@cosmicdrift/kumiko-bundled-features 0.87.0 → 0.87.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.87.0",
+  "version": "0.87.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -86,11 +86,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.87.0",
-    "@cosmicdrift/kumiko-framework": "0.87.0",
-    "@cosmicdrift/kumiko-headless": "0.87.0",
-    "@cosmicdrift/kumiko-renderer": "0.87.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.87.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.87.2",
+    "@cosmicdrift/kumiko-framework": "0.87.2",
+    "@cosmicdrift/kumiko-headless": "0.87.2",
+    "@cosmicdrift/kumiko-renderer": "0.87.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.87.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -429,3 +429,38 @@ describe("invitations-query (pending list)", () => {
     expect(list[0]?.status).toBe("pending");
   });
 });
+
+// Privilege-escalation regression: a Tenant-Admin must not be able to seed a
+// platform-global/reserved role (SystemAdmin, system, all, anonymous) into a
+// tenant membership via the invite flow — once it lands in membership.roles it
+// merges flat into the session and unlocks the SystemAdmin-gated cross-tenant
+// handler surface (hasAccess can't tell membership roles from global ones).
+describe("privilege escalation via invite role", () => {
+  // Each forbidden value is a platform-global/reserved role that must never
+  // reach a tenant membership. Proven exploitable before the fix: inviting
+  // "SystemAdmin" gave the invitee a JWT carrying SystemAdmin flat, which
+  // passed every SystemAdmin gate cross-tenant.
+  const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"];
+
+  test("invite-create rejects reserved/global roles — no invitation persisted", async () => {
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        AuthHandlers.inviteCreate,
+        { email: CAROL_EMAIL, role },
+        aliceSession(),
+      );
+      expect(err.code).toBe("access_denied");
+      const rows = await selectMany(stack.db, tenantInvitationsTable, { email: CAROL_EMAIL });
+      expect(rows).toHaveLength(0);
+    }
+  });
+
+  test("legitimate tenant role still issues an invitation", async () => {
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: CAROL_EMAIL, role: "Editor" },
+      aliceSession(),
+    )) as { role: string };
+    expect(result.role).toBe("Editor");
+  });
+});

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -27,6 +27,11 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
+// kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
+import {
+  findForbiddenMembershipRole,
+  reservedMembershipRoleError,
+} from "../../tenant/membership-roles";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants";
 import { getTokenForInvitation, storeInviteToken } from "../invite-token-store";
 
@@ -69,6 +74,11 @@ export function createInviteCreateHandler(opts: InviteCreateOptions = {}) {
         );
       }
 
+      const forbiddenRole = findForbiddenMembershipRole([event.payload.role]);
+      if (forbiddenRole !== undefined) {
+        return writeFailure(reservedMembershipRoleError(forbiddenRole));
+      }
+
       const email = event.payload.email.toLowerCase();
       const tenantId = event.user.tenantId;
       const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });

package/src/auth-email-password/web/__tests__/session-auth-bootstrap.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { emailPasswordClient } from "../client-plugin";
+import { hasLikelyAuthSession } from "../session";
+
+describe("hasLikelyAuthSession", () => {
+  test("no kumiko_csrf cookie → false", () => {
+    expect(hasLikelyAuthSession("theme=dark")).toBe(false);
+  });
+
+  test("kumiko_csrf present → true", () => {
+    expect(hasLikelyAuthSession("kumiko_csrf=abc-123")).toBe(true);
+  });
+});
+
+describe("emailPasswordClient", () => {
+  test("registers SessionAuthGate as gate, not SessionProvider as provider", () => {
+    const feature = emailPasswordClient();
+    expect(feature.providers).toEqual([]);
+    expect(feature.gates).toHaveLength(1);
+    expect(feature.gates[0]?.name).toBe("SessionAuthGate");
+  });
+});

package/src/auth-email-password/web/auth-gate.tsx

@@ -11,7 +11,7 @@
 
 import type { ComponentType, ReactNode } from "react";
 import { LoginScreen, type LoginScreenProps } from "./login-screen";
-import { useSession } from "./session";
+import { SessionProvider, useSession } from "./session";
 
