@cosmicdrift/kumiko-bundled-features 0.87.2 → 0.87.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.87.2",
+  "version": "0.87.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -86,11 +86,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.87.2",
-    "@cosmicdrift/kumiko-framework": "0.87.2",
-    "@cosmicdrift/kumiko-headless": "0.87.2",
-    "@cosmicdrift/kumiko-renderer": "0.87.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.87.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.87.3",
+    "@cosmicdrift/kumiko-framework": "0.87.3",
+    "@cosmicdrift/kumiko-headless": "0.87.3",
+    "@cosmicdrift/kumiko-renderer": "0.87.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.87.3",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -251,3 +251,46 @@ describe("multi-roles: switch-tenant erhält globale rollen", () => {
     expect(switchBody.roles).toEqual(["User"]);
   });
 });
+
+// Read-time backstop (engine/membership-roles): the write paths reject reserved
+// roles at command time, but a projection rebuild replays stored membership
+// events through the apply path, bypassing that check. addMembership inserts
+// straight into the projection table — the same shape a rebuild would produce —
+// so a forbidden role lands in the membership without going through a handler.
+// Every JWT mint must strip it; globalRoles must survive untouched.
+describe("multi-roles: reserved membership role stripped at the mint", () => {
+  test("login: resurrected ['SystemAdmin'] in membership → stripped, ['Admin'] survives", async () => {
+    const userId = await seedUser("resurrect@example.com", "pw-long-enough");
+    await addMembership(userId, tenantA, ["SystemAdmin", "Admin"]);
+
+    const { user } = await login("resurrect@example.com", "pw-long-enough");
+    expect(user.roles).toEqual(["Admin"]);
+    expect(user.roles).not.toContain("SystemAdmin");
+  });
+
+  test("login: global SystemAdmin survives even when membership repeats it", async () => {
+    const userId = await seedUser("realadmin@example.com", "pw-long-enough", ["SystemAdmin"]);
+    await addMembership(userId, tenantA, ["SystemAdmin", "Admin"]);
+
+    const { user } = await login("realadmin@example.com", "pw-long-enough");
+    expect(user.roles.sort()).toEqual(["Admin", "SystemAdmin"]);
+  });
+
+  test("switch-tenant: resurrected ['SystemAdmin'] on target tenant → stripped", async () => {
+    const userId = await seedUser("resurrect2@example.com", "pw-long-enough");
+    await addMembership(userId, tenantA, ["Admin"]);
+    await addMembership(userId, tenantB, ["SystemAdmin", "User"]);
+
+    const { token } = await login("resurrect2@example.com", "pw-long-enough");
+    const switchRes = await stack.http.raw(
+      "POST",
+      "/api/auth/switch-tenant",
+      { tenantId: tenantB },
+      { authorization: `Bearer ${token}` },
+    );
+    expect(switchRes.status).toBe(200);
+    const switchBody = (await switchRes.json()) as { roles: string[] };
+    expect(switchBody.roles).toEqual(["User"]);
+    expect(switchBody.roles).not.toContain("SystemAdmin");
+  });
+});

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -23,6 +23,7 @@ import {
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
+  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -164,7 +165,7 @@ export function createInviteAcceptWithLoginHandler() {
         const session: SessionUser = {
           id: userId,
           tenantId: invitationTenantId,
-          roles: [invitationRole],
+          roles: stripForbiddenMembershipRoles([invitationRole]),
         };
 
         committed = true;

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -27,6 +27,7 @@ import {
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
+  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -160,7 +161,7 @@ export function createInviteSignupCompleteHandler() {
         const session: SessionUser = {
           id: userId,
           tenantId: invitationTenantId,
-          roles: [invitationRole],
+          roles: stripForbiddenMembershipRoles([invitationRole]),
         };
 
         committed = true;

package/src/auth-email-password/handlers/login.write.ts

@@ -2,6 +2,7 @@ import {
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
+  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -165,7 +166,11 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       // membership. Dedupe via Set damit eine Rolle die in beiden Quellen
       // steht nicht doppelt im Session-Roles landet.
       const globalRoles = parseRoles(found.roles ?? null);
-      const mergedRoles = Array.from(new Set([...globalRoles, ...chosen.roles]));
+      // Strip reserved roles from the membership portion only (globalRoles keeps
+      // SystemAdmin) — read-time backstop against a rebuild-resurrected role.
+      const mergedRoles = Array.from(
+        new Set([...globalRoles, ...stripForbiddenMembershipRoles(chosen.roles)]),
+      );
       const baseSession: SessionUser = {
         id: found.id,
         tenantId: chosen.tenantId,

package/src/tenant/membership-roles.ts

@@ -6,18 +6,10 @@
 // this validator makes every membership-role write path enforce the same
 // invariant. Derived from the framework presets so it tracks access.privileged.
 
-import { access } from "@cosmicdrift/kumiko-framework/engine";
+import { findForbiddenMembershipRole } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 
-const FORBIDDEN_MEMBERSHIP_ROLES: ReadonlySet<string> = new Set<string>([
-  ...access.privileged, // system, SystemAdmin
-  ...access.all, // all
-  ...access.anonymous, // anonymous
-]);
-
-export function findForbiddenMembershipRole(roles: readonly string[]): string | undefined {
-  return roles.find((role) => FORBIDDEN_MEMBERSHIP_ROLES.has(role));
-}
+export { findForbiddenMembershipRole };
 
 export function reservedMembershipRoleError(role: string): AccessDeniedError {
   return new AccessDeniedError({