@open-mercato/shared 0.9.1-develop.7574.1.837288eec1 → 0.10.1-develop.7576.1.21d5b50435

package/src/lib/query/__tests__/overlap.test.ts

@@ -1,219 +0,0 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import {
-  DummyDriver,
-  Kysely,
-  PostgresAdapter,
-  PostgresIntrospector,
-  PostgresQueryCompiler,
-  sql,
-  type RawBuilder,
-} from 'kysely'
-import { BasicQueryEngine } from '../engine'
-import { normalizeFilters } from '../join-utils'
-import {
-  buildArrayColumnNoOverlapPredicate,
-  buildArrayColumnOverlapPredicate,
-  buildJsonbNoOverlapPredicate,
-  buildJsonbOverlapPredicate,
-  buildScalarOverlapPredicate,
-  jsonbDocKeyExpression,
-  normalizeOverlapValues,
-} from '../overlap'
-import type { FilterOp } from '../types'
-
-function makeCompilingDb(): Kysely<any> {
-  return new Kysely<any>({
-    dialect: {
-      createAdapter: () => new PostgresAdapter(),
-      createDriver: () => new DummyDriver(),
-      createIntrospector: (db) => new PostgresIntrospector(db),
-      createQueryCompiler: () => new PostgresQueryCompiler(),
-    },
-  })
-}
-
-const db = makeCompilingDb()
-
-function compileWhere(predicate: RawBuilder<boolean>): { sql: string; parameters: readonly unknown[] } {
-  const compiled = db.selectFrom('entity_indexes as ei').select('ei.id').where(predicate).compile()
-  return { sql: compiled.sql, parameters: compiled.parameters }
-}
-
-type EngineInternals = {
-  applyColumnOp: (builder: unknown, column: string, op: string, value: unknown) => { compile: () => { sql: string; parameters: readonly unknown[] } }
-  buildColumnOpExpression: (eb: unknown, column: string, op: string, value: unknown) => RawBuilder<boolean>
-  buildIndexDocOpExpression: (eb: unknown, opts: {
-    entity: string
-    field: string
-    op: FilterOp
-    value: unknown
-    recordIdColumn: string
-    tenantId?: string | null
-    withDeleted: boolean
-  }) => RawBuilder<boolean>
-}
-
-const engine = new BasicQueryEngine({} as EntityManager, () => db) as unknown as EngineInternals
-
-describe('normalizeOverlapValues', () => {
-  it('flattens, stringifies, drops nullish and de-duplicates', () => {
-    expect(normalizeOverlapValues(['a', 'b', 'a', null, undefined, 3])).toEqual(['a', 'b', '3'])
-    expect(normalizeOverlapValues('a')).toEqual(['a'])
-    expect(normalizeOverlapValues(undefined)).toEqual([])
-    expect(normalizeOverlapValues(null)).toEqual([])
-  })
-})
-
-describe('overlap predicate builders', () => {
-  it('compiles a jsonb has-any-of with the values bound as one array parameter', () => {
-    const compiled = compileWhere(buildJsonbOverlapPredicate('ei.doc', 'scope_keys', ['cat:1', 'tag:2']))
-    expect(compiled.sql).toContain(`("ei"."doc" -> 'scope_keys') ?| $1::text[]`)
-    expect(compiled.parameters).toEqual([['cat:1', 'tag:2']])
-  })
-
-  it('never interpolates values into the SQL text', () => {
-    const hostile = "x'); drop table entity_indexes; --"
-    const compiled = compileWhere(buildJsonbOverlapPredicate('ei.doc', 'scope_keys', [hostile]))
-    expect(compiled.sql).not.toContain('drop table')
-    expect(compiled.parameters).toEqual([[hostile]])
-  })
-
-  it('binds a key that is not a plain identifier instead of inlining it', () => {
-    const key = "scope'keys"
-    const expression = db.selectFrom('entity_indexes as ei').select(jsonbDocKeyExpression('ei.doc', key).as('value')).compile()
-    expect(expression.sql).toContain('("ei"."doc" -> $1)')
-    expect(expression.parameters).toEqual([key])
-  })
-
-  it.each([
