@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -10,6 +10,7 @@ import {
   TenantDataEncryptionService,
   parseDecryptedFieldValue,
 } from '../tenantDataEncryptionService'
+import { forgetEncryptionPolicyMemo } from '../policyMemo'
 
 const fixedKey = Buffer.alloc(32, 1).toString('base64')
 
@@ -306,6 +307,7 @@ describe('TenantDataEncryptionService system-scoped maps', () => {
     ))
     const service = new TenantDataEncryptionService(
       {
+        execute: jest.fn(async () => []),
         getConnection: () => ({ execute: jest.fn(async () => []) }),
       } as never,
       {
@@ -342,47 +344,373 @@ describe('TenantDataEncryptionService system-scoped maps', () => {
   })
 })
 
+type PolicyRow = {
+  entity_id: string
+  tenant_id: string | null
+  organization_id: string | null
+  fields_json: Array<{ field: string; hashField?: string | null }>
+}
+
+// Evaluates the scope predicate of the single policy statement against an in-memory table:
+// `[entityId, tenantId]` selects every row of the tenant plus the global row (tenant-wide scope,
+// including the all-organizations aggregate); `[entityId, tenantId, organizationId]` selects the
+// exact, tenant-wide and global rows only.
+function selectPolicyRows(table: readonly PolicyRow[], params: readonly unknown[]): PolicyRow[] {
+  const [entityId, tenantId, organizationId] = params
+  return table.filter((row) => {
+    if (row.entity_id !== entityId) return false
+    if (row.tenant_id === null && row.organization_id === null) return true
+    if (row.tenant_id !== (tenantId ?? null)) return false
+    if (params.length === 2) return true
+    return row.organization_id === null || row.organization_id === organizationId
+  })
+}
+
+function makePolicyEm(readTable: () => readonly PolicyRow[]) {
+  const execute = jest.fn(async (_sql: string, params: readonly unknown[] = []) => selectPolicyRows(readTable(), params))
+  return { em: { execute }, execute }
+}
+
 describe('TenantDataEncryptionService.getEncryptedFieldNames', () => {
   it('returns active encryption-map field names for query planning', async () => {
-    const service = new TenantDataEncryptionService({} as never)
-    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
-    ;(service as unknown as {
-      getMap: () => Promise<{ fields: Array<{ field?: unknown }> }>
-    }).getMap = jest.fn(async () => ({
-      fields: [
+    const entityId = 'customers:customer_entity'
+    const { em } = makePolicyEm(() => [{
+      entity_id: entityId,
+      tenant_id: 't1',
+      organization_id: 'org1',
+      fields_json: [
         { field: 'display_name' },
         { field: 'primary_email' },
         { field: '' },
-        { field: null },
+        { field: null as unknown as string },
       ],
-    }))
+    }])
+    const service = new TenantDataEncryptionService(em as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
 
     await expect(
-      service.getEncryptedFieldNames('customers:customer_entity', 't1', 'org1'),
+      service.getEncryptedFieldNames(entityId, 't1', 'org1'),
     ).resolves.toEqual(['display_name', 'primary_email'])
   })
 
-  it('returns org-scoped field union for all-organization query planning', async () => {
-    const execute = jest.fn(async (_sql: string, params: unknown[]) => {
-      if (params.length === 3) return []
-      return [
-        { fields_json: [{ field: 'display_name' }, { field: 'primary_email' }] },
-        { fields_json: [{ field: 'display_name' }, { field: 'description' }, { field: '' }] },
-      ]
-    })
-    const service = new TenantDataEncryptionService({
-      getConnection: () => ({ execute }),
-    } as never)
+  it('returns org-scoped field union for all-organization query planning in one statement', async () => {
+    const entityId = 'test:all_org_customer_entity'
+    const { em, execute } = makePolicyEm(() => [
+      { entity_id: entityId, tenant_id: 'tenant-all', organization_id: 'org-a', fields_json: [{ field: 'display_name' }, { field: 'primary_email' }] },
+      { entity_id: entityId, tenant_id: 'tenant-all', organization_id: 'org-b', fields_json: [{ field: 'display_name' }, { field: 'description' }, { field: '' }] },
+      { entity_id: entityId, tenant_id: 'other-tenant', organization_id: 'org-c', fields_json: [{ field: 'foreign' }] },
+    ])
+    const service = new TenantDataEncryptionService(em as never)
     jest.spyOn(service, 'isEnabled').mockReturnValue(true)
 
     await expect(
-      service.getEncryptedFieldNames('test:all_org_customer_entity', 'tenant-all', null),
+      service.getEncryptedFieldNames(entityId, 'tenant-all', null),
     ).resolves.toEqual(['display_name', 'primary_email', 'description'])
 
