@cosmicdrift/kumiko-framework 0.243.4 → 0.245.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.243.4",
+  "version": "0.245.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.243.4",
+    "@cosmicdrift/kumiko-types": "0.245.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.243.4",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.245.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/ownership-where-write-path.integration.test.ts

@@ -0,0 +1,143 @@
+// fw#2626 — `{ kind: "where" }` ownership rules on the WRITE path.
+//
+// `entity.access.write` is only ever evaluated in memory
+// (userCanCreateFieldRow / userCanWriteFieldRow); there is no SQL layer on the
+// write path to run a where-rule against, and on create there is not even a
+// row yet. Boot validation rejects the shape outright
+// (boot-validator/ownership.ts), but setupTestStack wires the registry without
+// validateBoot, so this suite still reaches the runtime path the boot guard
+// protects and pins it to a fail-closed deny instead of a 500.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "../db/query";
+import {
+  createEntity,
+  createTextField,
+  defineEntityQueryHandler,
+  defineEntityWriteHandler,
+  defineFeature,
+} from "../engine";
+import type { SessionUser, WhereRule } from "../engine/types";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "../stack";
+import { expectErrorIncludes } from "../testing";
+
+const ownerWhereRule: WhereRule = {
+  kind: "where",
+  where: (user, ctx) => ({
+    sqlText: `${ctx.tableName}.owner_id = $${ctx.paramStart}`,
+    params: [user.id],
+  }),
+};
+
+const memoEntity = createEntity({
+  table: "fw2626_memos",
+  softDelete: true,
+  fields: {
+    ownerId: createTextField({ required: true }),
+    title: createTextField({ required: true }),
+  },
+  access: {
+    read: { Admin: "all", Member: "all" },
+    // Admin keeps a plain rule so the suite can seed rows over real HTTP;
+    // Member is the shape under test.
+    write: { Admin: "all", Member: ownerWhereRule },
+  },
+});
+
+const memosFeature = defineFeature("fw2626memos", (r) => {
+  r.entity("memo", memoEntity);
+  for (const verb of ["create", "update", "delete"] as const) {
+    r.writeHandler(
+      defineEntityWriteHandler(`memo:${verb}`, memoEntity, {
+        access: { roles: ["Admin", "Member"] },
+      }),
+    );
+  }
+  r.queryHandler(
+    defineEntityQueryHandler("memo:detail", memoEntity, {
+      access: { roles: ["Admin", "Member"] },
+    }),
+  );
+});
+
+const tenant = testTenantId(1);
+const admin: SessionUser = { ...TestUsers.admin, tenantId: tenant };
+const member = createTestUser({
+  id: "22222222-0000-4000-8000-000000002626",
+  tenantId: tenant,
+  roles: ["Member"],
+});
+
+let stack: TestStack;
+let seeded: { id: string; version: number };
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [memosFeature] });
+  await unsafeCreateEntityTable(stack.db, memoEntity, "memo");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe("DELETE FROM fw2626_memos");
+  const row = await stack.http.writeOk<{ id: string; data: { version: number } }>(
+    "fw2626memos:write:memo:create",
+    { ownerId: member.id, title: "seed" },
+    admin,
+  );
+  seeded = { id: row.id, version: row.data.version };
+});
+
+describe("write-path where-rule — create", () => {
+  test("create under a where-rule is denied, not a 500", async () => {
+    const err = await stack.http.writeErr(
+      "fw2626memos:write:memo:create",
+      { ownerId: member.id, title: "mine" },
+      member,
+    );
+    expectErrorIncludes(err, "ownership_denied");
+    expect(err.httpStatus).toBe(422);
+  });
+});
+
+describe("write-path where-rule — update/delete", () => {
+  test("update under a where-rule stays denied", async () => {
+    const err = await stack.http.writeErr(
+      "fw2626memos:write:memo:update",
+      { id: seeded.id, version: seeded.version, changes: { title: "edited" } },
+      member,
+    );
+    expectErrorIncludes(err, "ownership_denied");
+    expect(err.httpStatus).toBe(422);
+  });
+
+  test("delete under a where-rule stays denied", async () => {
+    const err = await stack.http.writeErr(
+      "fw2626memos:write:memo:delete",
+      { id: seeded.id },
+      member,
+    );
+    expectErrorIncludes(err, "ownership_denied");
+    expect(err.httpStatus).toBe(422);
+  });
+});
+
+describe("write-path where-rule — sibling roles unaffected", () => {
+  test("Admin's plain rule still writes through the same map", async () => {
+    const res = await stack.http.writeOk<{ data: { title: string } }>(
+      "fw2626memos:write:memo:update",
+      { id: seeded.id, version: seeded.version, changes: { title: "by-admin" } },
+      admin,
+    );
+    expect(res.data.title).toBe("by-admin");
+  });
+});

