@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/tenant/__tests__/members-query-kms.integration.test.ts

@@ -0,0 +1,98 @@
+// members.query.ts's decrypt-on-read fix (#1252): before the fix, an
+// active PII-subject KMS meant the query returned raw ciphertext for
+// email/displayName instead of decrypting them like every other PII read
+// path. This pins the decrypt-on-read roundtrip with a real KMS adapter
+// configured, so a later refactor can't silently re-introduce the
+// ciphertext leak.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantMembershipsTable } from "../membership-table";
+import { tenantEntity } from "../schema/tenant";
+import { seedTenant, seedTenantMembership } from "../seeding";
+
+const tenantId = testTenantId(1);
+
+let stack: TestStack;
+
+function tenantAdmin(userId: string): SessionUser {
+  return { id: userId, tenantId, roles: ["TenantAdmin"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature()],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable, tenantMembershipsTable]);
+  await seedTenant(stack.db, { id: tenantId, key: "tenant-kms-members", name: "KMS Tenant" });
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("members query — decrypt-on-read with an active KMS (#1252)", () => {
+  test("email and displayName come back as plaintext, not ciphertext", async () => {
+    // KMS active BEFORE the seed — seedUser runs through the executor, so
+    // the row reflects the encrypted prod state.
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    const { id: userId } = await seedUser(stack.db, {
+      email: "kms-member@example.com",
+      displayName: "KMS Member",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId, roles: ["User"] });
+
+    // Prove the row is actually ciphertext at rest — otherwise a no-op
+    // encryption path would make this test pass while proving nothing.
+    const rawRows = await selectMany<{ email: unknown; displayName: unknown }>(
+      stack.db,
+      userTable,
+      {
+        id: userId,
+      },
+    );
+    expect(isPiiCiphertext(rawRows[0]?.email)).toBe(true);
+    expect(isPiiCiphertext(rawRows[0]?.displayName)).toBe(true);
+
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdmin(userId));
+
+    const self = members.find((m) => m.userId === userId);
+    expect(self?.email).toBe("kms-member@example.com");
+    expect(self?.displayName).toBe("KMS Member");
+  });
+});

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createConfigFeature } from "../../config/feature";
+import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { defaultTranslations } from "../web/i18n";
+
+describe("tenant members screen + handler access alignment", () => {
+  const features = [createConfigFeature(), createTenantFeature()];
+
+  test("boot-validates with members screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("members screen is custom, access.admin-gated", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+
+  test("members UI handlers share access.admin (screen ⊆ handler)", () => {
+    const tenant = createTenantFeature();
+    const adminRoles = [...access.admin];
+    expect(rolesOf(tenant.queryHandlers["members"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.queryHandlers["invitations"]?.access)).toEqual(adminRoles);
+    expect(rolesOf(tenant.writeHandlers["cancel-invitation"]?.access)).toEqual(adminRoles);
+    // invite-create lives on auth feature — checked in tenant-security.integration.test.ts
+    void AuthHandlers;
+    void TenantHandlers;
+    void TenantQueries;
+  });
+
+  test("members nav label uses tenantClient i18n key (not feature:nav.* alias)", () => {
+    const nav = createTenantFeature().navs["members"];
+    expect(nav?.label).toBe("tenant.nav.members");
+    expect(defaultTranslations["de"]?.["tenant.nav.members"]).toBe("Team");
+  });
+
+  test("updateMemberRoles stays SystemAdmin/system-only (not on members screen)", () => {
+    const tenant = createTenantFeature();
+    expect(rolesOf(tenant.writeHandlers["updateMemberRoles"]?.access)).toEqual([
+      "system",
+      "SystemAdmin",
+    ]);
+  });
+});

package/src/tenant/__tests__/multi-tenant.integration.test.ts

@@ -96,7 +96,7 @@ beforeAll(async () => {
           ...bridgeStub(),
         },
       );
-      return result as number[];
+      return result as TenantId[];
     },
   });
 