 export function makeAuthGate(
   LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
@@ -31,3 +31,22 @@ export function makeAuthGate(
   }
   return AuthGate;
 }
+
+/** SessionProvider + AuthGate als ein Gate — damit öffentliche Gates davor
+ *  (z.B. /rechner) den Session-Bootstrap nicht mounten. createKumikoApp
+ *  stackt providers außerhalb aller gates; SessionProvider darf deshalb
+ *  kein provider mehr sein. */
+export function makeSessionAuthGate(
+  LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
+  loginProps?: LoginScreenProps,
+): ComponentType<{ children: ReactNode }> {
+  const AuthGate = makeAuthGate(LoginComponent, loginProps);
+  function SessionAuthGate({ children }: { readonly children: ReactNode }): ReactNode {
+    return (
+      <SessionProvider>
+        <AuthGate>{children}</AuthGate>
+      </SessionProvider>
+    );
+  }
+  return SessionAuthGate;
+}

package/src/auth-email-password/web/client-plugin.ts

@@ -8,9 +8,8 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
 import { defaultTranslations, mergeTranslations } from "../i18n";
-import { makeAuthGate } from "./auth-gate";
+import { makeSessionAuthGate } from "./auth-gate";
 import type { LoginScreenProps } from "./login-screen";
-import { SessionProvider } from "./session";
 
 export type EmailPasswordClientOptions = {
   /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
@@ -41,8 +40,8 @@ export function emailPasswordClient(
   const translations = mergeTranslations(defaultTranslations, options.translations ?? {});
   return {
     name: "auth-email-password",
-    providers: [SessionProvider],
-    gates: [makeAuthGate(options.loginScreen, options.loginScreenProps)],
+    providers: [],
+    gates: [makeSessionAuthGate(options.loginScreen, options.loginScreenProps)],
     translations,
   };
 }

package/src/auth-email-password/web/index.ts

@@ -26,7 +26,7 @@ export {
 } from "./auth-client";
 export type { AuthShellRenderer } from "./auth-form-primitives";
 export { AuthShellProvider, useAuthShell } from "./auth-form-primitives";
-export { makeAuthGate } from "./auth-gate";
+export { makeAuthGate, makeSessionAuthGate } from "./auth-gate";
 export type {
   EmailPasswordClientFeature,
   EmailPasswordClientOptions,
@@ -43,7 +43,7 @@ export { LoginScreen } from "./login-screen";
 export type { ResetPasswordScreenProps } from "./reset-password-screen";
 export { ResetPasswordScreen } from "./reset-password-screen";
 export type { SessionApi, SessionState, SessionStatus } from "./session";
-export { SessionContext, SessionProvider, useSession } from "./session";
+export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session";
 export type { SignupCompleteScreenProps } from "./signup-complete-screen";
 export { SignupCompleteScreen } from "./signup-complete-screen";
 export type { SignupScreenProps } from "./signup-screen";

package/src/auth-email-password/web/session.tsx

@@ -9,6 +9,7 @@
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 
+import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
 import { createContext, type ReactNode, useCallback, useContext, useEffect, useState } from "react";
 import {
   type CurrentUserProfile,
@@ -43,6 +44,14 @@ export type SessionApi = SessionState & {
   readonly switchTenant: (tenantId: string) => Promise<void>;
 };
 
+const UNAUTHENTICATED: SessionState = {
+  status: "unauthenticated",
+  user: null,
+  activeTenantId: null,
+  tenants: [],
+  roles: [],
+};
+
 const INITIAL: SessionState = {
   status: "loading",
   user: null,
@@ -51,6 +60,11 @@ const INITIAL: SessionState = {
   roles: [],
 };
 
+// kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
+export function hasLikelyAuthSession(cookieSource?: string): boolean {
+  return readCsrfToken(cookieSource) !== undefined;
+}
+
 // Exported damit tests den merge-pfad direkt pinnen können — der hier
 // muss byte-identisch zum server-side merge in auth-routes.ts +
 // login.write.ts sein, sonst sieht der Client andere session-rollen
@@ -76,27 +90,18 @@ export function computeActiveRoles(
 export const SessionContext = createContext<SessionApi | undefined>(undefined);
 
