@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/lib/crud/enricher-runner.ts

@@ -15,6 +15,7 @@ import type {
 import { getEnrichersForEntity } from './enricher-registry'
 import { logEnricherTiming } from '../umes/enricher-timing'
 import { createLogger } from '../logger'
+import { getTelemetryRuntime } from '../telemetry/runtime'
 import { authorizeFeatures } from '../../security/featurePolicy'
 
 const logger = createLogger('shared').child({ component: 'umes' })
@@ -22,7 +23,82 @@ const logger = createLogger('shared').child({ component: 'umes' })
 const DEFAULT_TIMEOUT = 2000
 const SLOW_WARN_MS = 100
 const SLOW_ERROR_MS = 500
+const LOG_THROTTLE_INTERVAL_MS = 30_000
 const DEFAULT_CACHE_TTL_MS = 60_000
+const ENRICHER_DURATION_METRIC = 'om.enricher.duration'
+
+type SlowLogState = {
+  lastLoggedAt: number
+  suppressedCount: number
+  maxElapsedMs: number
+}
+
+const slowLogStateByEnricher = new Map<string, SlowLogState>()
+const metricFailureLoggedAtByEnricher = new Map<string, number>()
+
+function logMetricRecordingFailure(enricherId: string, err: unknown, failedAt: number): void {
+  const lastLoggedAt = metricFailureLoggedAtByEnricher.get(enricherId)
+  if (lastLoggedAt !== undefined && failedAt - lastLoggedAt < LOG_THROTTLE_INTERVAL_MS) return
+  metricFailureLoggedAtByEnricher.set(enricherId, failedAt)
+  logger.warn('Enricher duration metric recording failed', {
+    enricherId,
+    metric: ENRICHER_DURATION_METRIC,
+    err,
+  })
+}
+
+function recordEnricherDuration(
+  enricherId: string,
+  moduleId: string,
+  targetEntity: string,
+  elapsedMs: number,
+  finishedAt: number,
+): void {
+  logEnricherTiming(enricherId, moduleId, targetEntity, elapsedMs)
+  try {
+    getTelemetryRuntime()?.recordHistogram?.(
+      ENRICHER_DURATION_METRIC,
+      elapsedMs / 1000,
+      { 'enricher.id': enricherId },
+      's',
+    )
+  } catch (err) {
+    logMetricRecordingFailure(enricherId, err, finishedAt)
+  }
+}
+
+function logSlowEnricher(enricherId: string, elapsedMs: number, finishedAt: number): void {
+  if (elapsedMs <= SLOW_WARN_MS) return
+
+  if (elapsedMs <= SLOW_ERROR_MS) {
+    logger.debug('Enricher exceeded slow threshold', {
+      enricherId,
+      elapsedMs,
+      thresholdMs: SLOW_WARN_MS,
+    })
+    return
+  }
+
+  const state = slowLogStateByEnricher.get(enricherId)
+  if (state && finishedAt - state.lastLoggedAt < LOG_THROTTLE_INTERVAL_MS) {
+    state.suppressedCount += 1
+    state.maxElapsedMs = Math.max(state.maxElapsedMs, elapsedMs)
+    return
+  }
+
+  logger.error('Enricher exceeded slow threshold', {
+    enricherId,
+    elapsedMs,
+    thresholdMs: SLOW_ERROR_MS,
+    suppressedCount: state?.suppressedCount ?? 0,
+    maxElapsedMs: Math.max(state?.maxElapsedMs ?? 0, elapsedMs),
+  })
+  slowLogStateByEnricher.set(enricherId, {
+    lastLoggedAt: finishedAt,
+    suppressedCount: 0,
+    maxElapsedMs: 0,
+  })
+}
 
 function timeoutPromise(ms: number): Promise<never> {
   return new Promise((_, reject) =>
@@ -378,13 +454,10 @@ export async function applyResponseEnrichers<T extends Record<string, unknown>>(
         )
       }
 
