@open-mercato/shared 0.8.1-develop.7275.1.f772b944d4 → 0.8.1-develop.7295.1.d0e0e33014

package/src/lib/schedule/interval.ts

@@ -0,0 +1,45 @@
+/**
+ * Canonical interval-format rules for recurring schedules.
+ *
+ * Both the scheduler runtime and the API validators that reject a schedule
+ * before it is persisted read the format from here, so the documented format
+ * (`<number><unit>`, e.g. `15m`, `1h`, `24h`) cannot drift between the layer
+ * that accepts a value and the layer that has to run it.
+ */
+export const MIN_SCHEDULE_INTERVAL_MS = 60 * 1000
+
+export const SCHEDULE_INTERVAL_PATTERN = /^(\d+)(s|m|h|d)$/
+
+const UNIT_MULTIPLIERS: Record<string, number> = {
+  s: 1000,
+  m: 60 * 1000,
+  h: 60 * 60 * 1000,
+  d: 24 * 60 * 60 * 1000,
+}
+
+export type ScheduleIntervalUnit = 's' | 'm' | 'h' | 'd'
+
+export type ScheduleIntervalParts = {
+  amount: number
+  unit: ScheduleIntervalUnit
+}
+
+export function matchScheduleInterval(interval: string): ScheduleIntervalParts | null {
+  const match = SCHEDULE_INTERVAL_PATTERN.exec(interval)
+  if (!match) return null
+  return { amount: Number.parseInt(match[1], 10), unit: match[2] as ScheduleIntervalUnit }
+}
+
+export function parseScheduleInterval(interval: string): number {
+  const parts = matchScheduleInterval(interval)
+  if (!parts) {
+    throw new Error(`Invalid interval format: ${interval}. Expected format: <number><unit> (e.g., 15m, 2h, 1d)`)
+  }
+  return parts.amount * UNIT_MULTIPLIERS[parts.unit]
+}
+
+export function isValidScheduleInterval(interval: string): boolean {
+  const parts = matchScheduleInterval(interval)
+  if (!parts) return false
+  return parts.amount * UNIT_MULTIPLIERS[parts.unit] >= MIN_SCHEDULE_INTERVAL_MS
+}

package/src/lib/schedule/invalidScheduleValue.ts

@@ -0,0 +1,33 @@
+export const INVALID_SCHEDULE_VALUE_CODE = 'INVALID_SCHEDULE_VALUE'
+
+export type ScheduleValueKind = 'cron' | 'interval'
+
+export type InvalidScheduleValueError = Error & {
+  code: typeof INVALID_SCHEDULE_VALUE_CODE
+  scheduleType: ScheduleValueKind
+  scheduleValue: string
+}
+
+export function createInvalidScheduleValueError(
+  scheduleType: ScheduleValueKind,
+  scheduleValue: string,
+  message: string,
+): InvalidScheduleValueError {
+  return Object.assign(new Error(message), {
+    code: INVALID_SCHEDULE_VALUE_CODE,
+    scheduleType,
+    scheduleValue,
+  } as const)
+}
+
+/**
+ * Structural check rather than `instanceof`: the error crosses a package
+ * boundary (and a production bundle), where a duplicated class identity would
+ * make `instanceof` silently false.
+ */
+export function isInvalidScheduleValueError(error: unknown): error is InvalidScheduleValueError {
+  if (typeof error !== 'object' || error === null) return false
+  const candidate = error as { code?: unknown; scheduleType?: unknown }
+  return candidate.code === INVALID_SCHEDULE_VALUE_CODE
+    && (candidate.scheduleType === 'cron' || candidate.scheduleType === 'interval')
+}

package/src/lib/search/__tests__/config.test.ts

@@ -113,6 +113,33 @@ describe('OM_SEARCH_FIELD_BLOCKLIST parsing', () => {
   })
 })
 
+describe('OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS', () => {
+  const originalValue = process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS
+
+  afterEach(() => {
+    if (originalValue === undefined) {
+      delete process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS
+    } else {
+      process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS = originalValue
+    }
+  })
+
+  // #5383: the switch stays off by default until tokenization is made ILIKE-equivalent, so the
+  // rewrite-everything behavior is unchanged for a deployment that does not opt in. #5803 is the
+  // correctness gap this switch closes when a deployment opts in ahead of that follow-up.
+  it('defaults to off so the legacy rewrite is unchanged for every column', () => {
+    delete process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS
+
+    expect(resolveSearchConfig().useIlikeForNonEncryptedFields).toBe(false)
+  })
+
+  it('can be switched on to apply a declared ilike on a plaintext column as written', () => {
+    process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS = 'true'
+
+    expect(resolveSearchConfig().useIlikeForNonEncryptedFields).toBe(true)
+  })
+})
+
 describe('search token limits', () => {
   const variableNames = [
     'OM_SEARCH_MAX_FIELD_CHARS',

