@porulle/core 0.8.0 → 0.10.0

package/src/modules/orders/stale-order-cleanup.ts

@@ -1,6 +1,20 @@
-import { eq, and, lt, sql } from "drizzle-orm";
+import { eq, and, lt } from "drizzle-orm";
+import type { Actor } from "../../auth/types.js";
 import { orders } from "./schema.js";
-import type { TaskDefinition, TaskContext } from "../../kernel/jobs/types.js";
+import type { TaskDefinition } from "../../kernel/jobs/types.js";
+
+function systemActorForOrg(organizationId: string): Actor {
+  return {
+    type: "user",
+    userId: "system",
+    email: null,
+    name: "System",
+    vendorId: null,
+    organizationId,
+    role: "admin",
+    permissions: ["*:*"],
+  };
+}
 
 /**
  * Stale Order Cleanup Task
@@ -31,38 +45,49 @@ export const staleOrderCleanupTask: TaskDefinition<
     const thresholdHours = input.thresholdHours ?? 48;
     const cutoff = new Date(Date.now() - thresholdHours * 60 * 60 * 1000);
 
-    // Find stale pending orders
-    const staleOrders = await ctx.db
-      .select()
-      .from(orders)
-      .where(
-        and(
-          eq(orders.status, "pending"),
-          lt(orders.placedAt, cutoff),
-        ),
-      );
-
     const cancelledIds: string[] = [];
 
     // Cancel each stale order via the service (triggers inventory release + payment refund)
     const orderService = ctx.services.orders as {
-      cancel(orderId: string, actor: null, reason: string): Promise<unknown>;
+      cancel(orderId: string, actor: Actor | null, reason: string): Promise<unknown>;
     };
 
-    for (const order of staleOrders) {
-      try {
-        await orderService.cancel(
-          order.id,
-          null,
-          `Auto-cancelled: pending for >${thresholdHours}h`,
+    // This is a cross-org system sweep, but the row reads stay org-scoped: first
+    // enumerate the orgs that have stale orders (id-only projection), then read
+    // each org's stale orders under an explicit organizationId predicate. No
+    // query returns another tenant's order rows.
+    const staleOrgs = await ctx.db
+      .selectDistinct({ organizationId: orders.organizationId })
+      .from(orders)
+      .where(and(eq(orders.status, "pending"), lt(orders.placedAt, cutoff)));
+
+    for (const { organizationId } of staleOrgs) {
+      const staleOrders = await ctx.db
+        .select()
+        .from(orders)
+        .where(
+          and(
+            eq(orders.organizationId, organizationId),
+            eq(orders.status, "pending"),
+            lt(orders.placedAt, cutoff),
+          ),
         );
-        cancelledIds.push(order.id);
-        ctx.logger.info(`Stale order ${order.orderNumber} auto-cancelled`, {
-          orderId: order.id,
-          placedAt: order.placedAt,
-        });
-      } catch (error) {
-        ctx.logger.error(`Failed to cancel stale order ${order.orderNumber}`, { error });
+
+      for (const order of staleOrders) {
+        try {
+          await orderService.cancel(
+            order.id,
+            systemActorForOrg(order.organizationId),
+            `Auto-cancelled: pending for >${thresholdHours}h`,
+          );
+          cancelledIds.push(order.id);
+          ctx.logger.info(`Stale order ${order.orderNumber} auto-cancelled`, {
+            orderId: order.id,
+            placedAt: order.placedAt,
+          });
+        } catch (error) {
+          ctx.logger.error(`Failed to cancel stale order ${order.orderNumber}`, { error });
+        }
       }
     }
 

package/src/modules/pricing/service.ts

@@ -211,15 +211,14 @@ export class PricingService {
       );
     }
 
-    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx);
+    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
     if (!entity) {
       return Err(
         new CommerceNotFoundError("Entity not found for price assignment."),
       );
     }
 
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
-
     const priceData: PriceInsert = {
       organizationId: orgId,
       entityId: input.entityId,
@@ -473,7 +472,8 @@ export class PricingService {
     actor?: Actor | null,
     ctx?: TxContext,
   ): Promise<Result<ResolvedPrice>> {
-    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx);
+    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    const entity = await this.catalogRepo.findEntityById(input.entityId, ctx, orgId);
     if (!entity) {
       return Err(
         new CommerceNotFoundError(`Entity ${input.entityId} not found.`),
@@ -492,8 +492,7 @@ export class PricingService {
     const currency = normalizeCurrency(input.currency);
     const groupSet = toGroupSet(input);
 