-      const elapsedMs = Date.now() - startTime
-      if (elapsedMs > SLOW_ERROR_MS) {
-        logger.error('Enricher exceeded slow threshold', { enricherId: enricher.id, elapsedMs, thresholdMs: SLOW_ERROR_MS })
-      } else if (elapsedMs > SLOW_WARN_MS) {
-        logger.warn('Enricher exceeded slow threshold', { enricherId: enricher.id, elapsedMs, thresholdMs: SLOW_WARN_MS })
-      }
-      logEnricherTiming(enricher.id, entry.moduleId, targetEntity, elapsedMs)
+      const finishedAt = Date.now()
+      const elapsedMs = finishedAt - startTime
+      logSlowEnricher(enricher.id, elapsedMs, finishedAt)
+      recordEnricherDuration(enricher.id, entry.moduleId, targetEntity, elapsedMs, finishedAt)
 
       currentItems = result
       if (shouldUseCache && cacheKey) {
@@ -482,8 +555,9 @@ export async function applyResponseEnricherToRecord<T extends Record<string, unk
         timeoutPromise(timeout),
       ])
 
-      const elapsedMs = Date.now() - startTime
-      logEnricherTiming(enricher.id, entry.moduleId, targetEntity, elapsedMs)
+      const finishedAt = Date.now()
+      const elapsedMs = finishedAt - startTime
+      recordEnricherDuration(enricher.id, entry.moduleId, targetEntity, elapsedMs, finishedAt)
 
       currentRecord = result
       if (shouldUseCache && cacheKey) {

package/src/lib/crud/factory.ts

@@ -69,6 +69,7 @@ import { applyResponseEnrichers, applyResponseEnricherToRecord, resolveListCache
 import type { EnricherContext } from './response-enricher'
 import type { ApiInterceptorMethod, InterceptorRequest, InterceptorResponse } from './api-interceptor'
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from './interceptor-runner'
+import { resolveApiInterceptorRoutePath } from '../modules/api-route-identity'
 import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from './ids'
 import { buildQueryParams } from './query-params'
 import { mergeAdvancedFilters } from './advanced-filter-integration'
@@ -790,17 +791,6 @@ function snapshotEntity(entity: unknown): Record<string, unknown> | undefined {
   return safeClone(entity) as Record<string, unknown>
 }
 
-function normalizeInterceptorRoutePath(request: Request): string {
-  try {
-    const pathname = new URL(request.url).pathname
-    if (pathname.startsWith('/api/')) return pathname.slice(5)
-    if (pathname === '/api') return ''
-    return pathname.replace(/^\/+/, '')
-  } catch {
-    return ''
-  }
-}
-
 function toInterceptorHeaders(headers: Headers): Record<string, string> {
   const output: Record<string, string> = {}
   headers.forEach((value, key) => {
@@ -1029,7 +1019,7 @@ function safeClone<T>(value: T): T {
 }
 
