@cosmicdrift/kumiko-bundled-features 0.256.0 → 0.258.0

package/src/tags/__tests__/tags-read-gate.integration.test.ts

@@ -0,0 +1,366 @@
+// The read twin of tags-parent-visibility.integration.test.ts (fw#2766).
+// assign/remove were gated against the host row's own read path since
+// #2721/#2745, but `tag-assignment:list` returned every row of the tenant —
+// including assignments on host rows the caller could never see. Closing that
+// is default-on: none of the mounts below set `ownership`, which used to be
+// the only lever.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { TagsHandlers, TagsQueries } from "../constants";
+import { tagAssignmentEntity, tagEntity } from "../entity";
+import { createTagsFeature } from "../feature";
+
+const PROJECT_TABLE = "tags_rg_test_projects";
+
+const projectOwnership: NonNullable<EntityDefinition["access"]> = {
+  read: {
+    TenantMember: {
+      kind: "where",
+      where: (user, ctx) => ({
+        sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+        params: [user.claims?.["team"] ?? null],
+      }),
+    },
+  },
+};
+
+const projectEntity = createEntity({
+  table: PROJECT_TABLE,
+  fields: {
+    teamId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
+  access: projectOwnership,
+});
+
+const hostFixturesFeature = defineFeature("tags-rg-test-fixtures", (r) => {
+  r.entity("project", projectEntity);
+});
+
+type TestUser = ReturnType<typeof createTestUser>;
+
+const userA: TestUser = createTestUser({
+  id: 70,
+  roles: ["TenantMember"],
+  claims: { team: "team-a" },
+});
+const userB: TestUser = createTestUser({
+  id: 71,
+  roles: ["TenantMember"],
+  claims: { team: "team-b" },
+});
+
+// 4 projects for team-a, 3 for team-b — every one of them carries the same
+// tag, so the tagId scatter query below has a mixed-visibility result set.
+const TEAM_A_PROJECTS = [
+  "c0000000-0000-4000-8000-00000000000a",
+  "c0000000-0000-4000-8000-00000000000b",
+  "c0000000-0000-4000-8000-00000000000c",
+  "c0000000-0000-4000-8000-00000000000d",
+];
+const TEAM_B_PROJECTS = [
+  "c0000000-0000-4000-8000-00000000001a",
+  "c0000000-0000-4000-8000-00000000001b",
+  "c0000000-0000-4000-8000-00000000001c",
+];
+// Referenced by an assignment row but registered under no entity name.
+const ORPHAN_HOST_ID = "c0000000-0000-4000-8000-0000000000ff";
+
+type AssignmentRow = { id: string; tagId: string; entityType: string; entityId: string };
+type Page = { rows: readonly AssignmentRow[]; nextCursor: string | null; total?: number };
+
+let stack: TestStack;
+let tagId: string;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    // Deliberately no `ownership` — the gate must hold on a bare mount.
+    features: [createTagsFeature({ access: { openToAll: true } }), hostFixturesFeature],
+  });
+  await unsafeCreateEntityTable(stack.db, tagEntity);
+  await unsafeCreateEntityTable(stack.db, tagAssignmentEntity);
+  await unsafeCreateEntityTable(stack.db, projectEntity);
+  await createEventsTable(stack.db);
+
+  const values = [...TEAM_A_PROJECTS, ...TEAM_B_PROJECTS]
+    .map((id, i) => `('${id}', $1, '${i < TEAM_A_PROJECTS.length ? "team-a" : "team-b"}', 'p${i}')`)
+    .join(", ");
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES ${values}`,
+    [userA.tenantId],
+  );
+
+  const tag = await stack.http.writeOk<{ id: string }>(
+    TagsHandlers.createTag,
+    { name: "VIP" },
+    userA,
+  );
+  tagId = tag.id;
+
+  for (const id of TEAM_A_PROJECTS) {
+    await stack.http.writeOk(
+      TagsHandlers.assignTag,
+      { tagId, entityType: "project", entityId: id },
+      userA,
+    );
+  }
+  for (const id of TEAM_B_PROJECTS) {
+    await stack.http.writeOk(
+      TagsHandlers.assignTag,
+      { tagId, entityType: "project", entityId: id },
+      userB,
+    );
+  }
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+function listAssignments(payload: Record<string, unknown>, user: TestUser): Promise<Page> {