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -8,9 +8,16 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { asRawClient, transaction } from "../../db/query";
 import { createEntity, createTextField } from "../../engine";
 import { from } from "../../engine/ownership";
+import { createSystemUser } from "../../engine/system-user";
 import { createEventsTable } from "../../event-store";
 import type { EntityCache } from "../../pipeline/entity-cache";
-import { createTestDb, type TestDb, TestUsers, unsafeCreateEntityTable } from "../../stack";
+import {
+  createTestDb,
+  createTestUser,
+  type TestDb,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "../../stack";
 import { createEventStoreExecutor } from "../event-store-executor";
 import { buildEntityTable } from "../table-builder";
 import { createTenantDb, type TenantDb } from "../tenant-db";
@@ -118,6 +125,40 @@ describe("event-store-executor write-verbs — entity-level ownership_denied", (
     expect(events).toHaveLength(1);
   });
 
+  test("forget: framework system user bypasses ownership (fw#2639 — GDPR erasure runs as SYSTEM)", async () => {
+    const created = await crud.create({ email: "erase-me@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const systemUser = createSystemUser(admin.tenantId);
+    const result = await crud.forget({ id: created.data.id }, systemUser, tdb);
+    expect(result.isSuccess).toBe(true);
+
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT id FROM read_es_write_restricted WHERE email = 'erase-me@test.de'`,
+    )) as unknown[];
+    expect(rows).toHaveLength(0);
+
+    const events = (await asRawClient(testDb.db).unsafe(
+      `SELECT type FROM kumiko_events WHERE type = 'esWriteRestricted.forgotten' AND aggregate_id = $1`,
+      [String(created.data.id)],
+    )) as unknown[];
+    expect(events).toHaveLength(1);
+  });
+
+  test('forget: a role named "system" that isn\'t the framework SYSTEM_USER_ID is still denied', async () => {
+    // Proves the bypass is keyed on the id, not just the role name — a
+    // tenant-defined "system" role must not get an accidental Art.17
+    // shortcut around access.write.
+    const created = await crud.create({ email: "not-system@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const impostor = createTestUser({ id: 42, roles: ["system"] });
+    const result = await crud.forget({ id: created.data.id }, impostor, tdb);
+    expect(result.isSuccess).toBe(false);
+    if (result.isSuccess) return;
+    expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
+  });
+
   test("restore: role without a write-rule → ownership_denied", async () => {
     const created = await crud.create({ email: "torestore@test.de" }, admin, tdb);
     if (!created.isSuccess) throw new Error("setup failed");

package/src/db/event-store-executor-write.ts

@@ -1,6 +1,7 @@
 import { checkWriteFieldOwnership } from "../engine/field-access";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership";
-import type { EntityId } from "../engine/types";
+import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user";
+import type { EntityId, SessionUser } from "../engine/types";
 import {
   VersionConflictError as FrameworkVersionConflict,
   IdempotentReplayError,
@@ -28,6 +29,13 @@ import {
 } from "./event-store-executor-context";
 import { runInSavepointIfSupported, selectMany } from "./query";
 
+// Art. 17 erasure runs as the framework operator, not as a row owner; a
+// per-role ownership map can never cover it, and a silent deny means the
+// erasure never happened.
+function isFrameworkSystemUser(user: SessionUser): boolean {
+  return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
+
 // The five write verbs (create/update/delete/forget/restore) of the event-
 // store-executor. Split out of event-store-executor.ts (#1005, Welle 2) —
 // behavior-preserving relocation, not a redesign: every closure below is
@@ -616,7 +624,10 @@ export function createWriteVerbs(
       if (!raw) return writeFailure(new NotFoundError(entityName, payload.id));
       const existing = await decryptForRead(rehydrateCompoundTypes(raw as DbRow, entity) as DbRow);
 
-      if (!userCanWriteFieldRow(user, entity.access?.write, existing, existing)) {
+      if (
+        !isFrameworkSystemUser(user) &&
+        !userCanWriteFieldRow(user, entity.access?.write, existing, existing)
+      ) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {
             i18nKey: "errors.ownershipDenied",

package/src/engine/__tests__/boot-validator.test.ts

@@ -1099,6 +1099,58 @@ describe("boot-validator", () => {
       expect(() => validateBoot(features)).not.toThrow();
     });
 
+    test("fw#2639: a where-rule with an unqualified column inside a subquery fails boot", () => {
+      const features = [
+        defineFeature("orders", (r) => {
+          r.entity(
+            "order",
+            createEntity({
+              table: "orders",
+              fields: { entityId: createTextField({ required: true }) },
+              access: {
+                read: {
+                  Auditor: {
+                    kind: "where",
+                    where: (_user, ctx) => ({
+                      sqlText: `EXISTS (SELECT 1 FROM teams t WHERE t.entity_id = entity_id AND t.team_id = $${ctx.paramStart})`,
+                      params: ["team-a"],
+                    }),
+                  },
+                },
+              },
+            }),
+          );
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(/unqualified/i);
+    });
+
+    test("fw#2639: the same where-rule, correctly qualified, passes boot", () => {
+      const features = [
+        defineFeature("orders", (r) => {
+          r.entity(
+            "order",
+            createEntity({
+              table: "orders",
+              fields: { entityId: createTextField({ required: true }) },
+              access: {
+                read: {
+                  Auditor: {
+                    kind: "where",
+                    where: (_user, ctx) => ({
+                      sqlText: `EXISTS (SELECT 1 FROM teams t WHERE t.entity_id = ${ctx.tableName}.entity_id AND t.team_id = $${ctx.paramStart})`,
+                      params: ["team-a"],
+                    }),
+                  },
+                },
+              },
+            }),
+          );
+        }),
+      ];
+      expect(() => validateBoot(features)).not.toThrow();
+    });
+
     test("framework columns (id, tenantId, version, ...) are acceptable targets", () => {
       const features = [
         defineFeature("teams", (r) => {

package/src/engine/__tests__/ownership.test.ts

@@ -197,10 +197,9 @@ describe("userCanReadFieldRow() — multi-role OR", () => {
   });
 
