@cosmicdrift/kumiko-bundled-features 0.197.1 → 0.199.0

package/src/jobs/handlers/retry.write.ts

@@ -1,6 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import {
+  InternalError,
   NotFoundError,
   UnprocessableError,
   writeFailure,
@@ -24,7 +25,12 @@ export const retryWrite = defineWriteHandler({
   schema: z.object({ runId: z.uuid() }),
   access: { roles: ["SystemAdmin"] },
   handler: async (event, ctx) => {
-    const db = ctx.db;
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message: "jobs:write:retry requires ctx.systemDb (feature must declare r.systemScope())",
+      });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant("cross-tenant job monitoring");
     // @cast-boundary engine-payload — JobRunner attached by app-boot via ctx-extension
     const jobRunner = ctx["jobRunner"] as JobRunner;
 

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -21,6 +21,7 @@ import {
   deleteRows,
   resetBlindIndexKeyForTests,
   resetPiiSubjectKmsForTests,
+  updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
@@ -36,8 +37,9 @@ import { userSessionEntity } from "../../sessions/schema/user-session";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
+import { USER_STATUS } from "../../user";
 import { createUserFeature } from "../../user/feature";
-import { userEntity } from "../../user/schema/user";
+import { userEntity, userTable } from "../../user/schema/user";
 import { PatHandlers, PatQueries } from "../constants";
 import { createPersonalAccessTokensFeature } from "../feature";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token";
@@ -209,6 +211,17 @@ describe("PAT auth", () => {
     const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
     expect(res.status).toBe(401);
   });
+
+  test("user status Deleted → 401 (blocked principal, same as an unknown token)", async () => {
+    const actor = await actorFor("deleted-status@example.com");
+    const token = await mintToken(actor);
+    const ok = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
+    expect(ok.status).toBe(200);
+
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Deleted }, { id: actor.id });
+    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
+    expect(res.status).toBe(401);
+  });
 });
 
 describe("PAT with active KMS (#820): token name is userOwned PII", () => {

package/src/personal-access-tokens/feature.ts

@@ -83,12 +83,15 @@ export function createPersonalAccessTokensFeature(
     };
 
     // Dormant custom-screen — the client maps PAT_SCREEN_ID to PatTokensScreen;
-    // the app places it via r.nav in its logged-in settings area.
+    // the app places it via r.nav in its logged-in settings area. dormant:
+    // true skips createKumikoApp's missing-client-plugin boot diagnostic
+    // (#2025) for apps that don't nav this screen (#2034).
     r.screen({
       id: PAT_SCREEN_ID,
       type: "custom",
       renderer: { react: { __component: "PatTokensScreen" } },
       access: { openToAll: true },
+      dormant: true,
     });
     r.translations({ keys: PAT_FEATURE_I18N });
 

package/src/personal-access-tokens/roles.ts

@@ -2,8 +2,10 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+// kumiko-lint-ignore cross-feature-import shared lifecycle-status gate with session auth
+import { isPrincipalBlocked } from "../sessions";
 import { tenantMembershipsTable } from "../tenant";
-import { userTable } from "../user";
+import { type UserStatus, userTable } from "../user";
 
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
@@ -11,7 +13,10 @@ import { userTable } from "../user";
 // Resolved fresh on every PAT request — a snapshot baked at mint
 // time would keep a since-revoked admin role for the token's whole (months-long)
 // life. Returns null when the user has no membership in that tenant: removed
-// from the tenant → the PAT stops authenticating there.
+// from the tenant → the PAT stops authenticating there. Also null when the
+// user's lifecycle status blocks them (fw security-welle2) — collapsed onto
+// the same "no roles" outcome as missing-membership so a blocked user's PAT
+// gets an identical 401 to an unknown token (no status oracle).
 export async function resolvePatRoles(
   db: DbConnection,
   userId: string,
@@ -23,7 +28,10 @@ export async function resolvePatRoles(
   });
   const membership = memberships[0];
   if (!membership) return null;
-  const userRow = await fetchOne<{ roles: string | null }>(db, userTable, { id: userId });
+  const userRow = await fetchOne<{ roles: string | null; status: UserStatus }>(db, userTable, {
+    id: userId,
+  });
+  if (userRow && isPrincipalBlocked(userRow.status)) return null;
   const globalRoles = parseRoles(userRow?.roles ?? null);
   return buildSessionRoles(globalRoles, parseRoles(membership.roles));
 }

