@cosmicdrift/kumiko-bundled-features 0.215.7 → 0.216.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.7",
+  "version": "0.216.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.7",
-    "@cosmicdrift/kumiko-framework": "0.215.7",
-    "@cosmicdrift/kumiko-headless": "0.215.7",
-    "@cosmicdrift/kumiko-renderer": "0.215.7",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.7",
-    "@cosmicdrift/kumiko-types": "0.215.7",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.216.0",
+    "@cosmicdrift/kumiko-framework": "0.216.0",
+    "@cosmicdrift/kumiko-headless": "0.216.0",
+    "@cosmicdrift/kumiko-renderer": "0.216.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.216.0",
+    "@cosmicdrift/kumiko-types": "0.216.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,7 +160,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.7",
-    "@cosmicdrift/kumiko-locale-es": "0.215.7"
+    "@cosmicdrift/kumiko-locale-de": "0.216.0",
+    "@cosmicdrift/kumiko-locale-es": "0.216.0"
   }
 }

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -24,7 +24,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { randomBytes } from "node:crypto";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -54,7 +54,7 @@ import { createTenantFeature } from "../tenant";
 import { TenantHandlers } from "../tenant/constants";
 import { tenantMembershipsTable } from "../tenant/membership-table";
 import { tenantEntity } from "../tenant/schema/tenant";
-import { UserHandlers } from "../user";
+import { UserHandlers, UserQueries } from "../user";
 import { createUserFeature } from "../user/feature";
 import { userEntity, userTable } from "../user/schema/user";
 
@@ -276,4 +276,37 @@ describe("access-invalidation event consumer", () => {
 
     expect(invalidated).toEqual([userId]);
   });
+
+  test("user:update (global role change) revokes sessions and pushes an invalidation", async () => {
+    const { userId } = await h.seedUser("globalrolechange@example.com", "pw-long-enough");
+    const { sid } = await h.login("globalrolechange@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const detail = await stack.http.queryOk<Record<string, unknown>>(
+      UserQueries.detail,
+      { id: userId },
+      admin,
+    );
+
+    const result = await stack.http.writeOk(
+      UserHandlers.update,
+      {
+        id: userId,
+        version: detail["version"],
+        changes: { roles: JSON.stringify(["SystemAdmin"]) },
+      },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+
+    const sessionRow = await fetchOne<{ revokedAt: unknown }>(stack.db, userSessionTable, {
+      id: sid,
+    });
+    expect(sessionRow?.revokedAt).not.toBeNull();
+  });
 });

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -660,10 +660,9 @@ describe("invitations-query (pending list)", () => {
 // merges flat into the session and unlocks the SystemAdmin-gated cross-tenant
 // handler surface (hasAccess can't tell membership roles from global ones).
 describe("privilege escalation via invite role", () => {
-  // Each forbidden value is a platform-global/reserved role that must never
-  // reach a tenant membership. Proven exploitable before the fix: inviting
-  // "SystemAdmin" gave the invitee a JWT carrying SystemAdmin flat, which
-  // passed every SystemAdmin gate cross-tenant.
+  // Reserved / global roles: must NEVER reach a tenant invitation. hasAccess
+  // is flat, so a tenant-member invite for SystemAdmin would escalate on
+  // login/switch without any cross-tenant check.
   const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"];
 
   test("invite-create rejects reserved/global roles — no invitation persisted, no mail", async () => {
@@ -673,49 +672,100 @@ describe("privilege escalation via invite role", () => {
         { email: CAROL_EMAIL, role },
         aliceSession(),
       );
-      expect(err.code).toBe("access_denied");
+      expect(err.details).toMatchObject({ reason: "reserved_membership_role", role });
       const rows = await selectMany(stack.db, tenantInvitationsTable, { email: CAROL_EMAIL });
       expect(rows).toHaveLength(0);
+      expect(emailTransport.sent).toHaveLength(0);
     }
-    // The forbidden-role check fires before the mail dispatch.
-    expect(emailTransport.sent).toHaveLength(0);
   });
 
   test("legitimate tenant role still issues an invitation", async () => {
     const result = (await stack.http.writeOk(
       AuthHandlers.inviteCreate,
-      { email: CAROL_EMAIL, role: "Editor" },
+      { email: CAROL_EMAIL, role: "Admin" },
       aliceSession(),
     )) as { role: string };
-    expect(result.role).toBe("Editor");
+    expect(result.role).toBe("Admin");
   });
 