+    expect(execute).toHaveBeenCalledTimes(1)
     expect(execute).toHaveBeenCalledWith(
-      expect.stringContaining('organization_id is not null'),
-      ['test:all_org_customer_entity', 'tenant-all'],
+      expect.stringContaining('tenant_id is null and organization_id is null'),
+      [entityId, 'tenant-all'],
+    )
+  })
+
+  it('resolves the exact, tenant-wide and global fallback chain with one statement', async () => {
+    const entityId = 'test:fallback_chain'
+    let table: PolicyRow[] = [
+      { entity_id: entityId, tenant_id: null, organization_id: null, fields_json: [{ field: 'global' }] },
+      { entity_id: entityId, tenant_id: 'tenant-1', organization_id: null, fields_json: [{ field: 'tenant_wide' }] },
+      { entity_id: entityId, tenant_id: 'tenant-1', organization_id: 'org-1', fields_json: [{ field: 'exact' }] },
+    ]
+    const { em, execute } = makePolicyEm(() => table)
+    const service = new TenantDataEncryptionService(em as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames(entityId, 'tenant-1', 'org-1')).resolves.toEqual(['exact'])
+    table = table.filter((row) => row.organization_id !== 'org-1')
+    await expect(service.getEncryptedFieldNames(entityId, 'tenant-1', 'org-1')).resolves.toEqual(['tenant_wide'])
+    table = table.filter((row) => row.tenant_id !== 'tenant-1')
+    await expect(service.getEncryptedFieldNames(entityId, 'tenant-1', 'org-1')).resolves.toEqual(['global'])
+    expect(execute).toHaveBeenCalledTimes(3)
+    for (const [, params] of execute.mock.calls) expect(params).toEqual([entityId, 'tenant-1', 'org-1'])
+  })
+
+  it('fails closed when the EntityManager cannot execute SQL', async () => {
+    const service = new TenantDataEncryptionService({} as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames('test:no_executor', 'tenant-1', 'org-1'))
+      .rejects.toThrow('[internal]')
+  })
+})
+
+describe('TenantDataEncryptionService canonical map reads and invalidation', () => {
+  it('re-reads exact and all-organizations policies without waiting for invalidation', async () => {
+    const entityId = 'test:cache_invalidation_hit'
+    const tenantId = 'tenant-cache-invalidation-hit'
+    const organizationId = 'org-cache-invalidation-hit'
+    let exactFields = [{ field: 'existing_exact' }]
+    let aggregateFields = [{ field: 'existing_aggregate' }]
+    const { em } = makePolicyEm(() => [
+      { entity_id: entityId, tenant_id: tenantId, organization_id: organizationId, fields_json: exactFields },
+      { entity_id: entityId, tenant_id: tenantId, organization_id: 'org-aggregate', fields_json: aggregateFields },
+    ])
+    const service = new TenantDataEncryptionService(em as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['existing_exact'])
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, null))
+      .resolves.toEqual(['existing_exact', 'existing_aggregate'])
+
+    exactFields = [{ field: 'existing_exact' }, { field: 'fresh_exact' }]
+    aggregateFields = [{ field: 'existing_aggregate' }, { field: 'fresh_aggregate' }]
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['existing_exact', 'fresh_exact'])
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, null))
+      .resolves.toEqual(['existing_exact', 'fresh_exact', 'existing_aggregate', 'fresh_aggregate'])
+
+    await service.invalidateMap(entityId, tenantId, organizationId)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['existing_exact', 'fresh_exact'])
+  })
+
+  it('does not retain an exact miss after a map is committed', async () => {
+    const entityId = 'test:cache_invalidation_miss'
+    const tenantId = 'tenant-cache-invalidation-miss'
+    const organizationId = 'org-cache-invalidation-miss'
+    let table: PolicyRow[] = []
+    const { em } = makePolicyEm(() => table)
+    const service = new TenantDataEncryptionService(em as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId)).resolves.toEqual([])
+    table = [{ entity_id: entityId, tenant_id: tenantId, organization_id: organizationId, fields_json: [{ field: 'fresh_after_miss' }] }]
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['fresh_after_miss'])
+  })
+
+  it('never reads, publishes or deletes shared-cache entries', async () => {
+    const entityId = 'test:canonical_policy_over_shared_cache'
+    const tenantId = 'tenant-canonical-policy'
+    const organizationId = 'org-canonical-policy'
+    const cache = {
+      get: jest.fn(async () => ({ entityId, fields: [{ field: 'stale_shared_cache' }] })),
+      set: jest.fn(async () => undefined),
+      delete: jest.fn(async () => {
+        throw new Error('sensitive backend endpoint')
+      }),
+    }
+    const { em } = makePolicyEm(() => [
+      { entity_id: entityId, tenant_id: tenantId, organization_id: organizationId, fields_json: [{ field: 'fresh_exact' }] },
+    ])
+    const service = new TenantDataEncryptionService(em as never, { cache: cache as never })
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['fresh_exact'])
+    await expect(service.invalidateMap(entityId, tenantId, organizationId)).resolves.toBeUndefined()
+    expect(cache.get).not.toHaveBeenCalled()
+    expect(cache.set).not.toHaveBeenCalled()
+    expect(cache.delete).not.toHaveBeenCalled()
+  })
+})
+
+describe('TenantDataEncryptionService per-unit-of-work policy memo', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+  const tenantId = 'tenant-memo'
+  const organizationId = 'org-memo'
+
+  beforeEach(() => {
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  function makeService(entityId: string, table: { rows: PolicyRow[] }) {
+    const { execute } = makePolicyEm(() => table.rows)
+    const service = new TenantDataEncryptionService({ execute } as never, {
+      kms: {
+        getTenantDek: jest.fn(async (keyId: string) => ({ tenantId: keyId, key: fixedKey, fetchedAt: Date.now() })),
+        createTenantDek: jest.fn(async () => null),
+        isHealthy: () => true,
+      },
+    } as never)
+    table.rows.push({ entity_id: entityId, tenant_id: tenantId, organization_id: null, fields_json: [{ field: 'secret' }] })
+    return { service, execute }
+  }
+
+  function makeUnitOfWork(execute: jest.Mock) {
+    return { execute } as never
