@cosmicdrift/kumiko-framework 0.269.2 → 0.273.0

package/src/engine/__tests__/entity-write-crosstenant.integration.test.ts

@@ -1,19 +1,23 @@
-// fw#2650 — crossTenant on write handlers. A SystemAdmin operator writes a
-// row that lives in a different tenant than their own session. That needs
-// two things: (1) an unfiltered db instead of the caller's tenant-scoped
-// one (so the row is even visible), and (2) the event-store stream AND the
-// entity's tenant-based write-ownership rule — both keyed off the ACTING
-// user, not the db — so the acting user's tenantId must be rewritten to the
-// target row's tenant before the write, not just handed an unfiltered db.
+// fw#2650/fw#2915 — crossTenant / escapeHatch on entity convention handlers. A
+// SystemAdmin operator reads/writes a row that lives in a different tenant
+// than their own session. That needs two things: (1) an unfiltered db
+// instead of the caller's tenant-scoped one (so the row is even visible),
+// and (2) the event-store stream AND the entity's tenant-based
+// write-ownership rule — both keyed off the ACTING user, not the db — so the
+// acting user's tenantId must be rewritten to the target row's tenant before
+// the write, not just handed an unfiltered db.
 //
-// Two stacks on the SAME Postgres database: one registers the update
-// handler without `crossTenant`, the other with it — a clean A/B on the one
-// flag, no handler-name collisions to work around.
+// Three stacks on the SAME Postgres database: "none" (no cross-tenant
+// option), "legacy" (`crossTenant: true`), "escapeHatch"
+// (`escapeHatch: { reason }`) — a clean A/B/C on the one option, no
+// handler-name collisions to work around.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import type { EscapeHatchUseEvent } from "@cosmicdrift/kumiko-types/handlers";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { eventsTable } from "../../event-store";
+import type { Logger } from "../../logging/types";
 import {
   setupTestStack,
   type TestStack,
@@ -21,10 +25,12 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "../../stack";
+import { DEPRECATED_CROSS_TENANT_SIGNAL } from "../entity-handlers";
 import {
   createEntity,
   createTextField,
   defineEntityCreateHandler,
+  defineEntityListHandler,
   defineEntityUpdateHandler,
   defineFeature,
   from,
@@ -32,9 +38,9 @@ import {
 
 // "Admin" passes unconditionally (any tenant may create its own rows).
 // "SystemAdmin" is tenant-scoped — this is the entity-level rule the
-// crossTenant acting-user rewrite must satisfy for the operator write to
-// go through; without the rewrite the acting user's own tenant would never
-// match a foreign row's tenantId here.
+// crossTenant/escapeHatch acting-user rewrite must satisfy for the operator
+// write to go through; without the rewrite the acting user's own tenant
+// would never match a foreign row's tenantId here.
 const thingEntity = createEntity({
   table: "ctwrite_things",
   fields: {
@@ -44,7 +50,22 @@ const thingEntity = createEntity({
 });
 const thingTable = buildEntityTable("thing", thingEntity);
 
-function buildFeature(crossTenant: boolean) {
+const ESCAPE_HATCH_REASON = "fw#2915 integration test — operator cross-tenant scan";
+
+type CrossTenantMode = "none" | "legacy" | "escapeHatch";
+
+function crossTenantOptionsFor(mode: CrossTenantMode) {
+  switch (mode) {
+    case "legacy":
+      return { crossTenant: true as const };
+    case "escapeHatch":
+      return { escapeHatch: { reason: ESCAPE_HATCH_REASON } };
+    case "none":
+      return {};
+  }
+}
+
+function buildFeature(mode: CrossTenantMode) {
   return defineFeature("ctwrite", (r) => {
     r.entity("thing", thingEntity);
     r.writeHandler(
@@ -55,7 +76,13 @@ function buildFeature(crossTenant: boolean) {
     r.writeHandler(
       defineEntityUpdateHandler("thing", thingEntity, {
         access: { roles: ["SystemAdmin"] },
-        ...(crossTenant && { crossTenant: true }),
+        ...crossTenantOptionsFor(mode),
+      }),
+    );
+    r.queryHandler(
+      defineEntityListHandler("thing", thingEntity, {
+        access: { roles: ["SystemAdmin"] },
+        ...crossTenantOptionsFor(mode),
       }),
     );
   });
@@ -63,48 +90,81 @@ function buildFeature(crossTenant: boolean) {
 
 const dbName = `kumiko_test_ctwrite_${crypto.randomUUID().replace(/-/g, "").slice(0, 8)}`;
 
