@cosmicdrift/kumiko-framework 0.270.0 → 0.274.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.270.0",
+  "version": "0.274.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.270.0",
+    "@cosmicdrift/kumiko-types": "0.274.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.270.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.274.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/fixtures/migrate-cross-tenant/manual-only.expected.ts

@@ -0,0 +1,44 @@
+import {
+  defineEntityCreateHandler,
+  defineEntityListHandler,
+  defineEntityRestoreHandler,
+  registerEntityCrud,
+} from "../../../engine/entity-handlers";
+import { legacyReportEntity } from "./legacy-report.entity";
+import { widgetEntity } from "./widget.entity";
+
+const access = { roles: ["SystemAdmin"] };
+const someFlag = process.env.WIDGET_CROSS_TENANT === "true";
+
+const sysadminAccess = { access, crossTenant: true };
+
+export function registerWidget(r) {
+  r.writeHandler(defineEntityCreateHandler("widget", widgetEntity, { ...sysadminAccess }));
+
+  registerEntityCrud(r, "widget", widgetEntity, {
+    write: { access, crossTenant: true },
+    read: { access },
+  });
+
+  r.writeHandler(
+    defineEntityRestoreHandler("widget", widgetEntity, {
+      access,
+      crossTenant: true,
+      escapeHatch: { reason: "legacy grant, needs review" },
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityListHandler("legacy-report", legacyReportEntity, {
+      access,
+      crossTenant: someFlag,
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityListHandler("widget-summary", widgetEntity, {
+      access,
+      crossTenant: false,
+    }),
+  );
+}

package/src/__tests__/fixtures/migrate-cross-tenant/manual-only.input.ts

@@ -0,0 +1,44 @@
+import {
+  defineEntityCreateHandler,
+  defineEntityListHandler,
+  defineEntityRestoreHandler,
+  registerEntityCrud,
+} from "../../../engine/entity-handlers";
+import { legacyReportEntity } from "./legacy-report.entity";
+import { widgetEntity } from "./widget.entity";
+
+const access = { roles: ["SystemAdmin"] };
+const someFlag = process.env.WIDGET_CROSS_TENANT === "true";
+
+const sysadminAccess = { access, crossTenant: true };
+
+export function registerWidget(r) {
+  r.writeHandler(defineEntityCreateHandler("widget", widgetEntity, { ...sysadminAccess }));
+
+  registerEntityCrud(r, "widget", widgetEntity, {
+    write: { access, crossTenant: true },
+    read: { access },
+  });
+
+  r.writeHandler(
+    defineEntityRestoreHandler("widget", widgetEntity, {
+      access,
+      crossTenant: true,
+      escapeHatch: { reason: "legacy grant, needs review" },
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityListHandler("legacy-report", legacyReportEntity, {
+      access,
+      crossTenant: someFlag,
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityListHandler("widget-summary", widgetEntity, {
+      access,
+      crossTenant: false,
+    }),
+  );
+}

package/src/__tests__/fixtures/migrate-cross-tenant/rewrite.expected.ts

@@ -0,0 +1,41 @@
+import {
+  defineEntityDetailHandler,
+  defineEntityListHandler,
+  defineEntityUpdateHandler,
+  defineEntityWriteHandler,
+} from "../../../engine/entity-handlers";
+import { exportJobEntity } from "./export-job.entity";
+import { noteEntity } from "./note.entity";
+
+const access = { roles: ["SystemAdmin"] };
+
+export function registerExportJob(r) {
+  r.queryHandler(
+    defineEntityListHandler("export-job", exportJobEntity, {
+      access,
+      escapeHatch: { reason: "export-job:list reads export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" },
+      description: "Lists export jobs across every tenant for operator support",
+    }),
+  );
+
+  r.writeHandler(
+    defineEntityUpdateHandler("export-job", exportJobEntity, {
+      access,
+      escapeHatch: { reason: "export-job:update writes export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" },
+    }),
+  );
+
+  r.writeHandler(
+    defineEntityWriteHandler("note:delete", noteEntity, {
+      access,
+      escapeHatch: { reason: "note:delete writes note rows across every tenant (migrated from crossTenant: true; state the operator use case here)" },
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityDetailHandler("export-job", exportJobEntity, {
+      access,
+      escapeHatch: { reason: "export-job:detail reads export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" },
+    }),
+  );
+}