   // fw#1700: matchesRule() throws on a where-rule (SQL-layer only, can't
-  // evaluate in-memory). Field-level access is boot-validator-rejected for
-  // where-rules, but this function is also reachable from hand-rolled
-  // entity-level reads — a role backed by a where-rule must fail closed
-  // (deny, no throw) instead of crashing the caller with an uncaught 500.
+  // evaluate in-memory). A read map may legitimately carry one — it belongs
+  // on the SQL path (buildOwnershipClause) — so an in-memory read check must
+  // fail closed (deny, no throw) instead of crashing the caller with a 500.
   test("role backed by a where-rule → fails closed (deny), does not throw", () => {
     const whereMap: OwnershipMap = {
       Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
@@ -283,6 +282,18 @@ describe("userCanWriteFieldRow() — Straddle-attack prevention", () => {
     const user = mkUser();
     expect(userCanWriteFieldRow(user, undefined, {}, {})).toBe(true);
   });
+
+  // fw#2626: the write path never reaches SQL, so a where-rule there can only
+  // deny. Boot validation rejects the shape; this is the runtime backstop for
+  // maps assembled outside validateBoot.
+  test("role backed by a where-rule → fails closed (deny), does not throw", () => {
+    const user = mkUser({ roles: ["Support"] });
+    const whereMap: OwnershipMap = {
+      Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
+    };
+    expect(() => userCanWriteFieldRow(user, whereMap, { a: 1 }, { a: 2 })).not.toThrow();
+    expect(userCanWriteFieldRow(user, whereMap, { a: 1 }, { a: 2 })).toBe(false);
+  });
 });
 
 // --- userCanCreateFieldRow() ---
@@ -440,4 +451,25 @@ describe("userCanCreateFieldRow() — create case (no old row)", () => {
     const user = mkUser({ roles: ["Admin"] });
     expect(userCanCreateFieldRow(user, accessMap, { teamId: "ops" })).toBe(true);
   });
+
+  // fw#2626: create used to hand a where-rule to matchesRule(), which throws —
+  // every create against such an entity ended as a 500. It now denies, exactly
+  // like userCanWriteFieldRow does for update/delete.
+  test("role backed by a where-rule → fails closed (deny), does not throw", () => {
+    const user = mkUser({ roles: ["Support"] });
+    const whereMap: OwnershipMap = {
+      Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
+    };
+    expect(() => userCanCreateFieldRow(user, whereMap, { teamId: "ops" })).not.toThrow();
+    expect(userCanCreateFieldRow(user, whereMap, { teamId: "ops" })).toBe(false);
+  });
+
+  test("where-rule role does not block a later 'all' role in the same access map", () => {
+    const user = mkUser({ roles: ["Support", "Admin"] });
+    const mixedMap: OwnershipMap = {
+      Support: { kind: "where", where: () => ({ sqlText: "1=1", params: [] }) },
+      Admin: "all",
+    };
+    expect(userCanCreateFieldRow(user, mixedMap, { teamId: "ops" })).toBe(true);
+  });
 });

