@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/user/__tests__/user.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
   setupTestStack,
@@ -8,6 +8,7 @@ import {
   TestUsers,
   testTenantId,
   unsafeCreateEntityTable,
+  unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   expectErrorIncludes,
@@ -15,6 +16,8 @@ import {
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { tenantEntity, tenantMembershipsTable } from "../../tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
 import { UserErrors, UserHandlers, UserQueries } from "../constants";
 import { createUserFeature } from "../feature";
 import { userEntity, userTable } from "../schema/user";
@@ -27,6 +30,10 @@ const userFeature = createUserFeature();
 beforeAll(async () => {
   stack = await setupTestStack({ features: [userFeature] });
   await unsafeCreateEntityTable(stack.db, userEntity);
+  // Not part of userFeature — list.query.ts cross-feature-joins these to
+  // derive the `tenants` column, so the tables must exist for that test.
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { tenantMembershipsTable });
 });
 
 afterAll(async () => {
@@ -322,6 +329,51 @@ describe("scenario 4: detail + list access", () => {
     expect(result.rows.length).toBeGreaterThanOrEqual(2);
   });
 
+  test("list enriches rows with a `tenants` label built from active memberships", async () => {
+    const tenantA = "10000000-0000-4000-8000-0000000000a1" as TenantId;
+    const tenantB = "10000000-0000-4000-8000-0000000000b1" as TenantId;
+    await seedTenant(stack.db, { id: tenantA, key: "tenants-col-a", name: "Tenant Alpha" });
+    await seedTenant(stack.db, { id: tenantB, key: "tenants-col-b", name: "Tenant Beta" });
+
+    const withMemberships = await seedUser({
+      email: "multi-tenant-user@example.com",
+      displayName: "Multi Tenant User",
+    });
+    const withoutMemberships = await seedUser({
+      email: "no-tenant-user@example.com",
+      displayName: "No Tenant User",
+    });
+
+    await seedTenantMembership(stack.db, {
+      userId: withMemberships.id,
+      tenantId: tenantA,
+      roles: ["TenantAdmin"],
+    });
+    await seedTenantMembership(stack.db, {
+      userId: withMemberships.id,
+      tenantId: tenantB,
+      roles: [],
+    });
+
+    const result = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      UserQueries.list,
+      {},
+      systemAdmin,
+    );
+
+    const enrichedRow = result.rows.find((r) => r["id"] === withMemberships.id);
+    const bareRow = result.rows.find((r) => r["id"] === withoutMemberships.id);
+    if (!enrichedRow || !bareRow) throw new Error("expected both seeded users in the list result");
+
+    // Membership order from the join isn't guaranteed — compare as a sorted
+    // set of labels instead of a fixed-order string.
+    const labels = String(enrichedRow["tenants"]).split(", ").sort();
+    expect(labels).toEqual(["Tenant Alpha (TenantAdmin)", "Tenant Beta"].sort());
+
+    // No memberships: empty string (renderer formats); not a hard-coded em-dash.
+    expect(bareRow["tenants"]).toBe("");
+  });
+
   test("normal user cannot list", async () => {
     const signedIn = createTestUser({ id: 2000, roles: ["User"] });
     const res = await stack.http.query(UserQueries.list, {}, signedIn);
@@ -404,36 +456,6 @@ describe("scenario 5: global roles mutation & elevation guard (#2388)", () => {
     expect(parseRoles(reloaded["roles"])).toEqual(["SystemAdmin"]);
   });
 
-  test("promoted user with SystemAdmin role can perform SystemAdmin-only queries", async () => {
-    const created = await seedUser({
-      email: "promoted-admin@example.com",
-      displayName: "PromotedAdmin",
-    });
-    const loaded = await stack.http.queryOk<Record<string, unknown>>(
-      UserQueries.detail,
-      { id: created.id },
-      systemAdmin,
-    );
-
-    await stack.http.writeOk(
-      UserHandlers.update,
-      {
-        id: created.id,
-        version: loaded["version"],
-        changes: { roles: ["SystemAdmin"] },
-      },
-      systemAdmin,
-    );
-
-    const newlyPromoted = createTestUser({ id: created.id, roles: ["SystemAdmin"] });
-    const listResult = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
-      UserQueries.list,
-      {},
-      newlyPromoted,
-    );
-    expect(listResult.rows.length).toBeGreaterThanOrEqual(1);
-  });
-
   test("SystemAdmin updates target user roles to multiple valid roles", async () => {
     const created = await seedUser({ email: "multirole@example.com", displayName: "MultiRole" });
     const loaded = await stack.http.queryOk<Record<string, unknown>>(
@@ -507,6 +529,7 @@ describe("scenario 5: global roles mutation & elevation guard (#2388)", () => {
       actor,
     );
     expectErrorIncludes(error, "field_access_denied");
+    expect(error.httpStatus).toBe(403);
   });
 
