@cosmicdrift/kumiko-bundled-features 0.288.0 → 0.289.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.288.0",
+  "version": "0.289.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -82,6 +82,7 @@
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
     "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
+    "./tenant-handover": "./src/tenant-handover/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -132,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.288.0",
-    "@cosmicdrift/kumiko-framework": "0.288.0",
-    "@cosmicdrift/kumiko-headless": "0.288.0",
-    "@cosmicdrift/kumiko-renderer": "0.288.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.288.0",
-    "@cosmicdrift/kumiko-types": "0.288.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.289.0",
+    "@cosmicdrift/kumiko-framework": "0.289.0",
+    "@cosmicdrift/kumiko-headless": "0.289.0",
+    "@cosmicdrift/kumiko-renderer": "0.289.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.289.0",
+    "@cosmicdrift/kumiko-types": "0.289.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -166,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.288.0",
-    "@cosmicdrift/kumiko-locale-es": "0.288.0",
+    "@cosmicdrift/kumiko-locale-de": "0.289.0",
+    "@cosmicdrift/kumiko-locale-es": "0.289.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/query-as-member.integration.test.ts

@@ -104,6 +104,9 @@ const TRIES_UNSAFE_RAW_WRITE_QN = "queryasmemberprobe:query:tries-unsafe-raw-wri
 const TRIES_READ_WRITE_RESET_QN = "queryasmemberprobe:query:tries-read-write-reset";
 const NESTED_DB_WRITE_QN = "queryasmemberprobe:query:nested-db-write";
 const TRIES_SELECT_FOR_UPDATE_QN = "queryasmemberprobe:query:tries-select-for-update";
+const TRIES_COMMIT_THEN_WRITE_QN = "queryasmemberprobe:query:tries-commit-then-write";
+const TRIES_RAW_SELECT_QN = "queryasmemberprobe:query:tries-raw-select";
+const NESTED_RAW_SELECT_QN = "queryasmemberprobe:query:nested-raw-select";
 const TRIES_QUERY_AS_QN = "queryasmemberprobe:query:tries-query-as";
 const READ_AS_MEMBER_QUERY_QN = "queryasmemberprobe:query:read-as-member-query";
 const SYSTEM_SCOPE_READ_AS_MEMBER_QN = "queryasmembersystemscope:write:read-as-member";
@@ -240,6 +243,42 @@ const probeFeature = defineFeature("queryasmemberprobe", (r) => {
       escapeHatch: { reason: "test: select-for-update probe" },
     },
   );
+  // Transaction control, not a write: COMMIT ends the read-only scope, the
+  // UPDATE afterwards runs in a fresh, writable implicit transaction.
+  r.queryHandler(
+    "tries-commit-then-write",
+    z.object({}),
+    async (_query, ctx) => {
+      const raw = asRawClient(ctx.db.unsafeRaw("test: commit-then-write probe"));
+      await raw.unsafe("COMMIT");
+      await raw.unsafe("UPDATE qam_notes SET body = 'tampered'");
+      return { ok: true };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: commit-then-write probe" },
+    },
+  );
+  r.queryHandler(
+    "tries-raw-select",
+    z.object({}),
+    async (_query, ctx) => {
+      const rows = await asRawClient(ctx.db.unsafeRaw("test: raw select probe")).unsafe(
+        "SELECT 1 AS one",
+      );
+      return { ok: true, count: Array.isArray(rows) ? rows.length : 0 };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: raw select probe" },
+    },
+  );
+  r.queryHandler(
+    "nested-raw-select",
+    z.object({}),
+    async (_query, ctx) => ctx.query(TRIES_RAW_SELECT_QN, {}),
+    { access: { roles: ["Admin", "User"] } },
+  );
   r.queryHandler(
     "tries-query-as",
     z.object({}),
@@ -951,9 +990,10 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await addMembership(userId, TENANT_A);
     await createNote(userId, "note-1");
 
-    // SQLSTATE 25001, not 25006 — surfaces as internal_error rather than member_resolution_read_only.
+    // Denied at ctx.db.unsafeRaw, before the SET TRANSACTION READ WRITE reaches Postgres.
     const err = await readAsMemberErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -964,7 +1004,8 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await createNote(userId, "note-1");
 