-let tenantScopedStack: TestStack;
-let crossTenantStack: TestStack;
+function recordingSink(events: EscapeHatchUseEvent[]) {
+  return async (event: EscapeHatchUseEvent) => {
+    events.push(event);
+  };
+}
+
+function recordingLogger(sink: Array<{ msg: string; data?: Record<string, unknown> }>): Logger {
+  const log: Logger = {
+    info() {},
+    debug() {},
+    warn(msg, data) {
+      sink.push({ msg, data });
+    },
+    error() {},
+    child() {
+      return log;
+    },
+  };
+  return log;
+}
+
+let noneStack: TestStack;
+let legacyStack: TestStack;
+let escapeHatchStack: TestStack;
+
+const legacyWarnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+const escapeHatchWarnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+const escapeHatchAuditEvents: EscapeHatchUseEvent[] = [];
 
 beforeAll(async () => {
-  tenantScopedStack = await setupTestStack({ features: [buildFeature(false)], dbName });
-  await unsafeCreateEntityTable(tenantScopedStack.db, thingEntity, "thing");
-  // Second connection to the SAME database — persistentDb:true means its
-  // cleanup() only closes the pool; tenantScopedStack (created without that
-  // flag) owns the actual DROP DATABASE and must clean up last.
-  crossTenantStack = await setupTestStack({
-    features: [buildFeature(true)],
+  noneStack = await setupTestStack({ features: [buildFeature("none")], dbName });
+  await unsafeCreateEntityTable(noneStack.db, thingEntity, "thing");
+  // Second and third connections to the SAME database — persistentDb:true
+  // means their cleanup() only closes the pool; noneStack (created without
+  // that flag) owns the actual DROP DATABASE and must clean up last.
+  legacyStack = await setupTestStack({
+    features: [buildFeature("legacy")],
+    dbName,
+    persistentDb: true,
+    extraContext: { log: recordingLogger(legacyWarnCalls) },
+  });
+  escapeHatchStack = await setupTestStack({
+    features: [buildFeature("escapeHatch")],
     dbName,
     persistentDb: true,
+    extraContext: {
+      _escapeHatchAuditSink: recordingSink(escapeHatchAuditEvents),
+      log: recordingLogger(escapeHatchWarnCalls),
+    },
   });
 });
 
 afterAll(async () => {
-  await crossTenantStack.cleanup();
-  await tenantScopedStack.cleanup();
+  await escapeHatchStack.cleanup();
+  await legacyStack.cleanup();
+  await noneStack.cleanup();
 });
 
 async function updatedEventTenantId(aggregateId: string): Promise<string | undefined> {
-  const rows = await selectMany<{ type: string; tenantId: string }>(
-    tenantScopedStack.db,
-    eventsTable,
-    {
-      aggregateId,
-    },
-  );
+  const rows = await selectMany<{ type: string; tenantId: string }>(noneStack.db, eventsTable, {
+    aggregateId,
+  });
   const updatedRow = rows.find((r) => r.type.includes("updated"));
   return updatedRow?.tenantId;
 }
 
-describe("entity write handlers: crossTenant option (fw#2650)", () => {
-  test("crossTenant handler: SystemAdmin updates a row owned by another tenant", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+describe("entity write/list handlers: crossTenant vs. escapeHatch (fw#2650/fw#2915)", () => {
+  test("legacy crossTenant handler: SystemAdmin updates a row owned by another tenant", async () => {
+    const created = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
       { label: "foreign" },
       TestUsers.otherTenant,
     );
 
-    const updated = await crossTenantStack.http.writeOk<{ id: string; data: { label: string } }>(
+    const updated = await legacyStack.http.writeOk<{ id: string; data: { label: string } }>(
       "ctwrite:write:thing:update",
       { id: created.id, version: 1, changes: { label: "touched by operator" } },
       TestUsers.systemAdmin,
@@ -113,7 +173,7 @@ describe("entity write handlers: crossTenant option (fw#2650)", () => {
 
