@cosmicdrift/kumiko-bundled-features 0.244.0 → 0.246.0

package/src/tags/__tests__/tags-parent-visibility.integration.test.ts

@@ -0,0 +1,219 @@
+// assign-tag/remove-tag previously took entityType/entityId straight from the
+// client, so any dispatch-eligible tenant user could attach a catalog tag to —
+// or detach one from — an object they had no read access to. The tag-assignment
+// aggregate-id is derived from the tenant, so this was never a cross-tenant
+// hole; it was "tag an object inside your own tenant that you aren't allowed to
+// read", which also leaks through the assignment list of anyone who can see it.
+//
+// The check is unconditional (default-on, no opt-in): entityType must name a
+// registered entity, and the host row must be visible through that entity's own
+// read path (tenant scope plus its `access.read` ownership).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { TagsHandlers } from "../constants";
+import { tagAssignmentEntity, tagEntity } from "../entity";
+import { createTagsFeature } from "../feature";
+
+const PROJECT_TABLE = "tags_pv_test_projects";
+
+// Team-scoped read ownership on the host entity itself — the caller sees a
+// project row only if their `team` claim matches the row's team_id.
+const projectOwnership: NonNullable<EntityDefinition["access"]> = {
+  read: {
+    TenantMember: {
+      kind: "where",
+      where: (user, ctx) => ({
+        sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+        params: [user.claims?.["team"] ?? null],
+      }),
+    },
+  },
+};
+
+const projectEntity = createEntity({
+  table: PROJECT_TABLE,
+  fields: {
+    teamId: createTextField({ required: true, maxLength: 64 }),
+    name: createTextField({ required: true, maxLength: 64 }),
+  },
+  access: projectOwnership,
+});
+
+const hostFixturesFeature = defineFeature("tags-pv-test-fixtures", (r) => {
+  r.entity("project", projectEntity);
+});
+
+type TestUser = ReturnType<typeof createTestUser>;
+
+// Same tenant, different team claim.
+const userA: TestUser = createTestUser({
+  id: 60,
+  roles: ["TenantMember"],
+  claims: { team: "team-a" },
+});
+const userB: TestUser = createTestUser({
+  id: 61,
+  roles: ["TenantMember"],
+  claims: { team: "team-b" },
+});
+
+const PROJECT_A = "b0000000-0000-4000-8000-000000000001";
+// A second team-a project, dedicated to the remove-tag denial case so its
+// assignment count stays independent of PROJECT_A's.
+const PROJECT_A2 = "b0000000-0000-4000-8000-000000000002";
+// Never assigned anything — the "no assignment" half of the oracle check.
+const PROJECT_A3 = "b0000000-0000-4000-8000-000000000003";
+
+let stack: TestStack;
+let tagId: string;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+  });
+  await unsafeCreateEntityTable(stack.db, tagEntity);
+  await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, projectEntity);
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES
+       ($1, $2, 'team-a', 'Project A'),
+       ($3, $2, 'team-a', 'Project A2'),
+       ($4, $2, 'team-a', 'Project A3')`,
+    [PROJECT_A, userA.tenantId, PROJECT_A2, PROJECT_A3],
+  );
+
+  const tag = await stack.http.writeOk<{ id: string }>(
+    TagsHandlers.createTag,
+    { name: "VIP" },
+    userA,
+  );
+  tagId = tag.id;
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function activeAssignmentsFor(entityId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe<{ n: number }>(
+    "SELECT count(*)::int AS n FROM read_tag_assignments WHERE entity_id = $1 AND is_deleted = FALSE",
+    [entityId],
+  );
+  return rows[0]?.n ?? 0;
+}
+
+function assign(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    TagsHandlers.assignTag,
+    { tagId, entityType, entityId },
+    user,
+  );
+}
+
+function assignErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(TagsHandlers.assignTag, { tagId, entityType, entityId }, user);
+}
+
+function remove(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    TagsHandlers.removeTag,
+    { tagId, entityType, entityId },
+    user,
+  );
+}
+
+function removeErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(TagsHandlers.removeTag, { tagId, entityType, entityId }, user);
+}
+
+describe("tags integration — assign-tag parent-visibility", () => {
+  test("a host row visible through the host entity's own read path can be tagged", async () => {
+    const result = await assign("project", PROJECT_A, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A)).toBe(1);
+  });
+
+  test("a host row from a foreign team is denied, and nothing is written", async () => {
+    const err = await assignErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+
+    // Positive control: PROJECT_A2 IS taggable — by its own team — so the deny
+    // above is the team-claim check, not a row that doesn't exist at all.
+    const result = await assign("project", PROJECT_A2, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await assignErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+
+  test("a malformed entityId is denied cleanly, without poisoning the connection", async () => {
+    const err = await assignErr("project", "not-a-uuid", userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+
+    // The stack must still be usable — proves the malformed id was rejected
+    // before it reached a query, not caught after a tx-poisoning cast error.
+    expect((await assign("project", PROJECT_A, userA)).id).toBeTruthy();
+  });
+});
+
+describe("tags integration — remove-tag parent-visibility", () => {
+  test("a foreign team cannot detach an existing assignment; the row survives", async () => {
+    await assign("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    const err = await removeErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    // Zero-write: the assignment userA made is still active, not soft-deleted.
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    // Positive control: the owning team CAN detach it.
+    await remove("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+  });
+
+  test("the denial carries no existence oracle: assigned and unassigned rows answer alike", async () => {
+    await assign("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+    expect(await activeAssignmentsFor(PROJECT_A3)).toBe(0);
+
+    // remove-tag normally reports success for a never-assigned pair, so without
+    // the gate running FIRST the two responses below would differ and leak
+    // whether the invisible host row carries this tag.
+    const onAssigned = await removeErr("project", PROJECT_A2, userB);
+    const onUnassigned = await removeErr("project", PROJECT_A3, userB);
+    expect(onAssigned.code).toBe(onUnassigned.code);
+    expect(onAssigned.httpStatus).toBe(onUnassigned.httpStatus);
+    expect(onAssigned.code).toBe("not_found");
+
+    await remove("project", PROJECT_A2, userA);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await removeErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+});