 function collectScopeOrganizationIds(ctx: CrudCtx): Array<string | null> {
-  if (Array.isArray(ctx.organizationIds) && ctx.organizationIds.length > 0) {
+  if (Array.isArray(ctx.organizationIds)) {
     return Array.from(new Set(ctx.organizationIds))
   }
   const fallback = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
@@ -1059,7 +1049,7 @@ function buildCrudCacheKey(
   const scopeIds = collectScopeOrganizationIds(ctx)
   const scopeSegment = scopeIds.length
     ? scopeIds.map((id) => normalizeTagSegment(id)).sort((a, b) => a.localeCompare(b)).join(',')
-    : 'none'
+    : 'empty'
   const segments = [
     'crud',
     normalizeTagSegment(resource),
@@ -1417,12 +1407,20 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
     if (!interceptorContext) {
       return { errorResponse: null, requestPayload, metadataByInterceptor: {} }
     }
+    const routePath = resolveApiInterceptorRoutePath(args.request)
+    if (routePath === null) {
+      return {
+        errorResponse: json({ error: 'Bad request' }, { status: 400 }),
+        requestPayload,
+        metadataByInterceptor: {},
+      }
+    }
     const contextWithHeaders = {
       ...interceptorContext,
       extensionHeaders: parseExtensionHeaders(requestPayload.headers),
     }
     const result = await runApiInterceptorsBefore({
-      routePath: normalizeInterceptorRoutePath(args.request),
+      routePath,
       method: args.method,
       request: requestPayload,
       context: contextWithHeaders,
@@ -1445,8 +1443,12 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
   }): Promise<{ ok: boolean; statusCode: number; body: Record<string, unknown>; headers: Record<string, string> } | null> {
     const interceptorContext = await buildInterceptorContext(args.ctx)
     if (!interceptorContext) return { ok: true, statusCode: args.statusCode, body: args.body, headers: args.headers ?? {} }
+    const routePath = resolveApiInterceptorRoutePath(args.request)
+    if (routePath === null) {
+      return { ok: false, statusCode: 400, body: { error: 'Bad request' }, headers: {} }
+    }
     const result = await runApiInterceptorsAfter({
-      routePath: normalizeInterceptorRoutePath(args.request),
+      routePath,
       method: args.method,
       request: args.requestPayload,
       response: {
@@ -1523,10 +1525,16 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
           orgId: scopedOrgId ?? null,
         }
       : null
-    const fallbackOrgId = scopedOrgId ?? rawAuth?.orgId ?? null
+    const fallbackOrgId = scope ? scopedOrgId : (rawAuth?.orgId ?? null)
+    const hasExplicitEmptyScope = Boolean(scope && (
+      (Array.isArray(scope.filterIds) && scope.filterIds.length === 0)
+      || (Array.isArray(scope.allowedIds) && scope.allowedIds.length === 0)
+    ))
     const rawScopeIds = scope?.filterIds
     const scopedIds = Array.isArray(rawScopeIds) ? rawScopeIds.filter((id): id is string => typeof id === 'string' && id.length > 0) : null
-    if (!scope) {
+    if (hasExplicitEmptyScope) {
+      organizationIds = []
+    } else if (!scope) {
       organizationIds = fallbackOrgId ? [fallbackOrgId] : null
     } else if (scopedIds === null) {
       organizationIds = scope.allowedIds === null ? null : (fallbackOrgId ? [fallbackOrgId] : null)
@@ -1537,7 +1545,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       let canUseFallback = false
       if (allowedIds === null) {
         canUseFallback = true
-      } else if (allowedIds.includes(fallbackOrgId) || allowedIds.length === 0) {
+      } else if (allowedIds.includes(fallbackOrgId)) {
         canUseFallback = true
       }
       if (canUseFallback) {
@@ -1629,6 +1637,25 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       let validated = opts.list.schema.parse(rawQueryParams)
       profiler.mark('query_validated')
 
+      if (ormCfg.orgField && Array.isArray(ctx.organizationIds) && ctx.organizationIds.length === 0) {
+        profiler.mark('scope_blocked')
+        logForbidden({
+          resourceKind,
+          action: 'list',
+          reason: 'organization_scope_empty',
+          userId: ctx.auth?.sub ?? null,
+          tenantId: ctx.auth?.tenantId ?? null,
+          organizationIds: ctx.organizationIds,
+        })
+        const page = Number((validated as Record<string, unknown>).page ?? 1) || 1
+        const pageSize = Math.min(
+          Math.max(Number((validated as Record<string, unknown>).pageSize ?? 50) || 50, 1),
+          100,
+        )
+        finishProfile({ result: 'scope_blocked', itemCount: 0, total: 0 })
+        return json({ items: [], total: 0, page, pageSize, totalPages: 0 })
+      }
+
       const beforeInterceptors = await applyInterceptorsBefore({
         ctx,
         request,
@@ -1695,7 +1722,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         if (Array.isArray(payload)) return
         const items = Array.isArray((payload as any).items) ? (payload as any).items : []
         const tags = new Set<string>()
-        const scopeOrgIds = collectScopeOrganizationIds(ctx)
+        const scopeOrgIds = ormCfg.orgField ? collectScopeOrganizationIds(ctx) : [null]
         const crudSegment = deriveCrudSegmentTag(resourceKind, request)
         for (const target of resourceTargets) {
           for (const tag of buildCollectionTags(target, tenantForScope, scopeOrgIds)) {