-    // Get matching prices from repository
-    const orgId = resolveOrgId(actor ?? ctx?.actor ?? null);
+    // Get matching prices from repository (orgId resolved above)
     const allPrices = await this.repo.findPricesByEntityId(
       orgId,
       input.entityId,

package/src/modules/promotions/repository/index.ts

@@ -182,6 +182,7 @@ export class PromotionsRepository {
 
   async createUsage(
     data: PromotionUsageInsert,
+    orgId: string,
     ctx?: TxContext,
   ): Promise<PromotionUsage> {
     const db = this.getDb(ctx);
@@ -190,10 +191,13 @@ export class PromotionsRepository {
     // race conditions between concurrent checkouts using the same coupon.
     // A plain count-then-insert has a TOCTOU gap; this single statement
     // ensures the insert only succeeds if the limit has not been reached.
+    // Both reads are scoped by organizationId: these are raw/lock queries that
+    // bypass the scoped-db proxy, so a promotionId from another tenant must
+    // resolve to no row rather than reading/locking a foreign promotion.
     const promo = await db
       .select({ usageLimitTotal: promotions.usageLimitTotal })
       .from(promotions)
-      .where(eq(promotions.id, data.promotionId));
+      .where(and(eq(promotions.id, data.promotionId), eq(promotions.organizationId, orgId)));
 
     const limit = promo[0]?.usageLimitTotal;
 
@@ -206,7 +210,7 @@ export class PromotionsRepository {
       // concurrent callers. If the caller is already inside a transaction
       // (ctx.tx), the lock is held until that transaction commits.
       await db.execute(
-        sql`SELECT id FROM promotions WHERE id = ${data.promotionId} FOR UPDATE`,
+        sql`SELECT id FROM promotions WHERE id = ${data.promotionId} AND organization_id = ${orgId} FOR UPDATE`,
       );
 
       const currentCount = await this.countUsages(data.promotionId, ctx);

package/src/modules/promotions/service.ts

@@ -500,6 +500,7 @@ export class PromotionService {
   async recordUsage(
     input: {
       promotions: AppliedPromotion[];
+      organizationId: string;
       customerId?: string;
       orderId?: string;
     },
@@ -513,6 +514,7 @@ export class PromotionService {
           customerId: input.customerId ?? null,
           orderId: input.orderId ?? null,
         },
+        input.organizationId,
         ctx,
       );
       usages.push(usage);

package/src/modules/webhooks/repository/index.ts

@@ -1,4 +1,4 @@
-import { eq, and, lte, isNull, or, desc, sql } from "drizzle-orm";
+import { eq, and, lte, isNull, or, desc, sql, inArray } from "drizzle-orm";
 import type { TxContext } from "../../../kernel/database/tx-context.js";
 import type {
   DrizzleDatabase,
@@ -195,28 +195,30 @@ export class WebhooksRepository {
   }
 
   async findFailedDeliveries(
+    orgId: string,
     endpointId?: string,
     ctx?: TxContext,
   ): Promise<WebhookDelivery[]> {
     const db = this.getDb(ctx);
 
-    if (endpointId) {
-      return db
-        .select()
-        .from(webhookDeliveries)
-        .where(
-          and(
-            eq(webhookDeliveries.endpointId, endpointId),
-            sql`${webhookDeliveries.failedAt} IS NOT NULL`,
-          ),
-        )
-        .orderBy(desc(webhookDeliveries.failedAt));
-    }
+    // webhook_deliveries has no organizationId column — org lives on the parent
+    // endpoint. Scope failed deliveries to endpoints owned by orgId so this can
+    // never read another tenant's deliveries.
+    const orgEndpointIds = db
+      .select({ id: webhookEndpoints.id })
+      .from(webhookEndpoints)
+      .where(eq(webhookEndpoints.organizationId, orgId));
+
+    const conditions = [
+      sql`${webhookDeliveries.failedAt} IS NOT NULL`,
+      inArray(webhookDeliveries.endpointId, orgEndpointIds),
+    ];
+    if (endpointId) conditions.push(eq(webhookDeliveries.endpointId, endpointId));
 
     return db
       .select()
       .from(webhookDeliveries)
-      .where(sql`${webhookDeliveries.failedAt} IS NOT NULL`)
+      .where(and(...conditions))
       .orderBy(desc(webhookDeliveries.failedAt));
   }
 

