@cosmicdrift/kumiko-bundled-features 0.245.0 → 0.246.0

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -3,8 +3,15 @@
 // via selectMany without an isDeleted filter — folderAssignmentEntity is
 // softDelete: true, so a cleared assignment (clear-folder) still had a row
 // in read_folder_assignments and rode along in the export.
+//
+// set-folder/clear-folder verify that entityType names a registered entity and
+// that the host row is visible to the caller, so the two credits below are a
+// real registered fixture. The assertion is about the export hook's isDeleted
+// filter, not about ownership — the fixture is deliberately unrestricted.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -16,14 +23,31 @@ import { createFoldersFeature, FoldersHandlers } from "../../folders";
 import { folderAssignmentEntity, folderEntity } from "../../folders/entity";
 import { folderAssignmentExportHook } from "../hooks";
 
+const CREDIT_TABLE = "folders_export_test_credits";
+const creditEntity = createEntity({
+  table: CREDIT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const hostFixturesFeature = defineFeature("folders-export-test-host-fixtures", (r) => {
+  r.entity("credit", creditEntity);
+});
+
+const CREDIT_KEPT = "d0000000-0000-4000-8000-000000000001";
+const CREDIT_CLEARED = "d0000000-0000-4000-8000-000000000002";
+
 let stack: TestStack;
 const admin = createTestUser({ roles: ["TenantAdmin"] });
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [createFoldersFeature()] });
+  stack = await setupTestStack({ features: [createFoldersFeature(), hostFixturesFeature] });
   await unsafeCreateEntityTable(stack.db, folderEntity);
   await unsafeCreateEntityTable(stack.db, folderAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, creditEntity);
   await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${CREDIT_TABLE} (id, tenant_id, name) VALUES ($1, $3, 'kept'), ($2, $3, 'cleared')`,
+    [CREDIT_KEPT, CREDIT_CLEARED, admin.tenantId],
+  );
 });
 
 afterAll(async () => {
@@ -40,18 +64,18 @@ describe("folderAssignmentExportHook", () => {
 
     await stack.http.writeOk(
       FoldersHandlers.setFolder,
-      { folderId: folder.id, entityType: "credit", entityId: "credit-kept" },
+      { folderId: folder.id, entityType: "credit", entityId: CREDIT_KEPT },
       admin,
     );
     await stack.http.writeOk(
       FoldersHandlers.setFolder,
-      { folderId: folder.id, entityType: "credit", entityId: "credit-cleared" },
+      { folderId: folder.id, entityType: "credit", entityId: CREDIT_CLEARED },
       admin,
     );
     // clear-folder soft-deletes the assignment row (isDeleted: true).
     await stack.http.writeOk(
       FoldersHandlers.clearFolder,
-      { entityType: "credit", entityId: "credit-cleared" },
+      { entityType: "credit", entityId: CREDIT_CLEARED },
       admin,
     );
 
@@ -64,7 +88,7 @@ describe("folderAssignmentExportHook", () => {
 
     expect(snippet).not.toBeNull();
     const entityIds = (snippet?.rows ?? []).map((r) => r["entityId"]);
-    expect(entityIds).toContain("credit-kept");
-    expect(entityIds).not.toContain("credit-cleared");
+    expect(entityIds).toContain(CREDIT_KEPT);
+    expect(entityIds).not.toContain(CREDIT_CLEARED);
   });
 });

package/src/notes-history/handlers/add-note.write.ts

@@ -1,11 +1,10 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, parentRowIsVisible } from "../../shared";
 import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
 import { noteEntryExecutor } from "../executor";
-import { parentRowIsVisible } from "../parent-visibility";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 
 // add-note — appends a note-entry to (entityType, entityId). authorId is
@@ -17,7 +16,7 @@ import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 // entityType/entityId are never trusted client input: entityType must name a
 // registered entity, and the row must be visible to the caller through that
 // entity's own read path (tenant scope plus its `access.read` ownership) —
-// see parent-visibility.ts. `parents`, when set, is an ADDITIONAL allowlist
+// see shared/parent-visibility.ts. `parents`, when set, is an ADDITIONAL allowlist
 // narrowing which registered entities may be a note's parent at all; it is
 // not what turns the check on.
 export function createAddNoteHandler(

package/src/shared/index.ts

@@ -17,6 +17,7 @@ export { isWithinGracePeriod } from "./grace-period";
 export { hasWhereRule } from "./has-where-rule";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
+export { parentRowIsVisible } from "./parent-visibility";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
 export { sessionField } from "./session-field";
 export { sessionLocaleField } from "./session-locale-field";

package/src/{notes-history → shared}/parent-visibility.ts

@@ -15,10 +15,12 @@ function idShapeMatchesEntity(entity: EntityDefinition, entityId: string): boole
   return entity.idType === "serial" ? /^\d+$/.test(entityId) : isUuid(entityId);
 }
 
