@cosmicdrift/kumiko-bundled-features 0.264.1 → 0.266.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.264.1",
+  "version": "0.266.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.264.1",
-    "@cosmicdrift/kumiko-framework": "0.264.1",
-    "@cosmicdrift/kumiko-headless": "0.264.1",
-    "@cosmicdrift/kumiko-renderer": "0.264.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.264.1",
-    "@cosmicdrift/kumiko-types": "0.264.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.266.0",
+    "@cosmicdrift/kumiko-framework": "0.266.0",
+    "@cosmicdrift/kumiko-headless": "0.266.0",
+    "@cosmicdrift/kumiko-renderer": "0.266.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.266.0",
+    "@cosmicdrift/kumiko-types": "0.266.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.264.1",
-    "@cosmicdrift/kumiko-locale-es": "0.264.1"
+    "@cosmicdrift/kumiko-locale-de": "0.266.0",
+    "@cosmicdrift/kumiko-locale-es": "0.266.0"
   }
 }

package/src/auth-email-password/__tests__/active-membership.integration.test.ts

@@ -0,0 +1,255 @@
+// End-to-end via real HTTP: switch-tenant and login route through
+// dispatcher.resolveActiveMembership. No sessions feature mounted — proves principal_blocked is enforced at membership-resolution time, not session revocation.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import {
+  createTenantFeature,
+  TenantHandlers,
+  type TenantLifecycleStatus,
+  tenantMembershipsTable,
+} from "../../tenant";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { resetTenantLifecycleGateCacheForTests } from "../../tenant-lifecycle/lifecycle-gate";
+import { createUserFeature, USER_STATUS, UserHandlers, userEntity, userTable } from "../../user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+let stack: TestStack;
+
+const TENANT_A: TenantId = testTenantId(1);
+const TENANT_B: TenantId = testTenantId(2);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      createAuthEmailPasswordFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  // Statuses below are written directly via updateRows, bypassing the
+  // write handlers that invalidate the lifecycle-gate cache on a real
+  // request/cancel-destruction — clear it so a later test reusing TENANT_B
+  // doesn't read an earlier test's cached status (mirrors
+  // tenant-lifecycle.integration.test.ts).
+  resetTenantLifecycleGateCacheForTests();
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantTable,
+    tenantComplianceProfileTable,
+    tenantMembershipsTable,
+    eventsTable,
+  ]);
+});
+
+async function createTenant(id: TenantId): Promise<void> {
+  // testTenantId(n) shares the "00000000-0000-4000-8000-" prefix across
+  // every n — the differing suffix must drive the unique `key`, not a
+  // slice(0, 8) of the id (which would collide for every test tenant).
+  await stack.http.writeOk(
+    TenantHandlers.create,
+    { id, key: `t-${id.slice(-8)}`, name: "Tenant" },
+    TestUsers.systemAdmin,
+  );
+}
+
+async function setTenantStatus(id: TenantId, status: TenantLifecycleStatus): Promise<void> {
+  await updateRows(stack.db, tenantTable, { status }, { id });
+  resetTenantLifecycleGateCacheForTests();
+}
+
+async function createUser(email: string, password: string): Promise<string> {
+  const hash = await hashPassword(password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    { email, passwordHash: hash, displayName: email.split("@")[0] ?? "user" },
+    TestUsers.systemAdmin,
+  );
+  return created.id;
+}
+
+async function addMembership(
+  userId: string,
+  tenantId: TenantId,
+  roles: readonly string[] = ["Member"],
+): Promise<void> {
+  await seedTenantMembership(stack.db, { userId, tenantId, roles });
+}
+
+async function tokenFor(userId: string, tenantId: TenantId): Promise<string> {
+  return stack.jwt.sign({ id: userId, tenantId, roles: ["Member"] });
+}
+
+async function switchTenant(token: string, tenantId: TenantId) {
+  return stack.http.raw(
+    "POST",
+    "/api/auth/switch-tenant",
+    { tenantId },
+    { Authorization: `Bearer ${token}` },
+  );
+}
+
+describe("switch-tenant :: active-membership building block", () => {
+  test("switching into a tenant with no membership → 403 not_a_member", async () => {
+    await createTenant(TENANT_A);
+    await createTenant(TENANT_B);
+    const userId = await createUser("nomember@example.com", "pw-long-enough-1");
+    await addMembership(userId, TENANT_A);
+
+    const token = await tokenFor(userId, TENANT_A);
