@cosmicdrift/kumiko-bundled-features 0.197.1 → 0.199.0

package/src/form-draft/__tests__/limits.integration.test.ts

@@ -0,0 +1,112 @@
+// Proves the two DoS-shaped caps on form-draft save (#1900/2): an unbounded
+// `values` blob and unbounded drafts-per-owner both grow the append-only
+// event stream without limit. Real Postgres, real dispatch — not hand-fed
+// context.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createConfigFeature } from "../../config";
+import {
+  FORM_DRAFT_MAX_PER_OWNER,
+  FORM_DRAFT_VALUES_MAX_BYTES,
+  FormDraftHandlers,
+} from "../constants";
+import { formDraftEntity } from "../entity";
+import { formDraftFeature } from "../feature";
+
+let stack: TestStack;
+
+const owner = createTestUser({ id: 1, roles: ["TenantMember"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [formDraftFeature, createConfigFeature()] });
+  await unsafeCreateEntityTable(stack.db, formDraftEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe("DELETE FROM kumiko_events");
+  await asRawClient(stack.db).unsafe("DELETE FROM read_form_drafts");
+});
+
+async function saveDraft(draftKey: string, values: Record<string, unknown>) {
+  return stack.http.write(FormDraftHandlers.save, { draftKey, values, stepIndex: 0 }, owner);
+}
+
+describe("form-draft — values byte cap", () => {
+  test(`values at or under ${FORM_DRAFT_VALUES_MAX_BYTES} bytes is accepted`, async () => {
+    // Padding value sized so the whole payload lands just under the cap.
+    const padding = "x".repeat(FORM_DRAFT_VALUES_MAX_BYTES - 200);
+    const res = await saveDraft("wizard:within-cap", { note: padding });
+    expect(res.status).toBe(200);
+  });
+
+  test(`values exceeding ${FORM_DRAFT_VALUES_MAX_BYTES} bytes is rejected, not silently truncated`, async () => {
+    const padding = "x".repeat(FORM_DRAFT_VALUES_MAX_BYTES + 1);
+    const res = await saveDraft("wizard:over-cap", { note: padding });
+    expect(res.status).toBe(400);
+
+    const rows = await asRawClient(stack.db).unsafe(
+      "SELECT count(*)::int AS n FROM read_form_drafts WHERE draft_key = $1",
+      ["wizard:over-cap"],
+    );
+    expect((rows as Array<{ n: number }>)[0]?.n).toBe(0);
+  });
+});
+
+describe("form-draft — drafts-per-owner cap", () => {
+  test(`an owner can create up to ${FORM_DRAFT_MAX_PER_OWNER} drafts, then the next create is rejected`, async () => {
+    for (let i = 0; i < FORM_DRAFT_MAX_PER_OWNER; i++) {
+      const res = await saveDraft(`wizard:draft-${i}`, { note: "x" });
+      expect(res.status).toBe(200);
+    }
+
+    const overflow = await saveDraft("wizard:draft-overflow", { note: "x" });
+    expect(overflow.status).toBe(422);
+    const body = (await overflow.json()) as { error: { details: Record<string, unknown> } };
+    expect(body.error.details).toMatchObject({
+      reason: "draft_limit_reached",
+      limit: FORM_DRAFT_MAX_PER_OWNER,
+    });
+
+    const rows = await asRawClient(stack.db).unsafe(
+      "SELECT count(*)::int AS n FROM read_form_drafts WHERE owner_id = $1",
+      [String(owner.id)],
+    );
+    expect((rows as Array<{ n: number }>)[0]?.n).toBe(FORM_DRAFT_MAX_PER_OWNER);
+  });
+
+  test("updating an existing draft is never blocked by the cap, even at the limit", async () => {
+    for (let i = 0; i < FORM_DRAFT_MAX_PER_OWNER; i++) {
+      await saveDraft(`wizard:draft-${i}`, { note: "x" });
+    }
+
+    const res = await saveDraft("wizard:draft-0", { note: "updated" });
+    expect(res.status).toBe(200);
+  });
+
+  test("the cap is per-owner, not per-tenant — a different owner is unaffected", async () => {
+    for (let i = 0; i < FORM_DRAFT_MAX_PER_OWNER; i++) {
+      await saveDraft(`wizard:draft-${i}`, { note: "x" });
+    }
+
+    const otherOwner = createTestUser({ id: 2, roles: ["TenantMember"] });
+    const res = await stack.http.write(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:first", values: { note: "x" }, stepIndex: 0 },
+      otherOwner,
+    );
+    expect(res.status).toBe(200);
+  });
+});

