@cosmicdrift/kumiko-bundled-features 0.215.7 → 0.217.0

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -5,9 +5,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
   type TestStack,
+  TestUsers,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
@@ -15,6 +17,7 @@ import { expectErrorIncludes, rolesOf, seedRow } from "@cosmicdrift/kumiko-frame
 import { Temporal } from "temporal-polyfill";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -23,13 +26,18 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
-import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionsFeature, userSessionEntity, userSessionTable } from "../../sessions";
 import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { seedUser } from "../../user/seeding";
-import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import {
+  MEMBER_ROLES_EDIT_SCREEN_ID,
+  MEMBERS_SCREEN_ID,
+  TenantHandlers,
+  TenantQueries,
+} from "../constants";
 import { createTenantFeature } from "../feature";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../invitation-table";
 import { tenantMembershipsTable } from "../membership-table";
@@ -66,6 +74,10 @@ beforeAll(async () => {
       // inviteScreen: this suite dispatches AuthHandlers.inviteCreate and
       // needs /members' invite-create actionForm screen registered too.
       createTenantFeature({ inviteScreen: true }),
+      // Sessions required so updateMemberRoles can revoke target JWTs via
+      // sessions:write:user-session:revoke-all-for-user (best-effort lookup).
+      authFoundationFeature,
+      createSessionsFeature(),
       createTemplateResolverFeature(),
       createRendererFoundationFeature(),
       createDeliveryFeature(),
@@ -103,6 +115,7 @@ beforeAll(async () => {
     tenantMembershipsTable,
     notificationPreferencesTable,
   });
+  await createEventsTable(stack.db);
 });
 
 afterAll(async () => {
@@ -115,6 +128,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${eventsTable.tableName}"`);
   emailTransport.sent.length = 0;
   const keys = await stack.redis.redis.keys("invite:*");
   if (keys.length > 0) await stack.redis.redis.del(...keys);
@@ -249,6 +263,15 @@ describe("regular User is denied members-admin surface", () => {
             regularUserB(),
           ),
       ],
+      [
+        "update-member-roles",
+        () =>
+          stack.http.write(
+            TenantHandlers.updateMemberRoles,
+            { userId: regularUserBId, tenantId: TENANT_B_ID, roles: ["Admin"] },
+            regularUserB(),
+          ),
+      ],
     ] as const) {
       const res = await fn();
       expect(res.status, label).toBe(403);
@@ -277,6 +300,35 @@ describe("privilege escalation via invite role", () => {
     expect(rows).toHaveLength(0);
     expect(emailTransport.sent).toHaveLength(0);
   });
+
+  test("Admin cannot invite as TenantAdmin (elevation guard)", async () => {
+    const { id: adminUserId } = await seedUser(stack.db, {
+      email: "admin-inviter@example.com",
+      displayName: "Admin Inviter",
+    });
+    await seedTenantMembership(stack.db, {
+      userId: adminUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["Admin"],
+    });
+    const adminUser: SessionUser = { id: adminUserId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "elevated-invitee@example.com", role: "TenantAdmin" },
+      adminUser,
+    );
+    expectErrorIncludes(err, "unassignable_membership_role");
+  });
+
+  test("TenantAdmin cannot invite with unknown unranked role (elevation guard)", async () => {
+    const err = await stack.http.writeErr(
+      AuthHandlers.inviteCreate,
+      { email: "unknown-role@example.com", role: "SuperCustomRole" },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "unassignable_membership_role");
+  });
 });
 
 describe("tenant isolation on cancel-invitation", () => {
@@ -555,13 +607,389 @@ describe("cancel-invitation on the /members surface genuinely cancels", () => {
   });
 });
 