+  }
+
+  it('reads policy once per distinct scope for N decrypts on the same EntityManager', async () => {
+    const entityId = 'test:memo_same_em'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+    const em = makeUnitOfWork(execute)
+    const ciphertext = encryptWithAesGcm('value', fixedKey).value as string
+
+    const decrypted = await Promise.all(Array.from({ length: 25 }, () => (
+      service.decryptEntityPayload(entityId, { secret: ciphertext }, tenantId, organizationId, { em })
+    )))
+    await service.decryptEntityPayload(entityId, { secret: ciphertext }, tenantId, null, { em })
+    await service.encryptEntityPayload(entityId, { secret: 'value' }, tenantId, organizationId, { em })
+
+    expect(decrypted.every((row) => row.secret === 'value')).toBe(true)
+    expect(execute).toHaveBeenCalledTimes(2)
+    expect(execute.mock.calls.map(([, params]) => params)).toEqual([
+      [entityId, tenantId, organizationId],
+      [entityId, tenantId],
+    ])
+  })
+
+  it('keeps memos of different EntityManagers and transactions independent', async () => {
+    const entityId = 'test:memo_independent_em'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+    const first = makeUnitOfWork(execute)
+    const second = makeUnitOfWork(execute)
+    const transaction = {}
+    const transactional = { execute, getTransactionContext: () => transaction } as never
+
+    await service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em: first })
+    table.rows[0].fields_json = [{ field: 'secret' }, { field: 'rotated' }]
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em: first }))
+      .resolves.toEqual(['secret'])
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em: second }))
+      .resolves.toEqual(['secret', 'rotated'])
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em: transactional }))
+      .resolves.toEqual(['secret', 'rotated'])
+    expect(execute).toHaveBeenCalledTimes(3)
+  })
+
+  it('never memoizes lookups that fall back to the service EntityManager', async () => {
+    const entityId = 'test:memo_fallback_em'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+
+    await service.getEncryptedFieldNames(entityId, tenantId, organizationId)
+    await service.getEncryptedFieldNames(entityId, tenantId, organizationId)
+
+    expect(execute).toHaveBeenCalledTimes(2)
+  })
+
+  it('drops the memo when a map write goes through that EntityManager', async () => {
+    const entityId = 'test:memo_write_forget'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+    const em = makeUnitOfWork(execute)
+
+    await service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em })
+    table.rows[0].fields_json = [{ field: 'secret' }, { field: 'added' }]
+    forgetEncryptionPolicyMemo(em)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em }))
+      .resolves.toEqual(['secret', 'added'])
+    expect(execute).toHaveBeenCalledTimes(2)
+  })
+
+  it('drops every memo of this process when a map is invalidated', async () => {
+    const entityId = 'test:memo_invalidate'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+    const em = makeUnitOfWork(execute)
+
+    await service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em })
+    table.rows[0].fields_json = [{ field: 'secret' }, { field: 'added' }]
+    await service.invalidateMap(entityId, tenantId, null)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em }))
+      .resolves.toEqual(['secret', 'added'])
+    expect(execute).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not memoize a failed read', async () => {
+    const entityId = 'test:memo_failed_read'
+    const table = { rows: [] as PolicyRow[] }
+    const { service, execute } = makeService(entityId, table)
+    execute.mockRejectedValueOnce(new Error('connection terminated'))
+    const em = makeUnitOfWork(execute)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em }))
+      .rejects.toThrow('connection terminated')
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId, { em }))
+      .resolves.toEqual(['secret'])
+  })
+})
+
+describe('TenantDataEncryptionService duplicate map fail-safe', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  it('deterministically unions active duplicate rows so no declared field is stored as plaintext', async () => {
+    const entityId = 'test:duplicate_encryption_map'
+    const tenantId = 'tenant-duplicate-map'
+    const execute = jest.fn(async (sql: string) => {
+      expect(sql).toContain('order by organization_id asc, created_at asc, id asc')
+      return [
+        {
+          entity_id: entityId,
+          tenant_id: tenantId,
+          organization_id: 'org-1',
+          fields_json: [
+            { field: 'email' },
+            { field: 'display_name', hashField: 'display_name_hash' },
+          ],
+        },
+        {
+          entity_id: entityId,
+          tenant_id: tenantId,
+          organization_id: 'org-1',
+          fields_json: [
+            { field: 'email', hashField: 'email_hash' },
+            { field: 'phone' },
+          ],
+        },
+      ]
+    })
+    const service = new TenantDataEncryptionService(
+      { execute, getConnection: () => ({ execute }) } as never,
+      {
+        kms: {
+          getTenantDek: jest.fn(async () => ({ tenantId, key: fixedKey, fetchedAt: new Date() })),
+          createTenantDek: jest.fn(async () => null),
+          isHealthy: () => true,
+        },
+      } as never,
     )
+
+    const encrypted = await service.encryptEntityPayload(
+      entityId,
+      {
+        email: 'person@example.com',
+        email_hash: null,
+        display_name: 'Person',
+        display_name_hash: null,
+        phone: '+48123456789',
+      },
+      tenantId,
+      'org-1',
+    )
+
+    expect(decryptWithAesGcm(encrypted.email as string, fixedKey)).toBe('person@example.com')
+    expect(encrypted.email_hash).toBe(hashForLookup('person@example.com'))
+    expect(decryptWithAesGcm(encrypted.display_name as string, fixedKey)).toBe('Person')
+    expect(encrypted.display_name_hash).toBe(hashForLookup('Person'))
+    expect(decryptWithAesGcm(encrypted.phone as string, fixedKey)).toBe('+48123456789')
   })
 })
 
