@cosmicdrift/kumiko-framework 0.216.0 → 0.218.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.216.0",
+  "version": "0.218.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -194,7 +194,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.216.0",
+    "@cosmicdrift/kumiko-types": "0.218.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -210,7 +210,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.216.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.218.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/auth-routes.ts

@@ -9,7 +9,7 @@ import { createSystemUser } from "../engine/system-user";
 import { type SessionUser, SYSTEM_TENANT_ID, type TenantId } from "../engine/types";
 import { NotFoundError } from "../errors";
 import type { Dispatcher } from "../pipeline/dispatcher";
-import { parseStringArrayJson } from "../utils/parse-string-array-json";
+import { parseRoles } from "../utils/serialization";
 import { Routes } from "./api-constants";
 import {
   AUTH_COOKIE_NAME,
@@ -1361,11 +1361,10 @@ export function createAuthRoutes(
           config.userQuery,
           { id: user.id },
           createSystemUser(user.tenantId),
-        )) as { roles?: string | null } | null;
-        const raw = userRow?.roles;
-        if (typeof raw === "string" && raw.length > 0) {
-          globalRoles = parseStringArrayJson(raw);
-        }
+        )) as { roles?: unknown } | null;
+        // roles is jsonb string[] (multiSelect); parseRoles also accepts legacy
+        // JSON-encoded text from pre-0.217.0 rows.
+        globalRoles = parseRoles(userRow?.roles ?? null);
       } catch (e) {
         // Non-fatal: globale Rollen kann nicht aufgelöst werden → switch
         // läuft weiter mit nur tenant-rollen. Server-error mit nur dem

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -7,7 +7,13 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient } from "../../db/query";
-import { createDateField, createEntity, createNumberField, createTextField } from "../../engine";
+import {
+  createDateField,
+  createEntity,
+  createNumberField,
+  createTextField,
+  SYSTEM_TENANT_ID,
+} from "../../engine";
 import { UnprocessableError } from "../../errors";
 import { createEventsTable } from "../../event-store";
 import { TestUsers, unsafeCreateEntityTable } from "../../stack";
@@ -499,6 +505,45 @@ describe("event-store-executor.list — runtime SearchAdapter (Tier 2.7e Audit-F
     });
     expect(res.rows).toHaveLength(0);
   });
+
+  test("system-mode list: search uses SYSTEM_TENANT_ID (not session tenant)", async () => {
+    const systemTdb = createTenantDb(testDb.db, admin.tenantId, "system");
+    let searchedTenant: string | undefined;
+    const mockAdapter = {
+      configure: async () => {},
+      index: async () => {},
+      indexBatch: async () => {},
+      remove: async () => {},
+      search: async (tenantId: string) => {
+        searchedTenant = tenantId;
+        return [];
+      },
+      reset: async () => {},
+    } as never;
+    await exec.list({ limit: 50, search: "x" }, admin, systemTdb, {
+      searchAdapter: mockAdapter,
+    });
+    expect(searchedTenant).toBe(SYSTEM_TENANT_ID);
+  });
+
+  test("tenant-mode list: search still uses session tenantId", async () => {
+    let searchedTenant: string | undefined;
+    const mockAdapter = {
+      configure: async () => {},
+      index: async () => {},
+      indexBatch: async () => {},
+      remove: async () => {},
+      search: async (tenantId: string) => {
+        searchedTenant = tenantId;
+        return [];
+      },
+      reset: async () => {},
+    } as never;
+    await exec.list({ limit: 50, search: "x" }, admin, tdb, {
+      searchAdapter: mockAdapter,
+    });
+    expect(searchedTenant).toBe(admin.tenantId);
+  });
 });
 
 describe("event-store-executor.list — keyset cursor mit custom sort (#2265)", () => {

package/src/db/event-store-executor-read.ts

@@ -138,7 +138,10 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
             },
           });
         }
-        const results = await effectiveSearchAdapter.search(user.tenantId, payload.search, {
+        // system-mode lists (r.systemScope / cross-tenant) index under SYSTEM_TENANT_ID;
+        // searching the caller's session tenant misses the roster and can 500 on Meili.
+        const searchTenantId = db.mode === "system" ? SYSTEM_TENANT_ID : user.tenantId;
+        const results = await effectiveSearchAdapter.search(searchTenantId, payload.search, {
           filterType: entityName,
         });
         filterIds = results.map((r) => r.entityId);