@open-mercato/shared 0.6.8-develop.7015.1.af90a2ddc7 → 0.6.8-develop.7016.1.4ed7b1e49d

package/src/lib/auth/server.ts

@@ -195,13 +195,33 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       : []
     const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)
 
+    // A role-level super-admin grant is authorization-grade only when it is genuinely
+    // unrestricted: the grant itself must not be organization-scoped, it must belong to the
+    // key's tenant, and the key must not be bound to a single organization. RbacService applies
+    // the same intersection when projecting the scoped ACL, but generic guards
+    // (tenantAccess.resolveIsSuperAdmin, the scoped-API helpers) trust this raw bit *before*
+    // live RBAC runs — so an organization-restricted key must never carry it.
     let keyIsSuperAdmin = false
-    if (roleIds.length) {
-      const superAcl = await em.findOne(
+    const keyOrganizationId = typeof record.organizationId === 'string' && record.organizationId.trim().length > 0
+      ? record.organizationId.trim()
+      : null
+    if (roleIds.length && !keyOrganizationId) {
+      const superAcls = await em.find(
         RoleAcl,
-        { role: { $in: roleIds } as any, isSuperAdmin: true, deletedAt: null } as any,
+        {
+          role: { $in: roleIds } as any,
+          tenantId: record.tenantId ?? null,
+          isSuperAdmin: true,
+          deletedAt: null,
+        } as any,
       )
-      keyIsSuperAdmin = !!(superAcl && (superAcl as { isSuperAdmin?: boolean }).isSuperAdmin)
+      keyIsSuperAdmin = superAcls.some((acl) => {
+        const organizations = Array.isArray((acl as { organizationsJson?: string[] | null }).organizationsJson)
+          ? (acl as { organizationsJson?: string[] | null }).organizationsJson as string[]
+          : null
+        // An empty list means "inherit the key's own binding"; with no binding that is tenant-wide.
+        return !organizations || organizations.length === 0 || organizations.includes('__all__')
+      })
     }
 
     if (cache.shouldWriteLastUsed(record.id)) {
@@ -213,8 +233,25 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       }
     }
 
-    // For session keys, use sessionUserId; for regular keys, use createdBy
-    const actualUserId = record.sessionUserId ?? record.createdBy ?? null
+    // Ephemeral session keys are always user-bound. Regular keys retain their
+    // legacy creator identity, while tenant-scoped regular keys ignore only the
+    // creator's concrete organization when validating the wider key scope.
+    // Keep every session marker fail-closed so a malformed session key cannot
+    // fall back to the regular key path and escape its user/scope binding.
+    const isSessionBoundKey = Boolean(
+      record.sessionToken
+      || record.sessionUserId
+      || record.sessionSecretEncrypted
+      || record.opencodeSessionId
+    )
+    const actualUserId = isSessionBoundKey
+      ? record.sessionUserId ?? null
+      : record.createdBy ?? null
+
+    if (isSessionBoundKey && !actualUserId) {
+      cache.setMiss(secret)
+      return null
+    }
 
     if (actualUserId) {
       const user = await em.findOne(User, { id: actualUserId, deletedAt: null })
@@ -226,7 +263,8 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
         cache.setMiss(secret)
         return null
       }
-      if ((user.organizationId ?? null) !== (record.organizationId ?? null)) {
+      const requiresExactOrganization = isSessionBoundKey || Boolean(record.organizationId)
+      if (requiresExactOrganization && (user.organizationId ?? null) !== (record.organizationId ?? null)) {
         cache.setMiss(secret)
         return null
       }

package/src/lib/data/__tests__/engine.event-validation.test.ts

@@ -68,7 +68,15 @@ describe('DataEngine event contract validation (issue #1421)', () => {
       })
 
       expect(emitted).toEqual([
-        expect.objectContaining({ name: 'issue1421_test.widget.created' }),
+        expect.objectContaining({
+          name: 'issue1421_test.widget.created',
+          options: {
+            persistent: false,
+            tenantId: 'tenant-1',
+            organizationId: 'org-1',
+            emitterModuleId: 'issue1421_test',
+          },
+        }),
       ])
       expect(loggerWarn).not.toHaveBeenCalled()
     } finally {