+  return stack.http.queryOk<Page>(TagsQueries.assignmentList, payload, user);
+}
+
+describe("tags read-gate — entityId-filtered list", () => {
+  test("the owning team sees the assignment on its own project", async () => {
+    const page = await listAssignments(
+      { filter: { field: "entityId", op: "eq", value: TEAM_A_PROJECTS[0] } },
+      userA,
+    );
+    expect(page.rows).toHaveLength(1);
+    expect(page.rows[0]?.entityId).toBe(TEAM_A_PROJECTS[0] as string);
+  });
+
+  test("a foreign team sees nothing on that same project, without setting ownership", async () => {
+    const page = await listAssignments(
+      { filter: { field: "entityId", op: "eq", value: TEAM_A_PROJECTS[0] } },
+      userB,
+    );
+    expect(page.rows).toHaveLength(0);
+    expect(page.nextCursor).toBeNull();
+  });
+});
+
+describe("tags read-gate — unregistered host type", () => {
+  test("an assignment whose entityType names no registered entity is invisible to everyone", async () => {
+    const orphanId = "c0000000-0000-4000-8000-0000000000f1";
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_tag_assignments (id, tenant_id, tag_id, entity_type, entity_id, is_deleted)
+       VALUES ($1, $2, $3, 'not-a-registered-entity', $4, FALSE)`,
+      [orphanId, userA.tenantId, tagId, ORPHAN_HOST_ID],
+    );
+
+    for (const user of [userA, userB]) {
+      const page = await listAssignments(
+        { filter: { field: "entityId", op: "eq", value: ORPHAN_HOST_ID }, totalCount: true },
+        user,
+      );
+      expect(page.rows).toHaveLength(0);
+      expect(page.total).toBe(0);
+    }
+
+    // Positive control: the row really is in the table, so the zero above is
+    // the gate and not a failed insert.
+    const raw = await asRawClient(stack.db).unsafe<{ n: number }>(
+      "SELECT count(*)::int AS n FROM read_tag_assignments WHERE id = $1",
+      [orphanId],
+    );
+    expect(raw[0]?.n).toBe(1);
+  });
+});
+
+describe("tags read-gate — tagId scatter query stays paginated honestly", () => {
+  async function drain(user: TestUser, limit: number): Promise<readonly AssignmentRow[]> {
+    const seen: AssignmentRow[] = [];
+    let cursor: string | null = null;
+    for (let guard = 0; guard < 20; guard++) {
+      const page: Page = await listAssignments(
+        {
+          filter: { field: "tagId", op: "eq", value: tagId },
+          limit,
+          ...(cursor !== null && { cursor }),
+        },
+        user,
+      );
+      seen.push(...page.rows);
+      if (page.nextCursor === null) {
+        // A short page must be the last one.
+        expect(page.rows.length).toBeLessThanOrEqual(limit);
+        return seen;
+      }
+      // Every non-final page is full — a post-filter would shrink it here.
+      expect(page.rows).toHaveLength(limit);
+      cursor = page.nextCursor;
+    }
+    throw new Error("pagination did not terminate");
+  }
+
+  test("total counts only the rows the caller may see", async () => {
+    const forB = await listAssignments(
+      { filter: { field: "tagId", op: "eq", value: tagId }, totalCount: true },
+      userB,
+    );
+    expect(forB.total).toBe(TEAM_B_PROJECTS.length);
+
+    const forA = await listAssignments(
+      { filter: { field: "tagId", op: "eq", value: tagId }, totalCount: true },
+      userA,
+    );
+    expect(forA.total).toBe(TEAM_A_PROJECTS.length);
+  });
+
+  test("paging through the scatter query yields exactly the visible set, once each", async () => {
+    const drained = await drain(userA, 2);
+    const ids = drained.map((r) => r.entityId).sort();
+    expect(ids).toEqual([...TEAM_A_PROJECTS].sort());
+    expect(new Set(drained.map((r) => r.id)).size).toBe(drained.length);
+
+    const { total } = await listAssignments(
+      { filter: { field: "tagId", op: "eq", value: tagId }, totalCount: true },
+      userA,
+    );
