@cosmicdrift/kumiko-bundled-features 0.245.0 → 0.247.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.245.0",
+  "version": "0.247.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.245.0",
-    "@cosmicdrift/kumiko-framework": "0.245.0",
-    "@cosmicdrift/kumiko-headless": "0.245.0",
-    "@cosmicdrift/kumiko-renderer": "0.245.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.245.0",
-    "@cosmicdrift/kumiko-types": "0.245.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.247.0",
+    "@cosmicdrift/kumiko-framework": "0.247.0",
+    "@cosmicdrift/kumiko-headless": "0.247.0",
+    "@cosmicdrift/kumiko-renderer": "0.247.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.247.0",
+    "@cosmicdrift/kumiko-types": "0.247.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.245.0",
-    "@cosmicdrift/kumiko-locale-es": "0.245.0"
+    "@cosmicdrift/kumiko-locale-de": "0.247.0",
+    "@cosmicdrift/kumiko-locale-es": "0.247.0"
   }
 }

package/src/custom-fields/lib/define-or-resurrect.ts

@@ -20,8 +20,8 @@ type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;
 // restore-before-create matters: a create() version_conflict aborts the
 // surrounding tx, so a follow-up restore()/update() on the same connection would
 // fail with "current transaction is aborted". detail() (a read) + restore()
-// (which sees soft-deleted rows via selectMany and only writes on success) keep
-// the tx clean until the single terminal write.
+// (which sees soft-deleted rows via a tenant-scoped fetch and only writes on
+// success) keep the tx clean until the single terminal write.
 export async function defineOrResurrectFieldDefinition(
   aggregateId: string,
   columns: FieldDefinitionColumns,