   test("normal user gets 403 when attempting to assign global roles to self", async () => {
@@ -529,6 +552,7 @@ describe("scenario 5: global roles mutation & elevation guard (#2388)", () => {
       normalUser,
     );
     expectErrorIncludes(error, "field_access_denied");
+    expect(error.httpStatus).toBe(403);
   });
 
   test("normal user gets 403 when attempting to assign global roles to another user", async () => {
@@ -729,31 +753,29 @@ describe("scenario 6: last active SystemAdmin protection (#2388)", () => {
     expect(reloaded["displayName"]).toBe("UpdatedAdminName");
   });
 
-  test("updating non-SystemAdmin user roles succeeds when only one SystemAdmin exists", async () => {
-    // Seed 1 active SystemAdmin
+  test("demoting a SystemAdmin succeeds when another active SystemAdmin still exists", async () => {
+    // Extra active SystemAdmin so demoting the target is not a last-admin conflict.
     await seedUser({
       email: "the-system-admin@example.com",
       displayName: "TheAdmin",
       roles: ["SystemAdmin"],
     });
 
-    // Seed a normal user
-    const normalUser = await seedUser({
-      email: "regular-user@example.com",
-      displayName: "RegularUser",
-      roles: ["User"],
+    const targetAdmin = await seedUser({
+      email: "second-admin@example.com",
+      displayName: "SecondAdmin",
+      roles: ["SystemAdmin"],
     });
     const loaded = await stack.http.queryOk<Record<string, unknown>>(
       UserQueries.detail,
-      { id: normalUser.id },
+      { id: targetAdmin.id },
       systemAdmin,
     );
 
-    // Updating normal user roles to ["User", "Editor"] should succeed without conflict
     await stack.http.writeOk(
       UserHandlers.update,
       {
-        id: normalUser.id,
+        id: targetAdmin.id,
         version: loaded["version"],
         changes: { roles: ["User", "Editor"] },
       },
@@ -762,92 +784,108 @@ describe("scenario 6: last active SystemAdmin protection (#2388)", () => {
 
     const reloaded = await stack.http.queryOk<Record<string, unknown>>(
       UserQueries.detail,
-      { id: normalUser.id },
+      { id: targetAdmin.id },
       systemAdmin,
     );
     expect(parseRoles(reloaded["roles"])).toEqual(["User", "Editor"]);
   });
 