+    expect(drained).toHaveLength(total as number);
+  });
+
+  test("every row handed out belongs to a host the caller can actually read", async () => {
+    const drained = await drain(userB, 2);
+    expect(drained.length).toBeGreaterThan(0);
+    for (const row of drained) {
+      expect(TEAM_B_PROJECTS).toContain(row.entityId);
+    }
+  });
+});
+
+describe("tags read-gate — ownership narrows further, it does not replace the gate", () => {
+  const OWNED_TABLE = "tags_rg_owned_projects";
+  const ownedEntity = createEntity({
+    table: OWNED_TABLE,
+    fields: {
+      teamId: createTextField({
+        required: true,
+        maxLength: 64,
+        personal: false,
+        reason: "technical_reference",
+      }),
+    },
+    access: {
+      read: {
+        TenantMember: {
+          kind: "where",
+          where: (user, ctx) => ({
+            sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+            params: [user.claims?.["team"] ?? null],
+          }),
+        },
+      },
+    },
+  });
+  const ownedFixtures = defineFeature("tags-rg-owned-fixtures", (r) => {
+    r.entity("project", ownedEntity);
+  });
+  const HOST = "c0000000-0000-4000-8000-00000000002a";
+  // Same team (so the host gate passes for both), but only `tagger` carries
+  // the hostKind claim the extra assignment-row rule demands.
+  const tagger: TestUser = createTestUser({
+    id: 73,
+    roles: ["TenantMember"],
+    claims: { team: "team-a", hostKind: "project" },
+  });
+  const peer: TestUser = createTestUser({
+    id: 74,
+    roles: ["TenantMember"],
+    claims: { team: "team-a", hostKind: "something-else" },
+  });
+
+  let ownedStack: TestStack;
+  let ownedTagId: string;
+
+  beforeAll(async () => {
+    ownedStack = await setupTestStack({
+      features: [
+        createTagsFeature({
+          access: { openToAll: true },
+          // An extra row rule on the assignment row itself, unrelated to who
+          // may see the host: the caller's claim must name the row's host type.
+          ownership: {
+            read: {
+              TenantMember: {
+                kind: "where",
+                where: (user, ctx) => ({
+                  sqlText: `${ctx.tableName}.entity_type = $${ctx.paramStart}`,
+                  params: [user.claims?.["hostKind"] ?? null],
+                }),
+              },
+            },
+          },
+        }),
+        ownedFixtures,
+      ],
+    });
+    await unsafeCreateEntityTable(ownedStack.db, tagEntity);
+    await unsafeCreateEntityTable(ownedStack.db, tagAssignmentEntity);
+    await unsafeCreateEntityTable(ownedStack.db, ownedEntity);
+    await createEventsTable(ownedStack.db);
+    await asRawClient(ownedStack.db).unsafe(
+      `INSERT INTO ${OWNED_TABLE} (id, tenant_id, team_id) VALUES ($1, $2, 'team-a')`,
+      [HOST, tagger.tenantId],
+    );
+    const tag = await ownedStack.http.writeOk<{ id: string }>(
+      TagsHandlers.createTag,
+      { name: "Owned" },
+      tagger,
+    );
+    ownedTagId = tag.id;
+    await ownedStack.http.writeOk(
+      TagsHandlers.assignTag,
+      { tagId: ownedTagId, entityType: "project", entityId: HOST },
+      tagger,
+    );
+  });
+
+  afterAll(async () => {
+    await ownedStack.cleanup();
+  });
+
+  test("a caller passing both the host gate and the extra row rule still sees the row", async () => {
+    const page = await ownedStack.http.queryOk<Page>(
+      TagsQueries.assignmentList,
+      { filter: { field: "entityId", op: "eq", value: HOST } },
+      tagger,
+    );
+    expect(page.rows).toHaveLength(1);
+  });
+
+  test("a same-team peer is cut by ownership even though the host is visible to them", async () => {
+    const page = await ownedStack.http.queryOk<Page>(
+      TagsQueries.assignmentList,
+      { filter: { field: "entityId", op: "eq", value: HOST } },
+      peer,
+    );
+    expect(page.rows).toHaveLength(0);
+  });
+});