-  // Regression guard for the opt-in canAssignRole hook (#security): this
-  // stack's invite feature was mounted WITHOUT canAssignRole, so any
-  // non-reserved app-defined role must still go through unchanged — the
-  // hierarchy gate below is a separate, opt-in stack, not a default.
-  test("without canAssignRole configured, any non-reserved app-defined role is still assignable", async () => {
-    const result = (await stack.http.writeOk(
+  test("TenantAdmin can invite TenantAdmin, Admin, Editor, and User", async () => {
+    const tenantAdminSession: SessionUser = {
+      id: aliceId,
+      tenantId: TENANT_A_ID,
+      roles: ["TenantAdmin"],
+    };
+    for (const role of ["TenantAdmin", "Admin", "Editor", "User"]) {
+      const email = `target-${role.toLowerCase()}@example.com`;
+      const result = (await stack.http.writeOk(
+        AuthHandlers.inviteCreate,
+        { email, role },
+        tenantAdminSession,
+      )) as { role: string };
+      expect(result.role).toBe(role);
+    }
+  });
+
+  test("Admin cannot invite TenantAdmin (elevation guard default)", async () => {
+    const err = await stack.http.writeErr(
       AuthHandlers.inviteCreate,
-      { email: "dpo-candidate@example.com", role: "DPO" },
+      { email: "elevate-target@example.com", role: "TenantAdmin" },
+      aliceSession(), // roles: ["Admin"]
+    );
+    expect(err.details).toMatchObject({
+      reason: "unassignable_membership_role",
+      role: "TenantAdmin",
+    });
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "elevate-target@example.com",
+    });
+    expect(rows).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+
+  test("TenantAdmin cannot invite SystemAdmin (rejected by reserved role guard)", async () => {
+    const tenantAdminSession: SessionUser = {
+      id: aliceId,
+      tenantId: TENANT_A_ID,
+      roles: ["TenantAdmin"],
+    };
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "sysadmin-target@example.com", role: "SystemAdmin" },
+      tenantAdminSession,
+    );
+    expect(err.details).toMatchObject({
+      reason: "reserved_membership_role",
+      role: "SystemAdmin",
+    });
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "sysadmin-target@example.com",
+    });
+    expect(rows).toHaveLength(0);
+  });
+
+  test("rejects unknown/unranked roles fail-closed", async () => {
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "unknown-role@example.com", role: "CustomRole" },
       aliceSession(),
-    )) as { role: string };
-    expect(result.role).toBe("DPO");
+    );
+    expect(err.details).toMatchObject({
+      reason: "unassignable_membership_role",
+      role: "CustomRole",
+    });
   });
 });
 
-// canAssignRole is a role-hierarchy gate that must live in the app (roles are
-// app-defined strings, not a framework concept) — a separate stack mounts the
-// invite feature WITH the hook to prove it's actually enforced, distinct from
-// the framework-reserved-role check covered above.
+// canAssignRole further restricts ranked roles after the default elevation
+// guard — a separate stack mounts the invite feature WITH the hook.
 describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   let gateStack: TestStack;
   let gateAliceId: string;
   let gateTenantId: TenantId;
   const gateTransport = createInMemoryTransport();
 
-  function gateAliceSession(): SessionUser {
-    return { id: gateAliceId, tenantId: gateTenantId, roles: ["Admin"] };
+  function gateAliceSession(roles: readonly string[] = ["TenantAdmin"]): SessionUser {
+    return { id: gateAliceId, tenantId: gateTenantId, roles: [...roles] };
   }
 
   beforeAll(async () => {
@@ -737,11 +787,9 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
           invite: {
             tokenTtlMinutes: 60,
             appUrl: APP_ACCEPT_URL,
-            // Only "Admin" may grant "DPO" — everything else may only grant
-            // non-DPO roles. A minimal, deliberately app-shaped hierarchy;
-            // the framework itself knows nothing about "DPO".
+            // Custom app policy: only TenantAdmin with special flag may grant "Admin"
             canAssignRole: (inviterRoles, targetRole) =>
-              targetRole !== "DPO" || inviterRoles.includes("Admin"),
+              targetRole !== "Admin" || inviterRoles.includes("SpecialAdmin"),
           },
         }),
       ],
@@ -784,7 +832,7 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
     await seedTenantMembership(gateStack.db, {
       userId: gateAliceId,
       tenantId: gateTenantId,
-      roles: ["Admin"],
+      roles: ["TenantAdmin"],
     });
   });
 
