@cosmicdrift/kumiko-bundled-features 0.124.0 → 0.125.0

package/src/jobs/web/job-run-detail-screen.tsx

@@ -0,0 +1,169 @@
+// @runtime client
+// Single job-run detail + logs. Route entityId = run uuid.
+
+import { useDispatcher, useNav, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
+import { type ReactNode, useCallback, useEffect, useState } from "react";
+import { JOB_RUNS_SCREEN_ID, JobHandlers, JobQueries } from "../constants";
+
+type LogRow = {
+  readonly level: string;
+  readonly message: string;
+  readonly timestamp: string;
+};
+
+type JobRunDetail = {
+  readonly id: string;
+  readonly jobName: string;
+  readonly status: string;
+  readonly startedAt: string;
+  readonly finishedAt?: string | null;
+  readonly duration?: number | null;
+  readonly error?: string | null;
+  readonly logs: readonly LogRow[];
+};
+
+type State =
+  | { readonly kind: "loading" }
+  | { readonly kind: "missing" }
+  | { readonly kind: "error"; readonly message: string }
+  | { readonly kind: "ready"; readonly run: JobRunDetail };
+
+export function JobRunDetailScreen(): ReactNode {
+  const t = useTranslation();
+  const { Banner, Button, Card, Heading, Text } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const nav = useNav();
+  const runId = nav.route?.entityId;
+  const [state, setState] = useState<State>({ kind: "loading" });
+  const [retrying, setRetrying] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
+
+  const load = useCallback(async (): Promise<void> => {
+    if (runId === undefined || runId === "") {
+      setState({ kind: "missing" });
+      return;
+    }
+    setState({ kind: "loading" });
+    const res = await dispatcher.query<JobRunDetail | null>(JobQueries.details, { runId });
+    if (!res.isSuccess) {
+      setState({ kind: "error", message: res.error.message });
+      return;
+    }
+    if (res.data === null) {
+      setState({ kind: "missing" });
+      return;
+    }
+    setState({ kind: "ready", run: res.data });
+  }, [dispatcher, runId]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const onRetry = async (): Promise<void> => {
+    if (runId === undefined || runId === "") return;
+    setActionError(null);
+    setRetrying(true);
+    const res = await dispatcher.write(JobHandlers.retry, { runId });
+    setRetrying(false);
+    if (!res.isSuccess) {
+      setActionError(res.error.message);
+      return;
+    }
+    nav.navigate({ screenId: JOB_RUNS_SCREEN_ID });
+  };
+
+  if (state.kind === "loading") {
+    return (
+      <FormScreenShell testId="job-run-detail-screen">
+        <Text variant="small">{t("jobs.detail.loading")}</Text>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "missing") {
+    return (
+      <FormScreenShell testId="job-run-detail-screen">
+        <Banner variant="error">{t("jobs.detail.missing")}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "error") {
+    return (
+      <FormScreenShell testId="job-run-detail-screen">
+        <Banner variant="error">{state.message}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  const { run } = state;
+
+  return (
+    <FormScreenShell testId="job-run-detail-screen" className="flex flex-col gap-6">
+      <Button
+        type="button"
+        variant="secondary"
+        onClick={() => nav.navigate({ screenId: JOB_RUNS_SCREEN_ID })}
+        testId="job-run-back"
+      >
+        {t("jobs.detail.back")}
+      </Button>
+
+      <Heading variant="page">{t("jobs.detail.title")}</Heading>
+
+      <Card slots={{ title: run.jobName }}>
+        <dl className="grid gap-3 text-sm">
+          <div>
+            <dt className="font-medium">{t("jobs.detail.field.status")}</dt>
+            <dd data-testid="job-run-status">{run.status}</dd>
+          </div>
+          <div>
+            <dt className="font-medium">{t("jobs.detail.field.id")}</dt>
+            <dd>
+              <Text variant="code">{run.id}</Text>
+            </dd>
+          </div>
+          {run.error !== undefined && run.error !== null && run.error !== "" && (
+            <div>
+              <dt className="font-medium">{t("jobs.detail.field.error")}</dt>
+              <dd>
+                <Banner variant="error">{run.error}</Banner>
+              </dd>
+            </div>
+          )}
+        </dl>
+      </Card>
+
+      {run.status === "failed" && (
+        <Button
+          type="button"
+          variant="primary"
+          disabled={retrying}
+          loading={retrying}
+          onClick={() => void onRetry()}
+          testId="job-run-retry"
+        >
+          {retrying ? t("jobs.detail.retrying") : t("jobs.detail.retry")}
+        </Button>
+      )}
+
+      {actionError !== null && <Banner variant="error">{actionError}</Banner>}
+
+      <Card slots={{ title: t("jobs.detail.logs") }}>
+        {run.logs.length === 0 ? (
+          <Text variant="small">{t("jobs.detail.logs.empty")}</Text>
+        ) : (
+          <ul className="flex flex-col gap-1 font-mono text-sm" data-testid="job-run-logs">
+            {run.logs.map((log) => (
+              <li key={`${log.timestamp}-${log.level}-${log.message}`}>
+                <span className="text-muted-foreground">[{log.level}]</span> {log.message}
+              </li>
+            ))}
+          </ul>
+        )}
+      </Card>
+    </FormScreenShell>
+  );
+}