package/src/form-draft/constants.ts

@@ -29,3 +29,16 @@ export const FORM_DRAFT_ACCESS: AccessRule = { openToAll: true };
 export const FORM_DRAFT_UNIQUE_KEY_CONSTRAINT = "read_form_drafts_tenant_owner_key_uniq";
 
 export const FORM_DRAFT_KEY_MAX_LENGTH = 256;
+
+// `values` is unbounded, caller-controlled JSON (wizard-form fields) — an
+// autosaving frontend or a malicious authenticated caller could otherwise
+// grow a single draft row without limit. Each save appends an event to the
+// append-only event store, so an oversized draft is also a permanent
+// storage cost, not just a transient one.
+export const FORM_DRAFT_VALUES_MAX_BYTES = 64 * 1024;
+
+// Cap on concurrent drafts per (tenant, ownerId) — without it, an
+// autosaving frontend generating a new create-mode draftId per abandoned
+// wizard session grows the event stream without bound (every save is an
+// append-only event).
+export const FORM_DRAFT_MAX_PER_OWNER = 50;

package/src/form-draft/db/queries/cleanup.ts

@@ -8,6 +8,7 @@ export type StaleDraftRow = {
   readonly id: string;
   readonly tenantId: TenantId;
   readonly ownerId: string;
+  readonly draftKey: string;
   readonly draft: FormDraftBlob;
   readonly insertedAt: Temporal.Instant;
 };
@@ -29,7 +30,7 @@ export async function selectStaleDraftsBatch(
   batchSize: number,
 ): Promise<readonly StaleDraftRow[]> {
   const rows = (await asRawClient(db).unsafe(
-    `SELECT "id", "tenant_id", "owner_id", "draft", "inserted_at" FROM "read_form_drafts"
+    `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
      LIMIT $2`,
@@ -38,6 +39,7 @@ export async function selectStaleDraftsBatch(
     id: string;
     tenant_id: string;
     owner_id: string;
+    draft_key: string;
     draft: FormDraftBlob;
     inserted_at: Date;
   }[];
@@ -45,6 +47,7 @@ export async function selectStaleDraftsBatch(
     id: row.id,
     tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
     ownerId: row.owner_id,
+    draftKey: row.draft_key,
     draft: row.draft,
     insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
   }));

package/src/form-draft/db/queries/draft-count.ts

@@ -0,0 +1,20 @@
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+
+// COUNT(*), not selectMany(...).length — save.write.ts checks this on every
+// create, and a draft's `values` blob can be up to FORM_DRAFT_VALUES_MAX_BYTES
+// (64KB); loading up to FORM_DRAFT_MAX_PER_OWNER full rows just to count them
+// would be several MB of wasted transfer per save.
+export async function countDraftsByOwner(
+  db: DbRunner,
+  tenantId: TenantId,
+  ownerId: string,
+): Promise<number> {
+  const rows = (await asRawClient(db).unsafe(
+    `SELECT count(*)::int AS "count" FROM "read_form_drafts"
+     WHERE "tenant_id" = $1 AND "owner_id" = $2`,
+    [tenantId, ownerId],
+  )) as readonly { count: number }[];
+  return rows[0]?.count ?? 0;
+}