package/src/readiness/handlers/status.query.ts

@@ -19,7 +19,7 @@ export const statusQuery = defineQueryHandler({
   handler: async (query, ctx) => {
     // One gate for both halves: required keys/secrets of provider-features
     // count only while their provider is the selected one (r.extensionSelector).
-    const gate = await buildProviderSelectionGate(ctx, ReadinessQueries.status, query.user);
+    const gate = await buildProviderSelectionGate(ctx, ReadinessQueries.status, query.user, ctx.db);
     // skipAccessFilter: das Verdict muss ALLE required Keys zählen — der
     // Handler selbst ist TenantAdmin-gated, der Per-Key-Filter wäre hier
     // eine ready:true-Lüge für SystemAdmin-gated Keys (277/1).
@@ -27,6 +27,7 @@ export const statusQuery = defineQueryHandler({
       ctx,
       ReadinessQueries.status,
       query.user,
+      ctx.db,
       gate,
       { skipAccessFilter: true },
     );

package/src/sessions/__tests__/membership-revoke.integration.test.ts

@@ -0,0 +1,195 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/seeding";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { createSessionsFeature } from "../feature";
+import { userSessionEntity, userSessionTable } from "../schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../testing";
+import { makeSessionHelpers } from "./test-helpers";
+
+// Proves the two tenant-membership handlers (update-member-roles,
+// remove-member) reach into the sessions feature's cross-tenant / tenant-
+// scoped revoke, cutting an already-issued JWT instead of leaving it live
+// until the 30-day TTL. See remove-member.write.ts / update-member-roles.write.ts.
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+// request-helper's authHeader() auto-mints + CACHES a sid per (userId,
+// tenantId) the first time it sees a sid-less actor — a cached sid from an
+// earlier test survives that test's own userSessionTable truncation in
+// beforeEach and turns into a dangling row lookup ("session_invalid —
+// missing") on the next test. Minting a fresh admin session per test
+// sidesteps the cache entirely (the actor already carries a live sid).
+async function mintSystemAdmin(): Promise<SessionUser> {
+  return withMintedSession(sessionCreator, TestUsers.systemAdmin);
+}
+
+const encryptionKey = randomBytes(32).toString("base64");
+
+// Matches TestUsers.systemAdmin.tenantId — seed + write events land on the
+// same stream (see password-auto-revoke.integration.test.ts for why).
+const TENANT_A: TenantId = testTenantId(1);
+const TENANT_B: TenantId = testTenantId(2);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  // asAuthConfig() always sets sessionCreator (see sessionCallbacksFromLateBound) —
+  // the Pick<AuthRoutesConfig, ...> type just carries it as optional.
+  const creator = bound.asAuthConfig().sessionCreator;
+  if (!creator) throw new Error("sessionCreator missing from bound auth config");
+  sessionCreator = creator;
+  h = makeSessionHelpers(stack, TENANT_A, sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("updateMemberRoles revokes every live session", () => {
+  test("a role change invalidates the member's current JWT", async () => {
+    const { userId } = await h.seedUser("role-change@example.com", "first-password");
+    const { token } = await h.login("role-change@example.com", "first-password");
+
+    expect(
+      (await h.authedPost("/api/query", token, { type: "user:query:user:me", payload: {} })).status,
+    ).toBe(200);
+
+    await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT_A, roles: ["Admin"] },
+      await mintSystemAdmin(),
+    );
+
+    expect(
+      (await h.authedPost("/api/query", token, { type: "user:query:user:me", payload: {} })).status,
+    ).toBe(401);
+  });
+});
+
+describe("removeMember revokes only the member's sessions in that tenant", () => {
+  test("multi-tenant user keeps their session in the tenant they're still a member of", async () => {
+    const { userId } = await h.seedUser("multi-tenant@example.com", "first-password");
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["User"] });
+
+    // Two separate logins, pinned to different tenants via lastActiveTenantId
+    // — mirrors auth.integration.test.ts scenario 7 (multi-membership
+    // tenant resolution).
+    await stack.http.writeOk(
+      UserHandlers.update,
+      { id: userId, changes: { lastActiveTenantId: TENANT_A }, version: 1 },
+      await mintSystemAdmin(),
+    );
+    const sessionA = await h.login("multi-tenant@example.com", "first-password");
+
+    await stack.http.writeOk(
+      UserHandlers.update,
+      { id: userId, changes: { lastActiveTenantId: TENANT_B }, version: 2 },
+      await mintSystemAdmin(),
+    );
+    const sessionB = await h.login("multi-tenant@example.com", "first-password");
+
+    expect(
+      (
+        await h.authedPost("/api/query", sessionA.token, {
+          type: "user:query:user:me",
+          payload: {},
+        })
+      ).status,
+    ).toBe(200);
+    expect(
+      (
+        await h.authedPost("/api/query", sessionB.token, {
+          type: "user:query:user:me",
+          payload: {},
+        })
+      ).status,
+    ).toBe(200);
+
+    await stack.http.writeOk(
+      TenantHandlers.removeMember,
+      { userId, tenantId: TENANT_A },
+      await mintSystemAdmin(),
+    );
+
+    // Tenant A session is dead...
+    expect(
+      (
+        await h.authedPost("/api/query", sessionA.token, {
+          type: "user:query:user:me",
+          payload: {},
+        })
+      ).status,
+    ).toBe(401);
+    // ...but tenant B session is untouched — the user is still a member there.
+    expect(
+      (
+        await h.authedPost("/api/query", sessionB.token, {
+          type: "user:query:user:me",
+          payload: {},
+        })
+      ).status,
+    ).toBe(200);
+  });
+});