package/src/engine/__tests__/where-rule-lint.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, test } from "bun:test";
+import { assertQualifiedWhereFragment, tableColumnSqlNames } from "../where-rule-lint";
+
+const COLUMNS = new Set(["entity_id", "team_id", "owner_id"]);
+
+describe("assertQualifiedWhereFragment — passes (not a tautology)", () => {
+  test.each([
+    ["literal true", "1=1"],
+    ["unqualified column, no subquery", "owner_id = $1"],
+    ["unknown identifier compared to a literal", "custom_expr_42 = 1"],
+    [
+      "correctly qualified subquery",
+      "EXISTS (SELECT 1 FROM teams t WHERE t.entity_id = read_notes.entity_id AND t.team_id = $1)",
+    ],
+    [
+      "column name only inside a string literal",
+      "EXISTS (SELECT 1 FROM teams t WHERE t.label = 'entity_id')",
+    ],
+    [
+      "column name only inside a line comment",
+      "EXISTS (SELECT 1 FROM teams t WHERE t.x = $1) -- entity_id",
+    ],
+  ])("%s", (_label, sqlText) => {
+    expect(() => assertQualifiedWhereFragment(sqlText, COLUMNS, "scope")).not.toThrow();
+  });
+});
+
+describe("assertQualifiedWhereFragment — throws (fail-closed)", () => {
+  test("unqualified column shadowed inside a subquery (the real bug)", () => {
+    expect(() =>
+      assertQualifiedWhereFragment(
+        "EXISTS (SELECT 1 FROM teams t WHERE t.entity_id = entity_id AND t.team_id = $1)",
+        COLUMNS,
+        "scope",
+      ),
+    ).toThrow(/unqualified/i);
+  });
+
+  test("double-quoted unqualified column inside a subquery", () => {
+    expect(() =>
+      assertQualifiedWhereFragment(
+        'EXISTS (SELECT 1 FROM teams t WHERE t.entity_id = "entity_id")',
+        COLUMNS,
+        "scope",
+      ),
+    ).toThrow(/unqualified/i);
+  });
+
+  test("bare self-comparison", () => {
+    expect(() => assertQualifiedWhereFragment("team_id = team_id", COLUMNS, "scope")).toThrow(
+      /tautology/i,
+    );
+  });
+
+  test("qualified self-comparison", () => {
+    expect(() =>
+      assertQualifiedWhereFragment("t.entity_id = t.entity_id", COLUMNS, "scope"),
+    ).toThrow(/tautology/i);
+  });
+
+  test("$N placeholders never count as identifiers", () => {
+    // Regression guard: if the identifier regex ever matched "$1", this
+    // would misfire as a self-comparison between two placeholders.
+    expect(() => assertQualifiedWhereFragment("$1 = $1", COLUMNS, "scope")).not.toThrow();
+  });
+});
+
+describe("tableColumnSqlNames", () => {
+  test("plain-object table maps field keys to snake_case SQL names", () => {
+    const names = tableColumnSqlNames({ teamId: { name: "team_id" } });
+    expect(names.has("team_id")).toBe(true);
+  });
+
+  test("non-object table yields an empty set", () => {
+    expect(tableColumnSqlNames(null).size).toBe(0);
+    expect(tableColumnSqlNames(undefined).size).toBe(0);
+    expect(tableColumnSqlNames("not a table").size).toBe(0);
+  });
+});

package/src/engine/boot-validator/__tests__/ownership.test.ts

@@ -0,0 +1,87 @@
+// fw#2626 — boot guard: `{ kind: "where" }` is admissible on access.read
+// (buildOwnershipClause runs it as SQL) and rejected on access.write, where
+// rules are evaluated in memory against the concrete row and a create has no
+// row at all. Without the guard such a map boots and only ever denies.
+
+import { describe, expect, test } from "bun:test";
+import { defineFeature } from "../../define-feature";
+import { createEntity, createTextField } from "../../factories";
+import type { ClaimKeyDefinition, FeatureDefinition } from "../../types";
+import type { OwnershipMap, WhereRule } from "../../types/ownership";
+import { validateOwnershipRules } from "../ownership";
+
+const NO_CLAIMS: ReadonlyMap<string, ClaimKeyDefinition> = new Map();
+// Empty corpus keeps shouldValidateRoles() false, so role-existence checks
+// stay out of the way of the where-rule assertions below.
+const NO_ROLES: ReadonlySet<string> = new Set();
+
+const ownerWhere: WhereRule = {
+  kind: "where",
+  where: (user, ctx) => ({
+    sqlText: `${ctx.tableName}.owner_id = $${ctx.paramStart}`,
+    params: [user.id],
+  }),
+};
+
+type AccessMaps = { readonly read?: OwnershipMap; readonly write?: OwnershipMap };
+
+function featureWith(entityAccess: AccessMaps, fieldAccess?: AccessMaps): FeatureDefinition {
+  return defineFeature("memos", (r) => {
+    r.entity(
+      "memo",
+      createEntity({
+        table: "fw2626_guard_memos",
+        fields: {
+          ownerId: createTextField({ required: true }),
+          title: createTextField({ access: fieldAccess }),
+        },
+        access: entityAccess,
+      }),
+    );
+  });
+}
+
+function validate(feature: FeatureDefinition): void {
+  validateOwnershipRules(feature, NO_CLAIMS, NO_ROLES);
+}
+
+describe("validateOwnershipRules — where-rules on access.write", () => {
+  test("entity.access.write with a where-rule fails the boot", () => {
+    const feature = featureWith({ write: { Member: ownerWhere } });
+    expect(() => validate(feature)).toThrow(/access\.write/);
+    expect(() => validate(feature)).toThrow(/where/);
+  });
+
+  test("the error names the role, the feature and the from()-alternative", () => {
+    const feature = featureWith({ write: { Member: ownerWhere } });
+    let message = "";
+    try {
+      validate(feature);
+    } catch (e) {
+      message = e instanceof Error ? e.message : String(e);
+    }
+    expect(message).toContain('"Member"');
+    expect(message).toContain('"memos"');
+    expect(message).toContain("from(");
+  });
+
+  test("field.access.write with a where-rule fails the boot", () => {
+    const feature = featureWith({}, { write: { Member: ownerWhere } });
+    expect(() => validate(feature)).toThrow(/memo\.title\.access\.write/);
+  });
+
+  test("a where-rule on access.write is rejected even next to an 'all' role", () => {
+    const feature = featureWith({ write: { Admin: "all", Member: ownerWhere } });
+    expect(() => validate(feature)).toThrow(/access\.write/);
+  });
+});
+
+describe("validateOwnershipRules — where-rules on access.read stay supported", () => {
+  test("entity.access.read with a where-rule boots", () => {
+    expect(() => validate(featureWith({ read: { Member: ownerWhere } }))).not.toThrow();
+  });
+
+  test("field.access.read with a where-rule boots", () => {
+    expect(() => validate(featureWith({}, { read: { Member: ownerWhere } }))).not.toThrow();
+  });
+});