package/src/form-draft/db/queries/owned-file-refs.ts

@@ -18,14 +18,30 @@ import type { Temporal } from "temporal-polyfill";
 // entity) but must survive a discard/cleanup sweep because the live entity
 // still references them. Only uploads that happened during THIS draft's
 // lifetime (inserted after the draft row) are release-eligible.
+//
+// `isCreateMode` bypasses that timestamp filter entirely: a create-mode
+// draftKey (`${screenId}:new:${draftId}`) mints its draftId lazily on the
+// first step-change, so a file uploaded on step 0 gets a file_refs row
+// timestamped BEFORE the draft row exists. There is no pre-filled entity in
+// create-mode — every FileRef the draft references is draft-owned — so the
+// filter would otherwise permanently exclude that key from every future
+// discard/cleanup, leaking it as an unreleasable storage object.
 export async function filterOwnedStorageKeys(
   db: DbRunner,
   tenantId: TenantId,
   ownerId: string,
   candidateKeys: readonly string[],
   draftInsertedAt: Temporal.Instant,
+  isCreateMode: boolean,
 ): Promise<readonly string[]> {
-  const rows = await filterOwnedFileRefs(db, tenantId, ownerId, candidateKeys, draftInsertedAt);
+  const rows = await filterOwnedFileRefs(
+    db,
+    tenantId,
+    ownerId,
+    candidateKeys,
+    draftInsertedAt,
+    isCreateMode,
+  );
   return rows.map((row) => row.storageKey);
 }
 
@@ -43,14 +59,15 @@ export async function filterOwnedFileRefs(
   ownerId: string,
   candidateKeys: readonly string[],
   draftInsertedAt: Temporal.Instant,
+  isCreateMode: boolean,
 ): Promise<readonly OwnedFileRef[]> {
   if (candidateKeys.length === 0) return [];
   const rows = (await asRawClient(db).unsafe(
     `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
-       AND "inserted_at" > $4::timestamptz`,
-    [tenantId, ownerId, candidateKeys, draftInsertedAt.toString()],
+       AND ($5::boolean OR "inserted_at" > $4::timestamptz)`,
+    [tenantId, ownerId, candidateKeys, draftInsertedAt.toString(), isCreateMode],
   )) as readonly { id: string; storage_key: string }[];
   return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/src/form-draft/handlers/__tests__/cleanup.job.test.ts

@@ -19,6 +19,7 @@ function row(id: string, tenantId = TENANT_A): StaleDraftRow {
     id,
     tenantId,
     ownerId: "owner-1",
+    draftKey: "wizard:draft",
     draft: { values: {}, stepIndex: 0, savedAt: "" },
     insertedAt: Temporal.Instant.fromEpochMilliseconds(0),
   };

package/src/form-draft/handlers/cleanup.job.ts

@@ -63,12 +63,18 @@ async function releaseRowFileRefs(
   // db/queries/owned-file-refs.ts). Not wrapped in try/catch: a query
   // failure here (pool exhaustion, missing table) is a real error, not the
   // "no provider resolvable" case below — let it propagate so the job retries.
+  //
+  // Create-mode draftKey (`${screenId}:new:${draftId}`) mints its draftId
+  // lazily on the first step-change — a file uploaded before that exists
+  // predates the draft row, so the insertedAt filter must not apply.
+  const isCreateMode = row.draftKey.includes(":new:");
   const ownedKeys = await filterOwnedStorageKeys(
     db,
     row.tenantId,
     row.ownerId,
     keys,
     row.insertedAt,
+    isCreateMode,
   );
 
   try {

package/src/form-draft/handlers/discard.write.ts

@@ -53,12 +53,18 @@ export const discardDraftWrite = defineWriteHandler({
       // releasable — `values` is free-form JSON the caller controls, so an
       // unverified key could target someone else's file (see
       // db/queries/owned-file-refs.ts).
+      //
+      // Create-mode draftKey (`${screenId}:new:${draftId}`) mints its draftId
+      // lazily on the first step-change — a file uploaded before that exists
+      // predates the draft row, so the insertedAt filter must not apply.
+      const isCreateMode = event.payload.draftKey.includes(":new:");
       const ownedRefs = await filterOwnedFileRefs(
         ctx.db.raw,
         event.user.tenantId,
         ownerId,
         candidateKeys,
         existing.insertedAt,
+        isCreateMode,
       );
       const refsByStorageKey = new Map(ownedRefs.map((ref) => [ref.storageKey, ref]));
       await releaseDraftFileRefs(