   test("concurrent demotions of the last two SystemAdmins: one wins, one gets 409", async () => {
-    const adminA = await seedUser({
-      email: "race-admin-a@example.com",
-      displayName: "Race Admin A",
-      roles: ["SystemAdmin"],
-    });
-    const adminB = await seedUser({
-      email: "race-admin-b@example.com",
-      displayName: "Race Admin B",
-      roles: ["SystemAdmin"],
-    });
-
-    const loadedA = await stack.http.queryOk<Record<string, unknown>>(
-      UserQueries.detail,
-      { id: adminA.id },
-      systemAdmin,
-    );
-    const loadedB = await stack.http.queryOk<Record<string, unknown>>(
-      UserQueries.detail,
-      { id: adminB.id },
-      systemAdmin,
-    );
-
-    const [resA, resB] = await Promise.all([
-      stack.http.write(
-        UserHandlers.update,
-        {
-          id: adminA.id,
-          version: loadedA["version"],
-          changes: { roles: ["User"] },
-        },
+    // Repeated across fresh admin pairs: a single trial is a flaky regression
+    // guard — measured ~25% of runs still land on 1 success/1×409 by pure
+    // request-interleaving luck even with acquireNamespacedAdvisoryLock
+    // removed from applyUserRolesUpdate. 10 independent trials push the
+    // chance of missing a reintroduced race down to roughly 0.25^10.
+    async function raceTwoAdminDemotions(trial: number): Promise<void> {
+      // beforeEach only resets the table once per test, not per loop
+      // iteration — without this, a demoted-loser leftover from a prior
+      // trial would count as an "other active SystemAdmin" and mask the race.
+      await resetTestTables(stack.db, [userTable]);
+      const adminA = await seedUser({
+        email: `race-admin-a-${trial}@example.com`,
+        displayName: "Race Admin A",
+        roles: ["SystemAdmin"],
+      });
+      const adminB = await seedUser({
+        email: `race-admin-b-${trial}@example.com`,
+        displayName: "Race Admin B",
+        roles: ["SystemAdmin"],
+      });
+
+      const loadedA = await stack.http.queryOk<Record<string, unknown>>(
+        UserQueries.detail,
+        { id: adminA.id },
         systemAdmin,
-      ),
-      stack.http.write(
-        UserHandlers.update,
-        {
-          id: adminB.id,
-          version: loadedB["version"],
-          changes: { roles: ["User"] },
-        },
+      );
+      const loadedB = await stack.http.queryOk<Record<string, unknown>>(
+        UserQueries.detail,
+        { id: adminB.id },
         systemAdmin,
-      ),
-    ]);
-
-    const bodyA = (await resA.json()) as {
-      isSuccess: boolean;
-      error?: { code?: string; details?: { reason?: string } };
-    };
-    const bodyB = (await resB.json()) as {
-      isSuccess: boolean;
-      error?: { code?: string; details?: { reason?: string } };
-    };
-
-    const outcomes = [
-      { status: resA.status, body: bodyA },
-      { status: resB.status, body: bodyB },
-    ];
-    const successes = outcomes.filter((o) => o.body.isSuccess === true);
-    const failures = outcomes.filter((o) => o.body.isSuccess === false);
-
-    expect(successes).toHaveLength(1);
-    expect(failures).toHaveLength(1);
-    const loser = failures[0];
-    if (!loser) throw new Error("expected exactly one failing demotion");
-    expect(loser.status).toBe(409);
-    expect(loser.body.error?.code).toBe("conflict");
-    expect(loser.body.error?.details?.reason).toBe(UserErrors.cannotDemoteLastSystemAdmin);
-
-    // Exactly one active SystemAdmin must remain among the two race targets.
-    const stillAdmin = await Promise.all(
-      [adminA.id, adminB.id].map(async (id) => {
-        const row = await stack.http.queryOk<Record<string, unknown>>(
-          UserQueries.detail,
-          { id },
+      );
+
+      const [resA, resB] = await Promise.all([
+        stack.http.write(
+          UserHandlers.update,
+          {
+            id: adminA.id,
+            version: loadedA["version"],
+            changes: { roles: ["User"] },
+          },
           systemAdmin,
-        );
-        return parseRoles(row["roles"]).includes("SystemAdmin");
-      }),
-    );
-    expect(stillAdmin.filter(Boolean)).toHaveLength(1);
+        ),
+        stack.http.write(
+          UserHandlers.update,
+          {
+            id: adminB.id,
+            version: loadedB["version"],
+            changes: { roles: ["User"] },
+          },
+          systemAdmin,
+        ),
+      ]);
+
+      const bodyA = (await resA.json()) as {
+        isSuccess: boolean;
+        error?: { code?: string; details?: { reason?: string } };
+      };
+      const bodyB = (await resB.json()) as {
+        isSuccess: boolean;
+        error?: { code?: string; details?: { reason?: string } };
+      };
+
+      const outcomes = [
+        { status: resA.status, body: bodyA },
+        { status: resB.status, body: bodyB },
+      ];
+      const successes = outcomes.filter((o) => o.body.isSuccess === true);
+      const failures = outcomes.filter((o) => o.body.isSuccess === false);
+
+      expect(successes).toHaveLength(1);
+      expect(failures).toHaveLength(1);
+      const loser = failures[0];
+      if (!loser) throw new Error("expected exactly one failing demotion");
+      expect(loser.status).toBe(409);
+      expect(loser.body.error?.code).toBe("conflict");
+      expect(loser.body.error?.details?.reason).toBe(UserErrors.cannotDemoteLastSystemAdmin);
+
+      // Exactly one active SystemAdmin must remain among the two race targets.
+      const stillAdmin = await Promise.all(
+        [adminA.id, adminB.id].map(async (id) => {
+          const row = await stack.http.queryOk<Record<string, unknown>>(
+            UserQueries.detail,
+            { id },
+            systemAdmin,
+          );
+          return parseRoles(row["roles"]).includes("SystemAdmin");
+        }),
+      );
+      expect(stillAdmin.filter(Boolean)).toHaveLength(1);
+    }
+
+    const trials = 10;
+    for (let trial = 0; trial < trials; trial++) {
+      await raceTwoAdminDemotions(trial);
+    }
   });
 