     // Row stays on its original tenant — crossTenant reaches across the
     // tenant boundary, it does not migrate the row.
-    const rows = await selectMany(tenantScopedStack.db, thingTable, { id: created.id });
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
     expect(rows[0]?.["tenantId"]).toBe(testTenantId(2));
 
     // The append must land on the row's own tenant stream, not the acting
@@ -123,36 +183,135 @@ describe("entity write handlers: crossTenant option (fw#2650)", () => {
     expect(await updatedEventTenantId(created.id)).toBe(testTenantId(2));
   });
 
+  test("escapeHatch handler: SystemAdmin updates a row owned by another tenant, reported as acknowledge-cross-tenant", async () => {
+    escapeHatchAuditEvents.length = 0;
+    const created = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "foreign-escape-hatch" },
+      TestUsers.otherTenant,
+    );
+
+    const updated = await escapeHatchStack.http.writeOk<{ id: string; data: { label: string } }>(
+      "ctwrite:write:thing:update",
+      { id: created.id, version: 1, changes: { label: "touched by operator via escapeHatch" } },
+      TestUsers.systemAdmin,
+    );
+    expect(updated.data.label).toBe("touched by operator via escapeHatch");
+
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
+    expect(rows[0]?.["tenantId"]).toBe(testTenantId(2));
+    expect(await updatedEventTenantId(created.id)).toBe(testTenantId(2));
+
+    const matches = escapeHatchAuditEvents.filter((e) => e.kind === "acknowledge-cross-tenant");
+    expect(matches).toEqual([
+      {
+        handler: "ctwrite:write:thing:update",
+        kind: "acknowledge-cross-tenant",
+        reason: ESCAPE_HATCH_REASON,
+        tenantId: TestUsers.systemAdmin.tenantId,
+        actor: TestUsers.systemAdmin.id,
+      },
+    ]);
+  });
+
+  test("escapeHatch list: SystemAdmin sees rows from every tenant, reported as acknowledge-cross-tenant", async () => {
+    escapeHatchAuditEvents.length = 0;
+    await noneStack.http.writeOk(
+      "ctwrite:write:thing:create",
+      { label: "own-tenant-row" },
+      TestUsers.admin,
+    );
+    await noneStack.http.writeOk(
+      "ctwrite:write:thing:create",
+      { label: "other-tenant-row" },
+      TestUsers.otherTenant,
+    );
+
+    const list = await escapeHatchStack.http.queryOk<{
+      rows: ReadonlyArray<{ tenantId: string }>;
+    }>("ctwrite:query:thing:list", {}, TestUsers.systemAdmin);
+    const tenantIds = new Set(list.rows.map((r) => r.tenantId));
+    expect(tenantIds.has(testTenantId(1))).toBe(true);
+    expect(tenantIds.has(testTenantId(2))).toBe(true);
+
+    const matches = escapeHatchAuditEvents.filter((e) => e.kind === "acknowledge-cross-tenant");
+    expect(matches).toEqual([
+      {
+        handler: "ctwrite:query:thing:list",
+        kind: "acknowledge-cross-tenant",
+        reason: ESCAPE_HATCH_REASON,
+        tenantId: TestUsers.systemAdmin.tenantId,
+        actor: TestUsers.systemAdmin.id,
+      },
+    ]);
+  });
+
+  test("none: list returns only the caller's own tenant rows", async () => {
+    const created = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "none-mode-own-tenant" },
+      TestUsers.admin,
+    );
+
+    const list = await noneStack.http.queryOk<{
+      rows: ReadonlyArray<{ id: string; tenantId: string }>;
+    }>("ctwrite:query:thing:list", {}, TestUsers.systemAdmin);
+    expect(list.rows.some((r) => r.id === created.id)).toBe(true);
+    expect(list.rows.every((r) => r.tenantId === testTenantId(1))).toBe(true);
+  });
+
   test("normal (non-crossTenant) handler cannot reach a row in another tenant", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+    const created = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
       { label: "foreign-untouched" },
       TestUsers.otherTenant,
     );
 
-    const err = await tenantScopedStack.http.writeErr(
+    const err = await noneStack.http.writeErr(
       "ctwrite:write:thing:update",
       { id: created.id, version: 1, changes: { label: "nope" } },
       TestUsers.systemAdmin,
     );
     expect(err.code).toBe("not_found");
 