     const err = await readAsMemberViaQueryErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -1047,4 +1088,70 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
+
+  test("j1) tries-commit-then-write via a write-caller (savepoint path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-write@example.com", "pw-long-enough-36");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("j2) tries-commit-then-write via a query-caller (pool path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-query@example.com", "pw-long-enough-37");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("k1) tries-raw-select via a write-caller is denied — no raw handle, not even for reads", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-write@example.com", "pw-long-enough-38");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("k2) tries-raw-select via a query-caller (pool path) is denied", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-query@example.com", "pw-long-enough-39");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("l) nested-raw-select: a ctx.query hop inside a member read stays without a raw handle", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("nestedrawselect@example.com", "pw-long-enough-40");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, NESTED_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("m) tries-raw-select via the normal dispatch path (no queryAsMember) still works", async () => {
+    await createTenant(TENANT_A);
+
+    const result = await stack.http.queryOk<{ ok: boolean; count: number }>(
+      TRIES_RAW_SELECT_QN,
+      {},
+      admin,
+    );
+    expect(result.ok).toBe(true);
+    expect(result.count).toBe(1);
+  });
 });

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -14,6 +14,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
   name: "signup-registration-status",
   schema: z.object({}),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
   handler: async (_query, ctx) => {

package/src/compliance-profiles/handlers/sub-processors.query.ts

@@ -25,6 +25,7 @@ export const subProcessorsQuery = defineQueryHandler({
   name: "sub-processors",
   schema: z.object({}),
   access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
   handler: async (): Promise<SubProcessorListResponse> => {

package/src/files-tenant-data/__tests__/hooks.integration.test.ts

@@ -12,7 +12,11 @@ import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  type EntityId,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   append,
   createEventsTable,
@@ -133,6 +137,12 @@ async function seedFileRef(tenantId: TenantId, storageKey: string) {
   return { id: result.data.id };
 }
 
+// Stands in for a tenant-handover claim (kumiko-framework#3035): the row's
+// tenantId moves, the storageKey — and the bytes behind it — do not.
+async function handOverFileRef(fileRefId: EntityId, toTenantId: TenantId): Promise<void> {
+  await updateRows(db, fileRefsTable, { tenantId: toTenantId }, { id: String(fileRefId) });
+}
+
 // Sidesteps the `request-destruction` write handler (needs user/auth/sessions
 // features wired) by seeding the same "destroying" state it would produce —
 // same pattern as tenant-lifecycle's own poison-pill destroy tests.
@@ -279,4 +289,81 @@ describe("files-tenant-data :: tenant destroy", () => {
     // forget hook's resolution-failure stance.
     expect(await provider.exists(originalKeyA)).toBe(true);
   });
+
+  // kumiko-framework#3035 — tenant-handover leaves a fileRef row's tenantId
+  // pointing at a NEW tenant while its storageKey (and the bytes behind it)
+  // stay under the tenant that originally uploaded it.
+  describe("after a tenant-handover", () => {
+    test("the destination tenant's destroy deletes the handed-over binary even though it lives outside its own prefix", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const handedOverKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, handedOverKey);
+      await provider.write(handedOverKey, new Uint8Array([1]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantB.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantB.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(0);
+      expect(await provider.exists(handedOverKey)).toBe(false);
+    });
+
+    test("the SOURCE tenant's destroy does not delete a file — or its derivative — a foreign tenant claimed, but still sweeps a true orphan", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const originalKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const derivativeKey = `${originalKey.replace(/\.jpg$/, "")}.medium.jpg`;
+      const orphanKey = `${tenantA.tenantId}/some-other-file.bin`;
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, originalKey);
+      await provider.write(originalKey, new Uint8Array([1]));
+      await provider.write(derivativeKey, new Uint8Array([2]));
+      await provider.write(orphanKey, new Uint8Array([3]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantA.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantA.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      // A's own app-data stage never even sees this row — by the time it ran,
+      // the handover had already moved it to B.
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(1);
+
+      // The silent-data-loss case the whole handover design exists to
+      // prevent: A's storage-prefix sweep must not delete bytes a foreign
+      // tenant's surviving row still references — original AND derivative.
+      expect(await provider.exists(originalKey)).toBe(true);
+      expect(await provider.exists(derivativeKey)).toBe(true);
+      // A true orphan (no fileRef row anywhere) is still swept — the
+      // exception above is narrow, not a general retreat from the sweep.
+      expect(await provider.exists(orphanKey)).toBe(false);
+    });
+  });
 });

