@cosmicdrift/kumiko-framework 0.173.1 → 0.174.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.173.1",
+  "version": "0.174.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.173.1",
+    "@cosmicdrift/kumiko-types": "0.174.1",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.173.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.174.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/api.test.ts

@@ -564,9 +564,18 @@ describe("POST /api/stream pre-pull race", () => {
     // in-flight .next(), so cleanup only runs once the pending pull settles.
     // Abort before heartbeatMs so the route hits the 499 branch; sleep then
     // completes and the queued return drains the generator's finally.
+    //
+    // Abort is triggered off an entry signal, not a fixed sleep margin against
+    // the heartbeat timer — a stalled event loop could otherwise let the
+    // heartbeat fire first and flip the route onto the 200-SSE branch.
     let cleanedUp = false;
+    let entered: () => void;
+    const atEntry = new Promise<void>((resolve) => {
+      entered = resolve;
+    });
     const dispatcher = stubDispatcher(async function* () {
       try {
+        entered();
         await Bun.sleep(80);
         yield { i: 0 };
       } finally {
@@ -583,8 +592,8 @@ describe("POST /api/stream pre-pull race", () => {
         signal: ac.signal,
       }),
     );
-    // Abort while firstPull is still racing the heartbeat timer.
-    await Bun.sleep(5);
+    // Abort as soon as the generator has been entered — no timing window left.
+    await atEntry;
     ac.abort();
     const res = await pending;
     expect(res.status).toBe(499);

package/src/api/__tests__/request-id-middleware.test.ts

@@ -121,3 +121,76 @@ describe("requestIdMiddleware — ip + userAgent capture (603/2)", () => {
     expect(captured).toBeUndefined();
   });
 });
+
+describe("requestIdMiddleware — client-supplied id sanitization (input-validation)", () => {
+  test("oversized X-Request-ID is rejected, a fresh id is generated instead", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const junk = "x".repeat(5000);
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": junk },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBeDefined();
+    expect(captured).not.toBe(junk);
+    expect(captured?.length).toBeLessThan(128);
+  });
+
+  test("disallowed-character X-Correlation-ID falls back to the (sanitized) requestId", async () => {
+    let captured: { requestId: string | undefined; correlationId: string | undefined } = {
+      requestId: undefined,
+      correlationId: undefined,
+    };
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      const ctx = requestContext.get();
+      captured = { requestId: ctx?.requestId, correlationId: ctx?.correlationId };
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "req-1", "X-Correlation-ID": "corr injected; drop table" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured.requestId).toBe("req-1");
+    expect(captured.correlationId).toBe("req-1");
+  });
+
+  test("a well-formed client id is preserved", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "trace-abc123.def" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBe("trace-abc123.def");
+  });
+});

package/src/api/request-id-middleware.ts

@@ -4,6 +4,16 @@ import { requestContext } from "./request-context";
 const REQUEST_ID_HEADER = "X-Request-ID";
 const CORRELATION_ID_HEADER = "X-Correlation-ID";
 
+// requestId/correlationId flow unvalidated into append-only event-store
+// metadata (e.g. sessions:revoke-all-for-user) — cap shape at the trust
+// boundary so a client can't smuggle an oversized/control-char payload into
+// permanent, replayed, DSGVO-exported storage via a client-set header.
+const SAFE_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+
+function sanitizeClientId(value: string | undefined): string | undefined {
+  return value !== undefined && SAFE_ID_RE.test(value) ? value : undefined;
+}
+
 /**
  * Assigns a requestId + correlationId to every request and wraps execution
  * in AsyncLocalStorage. Runs BEFORE auth — both ids are available even for
@@ -15,8 +25,9 @@ const CORRELATION_ID_HEADER = "X-Correlation-ID";
  */
 export function requestIdMiddleware() {
   return async (c: Context, next: Next) => {
-    const requestId = c.req.header(REQUEST_ID_HEADER) ?? requestContext.generateId();
-    const correlationId = c.req.header(CORRELATION_ID_HEADER) ?? requestId;
+    const requestId =
+      sanitizeClientId(c.req.header(REQUEST_ID_HEADER)) ?? requestContext.generateId();
+    const correlationId = sanitizeClientId(c.req.header(CORRELATION_ID_HEADER)) ?? requestId;
     c.header(REQUEST_ID_HEADER, requestId);
     c.header(CORRELATION_ID_HEADER, correlationId);
     c.set("requestId", requestId);

