@cosmicdrift/kumiko-bundled-features 0.201.0 → 0.203.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.201.0",
+  "version": "0.203.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.201.0",
-    "@cosmicdrift/kumiko-framework": "0.201.0",
-    "@cosmicdrift/kumiko-headless": "0.201.0",
-    "@cosmicdrift/kumiko-renderer": "0.201.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.201.0",
-    "@cosmicdrift/kumiko-types": "0.201.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.203.0",
+    "@cosmicdrift/kumiko-framework": "0.203.0",
+    "@cosmicdrift/kumiko-headless": "0.203.0",
+    "@cosmicdrift/kumiko-renderer": "0.203.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.203.0",
+    "@cosmicdrift/kumiko-types": "0.203.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",

package/src/auth-mfa/__tests__/session-auto-revoke.integration.test.ts

@@ -30,6 +30,18 @@ import { currentTotpCode } from "../totp";
 // account — every OTHER live session must be signed out (stolen-session
 // defense), but the session that performed the change must survive.
 
+// sessionChecker's "live" outcome can now carry re-derived roles as
+// `{status: "live", roles: [...]}` instead of the bare string — these tests
+// only care about liveness, not the exact role set, so unwrap the status.
+async function checkerStatus(
+  callbacks: ReturnType<typeof createSessionCallbacks>,
+  sid: string,
+  userId: string,
+): Promise<string> {
+  const result = await callbacks.sessionChecker(sid, userId);
+  return typeof result === "string" ? result : result.status;
+}
+
 let stack: TestStack;
 let sessionCallbacks: ReturnType<typeof createSessionCallbacks>;
 
@@ -94,8 +106,8 @@ describe("session auto-revoke on MFA state changes", () => {
       user,
     );
 
-    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
-    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+    expect(await checkerStatus(sessionCallbacks, currentSid, userId)).toBe("live");
+    expect(await checkerStatus(sessionCallbacks, otherSid, userId)).toBe("revoked");
   });
 
   test("disable revokes every OTHER session but keeps the caller's", async () => {
@@ -130,8 +142,8 @@ describe("session auto-revoke on MFA state changes", () => {
       caller,
     );
 
-    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
-    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+    expect(await checkerStatus(sessionCallbacks, currentSid, userId)).toBe("live");
+    expect(await checkerStatus(sessionCallbacks, otherSid, userId)).toBe("revoked");
   });
 
   test("a failed disable attempt does NOT revoke any session", async () => {
@@ -163,7 +175,7 @@ describe("session auto-revoke on MFA state changes", () => {
     const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "000000" }, caller);
     expectErrorIncludes(err, "invalid_totp_code");
 
-    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
-    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("live");
+    expect(await checkerStatus(sessionCallbacks, currentSid, userId)).toBe("live");
+    expect(await checkerStatus(sessionCallbacks, otherSid, userId)).toBe("live");
   });
 });

