@cosmicdrift/kumiko-framework 0.215.7 → 0.217.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.215.7",
+  "version": "0.217.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -194,7 +194,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.215.7",
+    "@cosmicdrift/kumiko-types": "0.217.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -210,7 +210,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.7",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.217.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/auth-routes.ts

@@ -9,7 +9,7 @@ import { createSystemUser } from "../engine/system-user";
 import { type SessionUser, SYSTEM_TENANT_ID, type TenantId } from "../engine/types";
 import { NotFoundError } from "../errors";
 import type { Dispatcher } from "../pipeline/dispatcher";
-import { parseStringArrayJson } from "../utils/parse-string-array-json";
+import { parseRoles } from "../utils/serialization";
 import { Routes } from "./api-constants";
 import {
   AUTH_COOKIE_NAME,
@@ -1361,11 +1361,10 @@ export function createAuthRoutes(
           config.userQuery,
           { id: user.id },
           createSystemUser(user.tenantId),
-        )) as { roles?: string | null } | null;
-        const raw = userRow?.roles;
-        if (typeof raw === "string" && raw.length > 0) {
-          globalRoles = parseStringArrayJson(raw);
-        }
+        )) as { roles?: unknown } | null;
+        // roles is jsonb string[] (multiSelect); parseRoles also accepts legacy
+        // JSON-encoded text from pre-0.217.0 rows.
+        globalRoles = parseRoles(userRow?.roles ?? null);
       } catch (e) {
         // Non-fatal: globale Rollen kann nicht aufgelöst werden → switch
         // läuft weiter mit nur tenant-rollen. Server-error mit nur dem

package/src/engine/__tests__/role-assignment.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "bun:test";
+import { findForbiddenRoleAssignment } from "../role-assignment";
+
+describe("role assignment guard", () => {
+  test("rejects roles above the actor's highest role", () => {
+    expect(findForbiddenRoleAssignment(["Admin"], ["User", "TenantAdmin"])).toBe("TenantAdmin");
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["SystemAdmin"])).toBe("SystemAdmin");
+  });
+
+  test("allows equal or lower roles, including self-updates", () => {
+    expect(findForbiddenRoleAssignment(["Admin"], ["User", "Admin"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["Editor"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Editor"], ["User", "Editor"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User", "Admin"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["Admin"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["SystemAdmin"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["system"], ["SystemAdmin"])).toBeUndefined();
+  });
+
+  test("rejects Editor above User, Admin above Editor", () => {
+    expect(findForbiddenRoleAssignment(["User"], ["Editor"])).toBe("Editor");
+    expect(findForbiddenRoleAssignment(["Editor"], ["Admin"])).toBe("Admin");
+  });
+
+  test("rejects unknown roles (fail-closed)", () => {
+    expect(findForbiddenRoleAssignment(["User"], ["Custom"])).toBe("Custom");
+    expect(findForbiddenRoleAssignment(["SystemAdmin"], ["Custom"])).toBe("Custom");
+  });
+
+  test("rejects assignment if actor has no roles or only unknown roles", () => {
+    expect(findForbiddenRoleAssignment([], ["User"])).toBe("User");
+    expect(findForbiddenRoleAssignment(["UnknownRole"], ["User"])).toBe("User");
+  });
+
+  test("rejects modifying target user with higher existing role", () => {
+    expect(findForbiddenRoleAssignment(["Admin"], ["User"], ["SystemAdmin"])).toBe("SystemAdmin");
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User"], ["TenantAdmin"])).toBeUndefined();
+  });
+
+  test("allows modifying target that currently holds an unranked app role", () => {
+    // Editor is ranked (invite options); use a true app-defined role here.
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["User"], ["Billing"])).toBeUndefined();
+    expect(findForbiddenRoleAssignment(["Admin"], ["User"], ["Billing", "User"])).toBeUndefined();
+    // Still cannot assign the unranked role on the write path (fail-closed).
+    expect(findForbiddenRoleAssignment(["TenantAdmin"], ["Billing"], ["Billing"])).toBe("Billing");
+  });
+});

package/src/engine/index.ts

@@ -229,6 +229,7 @@ export { readClaim } from "./read-claim";
 export { createRegistry } from "./registry";
 export type { ClampInfo, ResolveOptions } from "./resolve-config-or-param";
 export { resolveConfigOrParam } from "./resolve-config-or-param";
+export { findForbiddenRoleAssignment } from "./role-assignment";
 export { runsInLane } from "./run-in";
 export type { StepListOutcome } from "./run-pipeline";
 export { runPipeline, runStepList } from "./run-pipeline";

package/src/engine/role-assignment.ts

@@ -0,0 +1,45 @@
+const ROLE_RANKS: Readonly<Record<string, number>> = {
+  User: 0,
+  // Matches DEFAULT_INVITE_ROLE_OPTIONS — must stay ranked or invite UI fails closed.
+  Editor: 1,
+  Admin: 2,
+  TenantAdmin: 3,
+  SystemAdmin: 4,
+  system: 5,
+};
+
+function getRoleRank(role: string): number {
+  return ROLE_RANKS[role] ?? Number.POSITIVE_INFINITY;
+}
+
+function maxRoleRank(roles: readonly string[]): number {
+  if (roles.length === 0) return -1;
+  return Math.max(...roles.map((role) => ROLE_RANKS[role] ?? -1));
+}
+
+/** Known built-in rank only — unranked app roles (Billing, …) are not privilege tiers. */
+function knownRoleRank(role: string): number | undefined {
+  return ROLE_RANKS[role];
+}
+
+export function findForbiddenRoleAssignment(
+  actorRoles: readonly string[],
+  assignedRoles: readonly string[],
+  targetCurrentRoles: readonly string[] = [],
+): string | undefined {
+  const actorRank = maxRoleRank(actorRoles);
+  // Assign path: fail-closed on unknown / above-actor roles.
+  const forbiddenAssigned = assignedRoles.find((role) => getRoleRank(role) > actorRank);
+  if (forbiddenAssigned) return forbiddenAssigned;
+
+  // Target path: only ranked roles above the actor block (can't touch a
+  // SystemAdmin). Unranked app roles must not block demotion/updates — invite
+  // can assign them; treating them as rank ∞ on the target freezes those members.
+  const forbiddenTarget = targetCurrentRoles.find((role) => {
+    const rank = knownRoleRank(role);
+    return rank !== undefined && rank > actorRank;
+  });
+  if (forbiddenTarget) return forbiddenTarget;
+
+  return undefined;
+}