package/src/api/sse-broker.ts

@@ -19,9 +19,13 @@ export type SseBroker = {
   getClientCount(channel: string): number;
   getTotalClientCount(): number;
   // Separate from addClient so it doesn't count towards getClientCount.
-  // Optional: additive for external/test SseBroker impls (call sites use?.).
-  subscribeAccessInvalidation?(userId: string, onInvalidate: () => void): () => void;
-  publishAccessInvalidation?(userId: string): void;
+  // Required (fw#1601): an app-injected SseBroker (e.g. a Redis-backed
+  // multi-replica broker) that skips these silently turns the mid-stream
+  // access-teardown security control (#1561) into a no-op — a revoked
+  // session keeps receiving live SSE data with no error or log. A no-op
+  // stub is one line for a broker that genuinely doesn't need it.
+  subscribeAccessInvalidation(userId: string, onInvalidate: () => void): () => void;
+  publishAccessInvalidation(userId: string): void;
 };
 
 export function createSseBroker(): SseBroker {

package/src/crypto/__tests__/kms-wiring.test.ts

@@ -83,6 +83,12 @@ describe("buildPgKmsOptions", () => {
       /PLATFORM_KEK_PREVIOUS_VERSION must be set/,
     );
   });
+
+  test("rejects PLATFORM_KEK_PREVIOUS_VERSION without PLATFORM_KEK_PREVIOUS — half-set rotation must not silently drop the version", () => {
+    expect(() => buildPgKmsOptions({ ...rotationEnv, PLATFORM_KEK_PREVIOUS_VERSION: "1" })).toThrow(
+      /PLATFORM_KEK_PREVIOUS must be set/,
+    );
+  });
 });
 
 describe("resolveKmsWiring", () => {

package/src/crypto/ciphertext-pattern.ts

@@ -0,0 +1,19 @@
+// Shared SQL helpers for locating a subject's PII ciphertext by its inline
+// subject-key prefix (kumiko-pii:v<version>:<subjectKey>:...). Used by both
+// the blind-index sweep (db/blind-index-cleanup.ts) and the search-index
+// purge (search/purge-subject.ts) — the two sweeps must stay in lockstep
+// across ciphertext format versions.
+
+export function quoteIdent(name: string): string {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+
+export function escapeLikePattern(value: string): string {
+  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+
+// "v%" matches any format version (v1 no-AAD, v2 AAD-bound, #1263) — the
+// subject key placement is stable across versions.
+export function subjectCiphertextLikePattern(subjectKey: string): string {
+  return `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
+}

package/src/crypto/kms-wiring.ts

@@ -83,6 +83,11 @@ export function buildPgKmsOptions(env: PgKmsRotationEnv): PgKmsAdapterOptions {
     ? parseKekVersion(env.PLATFORM_KEK_VERSION, "PLATFORM_KEK_VERSION")
     : 1;
   if (!env.PLATFORM_KEK_PREVIOUS) {
+    if (env.PLATFORM_KEK_PREVIOUS_VERSION) {
+      throw new Error(
+        "PLATFORM_KEK_PREVIOUS must be set when PLATFORM_KEK_PREVIOUS_VERSION is set.",
+      );
+    }
     return {
       databaseUrl: env.SUBJECT_KEYS_DATABASE_URL,
       platformKek: env.PLATFORM_KEK,

package/src/db/__tests__/eagerload.integration.test.ts

@@ -9,7 +9,7 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
 } from "../../crypto";
-import { createEntity, createTextField } from "../../engine";
+import { createEntity, createTextField, from } from "../../engine";
 import type { EntityDefinition } from "../../engine/types";
 import { setupTestStack, type TestStack, testTenantId, unsafeCreateEntityTable } from "../../stack";
 import { createTestEnvelopeCipher, resetPiiSubjectKmsForTests, seedRows } from "../../testing";
@@ -58,13 +58,44 @@ const leadEntity = createEntity({
   fields: {
     title: createTextField({ required: true }),
     contact: { type: "reference", entity: "contact" },
+    ownedContact: { type: "reference", entity: "ownedContact" },
+    unrestrictedContact: { type: "reference", entity: "unrestrictedContact" },
   },
 });
 const contactTable = buildEntityTable("contact", contactEntity);
 