-// Checks whether a note's proposed (entityType, entityId) parent is one the
-// caller can see via the parent entity's own read path — tenant scope plus
-// its `access.read` ownership. Used to gate add-note when a `parents`
-// allowlist is configured (see feature.ts).
+// Checks whether a client-supplied (entityType, entityId) host reference is one
+// the caller can see via that entity's own read path — tenant scope plus its
+// `access.read` ownership. Shared by every handler that attaches something to a
+// host entity the client names (add-note, assign-tag, remove-tag, set-folder,
+// clear-folder); those handlers deny with NotFoundError so the response never
+// doubles as an existence oracle.
 export async function parentRowIsVisible(
   registry: Registry,
   entityType: string,

package/src/tags/__tests__/tags-parent-visibility.integration.test.ts

@@ -0,0 +1,219 @@
+// assign-tag/remove-tag previously took entityType/entityId straight from the
+// client, so any dispatch-eligible tenant user could attach a catalog tag to —
+// or detach one from — an object they had no read access to. The tag-assignment
+// aggregate-id is derived from the tenant, so this was never a cross-tenant
+// hole; it was "tag an object inside your own tenant that you aren't allowed to
+// read", which also leaks through the assignment list of anyone who can see it.
+//
+// The check is unconditional (default-on, no opt-in): entityType must name a
+// registered entity, and the host row must be visible through that entity's own
+// read path (tenant scope plus its `access.read` ownership).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { TagsHandlers } from "../constants";
+import { tagAssignmentEntity, tagEntity } from "../entity";
+import { createTagsFeature } from "../feature";
+
+const PROJECT_TABLE = "tags_pv_test_projects";
+
+// Team-scoped read ownership on the host entity itself — the caller sees a
+// project row only if their `team` claim matches the row's team_id.
+const projectOwnership: NonNullable<EntityDefinition["access"]> = {
+  read: {
+    TenantMember: {
+      kind: "where",
+      where: (user, ctx) => ({
+        sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+        params: [user.claims?.["team"] ?? null],
+      }),
+    },
+  },
+};
+
+const projectEntity = createEntity({
+  table: PROJECT_TABLE,
+  fields: {
+    teamId: createTextField({ required: true, maxLength: 64 }),
+    name: createTextField({ required: true, maxLength: 64 }),
+  },
+  access: projectOwnership,
+});
+
+const hostFixturesFeature = defineFeature("tags-pv-test-fixtures", (r) => {
+  r.entity("project", projectEntity);
+});
+
+type TestUser = ReturnType<typeof createTestUser>;
+
+// Same tenant, different team claim.
+const userA: TestUser = createTestUser({
+  id: 60,
+  roles: ["TenantMember"],
+  claims: { team: "team-a" },
+});
+const userB: TestUser = createTestUser({
+  id: 61,
+  roles: ["TenantMember"],
+  claims: { team: "team-b" },
+});
+
+const PROJECT_A = "b0000000-0000-4000-8000-000000000001";
+// A second team-a project, dedicated to the remove-tag denial case so its
+// assignment count stays independent of PROJECT_A's.
+const PROJECT_A2 = "b0000000-0000-4000-8000-000000000002";
+// Never assigned anything — the "no assignment" half of the oracle check.
+const PROJECT_A3 = "b0000000-0000-4000-8000-000000000003";
+
+let stack: TestStack;
+let tagId: string;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+  });
+  await unsafeCreateEntityTable(stack.db, tagEntity);
+  await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, projectEntity);
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES
+       ($1, $2, 'team-a', 'Project A'),
+       ($3, $2, 'team-a', 'Project A2'),
+       ($4, $2, 'team-a', 'Project A3')`,
+    [PROJECT_A, userA.tenantId, PROJECT_A2, PROJECT_A3],
+  );
