@cosmicdrift/kumiko-framework 0.245.0 → 0.246.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.245.0",
+  "version": "0.246.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.245.0",
+    "@cosmicdrift/kumiko-types": "0.246.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.245.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.246.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/apply-entity-event.ts

@@ -14,15 +14,14 @@
 // (DEK erased → Wert unlesbar, bidx NULL). Load-bearing Test:
 // db/__tests__/implicit-projection-equivalence.integration.test.ts.
 //
-// Tenant-Isolation: applyEntityEvent erwartet einen rohen DbRunner (TX
-// oder pool), KEINEN TenantDb-Wrapper. Schutz kommt aus zwei Quellen:
-//   1. Live-Pfad ruft VOR der Schreibung loadById (tenant-scoped) für
-//      update/delete/restore — die aggregateId ist also schon tenant-
-//      validiert bevor wir hier ankommen.
-//   2. Bei create wird tenantId explizit aus event.tenantId gesetzt, also
-//      nie über den TenantDb-Wrapper-Default abgeleitet.
-// Damit ist der TenantDb-Wrapper-Loss in dieser Funktion funktional ohne
-// Sicherheitslücke.
+// Tenant isolation: applyEntityEvent expects a raw DbRunner (tx or pool), NOT
+// a TenantDb wrapper. Two sources keep it safe:
+//   1. The live path reads the target row through the tenant-scoped TenantDb
+//      before writing — loadById() for update/delete/forget, db.fetchOne() for
+//      restore — so the aggregateId is already tenant-validated on arrival.
+//   2. create sets tenantId explicitly from event.tenantId, never derived from
+//      the TenantDb wrapper default.
+// The missing TenantDb wrapper in this function is therefore not a hole.
 //
 // Auto-Verben:
 //   <entity>.created   → INSERT

package/src/db/event-store-executor-write.ts

@@ -27,7 +27,7 @@ import {
   entityEventName,
   tryMapUniqueViolation,
 } from "./event-store-executor-context";
-import { runInSavepointIfSupported, selectMany } from "./query";
+import { runInSavepointIfSupported } from "./query";
 
 // Art. 17 erasure runs as the framework operator, not as a row owner; a
 // per-role ownership map can never cover it, and a silent deny means the
@@ -714,7 +714,12 @@ export function createWriteVerbs(
         );
       }
 
-      const [row] = await selectMany(db.raw, table, { id: payload.id });
+      // Tenant boundary: db.fetchOne applies TenantDb's tenant predicate,
+      // selectMany(db.raw, ...) did not — any caller could un-delete a foreign
+      // tenant's row by id. "system"-mode dbs (r.systemScope() / crossTenant
+      // handlers) still read unfiltered. No isDeleted filter here: restore
+      // targets exactly the soft-deleted row.
+      const row = await db.fetchOne(table, { id: payload.id });
       if (!row) return writeFailure(new NotFoundError(entityName, payload.id));
       const data = row as DbRow;
       if (!data["isDeleted"]) {
@@ -783,9 +788,9 @@ export function createWriteVerbs(
         throw e;
       }
 
-      // Live==Rebuild via applyEntityEvent. Restore schreibt nur isDeleted=
-      // false + version-Bump in die Tabelle — keine sensitive-Drift, daher
-      // kein payload-override nötig.
+      // Live==Rebuild via applyEntityEvent. Restore only writes isDeleted=false
+      // plus the version bump, so there is no sensitive-field drift and no
+      // payload override is needed.
       const restoreResult = await runInSavepointIfSupported(db.raw, async (sp) =>
         applyEntityEvent(event, table, entity, sp),
       );
@@ -798,11 +803,11 @@ export function createWriteVerbs(
         await entityCache.del(user.tenantId, entityName, payload.id);
       }
 
-      // Read-Side Auto-Convert für Compound-Types (parallel zu update/list).
+      // Read-side auto-convert for compound types, same as update/list.
       // decryptForRead matches create/update/list/detail: the caller-facing
       // row and `previous` snapshot must be plaintext for `encrypted` fields,
       // same as every other executor method — `data`/`restored` are raw rows
-      // (selectMany / applyEntityEvent), never decrypted before this point.
+      // (db.fetchOne / applyEntityEvent), never decrypted before this point.
       const restoredHydrated = await decryptForRead(
         rehydrateCompoundTypes(restored as DbRow, entity) as DbRow,
       );