package/src/tags/__tests__/tags.integration.test.ts

@@ -7,9 +7,16 @@
 //   - read-layer composition both directions (tags of an entity / entities of a tag)
 //   - assign + remove are idempotent (re-assign = one row, remove-missing = ok)
 //   - multi-tenant isolation
+//
+// assign-tag/remove-tag verify that entityType names a registered entity and
+// that the host row is visible to the caller. This file's assertions are about
+// assignment mechanics, not parent ownership, so the `credit`/`note` fixtures
+// below stay unrestricted (no `access`) on purpose — every host row this file
+// tags is seeded in beforeAll.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -17,19 +24,77 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { v5 as uuidv5 } from "uuid";
 import { TagsHandlers, TagsQueries } from "../constants";
 import { tagAssignmentEntity, tagEntity } from "../entity";
 import { createTagsFeature } from "../feature";
 
 const tagsFeature = createTagsFeature();
 
+const CREDIT_TABLE = "tags_test_credits";
+const NOTE_TABLE = "tags_test_notes";
+const hostFields = { name: createTextField({ required: true, maxLength: 64 }) };
+const creditEntity = createEntity({ table: CREDIT_TABLE, fields: hostFields });
+const noteEntity = createEntity({ table: NOTE_TABLE, fields: hostFields });
+const hostFixturesFeature = defineFeature("tags-test-host-fixtures", (r) => {
+  r.entity("credit", creditEntity);
+  r.entity("note", noteEntity);
+});
+
+// The parent entity's ids are uuid-shaped, but the readable labels below carry
+// the intent of each case — derive one from the other instead of scattering
+// opaque uuid literals through the assertions.
+const HOST_FIXTURE_NAMESPACE = "6f1c4d2a-9b3e-4a7c-8d5f-1e2b3c4d5e6f";
+function hostId(label: string): string {
+  return uuidv5(label, HOST_FIXTURE_NAMESPACE);
+}
+
+const CREDIT_LABELS = [
+  "credit-1",
+  "credit-2",
+  "credit-3",
+  "credit-4",
+  "credit-5",
+  "credit-6",
+  "credit-7",
+  "credit-8",
+  "credit-d1",
+  "credit-r",
+  "credit-x",
+  ...Array.from({ length: 20 }, (_, i) => `credit-race-${i}`),
+];
+
+async function seedHostRows(
+  target: TestStack,
+  table: string,
+  labels: readonly string[],
+  tenantId: string,
+): Promise<void> {
+  for (const label of labels) {
+    await asRawClient(target.db).unsafe(
+      `INSERT INTO ${table} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [hostId(label), tenantId, label],
+    );
+  }
+}
+
 let stack: TestStack;
 