package/src/folders/__tests__/folders-parent-visibility.integration.test.ts

@@ -0,0 +1,238 @@
+// set-folder/clear-folder previously took entityType/entityId straight from the
+// client, so any dispatch-eligible tenant user could file — or unfile — an
+// object they had no read access to. The folder-assignment aggregate-id is
+// derived from the tenant, so this was never a cross-tenant hole; it was "file
+// an object inside your own tenant that you aren't allowed to read", which also
+// moves it out of whatever folder its own team had put it in.
+//
+// The check is unconditional (default-on, no opt-in): entityType must name a
+// registered entity, and the host row must be visible through that entity's own
+// read path (tenant scope plus its `access.read` ownership).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { FoldersHandlers } from "../constants";
+import { folderAssignmentEntity, folderEntity } from "../entity";
+import { createFoldersFeature } from "../feature";
+
+const PROJECT_TABLE = "folders_pv_test_projects";
+
+// Team-scoped read ownership on the host entity itself — the caller sees a
+// project row only if their `team` claim matches the row's team_id.
+const projectOwnership: NonNullable<EntityDefinition["access"]> = {
+  read: {
+    TenantMember: {
+      kind: "where",
+      where: (user, ctx) => ({
+        sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+        params: [user.claims?.["team"] ?? null],
+      }),
+    },
+  },
+};
+
+const projectEntity = createEntity({
+  table: PROJECT_TABLE,
+  fields: {
+    teamId: createTextField({ required: true, maxLength: 64 }),
+    name: createTextField({ required: true, maxLength: 64 }),
+  },
+  access: projectOwnership,
+});
+
+const hostFixturesFeature = defineFeature("folders-pv-test-fixtures", (r) => {
+  r.entity("project", projectEntity);
+});
+
+type TestUser = ReturnType<typeof createTestUser>;
+
+// Same tenant, different team claim.
+const userA: TestUser = createTestUser({
+  id: 70,
+  roles: ["TenantMember"],
+  claims: { team: "team-a" },
+});
+const userB: TestUser = createTestUser({
+  id: 71,
+  roles: ["TenantMember"],
+  claims: { team: "team-b" },
+});
+
+const PROJECT_A = "c0000000-0000-4000-8000-000000000001";
+// A second team-a project, dedicated to the clear-folder denial case so its
+// membership stays independent of PROJECT_A's.
+const PROJECT_A2 = "c0000000-0000-4000-8000-000000000002";
+// Never filed anywhere — the "no assignment" half of the oracle check.
+const PROJECT_A3 = "c0000000-0000-4000-8000-000000000003";
+
+let stack: TestStack;
+let folderId: string;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createFoldersFeature({ access: { openToAll: true } }), hostFixturesFeature],
+  });
+  await unsafeCreateEntityTable(stack.db, folderEntity);
+  await unsafeCreateEntityTable(stack.db, folderAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, projectEntity);
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES
+       ($1, $2, 'team-a', 'Project A'),
+       ($3, $2, 'team-a', 'Project A2'),
+       ($4, $2, 'team-a', 'Project A3')`,
+    [PROJECT_A, userA.tenantId, PROJECT_A2, PROJECT_A3],
+  );
+
+  const folder = await stack.http.writeOk<{ id: string }>(
+    FoldersHandlers.createFolder,
+    { name: "Inbox" },
+    userA,
+  );
+  folderId = folder.id;
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function activeAssignmentsFor(entityId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe<{ n: number }>(
+    "SELECT count(*)::int AS n FROM read_folder_assignments WHERE entity_id = $1 AND is_deleted = FALSE",
+    [entityId],
+  );
+  return rows[0]?.n ?? 0;
+}
+
+function setFolder(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    FoldersHandlers.setFolder,
+    { folderId, entityType, entityId },
+    user,
+  );
+}
+
+function setFolderErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(FoldersHandlers.setFolder, { folderId, entityType, entityId }, user);
+}
+
+function clearFolder(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeOk<{ id: string }>(
+    FoldersHandlers.clearFolder,
+    { entityType, entityId },
+    user,
+  );
+}
+
+function clearFolderErr(entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(FoldersHandlers.clearFolder, { entityType, entityId }, user);
+}
+
+describe("folders integration — set-folder parent-visibility", () => {
+  test("a host row visible through the host entity's own read path can be filed", async () => {
+    const result = await setFolder("project", PROJECT_A, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A)).toBe(1);
+  });
+
+  test("a host row from a foreign team is denied, and nothing is written", async () => {
+    const err = await setFolderErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+
+    // Positive control: PROJECT_A2 IS filable — by its own team — so the deny
+    // above is the team-claim check, not a row that doesn't exist at all.
+    const result = await setFolder("project", PROJECT_A2, userA);
+    expect(result.id).toBeTruthy();
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+  });
+
+  test("the denial precedes the folder lookup: an unknown folderId reports the host row, not the folder", async () => {
+    // Gate first means a caller who can't see the host row learns nothing about
+    // which folder ids exist — both cases answer with the same not_found.
+    const unknownFolder = await stack.http.writeErr(
+      FoldersHandlers.setFolder,
+      {
+        folderId: "00000000-0000-4000-8000-00000000dead",
+        entityType: "project",
+        entityId: PROJECT_A3,
+      },
+      userB,
+    );
+    const knownFolder = await setFolderErr("project", PROJECT_A3, userB);
+    expect(unknownFolder.code).toBe(knownFolder.code);
+    expect(unknownFolder.httpStatus).toBe(knownFolder.httpStatus);
+    expect(knownFolder.code).toBe("not_found");
+    expect(await activeAssignmentsFor(PROJECT_A3)).toBe(0);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await setFolderErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+
+  test("a malformed entityId is denied cleanly, without poisoning the connection", async () => {
+    const err = await setFolderErr("project", "not-a-uuid", userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+
+    // The stack must still be usable — proves the malformed id was rejected
+    // before it reached a query, not caught after a tx-poisoning cast error.
+    expect((await setFolder("project", PROJECT_A, userA)).id).toBeTruthy();
+  });
+});
+
+describe("folders integration — clear-folder parent-visibility", () => {
+  test("a foreign team cannot unfile an existing membership; the row survives", async () => {
+    await setFolder("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    const err = await clearFolderErr("project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    // Zero-write: the membership userA created is still active, not soft-deleted.
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+
+    // Positive control: the owning team CAN unfile it.
+    await clearFolder("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(0);
+  });
+
+  test("the denial carries no existence oracle: filed and unfiled rows answer alike", async () => {
+    await setFolder("project", PROJECT_A2, userA);
+    expect(await activeAssignmentsFor(PROJECT_A2)).toBe(1);
+    expect(await activeAssignmentsFor(PROJECT_A3)).toBe(0);
+
+    // clear-folder normally reports success for a never-filed entity, so without
+    // the gate running FIRST the two responses below would differ and leak
+    // whether the invisible host row sits in a folder at all.
+    const onFiled = await clearFolderErr("project", PROJECT_A2, userB);
+    const onUnfiled = await clearFolderErr("project", PROJECT_A3, userB);
+    expect(onFiled.code).toBe(onUnfiled.code);
+    expect(onFiled.httpStatus).toBe(onUnfiled.httpStatus);
+    expect(onFiled.code).toBe("not_found");
+
+    await clearFolder("project", PROJECT_A2, userA);
+  });
+
+  test("an entityType that is not a registered entity is denied", async () => {
+    const err = await clearFolderErr("totally-unknown-entity", PROJECT_A, userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+});