package/src/lib/data/__tests__/engine.pin-organization-id.test.ts

@@ -0,0 +1,102 @@
+import { registerEntityIds } from '../../encryption/entityIds'
+
+const setRecordCustomFieldsMock = jest.fn(async () => undefined)
+
+jest.mock('@open-mercato/core/modules/entities/lib/helpers', () => ({
+  setRecordCustomFields: (...args: unknown[]) => setRecordCustomFieldsMock(...args),
+}))
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { DefaultDataEngine, clearDataEngineTableExistsCache } = require('../engine')
+
+const ENTITY_ID = 'example:todo'
+const RECORD_ID = '11111111-1111-4111-8111-111111111111'
+
+function buildDb() {
+  const chain = {
+    select: (_s: unknown) => chain,
+    values: (_v: unknown) => chain,
+    set: (_v: unknown) => chain,
+    where: (_c: string, _o: string, _v: unknown) => chain,
+    onConflict: (callback: (builder: { columns: (c: string[]) => { doUpdateSet: (v: unknown) => unknown } }) => unknown) => {
+      callback({ columns: (_c) => ({ doUpdateSet: (_v) => ({}) }) })
+      return chain
+    },
+    executeTakeFirst: async () => ({ present: 1, doc: { id: RECORD_ID }, numUpdatedRows: 1n }),
+    execute: async () => [],
+  }
+  return {
+    selectFrom: (_table: string) => chain,
+    insertInto: (_table: string) => chain,
+    updateTable: (_table: string) => chain,
+    deleteFrom: (_table: string) => chain,
+  }
+}
+
+function buildEngine() {
+  const em = {
+    getKysely: () => buildDb(),
+    getMetadata: () => ({ find: () => undefined, getAll: () => [] }),
+    find: async () => [],
+    persist: () => undefined,
+    flush: async () => undefined,
+  }
+  return new DefaultDataEngine(em as never, {} as never)
+}
+
+describe('DataEngine EAV backcompat pins organizationId (#6034 review)', () => {
+  const previousFlag = process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM
+
+  beforeEach(() => {
+    registerEntityIds({ example: { todo: ENTITY_ID } })
+    clearDataEngineTableExistsCache()
+    setRecordCustomFieldsMock.mockClear()
+    process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM = 'true'
+  })
+
+  afterEach(() => {
+    registerEntityIds({})
+    if (previousFlag === undefined) delete process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM
+    else process.env.ENTITIES_BACKCOMPAT_EAV_FOR_CUSTOM = previousFlag
+  })
+
+  // custom_entities_storage upserts on (entity_type, entity_id, organization_id), so the same
+  // recordId can be a live record in two organizations of one tenant — the recordId-is-globally-
+  // unique invariant `setRecordCustomFields` otherwise relies on does not hold here. Both backcompat
+  // call sites must pin the reconciling delete/lookup to their own organization.
+  test('createCustomEntityRecord passes pinOrganizationId: true to setRecordCustomFields', async () => {
+    const engine = buildEngine()
+
+    await engine.createCustomEntityRecord({
+      entityId: ENTITY_ID,
+      recordId: RECORD_ID,
+      organizationId: 'org-a',
+      tenantId: 'tenant-1',
+      values: { priority: 3 },
+    })
+
+    expect(setRecordCustomFieldsMock).toHaveBeenCalledTimes(1)
+    expect(setRecordCustomFieldsMock.mock.calls[0]?.[1]).toMatchObject({
+      organizationId: 'org-a',
+      pinOrganizationId: true,
+    })
+  })
+
+  test('updateCustomEntityRecord passes pinOrganizationId: true to setRecordCustomFields', async () => {
+    const engine = buildEngine()
+
+    await engine.updateCustomEntityRecord({
+      entityId: ENTITY_ID,
+      recordId: RECORD_ID,
+      organizationId: 'org-a',
+      tenantId: 'tenant-1',
+      values: { priority: 3 },
+    })
+
+    expect(setRecordCustomFieldsMock).toHaveBeenCalledTimes(1)
+    expect(setRecordCustomFieldsMock.mock.calls[0]?.[1]).toMatchObject({
+      organizationId: 'org-a',
+      pinOrganizationId: true,
+    })
+  })
+})