package/src/__tests__/fixtures/migrate-cross-tenant/rewrite.input.ts

@@ -0,0 +1,41 @@
+import {
+  defineEntityDetailHandler,
+  defineEntityListHandler,
+  defineEntityUpdateHandler,
+  defineEntityWriteHandler,
+} from "../../../engine/entity-handlers";
+import { exportJobEntity } from "./export-job.entity";
+import { noteEntity } from "./note.entity";
+
+const access = { roles: ["SystemAdmin"] };
+
+export function registerExportJob(r) {
+  r.queryHandler(
+    defineEntityListHandler("export-job", exportJobEntity, {
+      access,
+      crossTenant: true,
+      description: "Lists export jobs across every tenant for operator support",
+    }),
+  );
+
+  r.writeHandler(
+    defineEntityUpdateHandler("export-job", exportJobEntity, {
+      access,
+      crossTenant: true,
+    }),
+  );
+
+  r.writeHandler(
+    defineEntityWriteHandler("note:delete", noteEntity, {
+      access,
+      crossTenant: true,
+    }),
+  );
+
+  r.queryHandler(
+    defineEntityDetailHandler("export-job", exportJobEntity, {
+      access,
+      crossTenant: true,
+    }),
+  );
+}

package/src/__tests__/migrate-cross-tenant-codemod.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { migrateCrossTenantSource } from "../scripts/codemod/migrate-cross-tenant";
+
+const FIXTURES_DIR = join(import.meta.dir, "fixtures", "migrate-cross-tenant");
+const PLACEHOLDER_PREFIXES = ["todo:", "fixme:", "tbd:"];
+
+function readFixture(name: string): { input: string; expected: string } {
+  return {
+    input: readFileSync(join(FIXTURES_DIR, `${name}.input.ts`), "utf8"),
+    expected: readFileSync(join(FIXTURES_DIR, `${name}.expected.ts`), "utf8"),
+  };
+}
+
+describe("migrateCrossTenantSource", () => {
+  it("rewrites crossTenant: true to escapeHatch: { reason } for every recognized entity-handler call shape", () => {
+    const { input, expected } = readFixture("rewrite");
+    const result = migrateCrossTenantSource(input, "export-job.handlers.ts");
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(4);
+    expect(result.manual).toHaveLength(0);
+
+    const byLine = new Map(result.rewrites.map((r) => [r.line, r]));
+
+    expect(byLine.get(16)?.after).toBe(
+      'escapeHatch: { reason: "export-job:list reads export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" }',
+    );
+    expect(byLine.get(24)?.after).toBe(
+      'escapeHatch: { reason: "export-job:update writes export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" }',
+    );
+    expect(byLine.get(31)?.after).toBe(
+      'escapeHatch: { reason: "note:delete writes note rows across every tenant (migrated from crossTenant: true; state the operator use case here)" }',
+    );
+    expect(byLine.get(38)?.after).toBe(
+      'escapeHatch: { reason: "export-job:detail reads export-job rows across every tenant (migrated from crossTenant: true; state the operator use case here)" }',
+    );
+  });
+
+  it("derives handlerName from the call for both the verb-in-name and verb-in-arg factory shapes", () => {
+    const { input } = readFixture("rewrite");
+    const result = migrateCrossTenantSource(input, "export-job.handlers.ts");
+
+    for (const rewrite of result.rewrites) {
+      expect(rewrite.after).toMatch(/^escapeHatch: \{ reason: "/);
+    }
+    expect(result.rewrites.map((r) => r.line)).toEqual([16, 24, 31, 38]);
+  });
+
+  it("leaves a spread/shared access object, a registerEntityCrud write/read block, an already-declared escapeHatch, and a non-literal crossTenant for manual review", () => {
+    const { input, expected } = readFixture("manual-only");
+    const result = migrateCrossTenantSource(input, "widget.handlers.ts");
+
+    expect(result.output).toBe(expected);
+    expect(result.rewrites).toHaveLength(0);
+    expect(result.manual).toHaveLength(4);
+
+    const byLine = new Map(result.manual.map((m) => [m.line, m]));
+
+    expect(byLine.get(13)?.why).toBe(
+      "crossTenant is not set directly in a handler call (e.g. a spread/shared object) — give each consuming handler its own escapeHatch reason",
+    );
+    expect(byLine.get(13)?.handlerName).toBeUndefined();
+
+    expect(byLine.get(19)?.why).toBe(
+      'under registerEntityCrud("widget", ...) → write: multiple verbs share this crossTenant — set escapeHatch per verb manually, one reason each',
+    );
+
+    expect(byLine.get(26)?.why).toBe(
+      "this object already declares escapeHatch — merge the two manually and remove crossTenant",
+    );
+    expect(byLine.get(26)?.handlerName).toBe("widget");
+
+    expect(byLine.get(34)?.why).toBe(
+      "crossTenant is not a literal boolean (`someFlag`) — replace manually with escapeHatch: { reason }",
+    );
+    expect(byLine.get(34)?.handlerName).toBe("legacy-report");
+  });
+
+  it("ignores crossTenant: false — no rewrite, no manual entry, output unchanged", () => {
+    const { input } = readFixture("manual-only");
+    const result = migrateCrossTenantSource(input, "widget.handlers.ts");
+
+    expect(input).toContain("crossTenant: false");
+    expect(result.manual.some((m) => m.line === 41)).toBe(false);
+    expect(result.rewrites.some((r) => r.line === 41)).toBe(false);
+    expect(result.output).toContain("crossTenant: false");
+  });
+
+  it("never generates a placeholder reason and never leaves a rewritten reason empty", () => {
+    const { input } = readFixture("rewrite");
+    const result = migrateCrossTenantSource(input, "export-job.handlers.ts");
+
+    for (const rewrite of result.rewrites) {
+      const match = rewrite.after.match(/reason: "([^"]*)"/);
+      expect(match).not.toBeNull();
+      const reason = match?.[1] ?? "";
+      expect(reason.length).toBeGreaterThan(0);
+      const lower = reason.toLowerCase();
+      for (const prefix of PLACEHOLDER_PREFIXES) {
+        expect(lower.startsWith(prefix)).toBe(false);
+      }
+    }
+  });
+});