-    ['jsonb', () => buildJsonbOverlapPredicate('ei.doc', 'scope_keys', [])],
-    ['array column', () => buildArrayColumnOverlapPredicate('ei.tags', [])],
-    ['scalar', () => buildScalarOverlapPredicate(sql`ei.value`, [null, undefined])],
-  ])('compiles an empty %s value list to false (matches nothing)', (_label, build) => {
-    const compiled = compileWhere(build())
-    expect(compiled.sql).toMatch(/where false$/)
-    expect(compiled.parameters).toEqual([])
-  })
-
-  it('compiles array-column overlap to && with a bound array', () => {
-    const compiled = compileWhere(buildArrayColumnOverlapPredicate('ei.tags', ['a', 'b']))
-    expect(compiled.sql).toContain('"ei"."tags" && $1')
-    expect(compiled.parameters).toEqual([['a', 'b']])
-  })
-
-  it('compiles scalar overlap to an IN list of bound values', () => {
-    const compiled = compileWhere(buildScalarOverlapPredicate(sql`ei.value`, ['a', 'b']))
-    expect(compiled.sql).toContain('ei.value in ($1, $2)')
-    expect(compiled.parameters).toEqual(['a', 'b'])
-  })
-})
-
-describe('BasicQueryEngine overlap', () => {
-  it('normalizes $overlap from the object filter syntax', () => {
-    const filters = normalizeFilters({ scope_keys: { $overlap: ['cat:1'] } })
-    expect(filters).toEqual([expect.objectContaining({ field: 'scope_keys', op: 'overlap', value: ['cat:1'] })])
-  })
-
-  it('applies && on a base column', () => {
-    const builder = db.selectFrom('catalog_products as b').select('b.id')
-    const compiled = engine.applyColumnOp(builder, 'b.tags', 'overlap', ['x', 'y']).compile()
-    expect(compiled.sql).toContain('"b"."tags" && $1')
-    expect(compiled.parameters).toEqual([['x', 'y']])
-  })
-
-  it('compiles an index-document overlap inside the entity_indexes EXISTS', () => {
-    const compiled = db
-      .selectFrom('catalog_products as b')
-      .select('b.id')
-      .where((eb) => engine.buildIndexDocOpExpression(eb, {
-        entity: 'catalog:catalog_product',
-        field: 'scope_keys',
-        op: 'overlap',
-        value: ['cat:1'],
-        recordIdColumn: 'b.id',
-        tenantId: 'tenant-1',
-        withDeleted: false,
-      }))
-      .compile()
-    expect(compiled.sql).toMatch(/exists \(select 1 as "one" from "entity_indexes" as "ei_\d+"/)
-    expect(compiled.sql).toMatch(/\("ei_\d+"\."doc" -> 'scope_keys'\) \?\| \$\d+::text\[\]/)
-    expect(compiled.parameters).toContainEqual(['cat:1'])
-  })
-
-  it('leaves existing operators unchanged', () => {
-    const compiled = db
-      .selectFrom('catalog_products as b')
-      .select('b.id')
-      .where((eb) => eb.and([
-        engine.buildColumnOpExpression(eb, 'b.sku', 'in', ['a', 'b']),
-        engine.buildColumnOpExpression(eb, 'b.title', 'ilike', '%x%'),
-        engine.buildColumnOpExpression(eb, 'b.deleted_at', 'exists', false),
-      ]))
-      .compile()
-    expect(compiled.sql).toContain('"b"."sku" in ($1, $2)')
-    expect(compiled.sql).toContain('"b"."title" ilike $3')
-    expect(compiled.sql).toContain('"b"."deleted_at" is null')
-    expect(compiled.sql).not.toContain('&&')
-    expect(compiled.sql).not.toContain('?|')
-  })
-})
-
-describe('noverlap predicate builders', () => {
-  it('compiles a jsonb has-none-of that requires a present array', () => {
-    const compiled = compileWhere(buildJsonbNoOverlapPredicate('ei.doc', 'scope_keys', ['cat:1', 'tag:2']))
-    expect(compiled.sql).toContain(
-      `(jsonb_typeof(("ei"."doc" -> 'scope_keys')) = 'array' and not (("ei"."doc" -> 'scope_keys') ?| $1::text[]))`,
-    )