package/src/engine/boot-validator/ownership.ts

@@ -1,5 +1,9 @@
-import type { OwnershipMap, OwnershipRule } from "../ownership";
-import type { ClaimKeyDefinition, FeatureDefinition } from "../types";
+import { buildEntityTable } from "../../db/table-builder";
+import type { OwnershipMap, OwnershipRule, SqlFragment, WhereRule } from "../ownership";
+import { SYSTEM_USER_ID } from "../system-user";
+import type { ClaimKeyDefinition, FeatureDefinition, SessionUser } from "../types";
+import { SYSTEM_TENANT_ID } from "../types/identifiers";
+import { assertQualifiedWhereFragment, tableColumnSqlNames } from "../where-rule-lint";
 
 // --- Ownership rule validation (H.2) ---
 //
@@ -7,6 +11,38 @@ import type { ClaimKeyDefinition, FeatureDefinition } from "../types";
 // FromRule against the cross-feature claim registry, and confirms the
 // referenced column exists on the entity. Catches typos, renames, and
 // cross-feature-claim-removal scenarios at boot instead of at request time.
+//
+// fw#2639: also probes every `{ kind: "where" }` rule against the where-rule
+// lint (see ../where-rule-lint.ts) so a fail-open unqualified-column bug
+// fails the boot instead of waiting for a request from the right role.
+//
+// fw#2626: `access.write` maps reject `{ kind: "where" }` outright. A
+// where-rule is raw SQL and the write path never reaches SQL — it evaluates
+// rules in memory against the concrete row (userCanCreateFieldRow /
+// userCanWriteFieldRow), and a create has no row to run a predicate against
+// at all. Such a rule can therefore only ever deny, so the boot fails instead
+// of shipping an access map that silently locks the role out.
+
+// A rule that reads real claims off the user can't be evaluated at boot —
+// PROBE_USER carries none — so probing is best-effort: rules that throw on
+// the probe user fall through to the runtime backstop in
+// ownership.ts#ruleToFragment instead.
+const PROBE_USER: SessionUser = {
+  id: SYSTEM_USER_ID,
+  tenantId: SYSTEM_TENANT_ID,
+  roles: [],
+  claims: {},
+};
+
+export type WhereRuleProbe = {
+  readonly table: unknown;
+  readonly tableName: string;
+  readonly columns: ReadonlySet<string>;
+};
+
+// Which half of an access map is being validated. Only "read" ever reaches
+// SQL, so it is the only path on which a where-rule is admissible.
+export type AccessPath = "read" | "write";
 
 export function validateOwnershipRules(
   feature: FeatureDefinition,
@@ -20,6 +56,19 @@ export function validateOwnershipRules(
     const frameworkColumns = ["id", "tenantId", "version", "insertedAt", "modifiedAt"];
     for (const col of frameworkColumns) columnNames.add(col);
 
+    let probe: WhereRuleProbe | undefined;
+    try {
+      const table = buildEntityTable(entityName, entity);
+      const columns = tableColumnSqlNames(table);
+      if (columns.size > 0) {
+        probe = { table, tableName: entity.table ?? entityName, columns };
+      }
+    } catch {
+      // skip: table cannot be built outside the real boot sequence here —
+      // the runtime backstop in ruleToFragment still covers this entity.
+      probe = undefined;
+    }
+
     // Entity-level access
     if (entity.access?.read) {
       checkOwnershipMap({
@@ -29,6 +78,8 @@ export function validateOwnershipRules(
         knownRoles,
         scope: `entity "${entityName}".access.read`,
         featureName: feature.name,
+        probe,
+        path: "read",
       });
     }
     if (entity.access?.write) {
@@ -39,6 +90,8 @@ export function validateOwnershipRules(
         knownRoles,
         scope: `entity "${entityName}".access.write`,
         featureName: feature.name,
+        probe,
+        path: "write",
       });
     }
 
@@ -53,6 +106,8 @@ export function validateOwnershipRules(
         knownRoles,
         scope: `${entityName}.${fieldName}.access.read`,
         featureName: feature.name,
+        probe,
+        path: "read",
       });
       checkFieldAccess({
         access: field.access?.write,
@@ -61,6 +116,8 @@ export function validateOwnershipRules(
         knownRoles,
         scope: `${entityName}.${fieldName}.access.write`,
         featureName: feature.name,
+        probe,
+        path: "write",
       });
     }
   }
@@ -73,6 +130,8 @@ export function checkFieldAccess(args: {
   readonly knownRoles: ReadonlySet<string>;
   readonly scope: string;
   readonly featureName: string;
+  readonly probe?: WhereRuleProbe;
+  readonly path: AccessPath;
 }): void {
   // skip: no access rules on this field, nothing to validate
   if (!args.access) return;
@@ -96,6 +155,8 @@ export function checkFieldAccess(args: {
     knownRoles: args.knownRoles,
     scope: args.scope,
     featureName: args.featureName,
+    probe: args.probe,
+    path: args.path,
   });
 }
 