package/src/tags/__tests__/tags.integration.test.ts

@@ -462,6 +462,7 @@ describe("tags integration — openToAll access model", () => {
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
     await unsafeCreateEntityTable(openStack.db, creditEntity);
+    await unsafeCreateEntityTable(openStack.db, noteEntity);
     await createEventsTable(openStack.db);
     await seedHostRows(openStack, CREDIT_TABLE, ["c-1"], unprivileged.tenantId);
 

package/src/tags/entity.ts

@@ -55,13 +55,23 @@ export const tagEntity = createEntity({
 // Cross-entity views compose in the read-layer (no JOIN):
 //   - tags of an entity   → list assignments filter { field: "entityId", op: "eq" }
 //   - entities with a tag  → list assignments filter { field: "tagId",   op: "eq" }
-export function createTagAssignmentEntity(access?: EntityDefinition["access"]) {
+export function createTagAssignmentEntity(
+  access?: EntityDefinition["access"],
+  parents?: readonly string[],
+) {
   return createEntity({
     table: "read_tag_assignments",
     description:
       "The join row recording that one catalog tag is attached to one host entity, addressed by tagId, entityType and entityId, with exactly one row per pair. An entity may carry many tags, unlike the single-folder membership rows.",
     softDelete: true,
     access,
+    // Declared unconditionally: the host-visibility gate is the default for
+    // both paths, and `parents` only narrows which hosts are admissible.
+    parentRef: {
+      entityTypeField: "entityType",
+      entityIdField: "entityId",
+      ...(parents !== undefined && { allowedTypes: parents }),
+    },
     fields: {
       tagId: createTextField({
         required: true,

package/src/tags/feature.ts

@@ -51,6 +51,7 @@ function registerTags(
   access: AccessRule,
   toggleable: TagsToggleable | undefined,
   ownership: EntityDefinition["access"] | undefined,
+  parents: readonly string[] | undefined,
 ): void {
   r.describe(
     "Generic, host-agnostic tagging for any entity. Owns two event-sourced entities — the per-tenant `tag` catalog (`read_tags`, with optional `color` and `scope`) and `tag-assignment` join rows keyed by (entityType, entityId) (`read_tag_assignments`) — so tagging adds NO column to the host entity and needs no relational pivot or JOIN. Catalog screens are declarative (`entityList` + `entityEdit`) and use convention QNs `tag:{create,update,delete}`; TagManager/TagPicker keep `create-tag`/`update-tag`/`delete-tag`. Also: `assign-tag` (idempotent), `remove-tag` (idempotent) and list queries for the catalog and the assignments. Read which tags an entity has, or which entities carry a tag, by listing `tag-assignment` filtered on `entityId` or `tagId` and composing in the read-layer. A tag with empty `scope` is global; a `scope` of an entityType restricts it to that type in the picker. Every path uses one access rule — adopt the host's model with createTagsFeature({ access: { openToAll: true } }) or pin roles with createTagsFeature({ roles }). Pass { toggleable: { default: false } } to make the whole feature tier-gatable via the tier-engine (no host hook).",
@@ -65,7 +66,7 @@ function registerTags(
   // feature toggleable lets tier-engine/feature-toggles cut it per tenant.
   if (toggleable !== undefined) r.toggleable(toggleable);
 
-  const tagAssignmentEntity = createTagAssignmentEntity(ownership);
+  const tagAssignmentEntity = createTagAssignmentEntity(ownership, parents);
   r.entity("tag", tagEntity);
   r.entity("tag-assignment", tagAssignmentEntity);
 
