Chore/awareness as a service temporary stub (#959)

* feat: add cross-eName ontology lookup helper

* feat: temporary token-gated cross-evault ontology read endpoint

Author: coodos

infrastructure/evault-core/src/core/db/db.service.ts

@@ -465,6 +465,58 @@ export class DbService {
         });
     }
 
+    /**
+     * Finds all meta-envelopes by ontology across every eName (no tenant isolation).
+     * Temporary helper — use with care; intended for the token-gated cross-eVault read endpoint.
+     */
+    async findMetaEnvelopesByOntologyAcrossAllENames<
+        T extends Record<string, any> = Record<string, any>,
+    >(
+        ontology: string,
+    ): Promise<(MetaEnvelopeResult<T> & { eName: string })[]> {
+        const result = await this.runQueryInternal(
+            `
+    MATCH (m:MetaEnvelope { ontology: $ontology })-[:LINKS_TO]->(e:Envelope)
+    RETURN m.id AS id, m.ontology AS ontology, m.acl AS acl, m.eName AS eName, collect(e) AS envelopes
+    `,
+            { ontology },
+        );
+
+        return result.records.map((record) => {
+            const envelopes = record
+                .get("envelopes")
+                .map((node: any): Envelope<T[keyof T]> => {
+                    const properties = node.properties;
+                    return {
+                        id: properties.id,
+                        ontology: properties.ontology,
+                        value: deserializeValue(
+                            properties.value,
+                            properties.valueType,
+                        ) as T[keyof T],
+                        valueType: properties.valueType,
+                    };
+                });
+
+            const parsed = envelopes.reduce(
+                (acc: T, envelope: Envelope<T[keyof T]>) => {
+                    (acc as any)[envelope.ontology] = envelope.value;
+                    return acc;
+                },
+                {} as T,
+            );
+
+            return {
+                id: record.get("id"),
+                ontology: record.get("ontology"),
+                acl: record.get("acl"),
+                eName: record.get("eName"),
+                envelopes,
+                parsed,
+            };
+        });
+    }
+
     /**
      * Deletes a meta-envelope and all its associated envelopes.
      * @param id - The ID of the meta-envelope to delete

infrastructure/evault-core/src/core/http/server.ts

@@ -355,6 +355,40 @@ export async function registerHttpRoutes(
         },
     );
 
+    // Temporary token-gated cross-eVault read by ontology. Intentionally undocumented in Swagger.
+    server.get<{ Params: { ontology: string } }>(
+        "/metaenvelopes/by-ontology/:ontology",
+        async (request, reply) => {
+            const authHeader =
+                request.headers.authorization || request.headers.Authorization;
+            const tokenPayload = await validateToken(
+                typeof authHeader === "string" ? authHeader : null,
+            );
+            if (!tokenPayload) {
+                return reply
+                    .status(401)
+                    .send({ error: "Invalid or missing authentication token" });
+            }
+            if (!dbService) {
+                return reply
+                    .status(503)
+                    .send({ error: "Database service unavailable" });
+            }
+            try {
+                const results =
+                    await dbService.findMetaEnvelopesByOntologyAcrossAllENames(
+                        request.params.ontology,
+                    );
+                return reply.send({ metaEnvelopes: results });
+            } catch (err) {
+                request.log.error(err);
+                return reply
+                    .status(500)
+                    .send({ error: "Failed to fetch meta-envelopes" });
+            }
+        },
+    );
+
     // Watchers signature endpoint - DISABLED: Requires W3ID functionality
     // This endpoint is disabled because the eVault no longer creates/manages W3IDs
     // The private key is now stored on the user's phone