+    const res = await switchTenant(token, TENANT_B);
+
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error?: string };
+    expect(body.error).toBe("not_a_member");
+  });
+
+  test("switching as a restricted principal who IS a member of the target → 403 principal_blocked (JWT itself stays valid, no sessions feature to revoke it)", async () => {
+    await createTenant(TENANT_A);
+    await createTenant(TENANT_B);
+    const userId = await createUser("restricted@example.com", "pw-long-enough-2");
+    await addMembership(userId, TENANT_A);
+    await addMembership(userId, TENANT_B);
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: userId });
+
+    const token = await tokenFor(userId, TENANT_A);
+    const res = await switchTenant(token, TENANT_B);
+
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error?: string };
+    expect(body.error).toBe("principal_blocked");
+  });
+
+  test("switching into a tenant mid-teardown (destroying/destroyFailed/destroyed) → 410 tenant_unavailable; destroyRequested still allows it (cancel window)", async () => {
+    await createTenant(TENANT_A);
+    await createTenant(TENANT_B);
+    const userId = await createUser("teardown@example.com", "pw-long-enough-3");
+    await addMembership(userId, TENANT_A);
+    await addMembership(userId, TENANT_B);
+    const token = await tokenFor(userId, TENANT_A);
+
+    for (const status of ["destroying", "destroyFailed", "destroyed"] as const) {
+      await setTenantStatus(TENANT_B, status);
+      const res = await switchTenant(token, TENANT_B);
+      expect(res.status).toBe(410);
+      expect(((await res.json()) as { error?: string }).error).toBe("tenant_unavailable");
+    }
+
+    await setTenantStatus(TENANT_B, "destroyRequested");
+    const pendingRes = await switchTenant(token, TENANT_B);
+    expect(pendingRes.status).toBe(200);
+  });
+
+  test("a non-member switching into a destroying tenant still gets not_a_member, not tenant_unavailable (membership checked before lifecycle — a non-member must not learn the target's teardown state)", async () => {
+    await createTenant(TENANT_A);
+    await createTenant(TENANT_B);
+    const userId = await createUser("outsider@example.com", "pw-long-enough-4");
+    await addMembership(userId, TENANT_A);
+    await setTenantStatus(TENANT_B, "destroying");
+
+    const token = await tokenFor(userId, TENANT_A);
+    const res = await switchTenant(token, TENANT_B);
+
+    expect(res.status).toBe(403);
+    expect(((await res.json()) as { error?: string }).error).toBe("not_a_member");
+  });
+});
+
+describe("login :: active-membership building block", () => {
+  test("restricted user login → rejected with the existing account_restricted error (gateEnforceAccountStatus runs before gateResolveMembership, behaviour unchanged)", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("restrictedlogin@example.com", "pw-long-enough-5");
+    await addMembership(userId, TENANT_A);
+    await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: userId });
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "restrictedlogin@example.com",
+      password: "pw-long-enough-5",
+    });
+
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.accountRestricted);
+  });
+
+  test("active user whose last-active tenant is destroying falls through to a second active membership", async () => {
+    await createTenant(TENANT_A);
+    await createTenant(TENANT_B);
+    const userId = await createUser("fallback@example.com", "pw-long-enough-6");
+    await addMembership(userId, TENANT_A);
+    await addMembership(userId, TENANT_B);
+    await updateRows(stack.db, userTable, { lastActiveTenantId: TENANT_A }, { id: userId });
+    await setTenantStatus(TENANT_A, "destroying");
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "fallback@example.com",
+      password: "pw-long-enough-6",
+    });
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user: { tenantId: string } };
+    expect(body.user.tenantId).toBe(TENANT_B);
+  });
+});
+
+describe("dispatcher.resolveActiveMembership", () => {
+  test("unknown principal (no persisted user row) with a membership resolves active", async () => {
+    await createTenant(TENANT_A);
+    const unknownUserId = crypto.randomUUID();
+    await addMembership(unknownUserId, TENANT_A);
+
+    const result = await stack.dispatcher.resolveActiveMembership(unknownUserId, TENANT_A);
+
+    expect(result.kind).toBe("active");
+  });
+});

