biz-a-cli 2.3.80-15238 → 2.3.80-15267

package/bin/directHubEvent.js

@@ -70,7 +70,7 @@ export function directHubEvent(serverSocket, argv) {
 			clientListener(clientSocket, argv);
 			clientSocket.join(CLIENT_ROOM);
 
-			// for ESB clientEmitter
+			// isolated Client in a room using clientInstanceId
 			const clientInstanceId =
 				clientSocket.handshake.query.clientInstanceId;
 			if (clientInstanceId) {
@@ -79,6 +79,16 @@ export function directHubEvent(serverSocket, argv) {
 					ClientEmitter.acknowledgeMessage(msgId, clientInstanceId);
 				});
 			}
+
+			// isolated Client in a room using argv.subdomain and UserId
+			const userId = clientSocket.handshake.query.userId;
+			if (
+				userId !== undefined &&
+				userId !== null &&
+				String(userId) !== "-1"
+			) {
+				clientSocket.join(`${argv.subdomain}_USER_${userId}`);
+			}
 		} else if (clientSocket.handshake.query.isDeploy) {
 			setConnectListeners(clientSocket);
 			deploymentListenerForVSCode(clientSocket, argv);
@@ -99,7 +109,11 @@ export function createSocketServer(httpServer, cliIpAddress = "127.0.0.1") {
 				/\.vscode-cdn\.net$/,
 			].concat(
 				process.env.NODE_ENV === "production"
-					? [`http://${cliIpAddress}:4200`, "http://localhost:4200", "http://localhost"]
+					? [
+							`http://${cliIpAddress}:4200`,
+							"http://localhost:4200",
+							"http://localhost",
+						]
 					: [`http://${cliIpAddress}:4200`, "http://localhost:4200"],
 			),
 		},

package/bin/hub.js

@@ -295,7 +295,7 @@ if (argv.mode.trim().toLowerCase() === "agent") {
 	// directHubEvent(createSocketServer(server, argv.cliAddress().ip), argv);
 	directHubEvent(ioServerInstance, argv);
 
-	ClientEmitter.init(ioServerInstance, socket);
+	ClientEmitter.init(ioServerInstance, socket, argv.subdomain);
 
 	bootMicroservices(argv, ioServerInstance);
 

package/bin/hubEvent.js

@@ -305,7 +305,8 @@ const EngineRegistry = {
 	"bpm/workflowRT": () => import("../engine/bpm/workflow-runtime.js"),
 	"domain/system": () => import("../engine/domain/system.js"),
 	"domain/appConfig": () => import("../engine/domain/appConfig.js"),
-	"domain/applicationConfig": () => import("../engine/domain/applicationConfig.js"),
+	"domain/applicationConfig": () =>
+		import("../engine/domain/applicationConfig.js"),
 };
 
 const handleCliCommand = async (data, cb, argv) => {
@@ -364,12 +365,42 @@ const handleCliCommand = async (data, cb, argv) => {
 				cb(null, { success: true, data: result });
 				break;
 			}
+			case "emitter": {
+				const requestData = data.data || {};
+				const { action, userIds, groupIds, eventName, payload } =
+					requestData;
+
+				if (action === "emitUsers" && Array.isArray(userIds)) {
+					ClientEmitter.emitUsers(userIds, eventName, payload).catch(
+						(err) => console.error("[ESB] emitUsers Error:", err),
+					);
+				} else if (
+					action === "emitUserGroups" &&
+					Array.isArray(groupIds)
+				) {
+					ClientEmitter.emitUserGroups(
+						groupIds,
+						eventName,
+						payload,
+					).catch((err) =>
+						console.error("[ESB] emitUserGroups Error:", err),
+					);
+				} else if (action === "broadcastClient") {
+					ClientEmitter.broadcastClient(eventName, payload);
+				}
 
+				cb(null, {
+					success: true,
+					message: `Handed over ${action} to ESB ClientEmitter`,
+				});
+				break;
+			}
 			default:
 				cb(`Unknown CLI command '${command}'`, null);
 		}
 	} catch (err) {
 		cb(err.message || err, null);
+		// console.error("[CLICommand] Error:", err);
 	}
 };
 

package/engine/domain/appConfig.js

@@ -1066,6 +1066,51 @@ export const buildGeneratorSyncPlan = (table, generatorRows, triggerRows) => {
 	};
 };
 
