@cosmicdrift/kumiko-bundled-features 0.200.1 → 0.202.0

package/src/sessions/__tests__/role-rederivation.integration.test.ts

@@ -0,0 +1,137 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { TenantQueries } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantInvitationEntity } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { createSessionsFeature } from "../feature";
+import { userSessionEntity, userSessionTable } from "../schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { sessionCallbacksFromLateBound } from "../testing";
+import { makeSessionHelpers } from "./test-helpers";
+
+// Proves the core DoD of #2148: a role change written directly to
+// tenantMembershipsTable takes effect on the very next request made with an
+// ALREADY-ISSUED, still-live token — no re-login, no JWT expiry needed.
+// Deliberately bypasses update-member-roles.write.ts (which force-revokes
+// the session on a role change) so the effect under test isn't masked by
+// that unrelated, already-correct revoke-on-change behavior.
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+
+// Matches TestUsers.systemAdmin.tenantId — same rationale as
+// membership-revoke.integration.test.ts.
+const TENANT_A: TenantId = testTenantId(1);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  const creator = bound.asAuthConfig().sessionCreator;
+  if (!creator) throw new Error("sessionCreator missing from bound auth config");
+  sessionCreator = creator;
+  h = makeSessionHelpers(stack, TENANT_A, sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("sessionChecker re-derives roles from the DB on every request", () => {
+  test("a DB-side membership role change unlocks a role-gated action for the SAME live token", async () => {
+    // 1. Log in with an initial tenant-membership role set that does NOT
+    //    satisfy the admin gate below.
+    const { userId } = await h.seedUser("role-upgrade@example.com", "first-password", {
+      roles: ["User"],
+    });
+    const { token } = await h.login("role-upgrade@example.com", "first-password");
+
+    // 2. tenant:query:invitations is gated on access.admin
+    //    (["TenantAdmin", "Admin", "SystemAdmin"]) — the freshly-logged-in
+    //    "User" role does not satisfy it.
+    const before = await h.authedPost("/api/query", token, {
+      type: TenantQueries.invitations,
+      payload: {},
+    });
+    expect(before.status).toBe(403);
+
+    // 3. Elevate the role by writing DIRECTLY to tenantMembershipsTable —
+    //    explicitly NOT via update-member-roles.write.ts, whose
+    //    force-revoke-on-change would kill the very token this test needs
+    //    to keep using.
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId, tenantId: TENANT_A },
+    );
+
+    // 4. Same, still-unrevoked, still-unexpired token — the next request
+    //    re-derives roles from the DB and now passes the gate.
+    const after = await h.authedPost("/api/query", token, {
+      type: TenantQueries.invitations,
+      payload: {},
+    });
+    expect(after.status).toBe(200);
+    expect(await after.json()).toEqual({ data: [] });
+  });
+});

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -494,7 +494,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     // Direct invariant: Bob's sid + Alice's userId → missing (not live/revoked).
     expect(await callbacks.get().sessionChecker(bobLogin.sid, alice.userId)).toBe("missing");
-    expect(await callbacks.get().sessionChecker(bobLogin.sid, bob.userId)).toBe("live");
+    const bobResult = await callbacks.get().sessionChecker(bobLogin.sid, bob.userId);
+    const bobStatus = typeof bobResult === "string" ? bobResult : bobResult.status;
+    expect(bobStatus).toBe("live");
 
     // HTTP path: mint Alice's identity onto Bob's sid (stolen-sid scenario).
     const forged = await stack.jwt.sign({

package/src/sessions/session-callbacks.ts

@@ -1,5 +1,5 @@
 import type {
-  AuthSessionStatus,
+  AuthSessionCheckResult,
   SessionChecker,
   SessionCreator,
   SessionMassRevoker,
@@ -11,12 +11,13 @@ export type { SessionMassRevoker } from "@cosmicdrift/kumiko-framework/api";
 
 import { fetchOne, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
-import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared";
+import { tenantMembershipsTable } from "../tenant";
 import { USER_STATUS, type UserStatus, userTable } from "../user";
 import { DEFAULT_SESSION_EXPIRY_MS } from "./constants";
 import { userSessionEntity, userSessionTable } from "./schema/user-session";
@@ -113,9 +114,10 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       );
     },
 