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -8,7 +8,7 @@
 //   - Member role → 403 (DPO/SystemAdmin only)
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   buildEntityTable,
@@ -28,8 +28,21 @@ import {
   TestUsers,
   testTenantId,
   unsafeCreateEntityTable,
+  unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "temporal-polyfill";
+import { authFoundationFeature } from "../../auth-foundation";
+import { createConfigFeature } from "../../config";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens/feature";
+import { apiTokenEntity, apiTokenTable } from "../../personal-access-tokens/schema/api-token";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { seedUser } from "../../user/seeding";
 import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 
@@ -283,3 +296,86 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
     expect(after.some((h) => String(h.entityId) === id)).toBe(false);
   });
 });
+
+// The P2 audit finding: forget-subject shredded the DEK but left status +
+// PATs untouched — a forgotten user's credentials stayed live (PAT resolver
+// checks revokedAt/expiresAt, never user.status). Own stack with user +
+// personal-access-tokens mounted (the handler's user-lifecycle + PAT-revoke
+// branches guard on those features).
+describe("crypto-shredding :: forget-subject closes the login door (user feature mounted)", () => {
+  let stack: TestStack;
+  let kms: InMemoryKmsAdapter;
+  const TENANT_B = testTenantId(3);
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [
+        createCryptoShreddingFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createConfigFeature(),
+        authFoundationFeature,
+        createPersonalAccessTokensFeature({ scopes: {} }),
+      ],
+    });
+    await unsafeCreateEntityTable(stack.db, userEntity);
+    await unsafeCreateEntityTable(stack.db, apiTokenEntity);
+    // tenant feature's only lookupable entity — the blind-index sweep
+    // touches it; without the table the handler 500s on `read_tenant_invitations`.
+    await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+    await unsafePushTables(stack.db, { tenantMembershipsTable });
+    await createEventsTable(stack.db);
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await resetTestTables(stack.db, [
+      userTable,
+      apiTokenTable,
+      tenantMembershipsTable,
+      eventsTable,
+    ]);
+    kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("user forget flips status to Deleted and revokes existing PATs", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "forgotten@example.com",
+      displayName: "Forgotten User",
+      emailVerified: true,
+    });
+    // No explicit createKey: seedUser's PII-encrypt (email) already created
+    // the subject key implicitly via getOrCreateDek.
+    await insertOne(stack.db, apiTokenTable, {
+      id: generateId(),
+      userId,
+      tenantId: TENANT_B,
+      name: "legacy-pat",
+      tokenHash: "a".repeat(64),
+      prefix: "ktest",
+      scopes: "[]",
+      createdAt: Temporal.Now.instant(),
+    });
+
+    await stack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).toBe(USER_STATUS.Deleted);
+
+    const tokens = await selectMany(stack.db, apiTokenTable, { userId });
+    expect(tokens).toHaveLength(1);
+    expect(tokens[0]?.["revokedAt"]).not.toBeNull();
+  });
+});

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -10,6 +10,9 @@ import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { z } from "zod";
+import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
+import { USER_STATUS } from "../../user";
+import { updateUserLifecycle } from "../../user-data-rights";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 
 export const subjectIdSchema = z.discriminatedUnion("kind", [
@@ -70,10 +73,10 @@ export const forgetSubjectWrite = defineWriteHandler({
       eraseReason: event.payload.reason,
     });
 
-    // Blind-Index-Sweep (#818): bidx-Spalten des erased Subjects sofort
-    // nullen — sonst bliebe der deterministische HMAC bis zum nächsten
-    // Rebuild equality-matchbar. Bewusst ctx.db.raw: der Ciphertext-Prefix
-    // adressiert das Subject tenant-übergreifend.
+    // Blind-index sweep (#818): null the erased subject's bidx columns now —
+    // otherwise the deterministic HMAC stays equality-matchable until the next
+    // rebuild. Deliberately ctx.db.raw: the ciphertext prefix addresses the
+    // subject across tenants.
     await nullBlindIndexesForSubject(ctx.db.raw, ctx.registry.features, subjectKey);
 
     // Derived search index still holds plaintext (#1610) — purge next to the
@@ -88,6 +91,28 @@ export const forgetSubjectWrite = defineWriteHandler({
       );
     }
 
+    // User subject: close the login door. DEK-erase makes the passwordHash
+    // ciphertext unreadable, but status + PATs are standalone credentials —
+    // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
+    // (resolver.ts). Without this block a forgotten user with a live PAT stays
+    // callable. Mirror of the automated Art.-17 path (userDeleteHook:
+    // status=Deleted; apiTokenDeleteHook: revoke):
+    //   - user.updated as lifecycle event (updateUserLifecycle), so a
+    //     read_users rebuild doesn't wipe the flip (#494)
+    //   - sessions don't need active revocation — session-callbacks
+    //     re-validate user.status on every request (isPrincipalBlocked
+    //     blocks Deleted).
+    // Both idempotent (status set / revokedAt IS NULL filter), retry after
+    // crash recovery is safe. User-feature guard: without the user feature
+    // read_users doesn't exist (crypto-only stack). Tenant subjects have no
+    // credentials.
+    if (raw.kind === "user" && ctx.registry.features.has("user")) {
+      await updateUserLifecycle(ctx.db.raw, raw.userId, { status: USER_STATUS.Deleted });
+      if (ctx.registry.features.has("personal-access-tokens")) {
+        await revokeAllPatTokensForUser(ctx.db.raw, raw.userId);
+      }
+    }
+
     await ctx.unsafeAppendEvent({
       aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
       aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,