   test("soft-deleted SystemAdmin does not count toward last-admin protection", async () => {

package/src/user/handlers/create.write.ts

@@ -11,10 +11,12 @@ import {
   type WriteErrorInfo,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { UserErrors } from "../constants";
+import { rolesInputSchema } from "../roles-input-schema";
 import { userEntity, userTable } from "../schema/user";
 
 const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -37,12 +39,11 @@ export const createWrite = defineWriteHandler({
     email: z.email(),
     passwordHash: z.string().optional(),
     displayName: z.string().min(1).max(100),
-    locale: z.string().min(2).max(10).optional(),
+    locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
     timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
-    // Global roles — multiSelect jsonb string[]. Optional (entity default []).
     // Field-level write access (privileged) is defense-in-depth — create is
     // already system/SystemAdmin-only.
-    roles: z.union([z.string(), z.array(z.string())]).optional(),
+    roles: rolesInputSchema.optional(),
   }),
   access: { roles: ["system", "SystemAdmin"] },
   handler: async (event, ctx) => {
@@ -70,7 +71,7 @@ export const createWrite = defineWriteHandler({
     let createPayload = event.payload;
     if (event.payload.roles !== undefined) {
       const newRoles = parseRoles(event.payload.roles);
-      const forbidden = findForbiddenRoleAssignment(event.user.roles, newRoles);
+      const forbidden = findForbiddenRoleAssignment(event.user.roles, newRoles, []);
       if (forbidden !== undefined) {
         return writeFailure(
           new AccessDeniedError({

package/src/user/handlers/detail.query.ts

@@ -1,9 +1,31 @@
-import { access, defineEntityDetailHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineEntityDetailHandler,
+  type HandlerContext,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { userEntity } from "../schema/user";
+import { attachTenantLabels, dbForList } from "./list.query";
 
 // Only SystemAdmins can read arbitrary users. Tenant-level "Admin" does NOT
 // grant this — the user feature is tenant-agnostic, and an Admin's scope is
 // bound to their own tenant's memberships (served by the tenant feature).
-export const detailQuery = defineEntityDetailHandler("user", userEntity, {
+const baseDetail = defineEntityDetailHandler("user", userEntity, {
   access: { roles: access.systemAdmin },
 });
+
+// Same tenants enrichment as user:list — derived field placeholder is "".
+export const detailQuery = {
+  ...baseDetail,
+  handler: async (
+    query: Parameters<NonNullable<typeof baseDetail.handler>>[0],
+    ctx: HandlerContext,
+  ) => {
+    const result = await baseDetail.handler?.(query, ctx);
+    if (result === null || typeof result !== "object") return result;
+    const [enriched] = await attachTenantLabels(
+      [result as Record<string, unknown>],
+      dbForList(ctx),
+    );
+    return enriched ?? result;
+  },
+};

package/src/user/handlers/list.query.ts

@@ -6,6 +6,7 @@ import {
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import type { QueryHandlerDef } from "@cosmicdrift/kumiko-types/handlers";
 // kumiko-lint-ignore cross-feature-import SystemAdmin user-list joins memberships for tenants column
 import { tenantMembershipsTable, tenantTable } from "../../tenant";
 import { userEntity } from "../schema/user";
@@ -17,23 +18,16 @@ const baseList = defineEntityListHandler("user", userEntity, {
 type MembershipRow = { userId: unknown; tenantId: unknown; roles?: unknown };
 type TenantRow = { id: unknown; name?: unknown; key?: unknown };
 