+export const buildAppendOnlyStructureQueries = (table) => {
+	const triggerName = toDbName(table.appendOnlyTriggerName ?? buildObjectName(table.name, "NOUPD"));
+	return {
+		exceptionSql: [
+			"SELECT COUNT(*) AS EXCEPTION_EXISTS",
+			"FROM RDB$EXCEPTIONS",
+			`WHERE UPPER(TRIM(RDB$EXCEPTION_NAME)) = '${firebirdDdl.APPEND_ONLY_EXCEPTION_NAME}';`,
+		].join(" "),
+		triggerSql: [
+			"SELECT COUNT(*) AS TRIGGER_EXISTS",
+			"FROM RDB$TRIGGERS T",
+			`WHERE UPPER(TRIM(T.RDB$TRIGGER_NAME)) = '${triggerName}'`,
+			"  AND COALESCE(T.RDB$SYSTEM_FLAG, 0) = 0;",
+		].join(" "),
+	};
+};
+
+export const buildAppendOnlySyncPlan = (table, exceptionRows, triggerRows) => {
+	if (!table?.appendOnly) {
+		return { statements: [], differences: [] };
+	}
+	const triggerName = toDbName(table.appendOnlyTriggerName ?? buildObjectName(table.name, "NOUPD"));
+	const statements = [];
+	const differences = [];
+
+	const exceptionExists =
+		Number(exceptionRows?.[0]?.["EXCEPTION_EXISTS"] ?? exceptionRows?.[0]?.["exception_exists"] ?? 0) === 1;
+	const triggerExists =
+		Number(triggerRows?.[0]?.["TRIGGER_EXISTS"] ?? triggerRows?.[0]?.["trigger_exists"] ?? 0) === 1;
+
+	if (!exceptionExists) {
+		differences.push(`Exception "${firebirdDdl.APPEND_ONLY_EXCEPTION_NAME}" is missing.`);
+		statements.push(firebirdDdl.buildCreateAppendOnlyExceptionStatement());
+	}
+	if (!triggerExists) {
+		differences.push(`Append-only trigger "${triggerName}" is missing.`);
+		statements.push(firebirdDdl.buildAppendOnlyTriggerStatement(table.name, triggerName));
+	}
+
+	return {
+		statements: [...new Set(statements.map((statement) => toSingleLine(statement)))],
+		differences,
+	};
+};
+
 export const buildDomainDdlPreview = (domainConfigContent, defaultDbIndex) => {
 	const buildResult = buildDomainSchemaInternal(domainConfigContent, defaultDbIndex);
 	const schema = buildResult.schema;
@@ -1373,6 +1418,11 @@ const buildEntityTable = (entityName, entity, defaultDbIndex) => {
 		table.triggerName = buildObjectName(tableName, "BI");
 	}
 
+	if (entity?.appendOnly === true) {
+		table.appendOnly = true;
+		table.appendOnlyTriggerName = buildObjectName(tableName, "NOUPD");
+	}
+
 	return {
 		entityName,
 		tableName,
@@ -2057,6 +2107,20 @@ const loadGeneratorSyncPlan = async (table, dbIndex, config) => {
 	return buildGeneratorSyncPlan(table, generatorRows, triggerRows);
 };
 
+const loadAppendOnlySyncPlan = async (table, dbIndex, config) => {
+	if (!table?.appendOnly) {
+		return { statements: [], differences: [] };
+	}
+
+	const queries = buildAppendOnlyStructureQueries(table);
+	const [exceptionRows, triggerRows] = await Promise.all([
+		execRawSql(queries.exceptionSql, dbIndex, config),
+		execRawSql(queries.triggerSql, dbIndex, config),
+	]);
+
+	return buildAppendOnlySyncPlan(table, exceptionRows, triggerRows);
+};
+
 const toFirebird25CompatibleDdl = (statement) => {
 	const sanitizedStatement = sanitizeSql(statement);
 	const notNullMatch = sanitizedStatement.match(
@@ -2187,6 +2251,22 @@ const applyGeneratorSyncPlan = async (table, generatorSyncPlan, dbIndex, config,
 	return null;
 };
 
+const applyAppendOnlySyncPlan = async (table, appendOnlySyncPlan, dbIndex, config, ctx) => {
+	appendDryRunReport(ctx.report, ctx.migrationMode, table.name, "append-only-sync", {
+		statements: appendOnlySyncPlan.statements,
+		warnings: [],
+		differences: appendOnlySyncPlan.differences,
+	});
+	if (appendOnlySyncPlan.statements.length === 0) {
+		return null;
+	}
+	if (appendOnlySyncPlan.differences.length > 0) {
+		console.log(`[AppConfig Publish] Table ${table.name} append-only:`, appendOnlySyncPlan.differences);
+	}
+	await executeSqlStatements(appendOnlySyncPlan.statements, dbIndex, config, ctx);
+	return null;
+};
+
 const splitSqlStatements = (sqlBatch) => {
 	const source = sqlBatch ?? "";
 	const statements = [];
@@ -2253,6 +2333,9 @@ const syncTable = async (table, ctx) => {
 		const generatorSyncPlan = await loadGeneratorSyncPlan(table, tableDbIndex, ctx.config);
 		await applyGeneratorSyncPlan(table, generatorSyncPlan, tableDbIndex, ctx.config, ctx);
 