+
+  const tag = await stack.http.writeOk<{ id: string }>(
+    TagsHandlers.createTag,
+    { name: "VIP" },
+    userA,
+  );
+  tagId = tag.id;
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function activeAssignmentsFor(entityId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe<{ n: number }>(
+    "SELECT count(*)::int AS n FROM read_tag_assignments WHERE entity_id = $1 AND is_deleted = FALSE",
+    [entityId],
+  );
+  return rows[0]?.n ?? 0;
+}
+
+function assign(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    TagsHandlers.assignTag,
+    { tagId, entityType, entityId },
+    user,
+  );
+}
+
+function assignErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(TagsHandlers.assignTag, { tagId, entityType, entityId }, user);
+}
+
+function remove(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    TagsHandlers.removeTag,
+    { tagId, entityType, entityId },
+    user,
+  );
+}
+
+function removeErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(TagsHandlers.removeTag, { tagId, entityType, entityId }, user);
+}
+
+describe("tags integration — assign-tag parent-visibility", () => {
+  test("a host row visible through the host entity's own read path can be tagged", async () => {
+    const result = await assign("project", PROJECT_A, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A)).toBe(1);
+  });
+
+  test("a host row from a foreign team is denied, and nothing is written", async () => {
+    const err = await assignErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+
+    // Positive control: PROJECT_A2 IS taggable — by its own team — so the deny
+    // above is the team-claim check, not a row that doesn't exist at all.
+    const result = await assign("project", PROJECT_A2, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await assignErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+
+  test("a malformed entityId is denied cleanly, without poisoning the connection", async () => {
+    const err = await assignErr("project", "not-a-uuid", userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+
+    // The stack must still be usable — proves the malformed id was rejected
+    // before it reached a query, not caught after a tx-poisoning cast error.
+    expect((await assign("project", PROJECT_A, userA)).id).toBeTruthy();
+  });
+});
+
+describe("tags integration — remove-tag parent-visibility", () => {
+  test("a foreign team cannot detach an existing assignment; the row survives", async () => {
+    await assign("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    const err = await removeErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    // Zero-write: the assignment userA made is still active, not soft-deleted.
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    // Positive control: the owning team CAN detach it.
+    await remove("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+  });
+
+  test("the denial carries no existence oracle: assigned and unassigned rows answer alike", async () => {
+    await assign("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+    expect(await activeAssignmentsFor(PROJECT_A3)).toBe(0);
+
+    // remove-tag normally reports success for a never-assigned pair, so without
+    // the gate running FIRST the two responses below would differ and leak
+    // whether the invisible host row carries this tag.
+    const onAssigned = await removeErr("project", PROJECT_A2, userB);
+    const onUnassigned = await removeErr("project", PROJECT_A3, userB);
+    expect(onAssigned.code).toBe(onUnassigned.code);
+    expect(onAssigned.httpStatus).toBe(onUnassigned.httpStatus);
+    expect(onAssigned.code).toBe("not_found");
+
+    await remove("project", PROJECT_A2, userA);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await removeErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+});