-    expect(compiled.parameters).toEqual([['cat:1', 'tag:2']])
-  })
-
-  it('keeps only the array check for an empty jsonb value list', () => {
-    const compiled = compileWhere(buildJsonbNoOverlapPredicate('ei.doc', 'scope_keys', []))
-    expect(compiled.sql).toMatch(/where jsonb_typeof\(\("ei"\."doc" -> 'scope_keys'\)\) = 'array'$/)
-    expect(compiled.parameters).toEqual([])
-  })
-
-  it('compiles array-column has-none-of to not && and an empty list to is not null', () => {
-    const compiled = compileWhere(buildArrayColumnNoOverlapPredicate('ei.tags', ['a']))
-    expect(compiled.sql).toContain('not ("ei"."tags" && $1)')
-    expect(compiled.parameters).toEqual([['a']])
-    expect(compileWhere(buildArrayColumnNoOverlapPredicate('ei.tags', [])).sql).toContain('"ei"."tags" is not null')
-  })
-})
-
-describe('BasicQueryEngine noverlap', () => {
-  it('normalizes $noverlap from the object filter syntax', () => {
-    const filters = normalizeFilters({ scope_keys: { $noverlap: ['cat:1'] } })
-    expect(filters).toEqual([expect.objectContaining({ field: 'scope_keys', op: 'noverlap', value: ['cat:1'] })])
-  })
-
-  it('compiles an index-document noverlap inside the entity_indexes EXISTS', () => {
-    const compiled = db
-      .selectFrom('catalog_products as b')
-      .select('b.id')
-      .where((eb) => engine.buildIndexDocOpExpression(eb, {
-        entity: 'catalog:catalog_product',
-        field: 'scope_keys',
-        op: 'noverlap',
-        value: ['cat:1'],
-        recordIdColumn: 'b.id',
-        tenantId: 'tenant-1',
-        withDeleted: false,
-      }))
-      .compile()
-    expect(compiled.sql).toMatch(/exists \(select 1 as "one" from "entity_indexes" as "ei_\d+"/)
-    expect(compiled.sql).toMatch(/not \(\("ei_\d+"\."doc" -> 'scope_keys'\) \?\| \$\d+::text\[\]\)/)
-  })
-
-  it('applies not && on a base column', () => {
-    const builder = db.selectFrom('catalog_products as b').select('b.id')
-    const compiled = engine.applyColumnOp(builder, 'b.tags', 'noverlap', ['x']).compile()
-    expect(compiled.sql).toContain('not ("b"."tags" && $1)')
-    const expression = db
-      .selectFrom('catalog_products as b')
-      .select('b.id')
-      .where((eb) => engine.buildColumnOpExpression(eb, 'b.tags', 'noverlap', ['x']))
-      .compile()
-    expect(expression.sql).toContain('not ("b"."tags" && $1)')
-  })
-})

package/src/lib/query/overlap.ts

@@ -1,106 +0,0 @@
-import { sql, type RawBuilder } from 'kysely'
-
-const LITERAL_SAFE_DOC_KEY = /^[A-Za-z0-9_:.-]{1,128}$/
-
-/**
- * Normalizes the right-hand side of an `overlap` filter into a de-duplicated list of strings.
- *
- * `null`/`undefined` entries are dropped; a scalar is treated as a one-element list. An empty
- * result means the filter matches nothing — every `overlap` builder compiles it to `false`
- * rather than dropping the predicate, so a caller that computes an empty inclusion set can
- * never widen a query by accident.
- */
-export function normalizeOverlapValues(value: unknown): string[] {
-  const list: readonly unknown[] = Array.isArray(value)
-    ? value
-    : value === undefined || value === null
-      ? []
-      : [value]
-  const out: string[] = []
-  const seen = new Set<string>()
-  for (const entry of list) {
-    if (entry === undefined || entry === null) continue
-    const normalized = String(entry)
-    if (seen.has(normalized)) continue
-    seen.add(normalized)
-    out.push(normalized)
-  }
-  return out
-}
-
-/**
- * `(<docColumn> -> '<key>')` — the jsonb sub-document of an index document.
