@open-mercato/shared 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/lib/encryption/policyMemo.ts

@@ -0,0 +1,51 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EncryptedFieldRule, EncryptionMapRecord } from './tenantDataEncryptionService'
+
+export type ResolvedEncryptionPolicy = {
+  map: EncryptionMapRecord | null
+  fields: EncryptedFieldRule[]
+}
+
+type PolicyMemo = {
+  generation: number
+  entries: Map<string, Promise<ResolvedEncryptionPolicy>>
+}
+
+const policyMemos = new WeakMap<object, PolicyMemo>()
+let policyMemoGeneration = 0
+
+function resolvePolicyMemoOwners(em: EntityManager): object[] {
+  const candidate = em as unknown as { getTransactionContext?: () => unknown }
+  const context = typeof candidate.getTransactionContext === 'function'
+    ? candidate.getTransactionContext()
+    : undefined
+  return context && typeof context === 'object' ? [context, em] : [em]
+}
+
+/**
+ * The encryption-policy reads of one unit of work: keyed by the EntityManager's open transaction
+ * when it has one, otherwise by the EntityManager itself, so the memo can never outlive either.
+ */
+export function getEncryptionPolicyMemo(em: EntityManager): Map<string, Promise<ResolvedEncryptionPolicy>> {
+  const [owner] = resolvePolicyMemoOwners(em)
+  const existing = policyMemos.get(owner)
+  if (existing && existing.generation === policyMemoGeneration) return existing.entries
+  const memo: PolicyMemo = { generation: policyMemoGeneration, entries: new Map() }
+  policyMemos.set(owner, memo)
+  return memo.entries
+}
+
+/** Retire every policy memo of this process; called after an encryption map is invalidated. */
+export function invalidateEncryptionPolicyMemos(): void {
+  policyMemoGeneration += 1
+}
+
+/**
+ * Forget the encryption-policy reads memoized for an EntityManager (and its open transaction).
+ * Encryption-map writers call it right after writing through that EntityManager so later
+ * encrypt/decrypt decisions in the same unit of work see the new policy.
+ */
+export function forgetEncryptionPolicyMemo(em: EntityManager | null | undefined): void {
+  if (!em) return
+  for (const owner of resolvePolicyMemoOwners(em)) policyMemos.delete(owner)
+}

package/src/lib/encryption/subscriber.ts

@@ -1,7 +1,9 @@
-import type { EntityMetadata, EventArgs, EventSubscriber } from '@mikro-orm/core'
-import { ReferenceKind } from '@mikro-orm/core'
+import type { EntityMetadata, EventArgs, EventSubscriber, FlushEventArgs } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { DriverException, ReferenceKind } from '@mikro-orm/core'
 import { resolveEntityIdFromMetadata } from './entityIds'
 import { TenantDataEncryptionService, parseDecryptedFieldValue } from './tenantDataEncryptionService'
+import { forgetEncryptionPolicyMemo } from './policyMemo'
 import { isTenantDataEncryptionEnabled } from './toggles'
 import { isEncryptionDebugEnabled } from './toggles'
 import { resolveTenantEncryptionService } from './customFieldValues'
@@ -90,6 +92,26 @@ function getSubscriberForService(service: TenantDataEncryptionService): TenantEn
 const toSnakeCase = (value: string): string =>
   value.replace(/([A-Z])/g, '_$1').replace(/__/g, '_').toLowerCase()
 
+function isDatabaseError(err: unknown): boolean {
+  if (err instanceof DriverException) return true
+  if (!err || typeof err !== 'object') return false
+  const candidate = err as { code?: unknown; severity?: unknown; sqlState?: unknown }
+  if (typeof candidate.sqlState === 'string') return true
+  return typeof candidate.code === 'string' && typeof candidate.severity === 'string'
+}
+
+function isInTransaction(em: unknown): boolean {
+  if (!em || typeof em !== 'object') return false
+  const candidate = em as { isInTransaction?: () => boolean; getTransactionContext?: () => unknown }
+  try {
+    if (typeof candidate.isInTransaction === 'function') return candidate.isInTransaction()
+    if (typeof candidate.getTransactionContext === 'function') return candidate.getTransactionContext() != null
+  } catch {
+    return false
+  }
+  return false
+}
+
 export class TenantEncryptionSubscriber implements EventSubscriber<any> {
   constructor(private readonly service: TenantDataEncryptionService) {}
 
