@cosmicdrift/kumiko-bundled-features 0.199.0 → 0.199.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.199.0",
+  "version": "0.199.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -125,12 +125,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.199.0",
-    "@cosmicdrift/kumiko-framework": "0.199.0",
-    "@cosmicdrift/kumiko-headless": "0.199.0",
-    "@cosmicdrift/kumiko-renderer": "0.199.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.199.0",
-    "@cosmicdrift/kumiko-types": "0.199.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.199.2",
+    "@cosmicdrift/kumiko-framework": "0.199.2",
+    "@cosmicdrift/kumiko-headless": "0.199.2",
+    "@cosmicdrift/kumiko-renderer": "0.199.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.199.2",
+    "@cosmicdrift/kumiko-types": "0.199.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",

package/src/config/__tests__/config.integration.test.ts

@@ -451,6 +451,27 @@ describe("Settings-Hub system-scope write by a human SystemAdmin", () => {
     );
     expectErrorIncludes(error, "access_denied");
   });
+
+  // Regression for assertTenantMatch wiring in reset.write.ts: a scope=
+  // "system" reset writes/deletes a row whose tenantId is SYSTEM_TENANT_ID,
+  // not the caller's own tenantId. If the handler ever passed that row
+  // tenantId (instead of event.user.tenantId) into assertTenantMatch, this
+  // would throw "tenant self-check failed" for every SystemAdmin reset.
+  test("resets a system-scope key back to its declared default", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: "integration:config:billing-live", value: true, scope: "system" },
+      systemAdmin,
+    );
+    expect(await sysAccessor()("integration:config:billing-live")).toBe(true);
+
+    await stack.http.writeOk(
+      ConfigHandlers.reset,
+      { key: "integration:config:billing-live", scope: "system" },
+      systemAdmin,
+    );
+    expect(await sysAccessor()("integration:config:billing-live")).toBe(false);
+  });
 });
 
 // --- Scenario 2: Mail Server — system default + tenant override ---

package/src/config/handlers/reset.write.ts

@@ -6,6 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { requireSystemDb } from "../feature";
 import { configValueEntity, configValuesTable } from "../table";
 import { findConfigRow, prepareConfigWrite } from "../write-helpers";
 
@@ -24,7 +25,7 @@ export const resetWrite = defineWriteHandler({
   // Per-key access enforcement lives inside the handler via checkWriteAccess.
   access: { openToAll: true },
   handler: async (event, ctx) => {
-    const db = ctx.db;
+    const db = requireSystemDb(ctx, "config:write:reset", event.user.tenantId);
 
     const prep = prepareConfigWrite({
       registry: ctx.registry,

package/src/config/handlers/set.write.ts

@@ -16,7 +16,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { requireConfigEncryption } from "../feature";
+import { requireConfigEncryption, requireSystemDb } from "../feature";
 import { configValueEntity, configValuesTable } from "../table";
 import {
   findConfigRow,
@@ -44,7 +44,7 @@ export const setWrite = defineWriteHandler({
   // Per-key access enforcement lives inside the handler via checkWriteAccess.
   access: { openToAll: true },
   handler: async (event, ctx) => {
-    const db = ctx.db;
+    const db = requireSystemDb(ctx, "config:write:set", event.user.tenantId);
 
     const prep = prepareConfigWrite({
       registry: ctx.registry,

package/src/jobs/__tests__/job-system-user.integration.test.ts

@@ -1,6 +1,10 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTenantDb,
+  createUncheckedSystemDb,
+  type DbConnection,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createRegistry,
@@ -78,6 +82,7 @@ const billingFeature = defineFeature("billing", (r) => {
         {
           db: tenantDb,
           dbOutsideTransaction: tenantDb,
+          systemDb: createUncheckedSystemDb(tenantDb),
           registry: reg,
           configResolver: ctx["configResolver"] as ConfigResolver,
           ...bridgeStub(),
@@ -161,11 +166,13 @@ describe("SYSTEM_USER in jobs", () => {
     });
 
     const adminUser = TestUsers.admin;
+    const adminTenantDb = createTenantDb(db, adminUser.tenantId, "system");
     const result = await handler.handler(
       { type: ConfigHandlers.set, payload: parsed, user: adminUser },
       {
-        db: createTenantDb(db, adminUser.tenantId, "system"),
-        dbOutsideTransaction: createTenantDb(db, adminUser.tenantId, "system"),
+        db: adminTenantDb,
+        dbOutsideTransaction: adminTenantDb,
+        systemDb: createUncheckedSystemDb(adminTenantDb),
         registry,
         configResolver: resolver,
         ...bridgeStub(),