@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/lib/commands/__tests__/command-bus.test.ts

@@ -49,6 +49,181 @@ describe('CommandBus', () => {
     expect(logEntry).toEqual({ id: 'log-entry' })
   })
 
+  it('authorizes undo before claiming the log or running mutations', async () => {
+    const authorizeReplay = jest.fn(async () => {
+      throw new Error('replay denied')
+    })
+    const undo = jest.fn(async () => undefined)
+    const claimForUndo = jest.fn(async () => true)
+    const markUndone = jest.fn(async () => undefined)
+    registerCommand({
+      id: 'test.command.undo-guarded',
+      execute: jest.fn(),
+      authorizeReplay,
+      undo,
+    })
+
+    const logEntry = {
+      id: 'log-guarded',
+      commandId: 'test.command.undo-guarded',
+      commandPayload: { __redoInput: { id: 'record-1' } },
+    }
+    const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
+    container.register({
+      actionLogService: asValue({
+        findByUndoToken: jest.fn(async () => logEntry),
+        claimForUndo,
+        markUndone,
+      }),
+    })
+    const ctx = {
+      container,
+      auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: null },
+      organizationScope: null,
+      selectedOrganizationId: null,
+      organizationIds: null,
+    }
+
+    await expect(new CommandBus().undo('undo-token', ctx)).rejects.toThrow('replay denied')
+
+    expect(authorizeReplay).toHaveBeenCalledWith(
+      expect.objectContaining({ operation: 'undo', logEntry })
+    )
+    expect(claimForUndo).not.toHaveBeenCalled()
+    expect(undo).not.toHaveBeenCalled()
+    expect(markUndone).not.toHaveBeenCalled()
+  })
+
+  it('authorizes redo before snapshots, mutations, or log writes', async () => {
+    const authorizeReplay = jest.fn(async () => {
+      throw new Error('redo denied')
+    })
+    const prepare = jest.fn(async () => ({ before: { value: 'before' } }))
+    const execute = jest.fn(async () => ({ ok: true }))
+    const undo = jest.fn(async () => undefined)
+    const log = jest.fn(async () => ({ id: 'unexpected-log' }))
+    registerCommand({
+      id: 'test.command.redo-guarded',
+      prepare,
+      execute,
+      authorizeReplay,
+      undo,
+    })
+
+    const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
+    container.register({ actionLogService: asValue({ log }) })
+    const ctx = {
+      container,
+      auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: null },
+      organizationScope: null,
+      selectedOrganizationId: null,
+      organizationIds: null,
+    }
+
+    await expect(
+      new CommandBus().execute('test.command.redo-guarded', {
+        input: { id: 'record-1' },
+        ctx,
+        redoLogEntry: { id: 'source-log', commandId: 'test.command.redo-guarded' },
+      })
+    ).rejects.toThrow('redo denied')
+
+    expect(authorizeReplay).toHaveBeenCalledWith(
+      expect.objectContaining({ operation: 'redo' })
+    )
+    expect(prepare).not.toHaveBeenCalled()
+    expect(execute).not.toHaveBeenCalled()
+    expect(log).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['auth.users.create', 'Password-bearing user create'],
+    ['auth.users.update', 'Password-bearing user update'],
+  ])('persists %s as audit-only without credentials, hashes, payload, or undo token', async (commandId, actionLabel) => {
+    const log = jest.fn(async (entry: Record<string, unknown>) => ({ id: 'log-sensitive', ...entry }))