package/src/lib/data/engine.ts

@@ -226,7 +226,12 @@ export class DefaultDataEngine implements DataEngine {
           const eventName = `${mod}.${ent}.updated`
           warnIfUndeclaredEvent(eventName, 'setCustomFields')
           try {
-            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, { persistent: true })
+            await bus.emitEvent(eventName, { id: recordId, organizationId, tenantId }, {
+              persistent: true,
+              tenantId,
+              organizationId,
+              emitterModuleId: mod,
+            })
           } catch {
             // non-blocking
           }
@@ -627,6 +632,7 @@ export class DefaultDataEngine implements DataEngine {
           persistent: !!events.persistent,
           tenantId: ctx.identifiers.tenantId ?? null,
           organizationId: ctx.identifiers.organizationId ?? null,
+          emitterModuleId: events.module,
         })
       } catch {
         // non-blocking

package/src/modules/events/__tests__/factory.test.ts

@@ -0,0 +1,88 @@
+const GLOBAL_EVENT_REGISTRY_KEY = '__openMercatoEventDefinitionRegistry__'
+
+type EventFactoryModule = typeof import('../factory')
+
+describe('event definition registry', () => {
+  const globalScope = globalThis as Record<string, unknown>
+  const originalRegistry = globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+
+  beforeEach(() => {
+    delete globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+  })
+
+  afterAll(() => {
+    if (originalRegistry === undefined) {
+      delete globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+    } else {
+      globalScope[GLOBAL_EVENT_REGISTRY_KEY] = originalRegistry
+    }
+  })
+
+  it('shares declarations and registered configs across isolated module instances', () => {
+    let firstInstance: EventFactoryModule | undefined
+    let secondInstance: EventFactoryModule | undefined
+
+    jest.isolateModules(() => {
+      firstInstance = require('../factory') as EventFactoryModule
+      const config = firstInstance.createModuleEvents({
+        moduleId: 'isolated_events_test',
+        events: [{
+          id: 'isolated_events_test.invalidated',
+          label: 'Invalidated',
+          crossProcessBroadcast: true,
+        }] as const,
+      })
+      firstInstance.registerEventModuleConfigs([config])
+    })
+
+    jest.isolateModules(() => {
+      secondInstance = require('../factory') as EventFactoryModule
+    })
+
+    expect(secondInstance).not.toBe(firstInstance)
+    expect(secondInstance?.isEventDeclared('isolated_events_test.invalidated')).toBe(true)
+    expect(secondInstance?.isCrossProcessBroadcastEvent('isolated_events_test.invalidated')).toBe(true)
+    expect(secondInstance?.getDeclaredEvents()).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        id: 'isolated_events_test.invalidated',
+        module: 'isolated_events_test',
+      }),
+    ]))
+    expect(secondInstance?.getEventModuleConfigs()).toHaveLength(1)
+  })
+
+  it('refreshes a module definition during HMR without duplicating its event id', () => {
+    let firstInstance: EventFactoryModule | undefined
+    let secondInstance: EventFactoryModule | undefined
+
+    jest.isolateModules(() => {
+      firstInstance = require('../factory') as EventFactoryModule
+      firstInstance.createModuleEvents({
+        moduleId: 'hmr_events_test',
+        events: [{ id: 'hmr_events_test.changed', label: 'Before' }] as const,
+      })
+    })
+
+    jest.isolateModules(() => {
+      secondInstance = require('../factory') as EventFactoryModule
+      secondInstance.createModuleEvents({
+        moduleId: 'hmr_events_test',
+        events: [{
+          id: 'hmr_events_test.changed',
+          label: 'After',
+          clientBroadcast: true,
+        }] as const,
+      })
+    })
+
+    expect(firstInstance?.isBroadcastEvent('hmr_events_test.changed')).toBe(true)
+    expect(firstInstance?.getAllDeclaredEventIds()).toEqual(['hmr_events_test.changed'])
+    expect(firstInstance?.getDeclaredEvents()).toEqual([
+      expect.objectContaining({
+        id: 'hmr_events_test.changed',
+        label: 'After',
+        clientBroadcast: true,
+      }),
+    ])
+  })
+})

package/src/modules/events/factory.ts

@@ -65,17 +65,54 @@ export function getGlobalEventBus(): GlobalEventBus | null {
 // Event Registry for Validation
 // =============================================================================
 