package/src/lib/data/engine.ts

@@ -98,6 +98,9 @@ export interface DataEngine {
     tenantId?: string | null
     values: Record<string, string | number | boolean | null | undefined | Array<string | number | boolean | null | undefined>>
     notify?: boolean // default true -> emit '<module>.<entity>.updated'
+    // Forwarded to `setRecordCustomFields` — see its doc for when a caller must pass
+    // true (a recordId that is not unique across organizations for this entityId).
+    pinOrganizationId?: boolean
   }): Promise<void>
 
   // Storage for user-defined entities (doc-based)
@@ -287,6 +290,7 @@ export class DefaultDataEngine implements DataEngine {
       tenantId,
       values: sanitizedValues,
       encryptionService,
+      pinOrganizationId: opts.pinOrganizationId === true,
     })
     if (opts.notify !== false) {
       let bus: EventBus | null = null
@@ -473,6 +477,10 @@ export class DefaultDataEngine implements DataEngine {
         tenantId: tenantId,
         values: normalizeCustomFieldValues(sanitizedValues),
         notify: opts.notify, // defaults to true
+        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),
+        // so `id` is unique only within this organization, not across organizations —
+        // pin the reconciling delete/lookup to this organization (#6034 review).
+        pinOrganizationId: true,
       })
     }
 
@@ -544,6 +552,10 @@ export class DefaultDataEngine implements DataEngine {
         tenantId: tenantId,
         values: normalizeCustomFieldValues(sanitizedValues),
         notify: opts.notify, // defaults to true
+        // custom_entities_storage upserts on (entity_type, entity_id, organization_id),
+        // so `id` is unique only within this organization, not across organizations —
+        // pin the reconciling delete/lookup to this organization (#6034 review).
+        pinOrganizationId: true,
       })
     }
   }

package/src/lib/db/__tests__/accentInsensitiveSearch.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from '@jest/globals'
+import {
+  IMMUTABLE_UNACCENT_FUNCTION,
+  buildAccentInsensitiveContainsPatternSql,
+  buildAccentInsensitivePatternSql,
+  buildAccentInsensitiveSearchExpression,
+  buildImmutableUnaccentFunctionSql,
+} from '../accentInsensitiveSearch'
+
+describe('accent-insensitive search SQL', () => {
+  it('builds a NULL-safe, space-separated concatenation wrapped in the immutable unaccent function', () => {
+    expect(buildAccentInsensitiveSearchExpression(['title', 'sku'])).toBe(
+      `${IMMUTABLE_UNACCENT_FUNCTION}(coalesce("title", '') || ' ' || coalesce("sku", ''))`,
+    )
+  })
+
+  it('wraps a single column without a separator', () => {
+    expect(buildAccentInsensitiveSearchExpression(['title'])).toBe(
+      `${IMMUTABLE_UNACCENT_FUNCTION}(coalesce("title", ''))`,
+    )
+  })
+
+  it('rejects an empty column list rather than emitting an unparsable call', () => {
+    expect(() => buildAccentInsensitiveSearchExpression([])).toThrow()
+  })
+
+  it('unaccents the bound pattern with the same function, so both sides of the comparison match', () => {
+    expect(buildAccentInsensitivePatternSql()).toBe(`${IMMUTABLE_UNACCENT_FUNCTION}(?)`)
+  })
+
+  // unaccent folds fullwidth ％ ＿ ＼ into ASCII LIKE metacharacters, so the raw
+  // term must be folded first and escaped afterwards (#6465).
+  it('escapes LIKE metacharacters after unaccent folds the raw term, backslash first', () => {
+    const sql = buildAccentInsensitiveContainsPatternSql()
+    expect(sql).toBe(
+      `'%' || replace(replace(replace(${IMMUTABLE_UNACCENT_FUNCTION}(?), chr(92), chr(92) || chr(92)), '%', chr(92) || '%'), '_', chr(92) || '_') || '%'`,
+    )
+    expect(sql.split('?')).toHaveLength(2)
+    expect(sql).not.toContain('\\')
+  })
+
+  // The wrapper may only be declared IMMUTABLE because the dictionary is pinned:
+  // the single-argument unaccent() resolves it through search_path and is STABLE,
+  // which PostgreSQL refuses inside an index expression.
+  it('pins the text-search dictionary instead of relying on search_path', () => {
+    const sql = buildImmutableUnaccentFunctionSql()
+    expect(sql).toContain(`create or replace function ${IMMUTABLE_UNACCENT_FUNCTION}(text)`)
+    expect(sql).toContain(`public.unaccent('public.unaccent'::regdictionary, $1)`)
+    expect(sql).toContain('immutable')
+  })
+})