package/src/__tests__/related-list-parent-filter.integration.test.ts

@@ -0,0 +1,103 @@
+// A relatedList section with `parentFilter` sends the parent id as
+// `payload.filter: { field, op: "eq", value: parentId }` instead of a
+// bespoke top-level key (related-list-section.tsx) — proving it against the
+// generic `<entity>:list` query end-to-end means proving `filter` and
+// `search` combine correctly in the real executor, over real HTTP, exactly
+// as the renderer's own request would look.
+//
+// Bun.SQL-only setup via setupTestStack.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  createEntity,
+  createTextField,
+  defineEntityCreateHandler,
+  defineEntityListHandler,
+  defineFeature,
+} from "../engine";
+import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../stack";
+
+const itemEntity = createEntity({
+  table: "akte_items",
+  fields: {
+    name: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      searchable: true,
+    }),
+    orderId: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+
+const ordersFeature = defineFeature("akteorders", (r) => {
+  r.entity("item", itemEntity);
+  r.writeHandler(defineEntityCreateHandler("item", itemEntity, { access: { roles: ["Admin"] } }));
+  r.queryHandler(defineEntityListHandler("item", itemEntity, { access: { roles: ["Admin"] } }));
+});
+
+describe("relatedList parentFilter against the generic <entity>:list query", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({ features: [ordersFeature] });
+    await unsafeCreateEntityTable(stack.db, itemEntity);
+
+    await stack.http.writeOk(
+      "akteorders:write:item:create",
+      { name: "Alice Corp", orderId: "order-1" },
+      TestUsers.admin,
+    );
+    await stack.http.writeOk(
+      "akteorders:write:item:create",
+      { name: "Bob LLC", orderId: "order-1" },
+      TestUsers.admin,
+    );
+    await stack.http.writeOk(
+      "akteorders:write:item:create",
+      { name: "Alice Two", orderId: "order-2" },
+      TestUsers.admin,
+    );
+    // Search indexing is async — drain the event dispatcher before any
+    // query below relies on `search` finding these rows.
+    await stack.eventDispatcher?.runOnce();
+  });
+
+  afterAll(() => stack.cleanup());
+
+  test("filter: eq on the parent id returns only that parent's rows", async () => {
+    const res = await stack.http.query(
+      "akteorders:query:item:list",
+      { filter: { field: "orderId", op: "eq", value: "order-1" } },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: { rows: Array<Record<string, unknown>> } };
+    const names = body.data.rows.map((r) => r["name"]).sort();
+    expect(names).toEqual(["Alice Corp", "Bob LLC"]);
+  });
+
+  test("filter combined with search narrows within the parent's own rows only", async () => {
+    const res = await stack.http.query(
+      "akteorders:query:item:list",
+      { filter: { field: "orderId", op: "eq", value: "order-1" }, search: "alice" },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: { rows: Array<Record<string, unknown>> } };
+    // "Alice Two" matches the search term but belongs to order-2 — the
+    // parent filter must exclude it even though search alone would find it.
+    expect(body.data.rows.map((r) => r["name"])).toEqual(["Alice Corp"]);
+  });
+
+  test("search alone (no filter) would find both Alice rows across parents — proves the filter is what narrows them", async () => {
+    const res = await stack.http.query(
+      "akteorders:query:item:list",
+      { search: "alice" },
+      TestUsers.admin,
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: { rows: Array<Record<string, unknown>> } };
+    expect(body.data.rows.map((r) => r["name"]).sort()).toEqual(["Alice Corp", "Alice Two"]);
+  });
+});