package/src/sessions/feature.ts

@@ -27,8 +27,8 @@ import {
 import { SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema } from "./session-revoked-event";
 
 export type SessionsFeatureOptions = {
-  // A successful update on the `user` entity that changes the `passwordHash`
-  // column triggers a mass-revoke of every live session for that user.
+  // A successful update on the `user` entity that changes `passwordHash`
+  // triggers a mass-revoke of every live session for that user.
   // Industry-standard "password-change signs you out everywhere" flow,
   // including the session that did the change itself — the client has
   // to re-login after a password change.
@@ -173,14 +173,22 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
     // the supported cross-feature path: entity-keyed, not prefixed by the
     // registering feature. Fires after every successful write on any
-    // user-entity handler; we only act when passwordHash is part of the
-    // changes-delta the handler was given.
+    // user-entity handler; we only act when one of REVOKE_TRIGGERING_FIELDS
+    // is part of the changes-delta the handler was given.
     //
-    // Checking `changes["passwordHash"] !== undefined` is cheaper and more
-    // correct than diffing data vs previous — "undefined in changes" means
-    // "the handler didn't touch this column", which is exactly the signal
-    // we want to skip on. Works for both direct user:update calls and any
+    // Checking `changes[field] !== undefined` is cheaper and more correct
+    // than diffing data vs previous — "undefined in changes" means "the
+    // handler didn't touch this column", which is exactly the signal we
+    // want to skip on. Works for both direct user:update calls and any
     // other handler that happens to write the column.
+    //
+    // Only `passwordHash` here: `status` changes go through
+    // updateUserLifecycle(), which writes via the event-store executor
+    // directly and never runs this postSave hook. restrict-account.write.ts
+    // already revokes sessions explicitly for that transition, and
+    // sessionChecker blocks a status-locked principal on its next request
+    // regardless.
+    const REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
     let autoRevoke = options?.autoRevokeOnPasswordChange;
     r.hook("postSave", { allOf: "user" }, async (ctx) => {
       // skip: nothing bound — stateless-JWT deployments without a runtime
@@ -191,8 +199,8 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       // otherwise — every registration would do a mass-revoke roundtrip
       // for a user who literally has no rows in user_sessions.
       if (ctx.isNew) return;
-      // skip: handler didn't touch passwordHash, nothing to revoke
-      if (ctx.changes["passwordHash"] === undefined) return;
+      // skip: handler didn't touch any revoke-triggering field
+      if (!REVOKE_TRIGGERING_FIELDS.some((field) => ctx.changes[field] !== undefined)) return;
       await autoRevoke(String(ctx.id));
     });
 