@@ -247,7 +269,13 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
       return
     }
     const { tenantId, organizationId } = resolveScope(target)
-    const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId)
+    // Hand the flushing EntityManager to the policy read so it runs on this
+    // transaction's own connection instead of acquiring a second pooled one
+    // (an uncached lookup from inside an open write transaction deadlocks the
+    // pool once every slot is held by such a transaction).
+    const encrypted = await this.service.encryptEntityPayload(entityId, target, tenantId, organizationId, {
+      em: em as EntityManager | undefined,
+    })
     const metaProps: Record<string, unknown> = resolvedMeta?.properties && typeof resolvedMeta.properties === 'object'
       ? resolvedMeta.properties
       : {}
@@ -349,7 +377,9 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     // drop the pending write (e.g. an undo handler that mutates an entity, then loads a related
     // encrypted entity whose deep-decrypt recurses back into the still-dirty entity before flush).
     const hadPendingChanges = syncOriginal ? this.hasPendingChanges(target, resolvedMeta, em as any) : false
-    const decrypted = await this.service.decryptEntityPayload(entityId, target, scopedTenantId, scopedOrgId)
+    const decrypted = await this.service.decryptEntityPayload(entityId, target, scopedTenantId, scopedOrgId, {
+      em: em as EntityManager | undefined,
+    })
     Object.assign(target, decrypted)
     this.restoreDecryptedJsonColumns(target, resolvedMeta)
     if (syncOriginal && !hadPendingChanges) {
@@ -426,6 +456,9 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
         }
       }
     } catch (err) {
+      // A failed statement aborts the surrounding Postgres transaction; swallowing it here would
+      // only move the failure to the caller's next statement ("current transaction is aborted").
+      if (isDatabaseError(err) && isInTransaction(em)) throw err
       debug('⚠️ subscriber.deep_decrypt.error', {
         entityId,
         message: (err as Error)?.message ?? String(err),
@@ -458,6 +491,10 @@ export class TenantEncryptionSubscriber implements EventSubscriber<any> {
     await this.decrypt(args.entity as Record<string, unknown>, args.meta, args.em, { syncOriginal: true })
   }
 
+  afterFlush(args: FlushEventArgs) {
+    forgetEncryptionPolicyMemo(args.em as unknown as EntityManager)
+  }
+
   async afterFind(args: EventArgs<any> & { entities?: unknown[] }) {
     const entities = Array.isArray(args.entities) ? args.entities : []
     for (const entity of entities) {

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -11,6 +11,11 @@ import {
 import { createKmsService, type KmsService, type TenantDek } from './kms'
 import { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'
 import { createLogger } from '../logger'
+import {
+  getEncryptionPolicyMemo,
+  invalidateEncryptionPolicyMemos,
+  type ResolvedEncryptionPolicy,
+} from './policyMemo'
 import type { EncryptionKeyScope, ModuleEncryptionMap } from '../../modules/encryption'
 
 const logger = createLogger('shared').child({ component: 'tenant-encryption' })
@@ -36,15 +41,19 @@ type SqlConnection = {
   execute(sql: string, params?: readonly unknown[]): Promise<unknown>
 }
 
-const MAP_MISS_TTL_MS = 5 * 60 * 1000
 // Mirror the Vault KMS default DEK TTL so a rotated/revoked tenant key is picked
 // up by long-lived processes without a restart (#2746). The service-level cache
 // previously had no TTL and shadowed the KMS's own 15-minute expiry.
 const DEK_CACHE_TTL_MS = 15 * 60 * 1000
-// Matches the `{ ttl: 300 }` passed to the `CacheStrategy` layer for the all-organizations
-// aggregate, so a process that only ever hits its own memory entry (no shared cache configured,
-// or already warm) still picks up a runtime map edit within the same bound (#6066).
-const AGGREGATE_CACHE_TTL_MS = 300 * 1000
+
+function readScopeId(row: Record<string, unknown>, column: string, property: string): string | null {
+  const value = row[column] ?? row[property]
+  return value == null ? null : String(value).toLowerCase()
+}
+
+function sameScopeId(value: string | null, expected: string | null): boolean {
+  return value === (expected == null ? null : expected.toLowerCase())
+}
 
 function cacheKey(key: MapCacheKey): string {
   return [
@@ -55,11 +64,12 @@ function cacheKey(key: MapCacheKey): string {
   ].join(':')
 }
 