 // Eine Refresh-Runde: /auth/tenants → wenn 401 nicht-eingeloggt, sonst
-// parallel /user:me. Beides zusammen ergibt den vollen SessionState.
+// /user:me. Beides zusammen ergibt den vollen SessionState.
 async function refresh(): Promise<SessionState> {
+  if (!hasLikelyAuthSession()) {
+    return UNAUTHENTICATED;
+  }
   const tenants = await fetchTenants();
   if (tenants === null) {
-    return {
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    };
+    return UNAUTHENTICATED;
   }
   const user = await fetchCurrentUser();
   if (user === null) {
-    return {
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    };
+    return UNAUTHENTICATED;
   }
   return {
     status: "authenticated",
@@ -131,13 +136,7 @@ export function SessionProvider({ children }: { readonly children: ReactNode }):
 
   const logout = useCallback<SessionApi["logout"]>(async () => {
     await logoutApi();
-    setState({
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    });
+    setState(UNAUTHENTICATED);
     // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
     // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
     // sauberer Ausgangslage, ohne dass wir jeden einzelnen Consumer

package/src/compliance-profiles/handlers/set-profile.write.ts

@@ -5,9 +5,12 @@ import {
   SELECTABLE_PROFILE_KEYS,
 } from "@cosmicdrift/kumiko-framework/compliance";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  AccessDeniedError,
+  crossTenantOverrideDenied,
+  defineWriteHandler,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
   UnprocessableError,
   validationErrorFromZod,
   writeFailure,
@@ -58,14 +61,12 @@ export const setProfileWrite = defineWriteHandler({
   access: { roles: [ROLES.TenantAdmin, ROLES.SystemAdmin] },
   handler: async (event, ctx) => {
     const tenantOverride = event.payload.tenantIdOverride;
-    if (tenantOverride !== undefined && !event.user.roles.includes(ROLES.SystemAdmin)) {
-      return writeFailure(
-        new AccessDeniedError({
-          i18nKey: "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin",
-          details: { reason: "tenant_override_requires_system_admin" },
-        }),
-      );
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      event.user,
+      tenantOverride,
+      "complianceProfiles.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) return writeFailure(overrideDenied);
     const tenantId = (tenantOverride ?? event.user.tenantId) as TenantId; // @cast-boundary engine-payload
     const executorUser = tenantOverride !== undefined ? { ...event.user, tenantId } : event.user;
 

package/src/managed-pages/handlers/set.write.ts

@@ -1,7 +1,11 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  crossTenantOverrideDenied,
+  defineWriteHandler,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { type PageRow, pageEntity, pagesTable } from "../table";
 
@@ -42,14 +46,12 @@ export const setWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     const db = ctx.db;
     const override = event.payload.tenantIdOverride;
-    if (override !== undefined && !event.user.roles.includes("SystemAdmin")) {
-      return writeFailure(
-        new AccessDeniedError({
-          i18nKey: "managedPages.errors.tenantOverrideRequiresSystemAdmin",
-          details: { reason: "tenant_override_requires_system_admin" },
-        }),
-      );
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      event.user,
+      override,
+      "managedPages.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) return writeFailure(overrideDenied);
     const tenantId = override ?? event.user.tenantId;
     // override: point the executor context at the target tenant, else getStreamVersion runs against user.tenantId → version_conflict.
     const executorUser =

package/src/template-resolver/handlers/upsert-tenant.write.ts

@@ -1,5 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
+  crossTenantOverrideDenied,
   defineWriteHandler,
   SYSTEM_TENANT_ID,
   type TenantId,
@@ -25,14 +26,12 @@ export const upsertTenantWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     const db = ctx.db;
     const override = event.payload.tenantIdOverride;
-    if (override !== undefined && !event.user.roles.includes("SystemAdmin")) {
-      return writeFailure(
-        new AccessDeniedError({
-          i18nKey: "templateResolver.errors.tenantOverrideRequiresSystemAdmin",
-          details: { reason: "tenant_override_requires_system_admin" },
-        }),
-      );
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      event.user,
+      override,
+      "templateResolver.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) return writeFailure(overrideDenied);
     // upsertTenant erzeugt scope='tenant'. SYSTEM_TENANT_ID-Override würde
     // scope='tenant' unter SYSTEM_TENANT_ID schreiben → inkonsistenter Zustand
     // (Resolver-Logik trennt sauber zwischen system+tenant). SystemAdmin muss