package/src/lib/db/accentInsensitiveSearch.ts

@@ -0,0 +1,70 @@
+/**
+ * SQL text for accent-insensitive `ILIKE` matching in PostgreSQL.
+ *
+ * A query predicate and the expression index backing it must be spelled
+ * identically or the planner silently ignores the index, so both sides build
+ * their SQL from the helpers here instead of repeating the literal. These are
+ * pure string builders — they assume nothing about which migration installed
+ * the function, only that both sides agree on its name.
+ *
+ * The function itself is created by a migration (currently
+ * `packages/core/src/modules/catalog/migrations/`); promote that migration to a
+ * platform-level one when a second module needs the same matching.
+ */
+
+/**
+ * Schema-qualified name of the IMMUTABLE `unaccent()` wrapper the expressions
+ * below call.
+ *
+ * PostgreSQL's built-in `unaccent()` is STABLE, because the single-argument form
+ * resolves its text-search dictionary through `search_path`, and a STABLE
+ * function cannot appear in an index expression. The wrapper pins the dictionary
+ * with `'public.unaccent'::regdictionary` so it is genuinely immutable rather
+ * than merely declared so — but the wrapper's own *call site* is still resolved
+ * through `search_path` unless it is schema-qualified too, so both the index
+ * expression and the runtime query predicate reference `public.` explicitly
+ * rather than relying on the caller's `search_path` containing it.
+ */
+export const IMMUTABLE_UNACCENT_FUNCTION = 'public.om_immutable_unaccent'
+
+/** DDL creating the wrapper. Kept here so the migration and the query agree. */
+export const buildImmutableUnaccentFunctionSql = (): string =>
+  `create or replace function ${IMMUTABLE_UNACCENT_FUNCTION}(text)
+returns text as $$
+  select public.unaccent('public.unaccent'::regdictionary, $1)
+$$ language sql immutable parallel safe strict;`
+
+/**
+ * `unaccent`ed concatenation of `columns`, NULL-safe and space-separated.
+ *
+ * Column names are quoted but not table-qualified: the caller's query must
+ * reference a single table, which is also what the index expression sees.
+ */
+export const buildAccentInsensitiveSearchExpression = (columns: readonly string[]): string => {
+  if (!columns.length) throw new Error('[internal] buildAccentInsensitiveSearchExpression requires at least one column')
+  const concatenated = columns.map((column) => `coalesce("${column}", '')`).join(` || ' ' || `)
+  return `${IMMUTABLE_UNACCENT_FUNCTION}(${concatenated})`
+}
+
+/**
+ * Right-hand side of the comparison: the bound pattern, unaccented the same way.
+ *
+ * @deprecated `unaccent` folds look-alikes such as fullwidth `％ ＿ ＼` into the
+ * ASCII LIKE metacharacters, so a pattern escaped before this call comes out of
+ * it with live wildcards (#6465). Use `buildAccentInsensitiveContainsPatternSql`,
+ * which binds the raw term and escapes it after folding.
+ */
+export const buildAccentInsensitivePatternSql = (): string => `${IMMUTABLE_UNACCENT_FUNCTION}(?)`
+
+const escapeLikeMetacharactersSql = (expression: string): string =>
+  `replace(replace(replace(${expression}, chr(92), chr(92) || chr(92)), '%', chr(92) || '%'), '_', chr(92) || '_')`
+
+/**
+ * Right-hand side of a "contains" comparison for a RAW (unescaped) search term
+ * bound as the single `?`: the term is unaccented first and only then
+ * LIKE-escaped, so characters that `unaccent` folds into `%`, `_` or `\` are
+ * matched literally. `chr(92)` spells the backslash independently of
+ * `standard_conforming_strings`.
+ */
+export const buildAccentInsensitiveContainsPatternSql = (): string =>
+  `'%' || ${escapeLikeMetacharactersSql(`${IMMUTABLE_UNACCENT_FUNCTION}(?)`)} || '%'`