- *
- * The key is emitted as an escaped SQL literal when it is a plain identifier so the expression is
- * textually identical to a GIN expression index such as `((doc -> 'scope_keys'))` and the planner
- * can match it. Any other key falls back to a bound parameter (still correct, just not indexable).
- */
-export function jsonbDocKeyExpression(docColumnRef: string, key: string): RawBuilder<unknown> {
-  const keyExpr = LITERAL_SAFE_DOC_KEY.test(key) ? sql.lit(key) : sql`${key}`
-  return sql`(${sql.ref(docColumnRef)} -> ${keyExpr})`
-}
-
-/**
- * jsonb "has any of" over a string-array key of an index document:
- * `(<docColumn> -> '<key>') ?| $n::text[]`. The values are bound as one array parameter.
- * A missing key or a JSON `null` evaluates to SQL NULL, i.e. the row does not match.
- */
-export function buildJsonbOverlapPredicate(docColumnRef: string, key: string, value: unknown): RawBuilder<boolean> {
-  const values = normalizeOverlapValues(value)
-  if (!values.length) return sql<boolean>`false`
-  return sql<boolean>`${jsonbDocKeyExpression(docColumnRef, key)} ?| ${values}::text[]`
-}
-
-/**
- * jsonb "has none of" over a string-array key of an index document (`noverlap`):
- * `(jsonb_typeof(<expr>) = 'array' and not (<expr> ?| $n::text[]))`.
- *
- * Only a document whose key holds a JSON array can match: a missing key, a JSON `null` or a
- * scalar never satisfies it, so an unindexed document can never slip through an exclusion.
- * An empty value list excludes nothing (only the array check remains).
- */
-export function buildJsonbNoOverlapPredicate(docColumnRef: string, key: string, value: unknown): RawBuilder<boolean> {
-  const values = normalizeOverlapValues(value)
-  const keyExpr = jsonbDocKeyExpression(docColumnRef, key)
-  const isArray = sql<boolean>`jsonb_typeof(${keyExpr}) = 'array'`
-  if (!values.length) return isArray
-  return sql<boolean>`(${isArray} and not (${keyExpr} ?| ${values}::text[]))`
-}
-
-/**
- * Postgres array overlap for array-typed columns: `<column> && $n`. The bound array takes its
- * element type from the column, so `text[]`, `varchar[]` and `uuid[]` columns all work.
- */
-export function buildArrayColumnOverlapPredicate(
-  column: string | RawBuilder<unknown>,
-  value: unknown,
-): RawBuilder<boolean> {
-  const values = normalizeOverlapValues(value)
-  if (!values.length) return sql<boolean>`false`
-  const columnExpr = typeof column === 'string' ? sql.ref(column) : column
-  return sql<boolean>`${columnExpr} && ${values}`
-}
-
-/**
- * Postgres array "has none of" for array-typed columns (`noverlap`): `not (<column> && $n)`.
- * A NULL column never matches; an empty value list excludes nothing (`<column> is not null`).
- */
-export function buildArrayColumnNoOverlapPredicate(
-  column: string | RawBuilder<unknown>,
-  value: unknown,
-): RawBuilder<boolean> {
-  const values = normalizeOverlapValues(value)
-  const columnExpr = typeof column === 'string' ? sql.ref(column) : column
-  if (!values.length) return sql<boolean>`${columnExpr} is not null`
-  return sql<boolean>`not (${columnExpr} && ${values})`
-}
-
-/**
- * `overlap` over a scalar expression evaluated once per stored value (custom-field value rows):
- * the record matches when any of its values is one of the requested ones — `<expr> in (...)`.