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+const otherTenant = createTestUser({
+  roles: ["TenantAdmin"],
+  tenantId: "00000000-0000-4000-8000-0000000000aa",
+});
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [tagsFeature] });
+  stack = await setupTestStack({ features: [tagsFeature, hostFixturesFeature] });
   await unsafeCreateEntityTable(stack.db, tagEntity);
   await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, creditEntity);
+  await unsafeCreateEntityTable(stack.db, noteEntity);
   await createEventsTable(stack.db);
+  await seedHostRows(stack, CREDIT_TABLE, CREDIT_LABELS, admin.tenantId);
+  await seedHostRows(stack, NOTE_TABLE, ["note-d1"], admin.tenantId);
 });
 
 afterAll(async () => {
@@ -42,12 +107,6 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM read_tag_assignments");
 });
 
-const admin = createTestUser({ roles: ["TenantAdmin"] });
-const otherTenant = createTestUser({
-  roles: ["TenantAdmin"],
-  tenantId: "00000000-0000-4000-8000-0000000000aa",
-});
-
 async function createTag(name: string, user = admin): Promise<string> {
   const tag = await stack.http.writeOk<{ id: string }>(TagsHandlers.createTag, { name }, user);
   return tag.id;
@@ -111,10 +170,14 @@ describe("tags integration — catalog + assignment roundtrip", () => {
 
   test("assign-tag → assignment queryable both composition directions", async () => {
     const tagId = await createTag("VIP");
-    await assign(tagId, "credit", "credit-1");
+    await assign(tagId, "credit", hostId("credit-1"));
 
     // tags of an entity
-    const byEntity = await listAssignments({ field: "entityId", op: "eq", value: "credit-1" });
+    const byEntity = await listAssignments({
+      field: "entityId",
+      op: "eq",
+      value: hostId("credit-1"),
+    });
     expect(byEntity).toHaveLength(1);
     expect(byEntity[0]?.["tagId"]).toBe(tagId);
     expect(byEntity[0]?.["entityType"]).toBe("credit");
@@ -122,17 +185,17 @@ describe("tags integration — catalog + assignment roundtrip", () => {
     // entities carrying a tag
     const byTag = await listAssignments({ field: "tagId", op: "eq", value: tagId });
     expect(byTag).toHaveLength(1);
-    expect(byTag[0]?.["entityId"]).toBe("credit-1");
+    expect(byTag[0]?.["entityId"]).toBe(hostId("credit-1"));
   });
 
   test("remove-tag deletes the assignment", async () => {
     const tagId = await createTag("temp");
-    await assign(tagId, "credit", "credit-2");
+    await assign(tagId, "credit", hostId("credit-2"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
 
-    await remove(tagId, "credit", "credit-2");
+    await remove(tagId, "credit", hostId("credit-2"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
-    const left = await listAssignments({ field: "entityId", op: "eq", value: "credit-2" });
+    const left = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-2") });
     expect(left).toHaveLength(0);
   });
 });
@@ -231,9 +294,9 @@ describe("tags integration — delete-tag cascade", () => {
     const target = await createTag("Sammelmappe");
     const other = await createTag("bleibt");
     // target spans two entityTypes; other tag stays attached to prove scoping
-    await assign(target, "credit", "credit-d1");
-    await assign(target, "note", "note-d1");
-    await assign(other, "credit", "credit-d1");
+    await assign(target, "credit", hostId("credit-d1"));
+    await assign(target, "note", hostId("note-d1"));
+    await assign(other, "credit", hostId("credit-d1"));
     expect(await countAssignments(admin.tenantId)).toBe(3);
 
     await deleteTag(target);
@@ -257,52 +320,54 @@ describe("tags integration — many-to-many composition", () => {
   test("one entity carries multiple tags", async () => {
     const a = await createTag("rot");
     const b = await createTag("wasser");
-    await assign(a, "credit", "credit-3");
-    await assign(b, "credit", "credit-3");
+    await assign(a, "credit", hostId("credit-3"));
+    await assign(b, "credit", hostId("credit-3"));
 