package/src/api/__tests__/nested-write-ownership.integration.test.ts

@@ -0,0 +1,268 @@
+// fw#2861 — nested-write parent-row ownership check. A custom (non-executor)
+// `:create` handler can hand back an EXISTING row instead of inserting a
+// fresh one (find-or-create, or a bug) — the framework must refuse to attach
+// nested children to a parent row the caller does not own, both across
+// tenants (role-only entity, no ownership field) and within a tenant (an
+// ownership-bound field pointing at a different owner). Modelled on
+// nested-write.integration.test.ts's project/task fixture. Real HTTP via
+// setupTestStack + stack.http.write — never createTestDispatcher.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { createEventStoreExecutor } from "../../db/event-store-executor";
+import { executeRawQuery } from "../../db/queries/raw-sql";
+import { asRawClient, selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import { createEntity, createTextField, defineFeature, from } from "../../engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "../../stack";
+
+// project2/task2: same-tenant ownership scenario (b/c). ownerId is an
+// ownership-bound field — checkWriteFieldOwnership evaluates it.
+const project2Entity = createEntity({
+  table: "nested_own_projects2",
+  fields: {
+    name: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    ownerId: createTextField({
+      personal: false,
+      reason: "test_fixture",
+      required: true,
+      access: { write: { User: from("user:id", "ownerId") } },
+    }),
+  },
+});
+const project2Table = buildEntityTable("project2", project2Entity);
+
+const task2Entity = createEntity({
+  table: "nested_own_tasks2",
+  fields: {
+    projectId: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    title: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+const task2Table = buildEntityTable("task2", task2Entity);
+
+// project3/task3: cross-tenant scenario (a). Role-only entity, no ownership
+// field — checkWriteFieldOwnership is a no-op here; only the tenant check
+// can catch it.
+const project3Entity = createEntity({
+  table: "nested_own_projects3",
+  fields: {
+    name: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+const project3Table = buildEntityTable("project3", project3Entity);
+
+const task3Entity = createEntity({
+  table: "nested_own_tasks3",
+  fields: {
+    projectId: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    title: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+const task3Table = buildEntityTable("task3", task3Entity);
+
+const nestedOwnershipFeature = defineFeature("nested-own", (r) => {
+  r.entity("project2", project2Entity);
+  r.entity("task2", task2Entity);
+  r.relation("project2", "tasks", {
+    type: "hasMany",
+    target: "task2",
+    foreignKey: "projectId",
+    nestedWrite: true,
+  });
+
+  r.entity("project3", project3Entity);
+  r.entity("task3", task3Entity);
+  r.relation("project3", "tasks", {
+    type: "hasMany",
+    target: "task3",
+    foreignKey: "projectId",
+    nestedWrite: true,
+  });
+
+  // Custom (non-executor-entry) find-or-create: same-tenant only (tenant-
+  // scoped fetchOne), simulating a handler that doesn't strictly insert a
+  // fresh row every time — only the "found" branch skips the executor.
+  // No escapeHatch needed — the lookup stays within the caller's own tenant.
+  r.writeHandler(
+    "project2:create",
+    z.object({ name: z.string().min(1), ownerId: z.string().uuid().optional() }),
+    async (event, ctx) => {
+      const existing = await ctx.db.fetchOne(project2Table, { name: event.payload.name });
+      if (existing) return { isSuccess: true as const, data: existing };
+      const crud = createEventStoreExecutor(project2Table, project2Entity, {
+        entityName: "project2",
+      });
+      return crud.create(
+        { name: event.payload.name, ownerId: event.payload.ownerId ?? event.user.id },
+        event.user,
+        ctx.db,
+      );
+    },
+    { access: { roles: ["Admin", "User"] } },
+  );
+
+  r.writeHandler(
+    "task2:create",
+    z.object({ projectId: z.string().uuid(), title: z.string().min(1) }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(task2Table, task2Entity, { entityName: "task2" });
+      return crud.create(event.payload, event.user, ctx.db);
+    },
+    { access: { roles: ["Admin", "User"] } },
+  );
+
+  // Custom find-or-create for the cross-tenant scenario: an unfiltered raw
+  // lookup by name (declared escapeHatch) simulates a handler bug that finds
+  // a same-named row belonging to a DIFFERENT tenant and hands it back
+  // instead of inserting a fresh, tenant-scoped row.
+  r.writeHandler(
+    "project3:create",
+    z.object({ name: z.string().min(1) }),