package/src/form-draft/handlers/save.write.ts

@@ -1,7 +1,12 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { failUnprocessable, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { FORM_DRAFT_ACCESS, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "../constants";
+import {
+  FORM_DRAFT_ACCESS,
+  FORM_DRAFT_MAX_PER_OWNER,
+  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
+} from "../constants";
+import { countDraftsByOwner } from "../db/queries/draft-count";
 import { formDraftExecutor } from "../executor";
 import { lookupDraft } from "../lookup";
 import { saveDraftPayloadSchema } from "../schemas";
@@ -45,6 +50,14 @@ export const saveDraftWrite = defineWriteHandler({
       );
     }
 
+    // Cap check only on the create path — an update never grows the number
+    // of drafts this owner has, so a user already at the limit can still
+    // keep saving their existing drafts.
+    const draftCount = await countDraftsByOwner(ctx.db.raw, event.user.tenantId, ownerId);
+    if (draftCount >= FORM_DRAFT_MAX_PER_OWNER) {
+      return failUnprocessable("draft_limit_reached", { limit: FORM_DRAFT_MAX_PER_OWNER });
+    }
+
     const result = await formDraftExecutor.create({ ownerId, draftKey, draft }, event.user, ctx.db);
     if (result.isSuccess) return result;
     if (!isDraftKeyConflict(result)) return result;

package/src/form-draft/schemas.ts

@@ -1,8 +1,22 @@
 import { z } from "zod";
-import { FORM_DRAFT_KEY_MAX_LENGTH } from "./constants";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants";
 
 const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);
 
+// UTF-8 byte length, not string.length — `values` is arbitrary JSON that can
+// hold multi-byte characters, and the event-store row this ends up in is
+// bounded by bytes, not JS string units.
+function jsonByteLength(value: unknown): number {
+  return new TextEncoder().encode(JSON.stringify(value)).length;
+}
+
+const draftValuesSchema = z
+  .record(z.string(), z.unknown())
+  .refine(
+    (values) => jsonByteLength(values) <= FORM_DRAFT_VALUES_MAX_BYTES,
+    `values exceeds the ${FORM_DRAFT_VALUES_MAX_BYTES}-byte limit`,
+  );
+
 // The draft blob shape — fixed by issue #1889 here, not left for consumers
 // to invent per-app. `stepIndex` is in from the start so wizard-mode resume
 // (kumiko-framework#1884) doesn't need a later migration.
@@ -17,7 +31,7 @@ export type FormDraftBlob = z.infer<typeof formDraftBlobSchema>;
 // accepted from the caller.
 export const saveDraftPayloadSchema = z.object({
   draftKey: draftKeySchema,
-  values: z.record(z.string(), z.unknown()),
+  values: draftValuesSchema,
   stepIndex: z.number().int().min(0),
 });
 export type SaveDraftPayload = z.infer<typeof saveDraftPayloadSchema>;

package/src/jobs/__tests__/jobs-feature.integration.test.ts

@@ -15,6 +15,7 @@ import {
   type TestDb,
   type TestRedis,
   TestUsers,
+  testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { sleep } from "@cosmicdrift/kumiko-framework/testing";
@@ -35,6 +36,14 @@ let jobRunner: JobRunner;
 
 const systemAdmin = TestUsers.systemAdmin;
 const normalUser = createTestUser({ id: 2, roles: ["User"] });
+// jobs is platform-wide, cross-tenant-by-design monitoring (fw#2077) — this
+// SystemAdmin lives under a different tenant than `systemAdmin` above, so
+// scenario 6 can prove list/details/retry see runs across tenant boundaries.
+const otherTenantSystemAdmin = createTestUser({
+  id: 20,
+  tenantId: testTenantId(2),
+  roles: ["SystemAdmin"],
+});
 const JWT_SECRET = "jobs-feature-test-secret-minimum-32-chars!!";
 