package/src/jobs/web/__tests__/job-runs-screen.test.tsx

@@ -49,10 +49,12 @@ const stubNav: NavApi = {
   route: undefined,
   navigate: () => {},
   replace: () => {},
-  hrefFor: (target) =>
-    target.entityId !== undefined
+  hrefFor: (target) => {
+    if (!("screenId" in target)) return "";
+    return target.entityId !== undefined
       ? `/${target.screenId}/${target.entityId}`
-      : `/${target.screenId}`,
+      : `/${target.screenId}`;
+  },
   searchParams: {},
   setSearchParams: () => {},
 };

package/src/personal-access-tokens/revoke-for-user.ts

@@ -1,5 +1,5 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "temporal-polyfill";
 import { apiTokenTable } from "./schema/api-token";
 
@@ -7,7 +7,7 @@ import { apiTokenTable } from "./schema/api-token";
 // level security events, not scoped to one tenant. Mirrors sessions'
 // sessionMassRevoker (session-callbacks.ts) which passes the boot-time
 // DbConnection directly — not ctx.db, which would be tenant-scoped in a hook.
-export async function revokeAllPatTokensForUser(db: DbConnection, userId: string): Promise<number> {
+export async function revokeAllPatTokensForUser(db: DbRunner, userId: string): Promise<number> {
   const updated = await updateMany<{ id: string }>(
     db,
     apiTokenTable,

package/src/sessions/__tests__/role-rederivation.integration.test.ts

@@ -0,0 +1,137 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { TenantQueries } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantInvitationEntity } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { createSessionsFeature } from "../feature";
+import { userSessionEntity, userSessionTable } from "../schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../session-callbacks";
+import { sessionCallbacksFromLateBound } from "../testing";
+import { makeSessionHelpers } from "./test-helpers";
+
+// Proves the core DoD of #2148: a role change written directly to
+// tenantMembershipsTable takes effect on the very next request made with an
+// ALREADY-ISSUED, still-live token — no re-login, no JWT expiry needed.
+// Deliberately bypasses update-member-roles.write.ts (which force-revokes
+// the session on a role change) so the effect under test isn't masked by
+// that unrelated, already-correct revoke-on-change behavior.
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+
+// Matches TestUsers.systemAdmin.tenantId — same rationale as
+// membership-revoke.integration.test.ts.
+const TENANT_A: TenantId = testTenantId(1);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  const creator = bound.asAuthConfig().sessionCreator;
+  if (!creator) throw new Error("sessionCreator missing from bound auth config");
+  sessionCreator = creator;
+  h = makeSessionHelpers(stack, TENANT_A, sessionCreator);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("sessionChecker re-derives roles from the DB on every request", () => {
+  test("a DB-side membership role change unlocks a role-gated action for the SAME live token", async () => {
+    // 1. Log in with an initial tenant-membership role set that does NOT
+    //    satisfy the admin gate below.
+    const { userId } = await h.seedUser("role-upgrade@example.com", "first-password", {
+      roles: ["User"],
+    });
+    const { token } = await h.login("role-upgrade@example.com", "first-password");
+
+    // 2. tenant:query:invitations is gated on access.admin
+    //    (["TenantAdmin", "Admin", "SystemAdmin"]) — the freshly-logged-in
+    //    "User" role does not satisfy it.
+    const before = await h.authedPost("/api/query", token, {
+      type: TenantQueries.invitations,
+      payload: {},
+    });
+    expect(before.status).toBe(403);
+
+    // 3. Elevate the role by writing DIRECTLY to tenantMembershipsTable —
+    //    explicitly NOT via update-member-roles.write.ts, whose
+    //    force-revoke-on-change would kill the very token this test needs
+    //    to keep using.
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId, tenantId: TENANT_A },
+    );
+
+    // 4. Same, still-unrevoked, still-unexpired token — the next request
+    //    re-derives roles from the DB and now passes the gate.
+    const after = await h.authedPost("/api/query", token, {
+      type: TenantQueries.invitations,
+      payload: {},
+    });
+    expect(after.status).toBe(200);
+    expect(await after.json()).toEqual({ data: [] });
+  });
+});