-describe("updateMemberRoles not reachable by TenantAdmin", () => {
-  test("TenantAdmin gets access_denied on updateMemberRoles", async () => {
+describe("updateMemberRoles — TenantAdmin session-scoped path and safety gates", () => {
+  test("TenantAdmin can update roles of a member in own tenant", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "updatable-member@example.com",
+      displayName: "Updatable Member",
+      passwordHash: await hashPassword("pw-update-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(rows).toHaveLength(1);
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
+  });
+
+  test("TenantAdmin cannot update membership of a user in another tenant", async () => {
+    const { id: otherTenantMemberId } = await seedUser(stack.db, {
+      email: "other-tenant-member@example.com",
+      displayName: "Other Tenant Member",
+      passwordHash: await hashPassword("pw-other-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: otherTenantMemberId,
+      tenantId: TENANT_B_ID,
+      roles: ["User"],
+    });
+
     const err = await stack.http.writeErr(
       TenantHandlers.updateMemberRoles,
-      { userId: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["User"] },
+      { userId: otherTenantMemberId, tenantId: TENANT_B_ID, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "membership_not_found");
+  });
+
+  test("TenantAdmin cannot assign reserved/global roles", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "reserved-role-target@example.com",
+      displayName: "Reserved Role Target",
+      passwordHash: await hashPassword("pw-res-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        TenantHandlers.updateMemberRoles,
+        { userId: memberUserId, tenantId: TENANT_A_ID, roles: [role] },
+        tenantAdminA(),
+      );
+      expectErrorIncludes(err, "access_denied");
+      expectErrorIncludes(err, "reserved_membership_role");
+    }
+  });
+
+  test("TenantAdmin can demote a member that currently holds an app-defined role", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "editor-demote-target@example.com",
+      displayName: "Editor Demote Target",
+      passwordHash: await hashPassword("pw-ed-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["Editor"],
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["User"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: memberUserId, roles: ["User"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["User"]);
+  });
+
+  test("TenantAdmin cannot assign unknown role (elevation guard)", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "elevation-guard-target@example.com",
+      displayName: "Elevation Guard Target",
+      passwordHash: await hashPassword("pw-elev-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    const err = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["SuperCustomRole"] },
       tenantAdminA(),
     );
     expectErrorIncludes(err, "access_denied");
+    expectErrorIncludes(err, "unassignable_membership_role");
+  });
+
+  test("Admin cannot elevate target to TenantAdmin or modify a TenantAdmin", async () => {
+    const { id: adminUserId } = await seedUser(stack.db, {
+      email: "plain-admin@example.com",
+      displayName: "Plain Admin",
+      passwordHash: await hashPassword("pw-adm-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: adminUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["Admin"],
+    });
+    const adminUser: SessionUser = { id: adminUserId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+
+    const { id: regularMemberId } = await seedUser(stack.db, {
+      email: "plain-member@example.com",
+      displayName: "Plain Member",
+      passwordHash: await hashPassword("pw-mem-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: regularMemberId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    // 1. Admin tries to assign TenantAdmin to regular member -> rejected
+    const errElevate = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: regularMemberId, tenantId: TENANT_A_ID, roles: ["TenantAdmin"] },
+      adminUser,
+    );
+    expectErrorIncludes(errElevate, "unassignable_membership_role");
+
+    // 2. Admin tries to modify existing TenantAdmin -> rejected
+    const errModifyHigher = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["Admin"] },
+      adminUser,
+    );
+    expectErrorIncludes(errModifyHigher, "unassignable_membership_role");
+  });
+
+  test("refuses demoting/removing the last TenantAdmin", async () => {
+    // tenantAdminA is currently the only TenantAdmin in TENANT_A_ID
+    const err = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["User"] },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "last_tenant_admin");
+    expectErrorIncludes(err, "cannot demote the last tenant admin");
+
+    // Verify role remains unchanged
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: tenantAdminAId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["TenantAdmin"]);
+  });
+
+  test("allows demoting a TenantAdmin when another TenantAdmin exists", async () => {
+    const { id: secondAdminId } = await seedUser(stack.db, {
+      email: "second-admin@example.com",
+      displayName: "Second Admin",
+      passwordHash: await hashPassword("pw-adm2-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: secondAdminId,
+      tenantId: TENANT_A_ID,
+      roles: ["TenantAdmin"],
+    });
+
+    // Now there are 2 TenantAdmins (tenantAdminA and secondAdminId)
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: secondAdminId, tenantId: TENANT_A_ID, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: secondAdminId, roles: ["Admin"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: secondAdminId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
+  });
+
+  test("SystemAdmin can update member roles across tenants", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "sysadmin-cross-target@example.com",
+      displayName: "SysAdmin Target",