-// Tag for the aggregate of every organization-scoped map of an entity/tenant. The prefix differs
-// from `cacheKey`'s in its first segment rather than by an extra one, so no entity id can spell a
-// tag that collides with an aggregate (`encmap:all-orgs:x:y` would be reachable both ways).
-function allOrganizationsCacheKey(entityId: string, tenantId: string | null): string {
-  return ['encmap-all-orgs', entityId.toLowerCase(), tenantId ?? 'null'].join(':')
+/**
+ * @deprecated Nothing reads this key: encryption policy is resolved from the canonical table and
+ * `invalidateMap` no longer publishes a version token. Kept for import compatibility.
+ */
+export function encryptionMapPolicyVersionCacheKey(entityId: string): string {
+  return ['encmap-policy-version', entityId.toLowerCase()].join(':')
 }
 
 function debug(event: string, payload: Record<string, unknown>) {
@@ -227,41 +237,45 @@ export function resolveEncryptionKeyId(
   return keyScope === 'system' ? `system:${entityId}` : tenantId ?? null
 }
 
-function getSqlConnection(em: EntityManager): SqlConnection | null {
-  const source = em as { getConnection?: () => unknown }
-  const conn = source.getConnection?.()
-  if (!conn || typeof conn !== 'object') return null
-  const candidate = conn as { execute?: unknown }
+/**
+ * Runs a map lookup on an EntityManager rather than on `em.getConnection()`.
+ *
+ * `AbstractSqlConnection.execute` falls back to the pool whenever it is handed no
+ * transaction context, so the connection-level call takes a SECOND pooled
+ * connection while the caller already holds one for its open write transaction.
+ * Policy resolution is not cached across units of work and runs for every
+ * encrypt/decrypt decision that misses the per-unit-of-work memo, so under
+ * concurrency every in-flight write waits on a connection that only another
+ * waiting write could release — the pool deadlocks at `DB_POOL_MAX` and never
+ * recovers. `SqlEntityManager.execute` forwards `getTransactionContext()`, so the
+ * lookup reuses the caller's own connection, provided callers hand in the
+ * EntityManager that owns the transaction (the flush subscriber passes
+ * `args.em`). Reading the policy inside that transaction is also what an atomic,
+ * transaction-aware map write needs.
+ */
+function getSqlExecutor(em: EntityManager): SqlConnection | null {
+  const candidate = em as unknown as { execute?: unknown }
   if (typeof candidate.execute !== 'function') return null
-  return candidate as SqlConnection
+  return candidate as unknown as SqlConnection
 }
 
 export class TenantDataEncryptionService {
-  private static globalMemoryCache = new Map<string, EncryptionMapRecord>()
-  private static globalAggregateMemoryCache = new Map<string, { at: number; record: EncryptionMapRecord }>()
-  private static globalInflightMaps = new Map<string, Promise<EncryptionMapRecord | null>>()
   private static globalDekCache = new Map<string, TenantDek>()
   private static globalInflightDeks = new Map<string, Promise<TenantDek | null>>()
-  private static globalMissCache = new Map<string, number>()
   private readonly kms: KmsService
-  private readonly cache?: CacheStrategy
-  private readonly memoryCache = TenantDataEncryptionService.globalMemoryCache
-  private readonly aggregateMemoryCache = TenantDataEncryptionService.globalAggregateMemoryCache
   private readonly dekCache = TenantDataEncryptionService.globalDekCache
   private readonly inflightDeks = TenantDataEncryptionService.globalInflightDeks
-  private readonly inflightMaps = TenantDataEncryptionService.globalInflightMaps
-  private readonly missCache = TenantDataEncryptionService.globalMissCache
   private readonly systemDefaultMaps: Map<string, ModuleEncryptionMap>
 
