fix(api-scenarios): query engine, bulk endpoint, JWT alg pinning, rate limiter

[frankstupak]

api-scenarios: the reference API now actually does what it advertises

This subproject is the sandbox's "full API" reference — CRUD, filtering, sorting, pagination, search, streaming, file upload, bulk ops, JWT, RBAC. Most of it was a facade. The suite stayed green because the tests asserted almost nothing: the bulk-operation tests accept HTTP 404 as a pass, i.e. "the endpoint doesn't exist" counted as success.

What was broken (all live at 44447fe)

Query engine did nothing. MockUserRepository.findMany returned the first limit rows and ignored filters, search, page, and sort. hasNext was hardcoded false. On top of that, CrudService.sanitizeQuery silently dropped query.search, so even the controllers that built a search query had the term discarded before it reached the repo. Net effect: GET /users?search=nobody&role=admin returned every user.

Duplicate detection was a no-op. The create/update "already exists?" check used a single AND filter array (email == X AND username == Y), which matches nobody unless one user has both — so it never caught a real duplicate by the field that actually collided.

JWT verified with no algorithm allowlist. jwt.verify(token, secret) trusts the token header's alg. That's the classic algorithm-confusion / alg:none footgun — RFC 8725 §3.1 requires pinning the accepted set.

Rate limiter enforced nothing. It emitted X-RateLimit-Limit: 1000 / Remaining: 999 as static strings on every request. No counter, no 429, no Retry-After.

Two response filters mutated the store. filterUserData did const filtered = { ...user } (shallow), then delete filtered.profile.phoneNumber on privacy-filtered views — which permanently deleted the phone number from the stored entity the first time a non-admin viewed the user, because profile was shared by reference. Avatar upload replaced the entire profile object, wiping timezone/language/phone on every upload. Partial preferences/profile updates merged against defaults, so updating one notification toggle reset the user's theme.

The bulk endpoint was a stub that returned "note": "This is a mock implementation" and persisted nothing — and wasn't even registered in the test server (hence the 404-tolerant tests).

Streaming leaks & gaps. The heartbeat reaper dropped tracking state but never closed the socket — leaking exactly the connections that stopped responding. Any client could publish into any room without joining it. Advertised subscription filters were never evaluated. Topic broadcasts scanned every connection and re-resolved each of its subscription ids on every message.

What changed

Correctness: real findMany (all operators with dot-path fields, case-insensitive multi-field search, multi-key stable sort, true offset pagination with honest metadata); sanitizeQuery preserves search; duplicate checks run one indexed query per unique field (OR); optimistic locking enforced (stale version → 409, version bumped per write).

Security: algorithms: ["HS256"] pinned on every verify path; real per-IP fixed-window rate limiter with accurate headers, 429 + Retry-After, lazy pruning, env-configurable.

Store integrity: filterUserData copies nested objects; avatar upload and partial updates merge against current values, not defaults/blank.

Bulk: POST /api/v1/users/bulk executes create/update/delete via new CrudService.bulkUpdate/bulkDelete — per-item validation, in-batch + cross-store uniqueness on create, password hashing, sensitive-field stripping, per-item results — and is registered in the test server.

Streaming: reaper closes the socket before dropping state; room publish requires membership; empty publish rejected; subscription filters evaluated on delivery; unsubscribe-by-id is caller-scoped; heartbeat timer unref()'d.

Numbers (benchmarked on the build host)

Operation	Before	After	Speedup
Email/username lookup @ 100k users	2.44 ms (O(n) scan)	0.0065 ms (hash index)	~377x
Topic-broadcast subscriber resolution @ 10k conns / 100 subs	0.585 ms (scan all conns)	0.0002 ms (topic index)	~2500x

Verification

• Subproject suite: 82 → 98 passing (+16 new in uplift-regressions.test.ts, +1 updated JWT assertion). Every new test pins a bug that was green-under-broken-behavior before.
• Root npm run test:all: 755 passed / 30 suites, 0 failures.
• tsc --noEmit clean; eslint 0 errors.
• Public API and response shapes unchanged (backward compatible).

— Lumen Industries