package/src/auth-email-password/handlers/login.write.ts

@@ -4,6 +4,7 @@ import {
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
+  TENANT_MEMBERSHIPS_QUERY,
   type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -178,7 +179,9 @@ export async function gateResolveMembership(
   systemUser: SessionUser,
   found: AuthUserRow,
 ): Promise<GateOutcome<{ readonly chosen: Membership; readonly mergedRoles: readonly string[] }>> {
-  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
+  // Still needed for candidate ORDER (preferred tenant first) — the actual
+  // active/blocked/teardown decision comes from ctx.resolveActiveMembership below.
+  const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
     userId: found.id,
   })) as Array<Membership>; // @cast-boundary db-runner
 
@@ -190,17 +193,34 @@ export async function gateResolveMembership(
     found.lastActiveTenantId !== null && found.lastActiveTenantId !== undefined
       ? memberships.find((m) => m.tenantId === found.lastActiveTenantId)
       : undefined;
-  const chosen = preferred ?? memberships[0];
-  if (!chosen) {
-    return reject(noMembership());
-  }
+  const candidates = preferred
+    ? [preferred, ...memberships.filter((m) => m !== preferred)]
+    : memberships;
 
   const globalRoles = parseRoles(found.roles ?? null);
-  // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
-  // roles only (globalRoles keeps SystemAdmin) — read-time backstop against a
-  // rebuild-resurrected role.
-  const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
-  return ok({ chosen, mergedRoles });
+
+  for (const candidate of candidates) {
+    const active = await ctx.resolveActiveMembership(found.id, candidate.tenantId);
+    if (active.kind === "rejected") {
+      // A blocked principal is blocked for every tenant, so stop here;
+      // not_a_member/tenant_teardown are per-tenant — try the next candidate.
+      if (active.reason === "principal_blocked") {
+        return reject(invalidCredentials());
+      }
+      continue;
+    }
+    const chosen: Membership = {
+      tenantId: active.membership.tenantId,
+      roles: active.membership.roles,
+    };
+    // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
+    // roles only (globalRoles keeps SystemAdmin) — read-time backstop against a
+    // rebuild-resurrected role.
+    const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
+    return ok({ chosen, mergedRoles });
+  }
+
+  return reject(noMembership());
 }
 
 // MFA challenge / setup-required / proceed. Excludes "auth-session" (this
@@ -266,8 +286,8 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
     escapeHatch: {
       reason:
         "Unauthenticated login has no caller identity yet — it looks up the user row by " +
-        "email and resolves tenant memberships via ctx.queryAs(SYSTEM, ...) before a " +
-        "session exists.",
+        "email via ctx.queryAs(SYSTEM, ...) and resolves tenant membership via " +
+        "ctx.resolveActiveMembership before a session exists.",
     },
     description:
       "Signs a user in with email and password, running the lockout, email-verification, account-status, tenant-membership and MFA gates, and answering with a session or with an MFA challenge or setup requirement.",

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -16,13 +16,19 @@ import {
 } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers as AuthEmailPasswordHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
-import { tenantEntity } from "../../tenant/schema/tenant";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { resetTenantLifecycleGateCacheForTests } from "../../tenant-lifecycle/lifecycle-gate";
 import { USER_STATUS } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
@@ -62,6 +68,8 @@ beforeAll(async () => {
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
       authMfaFeature,
       createAuthEmailPasswordFeature({
         mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
@@ -75,6 +83,7 @@ beforeAll(async () => {
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(stack.db, userMfaEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
 });
@@ -350,6 +359,37 @@ describe("mfa verify — re-checks account state the way login.write.ts does", (
     expectErrorIncludes(err, "invalid_challenge_token");
   });
 