+      passwordHash: await hashPassword("pw-sys-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_B_ID,
+      roles: ["User"],
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_B_ID, roles: ["Admin"] },
+      TestUsers.systemAdmin,
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_B_ID, roles: ["Admin"] });
+
+    const rows = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: memberUserId,
+      tenantId: TENANT_B_ID,
+    });
+    expect(JSON.parse(rows[0]?.["roles"] as string)).toEqual(["Admin"]);
+  });
+
+  test("updateMemberRoles appends audit event and invalidates active sessions for target user", async () => {
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "session-target@example.com",
+      displayName: "Session Target",
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    const sessionTarget1Id = crypto.randomUUID();
+    const sessionTarget2Id = crypto.randomUUID();
+    const sessionAdminId = crypto.randomUUID();
+    await seedRow(stack.db, userSessionTable, {
+      id: sessionTarget1Id,
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      createdAt: Temporal.Now.instant().subtract({ minutes: 30 }),
+      expiresAt: Temporal.Now.instant().add({ hours: 2 }),
+    });
+    await seedRow(stack.db, userSessionTable, {
+      id: sessionTarget2Id,
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      createdAt: Temporal.Now.instant().subtract({ minutes: 10 }),
+      expiresAt: Temporal.Now.instant().add({ hours: 2 }),
+    });
+    await seedRow(stack.db, userSessionTable, {
+      id: sessionAdminId,
+      userId: tenantAdminAId,
+      tenantId: TENANT_A_ID,
+      createdAt: Temporal.Now.instant().subtract({ minutes: 5 }),
+      expiresAt: Temporal.Now.instant().add({ hours: 2 }),
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
+
+    const [s1] = await selectMany(stack.db, userSessionTable, { id: sessionTarget1Id });
+    const [s2] = await selectMany(stack.db, userSessionTable, { id: sessionTarget2Id });
+    expect(s1?.revokedAt).not.toBeNull();
+    expect(s2?.revokedAt).not.toBeNull();
+
+    const [sAdmin] = await selectMany(stack.db, userSessionTable, { id: sessionAdminId });
+    expect(sAdmin?.revokedAt).toBeNull();
+
+    // Event-store actor is createSystemUser (handler rewrites via system
+    // stream), so filter by type + tenant — not the HTTP caller's user id.
+    const membershipEvents = await selectMany(stack.db, eventsTable, {
+      aggregateType: "tenant-membership",
+    });
+    const updateEvent = membershipEvents.find(
+      (e) => e.type === "tenant-membership.updated" && e.tenantId === TENANT_A_ID,
+    );
+    expect(updateEvent).toBeDefined();
+    expect(updateEvent?.payload).toMatchObject({
+      changes: { roles: JSON.stringify(["Admin"]) },
+    });
+  });
+});
+
+describe("invite + accept end-to-end integration against real stack", () => {
+  test("TenantAdmin invites user with Admin role, recipient accepts via invite-signup-complete and gains Admin membership", async () => {
+    const inviteeEmail = "invitee-e2e@example.com";
+    const inviteRes = (await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: inviteeEmail, role: "Admin" },
+      tenantAdminA(),
+    )) as { invitationId: string; email: string };
+
+    expect(inviteRes.email).toBe(inviteeEmail);
+
+    const sentMail = emailTransport.sent.find((m) => m.to.includes(inviteeEmail));
+    expect(sentMail).toBeDefined();
+    const tokenMatch = sentMail?.html?.match(/token=([a-zA-Z0-9_-]+)/);
+    expect(tokenMatch?.[1]).toBeDefined();
+    const token = tokenMatch![1];
+
+    const acceptRes = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      email: inviteeEmail,
+      name: "Invited Admin",
+      password: "StrongValidPassword123!",
+    });
+    expect(acceptRes.status).toBe(200);
+    const acceptBody = (await acceptRes.json()) as { user?: { id?: string }; token?: string };
+    expect(acceptBody.user?.id).toBeDefined();
+    const newUserId = acceptBody.user!.id!;
+
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, {
+      userId: newUserId,
+      tenantId: TENANT_A_ID,
+    });
+    expect(memberships).toHaveLength(1);
+    expect(JSON.parse(memberships[0]?.roles as string)).toEqual(["Admin"]);
+
+    const teamRows = await queryTeamList({}, tenantAdminA());
+    const pendingInvite = teamRows.find((r) => r.email === inviteeEmail && r.status === "pending");
+    expect(pendingInvite).toBeUndefined();
+    const activeMember = teamRows.find((r) => r.email === inviteeEmail && r.status === "active");
+    expect(activeMember).toBeDefined();
+
+    const newAdminSession: SessionUser = { id: newUserId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+    const membersList = await stack.http.queryOk<readonly { userId: string }[]>(
+      TenantQueries.members,
+      {},
+      newAdminSession,
+    );
+    expect(membersList.some((m) => m.userId === newUserId)).toBe(true);
+  });
+});
+
+describe("members UI screens and actions integration against real stack", () => {
+  test("members screen and member-roles-edit actionForm execute through stack", async () => {
+    const membersScreen = stack.registry.getScreen(`tenant:screen:${MEMBERS_SCREEN_ID}`);
+    expect(membersScreen).toBeDefined();
+    expect(membersScreen?.type).toBe("projectionList");
+
+    const editRolesScreen = stack.registry.getScreen(
+      `tenant:screen:${MEMBER_ROLES_EDIT_SCREEN_ID}`,
+    );
+    expect(editRolesScreen).toBeDefined();
+    expect(editRolesScreen?.type).toBe("actionForm");
+
+    const { id: memberUserId } = await seedUser(stack.db, {
+      email: "ui-member@example.com",
+      displayName: "UI Member",
+    });
+    await seedTenantMembership(stack.db, {
+      userId: memberUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    const res = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] },
+      tenantAdminA(),
+    );
+    expect(res).toMatchObject({ userId: memberUserId, tenantId: TENANT_A_ID, roles: ["Admin"] });
   });
 });