@@ -134,6 +195,8 @@ export function checkOwnershipMap(args: {
   readonly knownRoles: ReadonlySet<string>;
   readonly scope: string;
   readonly featureName: string;
+  readonly probe?: WhereRuleProbe;
+  readonly path: AccessPath;
 }): void {
   for (const [roleName, rawRule] of Object.entries(args.map)) {
     // Role-existence check — typos like `{"Admi": "all"}` where no handler
@@ -149,7 +212,13 @@ export function checkOwnershipMap(args: {
     // @cast-boundary schema-walk — extracted from feature-config inspection
     const rule = rawRule as OwnershipRule;
     if (rule === "all") continue;
-    if (rule.kind === "where") continue; // escape hatch — feature author owns the SQL
+    if (rule.kind === "where") {
+      if (args.path === "write") {
+        throw new Error(buildWhereOnWritePathMessage(roleName, args.scope, args.featureName));
+      }
+      probeWhereRule(rule, roleName, args.probe, args.scope);
+      continue; // escape hatch — feature author owns the SQL
+    }
 
     // FromRule — validate ref + column.
     if (rule.refKind === "claim") {
@@ -181,6 +250,53 @@ export function checkOwnershipMap(args: {
   }
 }
 
+// Best-effort: run the where-rule lint against the SQL the rule produces
+// for PROBE_USER. A rule that needs real claims throws on that call and is
+// silently skipped — ruleToFragment's runtime backstop is what catches it.
+export function probeWhereRule(
+  rule: WhereRule,
+  roleName: string,
+  probe: WhereRuleProbe | undefined,
+  scope: string,
+): void {
+  // skip: no probe means the entity's column set could not be derived above;
+  // without it there is nothing to check the rule's SQL against, so the
+  // runtime backstop in ruleToFragment is the only line of defense left.
+  if (!probe) return;
+  let fragment: SqlFragment;
+  try {
+    fragment = rule.where(PROBE_USER, {
+      table: probe.table,
+      tableName: probe.tableName,
+      paramStart: 1,
+    });
+  } catch {
+    // skip: a rule that needs real claims cannot be probed at boot; ruleToFragment is the backstop
+    return;
+  }
+  // skip: a rule producing no SQL fragment for the probe user has nothing to
+  // lint here; ruleToFragment still validates it against a real request.
+  if (typeof fragment?.sqlText !== "string") return;
+  assertQualifiedWhereFragment(fragment.sqlText, probe.columns, `${scope} (role "${roleName}")`);
+}
+
+export function buildWhereOnWritePathMessage(
+  roleName: string,
+  scope: string,
+  featureName: string,
+): string {
+  return (
+    `[Kumiko Ownership] ${scope} uses a \`{ kind: "where" }\` rule for role ` +
+    `"${roleName}" (feature: "${featureName}"). where-rules are raw SQL and only ` +
+    `the read path runs SQL (buildOwnershipClause); write access is decided in ` +
+    `memory against the concrete row, and a create has no row yet — so the rule ` +
+    `could only ever deny this role. Use a from()-rule (e.g. ` +
+    `from("user:id", "ownerId") or from("claim:<feature>:<key>")) on access.write, ` +
+    `or enforce the condition in the write-handler's preSave hook. ` +
+    `where-rules stay supported on access.read.`
+  );
+}
+
 export function buildUnknownRoleMessage(
   roleName: string,
   knownRoles: ReadonlySet<string>,

package/src/engine/ownership.ts

@@ -23,6 +23,7 @@ import {
 } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { toSnakeCase } from "../db/table-builder";
 import type { SessionUser } from "./types";
+import { assertQualifiedWhereFragment, tableColumnSqlNames } from "./where-rule-lint";
 
 // Types live in engine/types/ownership.ts (no runtime dependency); re-exported
 // here for backwards compatibility with existing importers of this file.
@@ -113,12 +114,13 @@ export function matchesRule(
 ): boolean {
   if (rule === "all") return true;
   if (rule.kind === "where") {
-    // `where` rules produce Drizzle SQL for the DB-side filter. They don't
-    // have a straightforward in-memory evaluator — the feature author owns
-    // the semantics. Field-level filters can't use `{ where }` rules; the
-    // boot-validator rejects them with a clear error at registration time.
+    // `where` rules produce SQL for the DB-side filter and have no in-memory
+    // evaluator — the feature author owns the semantics. Only the read path
+    // reaches SQL (buildOwnershipClause); on write maps the boot-validator
+    // rejects them outright (fw#2626), and the in-memory write helpers below
+    // fail closed rather than calling in here.
     throw new Error(
-      "where-rules can only be evaluated at the SQL layer; boot-validator should reject them on field-level access.",
+      "where-rules can only be evaluated at the SQL layer (buildOwnershipClause); they are rejected on access.write at boot.",
     );
   }
 