@@ -793,14 +841,14 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   });
 
   test("canAssignRole → false blocks invite-create with a role-hierarchy error, no invitation persisted", async () => {
-    // TenantAdmin clears the handler's own access.admin gate but canAssignRole
-    // above only lets literal "Admin" grant "DPO" — the case this hook exists for.
+    // TenantAdmin clears the handler's own access.admin gate and default elevation
+    // guard for "Admin", but canAssignRole blocks "Admin" because Alice lacks "SpecialAdmin".
     const err = await gateStack.http.writeErr(
       AuthHandlers.inviteCreate,
-      { email: "blocked-target@example.com", role: "DPO" },
-      { id: gateAliceId, tenantId: gateTenantId, roles: ["TenantAdmin"] },
+      { email: "blocked-target@example.com", role: "Admin" },
+      gateAliceSession(),
     );
-    expect(err.details).toMatchObject({ reason: "unassignable_membership_role", role: "DPO" });
+    expect(err.details).toMatchObject({ reason: "unassignable_membership_role", role: "Admin" });
     const rows = await selectMany(gateStack.db, tenantInvitationsTable, {
       email: "blocked-target@example.com",
     });
@@ -809,11 +857,12 @@ describe("invite-create role-hierarchy gate (opt-in canAssignRole)", () => {
   });
 
   test("canAssignRole → true allows invite-create through", async () => {
+    // Elevation alone would allow TenantAdmin → Admin; hook requires SpecialAdmin.
     const result = (await gateStack.http.writeOk(
       AuthHandlers.inviteCreate,
-      { email: "allowed-target@example.com", role: "DPO" },
-      gateAliceSession(),
+      { email: "allowed-target@example.com", role: "Admin" },
+      gateAliceSession(["TenantAdmin", "SpecialAdmin"]),
     )) as { role: string };
-    expect(result.role).toBe("DPO");
+    expect(result.role).toBe("Admin");
   });
 });

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -33,6 +33,7 @@ import {
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import {
   findForbiddenMembershipRole,
+  findForbiddenRoleAssignment,
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles";
@@ -71,9 +72,10 @@ export type InviteCreateOptions = {
    *  carries no locale signal (no X-Locale header, no usable
    *  Accept-Language) — see the locale resolution in the handler below. */
   readonly locale?: AuthMailLocale;
-  // Opt-in role-hierarchy gate. Roles are app-defined strings, not a framework
-  // concept, so the hierarchy itself must live in the app — this hook lets it
-  // plug in without the framework hardcoding any role names.
+  // Optional app policy on top of the default elevation guard
+  // (findForbiddenRoleAssignment). Cannot authorize reserved or unranked
+  // roles, and cannot raise above the inviter's max framework rank — only
+  // further restrict assignable ranked roles.
   readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
 };
 
@@ -101,6 +103,13 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
         return writeFailure(reservedMembershipRoleError(forbiddenRole));
       }
 
+      const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [
+        event.payload.role,
+      ]);
+      if (elevationForbidden !== undefined) {
+        return writeFailure(unassignableMembershipRoleError(elevationForbidden));
+      }
+
       if (opts.canAssignRole && !opts.canAssignRole(event.user.roles, event.payload.role)) {
         return writeFailure(unassignableMembershipRoleError(event.payload.role));
       }

package/src/shared/map-with-concurrency.test.ts

@@ -68,7 +68,7 @@ describe("mapWithConcurrency", () => {
       // for a real unhandled rejection (if any) to fire.
       await new Promise((resolve) => setTimeout(resolve, 50));
     } finally {
-      process.off("unhandledRejection", onUnhandledRejection);
+      process.off("unhandledRejection" as never, onUnhandledRejection);
     }
     expect(unhandled).toEqual([]);
   });

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -4,7 +4,9 @@ import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
 import {
+  DEFAULT_INVITE_ROLE_OPTIONS,
   INVITE_CREATE_SCREEN_ID,
+  MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBERS_SCREEN_ID,
   TenantHandlers,
   TenantQueries,
@@ -64,6 +66,37 @@ describe("tenant members screen + handler access alignment", () => {
     expect(rowAction.visible).toEqual({ field: "status", eq: "pending" });
   });
 