+  test("tenant enters teardown between login and verify → challenge rejected", async () => {
+    const { user, secret } = await enableMfaFor(11);
+    const challengeToken = challengeFor(user.id, user.tenantId);
+
+    // user.tenantId is the shared default test tenant (TestUsers.admin) —
+    // restore it to "active" afterwards so later tests reusing it aren't affected.
+    await seedRow(stack.db, tenantTable, {
+      id: user.tenantId,
+      tenantId: user.tenantId,
+      key: `t-${user.tenantId.slice(-8)}`,
+      name: "Tenant",
+      status: "destroying",
+    });
+    resetTenantLifecycleGateCacheForTests();
+
+    try {
+      const err = await stack.http.writeErr(
+        AuthMfaHandlers.verify,
+        { challengeToken, code: currentTotpCode(secret) },
+        GUEST,
+      );
+      expectErrorIncludes(err, "invalid_challenge_token");
+    } finally {
+      await asRawClient(stack.db).unsafe(
+        `UPDATE "${tenantTable.tableName}" SET status = $1 WHERE id = $2`,
+        ["active", user.tenantId],
+      );
+      resetTenantLifecycleGateCacheForTests();
+    }
+  });
+
   test("user row homed in a DIFFERENT tenant than the challenge → verify succeeds (#1235)", async () => {
     const { user, secret } = await enableMfaFor(8);
 

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -66,8 +66,8 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
     access: { roles: ["all"] },
     escapeHatch: {
       reason:
-        "Pre-auth MFA enrollment step has no session yet — re-checks status and membership via " +
-        "ctx.queryAs(SYSTEM, user:findForAuth / tenant:query:memberships) for the setup token's user.",
+        "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.queryAs(SYSTEM, " +
+        "user:findForAuth) and membership via ctx.resolveActiveMembership for the setup token's user.",
     },
     description:
       "Completes the enrollment that unblocks a sign-in forced into two-factor setup: verifies the code against the pre-auth setup token, stores the factor and derives the session the blocked login never got.",
@@ -165,11 +165,8 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
 
       const globalRoles = parseRoles(userRow?.roles ?? null);
 
-      const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-        userId,
-      })) as ReadonlyArray<{ tenantId: string; roles: readonly string[] }>; // @cast-boundary engine-payload
-      const membership = memberships.find((m) => m.tenantId === tenantId);
-      if (!membership) return invalidSetupToken();
+      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      if (active.kind === "rejected") return invalidSetupToken();
 
       const result = await executor.create(
         {
@@ -195,7 +192,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       // roles from the membership portion (globalRoles keeps SystemAdmin) —
       // read-time backstop against a rebuild-resurrected role, same as
       // verify.write.ts.
-      const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
+      const mergedRoles = buildSessionRoles(globalRoles, active.membership.roles);
 
       const baseSession: SessionUser = {
         id: userId,

package/src/auth-mfa/handlers/verify.write.ts

@@ -49,7 +49,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
     escapeHatch: {
       reason:
         "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +
-        "user:findForAuth / tenant:query:memberships) for the user the challenge token names.",
+        "user:findForAuth) and ctx.resolveActiveMembership for the user the challenge token names.",
     },
     description:
       "Finishes a two-step sign-in by checking a TOTP or recovery code against the challenge token that login handed back, under a per-account attempt cap, and derives the resulting session.",
@@ -166,19 +166,14 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
 
       const globalRoles = parseRoles(userRow?.roles ?? null);
 