package/src/files-tenant-data/hooks.ts

@@ -8,7 +8,20 @@
 //     every fileRef ROW for the tenant via forget() — rebuild-safe, mirrors
 //     document-ingest-foundation's documentExtractTenantDestroyHook. No
 //     isDeleted filter: tenant-destroy purges trashed rows too, a destroyed
-//     tenant has no "restore from trash" future.
+//     tenant has no "restore from trash" future. ALSO sweeps, per row, any
+//     storageKey that does NOT sit under one of this tenant's own
+//     tenantStoragePrefixes() — the shape a tenant-handover (kumiko-
+//     framework#3035) leaves behind: the fileRef row's tenantId moved to
+//     this tenant, but the bytes stayed under the SOURCE tenant's prefix
+//     (moving them would mean copying bytes, which the handover design
+//     explicitly rejects). Must run here, not in the "files" stage below —
+//     that stage's own prefix sweep only reaches keys under ITS tenant's
+//     prefixes by construction, and by the time it runs this hook has
+//     already forgotten (hard-deleted) the rows it would need to read the
+//     storageKey off. Deleted by STEM prefix (storageKeyStemPrefix), not the
+//     exact key: a derived variant (thumbnail, resized render) has no
+//     `file_refs` row of its own, so only the stem reaches original +
+//     derivatives together.
 //   - fileRefStorageDestroyHook ("files" stage, EXT_STORAGE_PROVIDER): wipes
 //     every BINARY (original + derivatives + anything else) under the
 //     tenant's storage prefixes. A full prefix sweep per tenantStoragePrefixes()
@@ -16,29 +29,67 @@
 //     first (see tenantExportPrefix), so this must sweep every known prefix,
 //     stays correct even though the "files" stage runs after "app-data"
 //     already forgot the rows, and can never cross into another tenant's keys
-//     (the provider's own list() prefix already scopes it).
+//     (the provider's own list() prefix already scopes it). Still catches a
+//     blob with no fileRef row at all (the orphan case the row-driven sweep
+//     above cannot see) — REFINED, not replaced, to skip a key a FOREIGN
+//     tenant's fileRef row still references (a tenant-handover, kumiko-
+//     framework#3035, leaves the row's tenantId moved but the storageKey
+//     under THIS tenant's prefix unchanged). By the time this stage runs,
+//     the "app-data" stage (stages.ts DESTRUCTION_STAGES: "app-data" before
+//     "files") has already hard-deleted every row THIS tenant owned, so any
+//     surviving row a listed key still matches is, by construction, a
+//     foreign tenant's — no tenant comparison needed, existence is enough.
+//     The exception is computed from the SURVIVING row's storageKeyStemPrefix
+//     (mirroring the deletion side above), not the listed key's exact match:
+//     a derivative has no fileRef row of its own, so excluding only exact
+//     matches would still delete it out from under the tenant that claimed
+//     its original. Batched: one existence query per chunk of listed keys,
+//     not one query per key.
 
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type StorageProviderDestroyTenantHook,
+  type StorageProviderHookCtx,
   type TenantDataDestroyHook,
+  type TenantDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   assertSafeStorageKey,
   fileRefEntity,
   fileRefsTable,
+  storageKeyStemPrefix,
   tenantStoragePrefixes,
 } from "@cosmicdrift/kumiko-framework/files";
 
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
+// Existence-check batch size for fileRefStorageDestroyHook's survivor lookup
+// — bounds each query instead of one `storage_key = ANY(...)` per listed key,
+// or a single unbounded array for a tenant with a huge prefix.
+const SURVIVOR_CHECK_BATCH_SIZE = 500;
+
+function chunk<T>(items: readonly T[], size: number): T[][] {
+  const chunks: T[][] = [];
+  for (let i = 0; i < items.length; i += size) chunks.push(items.slice(i, i + size));
+  return chunks;
+}
+
+function isUnderOwnPrefix(storageKey: string, prefixes: readonly string[]): boolean {
+  return prefixes.some((prefix) => storageKey.startsWith(prefix));
+}
+
 export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
-  const rows = await ctx.db.selectMany<{ id: string }>(fileRefsTable, {
+  const rows = await ctx.db.selectMany<{ id: string; storageKey: string }>(fileRefsTable, {
     tenantId: ctx.tenantId,
   });
+  const ownPrefixes = tenantStoragePrefixes(ctx.tenantId);
   const user = createSystemUser(ctx.tenantId);
   for (const row of rows) {
+    if (!isUnderOwnPrefix(row.storageKey, ownPrefixes)) {
+      await deleteHandedOverBinary(ctx, row.storageKey);
+    }
     const result = await crud.forget({ id: row.id }, user, ctx.db);
     // Executor writes return {isSuccess:false} instead of throwing — a
     // discarded result would report this destroy stage "succeeded" while the
@@ -52,6 +103,32 @@ export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
   }
 };
 