 // Track job executions
@@ -321,6 +330,54 @@ describe("scenario 5: retry failed job", () => {
   });
 });
 
+// --- Scenario 6: cross-tenant visibility (ctx.systemDb.acknowledgeCrossTenant) ---
+
+describe("scenario 6: cross-tenant job monitoring", () => {
+  test("SystemAdmin from a different tenant sees runs triggered under another tenant", async () => {
+    const triggerResult = await write(systemAdmin, JobHandlers.trigger, {
+      jobName: "app:job:sync-data",
+      payload: { source: "cross-tenant-check" },
+    });
+    expect(triggerResult.isSuccess).toBe(true);
+    const bullJobId = triggerResult.data.bullJobId;
+    await sleep(1000);
+
+    const listResult = await query(otherTenantSystemAdmin, JobQueries.list, {
+      jobName: "app:job:sync-data",
+    });
+    const run = listResult.data.rows.find(
+      (r: Record<string, unknown>) => r["bullJobId"] === bullJobId,
+    );
+    expect(run).toBeDefined();
+
+    const detailResult = await query(otherTenantSystemAdmin, JobQueries.details, {
+      runId: run.id,
+    });
+    expect(detailResult.data).not.toBeNull();
+    expect(detailResult.data.id).toBe(run.id);
+  });
+
+  test("SystemAdmin from a different tenant can retry a failed run triggered under another tenant", async () => {
+    const triggerResult = await write(systemAdmin, JobHandlers.trigger, {
+      jobName: "app:job:failing-import",
+    });
+    expect(triggerResult.isSuccess).toBe(true);
+    await sleep(1500);
+
+    const listResult = await query(otherTenantSystemAdmin, JobQueries.list, {
+      jobName: "app:job:failing-import",
+      status: "failed",
+    });
+    const failedRunId = listResult.data.rows[0].id;
+
+    const retryResult = await write(otherTenantSystemAdmin, JobHandlers.retry, {
+      runId: failedRunId,
+    });
+    expect(retryResult.isSuccess).toBe(true);
+    expect(retryResult.data.retriedFromRunId).toBe(failedRunId);
+  });
+});
+
 // --- Access control ---
 
 describe("access control", () => {

package/src/jobs/__tests__/projection-rebuild-job.integration.test.ts

@@ -153,9 +153,18 @@ describe("projection-rebuild job (jobs feature composed)", () => {
     for (let i = 0; i < 40 && (await getCount()) !== 2; i++) await sleep(200);
     expect(await getCount()).toBe(2);
 
-    const runs = await selectMany<{ jobName: string; status: string }>(db, jobRunsTable, {
-      jobName: PROJECTION_REBUILD_JOB,
-    });
+    // getCount()==2 only proves rebuildProjection's own writes landed — the
+    // run-completed event (job-run-logger's onJobComplete) is a separate
+    // async append that starts only after the handler returns, so it can
+    // still be in flight here. Poll status too instead of racing it.
+    let runs: readonly { jobName: string; status: string }[] = [];
+    for (let i = 0; i < 40; i++) {
+      runs = await selectMany<{ jobName: string; status: string }>(db, jobRunsTable, {
+        jobName: PROJECTION_REBUILD_JOB,
+      });
+      if (runs.some((r) => r.status === "completed")) break;
+      await sleep(200);
+    }
     expect(runs.length).toBeGreaterThanOrEqual(1);
     expect(runs.some((r) => r.status === "completed")).toBe(true);
   }, 30000);