@@ -400,19 +728,20 @@ describe('TenantDataEncryptionService tenant-wide scope parity (issue #5949)', (
   })
 
   // A base (organization-less) map declaring `display_name`, plus an organization-scoped map that
-  // declares the extra `description` field. `getMap` only ever resolves the base map for
-  // organizationId = null; the all-organizations aggregate is the 2-parameter query.
+  // declares the extra `description` field. At organizationId = null the policy statement also
+  // returns the organization-scoped rows (2-parameter form) for the all-organizations aggregate.
   function makeService(entityId: string) {
-    const execute = jest.fn(async (_sql: string, params: unknown[]) => {
-      if (params.length === 3) {
-        return params[2] === null
-          ? [{ entity_id: entityId, fields_json: [{ field: 'display_name' }] }]
-          : []
-      }
-      return [{ fields_json: [{ field: 'description', hashField: 'description_hash' }] }]
-    })
+    const { execute } = makePolicyEm(() => [
+      { entity_id: entityId, tenant_id: tenantId, organization_id: null, fields_json: [{ field: 'display_name' }] },
+      {
+        entity_id: entityId,
+        tenant_id: tenantId,
+        organization_id: 'org-with-description',
+        fields_json: [{ field: 'description', hashField: 'description_hash' }],
+      },
+    ])
     const service = new TenantDataEncryptionService(
-      { getConnection: () => ({ execute }) } as never,
+      { execute } as never,
       {
         kms: {
           getTenantDek: jest.fn(async (keyId: string) => (
@@ -494,31 +823,63 @@ describe('TenantDataEncryptionService tenant-wide scope parity (issue #5949)', (
     expect(execute).not.toHaveBeenCalledWith(expect.anything(), [entityId, tenantId])
   })
 