-    async sessionChecker(sid: string, expectedUserId: string): Promise<AuthSessionStatus> {
+    async sessionChecker(sid: string, expectedUserId: string): Promise<AuthSessionCheckResult> {
       const row = await fetchOne<{
         userId: string;
+        tenantId: TenantId;
         revokedAt: unknown;
         expiresAt: { epochMilliseconds: number };
       }>(db, userSessionTable, { id: sid });
@@ -137,14 +139,43 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       // revocation is primary; never turn a user-row miss into a global
       // lockout. (+1 PK read on read_users per authenticated request.)
       //
-      // Fail-open covers a THROW too, not just a null-miss: this read sits on
-      // the hot path of every authenticated request, so a DB timeout / lock
-      // contention / pool exhaustion here must not turn into a global lockout.
-      const user = await fetchOne<{ status: UserStatus }>(db, userTable, {
-        id: expectedUserId,
-      }).catch(() => null);
-      if (user && isPrincipalBlocked(user.status)) return "blocked";
-      return "live";
+      // Fail-open covers a THROW *and* a null-miss, not just a throw: this
+      // read sits on the hot path of every authenticated request, and a
+      // missing row here means we have no DB-confirmed roles to derive from
+      // (e.g. a bootstrap/system actor with no persisted user row) — that is
+      // a different situation from tenantMembershipsTable below, where a
+      // missing row is a legitimate "no tenant roles" outcome. Both branches
+      // return the bare "live" string (no re-derived roles) — the middleware
+      // falls back to the JWT's frozen roles claim.
+      let user: { status: UserStatus; roles: string | null } | undefined;
+      try {
+        user = await fetchOne<{ status: UserStatus; roles: string | null }>(db, userTable, {
+          id: expectedUserId,
+        });
+      } catch {
+        return "live";
+      }
+      if (!user) return "live";
+      if (isPrincipalBlocked(user.status)) return "blocked";
+
+      // Same fail-open reasoning as the userTable lookup above — a transient
+      // DB error on the membership read must not lock the user out. A
+      // missing row (not a throw) is a valid outcome: the user genuinely has
+      // no tenant-scoped roles for row.tenantId, so membershipRoles is [].
+      let membershipRoles: readonly string[];
+      try {
+        const membership = await fetchOne<{ roles: string | null }>(db, tenantMembershipsTable, {
+          userId: expectedUserId,
+          tenantId: row.tenantId,
+        });
+        membershipRoles = membership ? parseRoles(membership.roles) : [];
+      } catch {
+        return "live";
+      }
+
+      const globalRoles = parseRoles(user.roles);
+      const roles = buildSessionRoles(globalRoles, membershipRoles);
+      return { status: "live", roles } as const;
     },
 