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -0,0 +1,310 @@
+// Security integration tests for tenant-admin surfaces (members + invite/cancel).
+// Real HTTP via setupTestStack — no mocks. Proves access.admin alignment and
+// tenant isolation before the MembersScreen ships to apps.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { MEMBERS_SCREEN_ID, TenantHandlers, TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../invitation-table";
+import { tenantMembershipsTable } from "../membership-table";
+import { tenantEntity, tenantTable } from "../schema/tenant";
+import { seedTenant, seedTenantMembership } from "../seeding";
+
+const emailTransport = createInMemoryTransport();
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"] as const;
+
+let stack: TestStack;
+let TENANT_A_ID: TenantId;
+let TENANT_B_ID: TenantId;
+let tenantAdminAId: string;
+let regularUserBId: string;
+
+function newTenantId(): TenantId {
+  return crypto.randomUUID() as TenantId;
+}
+
+function tenantAdminA(): SessionUser {
+  return { id: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["TenantAdmin"] };
+}
+
+function regularUserB(): SessionUser {
+  return { id: regularUserBId, tenantId: TENANT_B_ID, roles: ["User"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const keys = await stack.redis.redis.keys("invite:*");
+  if (keys.length > 0) await stack.redis.redis.del(...keys);
+
+  TENANT_A_ID = newTenantId();
+  TENANT_B_ID = newTenantId();
+  await seedTenant(stack.db, {
+    id: TENANT_A_ID,
+    key: `tenant-a-${TENANT_A_ID.slice(0, 8)}`,
+    name: "Tenant A",
+  });
+  await seedTenant(stack.db, {
+    id: TENANT_B_ID,
+    key: `tenant-b-${TENANT_B_ID.slice(0, 8)}`,
+    name: "Tenant B",
+  });
+
+  ({ id: tenantAdminAId } = await seedUser(stack.db, {
+    email: "admin-a@example.com",
+    displayName: "Admin A",
+    passwordHash: await hashPassword("pw-a-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: tenantAdminAId,
+    tenantId: TENANT_A_ID,
+    roles: ["TenantAdmin"],
+  });
+
+  ({ id: regularUserBId } = await seedUser(stack.db, {
+    email: "user-b@example.com",
+    displayName: "User B",
+    passwordHash: await hashPassword("pw-b-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: regularUserBId,
+    tenantId: TENANT_B_ID,
+    roles: ["User"],
+  });
+});
+
+describe("access matrix: members screen handlers use access.admin", () => {
+  test("invite-create, members, invitations, cancel-invitation share access.admin", () => {
+    const adminRoles = [...access.admin];
+    expect(rolesOf(stack.registry.getWriteHandler(AuthHandlers.inviteCreate)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(rolesOf(stack.registry.getQueryHandler(TenantQueries.members)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(rolesOf(stack.registry.getQueryHandler(TenantQueries.invitations)?.access)).toEqual(
+      adminRoles,
+    );
+    expect(
+      rolesOf(stack.registry.getWriteHandler(TenantHandlers.cancelInvitation)?.access),
+    ).toEqual(adminRoles);
+  });
+
+  test("members screen access matches access.admin", () => {
+    const tenant = createTenantFeature();
+    const screen = tenant.screens[MEMBERS_SCREEN_ID];
+    expect(screen && "access" in screen && screen.access && "roles" in screen.access).toBe(true);
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+});
+
+describe("TenantAdmin can use members-admin HTTP surface", () => {
+  test("TenantAdmin invites → row persisted in own tenant", async () => {
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "new@example.com", role: "User" },
+      tenantAdminA(),
+    )) as { tenantId: string; email: string };
+    expect(result.tenantId).toBe(TENANT_A_ID);
+    const rows = await selectMany(stack.db, tenantInvitationsTable, { email: "new@example.com" });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["tenantId"]).toBe(TENANT_A_ID);
+  });
+
+  test("TenantAdmin lists members and pending invitations for own tenant only", async () => {
