@cosmicdrift/kumiko-bundled-features 0.55.1 → 0.56.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.55.1",
+  "version": "0.56.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,11 +80,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.50.0",
-    "@cosmicdrift/kumiko-framework": "0.50.0",
-    "@cosmicdrift/kumiko-headless": "0.50.0",
-    "@cosmicdrift/kumiko-renderer": "0.50.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.50.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.55.1",
+    "@cosmicdrift/kumiko-framework": "0.55.1",
+    "@cosmicdrift/kumiko-headless": "0.55.1",
+    "@cosmicdrift/kumiko-renderer": "0.55.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.55.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/config/constants.ts

@@ -22,6 +22,7 @@ export const ConfigErrors = {
   unknownKey: "unknown_config_key",
   systemOnly: "config_key_is_system_only",
   invalidScope: "invalid_scope",
+  systemScopeWriteDenied: "system_scope_write_denied",
   typeError: "type_error",
   invalidOption: "invalid_option",
 } as const;

package/src/config/handlers/__tests__/prepare-config-write.test.ts

@@ -184,6 +184,33 @@ describe("prepareConfigWrite", () => {
     expect(result.tenantId).toBe("t-99");
     expect(result.userId).toBe("u-99");
   });
+
+  test("TenantAdmin cannot write tenant-scoped key at system scope (platform default row)", () => {
+    const tenantKey = createTenantConfig("text", { write: access.admin });
+    const result = prepareConfigWrite({
+      registry: registryStub({ "ns:config:smtp-host": tenantKey }),
+      user: userStub(["TenantAdmin"]),
+      key: "ns:config:smtp-host",
+      scope: ConfigScopes.system,
+    });
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("unreachable");
+    expect(result.failure.error.code).toBe("access_denied");
+    expect(result.failure.error.i18nKey).toBe("config.errors.systemScopeWriteDenied");
+  });
+
+  test("SystemAdmin can write tenant-scoped key at system scope", () => {
+    const tenantKey = createTenantConfig("text", { write: access.admin });
+    const result = prepareConfigWrite({
+      registry: registryStub({ "ns:config:smtp-host": tenantKey }),
+      user: userStub(["SystemAdmin"], SYSTEM_TENANT_ID, "sys-1"),
+      key: "ns:config:smtp-host",
+      scope: ConfigScopes.system,
+    });
+    expect(result.ok).toBe(true);
+    if (!result.ok) throw new Error("unreachable");
+    expect(result.scope).toBe(ConfigScopes.system);
+  });
 });
 
 describe("validateBounds", () => {

package/src/config/write-helpers.ts

@@ -101,6 +101,9 @@ export function prepareConfigWrite(args: PrepareConfigWriteArgs): PrepareConfigW
   if (writeError) return { ok: false, failure: writeFailure(writeError) };
 
   const scope = requestedScope ?? keyDef.scope;
+  const scopeWriteError = checkScopeWriteAccess(scope, user.roles);
+  if (scopeWriteError) return { ok: false, failure: writeFailure(scopeWriteError) };
+
   const { tenantId, userId } = resolveScopeIds(scope, user.tenantId, user.id);
   return { ok: true, keyDef, scope, tenantId, userId };
 }
@@ -141,6 +144,24 @@ export function checkWriteAccess(
   });
 }
 
+/**
+ * Level-aware write gate: writing the system-row (platform default) requires
+ * SystemAdmin even when the key's flat write-set includes TenantAdmin.
+ */
+export function checkScopeWriteAccess(
+  scope: ConfigScope,
+  userRoles: readonly string[],
+): KumikoError | null {
+  if (scope !== ConfigScopes.system) return null;
+  if (userRoles.includes(SYSTEM_ROLE)) return null;
+  if (userRoles.includes("SystemAdmin")) return null;
+  return new AccessDeniedError({
+    message: "system-scope config write requires SystemAdmin",
+    i18nKey: "config.errors.systemScopeWriteDenied",
+    details: { reason: ConfigErrors.systemScopeWriteDenied, scope },
+  });
+}
+
 export function validateScope(
   requestedScope: ConfigScope,
   definedScope: ConfigScope,