+    registerCommand({
+      id: commandId,
+      execute: jest.fn(async () => ({ ok: true })),
+      undo: jest.fn(async () => undefined),
+      buildLog: jest.fn(() => ({
+        replayable: false,
+        actionLabel,
+        resourceKind: 'auth.user',
+        resourceId: 'user-1',
+        snapshotAfter: { email: 'person@example.com' },
+        payload: {
+          undo: {
+            after: {
+              passwordHash: '$2b$10$persisted-hash-must-not-survive',
+            },
+          },
+        },
+      })),
+    })
+
+    const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
+    container.register({ actionLogService: asValue({ log }) })
+    const ctx = {
+      container,
+      auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: null },
+      organizationScope: null,
+      selectedOrganizationId: null,
+      organizationIds: null,
+    }
+
+    await new CommandBus().execute(commandId, {
+      input: { password: 'plain-text-secret' },
+      ctx,
+    })
+
+    const persisted = log.mock.calls[0]?.[0]
+    expect(persisted.undoToken).toBeUndefined()
+    expect(persisted.commandPayload).toBeUndefined()
+    const persistedJson = JSON.stringify(persisted)
+    expect(persistedJson).not.toContain('plain-text-secret')
+    expect(persistedJson).not.toContain('persisted-hash-must-not-survive')
+    expect(persistedJson).not.toContain('passwordHash')
+  })
+
+  it('persists a redacted redoInput without dropping the undo token', async () => {
+    // A credential-bearing create must keep the secret out of `action_logs`
+    // WITHOUT losing undo: undoing a create only deletes the row, so suppressing
+    // the whole entry (`replayable: false`) would remove a safe affordance.
+    const log = jest.fn(async (entry: Record<string, unknown>) => ({ id: 'log-redacted', ...entry }))
+    registerCommand({
+      id: 'test.command.redacted-input',
+      execute: jest.fn(async () => ({ ok: true })),
+      undo: jest.fn(async () => undefined),
+      buildLog: jest.fn(() => ({
+        redoInput: { email: 'person@example.com' },
+        actionLabel: 'Create user',
+        resourceKind: 'auth.user',
+        resourceId: 'user-1',
+        payload: { undo: { after: { id: 'user-1', email: 'person@example.com' } } },
+      })),
+    })
+
+    const container = createContainer({ injectionMode: InjectionMode.CLASSIC })
+    container.register({ actionLogService: asValue({ log }) })
+
+    await new CommandBus().execute('test.command.redacted-input', {
+      input: { email: 'person@example.com', password: 'plain-text-secret' },
+      ctx: {
+        container,
+        auth: { sub: 'user-1', tenantId: 'tenant-1', orgId: null },
+        organizationScope: null,
+        selectedOrganizationId: null,
+        organizationIds: null,
+      },
+    })
+
+    const persisted = log.mock.calls[0]?.[0] as Record<string, unknown>
+    const commandPayload = persisted.commandPayload as Record<string, unknown>
+    expect(typeof persisted.undoToken).toBe('string')
+    expect(commandPayload.__redoInput).toEqual({ email: 'person@example.com' })
+    expect(JSON.stringify(persisted)).not.toContain('plain-text-secret')
+  })
+
   it('records the system actor marker when a trusted command has no auth actor', async () => {
     const logMock = jest.fn(async () => ({ id: 'system-log-entry' }))
     registerCommand({