-// Global set of all declared event IDs for runtime validation
-const allDeclaredEventIds = new Set<string>()
+type EventRegistryState = {
+  declaredEventIds: Set<string>
+  declaredEvents: EventDefinition[]
+  registeredEventConfigs: EventModuleConfig[] | null
+}
+
+const GLOBAL_EVENT_REGISTRY_KEY = '__openMercatoEventDefinitionRegistry__'
+
+const fallbackEventRegistryState: EventRegistryState = {
+  declaredEventIds: new Set<string>(),
+  declaredEvents: [],
+  registeredEventConfigs: null,
+}
+
+function isEventRegistryState(value: unknown): value is EventRegistryState {
+  if (!value || typeof value !== 'object') return false
+  const candidate = value as Partial<EventRegistryState>
+  return candidate.declaredEventIds instanceof Set
+    && Array.isArray(candidate.declaredEvents)
+    && (candidate.registeredEventConfigs === null || Array.isArray(candidate.registeredEventConfigs))
+}
 
-// Global registry of all declared events with their full definitions
-const allDeclaredEvents: EventDefinition[] = []
+function getEventRegistryState(): EventRegistryState {
+  try {
+    const globalScope = globalThis as Record<string, unknown>
+    const existing = globalScope[GLOBAL_EVENT_REGISTRY_KEY]
+    if (isEventRegistryState(existing)) return existing
+    globalScope[GLOBAL_EVENT_REGISTRY_KEY] = fallbackEventRegistryState
+    return fallbackEventRegistryState
+  } catch {
+    // Restricted runtimes may deny global access. Keep the previous
+    // module-local behavior as a safe fallback.
+    return fallbackEventRegistryState
+  }
+}
 
 function addDeclaredEvent(event: EventDefinition): void {
-  allDeclaredEventIds.add(event.id)
-  // Avoid duplicates if createModuleEvents/registerEventModuleConfigs is called multiple times (e.g., HMR)
-  if (!allDeclaredEvents.find(e => e.id === event.id)) {
-    allDeclaredEvents.push(event)
+  const state = getEventRegistryState()
+  state.declaredEventIds.add(event.id)
+  const existingIndex = state.declaredEvents.findIndex((candidate) => candidate.id === event.id)
+  if (existingIndex < 0) {
+    state.declaredEvents.push(event)
+    return
+  }
+  // Refresh a module's own definition in place during HMR without allowing a
+  // duplicate declaration from another module to take over the event id.
+  if (state.declaredEvents[existingIndex]?.module === event.module) {
+    state.declaredEvents[existingIndex] = event
   }
 }
 
@@ -84,7 +121,7 @@ function addDeclaredEvent(event: EventDefinition): void {
  * Used for runtime validation to ensure only declared events are emitted.
  */
 export function isEventDeclared(eventId: string): boolean {
-  return allDeclaredEventIds.has(eventId)
+  return getEventRegistryState().declaredEventIds.has(eventId)
 }
 
 /**
@@ -92,7 +129,7 @@ export function isEventDeclared(eventId: string): boolean {
  * Useful for debugging and introspection.
  */
 export function getAllDeclaredEventIds(): string[] {
-  return Array.from(allDeclaredEventIds)
+  return Array.from(getEventRegistryState().declaredEventIds)
 }
 
 /**
@@ -100,7 +137,7 @@ export function getAllDeclaredEventIds(): string[] {
  * Used by the API to return available events for workflow triggers.
  */
 export function getDeclaredEvents(): EventDefinition[] {
-  return [...allDeclaredEvents]
+  return [...getEventRegistryState().declaredEvents]
 }
 
 /**
@@ -108,16 +145,52 @@ export function getDeclaredEvents(): EventDefinition[] {
  * Used by the SSE endpoint to filter events for the DOM Event Bridge.
  */
 export function isBroadcastEvent(eventId: string): boolean {
-  const event = allDeclaredEvents.find(e => e.id === eventId)
+  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
   return event?.clientBroadcast === true
 }
 
+/**
+ * Check if an event should be published over the server-to-server event bridge.
+ * Browser-broadcast events remain eligible for backward compatibility, while
+ * crossProcessBroadcast supports private process coordination without SSE.
+ */
+export function isCrossProcessBroadcastEvent(eventId: string): boolean {
+  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
+  return event?.clientBroadcast === true || event?.crossProcessBroadcast === true
+}
+
+/**
+ * Check whether an event is reserved for private server-to-server
+ * coordination. Workflow-authored EMIT_EVENT activities must not emit these
+ * events because their payload and event id are tenant-managed input.
+ */
+export function isPrivateCrossProcessBroadcastEvent(eventId: string): boolean {
+  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
+  return event?.crossProcessBroadcast === true && event?.clientBroadcast !== true
+}
+
+/**
+ * Verify provenance for a private cross-process event. The module id is
+ * stamped by a declared module emitter or another trusted server-side seam;
+ * tenant-managed event payloads never participate in this decision.
+ */
+export function isPrivateCrossProcessEventEmitter(
+  eventId: string,
+  emitterModuleId: string | undefined,
+): boolean {
+  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
+  if (event?.crossProcessBroadcast !== true) return true
+  return typeof event.module === 'string'
+    && event.module.length > 0
+    && event.module === emitterModuleId
+}
+
 /**
  * Check if an event has portalBroadcast enabled.
  * Used by the portal SSE endpoint to filter events for the Portal Event Bridge.
  */
 export function isPortalBroadcastEvent(eventId: string): boolean {
-  const event = allDeclaredEvents.find(e => e.id === eventId)
+  const event = getEventRegistryState().declaredEvents.find(e => e.id === eventId)
   return event?.portalBroadcast === true
 }
 