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -11,6 +11,7 @@ import {
   buildEntityTable,
   createEventStoreExecutor,
   createTenantDb,
+  createUncheckedSystemDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
@@ -18,6 +19,7 @@ import {
   defineFeature,
   type JobContext,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -97,6 +99,7 @@ describe("reindexEntityJob", () => {
       registry: stack.registry,
       searchAdapter: stack.search,
       systemUser: admin,
+      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
       log: noopLogger,
       triggeredBy: null,
       ...bridgeStub(),
@@ -137,6 +140,7 @@ describe("reindexEntityJob", () => {
       registry: stack.registry,
       searchAdapter: stack.search,
       systemUser: admin,
+      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
       log: noopLogger,
       triggeredBy: null,
       ...bridgeStub(),
@@ -153,7 +157,12 @@ describe("reindexEntityJob", () => {
     await expect(
       reindexEntityJob(
         { entity: "widget" },
-        { db: stack.db, registry: stack.registry, searchAdapter: stack.search },
+        // @cast-boundary test-seam — deliberately no systemUser: proves the no-tenant fan-out-misfire path
+        {
+          db: stack.db,
+          registry: stack.registry,
+          searchAdapter: stack.search,
+        } as unknown as JobContext,
       ),
     ).resolves.toBeUndefined();
   });
@@ -162,8 +171,44 @@ describe("reindexEntityJob", () => {
     await expect(
       reindexEntityJob(
         { entity: "widget" },
-        { db: stack.db, registry: stack.registry, systemUser: admin },
+        // @cast-boundary test-seam — deliberately no searchAdapter: proves the missing-adapter throw
+        { db: stack.db, registry: stack.registry, systemUser: admin } as unknown as JobContext,
       ),
     ).rejects.toThrow(/searchAdapter/);
   });
+
+  test("throws when ctx.systemDb is missing", async () => {
+    await expect(
+      reindexEntityJob(
+        { entity: "widget" },
+        // @cast-boundary test-seam — deliberately no systemDb: proves the missing-systemDb throw
+        {
+          db: stack.db,
+          registry: stack.registry,
+          searchAdapter: stack.search,
+          systemUser: admin,
+        } as unknown as JobContext,
+      ),
+    ).rejects.toThrow(/systemDb/);
+  });
+
+  // Honest scope: in production job-runner.ts derives both ctx.systemDb's
+  // tenantId and ctx.systemUser from the same per-dispatch value, so this
+  // mismatch can't occur live — it only proves the self-check is wired to
+  // the tenant that was actually resolved, catching future drift between
+  // the two, not a real cross-tenant hole.
+  test("fails closed when ctx.systemDb is scoped to a different tenant than ctx.systemUser", async () => {
+    const otherTenantId = TestUsers.otherTenant.tenantId;
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      searchAdapter: stack.search,
+      systemUser: admin,
+      systemDb: createUncheckedSystemDb(createTenantDb(stack.db, otherTenantId, "system")),
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await expect(reindexEntityJob({ entity: "widget" }, ctx)).rejects.toThrow(AccessDeniedError);
+  });
 });

package/src/jobs/handlers/detail.query.ts

@@ -1,5 +1,6 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { decryptStoredPii } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
@@ -13,7 +14,12 @@ export const detailQuery = defineQueryHandler({
   schema: z.object({ runId: z.uuid() }),
   access: { roles: ["SystemAdmin"] },
   handler: async (query, ctx) => {
-    const db = ctx.db;
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message: "jobs:query:details requires ctx.systemDb (feature must declare r.systemScope())",
+      });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant("cross-tenant job monitoring");
 
     const row = await fetchOne(db, jobRunsTable, { id: query.payload.runId });
 

package/src/jobs/handlers/list.query.ts

@@ -1,5 +1,6 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { decryptStoredPii } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
@@ -18,10 +19,16 @@ export const listQuery = defineQueryHandler({
   }),
   access: { roles: ["SystemAdmin"] },
   handler: async (query, ctx) => {
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message: "jobs:query:list requires ctx.systemDb (feature must declare r.systemScope())",
+      });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant("cross-tenant job monitoring");
     const where: WhereObject = {};
     if (query.payload.jobName) where["jobName"] = query.payload.jobName;
     if (query.payload.status) where["status"] = query.payload.status;
-    const rows = await selectMany(ctx.db, jobRunsTable, where, {
+    const rows = await selectMany(db, jobRunsTable, where, {
       orderBy: { col: "id", direction: "desc" },
       limit: query.payload.limit ?? 50,
     });