   constructor(
     private em: EntityManager,
     opts?: {
+      /** Accepted for compatibility; encryption policy is never cached across units of work. */
       cache?: CacheStrategy
       kms?: KmsService
       defaultEncryptionMaps?: readonly ModuleEncryptionMap[]
     }
   ) {
-    this.cache = opts?.cache
     this.kms = opts?.kms ?? createKmsService()
     this.systemDefaultMaps = new Map(
       (opts?.defaultEncryptionMaps ?? [])
@@ -313,7 +327,6 @@ export class TenantDataEncryptionService {
     if (typeof this.kms.createTenantDek !== 'function') return existing ?? null
     // Dedupe concurrent first-time creation within this process so two callers
     // can't each generate a distinct DEK and overwrite one another (#2746).
-    // Mirrors the encryption-map inflight dedupe (`globalInflightMaps`).
     const pending = this.inflightDeks.get(tenantId)
     if (pending) return pending
     const creation = (async () => {
@@ -335,86 +348,65 @@ export class TenantDataEncryptionService {
     return dek
   }
 
-  private async fetchMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {
+  /**
+   * Reads every row that can decide the policy for `key` in ONE statement: the exact scope, the
+   * tenant-wide scope, and the global scope — plus, at the tenant-wide scope, every
+   * organization-scoped map of the tenant for the all-organizations aggregate (#5949). Precedence
+   * and duplicate merging happen in JS so the result is identical to resolving the fallback chain
+   * one scope at a time.
+   */
+  private async loadPolicy(key: MapCacheKey, em?: EntityManager): Promise<ResolvedEncryptionPolicy> {
     // Bypass ORM lifecycle hooks to avoid recursive decrypt loops by querying directly.
-    const conn = getSqlConnection(this.em)
-    if (!conn) return null
+    const conn = getSqlExecutor(em ?? this.em)
+    if (!conn) {
+      throw new Error('[internal] Encryption policy lookup requires an EntityManager that can execute SQL')
+    }
+    const includeAllOrganizations = key.organizationId == null
+    const scopeClause = includeAllOrganizations
+      ? 'tenant_id is not distinct from ?'
+      : '(tenant_id is not distinct from ? and (organization_id = ? or organization_id is null))'
     const sql = `
-      select entity_id, fields_json
+      select entity_id, tenant_id, organization_id, fields_json
       from encryption_maps
       where entity_id = ?
-        and tenant_id is not distinct from ?
-        and organization_id is not distinct from ?
         and is_active = true
         and deleted_at is null
-      limit 1
+        and (${scopeClause} or (tenant_id is null and organization_id is null))
+      order by organization_id asc, created_at asc, id asc
     `
-    const rows = await conn.execute(sql, [key.entityId, key.tenantId ?? null, key.organizationId ?? null])
-    const row = Array.isArray(rows) && rows.length && rows[0] && typeof rows[0] === 'object'
-      ? rows[0] as Record<string, unknown>
-      : null
-    if (!row) return null
-    return {
-      entityId: String(row.entity_id ?? row.entityId ?? key.entityId),
-      fields: readEncryptedFieldsJson(row),
-    }
-  }
-
-  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {
-    const declared = this.systemDefaultMaps.get(entityId)
-    if (!declared) return record
-    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({
-      field: field.field,
-      hashField: field.hashField ?? null,
-    }))
-    const declaredFields = new Set(fields.map((field) => field.field))
-    for (const field of record?.fields ?? []) {
-      if (!declaredFields.has(field.field)) fields.push(field)
-    }
-    return {
-      entityId,
-      keyScope: 'system',
-      fields,
-    }
+    const params = includeAllOrganizations
+      ? [key.entityId, key.tenantId]
+      : [key.entityId, key.tenantId, key.organizationId]
+    const rows = await conn.execute(sql, params)
+    const records = Array.isArray(rows)
+      ? rows.filter((row): row is Record<string, unknown> => Boolean(row) && typeof row === 'object')
+      : []
+
+    const map = this.applySystemDefault(this.pickMostSpecificMap(key, records), key.entityId)
+    const mapRules = normalizeEncryptedFieldRules(map?.fields)
+    if (!includeAllOrganizations) return { map, fields: mapRules }
+    const organizationRows = records.filter((record) => (
+      sameScopeId(readScopeId(record, 'tenant_id', 'tenantId'), key.tenantId)
+      && readScopeId(record, 'organization_id', 'organizationId') !== null
+    ))
+    const organizationRules = mergeEncryptedFieldRules(
+      organizationRows.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record))),
+    )
+    return { map, fields: mergeEncryptedFieldRules([mapRules, organizationRules]) }
   }
 