+    async (event, ctx) => {
+      const runner = ctx.db.unsafeRaw(
+        "fw#2861 test fixture — simulate cross-tenant find-or-create bug",
+      );
+      const rows = await executeRawQuery<{
+        id: string;
+        name: string;
+        tenant_id: string;
+      }>(
+        runner,
+        `SELECT id, name, tenant_id FROM "${project3Table.tableName}" WHERE name = $1 LIMIT 1`,
+        [event.payload.name],
+      );
+      const existing = rows[0];
+      if (existing) {
+        return {
+          isSuccess: true as const,
+          data: { id: existing.id, name: existing.name, tenantId: existing.tenant_id },
+        };
+      }
+      const crud = createEventStoreExecutor(project3Table, project3Entity, {
+        entityName: "project3",
+      });
+      return crud.create({ name: event.payload.name }, event.user, ctx.db);
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "fw#2861 test fixture — simulate cross-tenant find-or-create bug" },
+    },
+  );
+
+  r.writeHandler(
+    "task3:create",
+    z.object({ projectId: z.string().uuid(), title: z.string().min(1) }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(task3Table, task3Entity, { entityName: "task3" });
+      return crud.create(event.payload, event.user, ctx.db);
+    },
+    { access: { roles: ["Admin", "User"] } },
+  );
+});
+
+let stack: TestStack;
+const TENANT_A = testTenantId(9101);
+const TENANT_B = testTenantId(9102);
+const ownerUser = createTestUser({ id: 9111, tenantId: TENANT_A, roles: ["User"] });
+const attackerUser = createTestUser({ id: 9112, tenantId: TENANT_A, roles: ["User"] });
+const tenantAOtherUser = createTestUser({ id: 9114, tenantId: TENANT_A, roles: ["User"] });
+const tenantBUser = createTestUser({ id: 9113, tenantId: TENANT_B, roles: ["User"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [nestedOwnershipFeature] });
+  await unsafeCreateEntityTable(stack.db, project2Entity, "project2");
+  await unsafeCreateEntityTable(stack.db, task2Entity, "task2");
+  await unsafeCreateEntityTable(stack.db, project3Entity, "project3");
+  await unsafeCreateEntityTable(stack.db, task3Entity, "task3");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${task2Table.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${task3Table.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${project2Table.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${project3Table.tableName}"`);
+});
+
+describe("nested-write parent-row ownership check (fw#2861)", () => {
+  test("(a) cross-tenant: existing role-only parent row in tenant B, tenant-A caller -> access_denied, zero task rows", async () => {
+    // Seed the foreign row in tenant B.
+    const seedRes = await stack.http.write(
+      "nested-own:write:project3:create",
+      { name: "cross-tenant" },
+      tenantBUser,
+    );
+    expect(seedRes.status).toBe(200);
+
+    const res = await stack.http.write(
+      "nested-own:write:project3:create",
+      { name: "cross-tenant", tasks: [{ title: "t1" }] },
+      tenantAOtherUser,
+    );
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(res.status).toBeLessThan(500);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.error.code).toBe("access_denied");
+
+    const dbTasks = await selectMany(stack.db, task3Table);
+    expect(dbTasks).toHaveLength(0);
+  });
+
+  test("(b) same tenant, ownership-bound field, row owned by a different user -> access_denied, zero task rows", async () => {
+    const seedRes = await stack.http.write(
+      "nested-own:write:project2:create",
+      { name: "owned-by-other" },
+      ownerUser,
+    );
+    expect(seedRes.status).toBe(200);
+
+    const res = await stack.http.write(
+      "nested-own:write:project2:create",
+      { name: "owned-by-other", tasks: [{ title: "t1" }] },
+      attackerUser,
+    );
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(res.status).toBeLessThan(500);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.error.code).toBe("access_denied");
+
+    const dbTasks = await selectMany(stack.db, task2Table);
+    expect(dbTasks).toHaveLength(0);
+  });
+
+  test("(c) caller owns the existing same-tenant row -> children attach (regression)", async () => {
+    const seedRes = await stack.http.write(
+      "nested-own:write:project2:create",
+      { name: "owned-by-self" },
+      ownerUser,
+    );
+    expect(seedRes.status).toBe(200);
+
+    const res = await stack.http.write(
+      "nested-own:write:project2:create",
+      { name: "owned-by-self", tasks: [{ title: "t1" }] },
+      ownerUser,
+    );
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+
+    const dbTasks = await selectMany(stack.db, task2Table);
+    expect(dbTasks).toHaveLength(1);
+  });
+});