@cosmicdrift/kumiko-bundled-features 0.155.0 → 0.156.0

package/src/auth-mfa/web/qrcode-browser.d.ts

@@ -2,6 +2,11 @@
 // subpath (see mfa-enable-screen.tsx's import — the main entry pulls in
 // Node-only deps like yargs/pngjs via qrcode's own package.json#browser
 // remap, which Metro doesn't honor). Same runtime shape, just re-typed.
+// `export *` never re-exports a default — `import QRCode from "..."`
+// resolving here relies on the consuming app's esModuleInterop/
+// allowSyntheticDefaultImports (which synthesizes a default from the
+// namespace). Copy this file into apps that need it, but note that
+// requirement — without it, the default import comes back undefined.
 declare module "qrcode/lib/browser" {
   export * from "qrcode";
 }

package/src/config/__tests__/pii-encrypted.integration.test.ts

@@ -0,0 +1,158 @@
+// piiEncrypted config keys (kumiko-platform#231/#459): the value is
+// subject-KMS-encrypted at rest (tenant-row → tenant subject, user-row →
+// user subject), decrypted on read for authorized readers — unlike
+// `encrypted`/`backing="secrets"`, which the `values` query always masks
+// regardless of role (see config/handlers/values.query.ts).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  access,
+  createTenantConfig,
+  createUserConfig,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { ConfigHandlers, ConfigQueries } from "../constants";
+import { createConfigAccessorFactory, createConfigFeature } from "../feature";
+import { createConfigResolver } from "../resolver";
+import { configValuesTable } from "../table";
+
+const BILLING_ADDRESS_KEY = "pii-cfg-test:config:billing-address";
+const PHONE_NUMBER_KEY = "pii-cfg-test:config:phone-number";
+
+const piiFeature = defineFeature("pii-cfg-test", (r) => {
+  r.requires("config");
+
+  r.config({
+    keys: {
+      billingAddress: createTenantConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+      phoneNumber: createUserConfig("text", {
+        piiEncrypted: true,
+        read: access.all,
+        write: access.all,
+      }),
+    },
+  });
+});
+
+const configFeature = createConfigFeature();
+
+let stack: TestStack;
+const kms = new InMemoryKmsAdapter();
+const tenantAdmin = createTestUser({ id: 2 });
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [configFeature, piiFeature],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  // One shared KMS instance for the whole file, not beforeEach/afterEach:
+  // config rows persist in the same DB across tests in this file, so a
+  // fresh adapter per test would orphan the previous test's ciphertext
+  // (KeyNotFoundError) the moment the values query resolves more than the
+  // one key that test just wrote.
+  configurePiiSubjectKms(kms);
+});
+
+afterAll(async () => {
+  resetPiiSubjectKmsForTests();
+  await stack.cleanup();
+});
+
+describe("piiEncrypted config keys", () => {
+  test("tenant-scope value is stored as tenant-subject ciphertext, read back as plaintext", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "Musterstrasse 1, 12345 Berlin" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: BILLING_ADDRESS_KEY,
+      tenantId: tenantAdmin.tenantId,
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`kumiko-pii:v1:tenant:${tenantAdmin.tenantId}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[BILLING_ADDRESS_KEY]?.value).toBe("Musterstrasse 1, 12345 Berlin");
+  });
+
+  test("user-scope value is stored as user-subject ciphertext, distinct from tenant subject", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: PHONE_NUMBER_KEY, value: "+49 151 00000000" },
+      tenantAdmin,
+    );
+
+    const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
+      key: PHONE_NUMBER_KEY,
+      tenantId: tenantAdmin.tenantId,
+      userId: String(tenantAdmin.id),
+    });
+    expect(row).toBeDefined();
+    expect(isPiiCiphertext(row?.value)).toBe(true);
+    expect(row?.value).toStartWith(`kumiko-pii:v1:user:${tenantAdmin.id}:`);
+
+    const values = await stack.http.queryOk<
+      Record<string, { value: unknown; scope: string; source: string }>
+    >(ConfigQueries.values, {}, tenantAdmin);
+    expect(values[PHONE_NUMBER_KEY]?.value).toBe("+49 151 00000000");
+  });
+
+  test("write with scope override to system is rejected — no subject for system-row", async () => {
+    // SystemAdmin so checkScopeWriteAccess passes and the request actually
+    // reaches the piiEncrypted+scope="system" rejection, not an earlier
+    // generic "you can't write system scope" denial.
+    const err = await stack.http.writeErr(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "irrelevant", scope: "system" },
+      TestUsers.systemAdmin,
+    );
+    expect(err.code).toBe("unprocessable");
+    expect((err.details as { reason?: string } | undefined)?.reason).toBe("invalid_scope");
+  });
+
+  test("write without a configured KMS fails loud instead of silently storing plaintext", async () => {
+    resetPiiSubjectKmsForTests();
+    expect(configuredPiiSubjectKms()).toBeUndefined();
+
+    try {
+      const res = await stack.http.write(
+        ConfigHandlers.set,
+        { key: BILLING_ADDRESS_KEY, value: "no-kms-value" },
+        tenantAdmin,
+      );
+      expect(res.status).toBe(500);
+    } finally {
+      // Restore for any test running after this one in the file.
+      configurePiiSubjectKms(kms);
+    }
+  });
+});