package/src/jobs/web/job-runs-screen.tsx

@@ -0,0 +1,148 @@
+// @runtime client
+// SystemAdmin job-run list with link to detail screen.
+
+import { useDispatcher, useNav, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
+import { type ReactNode, useCallback, useEffect, useState } from "react";
+import { JOB_RUN_DETAIL_SCREEN_ID, JobQueries } from "../constants";
+
+type JobRunRow = {
+  readonly id: string;
+  readonly jobName: string;
+  readonly status: string;
+  readonly startedAt: string;
+  readonly finishedAt?: string | null;
+  readonly duration?: number | null;
+  readonly error?: string | null;
+};
+
+type ListResponse = { readonly rows: readonly JobRunRow[] };
+
+type State =
+  | { readonly kind: "loading" }
+  | { readonly kind: "error"; readonly message: string }
+  | { readonly kind: "ready"; readonly rows: readonly JobRunRow[] };
+
+const STATUS_FILTER_OPTIONS = [
+  { value: "", label: "all" },
+  { value: "completed", label: "completed" },
+  { value: "failed", label: "failed" },
+  { value: "running", label: "running" },
+  { value: "queued", label: "queued" },
+] as const;
+
+export function JobRunsScreen(): ReactNode {
+  const t = useTranslation();
+  const { Banner, Card, DataTable, Field, Heading, Input, Text } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const nav = useNav();
+  const [state, setState] = useState<State>({ kind: "loading" });
+  const [statusFilter, setStatusFilter] = useState("");
+
+  const filterOptions = STATUS_FILTER_OPTIONS.map((opt) => ({
+    value: opt.value,
+    label: opt.value === "" ? t("jobs.runs.filter.all") : opt.label,
+  }));
+
+  const refresh = useCallback(async (): Promise<void> => {
+    setState({ kind: "loading" });
+    const res = await dispatcher.query<ListResponse>(JobQueries.list, {
+      limit: 50,
+      ...(statusFilter !== "" && {
+        status: statusFilter as "queued" | "running" | "completed" | "failed",
+      }),
+    });
+    if (!res.isSuccess) {
+      setState({ kind: "error", message: res.error.message });
+      return;
+    }
+    setState({ kind: "ready", rows: res.data.rows });
+  }, [dispatcher, statusFilter]);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  if (state.kind === "loading") {
+    return (
+      <FormScreenShell testId="job-runs-screen">
+        <Text variant="small">{t("jobs.runs.loading")}</Text>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "error") {
+    return (
+      <FormScreenShell testId="job-runs-screen">
+        <Banner variant="error">{state.message}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  return (
+    <FormScreenShell testId="job-runs-screen" className="flex max-w-5xl flex-col gap-6">
+      <Heading variant="page">{t("jobs.runs.title")}</Heading>
+
+      <Field id="job-runs-status-filter" label={t("jobs.runs.filter.status")}>
+        <Input
+          kind="select"
+          id="job-runs-status-filter"
+          name="job-runs-status-filter"
+          value={statusFilter}
+          onChange={setStatusFilter}
+          options={filterOptions}
+        />
+      </Field>
+
+      <Card options={{ padded: false }}>
+        <DataTable
+          testId="job-runs-table"
+          columns={[
+            { field: "job", label: t("jobs.runs.col.job"), type: "string", sortable: false },
+            { field: "status", label: t("jobs.runs.col.status"), type: "string", sortable: false },
+            {
+              field: "started",
+              label: t("jobs.runs.col.started"),
+              type: "string",
+              sortable: false,
+            },
+            {
+              field: "duration",
+              label: t("jobs.runs.col.duration"),
+              type: "string",
+              sortable: false,
+            },
+          ]}
+          rows={state.rows.map((row) => ({
+            id: row.id,
+            values: {
+              job: row.jobName,
+              status: row.status,
+              started: formatWhen(row.startedAt),
+              duration: row.duration ?? "—",
+            },
+          }))}
+          rowActions={[
+            {
+              id: "open",
+              label: t("jobs.runs.open"),
+              style: "secondary",
+              onTrigger: (row) =>
+                nav.navigate({ screenId: JOB_RUN_DETAIL_SCREEN_ID, entityId: row.id }),
+            },
+          ]}
+          rowActionMode="inline"
+          emptyState={<Text variant="small">{t("jobs.runs.empty")}</Text>}
+        />
+      </Card>
+    </FormScreenShell>
+  );
+}
+
+function formatWhen(value: string): string {
+  try {
+    return new Date(value).toLocaleString();
+  } catch {
+    return value;
+  }
+}