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -494,7 +494,9 @@ describe("sessions feature — login → check → revoke → rejected", () => {
 
     // Direct invariant: Bob's sid + Alice's userId → missing (not live/revoked).
     expect(await callbacks.get().sessionChecker(bobLogin.sid, alice.userId)).toBe("missing");
-    expect(await callbacks.get().sessionChecker(bobLogin.sid, bob.userId)).toBe("live");
+    const bobResult = await callbacks.get().sessionChecker(bobLogin.sid, bob.userId);
+    const bobStatus = typeof bobResult === "string" ? bobResult : bobResult.status;
+    expect(bobStatus).toBe("live");
 
     // HTTP path: mint Alice's identity onto Bob's sid (stolen-sid scenario).
     const forged = await stack.jwt.sign({

package/src/sessions/session-callbacks.ts

@@ -1,5 +1,5 @@
 import type {
-  AuthSessionStatus,
+  AuthSessionCheckResult,
   SessionChecker,
   SessionCreator,
   SessionMassRevoker,
@@ -11,12 +11,13 @@ export type { SessionMassRevoker } from "@cosmicdrift/kumiko-framework/api";
 
 import { fetchOne, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
-import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared";
+import { tenantMembershipsTable } from "../tenant";
 import { USER_STATUS, type UserStatus, userTable } from "../user";
 import { DEFAULT_SESSION_EXPIRY_MS } from "./constants";
 import { userSessionEntity, userSessionTable } from "./schema/user-session";
@@ -113,9 +114,10 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       );
     },
 
-    async sessionChecker(sid: string, expectedUserId: string): Promise<AuthSessionStatus> {
+    async sessionChecker(sid: string, expectedUserId: string): Promise<AuthSessionCheckResult> {
       const row = await fetchOne<{
         userId: string;
+        tenantId: TenantId;
         revokedAt: unknown;
         expiresAt: { epochMilliseconds: number };
       }>(db, userSessionTable, { id: sid });
@@ -137,14 +139,43 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       // revocation is primary; never turn a user-row miss into a global
       // lockout. (+1 PK read on read_users per authenticated request.)
       //
-      // Fail-open covers a THROW too, not just a null-miss: this read sits on
-      // the hot path of every authenticated request, so a DB timeout / lock
-      // contention / pool exhaustion here must not turn into a global lockout.
-      const user = await fetchOne<{ status: UserStatus }>(db, userTable, {
-        id: expectedUserId,
-      }).catch(() => null);
-      if (user && isPrincipalBlocked(user.status)) return "blocked";
-      return "live";
+      // Fail-open covers a THROW *and* a null-miss, not just a throw: this
+      // read sits on the hot path of every authenticated request, and a
+      // missing row here means we have no DB-confirmed roles to derive from
+      // (e.g. a bootstrap/system actor with no persisted user row) — that is
+      // a different situation from tenantMembershipsTable below, where a
+      // missing row is a legitimate "no tenant roles" outcome. Both branches
+      // return the bare "live" string (no re-derived roles) — the middleware
+      // falls back to the JWT's frozen roles claim.
+      let user: { status: UserStatus; roles: string | null } | undefined;
+      try {
+        user = await fetchOne<{ status: UserStatus; roles: string | null }>(db, userTable, {
+          id: expectedUserId,
+        });
+      } catch {
+        return "live";
+      }
+      if (!user) return "live";
+      if (isPrincipalBlocked(user.status)) return "blocked";
+
+      // Same fail-open reasoning as the userTable lookup above — a transient
+      // DB error on the membership read must not lock the user out. A
+      // missing row (not a throw) is a valid outcome: the user genuinely has
+      // no tenant-scoped roles for row.tenantId, so membershipRoles is [].
+      let membershipRoles: readonly string[];
+      try {
+        const membership = await fetchOne<{ roles: string | null }>(db, tenantMembershipsTable, {
+          userId: expectedUserId,
+          tenantId: row.tenantId,
+        });
+        membershipRoles = membership ? parseRoles(membership.roles) : [];
+      } catch {
+        return "live";
+      }
+
+      const globalRoles = parseRoles(user.roles);
+      const roles = buildSessionRoles(globalRoles, membershipRoles);
+      return { status: "live", roles } as const;
     },
 