+// fw#1671: ownership-scoped ref entity — eagerload has no SessionUser to
+// evaluate access.read against, so PII/encrypted fields must be stripped
+// entirely rather than decrypted (fail closed, not a same-tenant PII leak).
+const ownedContactEntity = createEntity({
+  table: "el_owned_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+    iban: createTextField({ required: true, encrypted: true }),
+  },
+  access: { read: { admin: from("user:id", "ownerId") } },
+});
+const ownedContactTable = buildEntityTable("ownedContact", ownedContactEntity);
+
+// access.read present but every role is "all" (unrestricted) — must NOT
+// trigger the strip path, or #1667's decrypt would silently regress for
+// every entity that merely declares an access.read map without narrowing it.
+const unrestrictedContactEntity = createEntity({
+  table: "el_unrestricted_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+  },
+  access: { read: { admin: "all", member: "all" } },
+});
+const unrestrictedContactTable = buildEntityTable("unrestrictedContact", unrestrictedContactEntity);
+
 const resolve = (name: string): EntityDefinition | undefined => {
   if (name === "author") return authorEntity;
   if (name === "contact") return contactEntity;
+  if (name === "ownedContact") return ownedContactEntity;
+  if (name === "unrestrictedContact") return unrestrictedContactEntity;
   return undefined;
 };
 
@@ -83,6 +114,9 @@ const many = (r: EagerloadedRow | undefined, f: string) =>
   r?._refs?.[f] as ReadonlyArray<Record<string, unknown>> | undefined;
 
 const CX = "44444444-4444-4444-8444-444444444444";
+const OWNED = "66666666-6666-4666-8666-666666666666";
+const UNRESTRICTED = "88888888-8888-4888-8888-888888888888";
+const BROKEN = "77777777-7777-4777-8777-777777777777";
 const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
 const cipher = createTestEnvelopeCipher(TEST_KEY);
 const kms = new InMemoryKmsAdapter();
@@ -94,6 +128,8 @@ beforeAll(async () => {
   stack = await setupTestStack({ features: [] });
   await unsafeCreateEntityTable(stack.db, authorEntity);
   await unsafeCreateEntityTable(stack.db, contactEntity);
+  await unsafeCreateEntityTable(stack.db, ownedContactEntity);
+  await unsafeCreateEntityTable(stack.db, unrestrictedContactEntity);
   dbA = createTenantDb(stack.db, tenantA, "tenant");
 
   await seedRows(stack.db, authorTable, [
@@ -120,6 +156,44 @@ beforeAll(async () => {
     cipher,
   );
   await seedRows(stack.db, contactTable, [encrypted]);
+
+  const plainOwned = {
+    id: OWNED,
+    tenantId: tenantA,
+    name: "Owned Grace",
+    email: "owned-grace@acme.test",
+    iban: "DE99999",
+  };
+  const ownedPiiEncrypted = await encryptPiiFieldValues(
+    plainOwned,
+    ownedContactEntity,
+    ["email"],
+    kms,
+    { requestId: "test" },
+  );
+  const ownedEncrypted = await encryptEntityFieldValues(
+    ownedPiiEncrypted,
+    collectEncryptedFieldNames(ownedContactEntity),
+    cipher,
+  );
+  await seedRows(stack.db, ownedContactTable, [ownedEncrypted]);
+
+  // Legacy/backfilled row: iban never went through encryptEntityFieldValues,
+  // so decryptEntityFieldValues throws on it (fw#1671 error-propagation) —
+  // a single row like this must not 500 the whole eagerload lookup.
+  await seedRows(stack.db, contactTable, [
+    {
+      id: BROKEN,
+      tenantId: tenantA,
+      name: "Broken",
+      email: "broken@acme.test",
+      iban: "not-an-envelope",
+    },
+  ]);
+
+  await seedRows(stack.db, unrestrictedContactTable, [
+    { id: UNRESTRICTED, tenantId: tenantA, name: "Unrestricted", email: "unrestricted@acme.test" },
+  ]);
 });
 