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -15,10 +15,10 @@ export const projectionRebuildPayloadSchema = z.object({
 
 export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
   const { projection, skipApplyErrors } = projectionRebuildPayloadSchema.parse(rawPayload);
-  if (!ctx.db) {
+  if (!ctx.systemDb) {
     throw new InternalError({
       message:
-        "[jobs:projection-rebuild] ctx.db missing — job context requires a database connection.",
+        "[jobs:projection-rebuild] ctx.systemDb missing — is r.systemScope() still set on the jobs feature?",
     });
   }
   if (!ctx.registry) {
@@ -27,7 +27,10 @@ export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promi
         "[jobs:projection-rebuild] ctx.registry missing — job context requires the registry.",
     });
   }
-  const db = ctx.db as DbConnection; // @cast-boundary db-operator
+  // Global rebuild by design (streams every tenant's events, not just one) —
+  // acknowledgeCrossTenant documents that instead of the previous implicit
+  // ctx.db cast. .raw is the same DbConnection ctx.db carried before.
+  const db = ctx.systemDb.acknowledgeCrossTenant("global projection rebuild").raw as DbConnection; // @cast-boundary db-operator
   const result = await rebuildProjection(projection, {
     db,
     registry: ctx.registry,

package/src/jobs/handlers/reindex-entity.job.ts

@@ -4,7 +4,6 @@
 // just cron: one `jobs:write:trigger` call with { entity } re-runs once per
 // active tenant.
 
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { reindexEntity } from "@cosmicdrift/kumiko-framework/search";
@@ -16,11 +15,6 @@ export const reindexEntityPayloadSchema = z.object({
 
 export const reindexEntityJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
   const { entity } = reindexEntityPayloadSchema.parse(rawPayload);
-  if (!ctx.db) {
-    throw new InternalError({
-      message: "[jobs:reindex-entity] ctx.db missing — job context requires a database connection.",
-    });
-  }
   if (!ctx.registry) {
     throw new InternalError({
       message: "[jobs:reindex-entity] ctx.registry missing — job context requires the registry.",
@@ -33,14 +27,24 @@ export const reindexEntityJob: JobHandlerFn = async (rawPayload, ctx): Promise<v
     });
   }
   // perTenant fan-out — the job-runner enqueues one child run per active
-  // tenant with _tenantId set; a run without one (e.g. misconfigured
-  // manual dispatch outside the fan-out) has nothing scoped to reindex.
-  const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+  // tenant with ctx.systemUser scoped to it; a run without one (e.g.
+  // misconfigured manual dispatch outside the fan-out) has nothing scoped
+  // to reindex. ctx._tenantId is never populated per-dispatch (only
+  // ctx.systemUser is), so it is not a valid fallback here.
+  const tenantId = ctx.systemUser?.tenantId;
   if (tenantId === undefined) {
     // skip: fired without a perTenant fan-out tenant — nothing scoped to reindex
     return;
   }
-  const db = ctx.db as DbConnection; // @cast-boundary db-operator
+  if (!ctx.systemDb) {
+    throw new InternalError({
+      message:
+        "[jobs:reindex-entity] ctx.systemDb missing — the owning feature must declare r.systemScope().",
+    });
+  }
+  // .raw bypasses tenant filtering, safe here only because reindexEntity
+  // filters `WHERE tenant_id = $1` itself with this same tenantId.
+  const db = ctx.systemDb.assertTenantMatch(tenantId).raw;
   const result = await reindexEntity(db, ctx.registry, ctx.searchAdapter, entity, tenantId);
   ctx.log?.info?.(
     `[jobs:reindex-entity] tenant=${tenantId} reindexed ${entity}: ${result.indexedRows}/${result.scannedRows} rows indexed` +