-function isMissingRelation(err: unknown): boolean {
-  const msg = err instanceof Error ? err.message : String(err);
-  return msg.includes("does not exist") || msg.includes("42P01");
-}
-
 async function loadMemberships(
   db: TenantDb,
   userIds: readonly string[],
-): Promise<readonly MembershipRow[] | null> {
-  try {
-    return await selectMany<MembershipRow>(db, tenantMembershipsTable, {
-      userId: { in: [...userIds] },
-    });
-  } catch (err) {
-    if (isMissingRelation(err)) return null;
-    throw err;
-  }
+): Promise<readonly MembershipRow[]> {
+  // Membership tables ship with the tenant feature; user:list is SystemAdmin
+  // roster code that always mounts both. Do not swallow missing-relation
+  // errors here — that hid real schema bugs behind a permanent "—" column.
+  return await selectMany<MembershipRow>(db, tenantMembershipsTable, {
+    userId: { in: [...userIds] },
+  });
 }
 
 function tenantLabelById(tenants: readonly TenantRow[]): Map<string, string> {
@@ -70,7 +64,7 @@ function labelsByUserId(
   return map;
 }
 
-async function attachTenantLabels(
+export async function attachTenantLabels(
   rows: readonly Record<string, unknown>[],
   db: TenantDb,
 ): Promise<Record<string, unknown>[]> {
@@ -79,9 +73,6 @@ async function attachTenantLabels(
   if (userIds.length === 0) return [...rows];
 
   const memberships = await loadMemberships(db, userIds);
-  if (memberships === null) {
-    return rows.map((row) => ({ ...row, tenants: "—" }));
-  }
 
   const tenantIds = [
     ...new Set(memberships.map((m) => String(m.tenantId ?? "")).filter((id) => id !== "")),
@@ -93,11 +84,12 @@ async function attachTenantLabels(
   const byUser = labelsByUserId(memberships, tenantLabelById(tenants));
   return rows.map((row) => {
     const labels = byUser.get(String(row["id"] ?? "")) ?? [];
-    return { ...row, tenants: labels.length > 0 ? labels.join(", ") : "—" };
+    const sorted = [...labels].sort((a, b) => a.localeCompare(b));
+    return { ...row, tenants: sorted.length > 0 ? sorted.join(", ") : "" };
   });
 }
 
-function dbForList(ctx: HandlerContext): TenantDb {
+export function dbForList(ctx: HandlerContext): TenantDb {
   if (!ctx.systemDb) {
     throw new Error("user:list requires r.systemScope() / ctx.systemDb");
   }
@@ -110,13 +102,14 @@ function dbForList(ctx: HandlerContext): TenantDb {
 // members via the tenant feature (which scopes by membership, not globally).
 // Wraps the entity-convention list so each row carries a `tenants` label
 // (derived field) — without it the platform roster is unusable for ops.
-export const listQuery = {
+export const listQuery: QueryHandlerDef = {
   ...baseList,
-  handler: async (
-    query: Parameters<NonNullable<typeof baseList.handler>>[0],
-    ctx: HandlerContext,
-  ) => {
-    const result = await baseList.handler?.(query, ctx);
+  handler: async (query, ctx) => {
+    const baseHandler = baseList.handler;
+    if (baseHandler === undefined) {
+      throw new Error("user:list base handler missing");
+    }
+    const result = await baseHandler(query, ctx);
     if (result === null || typeof result !== "object" || !("rows" in result)) {
       return result;
     }

package/src/user/handlers/update-roles.ts

@@ -15,6 +15,7 @@ import {
 import {
   AccessDeniedError,
   ConflictError,
+  InternalError,
   NotFoundError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
@@ -32,7 +33,8 @@ const LAST_SYSTEM_ADMIN_LOCK_NAMESPACE = 0x7361646d; // 'sadm'
 
 type UserRolesRow = {
   id: string;
-  roles: string | null;
+  // jsonb string[] at rest; legacy text rows + parseRoles(unknown) still accepted
+  roles: readonly string[] | string | null;
   status: string | null;
   isDeleted?: boolean;
 };
@@ -51,7 +53,10 @@ function isActiveSystemAdminRow(row: UserRolesRow): boolean {
 }
 
 async function countOtherActiveSystemAdmins(db: TenantDb, excludeUserId: string): Promise<number> {
-  const tableName = asEntityTableMeta(userTable)?.tableName ?? "read_users";
+  const tableName = asEntityTableMeta(userTable)?.tableName;
+  if (!tableName) {
+    throw new InternalError({ message: "user read table meta missing" });
+  }
   // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
   const rows = (await asRawClient(db.raw).unsafe(
     `SELECT id, roles, status, is_deleted AS "isDeleted"
@@ -145,9 +150,10 @@ export async function applyUserRolesUpdate(
   };
 