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "pending@example.com", role: "Editor" },
+      tenantAdminA(),
+    );
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdminA());
+    expect(members.some((m) => m.userId === tenantAdminAId)).toBe(true);
+    const self = members.find((m) => m.userId === tenantAdminAId);
+    expect(self?.email).toBe("admin-a@example.com");
+    const invitations = await stack.http.queryOk<readonly { email: string }[]>(
+      TenantQueries.invitations,
+      {},
+      tenantAdminA(),
+    );
+    expect(invitations).toHaveLength(1);
+    expect(invitations[0]?.email).toBe("pending@example.com");
+  });
+
+  test("members email is null when user row is missing", async () => {
+    const orphanUserId = "00000000-0000-4000-8000-00000000dead";
+    await seedTenantMembership(stack.db, {
+      userId: orphanUserId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+    const members = await stack.http.queryOk<readonly { userId: string; email: string | null }[]>(
+      TenantQueries.members,
+      {},
+      tenantAdminA(),
+    );
+    expect(members.find((m) => m.userId === orphanUserId)?.email).toBeNull();
+  });
+});
+
+describe("regular User is denied members-admin surface", () => {
+  test("403 on members, invitations, invite-create, cancel-invitation", async () => {
+    for (const [label, fn] of [
+      ["members", () => stack.http.query(TenantQueries.members, {}, regularUserB())],
+      ["invitations", () => stack.http.query(TenantQueries.invitations, {}, regularUserB())],
+      [
+        "invite-create",
+        () =>
+          stack.http.write(
+            AuthHandlers.inviteCreate,
+            { email: "x@y.com", role: "User" },
+            regularUserB(),
+          ),
+      ],
+    ] as const) {
+      const res = await fn();
+      expect(res.status, label).toBe(403);
+    }
+  });
+});
+
+describe("privilege escalation via invite role", () => {
+  test("TenantAdmin cannot invite reserved/global roles", async () => {
+    for (const role of FORBIDDEN_ROLES) {
+      const err = await stack.http.writeErr(
+        AuthHandlers.inviteCreate,
+        { email: "escalate@example.com", role },
+        tenantAdminA(),
+      );
+      expectErrorIncludes(err, "access_denied");
+    }
+    const rows = await selectMany(stack.db, tenantInvitationsTable, {
+      email: "escalate@example.com",
+    });
+    expect(rows).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+});
+
+describe("tenant isolation on cancel-invitation", () => {
+  test("TenantAdmin cannot cancel invitation belonging to another tenant", async () => {
+    const { id: adminBId } = await seedUser(stack.db, {
+      email: "admin-b@example.com",
+      displayName: "Admin B",
+      passwordHash: await hashPassword("pw-b-admin-1234"),
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, {
+      userId: adminBId,
+      tenantId: TENANT_B_ID,
+      roles: ["TenantAdmin"],
+    });
+    const adminB: SessionUser = { id: adminBId, tenantId: TENANT_B_ID, roles: ["TenantAdmin"] };
+    await stack.http.writeOk(
+      AuthHandlers.inviteCreate,
+      { email: "cross@example.com", role: "User" },
+      adminB,
+    );
+    const rows = await selectMany(stack.db, tenantInvitationsTable, { email: "cross@example.com" });
+    const invitationId = rows[0]?.["id"] as string;
+
+    const err = await stack.http.writeErr(
+      TenantHandlers.cancelInvitation,
+      { invitationId },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "invitation_not_found");
+  });
+});
+
+describe("updateMemberRoles not reachable by TenantAdmin", () => {
+  test("TenantAdmin gets access_denied on updateMemberRoles", async () => {
+    const err = await stack.http.writeErr(
+      TenantHandlers.updateMemberRoles,
+      { userId: tenantAdminAId, tenantId: TENANT_A_ID, roles: ["User"] },
+      tenantAdminA(),
+    );
+    expectErrorIncludes(err, "access_denied");
+  });
+});

