@open-mercato/shared 0.6.8-develop.7049.1.b41427429a → 0.6.8-develop.7051.1.2e20648fd5

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 264 entry points
+[build:shared] found 265 entry points
 [build:shared] built successfully

package/dist/lib/search/entityAccess.js

@@ -0,0 +1,44 @@
+import { authorizeFeatures } from "../../security/featurePolicy.js";
+function canReadSearchEntity(entityId, lookup, subject, options = {}) {
+  if (subject.isSuperAdmin) return true;
+  const config = lookup.getEntityConfig(entityId);
+  if (!config) {
+    options.onDeny?.(entityId, "unconfigured");
+    return false;
+  }
+  const required = config.aclFeatures;
+  if (!required || required.length === 0) {
+    options.onDeny?.(entityId, "no-acl-features");
+    return false;
+  }
+  const allowed = authorizeFeatures(required, {
+    grantedFeatures: subject.grantedFeatures,
+    unrestricted: false
+  });
+  if (!allowed) options.onDeny?.(entityId, "insufficient-features");
+  return allowed;
+}
+function resolveReadableEntityTypes(lookup, subject, requestedEntityTypes) {
+  if (subject.isSuperAdmin) return requestedEntityTypes;
+  const readable = lookup.getAllEntityConfigs().filter((config) => config.enabled !== false).map((config) => config.entityId).filter((entityId) => canReadSearchEntity(entityId, lookup, subject));
+  if (!requestedEntityTypes) return readable;
+  const requested = new Set(requestedEntityTypes);
+  return readable.filter((entityId) => requested.has(entityId));
+}
+function filterSearchResultsByEntityAccess(results, lookup, subject, options = {}) {
+  if (subject.isSuperAdmin) return [...results];
+  const decisions = /* @__PURE__ */ new Map();
+  return results.filter((result) => {
+    const cached = decisions.get(result.entityId);
+    if (cached !== void 0) return cached;
+    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options);
+    decisions.set(result.entityId, allowed);
+    return allowed;
+  });
+}
+export {
+  canReadSearchEntity,
+  filterSearchResultsByEntityAccess,
+  resolveReadableEntityTypes
+};
+//# sourceMappingURL=entityAccess.js.map