-      const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-        userId,
-      })) as ReadonlyArray<{ tenantId: string; roles: readonly string[] }>; // @cast-boundary engine-payload
-      const membership = memberships.find((m) => m.tenantId === tenantId);
-      // Membership revoked between login and verify (race, or a stale
-      // challenge token from before removal) — login.write.ts would have
-      // refused with noMembership() at the same juncture; mirror it here
-      // instead of silently falling back to globalRoles only.
-      if (!membership) return invalidChallengeToken();
+      // Membership revoked or principal blocked between login and verify —
+      // mirror login.write.ts's refusal instead of falling back to globalRoles only.
+      const active = await ctx.resolveActiveMembership(userId, tenantId);
+      if (active.kind === "rejected") return invalidChallengeToken();
       // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
       // roles from the membership portion (globalRoles keeps SystemAdmin) —
       // read-time backstop against a rebuild-resurrected role.
-      const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
+      const mergedRoles = buildSessionRoles(globalRoles, active.membership.roles);
 
       const baseSession: SessionUser = {
         id: userId,

package/src/sessions/session-callbacks.ts

@@ -18,7 +18,7 @@ import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared";
 import { tenantMembershipsTable } from "../tenant";
-import { USER_STATUS, type UserStatus, userTable } from "../user";
+import { isPrincipalBlocked, type UserStatus, userTable } from "../user";
 import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS } from "./constants";
 import { userSessionEntity, userSessionTable } from "./schema/user-session";
 import {
@@ -27,19 +27,8 @@ import {
   sessionRevokedSchema,
 } from "./session-revoked-event";
 
-// Locked accounts whose live sessions must be refused. deletionRequested is
-// intentionally absent — it's a reversible grace period and the user needs
-// their session to reach cancel-deletion.
-const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
-  USER_STATUS.Restricted,
-  USER_STATUS.Deleted,
-]);
-
-// Shared with personal-access-tokens' resolver — a PAT belonging to a
-// locked-out principal must be refused the same way a live session is.
-export function isPrincipalBlocked(status: UserStatus): boolean {
-  return BLOCKED_STATUSES.has(status);
-}
+// Re-exported so existing `../sessions` importers keep working unchanged.
+export { isPrincipalBlocked };
 
 // Why the callbacks live at the raw-DB level rather than going through the
 // dispatcher: session-create/revoke/check run on the hot path of every

package/src/tenant/__tests__/multi-tenant.integration.test.ts

@@ -29,6 +29,8 @@ import type { Hono } from "hono";
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
 import { TenantHandlers, TenantQueries } from "../constants";
 import { createTenantFeature } from "../feature";
 import { tenantMembershipsTable } from "../membership-table";
@@ -65,12 +67,14 @@ beforeAll(async () => {
   db = testDb.db;
 
   await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, userEntity);
   await unsafePushTables(db, { tenantMembershipsTable, configValuesTable });
   await createEventsTable(db);
 
   const configFeature = createConfigFeature();
+  const userFeature = createUserFeature();
   const tenantFeature = createTenantFeature();
-  const registry = createRegistry([configFeature, tenantFeature, billingFeature]);
+  const registry = createRegistry([configFeature, userFeature, tenantFeature, billingFeature]);
   const resolver = createConfigResolver();
 
   const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;

package/src/tenant-lifecycle/feature.ts

@@ -5,7 +5,9 @@ import {
   EXT_SEARCH_ADAPTER,
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
+  EXT_TENANT_LIFECYCLE_STATUS,
   type FeatureDefinition,
+  type TenantLifecycleStatusPlugin,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { validateTenantDataHookCoverage } from "./boot-checks";
 import {
@@ -32,7 +34,14 @@ import {
 } from "./events";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write";
 import { requestDestructionWrite } from "./handlers/request-destruction.write";
-import { runTenantDestructionSweep } from "./run-tenant-destroy";
+import { resolveTenantLifecycleGate, runTenantDestructionSweep } from "./run-tenant-destroy";
+
+const tenantLifecycleStatusPlugin: TenantLifecycleStatusPlugin = {
+  async resolveStatus(tenantId, { db }) {
+    const gate = await resolveTenantLifecycleGate(db, tenantId);
+    return gate ? { status: gate.status } : null;
+  },
+};
 
 export function createTenantLifecycleFeature(): FeatureDefinition {
   return defineFeature("tenant-lifecycle", (r) => {
@@ -54,6 +63,11 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
     r.extendsRegistrar(EXT_STORAGE_PROVIDER, {});
     r.extendsRegistrar(EXT_INFRA_RESOURCE, {});
 