-    const rows = await selectMany(tenantScopedStack.db, thingTable, { id: created.id });
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
     expect(rows[0]?.["label"]).toBe("foreign-untouched");
   });
 
-  test("crossTenant still gates on access — a role without SystemAdmin is denied", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+  test("crossTenant/escapeHatch still gate on access — a role without SystemAdmin is denied", async () => {
+    const createdLegacy = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
-      { label: "foreign-denied" },
+      { label: "foreign-denied-legacy" },
       TestUsers.otherTenant,
     );
+    const errLegacy = await legacyStack.http.writeErr(
+      "ctwrite:write:thing:update",
+      { id: createdLegacy.id, version: 1, changes: { label: "nope" } },
+      TestUsers.admin,
+    );
+    expect(errLegacy.code).toBe("access_denied");
 
-    const err = await crossTenantStack.http.writeErr(
+    const createdEscapeHatch = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "foreign-denied-escape-hatch" },
+      TestUsers.otherTenant,
+    );
+    const errEscapeHatch = await escapeHatchStack.http.writeErr(
       "ctwrite:write:thing:update",
-      { id: created.id, version: 1, changes: { label: "nope" } },
+      { id: createdEscapeHatch.id, version: 1, changes: { label: "nope" } },
       TestUsers.admin,
     );
-    expect(err.code).toBe("access_denied");
+    expect(errEscapeHatch.code).toBe("access_denied");
+  });
+
+  test("legacy stack warns once per deprecated crossTenant handler at boot; the escapeHatch stack does not", () => {
+    const legacyMatches = legacyWarnCalls.filter((c) => c.msg === DEPRECATED_CROSS_TENANT_SIGNAL);
+    const legacyHandlers = legacyMatches.map((c) => c.data?.["handler"]).sort();
+    expect(legacyHandlers).toEqual(["ctwrite:query:thing:list", "ctwrite:write:thing:update"]);
+
+    const escapeHatchMatches = escapeHatchWarnCalls.filter(
+      (c) => c.msg === DEPRECATED_CROSS_TENANT_SIGNAL,
+    );
+    expect(escapeHatchMatches).toEqual([]);
   });
 });

package/src/engine/__tests__/extends-registrar.test.ts

@@ -142,7 +142,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "c1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "credit");
     });
@@ -181,7 +181,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.writeHandler(
         "vehicle:update",
@@ -190,7 +190,7 @@ describe("extendsRegistrar", () => {
           isSuccess: true as const,
           data: { id: "v1" },
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.useExtension("audited", "vehicle");
     });

package/src/engine/__tests__/feature-crud-shorthand.test.ts

@@ -11,7 +11,9 @@ const taskEntity = createEntity({
 describe("r.crud", () => {
   test("registers the entity + full CRUD handler set, same as registerEntityCrud", () => {
     const write = { access: { roles: ["Admin"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -28,7 +30,9 @@ describe("r.crud", () => {
 
   test("without verbAccess, write handlers keep write.access (never fall back to the broader read.access)", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
 
     const feature = defineFeature("via-crud-no-verb-access", (r) => {
       r.crud("task", taskEntity, { write, read });
@@ -44,7 +48,9 @@ describe("r.crud", () => {
 
   test("verbAccess overrides access per verb, other verbs keep write/read.access", () => {
     const write = { access: { roles: ["Manager"] } } as const;
-    const read = { access: { openToAll: true } } as const;
+    const read = {
+      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+    } as const;
     const deleteAccess = { roles: ["Operator"] } as const;
     const restoreAccess = { roles: ["Operator"] } as const;
     const listAccess = { roles: ["Auditor"] } as const;

package/src/engine/__tests__/feature-crud-verb-access.integration.test.ts

@@ -13,7 +13,7 @@ const propertyEntity = createEntity({
 const propertyFeature = defineFeature("crud-verb-access", (r) => {
   r.crud("property", propertyEntity, {
     write: { access: { roles: ["User"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
     verbAccess: {
       delete: { roles: ["Admin"] },
       restore: { roles: ["Admin"] },