-  private async getMap(key: MapCacheKey): Promise<EncryptionMapRecord | null> {
-    const shouldSkipLookup = (tag: string) => {
-      const expiresAt = this.missCache.get(tag)
-      if (!expiresAt) return false
-      if (expiresAt > Date.now()) return true
-      this.missCache.delete(tag)
-      return false
-    }
-    const recordMiss = (tag: string) => {
-      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)
-    }
-
+  private pickMostSpecificMap(key: MapCacheKey, records: Record<string, unknown>[]): EncryptionMapRecord | null {
     const candidates: MapCacheKey[] = [
       key,
-      { entityId: key.entityId, tenantId: key.tenantId ?? null, organizationId: null },
+      { entityId: key.entityId, tenantId: key.tenantId, organizationId: null },
       { entityId: key.entityId, tenantId: null, organizationId: null },
     ]
     for (const candidate of candidates) {
-      const tag = cacheKey(candidate)
-      if (shouldSkipLookup(tag)) continue
-      if (this.inflightMaps.has(tag)) {
-        const pending = this.inflightMaps.get(tag)!
-        const resolved = await pending
-        if (resolved) return this.applySystemDefault(resolved, key.entityId)
-      }
-      const mem = this.memoryCache.get(tag)
-      if (mem) return this.applySystemDefault(mem, key.entityId)
-      if (this.cache && typeof this.cache.get === 'function') {
-        const cached = await this.cache.get(tag)
-        if (cached) return this.applySystemDefault(cached as EncryptionMapRecord, key.entityId)
-      }
-      const pending = this.fetchMap(candidate)
-      this.inflightMaps.set(tag, pending)
-      const loaded = await pending
-      this.inflightMaps.delete(tag)
-      if (!loaded) {
-        recordMiss(tag)
+      const matches = records.filter((record) => (
+        sameScopeId(readScopeId(record, 'tenant_id', 'tenantId'), candidate.tenantId)
+        && sameScopeId(readScopeId(record, 'organization_id', 'organizationId'), candidate.organizationId)
+      ))
+      if (!matches.length) {
         debug('🔍 encmap.miss', {
           entityId: candidate.entityId,
           tenantId: candidate.tenantId,
@@ -422,125 +414,75 @@ export class TenantDataEncryptionService {
         })
         continue
       }
-      this.missCache.delete(tag)
-      this.memoryCache.set(tag, loaded)
-      if (this.cache && typeof this.cache.set === 'function') {
-        await this.cache.set(tag, loaded, { ttl: 300 })
+      if (matches.length > 1) {
+        logger.warn('Duplicate live encryption maps detected; merging field rules fail-safe', {
+          entityId: candidate.entityId,
+          tenantId: candidate.tenantId,
+          organizationId: candidate.organizationId,
+          count: matches.length,
+        })
+      }
+      return {
+        entityId: String(matches[0].entity_id ?? matches[0].entityId ?? key.entityId),
+        fields: mergeEncryptedFieldRules(matches.map((record) => normalizeEncryptedFieldRules(readEncryptedFieldsJson(record)))),
       }
-      return this.applySystemDefault(loaded, key.entityId)
-    }
-    return this.applySystemDefault(null, key.entityId)
-  }
-
-  private async fetchAllOrganizationFieldRules(
-    entityId: string,
-    tenantId: string | null,
-  ): Promise<EncryptedFieldRule[]> {
-    const conn = getSqlConnection(this.em)
-    if (!conn) return []
-    const sql = `
-      select fields_json
-      from encryption_maps
-      where entity_id = ?
-        and tenant_id is not distinct from ?
-        and organization_id is not null
-        and is_active = true
-        and deleted_at is null
-    `
-    const rows = await conn.execute(sql, [entityId, tenantId])
-    if (!Array.isArray(rows) || rows.length === 0) return []
-    const groups: EncryptedFieldRule[][] = []
-    for (const row of rows) {
-      if (!row || typeof row !== 'object') continue
-      groups.push(normalizeEncryptedFieldRules(readEncryptedFieldsJson(row as Record<string, unknown>)))
     }
-    return mergeEncryptedFieldRules(groups)
+    return null
   }
 