@@ -128,7 +129,7 @@ function registerTags(
 }
 
 export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>
-  registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined),
+  registerTags(r, DEFAULT_TAG_ACCESS, undefined, undefined, undefined),
 );
 
 export type TagsFeatureOptions = {
@@ -146,10 +147,11 @@ export type TagsFeatureOptions = {
   readonly toggleable?: TagsToggleable;
   /** Row-level ownership on the tag-assignment rows themselves — orthogonal to
    *  `access`, which only gates whether a caller may dispatch assign/remove/list
-   *  at all. Set `ownership.read` to close the read leak: without it — even if
-   *  `ownership.write` is set — `access.read` stays undefined and any
-   *  dispatch-eligible user can read every assignment in the tenant, including
-   *  assignments on entities they can't otherwise see. Applies only to
+   *  at all. `ownership.read` is no longer what keeps a caller from reading
+   *  assignments on host entities they can't see: that gate is default-on since
+   *  fw#2766 and derives from the entity's `parentRef`. Use `ownership.read` for
+   *  an ADDITIONAL row rule on the assignment row itself; it is AND-ed with the
+   *  host-visibility gate, never a replacement for it. Applies only to
    *  `tag-assignment`; the `tag` catalog stays tenant-wide by design.
    *
    *  `ownership.write` is separate and does NOT affect list/read. It's
@@ -161,6 +163,12 @@ export type TagsFeatureOptions = {
    *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make
    *  sure any `ownership.write` you set covers that role, or leave it unset. */
   readonly ownership?: EntityDefinition["access"];
+  /** Allowlist narrowing which registered entities may carry a tag. Not what
+   *  turns host-checking on — assign/remove and the assignment list always
+   *  verify that entityType names a registered entity whose row the caller can
+   *  see. Setting it narrows further, and shrinks the read gate's SQL, which
+   *  otherwise considers every registered entity as a candidate host. */
+  readonly parents?: readonly string[];
 };
 
 function resolveAccess(opts: TagsFeatureOptions): AccessRule {
@@ -177,10 +185,19 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
     opts.access === undefined &&
     opts.roles === undefined &&
     opts.toggleable === undefined &&
-    opts.ownership === undefined
+    opts.ownership === undefined &&
+    opts.parents === undefined
   ) {
     return tagsFeature;
   }
+  if (opts.parents !== undefined && opts.parents.length === 0) {
+    throw new Error(
+      "createTagsFeature({ parents }): parents must not be an empty array — " +
+        "an empty allowlist rejects every assign-tag call and hides every " +
+        "assignment row. Omit `parents` to keep every registered entity " +
+        "admissible as a host instead.",
+    );
+  }
   if (hasWhereRule(opts.ownership?.write)) {
     throw new Error(
       "createTagsFeature({ ownership }): ownership.write must not contain a " +
@@ -194,6 +211,6 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
   }
   const access = resolveAccess(opts);
   return defineFeature(TAGS_FEATURE_NAME, (r) =>
-    registerTags(r, access, opts.toggleable, opts.ownership),
+    registerTags(r, access, opts.toggleable, opts.ownership, opts.parents),
   );
 }

package/src/tags/handlers/assign-tag.write.ts

@@ -1,6 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { parentRowIsVisible } from "../../shared";
+import { joinRowParentIsVisible } from "../../shared";
 import { tagAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_TAG_ACCESS } from "../constants";
 import { tagAssignmentExecutor, tagExecutor } from "../executor";
@@ -43,13 +43,7 @@ export function createAssignTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
       // an invisible parent apart from a missing assignment or an unknown tag —
       // every path answers with the same NotFoundError.
       if (
-        !(await parentRowIsVisible(
-          ctx.registry,
-          payload.entityType,
-          payload.entityId,
-          event.user,
-          ctx.db,
-        ))
+        !(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))
       ) {
         return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
       }

package/src/tags/handlers/remove-tag.write.ts

@@ -1,6 +1,6 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { parentRowIsVisible } from "../../shared";
+import { joinRowParentIsVisible } from "../../shared";
 import { tagAssignmentAggregateId } from "../aggregate-id";
 import { DEFAULT_TAG_ACCESS } from "../constants";
 import { tagAssignmentExecutor } from "../executor";
@@ -29,13 +29,7 @@ export function createRemoveTagHandler(access: AccessRule = DEFAULT_TAG_ACCESS):
       // an invisible parent apart from a missing assignment or an unknown tag —
       // every path answers with the same NotFoundError.
       if (
-        !(await parentRowIsVisible(
-          ctx.registry,
-          payload.entityType,
-          payload.entityId,
-          event.user,
-          ctx.db,
-        ))
+        !(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))
       ) {
         return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
       }

package/src/tags/web/__tests__/entity-tags.test.tsx

@@ -22,7 +22,7 @@ beforeEach(() => {
   assignmentRows = [];
 });
 