package/src/engine/__tests__/hook-phases.test.ts

@@ -27,7 +27,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave);
     });
@@ -41,7 +41,7 @@ describe("HookPhases defaults", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", noopSave, { phase: HookPhases.inTransaction });
     });
@@ -60,7 +60,7 @@ describe("HookPhases defaults", () => {
           isSuccess: true,
           data: null,
         }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.hook("preDelete", "thing:delete", async () => undefined);
     });
@@ -95,7 +95,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.hook("postSave", "thing:create", inTxFn, { phase: HookPhases.inTransaction });
       r.hook("postSave", "thing:create", afterFn); // default afterCommit
@@ -127,7 +127,7 @@ describe("Registry phase filtering", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
       r.writeHandler("thing:create", z.object({}), async () => ({ isSuccess: true, data: null }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
     });
 

package/src/engine/__tests__/lifecycle-hooks.test.ts

@@ -69,7 +69,9 @@ describe("lifecycle hooks in registry", () => {
   test("merges preSave hooks within same feature", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("preSave", "user", async (changes) => changes);
       r.hook("preSave", "user", async (changes) => changes);
     });
@@ -81,12 +83,16 @@ describe("lifecycle hooks in registry", () => {
   test("cross-feature hooks use full prefixed name", () => {
     const f1 = defineFeature("a", (r) => {
       r.entity("user", createEntity({ table: "Users", fields: {} }));
-      r.writeHandler("user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "user", async () => {});
     });
     // Feature b hooks into a.user by using the full prefixed name
     const f2 = defineFeature("b", (r) => {
-      r.writeHandler("a.user", z.object({}), stubHandler, { access: { openToAll: true } });
+      r.writeHandler("a.user", z.object({}), stubHandler, {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postSave", "a.user", async () => {});
       r.hook("postSave", "a.user", async () => {});
     });

package/src/engine/__tests__/multiselect-filter.integration.test.ts

@@ -28,7 +28,7 @@ const LIST_QN = "checklist:query:equipment:list";
 const checklistFeature = defineFeature("checklist", (r) => {
   r.crud("equipment", equipmentEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
 });
 

package/src/engine/__tests__/post-query-hook.test.ts

@@ -24,7 +24,9 @@ describe("postQuery hook registration", () => {
   test("r.hook('postQuery', handlerQn, fn) lands in handler-keyed lifecycleHooks map", () => {
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", noop);
     });
 
@@ -70,7 +72,9 @@ describe("Registry getters", () => {
 
     const feature = defineFeature("test", (r) => {
       r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.queryHandler("thing:list", z.object({}), async () => [], { access: { openToAll: true } });
+      r.queryHandler("thing:list", z.object({}), async () => [], {
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
+      });
       r.hook("postQuery", "thing:list", fn);
     });
 

package/src/engine/__tests__/projection-detail-actions.test.ts

@@ -42,13 +42,13 @@ describe("validateBoot — projectionDetail actions (fw#2166)", () => {
   test("valid navigate + writeHandler actions boot cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.writeHandler(
         "archive",
         z.object({ id: z.string() }),
         async () => ({ isSuccess: true as const, data: {} }),
-        { access: { openToAll: true } },
+        { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
       );
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-detail-singleton.test.ts

@@ -21,7 +21,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton + idParam throws", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -46,7 +46,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
         }),
       );
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",
@@ -71,7 +71,7 @@ describe("validateBoot — projectionDetail singleton (fw#2312)", () => {
   test("singleton without idParam/detailFor boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("me", z.object({}), async () => ({ id: "u1" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "profile",

package/src/engine/__tests__/projection-detail-tabs.test.ts

@@ -140,7 +140,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("object-form metric with its own label needs no fieldLabels entry", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -192,7 +192,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("metric navigate.tab with no screen/entity — a known section id boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",
@@ -214,7 +214,7 @@ describe("validateBoot — projectionDetail tabs (fw record-layout)", () => {
   test("valid tabs + header + metrics declaration boots cleanly", () => {
     const feature = defineFeature("app", (r) => {
       r.queryHandler("rent:detail", z.object({}), async () => ({ description: "x" }), {
-        access: { openToAll: true },
+        access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
       });
       r.screen({
         id: "rent-detail",

package/src/engine/__tests__/projection-list-filter.integration.test.ts

@@ -37,7 +37,7 @@ const LIST_QN = "roster:query:member:list";
 const rosterFeature = defineFeature("roster", (r) => {
   r.crud("member", memberEntity, {
     write: { access: { roles: ["Admin"] } },
-    read: { access: { openToAll: true } },
+    read: { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   });
   r.screen({
     id: "member-list",