+		const createAppendOnlyPlan = await loadAppendOnlySyncPlan(table, tableDbIndex, ctx.config);
+		await applyAppendOnlySyncPlan(table, createAppendOnlyPlan, tableDbIndex, ctx.config, ctx);
+
 		const latestSnapshot = await loadTableSnapshot(table.name, true, tableDbIndex, ctx.config);
 		const postCreateSyncPlan = buildTableSyncPlan(table, latestSnapshot, { migrationMode: ctx.migrationMode });
 		if (postCreateSyncPlan.warnings.length > 0) {
@@ -2273,6 +2356,9 @@ const syncTable = async (table, ctx) => {
 	const generatorSyncPlan = await loadGeneratorSyncPlan(table, tableDbIndex, ctx.config);
 	await applyGeneratorSyncPlan(table, generatorSyncPlan, tableDbIndex, ctx.config, ctx);
 
+	const existingAppendOnlyPlan = await loadAppendOnlySyncPlan(table, tableDbIndex, ctx.config);
+	await applyAppendOnlySyncPlan(table, existingAppendOnlyPlan, tableDbIndex, ctx.config, ctx);
+
 	if (compareResult.isSame) {
 		return null;
 	}

package/engine/domain/firebird-ddl.js

@@ -237,6 +237,7 @@ export const buildStructureSnapshotFromRows = (input) => {
 
 export const generateExecuteBlockSql = (schema) => {
 	const statements = [];
+	let hasAppendOnly = false;
 
 	for (const table of schema.tables) {
 		const createTable = buildCreateTableStatement(table);
@@ -288,6 +289,18 @@ export const generateExecuteBlockSql = (schema) => {
 				),
 			);
 		}
+
+		if (table.appendOnly) {
+			hasAppendOnly = true;
+			statements.push(
+				buildAppendOnlyTriggerStatement(table.name, resolveAppendOnlyTriggerName(table)),
+			);
+		}
+	}
+
+	if (hasAppendOnly) {
+		// the shared exception must exist before any NOUPD trigger references it
+		statements.unshift(buildCreateAppendOnlyExceptionStatement());
 	}
 
 	return []
@@ -472,6 +485,30 @@ const resolveIdentityValueExpression = (table, identityColumn, generatorName) =>
 	return `GEN_ID(${normalizeIdentifier(generatorName)}, 1)`;
 };
 
+// Shared exception raised by every append-only table's NOUPD trigger.
+export const APPEND_ONLY_EXCEPTION_NAME = 'E_APPEND_ONLY';
+const APPEND_ONLY_EXCEPTION_MESSAGE = 'This table is append-only; UPDATE and DELETE are not allowed.';
+
+export const buildCreateAppendOnlyExceptionStatement = () => {
+	return `CREATE EXCEPTION ${APPEND_ONLY_EXCEPTION_NAME} '${APPEND_ONLY_EXCEPTION_MESSAGE}'`;
+};
+
+// A BEFORE UPDATE OR DELETE trigger that makes the table append-only (raises E_APPEND_ONLY).
+export const buildAppendOnlyTriggerStatement = (tableName, triggerName) => {
+	const normalizedTableName = normalizeIdentifier(tableName);
+	const normalizedTriggerName = normalizeIdentifier(triggerName);
+	return [
+		`CREATE TRIGGER ${normalizedTriggerName} FOR ${normalizedTableName} ACTIVE`,
+		'BEFORE UPDATE OR DELETE POSITION 0 AS BEGIN',
+		`EXCEPTION ${APPEND_ONLY_EXCEPTION_NAME};`,
+		'END',
+	].join(' ');
+};
+
+export const resolveAppendOnlyTriggerName = (table) => {
+	return normalizeIdentifier(table.appendOnlyTriggerName ?? `${table.name}_NOUPD`);
+};
+
 const wrapCreateIfMissing = (statement) => {
 	return [
 		'EXECUTE BLOCK AS',

package/message-broker/clientEmitter.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { createLogger, transports, format } from "winston";
+import { queryData } from "../db/db.js";
 
 export const CLIENT_ROOM = "clientRoom";
 const MAX_RETRIES = 3;
@@ -16,14 +17,16 @@ class ClientEmitterService {
 	constructor() {
 		this.ioServerInstance = null;
 		this.hubSocket = null;
+		this.subdomain = null;
 