@@ -158,10 +160,10 @@ export function userCanReadFieldRow(
   for (const role of user.roles) {
     const rule = accessMap[role];
     if (!rule) continue;
-    // where-rules are entity-level SQL predicates (buildOwnershipClause);
-    // matchesRule can't evaluate them in-memory and throws. Field-level
-    // access is boot-validator-rejected for where-rules, but this function
-    // is also reachable from hand-rolled entity-level reads.
+    // where-rules are SQL predicates (buildOwnershipClause); matchesRule
+    // can't evaluate them in-memory and throws. Read maps may legitimately
+    // carry one — it just belongs on the SQL path, so an in-memory read
+    // check denies rather than crashing.
     // skip: where-rules are SQL-layer only — fail closed instead of throwing.
     if (rule !== "all" && rule.kind === "where") continue;
     if (matchesRule(rule, user, row)) return true;
@@ -225,6 +227,10 @@ export function userCanCreateFieldRow(
     const rule = accessMap[role];
     if (!rule) continue;
     if (rule === "all") return true;
+    // skip: where-rules are SQL-layer only — fail closed instead of throwing.
+    // Mirrors userCanWriteFieldRow; a create has no row to run SQL against
+    // at all, so the boot-validator rejects the shape on access.write.
+    if (rule.kind === "where") continue;
     if (matchesRule(rule, user, newRow)) return true;
   }
   return false;
@@ -349,6 +355,14 @@ function ruleToFragment(
       tableName: tableNameOf(table),
       paramStart,
     });
+    // Runtime backstop for the boot-time probe (boot-validator/ownership.ts):
+    // an unqualified column in a correlated subquery silently turns into a
+    // fail-open tautology (fw#2639) — throw instead of shipping it.
+    assertQualifiedWhereFragment(
+      frag.sqlText,
+      tableColumnSqlNames(table),
+      `ownership where-rule on "${tableNameOf(table)}"`,
+    );
     return { kind: "sql", sqlText: frag.sqlText, params: frag.params };
   }
   // FromRule

