  await warnOnEncryptedLikeFilter({
+    em,
+    entityName,
+    where,
+    tenantId: scope?.tenantId,
+    encryptionService: scope?.encryptionService,
+  })
   const record = (await em.findOne<Entity, Hint, any, any>(entityName as any, where as any, options as any)) as any as
     | Entity
     | null
@@ -64,6 +79,13 @@ export async function findAndCountWithDecryption<Entity extends object, Hint ext
   options?: AnyFindOptions<Entity, Hint>,
   scope?: DecryptionScope,
 ): Promise<[Entity[], number]> {
+  await warnOnEncryptedLikeFilter({
+    em,
+    entityName,
+    where,
+    tenantId: scope?.tenantId,
+    encryptionService: scope?.encryptionService,
+  })
   const [recordsRaw, count] = await em.findAndCount<Entity, Hint, any, any>(
     entityName as any,
     where as any,

package/src/lib/encryption/likeFilterWarning.ts

@@ -0,0 +1,102 @@
+import type { EntityManager, EntityName } from '@mikro-orm/postgresql'
+import { warnOnCiphertextLikeFallback } from '../query/ciphertext-search-warning'
+import { resolveTenantEncryptionService } from './customFieldValues'
+import { resolveEntityIdFromMetadata } from './entityIds'
+import type { TenantDataEncryptionService } from './tenantDataEncryptionService'
+
+const LIKE_OPERATORS = new Set(['$like', '$ilike', '$re', '$fulltext'])
+const LOGICAL_OPERATORS = new Set(['$and', '$or', '$not', '$every', '$some', '$none'])
+
+const isPlainObject = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value) && !(value instanceof Date)
+
+// An operator object holds only `$`-prefixed keys. Anything else is a nested
+// relation filter, whose property names belong to another entity's encryption
+// map — attributing them to the root entity would produce false warnings.
+const isOperatorObject = (value: unknown): value is Record<string, unknown> => {
+  if (!isPlainObject(value)) return false
+  const keys = Object.keys(value)
+  return keys.length > 0 && keys.every((key) => key.startsWith('$'))
+}
+
+function walkFilter(node: unknown, field: string | null, out: Set<string>): void {
+  if (Array.isArray(node)) {
+    for (const item of node) walkFilter(item, field, out)
+    return
+  }
+  if (!isPlainObject(node)) return
+  for (const [key, value] of Object.entries(node)) {
+    if (LIKE_OPERATORS.has(key)) {
+      if (field) out.add(field)
+      continue
+    }
+    if (LOGICAL_OPERATORS.has(key)) {
+      walkFilter(value, field, out)
+      continue
+    }
+    if (key.startsWith('$')) continue
+    if (isOperatorObject(value)) walkFilter(value, key, out)
+  }
+}
+
+/**
+ * Lists the root-entity properties a filter targets with a string-matching
+ * operator (`$like`, `$ilike`, `$re`, `$fulltext`), including inside
+ * `$and`/`$or`/`$not` branches.
+ */
+export function collectLikeFilterFields(where: unknown): string[] {
+  const found = new Set<string>()
+  walkFilter(where, null, found)
+  return Array.from(found)
+}
+
+// The map lookup behind the warning issues an uncached read against
+// `encryption_maps`, and this path runs on every matching query rather than in a
+// rare fallback branch — so the check stays out of production entirely.
+const isWarningEnabled = (): boolean => process.env.NODE_ENV !== 'production'
+
+function resolveEntityId(em: EntityManager, entityName: EntityName<any>): string | null {
+  const metadata = (em as any)?.getMetadata?.()
+  if (!metadata || typeof metadata.find !== 'function') return null
+  const name = typeof entityName === 'string' ? entityName : (entityName as any)?.name
+  if (!name) return null
+  return resolveEntityIdFromMetadata(metadata.find(name) ?? undefined)
+}
+
+/**
+ * Warn, outside production, when a `where` clause matches an encrypted-at-rest
+ * column with a string operator.
+ *
+ * Decryption happens on load, not on filter, so the predicate compares a
+ * plaintext pattern against ciphertext: it matches nothing and does not raise,
+ * which is indistinguishable from a genuine empty result. The query engines
+ * already warn about their own `ILIKE` fallback; this covers the raw-ORM path
+ * that never reaches them. Issue #5051, related to #2990.
+ *
+ * Never throws and never blocks the query.
+ */
+export async function warnOnEncryptedLikeFilter(params: {
+  em: EntityManager
+  entityName: EntityName<any>
+  where: unknown
+  tenantId?: string | null
+  encryptionService?: TenantDataEncryptionService | null
+}): Promise<void> {
+  if (!isWarningEnabled()) return
+  const fields = collectLikeFilterFields(params.where)
+  if (!fields.length) return
+  try {
+    const entity = resolveEntityId(params.em, params.entityName)
+    if (!entity) return
+    const service = params.encryptionService ?? resolveTenantEncryptionService(params.em)
+    await warnOnCiphertextLikeFallback({
+      entity,
+      fields,
+      tenantId: params.tenantId ?? null,
+      reason: 'raw-orm-filter',
+      service,
+    })
+  } catch {
+    // A diagnostic must never break the query it is diagnosing.
+  }
+}