package/src/sessions/handlers/revoke-all-for-user.write.ts

@@ -21,14 +21,17 @@ import {
 // not the end-user themselves.
 //
 // Tenant-scope: the userSession schema persists tenantId per row (a user
-// can have sessions in multiple tenants). We revoke cross-tenant because
-// "account restriction" is a global user-level statement (the forget path
-// is global too, see the User-Entity special doc). The UPDATE filters
-// only on userId.
+// can have sessions in multiple tenants). Omitting `tenantId` revokes
+// cross-tenant because "account restriction" is a global user-level
+// statement (the forget path is global too, see the User-Entity special
+// doc). Passing `tenantId` narrows the UPDATE to that tenant's rows only —
+// used by tenant-membership removal, where a multi-tenant user must stay
+// logged in to tenants they're still a member of.
 export const revokeAllForUserWrite = defineWriteHandler({
   name: "user-session:revoke-all-for-user",
   schema: z.object({
     userId: z.string().min(1),
+    tenantId: z.string().min(1).optional(),
   }),
   access: { roles: access.privileged },
   handler: async (event, ctx) => {
@@ -36,7 +39,11 @@ export const revokeAllForUserWrite = defineWriteHandler({
       ctx.db.raw,
       userSessionTable,
       { revokedAt: Temporal.Now.instant() },
-      { userId: event.payload.userId, revokedAt: null },
+      {
+        userId: event.payload.userId,
+        revokedAt: null,
+        ...(event.payload.tenantId !== undefined && { tenantId: event.payload.tenantId }),
+      },
     );
 
     // Lightweight append alongside the direct-write above (#1559) — see

package/src/sessions/index.ts

@@ -14,7 +14,7 @@ export type {
   SessionCallbacksOptions,
   SessionMassRevoker,
 } from "./session-callbacks";
-export { createSessionCallbacks } from "./session-callbacks";
+export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks";
 export type { SessionRevokedPayload } from "./session-revoked-event";
 export {
   SESSION_REVOKED_AGGREGATE_TYPE,

package/src/sessions/session-callbacks.ts

@@ -34,6 +34,12 @@ const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
   USER_STATUS.Deleted,
 ]);
 
+// Shared with personal-access-tokens' resolver — a PAT belonging to a
+// locked-out principal must be refused the same way a live session is.
+export function isPrincipalBlocked(status: UserStatus): boolean {
+  return BLOCKED_STATUSES.has(status);
+}
+
 // Why the callbacks live at the raw-DB level rather than going through the
 // dispatcher: session-create/revoke/check run on the hot path of every
 // login and every request. The (createdAt/revokedAt/ip/userAgent) columns
@@ -137,7 +143,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       const user = await fetchOne<{ status: UserStatus }>(db, userTable, {
         id: expectedUserId,
       }).catch(() => null);
-      if (user && BLOCKED_STATUSES.has(user.status)) return "blocked";
+      if (user && isPrincipalBlocked(user.status)) return "blocked";
       return "live";
     },
 

package/src/tenant/__tests__/update-cross-tenant.integration.test.ts

@@ -0,0 +1,83 @@
+// Security regression: tenant:write:update is systemScope() (ctx.db is not
+// tenant-scoped), so without a self-check a caller with the tenant-scoped
+// "Admin" role could pass a foreign tenantId as payload.id and update another
+// tenant's row. Real HTTP via setupTestStack — no mocks.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { TenantHandlers } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantEntity } from "../schema/tenant";
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createTenantFeature()],
+    extraContext: { configResolver: createConfigResolver() },
+  });
+
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("tenant:write:update cross-tenant self-check", () => {
+  test("Admin can update its own tenant", async () => {
+    await stack.http.writeOk(
+      TenantHandlers.create,
+      { id: TestUsers.admin.tenantId, key: "own-tenant", name: "Own Tenant" },
+      TestUsers.systemAdmin,
+    );
+
+    const data = await stack.http.writeOk(
+      TenantHandlers.update,
+      { id: TestUsers.admin.tenantId, changes: { name: "Own Tenant Renamed" }, version: 1 },
+      TestUsers.admin,
+    );
+    expect((data!["data"] as Record<string, unknown>)["name"]).toBe("Own Tenant Renamed");
+  });
+
+  test("Admin cannot update a different tenant", async () => {
+    await stack.http.writeOk(
+      TenantHandlers.create,
+      { id: TestUsers.otherTenant.tenantId, key: "victim-tenant", name: "Victim Tenant" },
+      TestUsers.systemAdmin,
+    );
+
+    const err = await stack.http.writeErr(
+      TenantHandlers.update,
+      { id: TestUsers.otherTenant.tenantId, changes: { name: "Pwned" }, version: 1 },
+      TestUsers.admin,
+    );
+    expectErrorIncludes(err, "tenant_not_found");
+  });
+
+  test("SystemAdmin can still update any tenant", async () => {
+    const data = await stack.http.writeOk(
+      TenantHandlers.update,
+      {
+        id: TestUsers.otherTenant.tenantId,
+        changes: { name: "Renamed By SystemAdmin" },
+        version: 1,
+      },
+      TestUsers.systemAdmin,
+    );
+    expect((data!["data"] as Record<string, unknown>)["name"]).toBe("Renamed By SystemAdmin");
+  });
+});

package/src/tenant/handlers/remove-member.write.ts

@@ -1,6 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, withResponseData } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  defineWriteHandler,
+  withResponseData,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
@@ -9,6 +13,11 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
   entityName: "tenant-membership",
 });
 