package/src/runtime/kernel.ts

@@ -11,6 +11,7 @@ import { withTiming } from "../kernel/service-timing.js";
 import { setBootDefaultOrgId } from "../auth/org.js";
 import { setBootStrictOrgResolution } from "../auth/strict-org-resolution.js";
 import { DrizzleJobsAdapter } from "../kernel/jobs/drizzle-adapter.js";
+import type { ExecutionEngine } from "../kernel/jobs/adapter.js";
 import { CompensationFailuresRepository } from "../kernel/compensation/repository.js";
 
 import {
@@ -72,8 +73,21 @@ export function createKernel(config: CommerceConfig): Kernel {
   const jobsTaskMap = new Map(
     (config.jobs?.tasks ?? []).map((t) => [t.slug, t]),
   );
-  const jobsAdapter = new DrizzleJobsAdapter(db, jobsTaskMap);
-  serviceContainer.jobs = jobsAdapter;
+  const jobsEngine: ExecutionEngine =
+    config.jobs?.adapter ?? new DrizzleJobsAdapter(db);
+  const jobLogger = {
+    info: (message: string, data?: unknown) => logger.info(message, data),
+    warn: (message: string, data?: unknown) => logger.warn(message, data),
+    error: (message: string, data?: unknown) => logger.error(message, data),
+  };
+  jobsEngine.register({
+    tasks: jobsTaskMap,
+    context: { logger: jobLogger, db, services: serviceContainer },
+    ...(config.jobs?.processingOrder !== undefined
+      ? { processingOrder: config.jobs.processingOrder }
+      : {}),
+  });
+  serviceContainer.jobs = jobsEngine;
 
   const topoGraph = kernelModulesForTopoSort();
   const order = topoSortModules(topoGraph);

package/src/runtime/server.ts

@@ -17,7 +17,6 @@ import { createCustomerPortalRoutes } from "../interfaces/rest/customer-portal.j
 import { createKernel } from "./kernel.js";
 import { ensureDefaultOrg } from "../auth/org.js";
 import { createLogger, type Logger } from "./logger.js";
-import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
 import { createCommerce, type CommerceInstance } from "./commerce.js";
 import { rewriteCommerceAliasRequest } from "./url-alias-rewrite.js";
 import { mapErrorToResponse } from "../kernel/error-mapper.js";
@@ -408,48 +407,18 @@ export async function createServer(config: CommerceConfig) {
   //   2. GET /api/jobs/run: cron endpoint (serverless — Vercel, Cloudflare)
   //   3. runPendingJobs() export (custom worker process)
 
-  const { runPendingJobs } = await import("../kernel/jobs/runner.js");
-  const { runStaleJobReaper, getJobReapThresholdMs, getJobsReaperIntervalMs } =
-    await import("../kernel/jobs/reaper.js");
-  const taskMap = new Map<string, unknown>();
-  for (const task of config.jobs?.tasks ?? []) {
-    const t = task as { slug?: string; name?: string };
-    taskMap.set(t.slug ?? t.name ?? "", task);
-  }
-
-  const jobLogger = {
-    info: (msg: string, data?: unknown) => logger.info(data != null ? { data } : {}, msg),
-    warn: (msg: string, data?: unknown) => logger.warn(data != null ? { data } : {}, msg),
-    error: (msg: string, data?: unknown) => logger.error(data != null ? { data } : {}, msg),
-  };
-
-  let lastStaleJobReaperAt = 0;
+  const jobsEngine = (kernel.services as Record<string, unknown>)
+    .jobs as import("../kernel/jobs/adapter.js").ExecutionEngine;
 
-  const maybeRunStaleJobReaper = async () => {
-    const interval = getJobsReaperIntervalMs();
-    const now = Date.now();
-    if (now - lastStaleJobReaperAt < interval) return;
-    lastStaleJobReaperAt = now;
-    try {
-      await runStaleJobReaper(
-        kernel.database.db as DrizzleDatabase,
-        getJobReapThresholdMs(),
-        jobLogger,
+  const runJobs = async (queue?: string, limit?: number) => {
+    if (jobsEngine.execution.mode !== "pull") {
+      throw new Error(
+        "The configured push execution engine is driven by its native runtime and cannot be polled with runJobs().",
       );
-    } catch (err) {
-      logger.error({ err }, "Stale job reaper failed");
     }
-  };
-
-  const runJobs = async (queue?: string, limit?: number) => {
-    await maybeRunStaleJobReaper();
-    return runPendingJobs({
-      db: kernel.database.db as DrizzleDatabase,
-      tasks: taskMap as Parameters<typeof runPendingJobs>[0]["tasks"],
+    return jobsEngine.execution.run({
       queue: queue ?? "default",
       limit: limit ?? 10,
-      logger: jobLogger,
-      services: kernel.services as Parameters<typeof runPendingJobs>[0]["services"],
     });
   };
 