 afterAll(async () => {
@@ -237,4 +311,48 @@ describe("enrichWithReferences", () => {
     expect(contact?.["iban"]).toBe("DE12345");
     expect(isPiiCiphertext(contact?.["email"])).toBe(false);
   });
+
+  test('fw#1671: access.read map where every rule is "all" (unrestricted) does NOT trigger the strip path', async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", unrestrictedContact: UNRESTRICTED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const unrestricted = single(row, "unrestrictedContact");
+
+    expect(unrestricted).toBeDefined();
+    expect(unrestricted?.["name"]).toBe("Unrestricted");
+    expect(unrestricted?.["email"]).toBe("unrestricted@acme.test");
+  });
+
+  test("fw#1671: ownership-scoped ref entity — PII/encrypted fields are stripped, not decrypted or leaked as ciphertext", async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", ownedContact: OWNED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const owned = single(row, "ownedContact");
+
+    expect(owned).toBeDefined();
+    expect(owned?.["name"]).toBe("Owned Grace");
+    expect(owned?.["email"]).toBeUndefined();
+    expect(owned?.["iban"]).toBeUndefined();
+  });
+
+  test("fw#1671: a row with a broken envelope is dropped, a sibling row's good ref still resolves in the same batch", async () => {
+    const [goodRow, brokenRow] = (await enrichWithReferences(
+      [
+        { id: "l1", contact: CX },
+        { id: "l2", contact: BROKEN },
+      ],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+
+    expect(single(goodRow, "contact")?.["email"]).toBe("grace@acme.test");
+    expect(single(brokenRow, "contact")).toBeUndefined();
+  });
 });

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -245,6 +245,51 @@ describe("event-store-executor write-verbs — field-level ownership_denied", ()
     if (result.isSuccess) return;
     expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
   });
+
+  // fw#1685: a preSave hook that derives a field the user never submitted
+  // must not have that field field-ownership-checked against the user —
+  // only what the user actually wrote in `payload.changes` is checked.
+  test("create: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const result = await crud.create({ authorId: TestUsers.driver.id }, nonAdmin, tdb, {
+      preSave: async (changes) => ({ ...changes, note: "hook-derived" }),
+    });
+    expect(result.isSuccess).toBe(true);
+  });
+
+  test("update: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const created = await crud.create(
+      { authorId: TestUsers.driver.id, note: "original" },
+      admin,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, version: 1, changes: {} },
+      nonAdmin,
+      tdb,
+      { preSave: async (changes) => ({ ...changes, note: "hook-derived" }) },
+    );
+    expect(result.isSuccess).toBe(true);
+  });
+
+  // Review-fix (kumiko-framework#1685): a preSave hook that echoes `id`/
+  // `version` back in its return value must not have those leak into the
+  // persisted row — the framework-minted aggregateId stays authoritative.
+  test("create: preSave hook returning `id`/`version` does not override the minted aggregateId", async () => {
+    const result = await crud.create({ authorId: nonAdmin.id, note: "mine" }, nonAdmin, tdb, {
+      preSave: async (changes) => ({ ...changes, id: "hook-injected-id", version: 999 }),
+    });
+    expect(result.isSuccess).toBe(true);
+    if (!result.isSuccess) return;
+    expect(result.data.id).not.toBe("hook-injected-id");
+
+    const row = await asRawClient(testDb.db).unsafe(
+      `SELECT id FROM read_es_write_owned_field WHERE id = $1`,
+      [result.data.id],
+    );
+    expect(row.length).toBe(1);
+  });
 });
 
 // =============================================================================

package/src/db/__tests__/migrate-runner.test.ts

@@ -99,4 +99,20 @@ describe("splitSqlStatements", () => {
       'CREATE TABLE "a" ("id" uuid);',
     ]);
   });
+
+  test("throws fail-loud on a dollar-quoted body instead of splitting it in half", () => {
+    expect(() => splitSqlStatements("DO $$ BEGIN PERFORM 1; END $$;")).toThrow(
+      /unsupported dollar-quoted body/,
+    );
+  });
+
+  test("throws fail-loud on a tagged dollar-quoted body ($tag$...$tag$)", () => {
+    expect(() => splitSqlStatements("DO $tag$ BEGIN PERFORM 1; END $tag$;")).toThrow(
+      /unsupported dollar-quoted body/,
+    );
+  });
+
+  test("a bare $ not opening a dollar-tag does not false-positive (digit after $ is not a tag)", () => {
+    expect(splitSqlStatements("SELECT $1;")).toEqual(["SELECT $1;"]);
+  });
 });