package/src/lib/encryption/__tests__/dek-lifecycle.test.ts

@@ -107,6 +107,14 @@ describe('TenantDataEncryptionService DEK lifecycle (issue #2746)', () => {
     jest.restoreAllMocks()
   })
 
+  function makePolicyEm() {
+    return {
+      execute: jest.fn(async () => [
+        { entity_id: entityId, tenant_id: null, organization_id: null, fields_json: [{ field: 'secret' }] },
+      ]),
+    }
+  }
+
   function makeCreatingKms() {
     const created: string[] = []
     const kms: KmsService = {
@@ -136,10 +144,8 @@ describe('TenantDataEncryptionService DEK lifecycle (issue #2746)', () => {
 
   it('dedupes concurrent first-time DEK creation so no row is orphaned', async () => {
     const { kms, created } = makeCreatingKms()
-    const service = new TenantDataEncryptionService({} as never, { kms })
+    const service = new TenantDataEncryptionService(makePolicyEm() as never, { kms })
     jest.spyOn(service, 'isEnabled').mockReturnValue(true)
-    ;(service as unknown as { getMap: () => Promise<{ entityId: string; fields: { field: string }[] }> }).getMap =
-      jest.fn(async () => ({ entityId, fields: [{ field: 'secret' }] }))
     const tenantId = uniqueTenant('race')
 
     const rows = await Promise.all(
@@ -176,10 +182,8 @@ describe('TenantDataEncryptionService DEK lifecycle (issue #2746)', () => {
 
   it('provisions no DEK when the caller opts out, so a preview leaves KMS untouched', async () => {
     const { kms, created } = makeCreatingKms()
-    const service = new TenantDataEncryptionService({} as never, { kms })
+    const service = new TenantDataEncryptionService(makePolicyEm() as never, { kms })
     jest.spyOn(service, 'isEnabled').mockReturnValue(true)
-    ;(service as unknown as { getMap: () => Promise<{ entityId: string; fields: { field: string }[] }> }).getMap =
-      jest.fn(async () => ({ entityId, fields: [{ field: 'secret' }] }))
     const tenantId = uniqueTenant('no-create')
 
     const row = await service.encryptEntityPayload(
@@ -198,10 +202,8 @@ describe('TenantDataEncryptionService DEK lifecycle (issue #2746)', () => {
 
   it('still provisions on the default path so existing write callers are unaffected', async () => {
     const { kms, created } = makeCreatingKms()
-    const service = new TenantDataEncryptionService({} as never, { kms })
+    const service = new TenantDataEncryptionService(makePolicyEm() as never, { kms })
     jest.spyOn(service, 'isEnabled').mockReturnValue(true)
-    ;(service as unknown as { getMap: () => Promise<{ entityId: string; fields: { field: string }[] }> }).getMap =
-      jest.fn(async () => ({ entityId, fields: [{ field: 'secret' }] }))
     const tenantId = uniqueTenant('default-create')
 