package/dist/lib/search/entityAccess.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/search/entityAccess.ts"],
+  "sourcesContent": ["import type { SearchEntityConfig } from '../../modules/search'\nimport { authorizeFeatures } from '../../security/featurePolicy'\n\n/**\n * Minimal shape of the `searchIndexer` DI service consumed by per-entity ACL\n * resolution. Kept structural so callers and tests can pass a plain object\n * instead of constructing a full `SearchIndexer`.\n */\nexport type SearchEntityConfigLookup = {\n  getEntityConfig: (entityId: string) => SearchEntityConfig | undefined\n  getAllEntityConfigs: () => SearchEntityConfig[]\n}\n\nexport type SearchEntityAccessSubject = {\n  grantedFeatures: readonly string[]\n  isSuperAdmin?: boolean\n}\n\nexport type SearchEntityDenyReason =\n  /** No module declares this entity in a `search.ts` config. */\n  | 'unconfigured'\n  /** The entity is configured for search but declares no `aclFeatures`. */\n  | 'no-acl-features'\n  /** The caller does not hold the entity's declared view feature(s). */\n  | 'insufficient-features'\n\nexport type SearchEntityAccessOptions = {\n  /**\n   * Called once per denied entity type. Exists so a silent drop is diagnosable:\n   * results disappearing because a module forgot to declare `aclFeatures` looks\n   * identical, from the palette, to results that simply did not match.\n   */\n  onDeny?: (entityId: string, reason: SearchEntityDenyReason) => void\n}\n\n/**\n * Decide whether a caller may see results for one entity type.\n *\n * The single `search.global` gate on the palette only says \"this user may use\n * global search\"; it says nothing about which records they may read. Each entity\n * declares the owning module's view feature(s) in `aclFeatures`, and those are\n * what actually authorize the read \u2014 the same rule the `search_get` /\n * `search_aggregate` AI tools already apply.\n *\n * Fails closed: an entity that is not registered for search, or that declares no\n * `aclFeatures`, is never exposed to a non-superadmin caller.\n */\nexport function canReadSearchEntity(\n  entityId: string,\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  options: SearchEntityAccessOptions = {},\n): boolean {\n  if (subject.isSuperAdmin) return true\n\n  const config = lookup.getEntityConfig(entityId)\n  if (!config) {\n    options.onDeny?.(entityId, 'unconfigured')\n    return false\n  }\n\n  const required = config.aclFeatures\n  if (!required || required.length === 0) {\n    options.onDeny?.(entityId, 'no-acl-features')\n    return false\n  }\n\n  const allowed = authorizeFeatures(required, {\n    grantedFeatures: subject.grantedFeatures,\n    unrestricted: false,\n  })\n  if (!allowed) options.onDeny?.(entityId, 'insufficient-features')\n  return allowed\n}\n\n/**\n * The entity types this caller may read, narrowed to `requestedEntityTypes` when\n * the caller asked for specific ones.\n *\n * Restricting the query up front is what keeps `limit` meaningful. Filtering only\n * after the search would spend the whole result budget on records the caller\n * cannot see: an employee granted just `customers.people.view` would get the top\n * 50 hits across every entity type, then watch most of them be dropped, and the\n * palette would look empty even with hundreds of matching people behind it.\n *\n * Returns `undefined` when no restriction applies (superadmin with no explicit\n * request), and an empty array when nothing is readable \u2014 callers should\n * short-circuit on that rather than pass it down as \"no filter\".\n */\nexport function resolveReadableEntityTypes(\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  requestedEntityTypes?: string[],\n): string[] | undefined {\n  if (subject.isSuperAdmin) return requestedEntityTypes\n\n  const readable = lookup\n    .getAllEntityConfigs()\n    .filter((config) => config.enabled !== false)\n    .map((config) => config.entityId)\n    .filter((entityId) => canReadSearchEntity(entityId, lookup, subject))\n\n  if (!requestedEntityTypes) return readable\n  const requested = new Set(requestedEntityTypes)\n  return readable.filter((entityId) => requested.has(entityId))\n}\n\n/**\n * Drop the results whose entity type the caller is not allowed to read.\n *\n * Filtering happens server-side so an under-privileged caller never receives the\n * presenter title, subtitle or deep link of a record they cannot open. Decisions\n * are memoized per entity type because a single response commonly mixes dozens of\n * results across a handful of types.\n */\nexport function filterSearchResultsByEntityAccess<T extends { entityId: string }>(\n  results: readonly T[],\n  lookup: SearchEntityConfigLookup,\n  subject: SearchEntityAccessSubject,\n  options: SearchEntityAccessOptions = {},\n): T[] {\n  if (subject.isSuperAdmin) return [...results]\n\n  const decisions = new Map<string, boolean>()\n  return results.filter((result) => {\n    const cached = decisions.get(result.entityId)\n    if (cached !== undefined) return cached\n    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options)\n    decisions.set(result.entityId, allowed)\n    return allowed\n  })\n}\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AA8C3B,SAAS,oBACd,UACA,QACA,SACA,UAAqC,CAAC,GAC7B;AACT,MAAI,QAAQ,aAAc,QAAO;AAEjC,QAAM,SAAS,OAAO,gBAAgB,QAAQ;AAC9C,MAAI,CAAC,QAAQ;AACX,YAAQ,SAAS,UAAU,cAAc;AACzC,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,OAAO;AACxB,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,YAAQ,SAAS,UAAU,iBAAiB;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,kBAAkB,UAAU;AAAA,IAC1C,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,EAChB,CAAC;AACD,MAAI,CAAC,QAAS,SAAQ,SAAS,UAAU,uBAAuB;AAChE,SAAO;AACT;AAgBO,SAAS,2BACd,QACA,SACA,sBACsB;AACtB,MAAI,QAAQ,aAAc,QAAO;AAEjC,QAAM,WAAW,OACd,oBAAoB,EACpB,OAAO,CAAC,WAAW,OAAO,YAAY,KAAK,EAC3C,IAAI,CAAC,WAAW,OAAO,QAAQ,EAC/B,OAAO,CAAC,aAAa,oBAAoB,UAAU,QAAQ,OAAO,CAAC;AAEtE,MAAI,CAAC,qBAAsB,QAAO;AAClC,QAAM,YAAY,IAAI,IAAI,oBAAoB;AAC9C,SAAO,SAAS,OAAO,CAAC,aAAa,UAAU,IAAI,QAAQ,CAAC;AAC9D;AAUO,SAAS,kCACd,SACA,QACA,SACA,UAAqC,CAAC,GACjC;AACL,MAAI,QAAQ,aAAc,QAAO,CAAC,GAAG,OAAO;AAE5C,QAAM,YAAY,oBAAI,IAAqB;AAC3C,SAAO,QAAQ,OAAO,CAAC,WAAW;AAChC,UAAM,SAAS,UAAU,IAAI,OAAO,QAAQ;AAC5C,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,UAAU,oBAAoB,OAAO,UAAU,QAAQ,SAAS,OAAO;AAC7E,cAAU,IAAI,OAAO,UAAU,OAAO;AACtC,WAAO;AAAA,EACT,CAAC;AACH;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.8-develop.7049.1.b41427429a";
+const APP_VERSION = "0.6.8-develop.7051.1.2e20648fd5";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7049.1.b41427429a';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.8-develop.7051.1.2e20648fd5';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.8-develop.7049.1.b41427429a",
+  "version": "0.6.8-develop.7051.1.2e20648fd5",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -109,7 +109,7 @@
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/cache": "0.6.8-develop.7049.1.b41427429a",
+    "@open-mercato/cache": "0.6.8-develop.7051.1.2e20648fd5",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/search/entityAccess.ts