package/src/db/blind-index-cleanup.ts

@@ -1,46 +1,37 @@
-// Sofortiges Blind-Index-Nulling nach einem Subject-Erase (#818).
+// Immediate blind-index nulling after a subject erase (#818).
 //
-// Nach kms.eraseKey ist der Ciphertext unlesbar, aber die deterministische
-// bidx-Spalte bliebe bis zum nächsten Write/Rebuild matchbar — ein
-// Linkage-Fenster ("hat irgendeine Row den Wert X"). Dieser Sweep schließt
-// es sofort: der Ciphertext nennt sein Subject inline
-// (kumiko-pii:v1:<subjectKey>:...), also findet ein LIKE-Prefix-Match exakt
-// die Rows des erased Subjects — pro lookupable-Feld ein UPDATE.
+// After kms.eraseKey the ciphertext is unreadable, but the deterministic
+// bidx column would stay matchable until the next write/rebuild — a
+// linkage window ("does any row hold value X"). This sweep closes it right
+// away: the ciphertext names its subject inline
+// (kumiko-pii:v1:<subjectKey>:...), so a LIKE-prefix match finds exactly
+// the erased subject's rows — one UPDATE per lookupable field.
 //
-// Rows, die der Forget-Lauf ohnehin via Executor löscht/anonymisiert,
-// bekommen ihren bidx dort automatisch neu berechnet; dieser Sweep deckt
-// die liegen bleibenden Rows ab (fremde Entities mit userOwned-Feldern).
+// Rows the forget run deletes/anonymizes via the executor anyway get their
+// bidx recomputed automatically there; this sweep covers the rows left
+// behind (foreign entities with userOwned fields).
 
 import { collectLookupableFields } from "../crypto/blind-index";
+import { quoteIdent, subjectCiphertextLikePattern } from "../crypto/ciphertext-pattern";
 import type { FeatureDefinition } from "../engine/types";
 import { toSnakeCase } from "../utils/case";
 import type { DbRunner } from "./connection";
 import { resolveTableName } from "./entity-table-meta";
 import { executeRawQuery } from "./queries/raw-sql";
 
-function quoteIdent(name: string): string {
-  return `"${name.replace(/"/g, '""')}"`;
-}
-
-function escapeLikePattern(value: string): string {
-  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
-}
-
 export async function nullBlindIndexesForSubject(
   db: DbRunner,
   features: ReadonlyMap<string, FeatureDefinition>,
   subjectKey: string,
 ): Promise<void> {
-  // "v%" matches any format version (v1 no-AAD, v2 AAD-bound, #1263) — the
-  // subject key placement is stable across versions.
-  const likePattern = `kumiko-pii:v%:${escapeLikePattern(subjectKey)}:%`;
+  const likePattern = subjectCiphertextLikePattern(subjectKey);
   for (const feature of features.values()) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
       const lookupable = collectLookupableFields(entity);
       if (lookupable.length === 0) continue;
-      // Kein featureName-Prefix — der Dispatcher baut Entity-Tables ohne
-      // (buildEntityTable ohne featureName-Option), der Sweep muss dieselben
-      // Namen treffen.
+      // No featureName prefix — the dispatcher builds entity tables without
+      // one (buildEntityTable with no featureName option), the sweep has to
+      // hit the same names.
       const tableName = resolveTableName(entityName, entity, undefined);
       for (const fieldName of lookupable) {
         const snake = toSnakeCase(fieldName);