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from "bun:test";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createConfigFeature } from "../../config/feature";
+import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+
+describe("tenant members screen + handler access alignment", () => {
+  const features = [createConfigFeature(), createTenantFeature()];
+
+  test("boot-validates with members screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("members screen is custom, access.admin-gated", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+
+  test("members UI handlers share access.admin (screen ⊆ handler)", () => {
+    const tenant = createTenantFeature();
+    const adminRoles = [...access.admin];
+    expect(rolesOf(tenant.queryHandlers["members"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.queryHandlers["invitations"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.writeHandlers["cancel-invitation"]?.access)).toEqual(adminRoles);
+    // invite-create lives on auth feature — checked in tenant-security.integration.test.ts
+    void AuthHandlers;
+    void TenantHandlers;
+    void TenantQueries;
+  });
+
+  test("updateMemberRoles stays SystemAdmin/system-only (not on members screen)", () => {
+    const tenant = createTenantFeature();
+    expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([
+      "system",
+      "SystemAdmin",
+    ]);
+  });
+});

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -0,0 +1,295 @@
+// Security integration tests for tenant-admin surfaces (members + invite/cancel).
+// Real HTTP via setupTestStack — no mocks. Proves access.admin alignment and
+// tenant isolation before the MembersScreen ships to apps.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { hashPassword } from "../../auth-email-password/password-hashing";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../invitation-table";
+import { tenantMembershipsTable } from "../membership-table";
+import { tenantEntity, tenantTable } from "../schema/tenant";
+import { seedTenant, seedTenantMembership } from "../seeding";
+
+const emailTransport = createInMemoryTransport();
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"] as const;
+
+let stack: TestStack;
+let TENANT_A_ID: TenantId;
+let TENANT_B_ID: TenantId;
+let tenantAdminAId: string;
+let regularUserBId: string;
+
+function newTenantId(): TenantId {
+  return crypto.randomUUID() as TenantId;
+}
+
+function tenantAdminA(): SessionUser {
+  return { id: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["TenantAdmin"] };
+}
+
+function regularUserB(): SessionUser {
+  return { id: regularUserBId, tenantId: TENANT_B_ID, roles: ["User"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const keys = await stack.redis.redis.keys("invite:*");
+  if (keys.length > 0) await stack.redis.redis.del(...keys);
+
+  TENANT_A_ID = newTenantId();
+  TENANT_B_ID = newTenantId();
+  await seedTenant(stack.db, {
+    id: TENANT_A_ID,
+    key: `tenant-a-${TENANT_A_ID.slice(0, 8)}`,
+    name: "Tenant A",
+  });
+  await seedTenant(stack.db, {
+    id: TENANT_B_ID,
+    key: `tenant-b-${TENANT_B_ID.slice(0, 8)}`,
+    name: "Tenant B",
+  });
+
+  ({ id: tenantAdminAId } = await seedUser(stack.db, {
+    email: "admin-a@example.com",
+    displayName: "Admin A",
+    passwordHash: await hashPassword("pw-a-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: tenantAdminAId,
+    tenantId: TENANT_A_ID,
+    roles: ["TenantAdmin"],
+  });
+
+  ({ id: regularUserBId } = await seedUser(stack.db, {
+    email: "user-b@example.com",
+    displayName: "User B",
+    passwordHash: await hashPassword("pw-b-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: regularUserBId,
+    tenantId: TENANT_B_ID,
+    roles: ["User"],
+  });
+});
+
+describe("access matrix: members screen handlers use access.admin", () => {
+  test("invite-create, members, invitations, cancel-invitation share access.admin", () => {
+    const adminRoles = [...access.admin];
+    expect(rolesOf(stack.registry.getWriteHandler(AuthHandlers.inviteCreate)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(rolesOf(stack.registry.getQueryHandler(TenantQueries.members)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(rolesOf(stack.registry.getQueryHandler(TenantQueries.invitations)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(
+      rolesOf(stack.registry.getWriteHandler(TenantHandlers.cancelInvitation)?.access),
+    ).toEqual(adminRoles);
+  });
+