package/src/tags/__tests__/tags.integration.test.ts

@@ -7,9 +7,16 @@
 //   - read-layer composition both directions (tags of an entity / entities of a tag)
 //   - assign + remove are idempotent (re-assign = one row, remove-missing = ok)
 //   - multi-tenant isolation
+//
+// assign-tag/remove-tag verify that entityType names a registered entity and
+// that the host row is visible to the caller. This file's assertions are about
+// assignment mechanics, not parent ownership, so the `credit`/`note` fixtures
+// below stay unrestricted (no `access`) on purpose — every host row this file
+// tags is seeded in beforeAll.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -17,19 +24,77 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { v5 as uuidv5 } from "uuid";
 import { TagsHandlers, TagsQueries } from "../constants";
 import { tagAssignmentEntity, tagEntity } from "../entity";
 import { createTagsFeature } from "../feature";
 
 const tagsFeature = createTagsFeature();
 
+const CREDIT_TABLE = "tags_test_credits";
+const NOTE_TABLE = "tags_test_notes";
+const hostFields = { name: createTextField({ required: true, maxLength: 64 }) };
+const creditEntity = createEntity({ table: CREDIT_TABLE, fields: hostFields });
+const noteEntity = createEntity({ table: NOTE_TABLE, fields: hostFields });
+const hostFixturesFeature = defineFeature("tags-test-host-fixtures", (r) => {
+  r.entity("credit", creditEntity);
+  r.entity("note", noteEntity);
+});
+
+// The parent entity's ids are uuid-shaped, but the readable labels below carry
+// the intent of each case — derive one from the other instead of scattering
+// opaque uuid literals through the assertions.
+const HOST_FIXTURE_NAMESPACE = "6f1c4d2a-9b3e-4a7c-8d5f-1e2b3c4d5e6f";
+function hostId(label: string): string {
+  return uuidv5(label, HOST_FIXTURE_NAMESPACE);
+}
+
+const CREDIT_LABELS = [
+  "credit-1",
+  "credit-2",
+  "credit-3",
+  "credit-4",
+  "credit-5",
+  "credit-6",
+  "credit-7",
+  "credit-8",
+  "credit-d1",
+  "credit-r",
+  "credit-x",
+  ...Array.from({ length: 20 }, (_, i) => `credit-race-${i}`),
+];
+
+async function seedHostRows(
+  target: TestStack,
+  table: string,
+  labels: readonly string[],
+  tenantId: string,
+): Promise<void> {
+  for (const label of labels) {
+    await asRawClient(target.db).unsafe(
+      `INSERT INTO ${table} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [hostId(label), tenantId, label],
+    );
+  }
+}
+
 let stack: TestStack;
 
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+const otherTenant = createTestUser({
+  roles: ["TenantAdmin"],
+  tenantId: "00000000-0000-4000-8000-0000000000aa",
+});
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [tagsFeature] });
+  stack = await setupTestStack({ features: [tagsFeature, hostFixturesFeature] });
   await unsafeCreateEntityTable(stack.db, tagEntity);
   await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, creditEntity);
+  await unsafeCreateEntityTable(stack.db, noteEntity);
   await createEventsTable(stack.db);
+  await seedHostRows(stack, CREDIT_TABLE, CREDIT_LABELS, admin.tenantId);
+  await seedHostRows(stack, NOTE_TABLE, ["note-d1"], admin.tenantId);
 });
 
 afterAll(async () => {
@@ -42,12 +107,6 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM read_tag_assignments");
 });
 
-const admin = createTestUser({ roles: ["TenantAdmin"] });
-const otherTenant = createTestUser({
-  roles: ["TenantAdmin"],
-  tenantId: "00000000-0000-4000-8000-0000000000aa",
-});
-
 async function createTag(name: string, user = admin): Promise<string> {
   const tag = await stack.http.writeOk<{ id: string }>(TagsHandlers.createTag, { name }, user);
   return tag.id;
@@ -111,10 +170,14 @@ describe("tags integration — catalog + assignment roundtrip", () => {
 
   test("assign-tag → assignment queryable both composition directions", async () => {
     const tagId = await createTag("VIP");
-    await assign(tagId, "credit", "credit-1");
+    await assign(tagId, "credit", hostId("credit-1"));
 
     // tags of an entity
-    const byEntity = await listAssignments({ field: "entityId", op: "eq", value: "credit-1" });
+    const byEntity = await listAssignments({
+      field: "entityId",
+      op: "eq",
+      value: hostId("credit-1"),
+    });
     expect(byEntity).toHaveLength(1);
     expect(byEntity[0]?.["tagId"]).toBe(tagId);
     expect(byEntity[0]?.["entityType"]).toBe("credit");
@@ -122,17 +185,17 @@ describe("tags integration — catalog + assignment roundtrip", () => {
     // entities carrying a tag
     const byTag = await listAssignments({ field: "tagId", op: "eq", value: tagId });
     expect(byTag).toHaveLength(1);
-    expect(byTag[0]?.["entityId"]).toBe("credit-1");
+    expect(byTag[0]?.["entityId"]).toBe(hostId("credit-1"));
   });
 
   test("remove-tag deletes the assignment", async () => {
     const tagId = await createTag("temp");
-    await assign(tagId, "credit", "credit-2");
+    await assign(tagId, "credit", hostId("credit-2"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
 