-    const tags = await listAssignments({ field: "entityId", op: "eq", value: "credit-3" });
+    const tags = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-3") });
     expect(tags.map((r) => r["tagId"]).sort()).toEqual([a, b].sort());
   });
 
   test("one tag spans multiple entities", async () => {
     const tagId = await createTag("Mappe-2026");
-    await assign(tagId, "credit", "credit-4");
-    await assign(tagId, "credit", "credit-5");
+    await assign(tagId, "credit", hostId("credit-4"));
+    await assign(tagId, "credit", hostId("credit-5"));
 
     const entities = await listAssignments({ field: "tagId", op: "eq", value: tagId });
-    expect(entities.map((r) => r["entityId"]).sort()).toEqual(["credit-4", "credit-5"]);
+    expect(entities.map((r) => r["entityId"]).sort()).toEqual(
+      [hostId("credit-4"), hostId("credit-5")].sort(),
+    );
   });
 });
 
 describe("tags integration — idempotency", () => {
   test("re-assigning the same (tag, entity) keeps exactly one row", async () => {
     const tagId = await createTag("dup");
-    await assign(tagId, "credit", "credit-6");
-    await assign(tagId, "credit", "credit-6"); // re-assign: must be a no-op success
+    await assign(tagId, "credit", hostId("credit-6"));
+    await assign(tagId, "credit", hostId("credit-6")); // re-assign: must be a no-op success
 
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    const rows = await listAssignments({ field: "entityId", op: "eq", value: "credit-6" });
+    const rows = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-6") });
     expect(rows).toHaveLength(1);
   });
 
   test("removing a never-assigned (tag, entity) succeeds (no error, no row)", async () => {
     const tagId = await createTag("ghost");
     // never assigned — remove must still succeed (idempotent end-state)
-    await remove(tagId, "credit", "credit-7");
+    await remove(tagId, "credit", hostId("credit-7"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
   });
 
   test("assign → remove → assign-again resurrects the same deterministic stream", async () => {
     const tagId = await createTag("recurring");
-    await assign(tagId, "credit", "credit-r");
-    await remove(tagId, "credit", "credit-r");
+    await assign(tagId, "credit", hostId("credit-r"));
+    await remove(tagId, "credit", hostId("credit-r"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
 
     // Re-attaching the same (tag, entity) must succeed (restore), not 409 — the
     // deterministic aggregate-id reuses the removed stream.
-    await assign(tagId, "credit", "credit-r");
+    await assign(tagId, "credit", hostId("credit-r"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    const rows = await listAssignments({ field: "entityId", op: "eq", value: "credit-r" });
+    const rows = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-r") });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["tagId"]).toBe(tagId);
   });
@@ -319,7 +384,7 @@ describe("tags integration — idempotency", () => {
       // The handler must converge that into success instead of surfacing a 409
       // for what is, from the caller's perspective, an idempotent operation.
       const tagId = await createTag(`racy-${i}`);
-      const entityId = `credit-race-${i}`;
+      const entityId = hostId(`credit-race-${i}`);
       const [a, b] = await Promise.all([
         assign(tagId, "credit", entityId),
         assign(tagId, "credit", entityId),
@@ -336,7 +401,11 @@ describe("tags integration — referential integrity", () => {
   test("assigning an unknown tagId is rejected (no dangling assignment)", async () => {
     const err = await stack.http.writeErr(
       TagsHandlers.assignTag,
-      { tagId: "00000000-0000-4000-8000-00000000dead", entityType: "credit", entityId: "credit-x" },
+      {
+        tagId: "00000000-0000-4000-8000-00000000dead",
+        entityType: "credit",
+        entityId: hostId("credit-x"),
+      },
       admin,
     );
     expect(err.httpStatus).toBe(404);
@@ -347,11 +416,14 @@ describe("tags integration — referential integrity", () => {
 describe("tags integration — multi-tenant isolation", () => {
   test("tenant B sees neither tenant A's tags nor assignments", async () => {
     const tagId = await createTag("A-only", admin);
-    await assign(tagId, "credit", "credit-8", admin);
+    await assign(tagId, "credit", hostId("credit-8"), admin);
 