package/src/lib/i18n/__tests__/dictionary-cache.test.ts

@@ -41,6 +41,29 @@ describe('i18n dictionary memoization', () => {
     expect(loader).toHaveBeenCalledTimes(2)
   })
 
+  it('keeps other locale dictionaries cached after locale-scoped module registration', async () => {
+    const loader = jest.fn(async (locale: Locale) => ({ greeting: locale }))
+    registerAppDictionaryLoader(loader)
+    registerModules([
+      { id: 'demo', translations: { en: { module: 'English' }, pl: { module: 'Polski' } } },
+    ] as any)
+
+    const englishBefore = await loadDictionary('en')
+    const polishBefore = await loadDictionary('pl')
+
+    registerModules([
+      { id: 'demo', translations: { pl: { module: 'Polski 2' } } },
+    ] as any)
+
+    const englishAfter = await loadDictionary('en')
+    const polishAfter = await loadDictionary('pl')
+
+    expect(englishAfter).toBe(englishBefore)
+    expect(polishAfter).not.toBe(polishBefore)
+    expect(polishAfter.module).toBe('Polski 2')
+    expect(loader).toHaveBeenCalledTimes(3)
+  })
+
   it('rebuilds after modules are re-registered', async () => {
     registerAppDictionaryLoader(async () => ({}))
     registerModules([{ translations: { en: { a: 'one' } } }] as any)

package/src/lib/i18n/dictionary-cache.ts

@@ -33,3 +33,8 @@ export function setCachedDictionary(locale: Locale, dict: Dict): void {
 export function invalidateDictionaryCache(): void {
   getCache().clear()
 }
+
+export function invalidateDictionaryCacheLocales(locales: readonly Locale[]): void {
+  const cache = getCache()
+  for (const locale of locales) cache.delete(locale)
+}

package/src/lib/modules/__tests__/registry.test.ts

@@ -145,4 +145,30 @@ describe('shared modules registry', () => {
       }),
     ])
   })
+
+  it('preserves translations when runtime modules register after locale shards', () => {
+    const registry = loadRegistry()
+    const handler = jest.fn()
+    registry.registerModules([
+      {
+        id: 'checkout',
+        translations: { pl: { title: 'Kasa' } },
+      } as Module,
+    ])
+
+    registry.registerModules([
+      {
+        id: 'checkout',
+        subscribers: [{ id: 'checkout-gateway-payment-failed', event: 'payment_gateways.payment.failed', handler }],
+      } as Module,
+    ])
+
+    expect(registry.getModules()).toEqual([
+      expect.objectContaining({
+        id: 'checkout',
+        subscribers: [expect.objectContaining({ id: 'checkout-gateway-payment-failed' })],
+        translations: { pl: { title: 'Kasa' } },
+      }),
+    ])
+  })
 })

package/src/lib/modules/registry.ts

@@ -1,6 +1,7 @@
 import type { Module } from '@open-mercato/shared/modules/registry'
 import { applyModuleOverridesToModules } from '@open-mercato/shared/modules/overrides'
-import { invalidateDictionaryCache } from '../i18n/dictionary-cache'
+import type { Locale } from '../i18n/config'
+import { invalidateDictionaryCache, invalidateDictionaryCacheLocales } from '../i18n/dictionary-cache'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'modules-registry' })
@@ -38,7 +39,10 @@ function mergeI18nModules(existing: Module[], incoming: Module[]): Module[] {
     if (!i18nModule?.translations) return entry
     return {
       ...entry,
-      translations: i18nModule.translations,
+      translations: {
+        ...(entry.translations ?? {}),
+        ...i18nModule.translations,
+      },
     }
   })
 