package/src/config/__tests__/write-helpers.test.ts

@@ -10,6 +10,7 @@ import type { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   checkScopeWriteAccess,
   hasConfigAccess,
+  resolvePiiSubject,
   resolveScopeIds,
   validatePattern,
   validateScope,
@@ -101,6 +102,28 @@ describe("resolveScopeIds", () => {
   });
 });
 
+describe("resolvePiiSubject (kumiko-platform#231/#459)", () => {
+  const tenant = "tenant-9" as TenantId;
+
+  test("tenant scope resolves to the tenant subject", () => {
+    expect(resolvePiiSubject(ConfigScopes.tenant, tenant, null)).toEqual({
+      kind: "tenant",
+      tenantId: tenant,
+    });
+  });
+
+  test("user scope resolves to the user subject — the row's target user, not necessarily the writer", () => {
+    expect(resolvePiiSubject(ConfigScopes.user, tenant, "user-1")).toEqual({
+      kind: "user",
+      userId: "user-1",
+    });
+  });
+
+  test("user scope without a userId throws instead of silently falling back to tenant", () => {
+    expect(() => resolvePiiSubject(ConfigScopes.user, tenant, null)).toThrow(/userId is null/);
+  });
+});
+
 describe("validateType", () => {
   const numberKey = createTenantConfig("number", {});
   const boolKey = createTenantConfig("boolean", {});

package/src/config/handlers/set.write.ts

@@ -1,16 +1,27 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+  type KmsContext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   ConfigScopes,
   defineWriteHandler,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { requireConfigEncryption } from "../feature";
 import { configValueEntity, configValuesTable } from "../table";
 import {
   findConfigRow,
   prepareConfigWrite,
+  resolvePiiSubject,
   validateBounds,
   validatePattern,
   validateScope,
@@ -47,6 +58,19 @@ export const setWrite = defineWriteHandler({
     const scopeError = validateScope(scope, keyDef.scope, event.payload.key);
     if (scopeError) return writeFailure(scopeError);
 
+    // A piiEncrypted key can never be defined with scope="system" (boot-
+    // rejected), but an admin override write can still target scope=
+    // "system" for a tenant/user-scoped key (validateScope allows any
+    // requestedScope <= definedScope) — system-row has no subject.
+    if (keyDef.piiEncrypted && scope === ConfigScopes.system) {
+      return writeFailure(
+        new UnprocessableError("invalid_scope", {
+          i18nKey: "config.errors.invalidScope",
+          details: { key: event.payload.key, definedScope: keyDef.scope, requestedScope: scope },
+        }),
+      );
+    }
+
     const typeError = validateType(event.payload.value, keyDef);
     if (typeError) return writeFailure(typeError);
 
@@ -90,6 +114,28 @@ export const setWrite = defineWriteHandler({
     if (keyDef.encrypted) {
       const cipher = requireConfigEncryption(ctx, "config:write:set");
       serialized = await cipher.encrypt(serialized, { tenantId });
+    } else if (keyDef.piiEncrypted) {
+      const kms = configuredPiiSubjectKms();
+      if (!kms) {
+        throw new InternalError({
+          message:
+            `[config:write:set] key "${event.payload.key}" declares piiEncrypted=true but no ` +
+            `PII subject-KMS is configured — pass one via runProdApp({ kms }) / ` +
+            `configurePiiSubjectKms(adapter) at boot.`,
+        });
+      }
+      // scope="system" was already rejected above — narrow accordingly.
+      const subject = resolvePiiSubject(
+        scope as Exclude<typeof scope, "system">, // @cast-boundary runtime-checked above
+        tenantId,
+        userId,
+      );
+      const kmsCtx: KmsContext = {
+        requestId: requestContext.get()?.requestId ?? "config:write:set",
+        tenantId,
+        userId: String(event.user.id),
+      };
+      serialized = await encryptPiiValueForSubject(kms, subject, serialized, kmsCtx);
     }
 
     const existing = await findConfigRow(db, event.payload.key, tenantId, userId);

package/src/config/resolver.ts

@@ -1,4 +1,10 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiValueForSubject,
+  type KmsContext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigCascade,
@@ -96,6 +102,24 @@ async function decryptEncrypted(
   return cipher.decrypt(raw);
 }
 
