@cosmicdrift/kumiko-bundled-features 0.289.0 → 0.291.0

package/src/rate-limiting/__tests__/rate-limiting.integration.test.ts

@@ -7,7 +7,12 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+} from "@cosmicdrift/kumiko-framework/stack";
 import { z } from "zod";
 import { createRateLimitingFeature } from "../feature";
 
@@ -93,3 +98,66 @@ describe("rate-limiting feature — status query", () => {
     expect(res.status).toBe(403);
   });
 });
+
+// The bucket key is caller-supplied, so the tenant boundary has to be drawn
+// on it server-side. i18nKey is asserted alongside the code because a plain
+// 403 could also come from tenant resolution and would pass either way.
+const OUTSIDE_TENANT_KEY = "rateLimiting.errors.bucketOutsideTenant";
+
+describe("rate-limiting feature — bucket tenant scope", () => {
+  test("denies an admin the bucket of another tenant", async () => {
+    const err = await stack.http.queryErr(
+      "rate-limiting:query:status",
+      { bucket: `tenant:${testTenantId(2)}`, limit: 5, windowSeconds: 60 },
+      admin,
+    );
+    expect(err.code).toBe("access_denied");
+    expect(err.i18nKey).toBe(OUTSIDE_TENANT_KEY);
+    expect(err.httpStatus).toBe(403);
+  });
+
+  test("denies a key that only starts with the caller's tenant id", async () => {
+    const err = await stack.http.queryErr(
+      "rate-limiting:query:status",
+      { bucket: `tenant:${admin.tenantId}-other`, limit: 5, windowSeconds: 60 },
+      admin,
+    );
+    expect(err.i18nKey).toBe(OUTSIDE_TENANT_KEY);
+  });
+
+  test("denies another user's bucket and the global IP buckets", async () => {
+    for (const bucket of [`user:${TestUsers.user.id}`, "l1:203.0.113.5", "ip:203.0.113.5"]) {
+      const err = await stack.http.queryErr(
+        "rate-limiting:query:status",
+        { bucket, limit: 5, windowSeconds: 60 },
+        admin,
+      );
+      expect(err.i18nKey).toBe(OUTSIDE_TENANT_KEY);
+    }
+  });
+
+  test("allows the caller's own tenant and handler-scoped buckets", async () => {
+    for (const bucket of [
+      `tenant:${admin.tenantId}`,
+      `tenant+handler:${admin.tenantId}:rl-probe:query:ping`,
+      `user+handler:${admin.id}:rl-probe:query:ping`,
+    ]) {
+      const status = await stack.http.queryOk<{ bucket: string; remaining: number }>(
+        "rate-limiting:query:status",
+        { bucket, limit: 5, windowSeconds: 60 },
+        admin,
+      );
+      expect(status.bucket).toBe(bucket);
+      expect(status.remaining).toBe(5);
+    }
+  });
+
+  test("leaves SystemAdmin access to foreign buckets untouched", async () => {
+    const status = await stack.http.queryOk<{ bucket: string }>(
+      "rate-limiting:query:status",
+      { bucket: `tenant:${testTenantId(2)}`, limit: 5, windowSeconds: 60 },
+      TestUsers.systemAdmin,
+    );
+    expect(status.bucket).toBe(`tenant:${testTenantId(2)}`);
+  });
+});

package/src/rate-limiting/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.291.0",
+    "type": "breaking",
+    "title": "`rate-limiting:query:status` only peeks buckets of the calling tenant (fw#3076)",
+    "detail": "The handler took an arbitrary bucket key and peeked it, so a tenant Admin who knew or guessed another tenant's key could read that bucket's counter. The key is now matched segment-exact against the caller: `tenant:`/`tenant+handler:` must carry the caller's own tenant id, `user:`/`user+handler:` the caller's own user id. Everything else — other tenants, other users, the global `ip:`, `l1:` and `l2:` middleware buckets, malformed keys — is `access_denied` (`bucket_outside_tenant`) unless the caller is SystemAdmin, whose access is unchanged. The check runs before the resolver-wiring check, so a denied caller learns nothing about the mount either.",
+    "migration": "Only affects non-SystemAdmin callers of `rate-limiting:query:status`. A tenant\nAdmin keeps `tenant:<own>`, `tenant+handler:<own>:<handler>`, `user:<self>` and\n`user+handler:<self>:<handler>`. Two reads it had before now need SystemAdmin:\nanother user's bucket inside the same tenant (the tenant is not part of a\n`user:` key, so it cannot be verified without a membership lookup) and the\nglobal `ip:`/`l1:`/`l2:` buckets, which are not tenant-owned. Ops tooling that\npeeks those from a tenant Admin session has to run as SystemAdmin."
+  }
+]

package/src/rate-limiting/constants.ts

@@ -6,4 +6,5 @@ export const RateLimitQueries = {
 
 export const RateLimitErrors = {
   resolverUnavailable: "rate_limit_resolver_unavailable",
+  bucketOutsideTenant: "bucket_outside_tenant",
 } as const;