package/src/lib/search/__tests__/containment.test.ts

@@ -0,0 +1,61 @@
+import { buildContainmentPatterns, MAX_CONTAINMENT_WORDS } from '../containment'
+
+describe('buildContainmentPatterns (#5803)', () => {
+  test('splits a multi-word contains pattern into one pattern per word', () => {
+    // The token subquery matched every token in any order with anything between them. Reproducing
+    // that on SQL means ANDing per word, which is what TC-RESO-009 exercises through the API:
+    // `?search=Warehouse <stamp>` has to keep matching `Warehouse A <stamp>`.
+    expect(buildContainmentPatterns('%Warehouse 1757%')).toEqual(['%Warehouse%', '%1757%'])
+  })
+
+  test('collapses runs of whitespace rather than emitting empty patterns', () => {
+    expect(buildContainmentPatterns('%John   Smith%')).toEqual(['%John%', '%Smith%'])
+  })
+
+  test('leaves a single-word pattern exactly as the caller declared it', () => {
+    // The reported #5803 case: the distinguishing fragment must reach SQL untouched, or the exact
+    // row cannot come back at all.
+    expect(buildContainmentPatterns('%2026-08%')).toEqual(['%2026-08%'])
+  })
+
+  test('leaves a term too short to tokenize alone', () => {
+    expect(buildContainmentPatterns('%08%')).toEqual(['%08%'])
+  })
+
+  test('keeps escaped wildcards attached to their word', () => {
+    // escapeLikePattern turns a literal `%` into `\%`; splitting must not treat it as a wildcard
+    // and must not tear the escape off its word.
+    expect(buildContainmentPatterns('%50\\% off%')).toEqual(['%50\\%%', '%off%'])
+  })
+
+  test('does not split a structured pattern carrying its own wildcards', () => {
+    // A caller that hand-built `%a% b%` asked for that exact shape; re-splitting it would silently
+    // rewrite a predicate this helper has no business reinterpreting.
+    expect(buildContainmentPatterns('%a% b%')).toEqual(['%a% b%'])
+  })
+
+  test('does not split an anchored pattern', () => {
+    // `startsWith` / `endsWith` terms are anchored on purpose; per-word ANDing would drop the
+    // anchor and widen the match.
+    expect(buildContainmentPatterns('John Smith%')).toEqual(['John Smith%'])
+    expect(buildContainmentPatterns('%John Smith')).toEqual(['%John Smith'])
+  })
+
+  test('treats a trailing escaped percent as a literal, not as the closing wildcard', () => {
+    expect(buildContainmentPatterns('%John Smith\\%')).toEqual(['%John Smith\\%'])
+  })
+
+  test('splits a term at the word cap', () => {
+    const words = Array.from({ length: MAX_CONTAINMENT_WORDS }, (_, index) => `w${index}`)
+    expect(buildContainmentPatterns(`%${words.join(' ')}%`)).toEqual(words.map((word) => `%${word}%`))
+  })
+
+  test('falls back to the single verbatim pattern above the word cap', () => {
+    // Most list routes declare `search` as an unbounded string and this repo ships no trigram
+    // index, so an unbounded per-word AND would let one request compile into an unbounded number
+    // of sequential-scan predicates. Past the cap, this returns to the pre-split behavior instead.
+    const words = Array.from({ length: MAX_CONTAINMENT_WORDS + 1 }, (_, index) => `w${index}`)
+    const pattern = `%${words.join(' ')}%`
+    expect(buildContainmentPatterns(pattern)).toEqual([pattern])
+  })
+})

package/src/lib/search/config.ts

@@ -9,12 +9,34 @@ export type SearchConfig = {
   hashAlgorithm: 'sha256' | 'sha1' | 'md5'
   storeRawTokens: boolean
   /**
-   * When true, a like/ilike on a PLAINTEXT base column runs as exact SQL ILIKE instead of being
-   * rewritten into an approximate search-token match; encrypted columns always keep the token
-   * path (ILIKE against ciphertext cannot match). Off by default: token matching can be faster
-   * than an unanchored ILIKE, which may need a full scan without a trigram index — but it is
-   * approximate (fragments under minTokenLength vanish, so `ZK 1/2026` degrades to its year and
-   * an all-short term drops the predicate). Flip it on when list search must be exact.
+   * When true, a like/ilike on a PLAINTEXT base column runs as SQL ILIKE — one containment
+   * predicate per word of the term, ANDed — instead of being rewritten into an approximate
+   * search-token match; encrypted columns always keep the token path (ILIKE against ciphertext
+   * cannot match).
+   *
+   * Off by default, per #5383: the token store is expected to become faster than ILIKE once
+   * tokenization is made semantically equivalent to it, so the plan there is to keep this switch
+   * off until that follow-up lands rather than trade performance for correctness by default. #5803
+   * documents the correctness gap this switch closes when enabled: the token rewrite is lossy in a
+   * way that silently returns the WRONG record rather than merely extra ones (tokenization splits
+   * on non-alphanumerics and drops fragments under minTokenLength, so `2026-08` and `2026-01` both
+   * reduce to {202, 2026} and a picker offers the neighbouring period; a term that tokenizes to
+   * nothing (`08`) drops the predicate entirely and matches every row) — a deployment that hits
+   * that gap before #5383 lands can opt in here.
+   *
+   * Per-word ANDing (see lib/search/containment) is a trade-off, not a strict improvement, over
+   * the single-literal ILIKE #4622 originally introduced: the token subquery matched a value
+   * carrying every token in any order with anything between them, so `?search=Warehouse 1757`
+   * must keep matching `Warehouse A 1757` — a single verbatim `ILIKE '%Warehouse 1757%'` would
+   * not, and TC-RESO-009 pins that as required behavior. The same word-order independence also
+   * widens multi-word document-number searches: `?search=ZK 1/2026` now also matches
+   * `ZK 11/2026` and `1/2026 ZK`, where the old single-literal ILIKE matched neither.
+   *
+   * Set `OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS=true` to opt into declared-column ILIKE
+   * ahead of #5383 — worth doing when the #5803 wrong-record symptom is hit in practice. Leaving it
+   * unset keeps the legacy rewrite-everything behavior, including the token index's prefix matching
+   * (`?search=ware` matching `Warehouse` when `enablePartials` is on, which literal containment
+   * gives only where the fragment really is a substring).
    */
   useIlikeForNonEncryptedFields?: boolean
   blocklistedFields: string[]

