@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/lib/encryption/__tests__/kms.test.ts

@@ -1,6 +1,19 @@
 import crypto from 'node:crypto'
 import { buildDerivedKeyFallbackBannerLines, createKmsService, HashicorpVaultKmsService } from '../kms'
 
+jest.mock('../../logger', () => {
+  const warn = jest.fn()
+  const logger: Record<string, unknown> = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn,
+    error: jest.fn(),
+  }
+  logger.child = () => logger
+  return { createLogger: () => logger, __warn: warn }
+})
+
+const loggerModule = jest.requireMock('../../logger') as { __warn: jest.Mock }
 const originalEnv = { ...process.env }
 
 describe('kms timeout handling', () => {
@@ -74,8 +87,9 @@ describe('kms timeout handling', () => {
     expect(dek).toBeNull()
   })
 
-  it('never prints the explicit fallback secret verbatim in the banner, regardless of NODE_ENV', () => {
+  it('never prints the explicit fallback secret or a deterministic verifier in the banner', () => {
     const secret = 'super-secret-tenant-encryption-key'
+    const fingerprint = crypto.createHash('sha256').update(secret, 'utf8').digest('hex').slice(0, 16)
     for (const nodeEnv of ['development', 'staging', 'preview', 'PRODUCTION', 'production', undefined]) {
       if (nodeEnv === undefined) delete process.env.NODE_ENV
       else process.env.NODE_ENV = nodeEnv
@@ -88,12 +102,40 @@ describe('kms timeout handling', () => {
       const rendered = lines.join('\n')
 
       expect(rendered).not.toContain(secret)
+      expect(rendered).not.toContain(fingerprint)
+      expect(rendered).not.toMatch(/fingerprint|sha-?256/i)
       expect(rendered).toContain('Source: TENANT_DATA_ENCRYPTION_FALLBACK_KEY')
-      const expectedFingerprint = crypto.createHash('sha256').update(secret, 'utf8').digest('hex').slice(0, 16)
-      expect(rendered).toContain(`Secret fingerprint (sha256, truncated): ${expectedFingerprint}`)
     }
   })
 
+  it('logs fallback activation without the secret or a deterministic verifier', () => {
+    const secret = 'structured-log-fallback-secret'
+    const fingerprint = crypto.createHash('sha256').update(secret, 'utf8').digest('hex').slice(0, 16)
+    process.env.NODE_ENV = 'production'
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+    process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY = secret
+    delete process.env.TENANT_DATA_ENCRYPTION_KEY
+    delete process.env.VAULT_ADDR
+    delete process.env.VAULT_TOKEN
+    loggerModule.__warn.mockClear()
+    const stderrWrite = jest.spyOn(process.stderr, 'write').mockImplementation(() => true)
+
+    createKmsService()
+
+    const bannerOutput = stderrWrite.mock.calls.map(([chunk]) => String(chunk)).join('')
+    const structuredOutput = JSON.stringify(loggerModule.__warn.mock.calls)
+    for (const output of [bannerOutput, structuredOutput]) {
+      expect(output).not.toContain(secret)
+      expect(output).not.toContain(fingerprint)
+      expect(output).not.toMatch(/secretFingerprint|sha-?256/i)
+    }
+    expect(bannerOutput).toContain('Source: TENANT_DATA_ENCRYPTION_FALLBACK_KEY')
+    expect(loggerModule.__warn).toHaveBeenCalledWith(
+      'Using derived tenant encryption keys (Vault unavailable / no DEK)',
+      { fallbackSource: 'TENANT_DATA_ENCRYPTION_FALLBACK_KEY' },
+    )
+  })
+
   it('does not echo the dev default secret verbatim in the banner either', () => {
     const lines = buildDerivedKeyFallbackBannerLines({
       secret: 'om-dev-tenant-encryption',

package/src/lib/encryption/__tests__/likeFilterWarning.test.ts

@@ -99,6 +99,49 @@ describe('warnOnEncryptedLikeFilter', () => {
     expect(loggerModule.__warn.mock.calls[0][1].hint).toContain('findEntityIdsBySearchTokens')
   })
 