@@ -49,17 +53,42 @@ function mergeI18nModules(existing: Module[], incoming: Module[]): Module[] {
   return merged
 }
 
+function getTranslationLocales(modules: Module[]): Locale[] {
+  const locales = new Set<Locale>()
+  for (const entry of modules) {
+    for (const locale of Object.keys(entry.translations ?? {})) {
+      locales.add(locale as Locale)
+    }
+  }
+  return [...locales]
+}
+
+function preserveExistingTranslations(existing: Module[], incoming: Module[]): Module[] {
+  const existingById = new Map(existing.map((entry) => [entry.id, entry]))
+  return incoming.map((entry) => {
+    if (entry.translations) return entry
+    const translations = existingById.get(entry.id)?.translations
+    return translations ? { ...entry, translations } : entry
+  })
+}
+
 export function registerModules(modules: Module[]) {
   const existing = getGlobalModules()
   if (existing !== null && process.env.NODE_ENV === 'development') {
     logger.debug('Modules re-registered (this may occur during HMR)')
   }
   const nextModules = applyModuleOverridesToModules(modules)
-  const shouldMergeI18nOnly = existing !== null
-    && existing.some(hasRuntimeContracts)
-    && isI18nOnlyRegistration(nextModules)
-  setGlobalModules(shouldMergeI18nOnly ? mergeI18nModules(existing, nextModules) : nextModules)
-  invalidateDictionaryCache()
+  const i18nOnlyRegistration = isI18nOnlyRegistration(nextModules)
+  const shouldMergeI18nOnly = existing !== null && i18nOnlyRegistration
+  const registeredModules = shouldMergeI18nOnly
+    ? mergeI18nModules(existing, nextModules)
+    : preserveExistingTranslations(existing ?? [], nextModules)
+  setGlobalModules(registeredModules)
+  if (i18nOnlyRegistration) {
+    invalidateDictionaryCacheLocales(getTranslationLocales(nextModules))
+  } else {
+    invalidateDictionaryCache()
+  }
 }
 
 export function getModules(): Module[] {

package/src/lib/query/ciphertext-search-warning.ts

@@ -16,7 +16,22 @@ export type CiphertextWarningEncryptionService = {
   isEnabled?: () => boolean
 } | null | undefined
 
-export type CiphertextLikeFallbackReason = 'no-indexable-tokens' | 'no-search-tokens' | 'search-disabled'
+export type CiphertextLikeFallbackReason =
+  | 'no-indexable-tokens'
+  | 'no-search-tokens'
+  | 'search-disabled'
+  | 'raw-orm-filter'
+
+const REASON_HINTS: Record<CiphertextLikeFallbackReason, string> = {
+  'search-disabled':
+    'OM_SEARCH_ENABLED is off, so the filter runs as ILIKE against ciphertext and matches nothing.',
+  'no-indexable-tokens':
+    'The filter value produced no search tokens, so it runs as ILIKE against ciphertext and matches nothing. Use at least OM_SEARCH_MIN_LEN indexable characters, or filter on the deterministic hash column.',
+  'no-search-tokens':
+    'No search_tokens exist for this entity and scope, so the filter runs as ILIKE against ciphertext and matches nothing. Index the entity through query_index and reindex, or filter on the deterministic hash column.',
+  'raw-orm-filter':
+    'This filter bypasses the query engine, so it runs as ILIKE against ciphertext and matches nothing. Resolve ids through findEntityIdsBySearchTokens (@open-mercato/shared/lib/search/tokenLookup), filter on the deterministic hash column, or compare in memory after decryption.',
+}
 
 // One warning per entity/tenant/field per process — the fallback repeats on
 // every request, and an operator only needs to learn about it once.
@@ -79,11 +94,7 @@ export async function warnOnCiphertextLikeFallback(params: {
         entity,
         field,
         reason,
-        hint: reason === 'search-disabled'
-          ? 'OM_SEARCH_ENABLED is off, so the filter runs as ILIKE against ciphertext and matches nothing.'
-          : reason === 'no-indexable-tokens'
-            ? 'The filter value produced no search tokens, so it runs as ILIKE against ciphertext and matches nothing. Use at least OM_SEARCH_MIN_LEN indexable characters, or filter on the deterministic hash column.'
-            : 'No search_tokens exist for this entity and scope, so the filter runs as ILIKE against ciphertext and matches nothing. Index the entity through query_index and reindex, or filter on the deterministic hash column.',
+        hint: REASON_HINTS[reason],
       })
     }
   } catch (err) {