package/src/lib/search/containment.ts

@@ -0,0 +1,66 @@
+/**
+ * Splits a `contains` like/ilike pattern into one pattern per whitespace-separated word, so a
+ * plaintext column taken off the hashed-token path keeps the word-order-independent matching the
+ * token index provided.
+ *
+ * The token path matches a value when it carries EVERY token of the term, in any order and with
+ * anything in between: `?search=Warehouse 1757` matches `Warehouse A 1757`. A single verbatim
+ * `name ILIKE '%Warehouse 1757%'` is literal substring containment, so the `A ` sitting between the
+ * two words defeats it — that is a capability every list grid has today, and #5803's fix must not
+ * take it away (`TC-RESO-009` pins it).
+ *
+ * ANDing one containment predicate per word reproduces the token semantics exactly on a column the
+ * engine can read, without the token path's two lossy steps: nothing is dropped for being shorter
+ * than `minTokenLength` (`?search=08` filters instead of matching every row) and nothing is split on
+ * non-alphanumerics (`?search=2026-08` no longer collapses onto `2026-01`).
+ *
+ * Splitting is deliberately narrow — a pattern is only split when it is unambiguously the
+ * `%term%` shape `buildIlikeTerm(value, 'contains')` produces:
+ *
+ * - it opens and closes with a wildcard `%` (a trailing `\%` is an escaped literal, not a wildcard);
+ * - the term between them carries no unescaped `%` or `_`, so a hand-built structured pattern such
+ *   as `%a% b%` is left exactly as the caller wrote it;
+ * - the term holds at least two words.
+ *
+ * Anything else returns the input unchanged as a single pattern, which is the caller's existing
+ * behavior.
+ *
+ * The split is also capped at {@link MAX_CONTAINMENT_WORDS} words. Most list routes declare
+ * `search` as an unbounded string, this repository ships no trigram index for the resulting
+ * `ILIKE`, and the hybrid engine's `$or` groups multiply the split across every leaf — so an
+ * attacker-controlled term with thousands of words would otherwise compile into thousands of
+ * sequential-scan predicates from one request. A term at or under the cap keeps the per-word AND
+ * semantics; over the cap it falls back to the single verbatim pattern, which is bounded and was
+ * this helper's own behavior before the split existed.
+ */
+export const MAX_CONTAINMENT_WORDS = 10
+
+export function buildContainmentPatterns(pattern: string): string[] {
+  if (!isWrappedContainsPattern(pattern)) return [pattern]
+  const term = pattern.slice(1, -1)
+  if (hasUnescapedWildcard(term)) return [pattern]
+  const words = term.split(/\s+/).filter((word) => word.length > 0)
+  if (words.length < 2 || words.length > MAX_CONTAINMENT_WORDS) return [pattern]
+  return words.map((word) => `%${word}%`)
+}
+
+function isWrappedContainsPattern(pattern: string): boolean {
+  if (pattern.length < 2) return false
+  if (!pattern.startsWith('%') || !pattern.endsWith('%')) return false
+  return countTrailingBackslashes(pattern, pattern.length - 2) % 2 === 0
+}
+
+function hasUnescapedWildcard(term: string): boolean {
+  for (let index = 0; index < term.length; index += 1) {
+    const char = term[index]
+    if (char !== '%' && char !== '_') continue
+    if (countTrailingBackslashes(term, index - 1) % 2 === 0) return true
+  }
+  return false
+}
+
+function countTrailingBackslashes(value: string, fromIndex: number): number {
+  let count = 0
+  for (let index = fromIndex; index >= 0 && value[index] === '\\'; index -= 1) count += 1
+  return count
+}