package/src/engine/where-rule-lint.ts

@@ -0,0 +1,196 @@
+// Static lint for `WhereRule` SQL fragments (fw#2639).
+//
+// A `where`-rule hands the framework raw SQL. If the author writes an
+// unqualified column name inside a correlated subquery, Postgres binds it
+// to the innermost table instead of the outer one — the intended predicate
+// silently collapses into a tautology (`t.x = t.x`) and the rule grants
+// every row instead of none. This module is a text-level lint (no SQL
+// parser) that catches the two shapes that always mean "this rule is
+// broken": a bare column reference inside a subquery that shadows an outer
+// column, and a literal self-comparison.
+
+import { KUMIKO_COLUMNS_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
+import { toSnakeCase } from "../db/table-builder";
+
+const IDENT_SRC = `"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*`;
+const QUALIFIED_SRC = `(?:${IDENT_SRC})(?:\\.(?:${IDENT_SRC}))?`;
+
+const TOKEN_RE = new RegExp(IDENT_SRC, "g");
+const SELF_COMPARISON_RE = new RegExp(
+  `(${QUALIFIED_SRC})\\s*(?<![!<>=])=(?!=)\\s*(${QUALIFIED_SRC})`,
+  "g",
+);
+const QUALIFIED_PARSE_RE = new RegExp(`^(${IDENT_SRC})(?:\\.(${IDENT_SRC}))?$`);
+
+// Resolve the SQL column names a table exposes, so the lint can tell a
+// real column reference apart from a table alias / function name / SQL
+// keyword. Returns an empty set when nothing is derivable (fail-open on
+// the lint itself would be worse than skipping it).
+export function tableColumnSqlNames(table: unknown): ReadonlySet<string> {
+  if (table === null || typeof table !== "object") return new Set();
+
+  const cols = (table as Record<symbol, unknown>)[KUMIKO_COLUMNS_SYMBOL];
+  if (cols && typeof cols === "object") {
+    const names = new Set<string>();
+    for (const col of Object.values(cols as Record<string, unknown>)) {
+      if (col && typeof col === "object") {
+        const nameVal = (col as Record<string, unknown>)["name"];
+        if (typeof nameVal === "string") names.add(nameVal.toLowerCase());
+      }
+    }
+    return names;
+  }
+
+  // Plain-object fallback (tests): no Drizzle column-symbol map, so every
+  // object-valued key is treated as a field and mapped to its SQL name the
+  // same way columnSqlName() in ownership.ts does for hand-rolled tables.
+  const names = new Set<string>();
+  for (const [key, value] of Object.entries(table as Record<string, unknown>)) {
+    if (value && typeof value === "object") {
+      names.add(toSnakeCase(key).toLowerCase());
+    }
+  }
+  return names;
+}
+
+function skipLineComment(sql: string, i: number): number {
+  let j = i;
+  while (j < sql.length && sql[j] !== "\n") j++;
+  return j;
+}
+
+function skipBlockComment(sql: string, i: number): number {
+  let j = i + 2;
+  while (j < sql.length && !(sql[j] === "*" && sql[j + 1] === "/")) j++;
+  return j + 2;
+}
+
+function skipQuotedLiteral(sql: string, i: number): number {
+  let j = i + 1;
+  while (j < sql.length) {
+    if (sql[j] === "'" && sql[j + 1] === "'") {
+      j += 2;
+      continue;
+    }
+    if (sql[j] === "'") {
+      j++;
+      break;
+    }
+    j++;
+  }
+  return j;
+}
+
+function stripCommentsAndStrings(sqlText: string): string {
+  let result = "";
+  let i = 0;
+  const len = sqlText.length;
+  while (i < len) {
+    const ch = sqlText[i];
+    if (ch === "-" && sqlText[i + 1] === "-") {
+      i = skipLineComment(sqlText, i);
+      result += " ";
+      continue;
+    }
+    if (ch === "/" && sqlText[i + 1] === "*") {
+      i = skipBlockComment(sqlText, i);
+      result += " ";
+      continue;
+    }
+    if (ch === "'") {
+      i = skipQuotedLiteral(sqlText, i);
+      result += " ";
+      continue;
+    }
+    result += ch;
+    i++;
+  }
+  return result;
+}
+
+function normalizeIdent(raw: string): string {
+  if (raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"')) {
+    return raw.slice(1, -1).replace(/""/g, '"').toLowerCase();
+  }
+  return raw.toLowerCase();
+}
+
+function normalizeQualifiedRef(raw: string): string {
+  const parsed = QUALIFIED_PARSE_RE.exec(raw);
+  if (!parsed) return normalizeIdent(raw);
+  const first = normalizeIdent(parsed[1] ?? "");
+  const second = parsed[2];
+  return second === undefined ? first : `${first}.${normalizeIdent(second)}`;
+}
+
+// Rule 1: `X = Y` where X and Y are textually the same (optionally
+// once-qualified) identifier is always a tautology, subquery or not.
+function findSelfComparison(cleaned: string): string | null {
+  SELF_COMPARISON_RE.lastIndex = 0;
+  let match: RegExpExecArray | null = SELF_COMPARISON_RE.exec(cleaned);
+  while (match !== null) {
+    const left = match[1] ?? "";
+    const right = match[2] ?? "";
+    if (normalizeQualifiedRef(left) === normalizeQualifiedRef(right)) {
+      return left.trim();
+    }
+    match = SELF_COMPARISON_RE.exec(cleaned);
+  }
+  return null;
+}
+
+// Rule 2: inside a subquery, a bare identifier that happens to name a
+// column on the OUTER table is the fail-open shape — Postgres resolves it
+// against the innermost table first. A qualifier (`t.x`) or a table/alias
+// name immediately followed by `.` is not a column reference and is
+// ignored.
+function findUnqualifiedColumnReference(
+  cleaned: string,
+  columnSqlNames: ReadonlySet<string>,
+): string | null {
+  TOKEN_RE.lastIndex = 0;
+  let match: RegExpExecArray | null = TOKEN_RE.exec(cleaned);
+  while (match !== null) {
+    const start = match.index;
+    const end = start + match[0].length;
+    const precededByDot = start > 0 && cleaned[start - 1] === ".";
+    const followedByDot = cleaned[end] === ".";
+    if (!precededByDot && !followedByDot) {
+      const normalized = normalizeIdent(match[0]);
+      if (columnSqlNames.has(normalized)) return normalized;
+    }
+    match = TOKEN_RE.exec(cleaned);
+  }
+  return null;
+}
+
+// Throws (fail-closed) instead of shipping a where-rule that would silently
+// fail-open at request time. Called both as a runtime backstop
+// (ownership.ts#ruleToFragment) and as a boot-time probe
+// (boot-validator/ownership.ts).
+export function assertQualifiedWhereFragment(
+  sqlText: string,
+  columnSqlNames: ReadonlySet<string>,
+  scope: string,
+): void {
+  const cleaned = stripCommentsAndStrings(sqlText);
+
+  const selfComparison = findSelfComparison(cleaned);
+  if (selfComparison !== null) {
+    throw new Error(
+      `[Kumiko Ownership] ${scope}: where-rule SQL compares "${selfComparison}" with itself — this is a tautology that matches every row. Remove the redundant comparison or compare against a real bound value / a different, properly qualified column.`,
+    );
+  }
+
+  // skip: without a subquery there is no inner table to shadow — a bare
+  // column reference cannot bind against anything but the outer table, so
+  // the fail-open shape this lint targets is impossible here.
+  if (!/\bSELECT\b/i.test(cleaned)) return;
+
+  const unqualified = findUnqualifiedColumnReference(cleaned, columnSqlNames);
+  if (unqualified !== null) {
+    throw new Error(
+      `[Kumiko Ownership] ${scope}: where-rule SQL references column "${unqualified}" unqualified inside a subquery. Postgres binds an unqualified name to the innermost table first, which silently turns the ownership predicate into a tautology (fail-open). Qualify it with the outer table, e.g. \`\${ctx.tableName}.${unqualified}\`.`,
+    );
+  }
+}