+// Decrypt gate for piiEncrypted keys, mirroring decryptEncrypted above.
+// The subject lives inside the ciphertext (kumiko-pii:v1:<subject>:...),
+// so unlike the write side, no scope/subject resolution is needed here —
+// same call works for a user-row or a tenant-row value.
+async function decryptPiiEncrypted(raw: string, qualifiedKey: string): Promise<string> {
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    throw new InternalError({
+      message:
+        `[config] key "${qualifiedKey}" is piiEncrypted but no PII subject-KMS is wired — the ` +
+        `boot must configure one via runProdApp({ kms }) / configurePiiSubjectKms(adapter).`,
+      i18nKey: "config.errors.cipher_missing",
+    });
+  }
+  const kmsCtx: KmsContext = { requestId: requestContext.get()?.requestId ?? "config:resolver" };
+  return decryptPiiValueForSubject(kms, raw, kmsCtx);
+}
+
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -210,6 +234,8 @@ async function buildCascade(
       let raw = row.value;
       if (keyDef.encrypted) {
         raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+      } else if (keyDef.piiEncrypted) {
+        raw = await decryptPiiEncrypted(raw, qualifiedKey);
       }
       if (activeIndex === -1) activeIndex = levels.length;
       levels.push({
@@ -387,6 +413,8 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
           let raw = row.value;
           if (keyDef.encrypted) {
             raw = await decryptEncrypted(cipher, raw, qualifiedKey);
+          } else if (keyDef.piiEncrypted) {
+            raw = await decryptPiiEncrypted(raw, qualifiedKey);
           }
           return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
         }

package/src/config/write-helpers.ts

@@ -3,6 +3,7 @@
 // have to cross-import from another handler file.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   type ConfigKeyDefinition,
@@ -198,6 +199,27 @@ export function resolveScopeIds(
   }
 }
 
+// The subject a piiEncrypted config value is encrypted under, for the scope
+// actually written to (kumiko-platform#231/#459). Pure — no I/O — so a bug
+// here (e.g. picking the writer's identity instead of the row's target,
+// see entity fields' explicit userOwned.ownerField for why that
+// distinction matters) is caught by a fast unit test, not only the DB-
+// backed integration test. Caller has already rejected scope="system"
+// (no subject exists for it).
+export function resolvePiiSubject(
+  scope: Exclude<ConfigScope, "system">,
+  tenantId: TenantId,
+  userId: string | null,
+): SubjectId {
+  if (scope === ConfigScopes.user) {
+    if (userId === null) {
+      throw new Error('resolvePiiSubject: scope="user" but userId is null');
+    }
+    return { kind: "user", userId };
+  }
+  return { kind: "tenant", tenantId };
+}
+
 export function validateType(
   value: string | number | boolean,
   keyDef: ConfigKeyDefinition,

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -127,7 +127,7 @@ describe("T1.5a: custom-fields events are visible in the audit log", () => {
 
     const res = await listAudit({ aggregateType: "field-definition" });
 
-    // The fieldDefinition is created via r.entity + r.crud, so the event-type
+    // The fieldDefinition is created via registerEntityCrud, so the event-type
     // follows the entity-CRUD convention `<entity>.created` (with a dot),
     // not the feature-emit-via-defineEvent convention used by set/cleared
     // (`custom-fields:event:<short>`).

package/src/delivery/feature.ts

@@ -36,7 +36,7 @@ export function createDeliveryFeature(): FeatureDefinition {
     r.entity("notification-preference", notificationPreferenceEntity, {
       table: notificationPreferencesTable,
     });
-    r.unmanagedTable(deliveryAttemptsTableMeta, {
+    r.rawTable(deliveryAttemptsTableMeta, {
       reason: "read_side.delivery_attempt_log",
     });
 

package/src/file-foundation/__tests__/feature.test.ts

@@ -20,7 +20,7 @@ describe("fileFoundationFeature — shape", () => {
 });
 
 describe("fileFoundationFeature.exports — typed handles", () => {
-  test("exposes only the provider-selector config-key", () => {
+  test("exposes the provider-selector handle", () => {
     expect(fileFoundationFeature.exports.providerConfigKey).toBeDefined();
     expect(fileFoundationFeature.exports.providerConfigKey.name).toBe(
       "file-foundation:config:provider",