-  it('caches the all-organizations aggregate across payload calls', async () => {
-    const entityId = 'test:parity_cached_entity'
+  it('re-reads the all-organizations aggregate across payload calls', async () => {
+    const entityId = 'test:parity_canonical_entity'
     const { service, execute } = makeService(entityId)
 
     await service.encryptEntityPayload(entityId, { description: 'first' }, tenantId, null)
     await service.encryptEntityPayload(entityId, { description: 'second' }, tenantId, null)
 
     const aggregateReads = execute.mock.calls.filter(([, params]) => (params as unknown[]).length === 2)
-    expect(aggregateReads).toHaveLength(1)
+    expect(aggregateReads).toHaveLength(2)
   })
+})
 
-  it('re-reads the all-organizations aggregate once its memory entry passes the 300s TTL', async () => {
-    const entityId = 'test:parity_expired_cache_entity'
-    const { service, execute } = makeService(entityId)
-    const nowSpy = jest.spyOn(Date, 'now')
-
-    nowSpy.mockReturnValue(1_000_000)
-    await service.encryptEntityPayload(entityId, { description: 'first' }, tenantId, null)
-
-    nowSpy.mockReturnValue(1_000_000 + 300_000 + 1)
-    await service.encryptEntityPayload(entityId, { description: 'second' }, tenantId, null)
-
-    nowSpy.mockRestore()
+describe('TenantDataEncryptionService map read failures (issue #6334)', () => {
+  const tenantId = 'tenant-6334'
+  const organizationId = 'org-6334'
+  const mapRow = (entityId: string) => [{
+    entity_id: entityId,
+    tenant_id: tenantId,
+    organization_id: organizationId,
+    fields_json: [{ field: 'display_name' }],
+  }]
+
+  function makeService(execute: jest.Mock) {
+    const service = new TenantDataEncryptionService({ execute, getConnection: () => ({ execute }) } as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+    return service
+  }
 