 		// Map<clientInstanceId, Map<msgId, PendingData>>
 		this.clientQueues = new Map();
 	}
 
-	init(ioServerInstance, hubSocket) {
+	init(ioServerInstance, hubSocket, subdomain) {
 		this.ioServerInstance = ioServerInstance;
 		this.hubSocket = hubSocket;
+		this.subdomain = subdomain;
 	}
 
 	/**
@@ -149,6 +152,7 @@ class ClientEmitterService {
 			this.ioServerInstance
 				.to(CLIENT_ROOM)
 				.emit(eventName, wrappedPayload);
+
 		if (this.hubSocket && this.hubSocket.connected) {
 			this.hubSocket.emit("broadcastToClient", {
 				eventName,
@@ -166,6 +170,119 @@ class ClientEmitterService {
 			this.emitClient(payload.clientInstanceId, payload.eventName, data);
 		}
 	}
+
+	async emitUsers(userIds, eventName, payload) {
+		if (!Array.isArray(userIds) || userIds.length === 0) return;
+
+		// Use Set to natively guarantee unique values
+		let targetInstances = new Set();
+
+		// 1. Fetch instances from directHub
+		if (this.ioServerInstance && this.subdomain) {
+			for (const uid of userIds) {
+				const roomName = `${this.subdomain}_USER_${uid}`;
+				const sockets = await this.ioServerInstance
+					.in(roomName)
+					.fetchSockets();
+				sockets.forEach((s) => {
+					const cid = s.handshake?.query?.clientInstanceId;
+					if (cid !== undefined && cid !== null) {
+						targetInstances.add(cid);
+					}
+				});
+			}
+		}
+
+		// 2. Fetch instances from Hub Server
+		if (this.hubSocket && this.hubSocket.connected) {
+			try {
+				const cloudInstances = await new Promise((resolve, reject) => {
+					this.hubSocket
+						.timeout(5000)
+						.emit(
+							"clientInstancesByUserIds",
+							{ userIds },
+							(err, res) => {
+								if (err) reject(err);
+								else resolve(res);
+							},
+						);
+				});
+
+				// Explicitly deduplicate the dual-channel overlap
+				if (Array.isArray(cloudInstances)) {
+					cloudInstances.forEach((cid) => {
+						if (!targetInstances.has(cid)) {
+							targetInstances.add(cid);
+						}
+					});
+				}
+			} catch (e) {
+				console.error(
+					"[ESB] Timeout/Error fetching instances from Hub Server",
+					e.message,
+				);
+			}
+		}
+
+		// 3. Blast the Targeted Emits
+		if (targetInstances.size > 0) {
+			// console.log(
+			// 	`[ESB] Routing '${eventName}' to ${targetInstances.size} active instance(s) for users: ${userIds.join(", ")}`,
+			// );
+			for (const cid of targetInstances) {
+				this.emitClient(cid, eventName, payload);
+			}
+		}
+	}
+
+	/**
+	 * TARGETED EMIT BY GROUP: Queries the DB for User IDs, then hands off to emitUsers
+	 */
+	async emitUserGroups(groupIds, eventName, payload) {
+		if (!Array.isArray(groupIds) || groupIds.length === 0) return;
+
+		try {
+			// 1. Construct the exact payload format for orm.pas
+			const dbPayload = {
+				distinct: "true", // Triggers the DISTINCT keyword in orm.pas
+				columns: [{ data: "SYS$UGMEMBER.USER_ID", key: "USER_ID" }],
+				filter: [
+					{
+						junction: "",
+						column: "SYS$UGMEMBER.SYS$USERGROUP_ID",
+						operator: "IN",
+						value1: `(${groupIds.join(",")})`, // Generates: IN (1,2,3)
+					},
+				],
+			};
+
+			// 2. Execute the local LAN query via the DataSnap Adapter
+			const result = await queryData(dbPayload);
+			// 3. Extract the unique User IDs from the mapped result
+			if (Array.isArray(result) && result.length > 0) {
+				const extractedUserIds = result.map((row) => row.USER_ID);
+
+				// console.log(
+				// 	`[ESB] emitUserGroups mapped ${groupIds.length} group(s) to ${extractedUserIds.length} unique user(s).`,
+				// );
+
+				// 4. Hand off to the proven emitUsers Strict DLQ engine
+				if (extractedUserIds.length > 0) {
+					await this.emitUsers(extractedUserIds, eventName, payload);
+				}
+			} else {
+				// console.log(
+				// 	`[ESB] emitUserGroups found no active users for groups: ${groupIds.join(", ")}`,
+				// );
+			}
+		} catch (err) {
+			console.error(
+				"[ESB] emitUserGroups Query Error:",
+				err.message || err,
+			);
+		}
+	}
 }
 