package/src/files-provider-s3/__tests__/s3-provider.integration.test.ts

@@ -33,7 +33,9 @@ beforeAll(async () => {
   // Fail loud with an actionable message when Minio is down (otherwise
   // S3 networking errors look like provider bugs).
   try {
-    const health = await fetch(`${endpoint.replace(/\/$/, "")}/minio/health/live`);
+    const health = await fetch(`${endpoint.replace(/\/$/, "")}/minio/health/live`, {
+      signal: AbortSignal.timeout(2000),
+    });
     if (!health.ok) {
       throw new Error(`HTTP ${health.status}`);
     }

package/src/inbound-mail-foundation/__tests__/feature.test.ts

@@ -44,7 +44,7 @@ describe("inboundMailFoundationFeature — shape", () => {
   test("SyncCursor + SeenMessage sind unmanaged (NICHT event-sourced, Plan §3.4)", () => {
     // Drift-Pin: als r.entity würden die Tick-State-Tabellen (a) das
     // Event-Log fluten und (b) beim Projection-Rebuild gewischt.
-    const unmanaged = Object.keys(inboundMailFoundationFeature.unmanagedTables);
+    const unmanaged = Object.keys(inboundMailFoundationFeature.rawTables);
     expect(unmanaged.length).toBe(2);
   });
 });

package/src/inbound-mail-foundation/feature.ts

@@ -156,12 +156,12 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   });
 
   // Sync-Maschinerie: hochfrequenter Tick-State, bewusst NICHT
-  // event-sourced — r.unmanagedTable hält die Migration-DDL, nimmt die
+  // event-sourced — r.rawTable hält die Migration-DDL, nimmt die
   // Tabellen aber aus dem Projection-Rebuild (#494/#498-Klasse).
-  r.unmanagedTable(syncCursorTable, {
+  r.rawTable(syncCursorTable, {
     reason: "read_side.mail_sync_cursors_direct_write",
   });
-  r.unmanagedTable(seenMessageTable, {
+  r.rawTable(seenMessageTable, {
     reason: "read_side.mail_seen_messages_direct_write",
   });
 

package/src/inbound-provider-imap/__tests__/imap-foundation.integration.test.ts

@@ -82,11 +82,11 @@ function probe(host: string, port: number): Promise<boolean> {
   });
 }
 
-const available = await probe(HOST, IMAP_PORT);
+const available = (await probe(HOST, IMAP_PORT)) && (await probe(HOST, SMTP_PORT));
 const liveTest = available ? test : test.skip;
 if (!available) {
   console.warn(
-    `imap-foundation: kein IMAP-Server auf ${HOST}:${IMAP_PORT} — Suite wird geskippt (greenmail starten)`,
+    `imap-foundation: kein IMAP/SMTP-Server auf ${HOST}:${IMAP_PORT}/${SMTP_PORT} — Suite wird geskippt (greenmail starten)`,
   );
 }
 
@@ -96,6 +96,7 @@ let secrets: ReturnType<typeof createSecretsContext>;
 let providerRef: MutableMasterKeyProvider;
 
 beforeAll(async () => {
+  if (!available) return;
   const initialKp = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -131,6 +132,7 @@ beforeAll(async () => {
 });
 
 afterAll(async () => {
+  if (!available) return;
   await stack.cleanup();
   resetPiiSubjectKmsForTests();
 });
@@ -143,13 +145,13 @@ function adminFor(tenantNumber: number) {
   });
 }
 
-function credentialJson(): string {
+function credentialJson(passwordOverride?: string): string {
   return JSON.stringify({
     host: HOST,
     port: IMAP_PORT,
     secure: false,
     user: USER,
-    password: PASSWORD,
+    password: passwordOverride ?? PASSWORD,
   });
 }
 
@@ -256,13 +258,7 @@ describe("imap-foundation — greenmail + supervisor", () => {
       await secrets.set(
         admin.tenantId,
         inboundCredentialSecretKey(connected.accountId),
-        JSON.stringify({
-          host: HOST,
-          port: IMAP_PORT,
-          secure: false,
-          user: USER,
-          password: "definitely-wrong",
-        }),
+        credentialJson("definitely-wrong"),
       );
 
       const supervisor = createSupervisor();

package/src/jobs/feature.ts

@@ -38,7 +38,7 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
-    r.unmanagedTable(jobRunLogsTableMeta, {
+    r.rawTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
     // Events-only aggregate: "jobRun" has no r.entity registration, because