package/src/rate-limiting/handlers/bucket-access.ts

@@ -0,0 +1,39 @@
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
+import { RateLimitErrors } from "../constants";
+
+// Bucket keys are `<dimension>:<subject>[:<handler>]` (framework
+// rate-limit/bucket.ts) — only `tenant*` and `user*` carry a subject the
+// caller can own. `l1:`/`l2:` (middleware.ts) and every `ip*` bucket are
+// global, so they stay SystemAdmin-only.
+type BucketCaller = {
+  readonly id: string;
+  readonly tenantId: string;
+  readonly roles: readonly string[];
+};
+
+function ownsBucket(bucket: string, caller: BucketCaller): boolean {
+  const [dimension, subject, ...handler] = bucket.split(":");
+  if (dimension === undefined) return false;
+  const owner =
+    dimension === "tenant" || dimension === "tenant+handler"
+      ? caller.tenantId
+      : dimension === "user" || dimension === "user+handler"
+        ? caller.id
+        : undefined;
+  if (owner === undefined) return false;
+  // Segment-exact: a startsWith check would pass `tenant:<own-id>-other`.
+  if (subject !== owner) return false;
+  return dimension.endsWith("+handler") ? handler.length > 0 : handler.length === 0;
+}
+
+export function bucketAccessDenied(
+  bucket: string,
+  caller: BucketCaller,
+): AccessDeniedError | undefined {
+  if (caller.roles.includes("SystemAdmin")) return undefined;
+  if (ownsBucket(bucket, caller)) return undefined;
+  return new AccessDeniedError({
+    i18nKey: "rateLimiting.errors.bucketOutsideTenant",
+    details: { reason: RateLimitErrors.bucketOutsideTenant },
+  });
+}

package/src/rate-limiting/handlers/status.query.ts

@@ -2,6 +2,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { RateLimitErrors } from "../constants";
+import { bucketAccessDenied } from "./bucket-access";
 
 // Ops-side bucket inspection. Pass the bucket key (e.g. "user:42",
 // "user+handler:42:orders:write:order:create") plus the limit/window the bucket
@@ -16,14 +17,15 @@ import { RateLimitErrors } from "../constants";
 // Bucket key format is owned by the framework (see rate-limit/bucket.ts);
 // callers pass the constructed key directly. We don't synthesize from
 // (per, user, handler) here — peeking is a low-level op, the lookup
-// surface stays small.
+// surface stays small. Because the key is caller-supplied, bucket-access.ts
+// restricts it to the caller's own tenant/user unless they are SystemAdmin.
 export const rateLimitStatus = defineQueryHandler({
   // Short name — the registry qualifies this to `rate-limiting:query:status`
   // when the feature is registered. Passing the qualified form here would
   // double-prefix it and the handler wouldn't be reachable.
   name: "status",
   description:
-    "Peeks at one rate-limit bucket and returns its remaining tokens, window and next reset without consuming a token; use it to explain why a caller is being throttled.",
+    "Peeks at one rate-limit bucket and returns its remaining tokens, window and next reset without consuming a token; use it to explain why a caller is being throttled. Non-SystemAdmin callers may only peek their own tenant's buckets (`tenant:`/`tenant+handler:`) and their own user buckets (`user:`/`user+handler:`); every other key, including the global `ip:`/`l1:`/`l2:` buckets, requires SystemAdmin.",
   schema: z.object({
     bucket: z.string().min(1),
     limit: z.number().int().positive(),
@@ -31,6 +33,10 @@ export const rateLimitStatus = defineQueryHandler({
   }),
   access: { roles: ["Admin", "SystemAdmin"] },
   handler: async (query, ctx) => {
+    // Before the resolver check, so a foreign-tenant caller learns nothing
+    // about the wiring either.
+    const denied = bucketAccessDenied(query.payload.bucket, ctx.user);
+    if (denied) throw denied;
     if (!ctx.rateLimit) {
       throw new UnprocessableError(RateLimitErrors.resolverUnavailable, {
         i18nKey: "rateLimiting.errors.resolverUnavailable",

package/src/subscription-mollie/__tests__/mollie-foundation.integration.test.ts

@@ -33,6 +33,7 @@ import {
   setupTestStack,
   type TestStack,
   testTenantId,
+  unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import type {
   Payment as MolliePayment,
@@ -42,6 +43,7 @@ import { Hono } from "hono";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionMollieFeature } from "../feature";
 import type { MollieClientShape } from "../verify-webhook";
@@ -150,6 +152,7 @@ beforeAll(async () => {
   // subscriptionsProjectionTable wird von setupTestStack automatisch
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
 
   webhookApp = new Hono();
   webhookApp.post(

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -29,6 +29,7 @@ import {
   setupTestStack,
   type TestStack,
   testTenantId,
+  unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
@@ -45,6 +46,7 @@ import {
   tenantSecretsTable,
 } from "../../secrets";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { createSubscriptionStripeFeature } from "../feature";
 