package/src/lib/commands/__tests__/command-bus.undo-toctou.test.ts

@@ -92,7 +92,7 @@ describe('CommandBus.undo TOCTOU race guard', () => {
     const bus = new CommandBus()
     await expect(
       bus.undo('undo-token', { ...ctx, container: buildContainer(service) } as never),
-    ).rejects.toThrow('Undo token already consumed')
+    ).rejects.toThrow('[internal] Undo token already consumed')
 
     expect(undoMock).not.toHaveBeenCalled()
     expect(service.markUndone).not.toHaveBeenCalled()

package/src/lib/commands/__tests__/redo.test.ts

@@ -33,6 +33,10 @@ describe('reviveSnapshotSeed', () => {
     expect(seed.symbol).toBeNull()
     expect(seed.decimalPlaces).toBe(2)
   })
+
+  it('throws on an unparsable date instead of seeding an Invalid Date', () => {
+    expect(() => reviveSnapshotSeed({ id: 'row-1', createdAt: 'not-a-date' })).toThrow('Invalid createdAt snapshot date')
+  })
 })
 
 describe('serializeRowSnapshot', () => {

package/src/lib/commands/__tests__/transaction-lifetime.test.ts

@@ -0,0 +1,118 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { withAtomicFlush } from '../flush'
+import {
+  getTransactionLifetime,
+  onTransactionLifetimeComplete,
+  type TransactionOutcome,
+} from '../transaction-lifetime'
+import { registerTelemetryRuntime, type TelemetryRuntime } from '../../telemetry/runtime'
+
+function buildEntityManager(): EntityManager {
+  return {
+    begin: jest.fn(async () => undefined),
+    commit: jest.fn(async () => undefined),
+    flush: jest.fn(async () => undefined),
+    getUnitOfWork: jest.fn(() => ({
+      computeChangeSets: () => undefined,
+      getChangeSets: () => [],
+    })),
+    rollback: jest.fn(async () => undefined),
+  } as unknown as EntityManager
+}
+
+describe('transaction lifetime', () => {
+  it('isolates concurrent transactions that reuse an EntityManager test double', async () => {
+    const em = buildEntityManager()
+    const lifetimes: object[] = []
+    const outcomes: Array<{ label: string; outcome: TransactionOutcome }> = []
+    let releaseFirst: (() => void) | undefined
+    let markFirstEntered: (() => void) | undefined
+    const firstEntered = new Promise<void>((resolve) => {
+      markFirstEntered = resolve
+    })
+    const firstRelease = new Promise<void>((resolve) => {
+      releaseFirst = resolve
+    })
+
+    const first = withAtomicFlush(em, [async () => {
+      const lifetime = getTransactionLifetime(em)
+      expect(lifetime).not.toBeNull()
+      lifetimes.push(lifetime!)
+      onTransactionLifetimeComplete(em, (outcome) => {
+        outcomes.push({ label: 'first', outcome })
+      })
+      markFirstEntered!()
+      await firstRelease
+    }], { transaction: true })
+
+    await firstEntered
+    await withAtomicFlush(em, [async () => {
+      const lifetime = getTransactionLifetime(em)
+      expect(lifetime).not.toBeNull()
+      lifetimes.push(lifetime!)
+      onTransactionLifetimeComplete(em, (outcome) => {
+        outcomes.push({ label: 'second', outcome })
+      })
+    }], { transaction: true })
+    releaseFirst!()
+    await first
+
+    expect(lifetimes).toHaveLength(2)
+    expect(lifetimes[0]).not.toBe(lifetimes[1])
+    expect(outcomes).toEqual([
+      { label: 'second', outcome: 'committed' },
+      { label: 'first', outcome: 'committed' },
+    ])
+    expect(getTransactionLifetime(em)).toBeNull()
+  })
+
+  it('runs every completion callback after commit and reports failures without rejecting the committed flush', async () => {
+    const em = buildEntityManager()
+    const reportError = jest.fn()
+    const unregister = registerTelemetryRuntime({ reportError } as unknown as TelemetryRuntime)
+    const calls: string[] = []
+    const failure = new Error('post-commit callback failed')
+
+    try {
+      await expect(withAtomicFlush(em, [async () => {
+        onTransactionLifetimeComplete(em, () => {
+          calls.push('first')
+          throw failure
+        })
+        onTransactionLifetimeComplete(em, async (outcome) => {
+          calls.push(`second:${outcome}`)
+        })
+      }], { transaction: true })).resolves.toBeUndefined()
+    } finally {
+      unregister()
+    }
+
+    expect(em.commit).toHaveBeenCalledTimes(1)
+    expect(calls).toEqual(['first', 'second:committed'])
+    expect(reportError).toHaveBeenCalledWith(failure, expect.objectContaining({
+      code: 'shared.transaction_completion_callback_failed',
+      attributes: { outcome: 'committed' },
+    }))
+    expect(getTransactionLifetime(em)).toBeNull()
+  })
+
+  it('never lets a rollback completion callback mask the original error', async () => {
+    const em = buildEntityManager()
+    const original = new Error('phase failed')
+    const outcomes: TransactionOutcome[] = []
+
+    await expect(withAtomicFlush(em, [async () => {
+      onTransactionLifetimeComplete(em, async () => {
+        throw new Error('rollback callback failed')
+      })
+      onTransactionLifetimeComplete(em, (outcome) => {
+        outcomes.push(outcome)
+      })
+      throw original
+    }], { transaction: true })).rejects.toBe(original)
+
+    expect(em.rollback).toHaveBeenCalledTimes(1)
+    expect(outcomes).toEqual(['rolled_back'])
+    expect(getTransactionLifetime(em)).toBeNull()
+  })
+})

package/src/lib/commands/__tests__/undo.test.ts

@@ -1,4 +1,4 @@
-import { extractUndoPayload } from '../undo'
+import { extractUndoPayload, reviveSnapshotDates } from '../undo'
 