package/src/folders/__tests__/folders.integration.test.ts

@@ -8,9 +8,16 @@
 //     defining difference from tags' many-to-many
 //   - clear-folder unfiles; set → clear → set resurrects the deterministic stream
 //   - referential integrity (unknown folderId rejected) + multi-tenant isolation
+//
+// set-folder/clear-folder verify that entityType names a registered entity and
+// that the host row is visible to the caller. This file's assertions are about
+// membership mechanics, not parent ownership, so the `credit` fixture below
+// stays unrestricted (no `access`) on purpose — every host row this file files
+// is seeded in beforeAll.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -18,6 +25,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { v5 as uuidv5 } from "uuid";
 import { folderAssignmentDeleteHook, folderDeleteHook } from "../../folders-user-data/hooks";
 import { FoldersHandlers, FoldersQueries } from "../constants";
 import { folderAssignmentEntity, folderEntity } from "../entity";
@@ -25,13 +33,65 @@ import { createFoldersFeature } from "../feature";
 
 const foldersFeature = createFoldersFeature();
 
+const CREDIT_TABLE = "folders_test_credits";
+const creditEntity = createEntity({
+  table: CREDIT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const hostFixturesFeature = defineFeature("folders-test-host-fixtures", (r) => {
+  r.entity("credit", creditEntity);
+});
+
+// The parent entity's ids are uuid-shaped, but the readable labels below carry
+// the intent of each case — derive one from the other instead of scattering
+// opaque uuid literals through the assertions.
+const HOST_FIXTURE_NAMESPACE = "2c8a5f13-7d64-4b90-ae52-0f3d6c9b81e4";
+function hostId(label: string): string {
+  return uuidv5(label, HOST_FIXTURE_NAMESPACE);
+}
+
+const CREDIT_LABELS = [
+  "credit-1",
+  "credit-2",
+  "credit-3",
+  "credit-8",
+  "credit-never",
+  "credit-r",
+  "credit-x",
+  "credit-occupied",
+  "credit-occupied-2",
+  "credit-erase",
+  "c-y",
+];
+
+async function seedHostRows(
+  target: TestStack,
+  labels: readonly string[],
+  tenantId: string,
+): Promise<void> {
+  for (const label of labels) {
+    await asRawClient(target.db).unsafe(
+      `INSERT INTO ${CREDIT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [hostId(label), tenantId, label],
+    );
+  }
+}
+
 let stack: TestStack;
 
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+const otherTenant = createTestUser({
+  roles: ["TenantAdmin"],
+  tenantId: "00000000-0000-4000-8000-0000000000aa",
+});
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [foldersFeature] });
+  stack = await setupTestStack({ features: [foldersFeature, hostFixturesFeature] });
   await unsafeCreateEntityTable(stack.db, folderEntity);
   await unsafeCreateEntityTable(stack.db, folderAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, creditEntity);
   await createEventsTable(stack.db);
+  await seedHostRows(stack, CREDIT_LABELS, admin.tenantId);
 });
 
 afterAll(async () => {
@@ -44,12 +104,6 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM read_folder_assignments");
 });
 
-const admin = createTestUser({ roles: ["TenantAdmin"] });
-const otherTenant = createTestUser({
-  roles: ["TenantAdmin"],
-  tenantId: "00000000-0000-4000-8000-0000000000aa",
-});
-
 async function createFolder(name: string, parentId?: string, user = admin): Promise<string> {
   const payload = parentId === undefined ? { name } : { name, parentId };
   const folder = await stack.http.writeOk<{ id: string }>(
@@ -126,9 +180,9 @@ describe("folders integration — catalog (tree)", () => {
 describe("folders integration — single-membership set / move / clear", () => {
   test("set-folder files an entity; assignment is queryable", async () => {
     const f = await createFolder("Gruppe A");
-    await setFolder(f, "credit-1");
+    await setFolder(f, hostId("credit-1"));
 