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -433,3 +433,34 @@ describe("scenario 8: entityList/entityEdit convention QNs", () => {
     ]);
   });
 });
+
+// Privilege-escalation guard: platform-global/reserved roles must never be
+// writable into a tenant membership, not even by a SystemAdmin — once present
+// they merge flat into the session and grant cross-tenant authority. The
+// forbidden-role check runs before any DB access, so these reject without the
+// memberships table being mounted in this stack.
+describe("scenario 9: membership role escalation guard", () => {
+  const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"];
+
+  test("add-member rejects reserved/global roles even for SystemAdmin", async () => {
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        TenantHandlers.addMember,
+        { userId: systemAdmin.id, tenantId: systemAdmin.tenantId, roles: [role] },
+        systemAdmin,
+      );
+      expectErrorIncludes(err, "access_denied");
+    }
+  });
+
+  test("update-member-roles rejects reserved/global roles even for SystemAdmin", async () => {
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        TenantHandlers.updateMemberRoles,
+        { userId: systemAdmin.id, tenantId: systemAdmin.tenantId, roles: [role] },
+        systemAdmin,
+      );
+      expectErrorIncludes(err, "access_denied");
+    }
+  });
+});

package/src/tenant/handlers/add-member.write.ts

@@ -4,6 +4,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { TenantErrors } from "../constants";
+import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
 
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
@@ -20,6 +21,8 @@ export const addMemberWrite = defineWriteHandler({
   access: { roles: ["SystemAdmin"] },
   handler: async (event, ctx) => {
     const db = ctx.db;
+    const forbidden = findForbiddenMembershipRole(event.payload.roles);
+    if (forbidden !== undefined) return writeFailure(reservedMembershipRoleError(forbidden));
     const existing = await fetchOne(db, tenantMembershipsTable, {
       userId: event.payload.userId,
       tenantId: event.payload.tenantId,

package/src/tenant/handlers/update-member-roles.write.ts

@@ -3,6 +3,7 @@ import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framew
 import { defineWriteHandler, withResponseData } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
 
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
@@ -23,6 +24,8 @@ export const updateMemberRolesWrite = defineWriteHandler({
   access: { roles: ["system", "SystemAdmin"] },
   handler: async (event, ctx) => {
     const db = ctx.db;
+    const forbidden = findForbiddenMembershipRole(event.payload.roles);
+    if (forbidden !== undefined) return writeFailure(reservedMembershipRoleError(forbidden));
     const existing = await fetchOne(db, tenantMembershipsTable, {
       userId: event.payload.userId,
       tenantId: event.payload.tenantId,

package/src/tenant/membership-roles.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
+import { assertAssignableMembershipRoles, findForbiddenMembershipRole } from "./membership-roles";
+
+describe("membership-roles", () => {
+  const FORBIDDEN = ["system", "SystemAdmin", "all", "anonymous"];
+
+  test("findForbiddenMembershipRole flags each reserved/global role", () => {
+    for (const role of FORBIDDEN) {
+      expect(findForbiddenMembershipRole([role])).toBe(role);
+      expect(findForbiddenMembershipRole(["Admin", role, "User"])).toBe(role);
+    }
+  });
+
+  test("findForbiddenMembershipRole allows legitimate tenant roles", () => {
+    expect(findForbiddenMembershipRole(["Admin", "Editor", "User", "TenantAdmin"])).toBeUndefined();
+    expect(findForbiddenMembershipRole([])).toBeUndefined();
+  });
+
+  test("assertAssignableMembershipRoles throws AccessDeniedError on a forbidden role", () => {
+    expect(() => assertAssignableMembershipRoles(["Admin", "SystemAdmin"])).toThrow(
+      AccessDeniedError,
+    );
+  });
+
+  test("assertAssignableMembershipRoles passes legitimate roles", () => {
+    expect(() => assertAssignableMembershipRoles(["Admin", "User"])).not.toThrow();
+  });
+});

package/src/tenant/membership-roles.ts

@@ -0,0 +1,32 @@
+// A tenant membership must never carry a platform-global/reserved role.
+// hasAccess checks session.roles flat, with no notion of where a role came
+// from — so a membership role like "SystemAdmin" merges into the session at
+// login/switch and unlocks the SystemAdmin-gated, cross-tenant handler
+// surface. The seed path already keeps these roles global-only (users.roles);
+// this validator makes every membership-role write path enforce the same
+// invariant. Derived from the framework presets so it tracks access.privileged.
+
+import { access } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
+
+const FORBIDDEN_MEMBERSHIP_ROLES: ReadonlySet<string> = new Set<string>([
+  ...access.privileged, // system, SystemAdmin
+  ...access.all, // all
+  ...access.anonymous, // anonymous
+]);
+
+export function findForbiddenMembershipRole(roles: readonly string[]): string | undefined {
+  return roles.find((role) => FORBIDDEN_MEMBERSHIP_ROLES.has(role));
+}
+
+export function reservedMembershipRoleError(role: string): AccessDeniedError {
+  return new AccessDeniedError({
+    message: `role "${role}" is reserved and cannot be assigned to a tenant membership`,
+    details: { reason: "reserved_membership_role", role },
+  });
+}
+
+export function assertAssignableMembershipRoles(roles: readonly string[]): void {
+  const forbidden = findForbiddenMembershipRole(roles);
+  if (forbidden !== undefined) throw reservedMembershipRoleError(forbidden);
+}