-const useQuerySpy = mock((type: string) => ({
+const useQuerySpy = mock((type: string, _payload?: unknown) => ({
   data: type === TagsQueries.tagList ? { rows: catalogRows } : { rows: assignmentRows },
   loading: false,
   error: null,
@@ -79,9 +79,10 @@ describe("EntityTags", () => {
     expect(screen.queryByTestId("tag-chip")).toBeNull();
   });
 
-  test("ignores assignments belonging to a different entityType", () => {
+  test("scopes the assignment query to this entityType and id server-side", () => {
     catalogRows = [{ id: "t1", name: "important" }];
-    assignmentRows = [{ tagId: "t1", entityType: "invoice", entityId: "n1" }];
+    assignmentRows = [{ tagId: "t1", entityType: "note", entityId: "n1" }];
+    useQuerySpy.mockClear();
 
     render(
       <Wrapper>
@@ -89,7 +90,15 @@ describe("EntityTags", () => {
       </Wrapper>,
     );
 
-    expect(screen.queryByTestId("entity-tags")).toBeNull();
+    // Filtering server-side (rather than discarding foreign rows after the
+    // fetch) is what lets the parent-ref read gate narrow to one host entity.
+    const call = useQuerySpy.mock.calls.find((c) => c[0] === TagsQueries.assignmentList);
+    expect(call?.[1]).toEqual({
+      filters: [
+        { field: "entityType", op: "eq", value: "note" },
+        { field: "entityId", op: "eq", value: "n1" },
+      ],
+    });
   });
 
   test("renders nothing for a not-yet-saved entity (entityId null)", () => {

package/src/tags/web/entity-tags.tsx

@@ -25,15 +25,22 @@ export function EntityTags({
 }): ReactNode {
   const enabled = entityId !== null;
   const catalog = useQuery<{ rows: readonly TagRow[] }>(TagsQueries.tagList, {}, { enabled });
+  // entityType server-side, not just entityId: it collapses the parent-ref
+  // read gate to this one host entity instead of every registered one.
   const assignments = useQuery<{ rows: readonly AssignmentRow[] }>(
     TagsQueries.assignmentList,
-    { filter: { field: "entityId", op: "eq", value: entityId } },
+    {
+      filters: [
+        { field: "entityType", op: "eq", value: entityName },
+        { field: "entityId", op: "eq", value: entityId },
+      ],
+    },
     { enabled },
   );
 
   if (entityId === null) return null;
   const byId = new Map((catalog.data?.rows ?? []).map((t) => [t.id, t]));
-  const assigned = (assignments.data?.rows ?? []).filter((r) => r.entityType === entityName);
+  const assigned = assignments.data?.rows ?? [];
   if (assigned.length === 0) return null;
 
   return (

package/src/tags/web/tag-section.tsx

@@ -57,9 +57,16 @@ export function TagSection({
   const dispatcher = useDispatcher();
   const enabled = entityId !== null;
   const catalog = useQuery<TagListResponse>(TagsQueries.tagList, {}, { enabled });
+  // entityType server-side, not just entityId: it collapses the parent-ref
+  // read gate to this one host entity instead of every registered one.
   const assignments = useQuery<AssignmentListResponse>(
     TagsQueries.assignmentList,
-    { filter: { field: "entityId", op: "eq", value: entityId } },
+    {
+      filters: [
+        { field: "entityType", op: "eq", value: entityName },
+        { field: "entityId", op: "eq", value: entityId },
+      ],
+    },
     { enabled },
   );
   const [pickerOpen, setPickerOpen] = useState(false);
@@ -93,9 +100,7 @@ export function TagSection({
   }
 
   const byId = new Map((catalog.data?.rows ?? []).map((tg) => [tg.id, tg]));
-  const assignedIds = (assignments.data?.rows ?? [])
-    .filter((r) => r.entityType === entityName)
-    .map((r) => r.tagId);
+  const assignedIds = (assignments.data?.rows ?? []).map((r) => r.tagId);
 
   const refetch = async (): Promise<void> => {
     await Promise.all([catalog.refetch(), assignments.refetch()]);