-  /**
-   * Cached aggregate of every organization-scoped map for an entity/tenant. `encryptEntityPayload`
-   * and `decryptEntityPayload` consult it on every row at the tenant-wide scope, so the uncached
-   * read this used to be would add a round-trip per flush and per load (#5949).
-   */
-  private async getAllOrganizationFieldRules(
-    entityId: string,
-    tenantId: string | null,
-  ): Promise<EncryptedFieldRule[]> {
-    const tag = allOrganizationsCacheKey(entityId, tenantId)
-    const missExpiresAt = this.missCache.get(tag)
-    if (missExpiresAt) {
-      if (missExpiresAt > Date.now()) return []
-      this.missCache.delete(tag)
-    }
-    const mem = this.aggregateMemoryCache.get(tag)
-    if (mem) {
-      if (mem.at + AGGREGATE_CACHE_TTL_MS > Date.now()) return mem.record.fields
-      this.aggregateMemoryCache.delete(tag)
-    }
-    if (this.cache && typeof this.cache.get === 'function') {
-      const cached = await this.cache.get(tag)
-      if (cached) {
-        const record = cached as EncryptionMapRecord
-        this.aggregateMemoryCache.set(tag, { at: Date.now(), record })
-        return record.fields
-      }
-    }
-    const inflight = this.inflightMaps.get(tag)
-    if (inflight) return (await inflight)?.fields ?? []
-    const pending = (async (): Promise<EncryptionMapRecord | null> => {
-      const fields = await this.fetchAllOrganizationFieldRules(entityId, tenantId)
-      return fields.length ? { entityId, fields } : null
-    })()
-    this.inflightMaps.set(tag, pending)
-    let loaded: EncryptionMapRecord | null
-    try {
-      loaded = await pending
-    } finally {
-      this.inflightMaps.delete(tag)
-    }
-    if (!loaded) {
-      this.missCache.set(tag, Date.now() + MAP_MISS_TTL_MS)
-      return []
+  private applySystemDefault(record: EncryptionMapRecord | null, entityId: string): EncryptionMapRecord | null {
+    const declared = this.systemDefaultMaps.get(entityId)
+    if (!declared) return record
+    const fields: EncryptedFieldRule[] = declared.fields.map((field) => ({
+      field: field.field,
+      hashField: field.hashField ?? null,
+    }))
+    const declaredFields = new Set(fields.map((field) => field.field))
+    for (const field of record?.fields ?? []) {
+      if (!declaredFields.has(field.field)) fields.push(field)
     }
-    this.missCache.delete(tag)
-    this.aggregateMemoryCache.set(tag, { at: Date.now(), record: loaded })
-    if (this.cache && typeof this.cache.set === 'function') {
-      await this.cache.set(tag, loaded, { ttl: 300 })
+    return {
+      entityId,
+      keyScope: 'system',
+      fields,
     }
-    return loaded.fields
   }
 
   /**
-   * The field rules that are actually encrypted at rest for a scope.
+   * Resolve policy from the canonical table. Nothing is retained across units of work: no
+   * invalidation protocol can make process-local state authoritative after an independent worker
+   * commits a map mutation.
    *
-   * At the tenant-wide scope (`organizationId == null`) `getMap` resolves only the base map, but
-   * rows of the same entity may carry fields declared solely by an organization-scoped map. Reading
-   * or writing such a row with the base map alone stores those fields as plaintext and hands
-   * callers back undecrypted ciphertext, so every scope-aware path unions the organization maps in
-   * (#5949) — the same set `getEncryptedFieldNames` has reported since #2282.
+   * Within one unit of work — the caller's EntityManager, or its open transaction — repeated
+   * decisions for the same scope share a single read, so loading N rows or running the before/after
+   * hooks of one flush costs one query instead of one per row and hook. That memo dies with the
+   * EntityManager/transaction, is dropped for the EntityManager that writes a map
+   * (`forgetEncryptionPolicyMemo`) and after its flush, and for every EntityManager when this
+   * process invalidates a map. Calls that do not hand in an EntityManager fall back to the
+   * long-lived service EntityManager and are never memoized.
    */
-  private async resolveFieldRulesForScope(
-    entityId: string,
-    tenantId: string | null,
-    organizationId: string | null,
-    map: EncryptionMapRecord | null,
-  ): Promise<EncryptedFieldRule[]> {
-    const mapRules = normalizeEncryptedFieldRules(map?.fields)
-    if (organizationId != null) return mapRules
-    return mergeEncryptedFieldRules([mapRules, await this.getAllOrganizationFieldRules(entityId, tenantId)])
+  private resolvePolicy(key: MapCacheKey, em?: EntityManager): Promise<ResolvedEncryptionPolicy> {
+    if (!em) return this.loadPolicy(key)
+    const memo = getEncryptionPolicyMemo(em)
+    const tag = cacheKey(key)
+    const pending = memo.get(tag)
+    if (pending) return pending
+    const loading = this.loadPolicy(key, em)
+    memo.set(tag, loading)
+    loading.catch(() => {
+      if (memo.get(tag) === loading) memo.delete(tag)
+    })
+    return loading
   }
 