+  test("members screen access matches access.admin", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen && "access" in screen && screen.access && "roles" in screen.access).toBe(true);
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+});
+
+describe("TenantAdmin can use members-admin HTTP surface", () => {
+  test("TenantAdmin invites → row persisted in own tenant", async () => {
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "new@example.com", role: "User" },
+      tenantAdminA(),
+    )) as { tenantId: string; email: string };
+    expect(result.tenantId).toBe(TENANT_A_ID);
+    const rows = await selectMany(stack.db, tenantInvitationsTable, { email: "new@example.com" });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["tenantId"]).toBe(TENANT_A_ID);
+  });
+
+  test("TenantAdmin lists members and pending invitations for own tenant only", async () => {
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "pending@example.com", role: "Editor" },
+      tenantAdminA(),
+    );
+    const members = await stack.http.queryOk<readonly { userId: string }[]>(
+      TenantQueries.members,
+      {},
+      tenantAdminA(),
+    );
+    expect(members.some((m) => m.userId === tenantAdminAId)).toBe(true);
+    const invitations = await stack.http.queryOk<readonly { email: string }[]>(
+      TenantQueries.invitations,
+      {},
+      tenantAdminA(),
+    );
+    expect(invitations).toHaveLength(1);
+    expect(invitations[0]?.email).toBe("pending@example.com");
+  });
+});
+
+describe("regular User is denied members-admin surface", () => {
+  test("403 on members, invitations, invite-create, cancel-invitation", async () => {
+    for (const [label, fn] of [
+      ["members", () => stack.http.query(TenantQueries.members, {}, regularUserB())],
+      ["invitations", () => stack.http.query(TenantQueries.invitations, {}, regularUserB())],
+      [
+        "invite-create",
+        () =>
+          stack.http.write(
+            AuthHandlers.inviteCreate,
+            { email: "x@y.com", role: "User" },
+            regularUserB(),
+          ),
+      ],
+    ] as const) {
+      const res = await fn();
+      expect(res.status, label).toBe(403);
+    }
+  });
+});
+
+describe("privilege escalation via invite role", () => {
+  test("TenantAdmin cannot invite reserved/global roles", async () => {
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        AuthHandlers.inviteCreate,
+        { email: "escalate@example.com", role },
+        tenantAdminA(),
+      );
+      expectErrorIncludes(err, "access_denied");
+    }
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "escalate@example.com",
+    });
+    expect(rows).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+});
+
+describe("tenant isolation on cancel-invitation", () => {
+  test("TenantAdmin cannot cancel invitation belonging to another tenant", async () => {
+    const { id: adminBId } = await seedUser(stack.db, {
+      email: "admin-b@example.com",
+      displayName: "Admin B",
+      passwordHash: await hashPassword("pw-b-admin-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: adminBId,
+      tenantId: TENANT_B_ID,
+      roles: ["TenantAdmin"],
+    });
+    const adminB: SessionUser = { id: adminBId, tenantId: TENANT_B_ID, roles: ["TenantAdmin"] };
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "cross@example.com", role: "User" },
+      adminB,
+    );
+    const rows = await selectMany(stack.db, tenantInvitationsTable, { email: "cross@example.com" });
+    const invitationId = rows[0]?.["id"] as string;
+
+    const err = await stack.http.writeErr(
+      TenantHandlers.cancelInvitation,
+      { invitationId },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "invitation_not_found");
+  });
+});
+
+describe("updateMemberRoles not reachable by TenantAdmin", () => {
+  test("TenantAdmin gets access_denied on updateMemberRoles", async () => {
+    const err = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["User"] },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "access_denied");
+  });
+});

package/src/tenant/constants.ts

@@ -7,6 +7,11 @@
 // Feature name
 export const TENANT_FEATURE = "tenant" as const;
 
+export const MEMBERS_SCREEN_ID = "members" as const;
+
+/** Closed allowlist for invite-role picker — never free text (escalation guard). */
+export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Admin", "Editor"] as const;
+
 // Qualified write handler names (QN format: scope:type:name)
 export const TenantHandlers = {
   create: "tenant:write:create",