+  // A predicate built with raw() is keyed by a symbol, which the walker cannot
+  // see, so the caller names the matched properties instead (#6074 / #5051).
+  it('warns for properties supplied as likeFields without a readable where clause', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      likeFields: ['subject', 'body'],
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['subject']) as any,
+    })
+
+    expect(loggerModule.__warn).toHaveBeenCalledTimes(1)
+    expect(loggerModule.__warn.mock.calls[0][1]).toMatchObject({
+      entity: 'mail:mail_message',
+      field: 'subject',
+      reason: 'raw-orm-filter',
+    })
+  })
+
+  it('reports a property once when it appears in both the where clause and likeFields', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      where: { subject: { $ilike: '%invoice%' } },
+      likeFields: ['subject'],
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['subject']) as any,
+    })
+
+    expect(loggerModule.__warn).toHaveBeenCalledTimes(1)
+  })
+
+  it('stays quiet for likeFields outside the encryption map', async () => {
+    await warnOnEncryptedLikeFilter({
+      em: makeEm() as any,
+      entityName: 'MailMessage',
+      likeFields: ['subject'],
+      tenantId: 'tenant-1',
+      encryptionService: makeService(['body']) as any,
+    })
+    expect(loggerModule.__warn).not.toHaveBeenCalled()
+  })
+
   it('stays quiet for properties outside the encryption map', async () => {
     await warnOnEncryptedLikeFilter({
       em: makeEm() as any,

package/src/lib/encryption/__tests__/migration-backfill.test.ts

@@ -0,0 +1,57 @@
+import { buildEncryptionMapBackfillSql } from '../migration-backfill'
+
+function normalize(sql: string): string {
+  return sql.replace(/\s+/g, ' ').trim()
+}
+
+describe('buildEncryptionMapBackfillSql', () => {
+  test('emits a single table-guarded block that inserts missing maps for active scopes', () => {
+    const sql = normalize(buildEncryptionMapBackfillSql({ entityId: 'demo:thing', fields: [{ field: 'secret' }] }))
+
+    expect(sql.startsWith('do $$ begin if to_regclass(\'encryption_maps\') is null then return; end if;')).toBe(true)
+    expect(sql.endsWith('end $$;')).toBe(true)
+    expect(sql).toContain(
+      `select gen_random_uuid(), 'demo:thing', src."tenant_id", src."organization_id", '[{"field":"secret"}]'::jsonb, true, now(), now()`,
+    )
+    expect(sql).toContain('where "is_active" = true and "deleted_at" is null')
+    expect(sql).toContain(`where existing."entity_id" = 'demo:thing'`)
+  })
+
+  test('appends each missing field rule to existing maps without replacing other rules', () => {
+    const sql = normalize(
+      buildEncryptionMapBackfillSql({
+        entityId: 'demo:thing',
+        fields: [{ field: 'secret' }, { field: 'email', hashField: 'email_hash' }],
+      }),
+    )
+
+    expect(sql).toContain(`'[{"field":"secret"},{"field":"email","hashField":"email_hash"}]'::jsonb`)
+    expect(sql).toContain(`coalesce("fields_json", '[]'::jsonb) || '[{"field":"secret"}]'::jsonb`)
+    expect(sql).toContain(`coalesce("fields_json", '[]'::jsonb) || '[{"field":"email","hashField":"email_hash"}]'::jsonb`)
+    expect(sql).toContain(`where rule->>'field' = 'secret'`)
+    expect(sql).toContain(`where rule->>'field' = 'email'`)
+  })
+
+  test('deduplicates repeated field rules', () => {
+    const sql = buildEncryptionMapBackfillSql({ entityId: 'demo:thing', fields: [{ field: 'secret' }, { field: 'secret' }] })
+
+    expect(sql.match(/update "encryption_maps"/g)).toHaveLength(1)
+    expect(sql).toContain(`'[{"field":"secret"}]'::jsonb, true`)
+  })
+
+  test.each([
+    ['entity id with a quote', { entityId: "demo:thing'; drop table x; --", fields: [{ field: 'secret' }] }],
+    ['entity id without module prefix', { entityId: 'thing', fields: [{ field: 'secret' }] }],
+    ['field with a quote', { entityId: 'demo:thing', fields: [{ field: "secret'" }] }],
+    ['hash field with a quote', { entityId: 'demo:thing', fields: [{ field: 'email', hashField: "x'" }] }],
+    ['no fields', { entityId: 'demo:thing', fields: [] }],
+  ])('rejects %s', (_label, map) => {
+    expect(() => buildEncryptionMapBackfillSql(map)).toThrow('[internal]')
+  })
+
+  test('rejects system-scoped maps, which never live in encryption_maps', () => {
+    expect(() =>
+      buildEncryptionMapBackfillSql({ entityId: 'demo:thing', keyScope: 'system', fields: [{ field: 'secret' }] }),
+    ).toThrow('system-scoped')
+  })
+})