+    // Self-extension, same pattern as `user`/EXT_PRINCIPAL_STATUS — declares
+    // AND fulfils tenantLifecycleStatus so teardown state is visible with no per-app wiring.
+    r.extendsRegistrar(EXT_TENANT_LIFECYCLE_STATUS, {});
+    r.useExtension(EXT_TENANT_LIFECYCLE_STATUS, "tenant-lifecycle", tenantLifecycleStatusPlugin);
+
     // GDPR-storage guard V4 (#1314) — moved off the framework-internal
     // boot-validator onto this feature's own r.bootCheck(), since it owns
     // EXT_TENANT_DATA: its own mount is the trigger, matching the original

package/src/user/feature.ts

@@ -1,4 +1,8 @@
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineFeature,
+  EXT_PRINCIPAL_STATUS,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createWrite } from "./handlers/create.write";
 import { detailQuery } from "./handlers/detail.query";
 import { findForAuthQuery } from "./handlers/find-for-auth.query";
@@ -6,6 +10,7 @@ import { listQuery } from "./handlers/list.query";
 import { meQuery } from "./handlers/me.query";
 import { updateWrite } from "./handlers/update.write";
 import { USER_I18N } from "./i18n";
+import { principalStatusPlugin } from "./principal-status";
 import { userEntity } from "./schema/user";
 import { userEditScreen, userListScreen } from "./screens";
 
@@ -25,6 +30,11 @@ export function createUserFeature(): FeatureDefinition {
     r.systemScope();
     r.entity("user", userEntity);
 
+    // Self-extension: `user` declares AND fulfils principalStatus (precedent:
+    // tier-engine/feature.ts) — wires the blocked-principal check into every stack that mounts `user`.
+    r.extendsRegistrar(EXT_PRINCIPAL_STATUS, {});
+    r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin);
+
     const handlers = {
       create: r.writeHandler(createWrite),
       update: r.writeHandler(updateWrite),

package/src/user/handlers/update.write.ts

@@ -40,7 +40,14 @@ export const updateWrite = defineWriteHandler({
       roles: rolesInputSchema.optional(),
     }),
   }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "Any signed-in user edits their own profile and privileged actors edit any user; " +
+        "the self-or-privileged check lives in the handler body, not in userEntity.access.write.",
+      personalData: "tenant-members",
+    },
+  },
   description:
     "Changes a user's display name, locale, timezone, email, verification flag, last active tenant or global roles against the version the caller read; callers may edit themselves, while editing someone else or granting roles needs a privileged actor.",
   handler: async (event, ctx) => {

package/src/user/index.ts

@@ -5,6 +5,7 @@ export {
   type UserStreamBackfillResult,
 } from "./db/queries/stream-tenant-backfill";
 export { createUserFeature } from "./feature";
+export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status";
 export type { UserStatus } from "./schema/user";
 export {
   USER_ANONYMIZED_DISPLAY_NAME,

package/src/user/principal-status.ts

@@ -0,0 +1,26 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { PrincipalStatus, PrincipalStatusPlugin } from "@cosmicdrift/kumiko-framework/engine";
+import { USER_STATUS, type UserStatus, userTable } from "./schema/user";
+
+// Locked accounts whose live sessions must be refused. deletionRequested is
+// intentionally absent — it's a reversible grace period and the user needs their session to reach cancel-deletion.
+const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
+  USER_STATUS.Restricted,
+  USER_STATUS.Deleted,
+]);
+
+// Shared with personal-access-tokens' resolver and sessions' sessionChecker
+// — a PAT or a live session belonging to a locked-out principal is refused the same way.
+export function isPrincipalBlocked(status: UserStatus): boolean {
+  return BLOCKED_STATUSES.has(status);
+}
+
+// Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
+// so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
+export const principalStatusPlugin: PrincipalStatusPlugin = {
+  async resolveStatus(userId, { db }): Promise<PrincipalStatus> {
+    const row = await fetchOne<{ status: UserStatus }>(db, userTable, { id: userId });
+    if (!row) return "unknown";
+    return isPrincipalBlocked(row.status) ? "blocked" : "active";
+  },
+};