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -10,7 +10,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+  rolesOf,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigAccessor, createConfigFeature } from "../../config";
 import { ConfigHandlers, ConfigQueries } from "../../config/constants";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
@@ -33,8 +37,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature],

package/src/tenant/constants.ts

@@ -7,6 +7,11 @@
 // Feature name
 export const TENANT_FEATURE = "tenant" as const;
 
+export const MEMBERS_SCREEN_ID = "members" as const;
+
+/** Closed allowlist for invite-role picker — never free text (escalation guard). */
+export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Admin", "Editor"] as const;
+
 // Qualified write handler names (QN format: scope:type:name)
 export const TenantHandlers = {
   create: "tenant:write:create",

package/src/tenant/feature.ts

@@ -8,6 +8,7 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { MEMBERS_SCREEN_ID } from "./constants";
 import { activeTenantIdsQuery } from "./handlers/active-tenant-ids.query";
 import { addMemberWrite } from "./handlers/add-member.write";
 import { cancelInvitationWrite } from "./handlers/cancel-invitation.write";
@@ -22,6 +23,7 @@ import { resolveUserIdsQuery } from "./handlers/resolve-user-ids.query";
 import { disableWrite, enableWrite } from "./handlers/toggle-enabled.write";
 import { updateWrite } from "./handlers/update.write";
 import { updateMemberRolesWrite } from "./handlers/update-member-roles.write";
+import { TENANT_I18N } from "./i18n";
 import { tenantInvitationEntity } from "./invitation-table";
 import { tenantMembershipEntity } from "./membership-table";
 import { tenantEntity } from "./schema/tenant";
@@ -134,6 +136,23 @@ export function createTenantFeature(): FeatureDefinition {
     );
     r.screen(tenantListScreen);
     r.screen(tenantEditScreen);
+    // Tenant-admin team UI: members list + invite/cancel (no role-edit — updateMemberRoles
+    // stays SystemAdmin-only). Screen access matches handler access.admin.
+    r.screen({
+      id: MEMBERS_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "MembersScreen" } },
+      access: { roles: access.admin },
+    });
+    r.nav({
+      id: "members",
+      label: "tenant.nav.members",
+      icon: "users",
+      screen: "tenant:screen:members",
+      order: 20,
+    });
+
+    r.translations({ keys: TENANT_I18N });
 
     return { handlers, queries };
   });

package/src/tenant/handlers/active-tenant-ids.query.ts

@@ -1,5 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_ROLE,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import { tenantTable } from "../schema/tenant";
 
@@ -8,7 +12,9 @@ export const activeTenantIdsQuery = defineQueryHandler({
   schema: z.object({}),
   access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
   handler: async (_query, ctx) => {
-    const rows = await selectMany<{ id: number }>(ctx.db, tenantTable, { isEnabled: true });
+    // tenants.id is a uuid string (TenantId), not a numeric surrogate.
+    // Brand at the DB parse boundary — getActiveTenantIds consumers expect TenantId[].
+    const rows = await selectMany<{ id: TenantId }>(ctx.db, tenantTable, { isEnabled: true });
     return rows.map((r) => r.id);
   },
 });

package/src/tenant/handlers/cancel-invitation.write.ts

@@ -12,7 +12,7 @@
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 // kumiko-lint-ignore cross-feature-import cancel needs invite-token-store für Redis-cleanup
@@ -37,7 +37,7 @@ const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitati
 export const cancelInvitationWrite = defineWriteHandler({
   name: "cancel-invitation",
   schema: CancelInvitationSchema,
-  access: { roles: ["Admin"] },
+  access: { roles: access.admin },
   handler: async (event, ctx) => {
     const invitation = await fetchOne(ctx.db.raw, tenantInvitationsTable, {
       id: event.payload.invitationId,

package/src/tenant/handlers/invitations.query.ts

@@ -1,8 +1,16 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table";
 
+// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
+// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
+// one call per row unbounded and exhausts the pool once invitation counts
+// exceed a handful, surfacing as "the connection was closed"; a strict
+// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
+const KMS_POOL_CONCURRENCY = 4;
+
 // Pending-Invitations-Liste für den aktuellen Tenant. Admin-only.
 // Filter: status="pending" — accepted/cancelled/expired sind für die
 // UI uninteressant (UI zeigt nur "ausstehende Einladungen"; Audit-Log
@@ -15,12 +23,21 @@ import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table";
 export const invitationsQuery = defineQueryHandler({
   name: "invitations",
   schema: z.object({}),
-  access: { roles: ["Admin", "SystemAdmin"] },
+  access: { roles: access.admin },
   handler: async (query, ctx) => {
-    const rows = await selectMany(ctx.db, tenantInvitationsTable, {
+    const rows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
       tenantId: query.user.tenantId,
       status: INVITATION_STATUS.pending,
     });
-    return rows ?? [];
+    return mapWithConcurrency(rows ?? [], KMS_POOL_CONCURRENCY, async (row) => {
+      const email = row["email"];
+      const decryptedEmail =
+        typeof email === "string"
+          ? await decryptStoredPii(email, "email", "tenant:invitations")
+          : email;
+      // invitedBy is a plain userId (invitation-table.ts: no `pii: true`) —
+      // never encrypted at write time, so it needs no decrypt (#1252).
+      return { ...row, email: decryptedEmail };
+    });
   },
 });