+// Literal QN, not an import off the sessions feature — tenant is
+// foundational and must boot without sessions mounted (no r.requires/
+// r.usesApi here, unlike user-data-rights:restrict-account's hard dep).
+const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user";
+
 export const removeMemberWrite = defineWriteHandler({
   name: "removeMember",
   schema: z.object({ userId: z.string(), tenantId: z.string() }),
@@ -33,6 +42,19 @@ export const removeMemberWrite = defineWriteHandler({
       event.user,
       db,
     );
+
+    // Revoke only this tenant's sessions — a multi-tenant user stays logged
+    // in to tenants they're still a member of. Best-effort cross-feature
+    // call: sessions may not be mounted (registry lookup, see above).
+    if (result.isSuccess) {
+      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+      if (revoker) {
+        await ctx.writeAs(createSystemUser(event.payload.tenantId), REVOKE_ALL_SESSIONS_QN, {
+          userId: event.payload.userId,
+          tenantId: event.payload.tenantId,
+        });
+      }
+    }
     return withResponseData(result, event.payload);
   },
 });

package/src/tenant/handlers/update-member-roles.write.ts

@@ -1,6 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, withResponseData } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  defineWriteHandler,
+  withResponseData,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles";
@@ -10,6 +14,11 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
   entityName: "tenant-membership",
 });
 
+// Literal QN, not an import off the sessions feature — tenant is
+// foundational and must boot without sessions mounted (no r.requires/
+// r.usesApi here, unlike user-data-rights:restrict-account's hard dep).
+const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user";
+
 export const updateMemberRolesWrite = defineWriteHandler({
   name: "updateMemberRoles",
   schema: z.object({
@@ -54,6 +63,19 @@ export const updateMemberRolesWrite = defineWriteHandler({
       event.user,
       db,
     );
+
+    // A role change can be security-relevant (e.g. demoting an Admin) — the
+    // user must re-authenticate with the new roles, everywhere, not just in
+    // this tenant. Best-effort cross-feature call: sessions may not be
+    // mounted (registry lookup instead of a hard requires, see above).
+    if (result.isSuccess) {
+      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+      if (revoker) {
+        await ctx.writeAs(createSystemUser(event.user.tenantId), REVOKE_ALL_SESSIONS_QN, {
+          userId: event.payload.userId,
+        });
+      }
+    }
     return withResponseData(result, event.payload);
   },
 });

package/src/tenant/handlers/update.write.ts

@@ -1,5 +1,11 @@
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  InternalError,
+  NotFoundError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { tenantEntity, tenantTable } from "../schema/tenant";
 
@@ -16,5 +22,32 @@ export const updateWrite = defineWriteHandler({
     changes: z.object({ name: z.string().min(1).max(200).optional() }),
   }),
   access: { roles: ["Admin", "SystemAdmin"] },
-  handler: async (event, ctx) => crud.update(event.payload, event.user, ctx.db), // @wrapper-known semantic-alias
+  handler: async (event, ctx) => {
+    if (!ctx.systemDb) {
+      throw new InternalError({
+        message:
+          "tenant:write:update requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
+      });
+    }
+
+    // "Admin" is tenant-scoped and must not touch another tenant's row —
+    // SystemAdmin is the platform-wide role and stays cross-tenant by design.
+    if (event.user.roles.includes("SystemAdmin")) {
+      const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin is platform-wide by design");
+      return crud.update(event.payload, event.user, db);
+    }
+
+    let db: TenantDb;
+    try {
+      db = ctx.systemDb.assertTenantMatch(event.payload.id);
+    } catch (err) {
+      // Kept as tenant_not_found (not the underlying access_denied) so a
+      // cross-tenant Admin can't use the error to enumerate tenant existence.
+      if (err instanceof AccessDeniedError) {
+        return writeFailure(new NotFoundError("tenant", event.payload.id));
+      }
+      throw err;
+    }
+    return crud.update(event.payload, event.user, db);
+  },
 });