-    await remove(tagId, "credit", "credit-2");
+    await remove(tagId, "credit", hostId("credit-2"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
-    const left = await listAssignments({ field: "entityId", op: "eq", value: "credit-2" });
+    const left = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-2") });
     expect(left).toHaveLength(0);
   });
 });
@@ -231,9 +294,9 @@ describe("tags integration — delete-tag cascade", () => {
     const target = await createTag("Sammelmappe");
     const other = await createTag("bleibt");
     // target spans two entityTypes; other tag stays attached to prove scoping
-    await assign(target, "credit", "credit-d1");
-    await assign(target, "note", "note-d1");
-    await assign(other, "credit", "credit-d1");
+    await assign(target, "credit", hostId("credit-d1"));
+    await assign(target, "note", hostId("note-d1"));
+    await assign(other, "credit", hostId("credit-d1"));
     expect(await countAssignments(admin.tenantId)).toBe(3);
 
     await deleteTag(target);
@@ -257,52 +320,54 @@ describe("tags integration — many-to-many composition", () => {
   test("one entity carries multiple tags", async () => {
     const a = await createTag("rot");
     const b = await createTag("wasser");
-    await assign(a, "credit", "credit-3");
-    await assign(b, "credit", "credit-3");
+    await assign(a, "credit", hostId("credit-3"));
+    await assign(b, "credit", hostId("credit-3"));
 
-    const tags = await listAssignments({ field: "entityId", op: "eq", value: "credit-3" });
+    const tags = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-3") });
     expect(tags.map((r) => r["tagId"]).sort()).toEqual([a, b].sort());
   });
 
   test("one tag spans multiple entities", async () => {
     const tagId = await createTag("Mappe-2026");
-    await assign(tagId, "credit", "credit-4");
-    await assign(tagId, "credit", "credit-5");
+    await assign(tagId, "credit", hostId("credit-4"));
+    await assign(tagId, "credit", hostId("credit-5"));
 
     const entities = await listAssignments({ field: "tagId", op: "eq", value: tagId });
-    expect(entities.map((r) => r["entityId"]).sort()).toEqual(["credit-4", "credit-5"]);
+    expect(entities.map((r) => r["entityId"]).sort()).toEqual(
+      [hostId("credit-4"), hostId("credit-5")].sort(),
+    );
   });
 });
 
 describe("tags integration — idempotency", () => {
   test("re-assigning the same (tag, entity) keeps exactly one row", async () => {
     const tagId = await createTag("dup");
-    await assign(tagId, "credit", "credit-6");
-    await assign(tagId, "credit", "credit-6"); // re-assign: must be a no-op success
+    await assign(tagId, "credit", hostId("credit-6"));
+    await assign(tagId, "credit", hostId("credit-6")); // re-assign: must be a no-op success
 
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    const rows = await listAssignments({ field: "entityId", op: "eq", value: "credit-6" });
+    const rows = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-6") });
     expect(rows).toHaveLength(1);
   });
 
   test("removing a never-assigned (tag, entity) succeeds (no error, no row)", async () => {
     const tagId = await createTag("ghost");
     // never assigned — remove must still succeed (idempotent end-state)
-    await remove(tagId, "credit", "credit-7");
+    await remove(tagId, "credit", hostId("credit-7"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
   });
 
   test("assign → remove → assign-again resurrects the same deterministic stream", async () => {
     const tagId = await createTag("recurring");
-    await assign(tagId, "credit", "credit-r");
-    await remove(tagId, "credit", "credit-r");
+    await assign(tagId, "credit", hostId("credit-r"));
+    await remove(tagId, "credit", hostId("credit-r"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
 
     // Re-attaching the same (tag, entity) must succeed (restore), not 409 — the
     // deterministic aggregate-id reuses the removed stream.
-    await assign(tagId, "credit", "credit-r");
+    await assign(tagId, "credit", hostId("credit-r"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    const rows = await listAssignments({ field: "entityId", op: "eq", value: "credit-r" });
+    const rows = await listAssignments({ field: "entityId", op: "eq", value: hostId("credit-r") });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["tagId"]).toBe(tagId);
   });
@@ -319,7 +384,7 @@ describe("tags integration — idempotency", () => {
       // The handler must converge that into success instead of surfacing a 409
       // for what is, from the caller's perspective, an idempotent operation.
       const tagId = await createTag(`racy-${i}`);
-      const entityId = `credit-race-${i}`;
+      const entityId = hostId(`credit-race-${i}`);
       const [a, b] = await Promise.all([
         assign(tagId, "credit", entityId),
         assign(tagId, "credit", entityId),
@@ -336,7 +401,11 @@ describe("tags integration — referential integrity", () => {
   test("assigning an unknown tagId is rejected (no dangling assignment)", async () => {
     const err = await stack.http.writeErr(
       TagsHandlers.assignTag,
-      { tagId: "00000000-0000-4000-8000-00000000dead", entityType: "credit", entityId: "credit-x" },
+      {
+        tagId: "00000000-0000-4000-8000-00000000dead",
+        entityType: "credit",
+        entityId: hostId("credit-x"),
+      },
       admin,
     );
     expect(err.httpStatus).toBe(404);
@@ -347,11 +416,14 @@ describe("tags integration — referential integrity", () => {
 describe("tags integration — multi-tenant isolation", () => {
   test("tenant B sees neither tenant A's tags nor assignments", async () => {
     const tagId = await createTag("A-only", admin);
-    await assign(tagId, "credit", "credit-8", admin);
+    await assign(tagId, "credit", hostId("credit-8"), admin);
 