     expect(await listTags(otherTenant)).toHaveLength(0);
     expect(
-      await listAssignments({ field: "entityId", op: "eq", value: "credit-8" }, otherTenant),
+      await listAssignments(
+        { field: "entityId", op: "eq", value: hostId("credit-8") },
+        otherTenant,
+      ),
     ).toHaveLength(0);
 
     // tenant A still sees its own
@@ -378,11 +450,13 @@ describe("tags integration — openToAll access model", () => {
 
   beforeAll(async () => {
     openStack = await setupTestStack({
-      features: [createTagsFeature({ access: { openToAll: true } })],
+      features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
     });
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
+    await unsafeCreateEntityTable(openStack.db, creditEntity);
     await createEventsTable(openStack.db);
+    await seedHostRows(openStack, CREDIT_TABLE, ["c-1"], unprivileged.tenantId);
 
     defaultStack = await setupTestStack({ features: [tagsFeature] });
     await unsafeCreateEntityTable(defaultStack.db, tagEntity);
@@ -403,7 +477,7 @@ describe("tags integration — openToAll access model", () => {
     );
     await openStack.http.writeOk(
       TagsHandlers.assignTag,
-      { tagId: tag.id, entityType: "credit", entityId: "c-1" },
+      { tagId: tag.id, entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
 
@@ -416,14 +490,14 @@ describe("tags integration — openToAll access model", () => {
 
     const assigned = await openStack.http.queryOk<{ rows: unknown[] }>(
       TagsQueries.assignmentList,
-      { filter: { field: "entityId", op: "eq", value: "c-1" } },
+      { filter: { field: "entityId", op: "eq", value: hostId("c-1") } },
       unprivileged,
     );
     expect(assigned.rows).toHaveLength(1);
 
     await openStack.http.writeOk(
       TagsHandlers.removeTag,
-      { tagId: tag.id, entityType: "credit", entityId: "c-1" },
+      { tagId: tag.id, entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
   });

package/src/tags/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.246.0",
+    "type": "improvement",
+    "title": "assign-tag and remove-tag now verify entityType/entityId against the host entity's own read path",
+    "detail": "Before this change, assign-tag and remove-tag took entityType/entityId straight from the client with no check — any dispatch-eligible tenant user could attach a catalog tag to, or detach one from, any object in their tenant, including one they could not otherwise read. The tag-assignment aggregate-id is derived from the tenant, so this was never a cross-tenant hole; it was tagging inside your own tenant across a row-level ownership boundary. Both handlers now unconditionally verify that entityType names a registered entity and that the host row is visible to the caller through that entity's own read path (tenant scope plus its `access.read` ownership) before touching the assignment; either check failing returns a not_found response, the same answer a genuinely missing row gets, so nothing doubles as an existence oracle. The check runs before the assignment and tag lookups, so a denied caller cannot tell an invisible host row apart from a missing assignment. This mirrors the add-note gate shipped in 0.244.0 and shares its helper.",
+    "migration": "entityType must now name an entity registered in the same app (via r.entity(...) or a bundled feature), and the caller must be able to see the target row through that entity's own read path. Any consumer that called assign-tag or remove-tag with an entityType that is NOT a registered entity name, or with an entityId the caller could not otherwise read, will now get a not_found error instead of a successful write — register the host entity (and, if it needs row-level ownership, its `access.read` rule) before upgrading. Note the consequence for hard-deleted host rows: once the host row is gone, its assignment can no longer be removed through remove-tag; delete-tag's cascade still detaches it."
+  }
+]