-    const aggregateReads = execute.mock.calls.filter(([, params]) => (params as unknown[]).length === 2)
-    expect(aggregateReads).toHaveLength(2)
+  it('retries the map read after a failed one instead of replaying the stored rejection', async () => {
+    const entityId = 'test:inflight_rejection_entity'
+    const execute = jest.fn()
+      .mockRejectedValueOnce(new Error('connection terminated'))
+      .mockImplementation(async () => mapRow(entityId))
+    const service = makeService(execute)
+
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .rejects.toThrow('connection terminated')
+    await expect(service.getEncryptedFieldNames(entityId, tenantId, organizationId))
+      .resolves.toEqual(['display_name'])
+  })
+
+  it('does not couple a concurrent reader to another failing read', async () => {
+    const entityId = 'test:inflight_joined_rejection_entity'
+    let rejectFirst: (error: Error) => void = () => {}
+    const execute = jest.fn()
+      .mockImplementationOnce(() => new Promise((_resolve, reject) => { rejectFirst = reject }))
+      .mockImplementation(async () => mapRow(entityId))
+    const service = makeService(execute)
+
+    const owner = service.getEncryptedFieldNames(entityId, tenantId, organizationId)
+    const joiner = service.getEncryptedFieldNames(entityId, tenantId, organizationId)
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(execute).toHaveBeenCalledTimes(2)
+    await expect(joiner).resolves.toEqual(['display_name'])
+    rejectFirst(new Error('statement timeout'))
+
+    await expect(owner).rejects.toThrow('statement timeout')
+    expect(execute).toHaveBeenCalledTimes(2)
   })
 })

package/src/lib/encryption/kms.ts

@@ -388,17 +388,12 @@ export class HashicorpVaultKmsService implements KmsService {
 
 let loggedDerivedKeyFallbackBanner = false
 
-function fingerprintSecret(secret: string): string {
-  return crypto.createHash('sha256').update(secret, 'utf8').digest('hex').slice(0, 16)
-}
-
 export function buildDerivedKeyFallbackBannerLines(opts: DerivedSecret): string[] {
   const sourceLine =
     opts.source === 'explicit' ? `Source: ${opts.envName}` : 'Source: dev default secret (do NOT use in production)'
   return [
     '🚨 Using derived tenant encryption keys (Vault unavailable / no DEK)',
     sourceLine,
-    `Secret fingerprint (sha256, truncated): ${fingerprintSecret(opts.secret)}`,
     'Persist this secret securely. Without it, encrypted tenant data cannot be recovered after restart.',
   ]
 }
@@ -419,7 +414,7 @@ function logDerivedKeyFallbackBanner(opts: DerivedSecret): void {
   ]
   process.stderr.write(bannerLines.join('\n') + '\n')
   logger.warn('Using derived tenant encryption keys (Vault unavailable / no DEK)', {
-    secretFingerprint: fingerprintSecret(opts.secret),
+    fallbackSource: opts.envName,
   })
 }
 

package/src/lib/encryption/likeFilterWarning.ts

@@ -73,17 +73,25 @@ function resolveEntityId(em: EntityManager, entityName: EntityName<any>): string
  * already warn about their own `ILIKE` fallback; this covers the raw-ORM path
  * that never reaches them. Issue #5051, related to #2990.
  *
+ * A caller whose predicate the walker cannot read — a `raw()` fragment keyed by
+ * a symbol, say, which `Object.entries` never yields — passes the matched
+ * properties as `likeFields` instead, so wrapping a filter in raw SQL does not
+ * silently opt it out of the diagnostic.
+ *
  * Never throws and never blocks the query.
  */
 export async function warnOnEncryptedLikeFilter(params: {
   em: EntityManager
   entityName: EntityName<any>
-  where: unknown
+  where?: unknown
+  likeFields?: readonly string[]
   tenantId?: string | null
   encryptionService?: TenantDataEncryptionService | null
 }): Promise<void> {
   if (!isWarningEnabled()) return
-  const fields = collectLikeFilterFields(params.where)
+  const fields = Array.from(
+    new Set([...collectLikeFilterFields(params.where), ...(params.likeFields ?? [])]),
+  )
   if (!fields.length) return
   try {
     const entity = resolveEntityId(params.em, params.entityName)