     async sessionMassRevoker(userId: string): Promise<number> {

package/src/sessions/session-checker-fail-open.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, spyOn, test } from "bun:test";
 import * as bunDb from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "temporal-polyfill";
+import { tenantMembershipsTable } from "../tenant/membership-table";
 import { USER_STATUS, userTable } from "../user/schema/user";
 import { userSessionTable } from "./schema/user-session";
 import { createSessionCallbacks } from "./session-callbacks";
@@ -74,4 +75,77 @@ describe("sessionChecker fail-open on user-lookup throw", () => {
       spy.mockRestore();
     }
   });
+
+  test("membership lookup THROW → live (not 500)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid3";
+    const userId = "00000000-0000-4000-8000-00000000usr3";
+    const tenantId = "00000000-0000-4000-8000-000000tenant";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          tenantId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Active, roles: null };
+      }
+      if (table === tenantMembershipsTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});
+
+describe("sessionChecker role re-derivation", () => {
+  test("live session composes global + tenant-membership roles fresh from the DB", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid4";
+    const userId = "00000000-0000-4000-8000-00000000usr4";
+    const tenantId = "00000000-0000-4000-8000-000000tenan2";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          tenantId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Active, roles: JSON.stringify(["Support"]) };
+      }
+      if (table === tenantMembershipsTable) {
+        return { roles: JSON.stringify(["User"]) };
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      const result = await cbs.sessionChecker(sid, userId);
+      if (typeof result === "string") {
+        throw new Error(`expected object result, got bare string "${result}"`);
+      }
+      expect(result.status).toBe("live");
+      expect([...result.roles].sort()).toEqual(["Support", "User"]);
+    } finally {
+      spy.mockRestore();
+    }
+  });
 });

package/src/step-dispatcher/webhook-runner.ts

@@ -39,6 +39,20 @@ export function setWebhookFetch(fn: typeof fetch): void {
 }
 
 export async function performWebhookDispatch(spec: WebhookSpec): Promise<WebhookDispatchResult> {
+  // SSRF guard at the primitive boundary: only http(s), and never follow
+  // redirects — a 3xx could point at an internal/metadata target and the
+  // spec carries secrets (auth) that would be forwarded there. A webhook
+  // destination that redirects now surfaces as a delivery error instead.
+  let url: URL;
+  try {
+    url = new URL(spec.url);
+  } catch {
+    return { ok: false, error: `invalid url "${spec.url}"` };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { ok: false, error: `unsupported url scheme "${url.protocol}"` };
+  }
+
   const headers: Record<string, string> = { "content-type": "application/json", ...spec.headers };
   if (spec.auth) {
     const secret = secretResolver(spec.auth.secretRef);
@@ -55,6 +69,7 @@ export async function performWebhookDispatch(spec: WebhookSpec): Promise<Webhook
     const res = await fetchImpl(spec.url, {
       method: spec.method,
       headers,
+      redirect: "manual",
       body: spec.body !== undefined ? JSON.stringify(spec.body) : undefined,
     });
     if (!res.ok) {

package/src/tenant/handlers/remove-member.write.ts

@@ -45,24 +45,25 @@ export const removeMemberWrite = defineWriteHandler({
       );
     }
 