+async function deleteHandedOverBinary(ctx: TenantDataHookCtx, storageKey: string): Promise<void> {
+  if (!ctx.fileProviderResolver) {
+    // skip: same graceful-degradation stance as fileRefStorageDestroyHook —
+    // no provider wired means the binary sweep is skipped, not fail-closed.
+    ctx.log?.(
+      `[files-tenant-data] no fileProviderResolver wired — handed-over binary for ${storageKey} is NOT deleted`,
+    );
+    // skip: no provider wired, so there is no store to delete from — logged above.
+    return;
+  }
+  let provider: Awaited<ReturnType<NonNullable<TenantDataHookCtx["fileProviderResolver"]>>>;
+  try {
+    provider = await ctx.fileProviderResolver(ctx.tenantId);
+  } catch (err) {
+    ctx.log?.(
+      `[files-tenant-data] no file provider resolvable for tenant ${ctx.tenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`,
+    );
+    // skip: provider resolution failed, so there is nothing this call can delete — logged above.
+    return;
+  }
+  for (const key of await provider.list(storageKeyStemPrefix(storageKey))) {
+    assertSafeStorageKey(key);
+    await provider.delete(key);
+  }
+}
+
 export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async (
   tenantId,
   ctx,
@@ -86,9 +163,30 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
   // converges rather than double-deleting or erroring on a missing key).
   for (const prefix of tenantStoragePrefixes(tenantId)) {
     const keys = await provider.list(prefix);
+    const keptStemPrefixes = await survivorStemPrefixes(ctx.db, keys);
     for (const key of keys) {
+      if (keptStemPrefixes.some((stemPrefix) => key.startsWith(stemPrefix))) continue;
       assertSafeStorageKey(key);
       await provider.delete(key);
     }
   }
 };
+
+// Any listed key that is itself a surviving row's exact storageKey means a
+// foreign tenant still owns it (see header comment) — its stem prefix then
+// also protects any derivative of that same original sitting in the same
+// listed batch, none of which have their own fileRef row.
+async function survivorStemPrefixes(
+  db: StorageProviderHookCtx["db"],
+  keys: readonly string[],
+): Promise<readonly string[]> {
+  const stemPrefixes: string[] = [];
+  for (const batch of chunk(keys, SURVIVOR_CHECK_BATCH_SIZE)) {
+    if (batch.length === 0) continue;
+    const survivors = await selectMany<{ storageKey: string }>(db, fileRefsTable, {
+      storageKey: batch,
+    });
+    for (const survivor of survivors) stemPrefixes.push(storageKeyStemPrefix(survivor.storageKey));
+  }
+  return stemPrefixes;
+}

package/src/managed-pages/handlers/branding.query.ts

@@ -19,6 +19,7 @@ export function createBrandingQuery(opts: { readonly allowCustomCss: boolean })
     name: "branding",
     schema: z.object({}),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
     description:
       "Reads the tenant's public branding values for the rendered page shell, adding the raw custom CSS only when the app opted in and the per-tenant CSS toggle is on; anonymous callers may read it because it dresses public pages.",
     handler: async (_query, ctx) => {

package/src/managed-pages/handlers/by-slug.query.ts

@@ -16,6 +16,7 @@ export const bySlugQuery = defineQueryHandler({
     lang: z.string().min(2).max(8),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Reads the body and metadata of one published managed page of the caller's tenant by slug and language, returning null for drafts and bodyless pages; use it to render a public page, not to load one for editing.",
   handler: async (query, ctx) => {

package/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -28,6 +28,7 @@ export const byTenantPublishedQuery = defineQueryHandler({
     tenantIdOverride: z.string().min(1).optional(),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Lists every published page of a tenant with slug, language, title and last-change time but no body; use it to enumerate the public pages for sitemap.xml or llms.txt, rather than by-slug which fetches one page's content.",
   handler: async (query, ctx) => {

package/src/seo/handlers/seo-config.query.ts

@@ -18,6 +18,7 @@ export const seoConfigQuery = defineQueryHandler({
   name: "config",
   schema: z.object({}),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Reads the tenant's SEO metadata settings — organization name and logo URL, Twitter site handle, LLMs summary and default OG image — as plain strings; use it to inspect what the sitemap, llms.txt and page meta tags will publish.",
   handler: async (_query, ctx) => {

package/src/template-resolver/handlers/by-slug.query.ts

@@ -28,6 +28,7 @@ export const bySlugQuery = defineQueryHandler({
     tenantIdOverride: z.string().min(1).optional(),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
   handler: async (query, ctx) => {

package/src/template-resolver/handlers/by-tenant.query.ts

@@ -33,6 +33,7 @@ export const byTenantQuery = defineQueryHandler({
     tenantIdOverride: z.string().min(1).optional(),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
   handler: async (query, ctx) => {