@@ -478,6 +447,11 @@ export async function createServer(config: CommerceConfig) {
   // Strategy 2: In-process polling for long-running servers (ECS, Cloud Run, Docker).
   // Enable via config.jobs.autorun.enabled = true
   if (config.jobs?.autorun?.enabled) {
+    if (jobsEngine.execution.mode !== "pull") {
+      throw new Error(
+        "jobs.autorun is only valid for pull execution engines. Serve the configured push engine through its native runtime.",
+      );
+    }
     const intervalMs = config.jobs.autorun.intervalMs ?? 10_000;
 
     const jobInterval = setInterval(async () => {
@@ -494,10 +468,16 @@ export async function createServer(config: CommerceConfig) {
 
     logger.info({ intervalMs }, "Job queue autorun started (in-process polling)");
   } else {
-    logger.info(
-      "Job queue autorun disabled. Use GET /api/jobs/run for serverless cron, " +
-      "or set config.jobs.autorun.enabled = true for in-process polling.",
-    );
+    if (jobsEngine.execution.mode === "push") {
+      logger.info(
+        "Push job engine registered. Serve it through its native runtime.",
+      );
+    } else {
+      logger.info(
+        "Job queue autorun disabled. Use GET /api/jobs/run for serverless cron, " +
+        "or set config.jobs.autorun.enabled = true for in-process polling.",
+      );
+    }
   }
 
   const dispatchFetch = app.fetch.bind(app);

package/src/test-utils/create-test-config.ts

@@ -64,6 +64,7 @@ export async function createTestConfig(
       provider: "postgresql",
     },
     auth: {
+      allowTestActor: true,
       defaultOrganizationId: "org_default",
       requireEmailVerification: false,
       apiKeys: { enabled: true, defaultPermissions: ["catalog:read"] },
@@ -81,6 +82,7 @@ export async function createTestConfig(
             "orders:create",
             "orders:read",
             "orders:update",
+            "orders:manage",
             "cart:create",
             "cart:update",
             "customers:update:self",

package/src/test-utils/order-test-helpers.ts

@@ -0,0 +1,26 @@
+import { eq } from "drizzle-orm";
+import { orders } from "../modules/orders/schema.js";
+import type { Kernel } from "../runtime/kernel.js";
+import type { DrizzleDatabase } from "../kernel/database/drizzle-db.js";
+
+/**
+ * Mark an order as paid (captured) for tests.
+ *
+ * Refund and return flows require a paid order — a refund moves collected money,
+ * and the order primitive rejects refunds on unpaid/pending orders. There is no
+ * public "set captured amount" service (capture() needs a live payment intent),
+ * so tests set the column here through a single typed helper rather than
+ * scattering raw SQL / `as any` casts across test files.
+ */
+export async function markOrderPaidForTest(
+  kernel: Kernel,
+  orderId: string,
+  amountCaptured: number,
+  paymentIntentId?: string,
+): Promise<void> {
+  const db = kernel.database.db as DrizzleDatabase;
+  await db
+    .update(orders)
+    .set({ amountCaptured, ...(paymentIntentId ? { paymentIntentId } : {}) })
+    .where(eq(orders.id, orderId));
+}

package/src/test-utils/rest-api-test-utils.ts

@@ -163,6 +163,7 @@ export const testActor: Actor = {
     "orders:create",
     "orders:read",
     "orders:update",
+    "orders:manage",
     "cart:create",
     "cart:update",
     "cart:read",

package/src/test-utils/test-actors.ts

@@ -32,7 +32,7 @@ export const testStaffActor: Actor = {
   role: "staff",
   permissions: [
     "catalog:read", "catalog:create", "catalog:update",
-    "inventory:adjust", "orders:read", "orders:create", "orders:update",
+    "inventory:adjust", "orders:read", "orders:create", "orders:update", "orders:manage",
   ],
 };
 

package/src/testing.ts

@@ -16,6 +16,7 @@ export {
   jsonHeaders,
 } from "./test-utils/test-actors.js";
 export { beforeHook, afterHook } from "./test-utils/typed-hooks.js";
+export { markOrderPaidForTest } from "./test-utils/order-test-helpers.js";
 
 // Actor type re-export for plugin tests that build custom test actors.
 export type { Actor } from "./auth/types.js";