   // Persist roles first. Session revoke runs only after a successful update so a
-  // version conflict / projection error cannot leave sessions revoked while roles
-  // stay unchanged. Dispatcher TX still wraps both: revoke shares the write tx
-  // and rolls back with a failed outer write.
+  // version conflict / permission error cannot leave sessions revoked while roles
+  // stay unchanged. Nested writeAs returns {isSuccess:false} instead of throwing —
+  // we must propagate that failure so the dispatcher TX rolls the role update
+  // back with the revoke (writeAs alone does not abort the outer handler).
   const updateResult = await crud.update(
     { ...event.payload, changes: normalizedChanges },
     event.user,
@@ -159,13 +165,24 @@ export async function applyUserRolesUpdate(
 
   const revoker = ctx.registry.getWriteHandler(REVOKE_ALL_SESSIONS_QN);
   if (revoker) {
-    await ctx.writeAs(
+    const revokeResult = await ctx.writeAs(
       createSystemUser(event.user.tenantId ?? SYSTEM_TENANT_ID),
       REVOKE_ALL_SESSIONS_QN,
       {
         userId: event.payload.id,
       },
     );
+    if (!revokeResult.isSuccess) return revokeResult;
+  } else {
+    // skip: sessions feature not mounted — no live JWTs to revoke; role update
+    // still commits. Apps that mount user without sessions accept stale claims
+    // until JWT TTL.
+    ctx.log?.warn(
+      "user:update-roles: sessions revoke-all handler missing; role change commits without session invalidation",
+      {
+        userId: event.payload.id,
+      },
+    );
   }
 
   return updateResult;

package/src/user/handlers/update.write.ts

@@ -5,9 +5,11 @@ import {
   InternalError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
+import { rolesInputSchema } from "../roles-input-schema";
 import { userEntity, userTable } from "../schema/user";
 import { applyUserRolesUpdate } from "./update-roles";
 
@@ -27,16 +29,15 @@ export const updateWrite = defineWriteHandler({
     version: z.number(),
     changes: z.object({
       displayName: z.string().min(1).max(100).optional(),
-      locale: z.string().min(2).max(10).optional(),
+      locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
       timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
       email: z.email().optional(),
       passwordHash: z.string().optional(),
       lastActiveTenantId: z.string().optional(),
       emailVerified: z.boolean().optional(),
-      // Global roles — JSON-encoded string[] or string[]. Field-level write
-      // access is privileged (see userEntity.roles); handler also requires a
-      // privileged actor and runs the elevation guard.
-      roles: z.union([z.string(), z.array(z.string())]).optional(),
+      // Field-level write access is privileged (see userEntity.roles); handler
+      // also requires a privileged actor and runs the elevation guard.
+      roles: rolesInputSchema.optional(),
     }),
   }),
   access: { openToAll: true },

package/src/user/i18n.ts

@@ -7,12 +7,6 @@ export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
   "user:entity:user:field:displayName": { en: "Display name" },
   "user:entity:user:field:roles": { en: "Platform roles" },
   "user:entity:user:field:tenants": { en: "Tenants" },
-  "user:entity:user:field:tenants:description": {
-    en: "Membership tenants with roles, e.g. Offlot Demo (TenantAdmin). Edit under Team → Members.",
-  },
-  "user:entity:user:field:roles:description": {
-    en: "Global platform roles only (SystemAdmin). TenantAdmin/Admin are membership roles under Team → Members.",
-  },
   "user:entity:user:field:roles:option:SystemAdmin": { en: "SystemAdmin" },
   "user:entity:user:field:status": { en: "Status" },
   "user:entity:user:field:emailVerified": { en: "Email verified" },

package/src/user/roles-input-schema.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+
+/** Accept string[] or a JSON-encoded string[]; reject bare non-JSON strings. */
+export const rolesInputSchema = z.union([
+  z.array(z.string()),
+  // Legacy wire form: JSON-encoded string[]. Bare "SystemAdmin" used to
+  // parseRoles → [] and silently wipe/clear roles — reject that at the boundary.
+  z.string().transform((raw, ctx) => {
+    try {
+      const parsed: unknown = JSON.parse(raw);
+      if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
+        return parsed as string[];
+      }
+    } catch {
+      /* fall through */
+    }
+    ctx.addIssue({ code: "custom", message: "roles must be a string[] or JSON string array" });
+    return z.NEVER;
+  }),
+]);