     async sessionMassRevoker(userId: string): Promise<number> {

package/src/sessions/session-checker-fail-open.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, spyOn, test } from "bun:test";
 import * as bunDb from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "temporal-polyfill";
+import { tenantMembershipsTable } from "../tenant/membership-table";
 import { USER_STATUS, userTable } from "../user/schema/user";
 import { userSessionTable } from "./schema/user-session";
 import { createSessionCallbacks } from "./session-callbacks";
@@ -74,4 +75,77 @@ describe("sessionChecker fail-open on user-lookup throw", () => {
       spy.mockRestore();
     }
   });
+
+  test("membership lookup THROW → live (not 500)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid3";
+    const userId = "00000000-0000-4000-8000-00000000usr3";
+    const tenantId = "00000000-0000-4000-8000-000000tenant";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          tenantId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Active, roles: null };
+      }
+      if (table === tenantMembershipsTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});
+
+describe("sessionChecker role re-derivation", () => {
+  test("live session composes global + tenant-membership roles fresh from the DB", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid4";
+    const userId = "00000000-0000-4000-8000-00000000usr4";
+    const tenantId = "00000000-0000-4000-8000-000000tenan2";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          tenantId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Active, roles: JSON.stringify(["Support"]) };
+      }
+      if (table === tenantMembershipsTable) {
+        return { roles: JSON.stringify(["User"]) };
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      const result = await cbs.sessionChecker(sid, userId);
+      if (typeof result === "string") {
+        throw new Error(`expected object result, got bare string "${result}"`);
+      }
+      expect(result.status).toBe("live");
+      expect([...result.roles].sort()).toEqual(["Support", "User"]);
+    } finally {
+      spy.mockRestore();
+    }
+  });
 });

package/src/step-dispatcher/webhook-runner.ts

@@ -39,6 +39,20 @@ export function setWebhookFetch(fn: typeof fetch): void {
 }
 
 export async function performWebhookDispatch(spec: WebhookSpec): Promise<WebhookDispatchResult> {
+  // SSRF guard at the primitive boundary: only http(s), and never follow
+  // redirects — a 3xx could point at an internal/metadata target and the
+  // spec carries secrets (auth) that would be forwarded there. A webhook
+  // destination that redirects now surfaces as a delivery error instead.
+  let url: URL;
+  try {
+    url = new URL(spec.url);
+  } catch {
+    return { ok: false, error: `invalid url "${spec.url}"` };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { ok: false, error: `unsupported url scheme "${url.protocol}"` };
+  }
+
   const headers: Record<string, string> = { "content-type": "application/json", ...spec.headers };
   if (spec.auth) {
     const secret = secretResolver(spec.auth.secretRef);
@@ -55,6 +69,7 @@ export async function performWebhookDispatch(spec: WebhookSpec): Promise<Webhook
     const res = await fetchImpl(spec.url, {
       method: spec.method,
       headers,
+      redirect: "manual",
       body: spec.body !== undefined ? JSON.stringify(spec.body) : undefined,
     });
     if (!res.ok) {

package/src/tenant/handlers/remove-member.write.ts

@@ -45,24 +45,25 @@ export const removeMemberWrite = defineWriteHandler({
       );
     }
 
+    // Revoke THIS tenant's sessions BEFORE the delete — a removed member must
+    // not keep a valid session for the window between the delete and a
+    // post-delete revoke. Best-effort cross-feature call: sessions may not be
+    // mounted (registry lookup, see above). If the delete then fails, the
+    // member is logged out but the membership is intact — safe direction.
+    const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+    if (revoker) {
+      await ctx.writeAs(createSystemUser(event.payload.tenantId), REVOKE_ALL_SESSIONS_QN, {
+        userId: event.payload.userId,
+        tenantId: event.payload.tenantId,
+      });
+    }
+
     const result = await executor.delete(
       { id: (existing as DbRow)["id"] as string }, // @cast-boundary db-row
       event.user,
       db,
     );
 
-    // Revoke only this tenant's sessions — a multi-tenant user stays logged
-    // in to tenants they're still a member of. Best-effort cross-feature
-    // call: sessions may not be mounted (registry lookup, see above).
-    if (result.isSuccess) {
-      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
-      if (revoker) {
-        await ctx.writeAs(createSystemUser(event.payload.tenantId), REVOKE_ALL_SESSIONS_QN, {
-          userId: event.payload.userId,
-          tenantId: event.payload.tenantId,
-        });
-      }
-    }
     return withResponseData(result, event.payload);
   },
 });

