@cosmicdrift/kumiko-bundled-features 0.281.0 → 0.283.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.281.0",
+  "version": "0.283.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.281.0",
-    "@cosmicdrift/kumiko-framework": "0.281.0",
-    "@cosmicdrift/kumiko-headless": "0.281.0",
-    "@cosmicdrift/kumiko-renderer": "0.281.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.281.0",
-    "@cosmicdrift/kumiko-types": "0.281.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.283.0",
+    "@cosmicdrift/kumiko-framework": "0.283.0",
+    "@cosmicdrift/kumiko-headless": "0.283.0",
+    "@cosmicdrift/kumiko-renderer": "0.283.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.283.0",
+    "@cosmicdrift/kumiko-types": "0.283.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.281.0",
-    "@cosmicdrift/kumiko-locale-es": "0.281.0"
+    "@cosmicdrift/kumiko-locale-de": "0.283.0",
+    "@cosmicdrift/kumiko-locale-es": "0.283.0"
   }
 }

package/src/cap-overview/__tests__/caps-usage-escape-hatch.integration.test.ts

@@ -0,0 +1,111 @@
+// fw#2971 — withUnsafeRawGrant was un-exported, so an app-owned CapSpec.usage()
+// provider's db.unsafeRaw() call was rejected even though caps:usage itself
+// runs with r.systemScope(). caps-usage.query.ts now declares its own
+// escapeHatch so those providers keep working. This proves the grant
+// actually reaches a cap provider doing a real raw-SQL SUM aggregate (the
+// shape a typed TenantDb helper like count() can't express) end to end
+// through the real caps:usage HTTP handler.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { billingFoundationFeature } from "../../billing-foundation";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenant } from "../../tenant/seeding";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { TierEngineHandlers, tierAssignmentEntity, tierEngineFeature } from "../../tier-engine";
+import { CapOverviewQueries } from "../constants";
+import { createCapOverviewFeature } from "../feature";
+import type { CapSpec } from "../types";
+
+const RAW_USAGE_REASON =
+  "test: cap provider sums cap_overview_raw_usage_probe via raw SQL (fw#2971 regression)";
+const TENANT_A = testTenantId(9101);
+
+const rawSqlSumCap: CapSpec = {
+  id: "raw-sql-sum",
+  label: "test.cap.rawSqlSum",
+  limit: () => 1000,
+  usage: async (db, tenantId) => {
+    // @cast-boundary db-operator — unsafeRaw's DbRunner narrows to
+    // DbConnection|DbTx; this call site only ever runs outside a tx.
+    const raw = asRawClient(db.unsafeRaw(RAW_USAGE_REASON) as DbConnection);
+    const rows = await raw.unsafe<{ total: number }>(
+      "SELECT COALESCE(SUM(amount), 0)::int AS total FROM cap_overview_raw_usage_probe WHERE tenant_id = $1",
+      [tenantId],
+    );
+    return rows[0]?.total ?? 0;
+  },
+};
+
+let stack: TestStack;
+let db: DbConnection;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      tierEngineFeature,
+      createCapOverviewFeature({ caps: [rawSqlSumCap] }),
+    ],
+  });
+  db = stack.db;
+  await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, tierAssignmentEntity);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+  await asRawClient(db).unsafe(`
+    CREATE TABLE IF NOT EXISTS cap_overview_raw_usage_probe (
+      tenant_id text NOT NULL,
+      amount int NOT NULL
+    )
+  `);
+  await asRawClient(db).unsafe(
+    "INSERT INTO cap_overview_raw_usage_probe (tenant_id, amount) VALUES ($1, $2), ($1, $3)",
+    [TENANT_A, 30, 12],
+  );
+
+  await seedTenant(db, { id: TENANT_A, key: `cap-overview-raw-${TENANT_A}`, name: "Tenant Raw" });
+  const ownerA = createTestUser({
+    id: 91011,
+    tenantId: TENANT_A,
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+  await stack.http.writeOk(TierEngineHandlers.create, { tier: "pro" }, ownerA);
+});
+
+afterAll(async () => {
+  await asRawClient(db).unsafe("DROP TABLE IF EXISTS cap_overview_raw_usage_probe");
+  await stack.cleanup();
+});
+
+describe("caps:usage's own escapeHatch grants a cap provider raw SQL", () => {
+  test("a cap provider's db.unsafeRaw() SUM aggregate runs successfully through caps:usage", async () => {
+    const memberA = createTestUser({ id: 91012, tenantId: TENANT_A, roles: ["User"] });
+    const result = await stack.http.queryOk<{
+      rows: readonly { id: string; used: number | null }[];
+    }>(CapOverviewQueries.capsUsage, {}, memberA);
+    const row = result.rows.find((r) => r.id === rawSqlSumCap.id);
+    expect(row?.used).toBe(42);
+  });
+});

package/src/cap-overview/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.282.0",
+    "type": "fix",
+    "title": "caps:usage declares escapeHatch again so raw-SQL cap providers work",
+    "detail": "fw#2971 un-exported withUnsafeRawGrant, the mechanism app-owned CapSpec.usage() providers used (via caps:usage's system-mode db) to run raw SQL for aggregates TenantDb has no typed helper for (a SUM, unlike the COUNT(*)-only TenantDb.count() added in fw#2854). caps:usage's own defineQueryHandler(...) call now carries `escapeHatch: { reason: \"...\" }`, restoring the grant through the same mechanism every other handler-owned unsafeRaw use goes through. Cap providers that only need COUNT(*) should migrate to TenantDb.count(table, where) instead — it needs no escapeHatch at all."
+  },
   {
     "version": "0.233.0",
     "type": "improvement",

package/src/cap-overview/handlers/caps-usage.query.ts

@@ -23,6 +23,12 @@ export function createCapsUsageQuery(caps: readonly CapSpec[]): QueryHandlerDefi
       "Returns the calling user's own tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (only SystemAdmin may target another tenant via tenantId).",
     schema: z.object({ tenantId: z.string().min(1).optional() }),
     access: { roles: MY_CAPS_ACCESS_ROLES },
+    // App-owned CapSpec.usage() providers get this handler's db; a SUM has
+    // no TenantDb helper (count() is COUNT(*)-only), so they need raw SQL.
+    escapeHatch: {
+      reason:
+        "cap-overview:caps:usage — grants app-owned CapSpec.usage() providers raw SQL for aggregates TenantDb has no typed helper for (e.g. a SUM)",
+    },
     handler: async (query, ctx) => {
       if (!ctx.systemDb) {
         throw new InternalError({