@@ -125,17 +198,16 @@ export function isPortalBroadcastEvent(eventId: string): boolean {
 // Bootstrap Registration (similar to searchModuleConfigs pattern)
 // =============================================================================
 
-let _registeredEventConfigs: EventModuleConfig[] | null = null
-
 /**
  * Register event module configurations globally.
  * Called during app bootstrap with configs from events.generated.ts.
  */
 export function registerEventModuleConfigs(configs: EventModuleConfig[]): void {
-  if (_registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {
+  const state = getEventRegistryState()
+  if (state.registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {
     logger.debug('Event module configs re-registered (this may occur during HMR)')
   }
-  _registeredEventConfigs = configs
+  state.registeredEventConfigs = configs
   for (const config of configs) {
     for (const event of config.events) {
       addDeclaredEvent(event)
@@ -148,7 +220,7 @@ export function registerEventModuleConfigs(configs: EventModuleConfig[]): void {
  * Returns empty array if not registered.
  */
 export function getEventModuleConfigs(): EventModuleConfig[] {
-  return _registeredEventConfigs ?? []
+  return getEventRegistryState().registeredEventConfigs ?? []
 }
 
 // =============================================================================
@@ -239,7 +311,27 @@ export function createModuleEvents<
       return
     }
 
-    await eventBus.emit(eventId, payload, emitOptions)
+    const eventDefinition = fullEvents.find((event) => event.id === eventId)
+    const isClientBroadcast = eventDefinition?.clientBroadcast === true
+    const trustedOptions = eventDefinition?.crossProcessBroadcast === true || isClientBroadcast
+      ? {
+          ...emitOptions,
+          // Browser-broadcast module emitters historically accepted scope in
+          // their typed payload. Preserve that contract at the trusted module
+          // boundary while the event bus itself relies only on options.
+          ...(isClientBroadcast && emitOptions?.tenantId === undefined
+            ? { tenantId: payload.tenantId ?? null }
+            : {}),
+          ...(isClientBroadcast && emitOptions?.organizationId === undefined
+            ? { organizationId: payload.organizationId ?? null }
+            : {}),
+          ...(isClientBroadcast && emitOptions?.organizationIds === undefined && Array.isArray(payload.organizationIds)
+            ? { organizationIds: payload.organizationIds.filter((value): value is string => typeof value === 'string') }
+            : {}),
+          emitterModuleId: moduleId,
+        }
+      : emitOptions
+    await eventBus.emit(eventId, payload, trustedOptions)
   }
 
   return {

package/src/modules/events/types.ts

@@ -34,6 +34,8 @@ export interface EventDefinition {
   excludeFromTriggers?: boolean
   /** When true, this event is bridged to the browser via SSE (DOM Event Bridge). Default: false */
   clientBroadcast?: boolean
+  /** When true, this event is bridged between server processes without enabling browser delivery. Default: false */
+  crossProcessBroadcast?: boolean
   /** When true, this event is bridged to the customer portal via SSE (Portal Event Bridge). Default: false */
   portalBroadcast?: boolean
 }
@@ -66,6 +68,21 @@ export interface EmitOptions {
   tenantId?: string | null
   /** Trusted organization scope forwarded to subscribers separately from the payload */
   organizationId?: string | null
+  /**
+   * Trusted multi-organization audience forwarded to subscribers separately
+   * from the payload. Mirrors the documented SSE audience contract, where a
+   * clientBroadcast event may target several organizations at once; carried in
+   * trusted options so the receiver never falls back to payload scope.
+   */
+  organizationIds?: string[] | null
+  /**
+   * Module that emitted a private cross-process coordination event.
+   *
+   * This is stamped by `createModuleEvents`; application inputs must not set or
+   * derive it from event payloads.
+   * @internal
+   */
+  emitterModuleId?: string
 }
 
 // =============================================================================