-    const rows = await assignmentsOf("credit-1");
+    const rows = await assignmentsOf(hostId("credit-1"));
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["folderId"]).toBe(f);
     expect(rows[0]?.["entityType"]).toBe("credit");
@@ -137,56 +191,56 @@ describe("folders integration — single-membership set / move / clear", () => {
   test("re-setting to a different folder MOVES (still exactly one row)", async () => {
     const a = await createFolder("A");
     const b = await createFolder("B");
-    await setFolder(a, "credit-1");
+    await setFolder(a, hostId("credit-1"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
 
-    await setFolder(b, "credit-1"); // MOVE, not a second assignment
+    await setFolder(b, hostId("credit-1")); // MOVE, not a second assignment
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    const rows = await assignmentsOf("credit-1");
+    const rows = await assignmentsOf(hostId("credit-1"));
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["folderId"]).toBe(b);
   });
 
   test("set the same folder twice is an idempotent no-op (one row)", async () => {
     const f = await createFolder("dup");
-    await setFolder(f, "credit-2");
-    await setFolder(f, "credit-2");
+    await setFolder(f, hostId("credit-2"));
+    await setFolder(f, hostId("credit-2"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
   });
 
   test("clear-folder unfiles the entity", async () => {
     const f = await createFolder("temp");
-    await setFolder(f, "credit-3");
+    await setFolder(f, hostId("credit-3"));
     expect(await countAssignments(admin.tenantId)).toBe(1);
 
-    await clearFolder("credit-3");
+    await clearFolder(hostId("credit-3"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
-    expect(await assignmentsOf("credit-3")).toHaveLength(0);
+    expect(await assignmentsOf(hostId("credit-3"))).toHaveLength(0);
   });
 
   test("clearing a never-filed entity succeeds (idempotent end-state)", async () => {
-    await clearFolder("credit-never");
+    await clearFolder(hostId("credit-never"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
   });
 
   test("set → clear → set resurrects the same deterministic stream", async () => {
     const f = await createFolder("recurring");
-    await setFolder(f, "credit-r");
-    await clearFolder("credit-r");
+    await setFolder(f, hostId("credit-r"));
+    await clearFolder(hostId("credit-r"));
     expect(await countAssignments(admin.tenantId)).toBe(0);
 
-    await setFolder(f, "credit-r"); // restore, not 409
+    await setFolder(f, hostId("credit-r")); // restore, not 409
     expect(await countAssignments(admin.tenantId)).toBe(1);
-    expect((await assignmentsOf("credit-r"))[0]?.["folderId"]).toBe(f);
+    expect((await assignmentsOf(hostId("credit-r")))[0]?.["folderId"]).toBe(f);
   });
 
   test("set → clear → set into a DIFFERENT folder lands in the new folder", async () => {
     const a = await createFolder("A");
     const b = await createFolder("B");
-    await setFolder(a, "credit-x");
-    await clearFolder("credit-x");
-    await setFolder(b, "credit-x"); // restore + update folderId to b
-    const rows = await assignmentsOf("credit-x");
+    await setFolder(a, hostId("credit-x"));
+    await clearFolder(hostId("credit-x"));
+    await setFolder(b, hostId("credit-x")); // restore + update folderId to b
+    const rows = await assignmentsOf(hostId("credit-x"));
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["folderId"]).toBe(b);
   });
@@ -195,7 +249,7 @@ describe("folders integration — single-membership set / move / clear", () => {
 describe("folders integration — delete blocks on live assignments (658/1)", () => {
   test("deleting a folder that still holds an assignment is rejected, row survives", async () => {
     const f = await createFolder("occupied");
-    await setFolder(f, "credit-occupied");
+    await setFolder(f, hostId("credit-occupied"));
 
     const err = await stack.http.writeErr(FoldersHandlers.deleteFolder, { id: f }, admin);
     expect(err.httpStatus).toBe(422);
@@ -210,8 +264,8 @@ describe("folders integration — delete blocks on live assignments (658/1)", ()
 
   test("clearing the assignment first unblocks the delete", async () => {
     const f = await createFolder("occupied-then-cleared");
-    await setFolder(f, "credit-occupied-2");
-    await clearFolder("credit-occupied-2");
+    await setFolder(f, hostId("credit-occupied-2"));
+    await clearFolder(hostId("credit-occupied-2"));
 