 describe('extractUndoPayload', () => {
   it('returns undo payload from direct property', () => {
@@ -56,3 +56,92 @@ describe('extractUndoPayload', () => {
     expect(extractUndoPayload(logEntry as any)).toEqual({ before: { id: 'before' }, after: null })
   })
 })
+
+describe('extractUndoPayload date revival (#6336)', () => {
+  const iso = '2026-01-02T03:04:05.000Z'
+  const jsonRoundTrip = <T>(value: T): T => JSON.parse(JSON.stringify(value))
+
+  it('returns ISO strings untouched when no options are given', () => {
+    const logEntry = jsonRoundTrip({ commandPayload: { undo: { before: { item: { occurredAt: new Date(iso) } } } } })
+    const payload = extractUndoPayload<{ before: { item: { occurredAt: unknown } } }>(logEntry)
+    expect(payload?.before.item.occurredAt).toBe(iso)
+  })
+
+  it('revives dateFields at any depth, including inside arrays', () => {
+    const logEntry = jsonRoundTrip({
+      commandPayload: {
+        undo: {
+          before: { item: { occurredAt: new Date(iso), scheduledAt: null, title: iso }, lines: [{ occurredAt: new Date(iso) }] },
+          after: { item: { occurredAt: new Date(iso) } },
+        },
+      },
+    })
+    const payload = extractUndoPayload<{
+      before: { item: { occurredAt: Date; scheduledAt: Date | null; title: string }; lines: Array<{ occurredAt: Date }> }
+      after: { item: { occurredAt: Date } }
+    }>(logEntry, { dateFields: ['occurredAt', 'scheduledAt'] })
+    expect(payload?.before.item.occurredAt).toBeInstanceOf(Date)
+    expect(payload?.before.item.occurredAt.toISOString()).toBe(iso)
+    expect(payload?.before.item.scheduledAt).toBeNull()
+    expect(payload?.before.item.title).toBe(iso)
+    expect(payload?.before.lines[0].occurredAt).toBeInstanceOf(Date)
+    expect(payload?.after.item.occurredAt).toBeInstanceOf(Date)
+  })
+
+  it('revives only the named datePaths', () => {
+    const logEntry = jsonRoundTrip({
+      commandPayload: { undo: { before: { item: { occurredAt: iso }, lines: [{ occurredAt: iso }] }, after: { item: { occurredAt: iso } } } },
+    })
+    const payload = extractUndoPayload<{
+      before: { item: { occurredAt: unknown }; lines: Array<{ occurredAt: unknown }> }
+      after: { item: { occurredAt: unknown } }
+    }>(logEntry, { datePaths: ['before.item.occurredAt', 'before.lines.occurredAt', 'before.missing.occurredAt'] })
+    expect(payload?.before.item.occurredAt).toBeInstanceOf(Date)
+    expect(payload?.before.lines[0].occurredAt).toBeInstanceOf(Date)
+    expect(payload?.after.item.occurredAt).toBe(iso)
+    expect(payload?.before).not.toHaveProperty('missing')
+  })
+
+  it('revives dates in the snapshot fallback too', () => {
+    const logEntry = { snapshotBefore: { occurredAt: iso }, snapshotAfter: null }
+    const payload = extractUndoPayload<{ before: { occurredAt: Date } }>(logEntry, { dateFields: ['occurredAt'] })
+    expect(payload?.before.occurredAt).toBeInstanceOf(Date)
+  })
+
+  it('does not mutate the log entry payload', () => {
+    const logEntry = { commandPayload: { undo: { before: { occurredAt: iso } } } }
+    extractUndoPayload(logEntry, { dateFields: ['occurredAt'] })
+    expect(logEntry.commandPayload.undo.before.occurredAt).toBe(iso)
+  })
+
+  it('keeps a __proto__ key as plain data while walking', () => {
+    const logEntry = { commandPayload: JSON.parse('{"undo":{"before":{"__proto__":{"polluted":true},"occurredAt":"2026-01-02T03:04:05.000Z"}}}') }
+    const payload = extractUndoPayload<{ before: Record<string, unknown> }>(logEntry, { dateFields: ['occurredAt'] })
+    expect(Object.getPrototypeOf(payload?.before)).toBe(Object.prototype)
+    expect(Object.keys(payload?.before ?? {})).toContain('__proto__')
+  })
+
+  it('throws on an unparsable snapshot date', () => {
+    const logEntry = { commandPayload: { undo: { before: { occurredAt: 'not-a-date' } } } }
+    expect(() => extractUndoPayload(logEntry, { dateFields: ['occurredAt'] })).toThrow('Invalid occurredAt snapshot date')
+  })
+})
+
+describe('reviveSnapshotDates', () => {
+  it('shallow-clones the record and revives only the named fields', () => {
+    const existing = new Date('2026-05-06T00:00:00.000Z')
+    const snapshot = { id: 'row-1', effectiveAt: '2026-02-03T00:00:00.000Z', deletedAt: null, updatedAt: existing, label: '2026-02-03' }
+    const revived = reviveSnapshotDates(snapshot, ['effectiveAt', 'deletedAt', 'updatedAt', 'absentAt'])
+    expect(revived).not.toBe(snapshot)
+    expect(revived.effectiveAt).toBeInstanceOf(Date)
+    expect(revived.deletedAt).toBeNull()
+    expect(revived.updatedAt).toBe(existing)
+    expect(revived.label).toBe('2026-02-03')
+    expect(revived).not.toHaveProperty('absentAt')
+    expect(snapshot.effectiveAt).toBe('2026-02-03T00:00:00.000Z')
+  })
+
+  it('throws on an unparsable value', () => {
+    expect(() => reviveSnapshotDates({ effectiveAt: 'garbage' }, ['effectiveAt'])).toThrow('Invalid effectiveAt snapshot date')
+  })
+})