@@ -0,0 +1,132 @@
+import type { SearchEntityConfig } from '../../modules/search'
+import { authorizeFeatures } from '../../security/featurePolicy'
+
+/**
+ * Minimal shape of the `searchIndexer` DI service consumed by per-entity ACL
+ * resolution. Kept structural so callers and tests can pass a plain object
+ * instead of constructing a full `SearchIndexer`.
+ */
+export type SearchEntityConfigLookup = {
+  getEntityConfig: (entityId: string) => SearchEntityConfig | undefined
+  getAllEntityConfigs: () => SearchEntityConfig[]
+}
+
+export type SearchEntityAccessSubject = {
+  grantedFeatures: readonly string[]
+  isSuperAdmin?: boolean
+}
+
+export type SearchEntityDenyReason =
+  /** No module declares this entity in a `search.ts` config. */
+  | 'unconfigured'
+  /** The entity is configured for search but declares no `aclFeatures`. */
+  | 'no-acl-features'
+  /** The caller does not hold the entity's declared view feature(s). */
+  | 'insufficient-features'
+
+export type SearchEntityAccessOptions = {
+  /**
+   * Called once per denied entity type. Exists so a silent drop is diagnosable:
+   * results disappearing because a module forgot to declare `aclFeatures` looks
+   * identical, from the palette, to results that simply did not match.
+   */
+  onDeny?: (entityId: string, reason: SearchEntityDenyReason) => void
+}
+
+/**
+ * Decide whether a caller may see results for one entity type.
+ *
+ * The single `search.global` gate on the palette only says "this user may use
+ * global search"; it says nothing about which records they may read. Each entity
+ * declares the owning module's view feature(s) in `aclFeatures`, and those are
+ * what actually authorize the read — the same rule the `search_get` /
+ * `search_aggregate` AI tools already apply.
+ *
+ * Fails closed: an entity that is not registered for search, or that declares no
+ * `aclFeatures`, is never exposed to a non-superadmin caller.
+ */
+export function canReadSearchEntity(
+  entityId: string,
+  lookup: SearchEntityConfigLookup,
+  subject: SearchEntityAccessSubject,
+  options: SearchEntityAccessOptions = {},
+): boolean {
+  if (subject.isSuperAdmin) return true
+
+  const config = lookup.getEntityConfig(entityId)
+  if (!config) {
+    options.onDeny?.(entityId, 'unconfigured')
+    return false
+  }
+
+  const required = config.aclFeatures
+  if (!required || required.length === 0) {
+    options.onDeny?.(entityId, 'no-acl-features')
+    return false
+  }
+
+  const allowed = authorizeFeatures(required, {
+    grantedFeatures: subject.grantedFeatures,
+    unrestricted: false,
+  })
+  if (!allowed) options.onDeny?.(entityId, 'insufficient-features')
+  return allowed
+}
+
+/**
+ * The entity types this caller may read, narrowed to `requestedEntityTypes` when
+ * the caller asked for specific ones.
+ *
+ * Restricting the query up front is what keeps `limit` meaningful. Filtering only
+ * after the search would spend the whole result budget on records the caller
+ * cannot see: an employee granted just `customers.people.view` would get the top
+ * 50 hits across every entity type, then watch most of them be dropped, and the
+ * palette would look empty even with hundreds of matching people behind it.
+ *
+ * Returns `undefined` when no restriction applies (superadmin with no explicit
+ * request), and an empty array when nothing is readable — callers should
+ * short-circuit on that rather than pass it down as "no filter".
+ */
+export function resolveReadableEntityTypes(
+  lookup: SearchEntityConfigLookup,
+  subject: SearchEntityAccessSubject,
+  requestedEntityTypes?: string[],
+): string[] | undefined {
+  if (subject.isSuperAdmin) return requestedEntityTypes
+
+  const readable = lookup
+    .getAllEntityConfigs()
+    .filter((config) => config.enabled !== false)
+    .map((config) => config.entityId)
+    .filter((entityId) => canReadSearchEntity(entityId, lookup, subject))
+
+  if (!requestedEntityTypes) return readable
+  const requested = new Set(requestedEntityTypes)
+  return readable.filter((entityId) => requested.has(entityId))
+}
+
+/**
+ * Drop the results whose entity type the caller is not allowed to read.
+ *
+ * Filtering happens server-side so an under-privileged caller never receives the
+ * presenter title, subtitle or deep link of a record they cannot open. Decisions
+ * are memoized per entity type because a single response commonly mixes dozens of
+ * results across a handful of types.
+ */
+export function filterSearchResultsByEntityAccess<T extends { entityId: string }>(
+  results: readonly T[],
+  lookup: SearchEntityConfigLookup,
+  subject: SearchEntityAccessSubject,
+  options: SearchEntityAccessOptions = {},
+): T[] {
+  if (subject.isSuperAdmin) return [...results]
+
+  const decisions = new Map<string, boolean>()
+  return results.filter((result) => {
+    const cached = decisions.get(result.entityId)
+    if (cached !== undefined) return cached
+    const allowed = canReadSearchEntity(result.entityId, lookup, subject, options)
+    decisions.set(result.entityId, allowed)
+    return allowed
+  })
+}