package/src/engine/__tests__/entity-restore-tenant-isolation.integration.test.ts

@@ -0,0 +1,143 @@
+// restore() used to load its target row with selectMany(db.raw, ...) — a raw,
+// unfiltered read. Any caller holding the write role could therefore un-delete
+// a soft-deleted row belonging to another tenant and got the decrypted row back
+// in the response. delete() never had that hole (it goes through the
+// tenant-scoped loadById). These tests pin both halves: the tenant-scoped
+// handler must not reach across, and the crossTenant handler must still be able
+// to.
+//
+// Two stacks on the SAME Postgres database: one registers the restore handler
+// without `crossTenant`, the other with it — a clean A/B on the one flag.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "../../stack";
+import {
+  createEntity,
+  createTextField,
+  defineEntityCreateHandler,
+  defineEntityDeleteHandler,
+  defineEntityRestoreHandler,
+  defineFeature,
+  from,
+} from "../index";
+
+const thingEntity = createEntity({
+  table: "ctrestore_things",
+  softDelete: true,
+  fields: {
+    label: createTextField({ required: true }),
+  },
+  access: { write: { Admin: "all", SystemAdmin: from("user:tenantId", "tenantId") } },
+});
+const thingTable = buildEntityTable("thing", thingEntity);
+
+function buildFeature(crossTenant: boolean) {
+  return defineFeature("ctrestore", (r) => {
+    r.entity("thing", thingEntity);
+    r.writeHandler(
+      defineEntityCreateHandler("thing", thingEntity, {
+        access: { roles: ["Admin", "SystemAdmin"] },
+      }),
+    );
+    r.writeHandler(
+      defineEntityDeleteHandler("thing", thingEntity, {
+        access: { roles: ["Admin", "SystemAdmin"] },
+      }),
+    );
+    r.writeHandler(
+      defineEntityRestoreHandler("thing", thingEntity, {
+        access: { roles: ["Admin", "SystemAdmin"] },
+        ...(crossTenant && { crossTenant: true }),
+      }),
+    );
+  });
+}
+
+const dbName = `kumiko_test_ctrestore_${crypto.randomUUID().replace(/-/g, "").slice(0, 8)}`;
+
+let tenantScopedStack: TestStack;
+let crossTenantStack: TestStack;
+
+beforeAll(async () => {
+  tenantScopedStack = await setupTestStack({ features: [buildFeature(false)], dbName });
+  await unsafeCreateEntityTable(tenantScopedStack.db, thingEntity, "thing");
+  crossTenantStack = await setupTestStack({
+    features: [buildFeature(true)],
+    dbName,
+    persistentDb: true,
+  });
+});
+
+afterAll(async () => {
+  await crossTenantStack.cleanup();
+  await tenantScopedStack.cleanup();
+});
+
+async function createDeletedThing(label: string): Promise<string> {
+  const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+    "ctrestore:write:thing:create",
+    { label },
+    TestUsers.otherTenant,
+  );
+  await tenantScopedStack.http.writeOk(
+    "ctrestore:write:thing:delete",
+    { id: created.id },
+    TestUsers.otherTenant,
+  );
+
+  const rows = await selectMany(tenantScopedStack.db, thingTable, { id: created.id });
+  expect(rows[0]?.["isDeleted"]).toBe(true);
+
+  return created.id;
+}
+
+describe("entity restore: tenant isolation", () => {
+  test("tenant-scoped restore cannot un-delete a foreign tenant's row", async () => {
+    const id = await createDeletedThing("foreign-deleted");
+
+    const err = await tenantScopedStack.http.writeErr(
+      "ctrestore:write:thing:restore",
+      { id },
+      TestUsers.admin,
+    );
+    expect(err.code).toBe("not_found");
+
+    const rows = await selectMany(tenantScopedStack.db, thingTable, { id });
+    expect(rows[0]?.["isDeleted"]).toBe(true);
+  });
+
+  test("own-tenant restore still works", async () => {
+    const id = await createDeletedThing("own-restore");
+
+    await tenantScopedStack.http.writeOk(
+      "ctrestore:write:thing:restore",
+      { id },
+      TestUsers.otherTenant,
+    );
+
+    const rows = await selectMany(tenantScopedStack.db, thingTable, { id });
+    expect(rows[0]?.["isDeleted"]).toBe(false);
+  });
+
+  test("crossTenant restore still reaches a foreign tenant's row", async () => {
+    const id = await createDeletedThing("crosstenant-restore");
+
+    await crossTenantStack.http.writeOk(
+      "ctrestore:write:thing:restore",
+      { id },
+      TestUsers.systemAdmin,
+    );
+
+    const rows = await selectMany(tenantScopedStack.db, thingTable, { id });
+    expect(rows[0]?.["isDeleted"]).toBe(false);
+    expect(rows[0]?.["tenantId"]).toBe(testTenantId(2));
+  });
+});