+  /**
+   * Drops the policy reads memoized by every EntityManager of this process. Map writers call it
+   * after their write commits; readers in other processes never depended on it, because policy is
+   * not cached across units of work.
+   */
   async invalidateMap(entityId: string, tenantId: string | null, organizationId: string | null): Promise<void> {
-    const tags = [cacheKey({ entityId, tenantId, organizationId }), allOrganizationsCacheKey(entityId, tenantId)]
-    for (const tag of tags) {
-      this.memoryCache.delete(tag)
-      this.aggregateMemoryCache.delete(tag)
-      this.inflightMaps.delete(tag)
-      this.missCache.delete(tag)
-      if (this.cache && typeof (this.cache as any).delete === 'function') {
-        await (this.cache as any).delete(tag)
-      }
-    }
+    debug('♻️ encmap.invalidate', { entityId, tenantId, organizationId })
+    invalidateEncryptionPolicyMemos()
   }
 
   // Force a flush of a tenant's cached DEK across the service-level cache and the
@@ -565,19 +507,16 @@ export class TenantDataEncryptionService {
     entityId: string,
     tenantId: string | null | undefined,
     organizationId?: string | null,
-    options?: { ignoreRuntimeHealth?: boolean }
+    options?: { ignoreRuntimeHealth?: boolean; em?: EntityManager }
   ): Promise<string[]> {
     if (options?.ignoreRuntimeHealth) {
       if (!isTenantDataEncryptionEnabled()) return []
     } else if (!this.isEnabled()) {
       return []
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map,
+    const { fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em,
     )
     return fields.map((rule) => rule.field)
   }
@@ -666,18 +605,15 @@ export class TenantDataEncryptionService {
     payload: Record<string, unknown>,
     tenantId: string | null | undefined,
     organizationId?: string | null,
-    options?: { createMissingDek?: boolean }
+    options?: { createMissingDek?: boolean; em?: EntityManager }
   ): Promise<Record<string, unknown>> {
     if (!this.isEnabled()) {
       debug('⚪️ encrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map,
+    const { map, fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em,
     )
     if (!fields.length) {
       debug('⚪️ encrypt.skip.no-map', { entityId, tenantId })
@@ -697,18 +633,16 @@ export class TenantDataEncryptionService {
     entityId: string,
     payload: Record<string, unknown>,
     tenantId: string | null | undefined,
-    organizationId?: string | null
+    organizationId?: string | null,
+    options?: { em?: EntityManager }
   ): Promise<Record<string, unknown>> {
     if (!isTenantDataEncryptionEnabled()) {
       debug('⚪️ decrypt.skip.disabled', { entityId, tenantId })
       return payload
     }
-    const map = await this.getMap({ entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null })
-    const fields = await this.resolveFieldRulesForScope(
-      entityId,
-      tenantId ?? null,
-      organizationId ?? null,
-      map,
+    const { map, fields } = await this.resolvePolicy(
+      { entityId, tenantId: tenantId ?? null, organizationId: organizationId ?? null },
+      options?.em,
     )
     if (!fields.length) {
       debug('⚪️ decrypt.skip.no-map', { entityId, tenantId })