+  test("edit-roles row action is only visible on active rows and navigates to member-roles-edit", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    if (screen?.type !== "projectionList")
+      throw new Error("expected members screen to be projectionList");
+    const rowAction = screen.rowActions?.find((a) => a.id === "edit-roles");
+    if (rowAction?.kind !== "navigate") throw new Error("expected a navigate row action");
+    expect(rowAction.screen).toBe(MEMBER_ROLES_EDIT_SCREEN_ID);
+    expect(rowAction.params).toEqual({ map: { userId: "userId" } });
+    expect(rowAction.visible).toEqual({ field: "status", eq: "active" });
+  });
+
+  test("member-roles-edit actionForm screen is registered and bound to updateMemberRoles, access.admin-gated", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBER_ROLES_EDIT_SCREEN_ID];
+    if (screen?.type !== "actionForm")
+      throw new Error("expected member-roles-edit screen to be actionForm");
+    expect(screen.handler).toBe(TenantHandlers.updateMemberRoles);
+    expect(screen.fields["userId"]).toEqual({ type: "text", required: true });
+    expect(screen.fields["roles"]).toEqual({
+      type: "multiSelect",
+      options: DEFAULT_INVITE_ROLE_OPTIONS,
+      required: true,
+    });
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(rolesOf(screen.access)).toEqual([...access.admin]);
+    } else {
+      throw new Error("expected member-roles-edit screen to have access.roles");
+    }
+  });
+
   // The generic drawer-open/submit/close/refetch mechanics for kind:"drawer"
   // toolbar actions are already covered end-to-end with a synthetic screen in
   // renderer-web's projection-list-actions.test.tsx — this only proves OUR
@@ -103,6 +136,10 @@ describe("tenant members screen + handler access alignment", () => {
     expect(rolesOf(tenant.queryHandlers["invitations"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.queryHandlers["team:list"]?.access)).toEqual(adminRoles);
     expect(rolesOf(tenant.writeHandlers["cancel-invitation"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([
+      "system",
+      ...adminRoles,
+    ]);
     // invite-create lives on auth feature — checked in tenant-security.integration.test.ts
     void AuthHandlers;
     void TenantHandlers;
@@ -114,11 +151,11 @@ describe("tenant members screen + handler access alignment", () => {
     expect(nav?.label).toBe("tenant.nav.members");
   });
 
-  test("updateMemberRoles stays SystemAdmin/system-only (not on members screen)", () => {
+  test("updateMemberRoles allows system and access.admin", () => {
     const tenant = createTenantFeature();
     expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([
       "system",
-      "SystemAdmin",
+      ...access.admin,
     ]);
   });
 });

package/src/tenant/__tests__/seed-testing.integration.test.ts

@@ -13,13 +13,12 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { SYSTEM_USER_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
-  TestUsers,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
@@ -200,9 +199,9 @@ describe("seedTenantMembership", () => {
   });
 
   test("records the `by` user as insertedById on the projection", async () => {
-    // Audit-queries that join events → users need a stable actor. Default
-    // `by` is TestUsers.systemAdmin; override to a custom test user and
-    // assert it propagates to the projection's inserted_by_id column.
+    // Audit-queries that join events → users need a stable actor. Override
+    // default createSystemUser(tenantId) with a custom test user and assert
+    // it propagates to the projection's inserted_by_id column.
     const seedActor = createTestUser({ id: 99, tenantId: TENANT_A });
     await seedTenantMembership(stack.db, {
       userId: ALICE_ID,
@@ -215,15 +214,18 @@ describe("seedTenantMembership", () => {
     expect(row?.["insertedById"]).toBe(seedActor.id);
   });
 
-  test("default `by` is TestUsers.systemAdmin", async () => {
-    // Documents the fallback — a regression that changed the default would
-    // silently skew audit queries across 18 call-sites.
+  test("default `by` is createSystemUser(tenantId)", async () => {
     await seedTenantMembership(stack.db, {
       userId: ALICE_ID,
       tenantId: TENANT_A,
       roles: ["User"],
     });
     const [row] = await selectMany(stack.db, tenantMembershipsTable, { userId: ALICE_ID });
-    expect(row?.["insertedById"]).toBe(TestUsers.systemAdmin.id);
+    expect(row?.["insertedById"]).toBe(SYSTEM_USER_ID);
+
+    const events = await selectMany(stack.db, eventsTable, { aggregateType: "tenant-membership" });
+    const created = events.filter((e) => e.type === "tenant-membership.created");
+    expect(created).toHaveLength(1);
+    expect(created[0]?.tenantId).toBe(TENANT_A);
   });
 });