package/src/tenant/seeding.ts

@@ -37,6 +37,7 @@ import {
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { assertAssignableMembershipRoles } from "./membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
 import { tenantEntity, tenantTable } from "./schema/tenant";
 
@@ -127,6 +128,9 @@ export async function seedTenantMembership(
   db: DbRunner,
   options: SeedTenantMembershipOptions,
 ): Promise<{ id: string }> {
+  // Chokepoint: invite-accept (×3) + seedAdmin/provisionSignup all flow
+  // through here — reject reserved/global roles before they ever persist.
+  assertAssignableMembershipRoles(options.roles);
   const by = options.by ?? TestUsers.systemAdmin;
   // Wrap into a system-scoped TenantDb so the insert respects the tenant-
   // override (we write into options.tenantId, which may differ from by.tenantId).

package/src/text-content/handlers/by-slug.query.ts

@@ -1,6 +1,8 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  crossTenantOverrideDenied,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { type TextBlockRow, textBlocksTable } from "../table";
 
@@ -27,12 +29,12 @@ export const bySlugQuery = defineQueryHandler({
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
   handler: async (query, ctx) => {
     const override = query.payload.tenantIdOverride;
-    if (override !== undefined && !query.user.roles.includes("SystemAdmin")) {
-      throw new AccessDeniedError({
-        i18nKey: "textContent.errors.tenantOverrideRequiresSystemAdmin",
-        details: { reason: "tenant_override_requires_system_admin" },
-      });
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      query.user,
+      override,
+      "textContent.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) throw overrideDenied;
     const tenantId = override ?? query.user.tenantId;
     const row = await fetchOne<TextBlockRow>(ctx.db, textBlocksTable, {
       tenantId,

package/src/text-content/handlers/by-tenant.query.ts

@@ -1,7 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  crossTenantOverrideDenied,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { type TextBlockRow, textBlocksTable } from "../table";
 
@@ -34,12 +36,12 @@ export const byTenantQuery = defineQueryHandler({
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
   handler: async (query, ctx) => {
     const override = query.payload.tenantIdOverride;
-    if (override !== undefined && !query.user.roles.includes("SystemAdmin")) {
-      throw new AccessDeniedError({
-        i18nKey: "textContent.errors.tenantOverrideRequiresSystemAdmin",
-        details: { reason: "tenant_override_requires_system_admin" },
-      });
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      query.user,
+      override,
+      "textContent.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) throw overrideDenied;
     const tenantId = override ?? query.user.tenantId;
     const rows = castTenantRows<TextBlockRow>(
       await selectMany(ctx.db, textBlocksTable, { tenantId: tenantId }),

package/src/text-content/handlers/set.write.ts

@@ -1,7 +1,11 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  crossTenantOverrideDenied,
+  defineWriteHandler,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { type TextBlockRow, textBlockEntity, textBlocksTable } from "../table";
 
@@ -68,14 +72,12 @@ export const setWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     const db = ctx.db;
     const override = event.payload.tenantIdOverride;
-    if (override !== undefined && !event.user.roles.includes("SystemAdmin")) {
-      return writeFailure(
-        new AccessDeniedError({
-          i18nKey: "textContent.errors.tenantOverrideRequiresSystemAdmin",
-          details: { reason: "tenant_override_requires_system_admin" },
-        }),
-      );
-    }
+    const overrideDenied = crossTenantOverrideDenied(
+      event.user,
+      override,
+      "textContent.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) return writeFailure(overrideDenied);
     const tenantId = override ?? event.user.tenantId;
     // Bei tenantIdOverride muss auch der user-context auf den ziel-tenant
     // umgestellt werden, sonst läuft der event-store-Lookup