package/src/lib/encryption/migration-backfill.ts

@@ -0,0 +1,90 @@
+import type { ModuleEncryptionFieldRule, ModuleEncryptionMap } from '../../modules/encryption'
+
+/**
+ * Tenant encryption maps are seeded only when a tenant is created (`auth:setup`) or by hand
+ * (`mercato entities seed-encryption`). A map entry added to a module after tenants exist therefore
+ * never reaches them: `encryptEntityPayload` finds no rule and the column is written as plaintext.
+ *
+ * `buildEncryptionMapBackfillSql` emits one idempotent statement for a module migration that closes
+ * that gap for every pre-existing (tenant, organization) scope with active maps:
+ * - inserts the whole map where the scope has no row for the entity yet (`NOT EXISTS` guard);
+ * - appends each missing field rule to rows that already exist, leaving other rules untouched.
+ *
+ * Scopes without active maps (encryption disabled) are skipped, mirroring `seed-encryption`. When the
+ * `encryption_maps` table does not exist yet (a fresh database where this module migrates before
+ * `entities`), the statement is a no-op: no tenant exists at that point either.
+ *
+ * Prefer a forward-only migration (`down()` without SQL): deleting by `entity_id` would also remove
+ * maps seeded at tenant creation or edited by admins and silently switch encryption off.
+ */
+
+const ENTITY_ID_PATTERN = /^[a-z0-9_]+:[a-z0-9_]+$/
+const FIELD_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+function assertIdentifier(value: unknown, pattern: RegExp, label: string): string {
+  if (typeof value !== 'string' || !pattern.test(value)) {
+    throw new Error(`[internal] buildEncryptionMapBackfillSql received an invalid ${label}: ${String(value)}`)
+  }
+  return value
+}
+
+function normalizeRules(map: ModuleEncryptionMap): ModuleEncryptionFieldRule[] {
+  if (!Array.isArray(map.fields) || map.fields.length === 0) {
+    throw new Error(`[internal] buildEncryptionMapBackfillSql requires at least one field for ${map.entityId}`)
+  }
+  const rules: ModuleEncryptionFieldRule[] = []
+  for (const rule of map.fields) {
+    const field = assertIdentifier(rule?.field, FIELD_NAME_PATTERN, 'field name')
+    if (rules.some((existing) => existing.field === field)) continue
+    const hashField = rule.hashField == null ? null : assertIdentifier(rule.hashField, FIELD_NAME_PATTERN, 'hash field name')
+    rules.push(hashField ? { field, hashField } : { field })
+  }
+  return rules
+}
+
+function jsonbLiteral(value: unknown): string {
+  return `'${JSON.stringify(value)}'::jsonb`
+}
+
+export function buildEncryptionMapBackfillSql(map: ModuleEncryptionMap): string {
+  const entityId = assertIdentifier(map?.entityId, ENTITY_ID_PATTERN, 'entity id')
+  if (map.keyScope === 'system') {
+    throw new Error(`[internal] buildEncryptionMapBackfillSql: ${entityId} is system-scoped and is resolved from module code, not encryption_maps`)
+  }
+  const rules = normalizeRules(map)
+  const appendStatements = rules.map((rule) => `
+  update "encryption_maps"
+  set "fields_json" = coalesce("fields_json", '[]'::jsonb) || ${jsonbLiteral([rule])}, "updated_at" = now()
+  where "entity_id" = '${entityId}'
+    and "deleted_at" is null
+    and jsonb_typeof(coalesce("fields_json", '[]'::jsonb)) = 'array'
+    and not exists (
+      select 1
+      from jsonb_array_elements(case when jsonb_typeof("fields_json") = 'array' then "fields_json" else '[]'::jsonb end) as rule
+      where rule->>'field' = '${rule.field}'
+    );`).join('\n')
+
+  return `do $$
+begin
+  if to_regclass('encryption_maps') is null then
+    return;
+  end if;
+
+  insert into "encryption_maps" ("id", "entity_id", "tenant_id", "organization_id", "fields_json", "is_active", "created_at", "updated_at")
+  select gen_random_uuid(), '${entityId}', src."tenant_id", src."organization_id", ${jsonbLiteral(rules)}, true, now(), now()
+  from (
+    select distinct "tenant_id", "organization_id"
+    from "encryption_maps"
+    where "is_active" = true and "deleted_at" is null
+  ) src
+  where not exists (
+    select 1 from "encryption_maps" existing
+    where existing."entity_id" = '${entityId}'
+      and existing."tenant_id" is not distinct from src."tenant_id"
+      and existing."organization_id" is not distinct from src."organization_id"
+      and existing."deleted_at" is null
+  );
+${appendStatements}
+end
+$$;`
+}