- */
-export function buildScalarOverlapPredicate(expression: RawBuilder<unknown>, value: unknown): RawBuilder<boolean> {
-  const values = normalizeOverlapValues(value)
-  if (!values.length) return sql<boolean>`false`
-  return sql<boolean>`${expression} in (${sql.join(values.map((entry) => sql`${entry}`), sql`, `)})`
-}

package/src/modules/notifications/safeHref.ts

@@ -1,19 +0,0 @@
-const SENTINEL_ORIGIN = 'https://notifications.open-mercato.local'
-const CONTROL_OR_BACKSLASH = /[\u0000-\u001F\u007F\\]/
-
-export function isSafeNotificationHref(href: string): boolean {
-  if (!href.startsWith('/') || href.startsWith('//')) {
-    return false
-  }
-
-  if (CONTROL_OR_BACKSLASH.test(href)) {
-    return false
-  }
-
-  try {
-    const parsed = new URL(href, SENTINEL_ORIGIN)
-    return parsed.origin === SENTINEL_ORIGIN && !parsed.pathname.startsWith('//')
-  } catch {
-    return false
-  }
-}

package/src/modules/widgets/__tests__/injection-loader.partitioned-registration.test.ts

@@ -1,78 +0,0 @@
-/**
- * Regression coverage for the partitioned-bootstrap registry contract.
- *
- * A Node process can run more than one bootstrap partition: the API-only one
- * (`skipCoreInjectionWidgets: true`) and the full page one. Two invariants have to hold
- * together, and skipping registration outright only satisfied the first:
- *
- * 1. the partition that registers second must never shrink the registry the first published;
- * 2. an API-only process must still be able to READ the registry, because module API routes
- *    resolve widget contributions on the request path.
- */
-import { describe, it, expect, beforeEach, jest } from '@jest/globals'
-import type { ModuleInjectionWidgetEntry } from '@open-mercato/shared/modules/registry'
-
-const GLOBAL_INJECTION_WIDGETS_KEY = '__openMercatoCoreInjectionWidgetEntries__'
-
-function entry(key: string): ModuleInjectionWidgetEntry {
-  return { moduleId: key.split(':')[0]!, key, source: 'package', widgetId: key, loader: async () => ({}) as never }
-}
-
-type Loader = typeof import('@open-mercato/shared/modules/widgets/injection-loader')
-
-function freshLoader(): Loader {
-  delete (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]
-  let loader!: Loader
-  jest.isolateModules(() => {
-    loader = require('@open-mercato/shared/modules/widgets/injection-loader') as Loader
-  })
-  return loader
-}
-
-describe('core injection widget registration modes', () => {
-  beforeEach(() => {
-    delete (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]
-  })
-
-  it('replaces the registry by default', () => {
-    const loader = freshLoader()
-    loader.registerCoreInjectionWidgets([entry('a:one'), entry('b:two')])
-    loader.registerCoreInjectionWidgets([entry('a:one')])
-
-    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one'])
-  })
-
-  it('populates an unregistered registry in merge mode instead of leaving it throwing', () => {
-    const loader = freshLoader()
-    expect(() => loader.getCoreInjectionWidgets()).toThrow(/not registered/)
-
-    loader.registerCoreInjectionWidgets([entry('a:one')], { mode: 'merge' })
-
-    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one'])
-  })
-
-  it('never shrinks a registry a fuller partition already published', () => {
-    const loader = freshLoader()
-    loader.registerCoreInjectionWidgets([entry('a:one'), entry('b:two'), entry('c:three')])
-    loader.registerCoreInjectionWidgets([entry('a:one')], { mode: 'merge' })
-
-    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one', 'b:two', 'c:three'])
-  })
-
-  it('adds only the entries the registry does not already carry', () => {
-    const loader = freshLoader()
-    loader.registerCoreInjectionWidgets([entry('a:one')])
-    loader.registerCoreInjectionWidgets([entry('a:one'), entry('d:four')], { mode: 'merge' })
-
-    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one', 'd:four'])
-  })
-
-  it('leaves an unregistered registry untouched when it has nothing to contribute', () => {
-    const loader = freshLoader()
-    loader.registerCoreInjectionWidgets([], { mode: 'merge' })
-
-    // Publishing an empty array here would turn the loud "not registered" bootstrap error into
-    // silently missing contributions on every request.
-    expect(() => loader.getCoreInjectionWidgets()).toThrow(/not registered/)
-  })
-})