package/src/legal-pages/feature.ts

@@ -50,7 +50,7 @@ export type LegalPagesWrapLayout = (opts: {
   readonly title: string;
   readonly bodyHtml: string;
   readonly lang: string;
-  readonly slug?: "imprint" | "privacy" | "terms";
+  readonly slug?: (typeof LEGAL_ROUTES)[number]["slug"];
 }) => string;
 
 export type LegalPagesOptions = {

package/src/mail-foundation/__tests__/feature.test.ts

@@ -28,7 +28,7 @@ describe("mailFoundationFeature — shape", () => {
 });
 
 describe("mailFoundationFeature.exports — typed handles", () => {
-  test("exposes only the provider-selector config-key", () => {
+  test("exposes the provider-selector handle", () => {
     expect(mailFoundationFeature.exports.providerConfigKey).toBeDefined();
     expect(mailFoundationFeature.exports.providerConfigKey.name).toBe(
       "mail-foundation:config:provider",

package/src/page-render/branding.ts

@@ -73,6 +73,7 @@ export function brandingStyleBlock(tokens: BrandingTokens): string {
     decls.push(`--accent:${tokens.accentColor}`);
   }
   decls.push(`--page-max-width:${layoutMaxWidth(tokens.layoutPreset)}`);
+  // html-ok: decls are CSS custom-property declarations (regex-validated hex color or fixed table lookup), never raw user text.
   return `<style id="tenant-theme">:root{${decls.join(";")}}</style>`;
 }
 
@@ -91,9 +92,9 @@ export function brandingHeaderHtml(tokens: BrandingTokens): string {
   }
   if (parts.length === 0) return "";
 
-  const inner = parts.join("\n");
+  const innerHtml = parts.join("\n");
   if (isSafeHttpsUrl(tokens.siteUrl)) {
-    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${inner}</a></header>`;
+    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${innerHtml}</a></header>`;
   }
-  return `<header class="brand-header">${inner}</header>`;
+  return `<header class="brand-header">${innerHtml}</header>`;
 }

package/src/personal-access-tokens/feature.ts

@@ -53,7 +53,7 @@ export function createPersonalAccessTokensFeature(
     // Direct-write store like read_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
-    r.unmanagedTable(buildEntityTableMeta("api-token", apiTokenEntity), {
+    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity), {
       reason: "read_side.api_tokens_direct_write",
       // create.write encrypts `name` via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -511,6 +511,48 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     });
     expect(asUser.status).toBe(403);
   });
+
+  // IDOR guard: session:detail/session:list are scoped by ctx.db (TenantDb)
+  // alone, no explicit tenant predicate in the handler — an admin from a
+  // different tenant must not be able to read another tenant's session rows.
+  test("session:detail and session:list never leak sessions across tenants", async () => {
+    const TENANT_2 = testTenantId(2);
+    const h2 = makeSessionHelpers(stack, TENANT_2);
+
+    const { userId: carolId } = await h.seedUser("carol4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: carolId, tenantId: TENANT },
+    );
+    const carolAsAdmin = await h.login("carol4@example.com", "pw-long-enough");
+
+    const { userId: daveId } = await h2.seedUser("dave4@example.com", "pw-long-enough");
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: daveId, tenantId: TENANT_2 },
+    );
+    const daveAsAdmin = await h2.login("dave4@example.com", "pw-long-enough");
+
+    const detailRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: carolAsAdmin.sid },
+    });
+    expect(detailRes.status).toBe(200);
+    const detailBody = (await detailRes.json()) as { data: unknown };
+    expect(detailBody.data).toBeNull();
+
+    const listRes = await h2.authedPost("/api/query", daveAsAdmin.token, {
+      type: SessionQueries.list,
+      payload: {},
+    });
+    expect(listRes.status).toBe(200);
+    const listBody = (await listRes.json()) as { data: Array<{ id: string }> };
+    expect(listBody.data.map((r) => r.id)).not.toContain(carolAsAdmin.sid);
+  });
 });
 
 // Defense-in-depth: the sessionChecker refuses a live sid once the user it

package/src/sessions/feature.ts

@@ -93,10 +93,10 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // r.entity would make it a rebuildable implicit projection whose replay
     // finds zero session events and swaps an empty shadow over the live
     // table — wiping every active session on the next projection rebuild
-    // (#498/#494). r.unmanagedTable keeps the migration DDL but opts the
+    // (#498/#494). r.rawTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.unmanagedTable(buildEntityTableMeta("user-session", userSessionEntity), {
+    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity), {
       reason: "read_side.user_sessions_direct_write",
       // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,