     await stack.http.writeOk(FoldersHandlers.deleteFolder, { id: f }, admin);
     expect((await listFolders()).some((row) => row["id"] === f)).toBe(false);
@@ -240,7 +294,11 @@ describe("folders integration — referential integrity", () => {
   test("set-folder with an unknown folderId is rejected (no dangling assignment)", async () => {
     const err = await stack.http.writeErr(
       FoldersHandlers.setFolder,
-      { folderId: "00000000-0000-4000-8000-00000000dead", entityType: "credit", entityId: "c-y" },
+      {
+        folderId: "00000000-0000-4000-8000-00000000dead",
+        entityType: "credit",
+        entityId: hostId("c-y"),
+      },
       admin,
     );
     expect(err.httpStatus).toBe(404);
@@ -251,10 +309,10 @@ describe("folders integration — referential integrity", () => {
 describe("folders integration — multi-tenant isolation", () => {
   test("tenant B sees neither tenant A's folders nor assignments", async () => {
     const f = await createFolder("A-only", undefined, admin);
-    await setFolder(f, "credit-8", admin);
+    await setFolder(f, hostId("credit-8"), admin);
 
     expect(await listFolders(otherTenant)).toHaveLength(0);
-    expect(await assignmentsOf("credit-8", otherTenant)).toHaveLength(0);
+    expect(await assignmentsOf(hostId("credit-8"), otherTenant)).toHaveLength(0);
 
     expect(await listFolders(admin)).toHaveLength(1);
     expect(await countAssignments(admin.tenantId)).toBe(1);
@@ -271,11 +329,13 @@ describe("folders integration — openToAll access model", () => {
 
   beforeAll(async () => {
     openStack = await setupTestStack({
-      features: [createFoldersFeature({ access: { openToAll: true } })],
+      features: [createFoldersFeature({ access: { openToAll: true } }), hostFixturesFeature],
     });
     await unsafeCreateEntityTable(openStack.db, folderEntity);
     await unsafeCreateEntityTable(openStack.db, folderAssignmentEntity);
+    await unsafeCreateEntityTable(openStack.db, creditEntity);
     await createEventsTable(openStack.db);
+    await seedHostRows(openStack, ["c-1"], unprivileged.tenantId);
   });
 
   afterAll(async () => {
@@ -290,7 +350,7 @@ describe("folders integration — openToAll access model", () => {
     );
     await openStack.http.writeOk(
       FoldersHandlers.setFolder,
-      { folderId: folder.id, entityType: "credit", entityId: "c-1" },
+      { folderId: folder.id, entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
     const folders = await openStack.http.queryOk<{ rows: unknown[] }>(
@@ -301,7 +361,7 @@ describe("folders integration — openToAll access model", () => {
     expect(folders.rows).toHaveLength(1);
     await openStack.http.writeOk(
       FoldersHandlers.clearFolder,
-      { entityType: "credit", entityId: "c-1" },
+      { entityType: "credit", entityId: hostId("c-1") },
       unprivileged,
     );
   });
@@ -324,7 +384,7 @@ describe("folders integration — openToAll access model", () => {
 describe("folders-user-data — tenantScopedDelete hooks", () => {
   async function seedOneFolderWithAssignment(): Promise<void> {
     const f = await createFolder("to-be-erased");
-    await setFolder(f, "credit-erase");
+    await setFolder(f, hostId("credit-erase"));
   }
 
   test("multi-user tenant: no-op, rows survive", async () => {

package/src/folders/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.246.0",
+    "type": "improvement",
+    "title": "set-folder and clear-folder now verify entityType/entityId against the host entity's own read path",
+    "detail": "Before this change, set-folder and clear-folder took entityType/entityId straight from the client with no check — any dispatch-eligible tenant user could file, move or unfile any object in their tenant, including one they could not otherwise read, and moving it out of whatever folder its owning team had put it in. The folder-assignment aggregate-id is derived from the tenant, so this was never a cross-tenant hole; it was filing inside your own tenant across a row-level ownership boundary. Both handlers now unconditionally verify that entityType names a registered entity and that the host row is visible to the caller through that entity's own read path (tenant scope plus its `access.read` ownership) before touching the membership; either check failing returns a not_found response, the same answer a genuinely missing row gets, so nothing doubles as an existence oracle. The check runs before the folder lookup, so a denied caller learns nothing about which folder ids exist. This mirrors the add-note gate shipped in 0.244.0 and shares its helper.",
+    "migration": "entityType must now name an entity registered in the same app (via r.entity(...) or a bundled feature), and the caller must be able to see the target row through that entity's own read path. Any consumer that called set-folder or clear-folder with an entityType that is NOT a registered entity name, or with an entityId the caller could not otherwise read, will now get a not_found error instead of a successful write — register the host entity (and, if it needs row-level ownership, its `access.read` rule) before upgrading. Note the consequence for hard-deleted host rows: once the host row is gone, its folder-assignment can no longer be cleared, and folder:delete keeps refusing while that assignment points at the folder."
+  }
+]