+    // Revoke THIS tenant's sessions BEFORE the delete — a removed member must
+    // not keep a valid session for the window between the delete and a
+    // post-delete revoke. Best-effort cross-feature call: sessions may not be
+    // mounted (registry lookup, see above). If the delete then fails, the
+    // member is logged out but the membership is intact — safe direction.
+    const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+    if (revoker) {
+      await ctx.writeAs(createSystemUser(event.payload.tenantId), REVOKE_ALL_SESSIONS_QN, {
+        userId: event.payload.userId,
+        tenantId: event.payload.tenantId,
+      });
+    }
+
     const result = await executor.delete(
       { id: (existing as DbRow)["id"] as string }, // @cast-boundary db-row
       event.user,
       db,
     );
 
-    // Revoke only this tenant's sessions — a multi-tenant user stays logged
-    // in to tenants they're still a member of. Best-effort cross-feature
-    // call: sessions may not be mounted (registry lookup, see above).
-    if (result.isSuccess) {
-      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
-      if (revoker) {
-        await ctx.writeAs(createSystemUser(event.payload.tenantId), REVOKE_ALL_SESSIONS_QN, {
-          userId: event.payload.userId,
-          tenantId: event.payload.tenantId,
-        });
-      }
-    }
     return withResponseData(result, event.payload);
   },
 });

package/src/tenant/handlers/update-member-roles.write.ts

@@ -62,6 +62,19 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // silent overwrite. Per-membership parallelism is rare; if it happens,
     // the client retries on the error.
     const row = existing as DbRow; // @cast-boundary generic-record
+    // A role change can be security-relevant (e.g. demoting an Admin) — the
+    // user must re-authenticate with the new roles, everywhere. Revoke BEFORE
+    // the update closes the window where the demoted user keeps a valid
+    // session until the revoke write lands. Best-effort cross-feature call:
+    // sessions may not be mounted (registry lookup instead of a hard
+    // requires, see above).
+    const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
+    if (revoker) {
+      await ctx.writeAs(createSystemUser(event.user.tenantId), REVOKE_ALL_SESSIONS_QN, {
+        userId: event.payload.userId,
+      });
+    }
+
     const result = await executor.update(
       {
         id: row["id"] as string, // @cast-boundary db-row
@@ -72,18 +85,6 @@ export const updateMemberRolesWrite = defineWriteHandler({
       db,
     );
 
-    // A role change can be security-relevant (e.g. demoting an Admin) — the
-    // user must re-authenticate with the new roles, everywhere, not just in
-    // this tenant. Best-effort cross-feature call: sessions may not be
-    // mounted (registry lookup instead of a hard requires, see above).
-    if (result.isSuccess) {
-      const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
-      if (revoker) {
-        await ctx.writeAs(createSystemUser(event.user.tenantId), REVOKE_ALL_SESSIONS_QN, {
-          userId: event.payload.userId,
-        });
-      }
-    }
     return withResponseData(result, event.payload);
   },
 });

package/src/user-data-rights/index.ts

@@ -2,7 +2,7 @@ export { createUserDataRightsFeature, type UserDataRightsOptions } from "./featu
 export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write";
 // #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
 // von read_users-Rebuilds (siehe lib-Doc).
-export { backfillUserLifecycleEvents } from "./lib/update-user-lifecycle";
+export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle";
 export type {
   SendExportFailedEmailFn,
   SendExportReadyEmailFn,