package/src/tags/feature.ts

@@ -187,8 +187,9 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
         '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
         "layer (the read path, via buildOwnershipClause). Write paths that " +
         "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them: create throws at runtime, update/delete/forget/restore " +
-        "silently deny. Use a `from()` rule for ownership.write, or leave it unset.",
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.",
     );
   }
   const access = resolveAccess(opts);

package/src/tags/handlers/assign-tag.write.ts

@@ -1,5 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parentRowIsVisible } from "../../shared";
 import { tagAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_TAG_ACCESS } from "../constants";
 import { tagAssignmentExecutor, tagExecutor } from "../executor";
@@ -21,6 +22,11 @@ import { type AssignTagPayload, assignTagPayloadSchema } from "../schemas";
 // Referential integrity: there is no FK (event-sourced, no JOIN), so before a
 // first-time create we verify the tag exists in the catalog — a malformed call
 // with an unknown tagId would otherwise project a dangling assignment.
+//
+// Host reference: entityType/entityId are never trusted client input either —
+// the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
+// without the check any dispatch-eligible tenant user could tag an object they
+// are not allowed to read. See shared/parent-visibility.ts.
 export function createAssignTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS): WriteHandlerDef {
   return {
     name: "assign-tag",
@@ -30,6 +36,24 @@ export function createAssignTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
       "Attaches an existing catalog tag to one host entity addressed by its type and id, reporting success when the tag was already attached; use it to tag a record, not to create the tag.",
     handler: async (event, ctx) => {
       const payload = event.payload as AssignTagPayload; // @cast-boundary engine-payload
+      // entityType/entityId are client input: the caller must be able to see
+      // the host row through that entity's own read path (tenant scope plus its
+      // `access.read` ownership) before its assignment row may be written.
+      // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
+      // an invisible parent apart from a missing assignment or an unknown tag —
+      // every path answers with the same NotFoundError.
+      if (
+        !(await parentRowIsVisible(
+          ctx.registry,
+          payload.entityType,
+          payload.entityId,
+          event.user,
+          ctx.db,
+        ))
+      ) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       const id = tagAssignmentAggregateId(
         event.user.tenantId,
         payload.tagId,

package/src/tags/handlers/remove-tag.write.ts

@@ -1,4 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parentRowIsVisible } from "../../shared";
 import { tagAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_TAG_ACCESS } from "../constants";
 import { tagAssignmentExecutor } from "../executor";
@@ -7,6 +9,10 @@ import { type RemoveTagPayload, removeTagPayloadSchema } from "../schemas";
 // remove-tag — unlinks a tag from a host entity. Idempotent: removing an
 // assignment that doesn't exist is already the requested end state (not
 // assigned), so we pre-check and return success without a delete.
+//
+// Host reference: entityType/entityId are client input, so the caller must be
+// able to see the host row before detaching anything from it — see
+// shared/parent-visibility.ts.
 export function createRemoveTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS): WriteHandlerDef {
   return {
     name: "remove-tag",
@@ -16,6 +22,24 @@ export function createRemoveTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
       "Detaches one catalog tag from one host entity, reporting success when it was not attached; use it to untag a single record while the tag itself stays in the catalog.",
     handler: async (event, ctx) => {
       const payload = event.payload as RemoveTagPayload; // @cast-boundary engine-payload
+      // entityType/entityId are client input: the caller must be able to see
+      // the host row through that entity's own read path (tenant scope plus its
+      // `access.read` ownership) before its assignment row may be written.
+      // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
+      // an invisible parent apart from a missing assignment or an unknown tag —
+      // every path answers with the same NotFoundError.
+      if (
+        !(await parentRowIsVisible(
+          ctx.registry,
+          payload.entityType,
+          payload.entityId,
+          event.user,
+          ctx.db,
+        ))
+      ) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       const id = tagAssignmentAggregateId(
         event.user.tenantId,
         payload.tagId,

package/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -6,6 +6,7 @@ import {
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { configValueEntity, configValuesTable } from "../../config";
+import { assertErased } from "../../shared";
 import { featureMounted } from "./feature-mounted";
 
 // userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
@@ -46,6 +47,6 @@ export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    await crud.forget({ id }, systemUser, tdb);
+    assertErased(await crud.forget({ id }, systemUser, tdb), "config-value", id);
   }
 };