     expect(await listTags(otherTenant)).toHaveLength(0);
     expect(
-      await listAssignments({ field: "entityId", op: "eq", value: "credit-8" }, otherTenant),
+      await listAssignments(
+        { field: "entityId", op: "eq", value: hostId("credit-8") },
+        otherTenant,
+      ),
     ).toHaveLength(0);
 
     // tenant A still sees its own
@@ -378,11 +450,13 @@ describe("tags integration — openToAll access model", () => {
 
   beforeAll(async () => {
     openStack = await setupTestStack({
-      features: [createTagsFeature({ access: { openToAll: true } })],
+      features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
     });
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
+    await unsafeCreateEntityTable(openStack.db, creditEntity);
     await createEventsTable(openStack.db);
+    await seedHostRows(openStack, CREDIT_TABLE, ["c-1"], unprivileged.tenantId);
 
     defaultStack = await setupTestStack({ features: [tagsFeature] });
     await unsafeCreateEntityTable(defaultStack.db, tagEntity);
@@ -403,7 +477,7 @@ describe("tags integration — openToAll access model", () => {
     );
     await openStack.http.writeOk(
       TagsHandlers.assignTag,
-      { tagId: tag.id, entityType: "credit", entityId: "c-1" },
+      { tagId: tag.id, entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
 
@@ -416,14 +490,14 @@ describe("tags integration — openToAll access model", () => {
 
     const assigned = await openStack.http.queryOk<{ rows: unknown[] }>(
       TagsQueries.assignmentList,
-      { filter: { field: "entityId", op: "eq", value: "c-1" } },
+      { filter: { field: "entityId", op: "eq", value: hostId("c-1") } },
       unprivileged,
     );
     expect(assigned.rows).toHaveLength(1);
 
     await openStack.http.writeOk(
       TagsHandlers.removeTag,
-      { tagId: tag.id, entityType: "credit", entityId: "c-1" },
+      { tagId: tag.id, entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
   });

package/src/tags/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.246.0",
+    "type": "improvement",
+    "title": "assign-tag and remove-tag now verify entityType/entityId against the host entity's own read path",
+    "detail": "Before this change, assign-tag and remove-tag took entityType/entityId straight from the client with no check — any dispatch-eligible tenant user could attach a catalog tag to, or detach one from, any object in their tenant, including one they could not otherwise read. The tag-assignment aggregate-id is derived from the tenant, so this was never a cross-tenant hole; it was tagging inside your own tenant across a row-level ownership boundary. Both handlers now unconditionally verify that entityType names a registered entity and that the host row is visible to the caller through that entity's own read path (tenant scope plus its `access.read` ownership) before touching the assignment; either check failing returns a not_found response, the same answer a genuinely missing row gets, so nothing doubles as an existence oracle. The check runs before the assignment and tag lookups, so a denied caller cannot tell an invisible host row apart from a missing assignment. This mirrors the add-note gate shipped in 0.244.0 and shares its helper.",
+    "migration": "entityType must now name an entity registered in the same app (via r.entity(...) or a bundled feature), and the caller must be able to see the target row through that entity's own read path. Any consumer that called assign-tag or remove-tag with an entityType that is NOT a registered entity name, or with an entityId the caller could not otherwise read, will now get a not_found error instead of a successful write — register the host entity (and, if it needs row-level ownership, its `access.read` rule) before upgrading. Note the consequence for hard-deleted host rows: once the host row is gone, its assignment can no longer be removed through remove-tag; delete-tag's cascade still detaches it."
+  }
+]