package/src/lib/encryption/__tests__/process-policy-coherence.test.ts

@@ -0,0 +1,128 @@
+import { fork, type ChildProcess } from 'node:child_process'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+type WorkerResponse = {
+  id?: number
+  ready?: boolean
+  exactReadBlocked?: boolean
+  ok?: boolean
+  value?: unknown
+  error?: string
+}
+
+function waitForMessage(worker: ChildProcess, predicate: (message: WorkerResponse) => boolean): Promise<WorkerResponse> {
+  return new Promise((resolve, reject) => {
+    const onMessage = (message: WorkerResponse) => {
+      if (!predicate(message)) return
+      cleanup()
+      resolve(message)
+    }
+    const onExit = (code: number | null) => {
+      cleanup()
+      reject(new Error(`[internal] Policy worker exited with code ${String(code)}`))
+    }
+    const cleanup = () => {
+      worker.off('message', onMessage)
+      worker.off('exit', onExit)
+    }
+    worker.on('message', onMessage)
+    worker.on('exit', onExit)
+  })
+}
+
+async function startWorker(
+  statePath: string,
+  cacheFailurePath: string,
+  exactReadBlockPath: string,
+): Promise<ChildProcess> {
+  const worker = fork(join(__dirname, 'fixtures/policy-process-worker.ts'), [], {
+    execArgv: ['--import', require.resolve('tsx')],
+    env: {
+      ...process.env,
+      TENANT_DATA_ENCRYPTION: 'yes',
+      ENCRYPTION_POLICY_STATE_PATH: statePath,
+      ENCRYPTION_POLICY_CACHE_FAILURE_PATH: cacheFailurePath,
+      ENCRYPTION_POLICY_EXACT_BLOCK_PATH: exactReadBlockPath,
+    },
+    stdio: ['ignore', 'ignore', 'inherit', 'ipc'],
+  })
+  await waitForMessage(worker, (message) => message.ready === true)
+  return worker
+}
+
+let commandId = 0
+
+async function runCommand(worker: ChildProcess, action: 'readExact' | 'readAggregate' | 'invalidate') {
+  const id = ++commandId
+  const response = waitForMessage(worker, (message) => message.id === id)
+  worker.send({ id, action })
+  return response
+}
+
+describe('encryption policy coherence across processes', () => {
+  it('re-reads exact and aggregate policy after a remote commit while the shared cache is unavailable', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'om-encryption-policy-'))
+    const statePath = join(directory, 'policy.json')
+    const cacheFailurePath = join(directory, 'cache-status.txt')
+    const exactReadBlockPath = join(directory, 'exact-read-block.txt')
+    const workers: ChildProcess[] = []
+    try {
+      await writeFile(statePath, JSON.stringify({
+        exact: [{ field: 'stale_exact' }],
+        aggregate: [{ field: 'stale_aggregate' }],
+      }))
+      await writeFile(cacheFailurePath, 'available')
+      await writeFile(exactReadBlockPath, 'released')
+      const reader = await startWorker(statePath, cacheFailurePath, exactReadBlockPath)
+      const invalidator = await startWorker(statePath, cacheFailurePath, exactReadBlockPath)
+      workers.push(reader, invalidator)
+
+      await expect(runCommand(reader, 'readExact')).resolves.toMatchObject({
+        ok: true,
+        value: ['stale_exact'],
+      })
+      await expect(runCommand(reader, 'readAggregate')).resolves.toMatchObject({
+        ok: true,
+        value: ['stale_aggregate'],
+      })
+
+      await writeFile(exactReadBlockPath, 'blocked')
+      const exactReadBlocked = waitForMessage(reader, (message) => message.exactReadBlocked === true)
+      const blockedPreCommitRead = runCommand(reader, 'readExact')
+      await exactReadBlocked
+
+      await writeFile(statePath, JSON.stringify({
+        exact: [{ field: 'fresh_exact' }],
+        aggregate: [{ field: 'fresh_aggregate' }],
+      }))
+      await writeFile(cacheFailurePath, 'unavailable')
+      await expect(runCommand(invalidator, 'invalidate')).resolves.toMatchObject({ ok: true })
+
+      await expect(runCommand(reader, 'readExact')).resolves.toMatchObject({
+        ok: true,
+        value: ['fresh_exact'],
+      })
+      await expect(runCommand(reader, 'readAggregate')).resolves.toMatchObject({
+        ok: true,
+        value: ['fresh_aggregate'],
+      })
+      await writeFile(exactReadBlockPath, 'released')
+      await expect(blockedPreCommitRead).resolves.toMatchObject({
+        ok: true,
+        value: ['stale_exact'],
+      })
+
+      await writeFile(cacheFailurePath, 'available')
+      await expect(runCommand(invalidator, 'invalidate')).resolves.toMatchObject({ ok: true })
+      await expect(runCommand(reader, 'readExact')).resolves.toMatchObject({
+        ok: true,
+        value: ['fresh_exact'],
+      })
+    } finally {
+      for (const worker of workers) worker.kill()
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+})