 export const ClientEmitter = new ClientEmitterService();

package/message-broker/dispatcher.js

@@ -75,6 +75,20 @@ export class CLI_Dispatcher {
 			return;
 		}
 
+		// --- EMIT BY USERS ---
+		if (topic === "emitUsers") {
+			const { userIds, eventName, data } = payload;
+			ClientEmitter.emitUsers(userIds, eventName, data);
+			return;
+		}
+
+		// --- EMIT BY USER GROUPS ---
+		if (topic === "emitUserGroups") {
+			const { groupIds, eventName, data } = payload;
+			ClientEmitter.emitUserGroups(groupIds, eventName, data);
+			return;
+		}
+
 		// --- INTERNAL SYSTEM ROUTING ---
 		// ex : this.lib.emitCLI("email:send", data);
 		if (this.mode === "monolithic" && this.localBus) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "biz-a-cli",
-	"version": "2.3.80-15238",
+	"version": "2.3.80-15267",
 	"description": "",
 	"main": "bin/index.js",
 	"type": "module",

package/scheduler/datalib.js

@@ -5,6 +5,7 @@ import * as dayjs from "dayjs";
 import timezone from "dayjs/plugin/timezone.js";
 import utc from "dayjs/plugin/utc.js";
 import crypto from "crypto";
+import { secretProvider } from "../security/secretProvider.js";
 import { createLogger, transports, format } from "winston";
 import { execCLIScriptWorker } from "../worker/cliWorkerPool.js";
 
@@ -199,6 +200,23 @@ export async function extractFunctionScript(
 		axios: axiosInstance, //SCY BZ 4316
 		dayjs: dayjs.default,
 		crypto: crypto,
+		// Keyed HMAC by NAME. The key never enters the CLI script — it stays in the
+		// platform secret provider (file -> DPAPI -> Vault, swappable). Fails closed.
+		hmac: (name, data) => {
+			const { key } = secretProvider.resolveForSign(name);
+			return crypto.createHmac("sha256", key).update(String(data)).digest("hex");
+		},
+		// Rotation-aware verify: resolves the key by the row's stored keyId.
+		hmacVerify: (name, data, digest, keyId) => {
+			const { key } = secretProvider.resolveForVerify(name, keyId);
+			const expected = crypto
+				.createHmac("sha256", key)
+				.update(String(data))
+				.digest("hex");
+			const a = Buffer.from(expected, "hex");
+			const b = Buffer.from(String(digest || ""), "hex");
+			return a.length === b.length && crypto.timingSafeEqual(a, b);
+		},
 		log: logger,
 		data: { sendModel, queryData, crudData, genId, getUrlAndParam },
 		...extraLib,

package/worker/cliScriptWorker.js

@@ -87,6 +87,24 @@ export const run = async (apiConfig, scriptIdentifier, scriptData) => {
 				payload: { eventName, data },
 			});
 		};
+
+		// 4. Targeted by Users
+		lib.emitUsers = (userIds, eventName, data) => {
+			workerpool.workerEmit({
+				type: "IPC_RELAY",
+				topic: "emitUsers",
+				payload: { userIds, eventName, data },
+			});
+		};
+
+		// 5. Targeted by User Groups
+		lib.emitUserGroups = (groupIds, eventName, data) => {
+			workerpool.workerEmit({
+				type: "IPC_RELAY",
+				topic: "emitUserGroups",
+				payload: { groupIds, eventName, data },
+			});
+		};
 	};
 
 	const injectDBMethods = (lib, baseConfig) => {

package/worker/cliWorkerPool.js

@@ -15,7 +15,10 @@ export const cliScriptWorkerPool = workerpool.pool(
 		workerType: "thread",
 		emitStdStreams: true, // the worker will emit stdout and stderr events instead of passing it through to the parent streams
 		workerThreadOpts: {
-			env: { NODE_ENV: process.env.NODE_ENV || "production" },
+			// worker env is a whitelist (not the full process.env). No application secrets here:
+			// CLI scripts get keyed HMAC via lib.hmac(name,...), resolved by the platform secret
+			// provider from the secrets store. BIZA_SECRETS_FILE (optional) points at that store.
+			env: { NODE_ENV: process.env.NODE_ENV || "production", BIZA_SECRETS_FILE: process.env.BIZA_SECRETS_FILE },
 		},
 	},
 );