@@ -115,6 +117,7 @@ beforeAll(async () => {
   // gepusht (r.projection mit `table`-Property → auto-push). config +
   // secrets brauchen ihre Tabellen explizit.
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafePushTables(db, { configValuesTable, tenant_secrets: tenantSecretsTable });
   // Standalone-secrets-context (gleiche KEK) zum direkten Seeden +
   // als systemSecrets für die zweite webhook-app.
@@ -504,6 +507,7 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
       }),
     });
     await createEventsTable(gateStack.db);
+    await unsafeCreateEntityTable(gateStack.db, tenantEntity);
     await unsafePushTables(gateStack.db, {
       configValuesTable,
       tenant_secrets: tenantSecretsTable,

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -469,3 +469,111 @@ describe("tenant-lifecycle :: sweep isolates one tenant's failure from another's
     expect(eventsB.some((e) => e.type.endsWith("tenant-destruction-stage-succeeded"))).toBe(true);
   });
 });
+
+// No authConfig here on purpose: buildServer derives the 410 gate from the
+// mounted tenantLifecycleStatus provider. The stacks above keep the explicit
+// auth.resolveTenantLifecycleStatus override covered.
+describe("tenant-lifecycle :: 410 gate derived from the mounted provider", () => {
+  let derivedStack: TestStack;
+
+  beforeAll(async () => {
+    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ cipher: encryption });
+    derivedStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        authFoundationFeature,
+        createSessionsFeature(),
+        createTenantLifecycleFeature(),
+      ],
+      extraContext: { configResolver: resolver, configEncryption: encryption },
+    });
+    await unsafeCreateEntityTable(derivedStack.db, tenantEntity);
+    await unsafeCreateEntityTable(derivedStack.db, userSessionEntity);
+    await unsafeCreateEntityTable(derivedStack.db, tenantComplianceProfileEntity);
+    await unsafeCreateEntityTable(derivedStack.db, tenantMembershipEntity);
+    await createEventsTable(derivedStack.db);
+    await unsafePushTables(derivedStack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await derivedStack.cleanup();
+  });
+
+  beforeEach(async () => {
+    derivedStack.events.reset();
+    resetTenantLifecycleGateCacheForTests();
+    await resetTestTables(derivedStack.db, [
+      tenantTable,
+      tenantComplianceProfileTable,
+      userSessionTable,
+      tenantMembershipsTable,
+      eventsTable,
+    ]);
+    await derivedStack.http.writeOk(
+      TenantHandlers.create,
+      { id: tenantAdmin.tenantId, key: "acme", name: "ACME Corp" },
+      TestUsers.systemAdmin,
+    );
+    await derivedStack.http.writeOk(SET_PROFILE, { profileKey: "eu-dsgvo" }, tenantAdmin);
+  });
+
+  async function rejectionCode(res: Response): Promise<string | undefined> {
+    const body = (await res.json()) as { error?: { code?: string } };
+    return body.error?.code;
+  }
+
+  test("active tenant passes the gate", async () => {
+    const res = await derivedStack.http.query(TenantQueries.me, {}, tenantAdmin);
+    expect(res.status).toBe(200);
+  });
+
+  test("destroyRequested tenant gets 410 tenant_unavailable without any hand-wiring", async () => {
+    await derivedStack.http.writeOk(REQUEST, {}, tenantAdmin);
+    resetTenantLifecycleGateCacheForTests();
+
+    const res = await derivedStack.http.query(TenantQueries.me, {}, tenantAdmin);
+    expect(res.status).toBe(410);
+    expect(await rejectionCode(res)).toBe("tenant_unavailable");
+  });
+
+  test("cancel-destruction stays exempt while destroyRequested", async () => {
+    await derivedStack.http.writeOk(REQUEST, {}, tenantAdmin);
+    resetTenantLifecycleGateCacheForTests();
+
+    const cancelled = await derivedStack.http.writeOk<{ status: string }>(CANCEL, {}, tenantAdmin);
+    expect(cancelled.status).toBe("active");
+  });
+
+  test("batch mixing cancel-destruction with another write gets 410", async () => {
+    await derivedStack.http.writeOk(REQUEST, {}, tenantAdmin);
+    resetTenantLifecycleGateCacheForTests();
+
+    const res = await derivedStack.http.batch(
+      [
+        { type: CANCEL, payload: {} },
+        { type: SET_PROFILE, payload: { profileKey: "eu-dsgvo" } },
+      ],
+      tenantAdmin,
+    );
+    expect(res.status).toBe(410);
+    expect(await rejectionCode(res)).toBe("tenant_unavailable");
+  });
+
+  test("destroying tenant has no cancel exemption", async () => {
+    await updateRows(
+      derivedStack.db,
+      tenantTable,
+      { status: "destroying" },
+      { id: tenantAdmin.tenantId },
+    );
+    resetTenantLifecycleGateCacheForTests();
+
+    const res = await derivedStack.http.write(CANCEL, {}, tenantAdmin);
+    expect(res.status).toBe(410);
+    expect(await rejectionCode(res)).toBe("tenant_unavailable");
+  });
+});