package/src/lib/encryption/__tests__/subscriber.deep-decrypt-collections.test.ts

@@ -1,4 +1,4 @@
-import { ReferenceKind } from '@mikro-orm/core'
+import { DriverException, ReferenceKind } from '@mikro-orm/core'
 import { TenantEncryptionSubscriber } from '../subscriber'
 import { registerEntityIds } from '../entityIds'
 import type { TenantDataEncryptionService } from '../tenantDataEncryptionService'
@@ -121,3 +121,68 @@ describe('TenantEncryptionSubscriber deep-decrypt of loaded collection relations
     expect(decryptedEntityIds).toContain('test:child')
   })
 })
+
+describe('TenantEncryptionSubscriber nested decrypt failures inside a transaction', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    delete process.env.TENANT_DATA_ENCRYPTION
+    registerEntityIds({ test: { parent: 'test:parent', child: 'test:child' } })
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  function makeFailingChildService(error: Error): TenantDataEncryptionService {
+    return {
+      isEnabled: () => true,
+      async decryptEntityPayload(entityId: string) {
+        if (entityId === 'test:child') throw error
+        return {}
+      },
+    } as unknown as TenantDataEncryptionService
+  }
+
+  function makeGraph() {
+    const child = { secret: 'enc:zeta', tenantId: 't1', __meta: CHILD_META }
+    const meta = parentMeta(ReferenceKind.MANY_TO_ONE, 'child')
+    return { meta, parent: { tenantId: 't1', child: makeReference(child), __meta: meta } }
+  }
+
+  function makeTransactionalEm(inTransaction: boolean) {
+    return { ...makeEm(), isInTransaction: () => inTransaction }
+  }
+
+  const abortedStatement = () => new DriverException(
+    Object.assign(new Error('current transaction is aborted'), { code: '25P02' }),
+  )
+
+  it('rethrows a database error so the caller sees its aborted transaction', async () => {
+    const { meta, parent } = makeGraph()
+    const subscriber = new TenantEncryptionSubscriber(makeFailingChildService(abortedStatement()))
+
+    await expect(
+      subscriber.decryptEntityGraph(parent, meta, makeTransactionalEm(true), { syncOriginal: true }),
+    ).rejects.toBeInstanceOf(DriverException)
+  })
+
+  it('keeps swallowing a database error outside a transaction', async () => {
+    const { meta, parent } = makeGraph()
+    const subscriber = new TenantEncryptionSubscriber(makeFailingChildService(abortedStatement()))
+
+    await expect(
+      subscriber.decryptEntityGraph(parent, meta, makeTransactionalEm(false), { syncOriginal: true }),
+    ).resolves.toBeUndefined()
+  })
+
+  it('keeps swallowing a non-database decrypt error inside a transaction', async () => {
+    const { meta, parent } = makeGraph()
+    const subscriber = new TenantEncryptionSubscriber(makeFailingChildService(new Error('malformed payload')))
+
+    await expect(
+      subscriber.decryptEntityGraph(parent, meta, makeTransactionalEm(true), { syncOriginal: true }),
+    ).resolves.toBeUndefined()
+  })
+})

package/src/lib/encryption/__tests__/subscriber.test.ts

@@ -192,11 +192,14 @@ describe('tenant-less entity encryption delegation', () => {
       changeSet,
     } as never)
 
+    // The flushing EntityManager is handed through so the policy lookup runs on
+    // this transaction's connection instead of acquiring a second pooled one.
     expect(encryptEntityPayload).toHaveBeenCalledWith(
       'onboarding:onboarding_request',
       expect.any(Object),
       null,
       null,
+      { em: {} },
     )
     expect(entity.secret).toBe('encrypted')
     expect(changeSet.payload.secret).toBe('encrypted')