package/src/folders/handlers/clear-folder.write.ts

@@ -1,4 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parentRowIsVisible } from "../../shared";
 import { folderAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_FOLDER_ACCESS } from "../constants";
 import { folderAssignmentExecutor } from "../executor";
@@ -7,6 +9,10 @@ import { type ClearFolderPayload, clearFolderPayloadSchema } from "../schemas";
 // clear-folder — removes a host entity from its folder (back to "unfiled").
 // Idempotent: clearing an entity that isn't in any folder is already the
 // requested end state, so we pre-check and return success without a delete.
+//
+// Host reference: entityType/entityId are client input, so the caller must be
+// able to see the host row before unfiling it — see
+// shared/parent-visibility.ts.
 export function createClearFolderHandler(
   access: AccessRule = DEFAULT_FOLDER_ACCESS,
 ): WriteHandlerDef {
@@ -18,6 +24,24 @@ export function createClearFolderHandler(
       "Unfiles a host entity so it sits in no folder at all, reporting success when it was already unfiled; use it to take an entity out of its folder without touching the folder itself.",
     handler: async (event, ctx) => {
       const payload = event.payload as ClearFolderPayload; // @cast-boundary engine-payload
+      // entityType/entityId are client input: the caller must be able to see
+      // the host row through that entity's own read path (tenant scope plus its
+      // `access.read` ownership) before its assignment row may be written.
+      // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
+      // an invisible parent apart from a missing assignment or an unknown folder —
+      // every path answers with the same NotFoundError.
+      if (
+        !(await parentRowIsVisible(
+          ctx.registry,
+          payload.entityType,
+          payload.entityId,
+          event.user,
+          ctx.db,
+        ))
+      ) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       const id = folderAssignmentAggregateId(
         event.user.tenantId,
         payload.entityType,

package/src/folders/handlers/set-folder.write.ts

@@ -1,5 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parentRowIsVisible } from "../../shared";
 import { folderAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_FOLDER_ACCESS } from "../constants";
 import { folderAssignmentExecutor, folderExecutor } from "../executor";
@@ -23,6 +24,11 @@ import { type SetFolderPayload, setFolderPayloadSchema } from "../schemas";
 // Referential integrity: there is no FK (event-sourced, no JOIN), so we verify
 // the target folder exists before writing — a malformed call with an unknown
 // folderId would otherwise point an entity at a phantom folder.
+//
+// Host reference: entityType/entityId are never trusted client input either —
+// the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
+// without the check any dispatch-eligible tenant user could file an object they
+// are not allowed to read. See shared/parent-visibility.ts.
 export function createSetFolderHandler(
   access: AccessRule = DEFAULT_FOLDER_ACCESS,
 ): WriteHandlerDef {
@@ -34,6 +40,24 @@ export function createSetFolderHandler(
       "Files a host entity into one existing folder and moves it out of whatever folder it was in, since an entity belongs to at most one folder; use it for both the first filing and every later move.",
     handler: async (event, ctx) => {
       const payload = event.payload as SetFolderPayload; // @cast-boundary engine-payload
+      // entityType/entityId are client input: the caller must be able to see
+      // the host row through that entity's own read path (tenant scope plus its
+      // `access.read` ownership) before its assignment row may be written.
+      // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
+      // an invisible parent apart from a missing assignment or an unknown folder —
+      // every path answers with the same NotFoundError.
+      if (
+        !(await parentRowIsVisible(
+          ctx.registry,
+          payload.entityType,
+          payload.entityId,
+          event.user,
+          ctx.db,
+        ))
+      ) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       const id = folderAssignmentAggregateId(
         event.user.tenantId,
         payload.entityType,