package/src/db/eagerload.ts

@@ -95,25 +95,86 @@ export function collectReferenceFields(entity: EntityDefinition): readonly Refer
 // event-store-executor-context's decryptForRead ordering: PII is the outer
 // layer, peel it before the envelope-encrypted fields, or the envelope
 // cipher chokes on a still-PII-wrapped string.
+//
+// Ownership guard (fw#1671): the ref lookup below is tenant-scoped only, not
+// ownership-scoped — this function has no SessionUser to evaluate
+// refEntity.access.read against. If the ref entity declares row-level
+// ownership at all, decrypting here would hand a same-tenant User A the
+// plaintext PII of a User B row they merely reference (e.g. a freely-settable
+// reference UUID), even though refEntity.access.read says "own" — the caller
+// never gets to run that ownership check. Fail closed: strip PII/encrypted
+// fields entirely instead of decrypting (or leaking ciphertext) when that
+// guarantee can't be evaluated here.
+function hasOwnershipScopedRead(refEntity: EntityDefinition): boolean {
+  const readMap = refEntity.access?.read;
+  if (readMap === undefined) return false;
+  // "all" means that role sees every row unrestricted — a map where every
+  // rule is "all" carries no ownership restriction at all, so stripping
+  // here would just silently drop PII/encrypted fields #1667 wants
+  // decrypted, for no security benefit.
+  return Object.values(readMap).some((rule) => rule !== "all");
+}
+
 async function decryptReferencedRow(
   row: Record<string, unknown>,
   refEntity: EntityDefinition,
+  piiFields: readonly string[],
+  encryptedFields: ReadonlySet<string>,
+  kms: ReturnType<typeof configuredPiiSubjectKms>,
 ): Promise<Record<string, unknown>> {
+  if (hasOwnershipScopedRead(refEntity)) {
+    if (piiFields.length === 0 && encryptedFields.size === 0) return row;
+    const out = { ...row };
+    for (const field of piiFields) delete out[field];
+    for (const field of encryptedFields) delete out[field];
+    return out;
+  }
+
   let out = row;
-  const piiFields = collectPiiSubjectFields(refEntity);
-  const kms = configuredPiiSubjectKms();
   if (piiFields.length > 0 && kms) {
     out = await decryptPiiFieldValues(out, piiFields, kms, {
       requestId: requestContext.get()?.requestId ?? "eagerload",
     });
   }
-  const encryptedFields = collectEncryptedFieldNames(refEntity);
   if (encryptedFields.size > 0) {
     out = await decryptEntityFieldValues(out, encryptedFields, resolveEntityFieldEncryption());
   }
   return out;
 }
 
+// Per-row, not Promise.all: a single legacy/backfilled row without a valid
+// envelope (decryptEntityFieldValues throws hard on malformed ciphertext)
+// must not 500 the whole list request — the main rows the caller asked for
+// are unrelated to this one broken reference. Drop just that row from the
+// map; the renderer falls back to the raw UUID.
+//
+// piiFields/encryptedFields/kms are constant per refEntity (fw#1671) — the
+// caller computes them once and passes them in instead of recomputing per row.
+async function buildRefLookupMap(
+  rawRefRows: ReadonlyArray<Record<string, unknown>>,
+  refEntity: EntityDefinition,
+  refEntityName: string,
+  piiFields: readonly string[],
+  encryptedFields: ReadonlySet<string>,
+  kms: ReturnType<typeof configuredPiiSubjectKms>,
+): Promise<Map<string, Record<string, unknown>>> {
+  const map = new Map<string, Record<string, unknown>>();
+  for (const r of rawRefRows) {
+    let decrypted: Record<string, unknown>;
+    try {
+      decrypted = await decryptReferencedRow(r, refEntity, piiFields, encryptedFields, kms);
+    } catch (e) {
+      console.warn(
+        `[eagerload] failed to decrypt referenced row entity=${refEntityName} id=${String(r["id"])}: ${e instanceof Error ? e.message : String(e)}`,
+      );
+      continue;
+    }
+    const id = decrypted["id"];
+    if (typeof id === "string") map.set(id, decrypted);
+  }
+  return map;
+}
+
 /** Eagerload für eine Liste von Rows. Mutiert nicht — gibt eine
  *  flache Kopie der Rows mit hinzugefügtem `_refs`-Property zurück. */
 export async function enrichWithReferences(
@@ -159,12 +220,17 @@ export async function enrichWithReferences(
       const rawRefRows = (await selectMany(db, refTable, { id: idArray })) as Array<
         Record<string, unknown>
       >;
-      const refRows = await Promise.all(rawRefRows.map((r) => decryptReferencedRow(r, refEntity)));
-      const map = new Map<string, Record<string, unknown>>();
-      for (const r of refRows) {
-        const id = r["id"];
-        if (typeof id === "string") map.set(id, r);
-      }
+      const piiFields = collectPiiSubjectFields(refEntity);
+      const encryptedFields = collectEncryptedFieldNames(refEntity);
+      const kms = configuredPiiSubjectKms();
+      const map = await buildRefLookupMap(
+        rawRefRows,
+        refEntity,
+        rf.refEntityName,
+        piiFields,
+        encryptedFields,
+        kms,
+      );
       return { fieldName: rf.fieldName, multiple: rf.multiple, map };
     }),
   );