     const row = await service.encryptEntityPayload(entityId, { secret: 'value' }, tenantId)

package/src/lib/encryption/__tests__/fixtures/policy-process-worker.ts

@@ -0,0 +1,96 @@
+import { readFile } from 'node:fs/promises'
+import { TenantDataEncryptionService } from '../../tenantDataEncryptionService'
+
+type PolicyState = {
+  exact: Array<{ field: string }>
+  aggregate: Array<{ field: string }>
+}
+
+type WorkerCommand = {
+  id: number
+  action: 'readExact' | 'readAggregate' | 'invalidate'
+}
+
+const entityId = 'test:process_policy'
+const tenantId = 'tenant-process-policy'
+const organizationId = 'org-process-policy'
+const statePath = process.env.ENCRYPTION_POLICY_STATE_PATH
+const cacheFailurePath = process.env.ENCRYPTION_POLICY_CACHE_FAILURE_PATH
+const exactReadBlockPath = process.env.ENCRYPTION_POLICY_EXACT_BLOCK_PATH
+
+if (!statePath || !cacheFailurePath || !exactReadBlockPath) {
+  throw new Error('[internal] Process policy fixture paths are required')
+}
+
+async function readPolicyState(): Promise<PolicyState> {
+  return JSON.parse(await readFile(statePath, 'utf8')) as PolicyState
+}
+
+async function cacheIsUnavailable(): Promise<boolean> {
+  return (await readFile(cacheFailurePath, 'utf8')).trim() === 'unavailable'
+}
+
+let hasBlockedExactRead = false
+
+// One statement resolves a scope: `[entity, tenant]` is the tenant-wide read that also returns
+// every organization-scoped row for the all-organizations aggregate, `[entity, tenant, org]` the
+// exact read.
+const execute = async (_sql: string, params: readonly unknown[] = []) => {
+  const state = await readPolicyState()
+  if (params.length === 2) {
+    return [{ entity_id: entityId, tenant_id: tenantId, organization_id: 'org-aggregate', fields_json: state.aggregate }]
+  }
+  if (params[2] === organizationId) {
+    if (!hasBlockedExactRead && (await readFile(exactReadBlockPath, 'utf8')).trim() === 'blocked') {
+      hasBlockedExactRead = true
+      process.send?.({ exactReadBlocked: true })
+      while ((await readFile(exactReadBlockPath, 'utf8')).trim() === 'blocked') {
+        await new Promise((resolve) => setTimeout(resolve, 5))
+      }
+    }
+    return [{ entity_id: entityId, tenant_id: tenantId, organization_id: organizationId, fields_json: state.exact }]
+  }
+  return []
+}
+
+const cache = {
+  get: async () => ({ entityId, fields: [{ field: 'stale_shared_cache' }] }),
+  set: async () => {
+    if (await cacheIsUnavailable()) throw new Error('cache publication failed')
+  },
+  delete: async () => {
+    if (await cacheIsUnavailable()) throw new Error('cache invalidation failed')
+    return true
+  },
+}
+
+const service = new TenantDataEncryptionService(
+  { execute, getConnection: () => ({ execute }) } as never,
+  {
+    cache: cache as never,
+    kms: {
+      getTenantDek: async () => null,
+      createTenantDek: async () => null,
+      isHealthy: () => true,
+    },
+  } as never,
+)
+
+process.on('message', async (command: WorkerCommand) => {
+  try {
+    const value = command.action === 'readExact'
+      ? await service.getEncryptedFieldNames(entityId, tenantId, organizationId)
+      : command.action === 'readAggregate'
+        ? await service.getEncryptedFieldNames(entityId, tenantId, null)
+        : await service.invalidateMap(entityId, tenantId, organizationId)
+    process.send?.({ id: command.id, ok: true, value })
+  } catch (error) {
+    process.send?.({
+      id: command.id,
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    })
+  }
+})
+
+process.send?.({ ready: true })