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { access } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -360,10 +361,10 @@ describe("scenario 7: access rules on handlers", () => {
       "SystemAdmin",
     ]);
     // updateMemberRoles akzeptiert "system" (für seed-migrations + ops-tooling)
-    // PLUS "SystemAdmin" (echter Operator-Pfad). Symmetrisch zu create.
+    // PLUS access.admin ("TenantAdmin", "Admin", "SystemAdmin").
     expect(
       rolesOf(stack.registry.getWriteHandler(TenantHandlers.updateMemberRoles)?.access),
-    ).toEqual(["system", "SystemAdmin"]);
+    ).toEqual(["system", ...access.admin]);
     expect(rolesOf(stack.registry.getQueryHandler(TenantQueries.list)?.access)).toEqual([
       "SystemAdmin",
     ]);

package/src/tenant/constants.ts

@@ -11,6 +11,8 @@ export const MEMBERS_SCREEN_ID = "members" as const;
 
 export const INVITE_CREATE_SCREEN_ID = "invite-create" as const;
 
+export const MEMBER_ROLES_EDIT_SCREEN_ID = "member-roles-edit" as const;
+
 /** Client column-renderer for the /members screen's status column — see
  *  `screen.columns[].renderer.react.__component` in screens.ts and
  *  `tenantClient()`'s `columnRenderers` map. */
@@ -53,4 +55,5 @@ export const TenantQueries = {
 export const TenantErrors = {
   membershipNotFound: "membership_not_found",
   membershipAlreadyExists: "membership_already_exists",
+  lastTenantAdmin: "last_tenant_admin",
 } as const;

package/src/tenant/feature.ts

@@ -30,6 +30,7 @@ import { tenantEntity } from "./schema/tenant";
 import {
   createMembersScreen,
   inviteCreateScreen,
+  memberRolesEditScreen,
   tenantEditScreen,
   tenantListScreen,
 } from "./screens";
@@ -154,10 +155,10 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
     r.screen(tenantListScreen);
     r.screen(tenantEditScreen);
     // Tenant-admin team UI: one list (active members + pending invitations,
-    // §2.6), invite via a drawer-hosted actionForm. No role-edit —
-    // updateMemberRoles stays SystemAdmin-only. Screen access matches
-    // handler access.admin.
+    // §2.6), invite via a drawer-hosted actionForm, role-edit via
+    // actionForm. Screen access matches handler access.admin.
     r.screen(createMembersScreen(options));
+    r.screen(memberRolesEditScreen);
     if (options?.inviteScreen) {
       r.screen(inviteCreateScreen);
     }

package/src/tenant/handlers/team-list.query.ts

@@ -20,6 +20,7 @@ type TeamStatus = "active" | "pending";
 
 type TeamRow = {
   readonly id: string;
+  readonly userId: string | null;
   readonly email: string | null;
   readonly displayName: string | null;
   readonly roles: readonly string[];
@@ -165,6 +166,7 @@ export const teamListQuery = definePagedQueryHandler({
       const createdAt = row["createdAt"];
       return {
         id: String(row["id"]),
+        userId,
         email: decrypted?.email ?? null,
         displayName: decrypted?.displayName ?? null,
         roles: parseRoles(row["roles"]),
@@ -197,6 +199,7 @@ export const teamListQuery = definePagedQueryHandler({
         const expiresAt = row["expiresAt"];
         return {
           id: String(row["id"]),
+          userId: null,
           email: decryptedEmail,
           displayName: null,
           roles: typeof row["role"] === "string" ? [row["role"]] : [],