package/src/tenant/handlers/update-member-roles.write.ts

@@ -62,6 +62,19 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // silent overwrite. Per-membership parallelism is rare; if it happens,
     // the client retries on the error.
     const row = existing as DbRow; // @cast-boundary generic-record
+    // A role change can be security-relevant (e.g. demoting an Admin) — the
+    // user must re-authenticate with the new roles, everywhere. Revoke BEFORE
+    // the update closes the window where the demoted user keeps a valid
+    // session until the revoke write lands. Best-effort cross-feature call:
+    // sessions may not be mounted (registry lookup instead of a hard
+    // requires, see above).
+    const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+    if (revoker) {
+      await ctx.writeAs(createSystemUser(event.user.tenantId), REVOKE_ALL_SESSIONS_QN, {
+        userId: event.payload.userId,
+      });
+    }
+
     const result = await executor.update(
       {
         id: row["id"] as string, // @cast-boundary db-row
@@ -72,18 +85,6 @@ export const updateMemberRolesWrite = defineWriteHandler({
       db,
     );
 
-    // A role change can be security-relevant (e.g. demoting an Admin) — the
-    // user must re-authenticate with the new roles, everywhere, not just in
-    // this tenant. Best-effort cross-feature call: sessions may not be
-    // mounted (registry lookup instead of a hard requires, see above).
-    if (result.isSuccess) {
-      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
-      if (revoker) {
-        await ctx.writeAs(createSystemUser(event.user.tenantId), REVOKE_ALL_SESSIONS_QN, {
-          userId: event.payload.userId,
-        });
-      }
-    }
     return withResponseData(result, event.payload);
   },
 });

package/src/tenant/membership-roles.ts

@@ -18,6 +18,13 @@ export function reservedMembershipRoleError(role: string): AccessDeniedError {
   });
 }
 
+export function unassignableMembershipRoleError(role: string): AccessDeniedError {
+  return new AccessDeniedError({
+    message: `role "${role}" cannot be assigned by this inviter`,
+    details: { reason: "unassignable_membership_role", role },
+  });
+}
+
 export function assertAssignableMembershipRoles(roles: readonly string[]): void {
   const forbidden = findForbiddenMembershipRole(roles);
   if (forbidden !== undefined) throw reservedMembershipRoleError(forbidden);

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -34,7 +34,7 @@ import {
 import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
-import { createConfigResolver } from "../../config/resolver";
+import { buildEnvConfigOverrides, createConfigResolver } from "../../config/resolver";
 import { configValueEntity } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
@@ -147,6 +147,28 @@ describe("tenant-model config resolution (seam)", () => {
     });
     expect(model).toBe("multi-user");
   });
+
+  test("TENANT_MODEL env var bridges through the real registry to resolveAppTenantModel", async () => {
+    // Mirrors the cascade.integration.test.ts env seam test, but pins it at
+    // the real tenantModel key: registry → buildEnvConfigOverrides →
+    // resolveAppTenantModel, so a key-qualification mismatch between the
+    // feature's `env` declaration and the bridge would fail here, not just
+    // on a stub registry.
+    const keyDef = stack.registry.getConfigKey(TENANT_MODEL_CONFIG_KEY);
+    expect(keyDef).toBeDefined();
+    expect(keyDef?.env).toBe("TENANT_MODEL");
+
+    const overrides = buildEnvConfigOverrides(stack.registry, { TENANT_MODEL: "single-user" });
+    expect(overrides.get(TENANT_MODEL_CONFIG_KEY)).toBe("single-user");
+
+    const model = await resolveAppTenantModel({
+      registry: stack.registry,
+      configResolver: createConfigResolver({ appOverrides: overrides }),
+      db: stack.db,
+      userId: SYSTEM_USER_ID,
+    });
+    expect(model).toBe("single-user");
+  });
 });
 
 describe("forget pipeline honours the effective tenant model", () => {

package/src/user-data-rights/feature.ts

@@ -179,6 +179,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       createSystemConfig("select", {
         default: "multi-user",
         options: ["single-user", "multi-user"],
+        env: "TENANT_MODEL",
       }),
     );