@cosmicdrift/kumiko-framework 0.395.0 → 0.396.0

package/agents/examples/ownership.md

@@ -203,14 +203,14 @@ describe("entity-level write: create/update/delete blocked on foreign rows", ()
   });
 
   test("TeamMember eng CANNOT update the ops row (not visible → not modifiable)", async () => {
-    // The row exists but entity-level ownership rejects the update.
-    // version is guessed — doesn't matter, the ownership check fires first.
+    // The row exists, but a row the caller cannot read answers like a missing
+    // one, so the write does not reveal it. The guessed version never matters.
     const err = await stack.http.writeErr(
       "contracts:write:contract:update",
       { id: opsRowId, version: 1, changes: { propA: "hack" } },
       teamMemberEng,
     );
-    expectErrorIncludes(err, "ownership_denied");
+    expectErrorIncludes(err, "not_found");
   });
 
   test("TeamMember eng CANNOT move their row to another team (teamId rewrite blocked)", async () => {

package/dist/db/event-store-executor-context.d.ts

@@ -1,3 +1,4 @@
+import type { ParentVisibilityOption } from "@cosmicdrift/kumiko-types/event-store-executor-types";
 import type { EntityDefinition } from "@cosmicdrift/kumiko-types/fields";
 import type { EntityId } from "@cosmicdrift/kumiko-types/identifiers";
 import type { ErasedSubjectHandling } from "../crypto/pii-field-encryption.ts";
@@ -44,6 +45,7 @@ export type ExecutorContext = {
         readonly owned: boolean;
         readonly streamVersion: number;
     }>;
+    readonly isRowReadable: (id: EntityId, user: SessionUser, db: TenantDb, parentVisibility: ParentVisibilityOption | undefined) => Promise<boolean>;
     readonly loadDetailSnapshot: (db: TenantDb, idWhere: WhereObject, ownership: {
         kind: "pass";
     } | {

package/dist/db/event-store-executor-context.js

@@ -10,6 +10,7 @@ import { isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
 import { collectEncryptedFieldNames, decryptEntityFieldValues, encryptEntityFieldValues, logUndecryptableField, resolveEntityFieldEncryption, } from "./entity-field-encryption.js";
+import { resolveReadOwnership } from "./event-store-executor-read-where.js";
 import { constraintOf, isUniqueViolation } from "./pg-error.js";
 import { toSnakeCase } from "./table-builder.js";
 import { columnHandleName, schemaTableName } from "./table-introspection.js";
@@ -355,6 +356,21 @@ export function buildExecutorContext(table, entity, options) {
         const version = first["__streamVersion"];
         return { owned: true, streamVersion: typeof version === "number" ? version : 0 };
     }
+    // Same read predicate detail applies (access.read plus the parent-ref gate), evaluated
+    // for one row. The row's own isDeleted is not filtered because restore targets a
+    // soft-deleted row; includeDeleted below only concerns the parent host. Writers use it
+    // to treat an unreadable row as nonexistent.
+    async function isRowReadable(id, user, db, parentVisibility) {
+        const ownership = resolveReadOwnership({ entity, table }, String(schemaTableName(table)), user, db, parentVisibility, { includeDeleted: false, narrowTypes: undefined });
+        if (ownership.kind === "pass")
+            return true;
+        if (ownership.kind === "empty")
+            return false;
+        const tableName = String(schemaTableName(table));
+        const { whereParts, params } = buildRawIdWhere(db, { id }, ownership);
+        const rows = await executeRawQueryRead(tenantDbRunner(db), `SELECT 1 AS "__readable" FROM "${tableName}" WHERE ${whereParts.join(" AND ")} LIMIT 1`, params);
+        return rows.length > 0;
+    }
     // Row and MAX(version) in ONE statement: two reads can pair a post-write
     // version with a pre-write row, and update({version: detail.version}) would
     // then pass the optimistic lock and overwrite the newer write (lost update).
@@ -436,6 +452,7 @@ export function buildExecutorContext(table, entity, options) {
         loadById,
         assertStreamWritable,
         probeOwnershipWithStreamVersion,
+        isRowReadable,
         loadDetailSnapshot,
         loadExpectSnapshot,
         encryptForStorage,

package/dist/db/event-store-executor-write.js

@@ -24,8 +24,17 @@ import { tenantDbWriteRunner } from "./tenant-db-runner.js";
 // store-executor, split out of event-store-executor.ts. They read an explicit
 // ExecutorContext instead of capturing the factory's local scope directly.
 export function createWriteVerbs(ctx) {
-    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, ownerTransitionRekeys, applyDefaults, stripSensitive, loadById, assertStreamWritable, loadExpectSnapshot, } = ctx;
+    const { table, entity, entityName, entityCache, softDelete, streamTenantFor, streamTenantOverrideFailure, streamTenantCreateFailure, encryptForStorage, decryptForRead, ownerTransitionRekeys, applyDefaults, stripSensitive, loadById, assertStreamWritable, isRowReadable, loadExpectSnapshot, } = ctx;
     const entityInstructionFieldNames = instructionFieldNames(entity);
+    // A row the caller cannot read is reported as missing, like detail does, so a write
+    // can neither change it nor echo its content back. Framework system writes skip the
+    // check as they do for forget: their role never appears in a per-role read map.
+    async function unreadableRowFailure(id, user, db, parentVisibility) {
+        if (isFrameworkSystemUser(user) || (await isRowReadable(id, user, db, parentVisibility))) {
+            return undefined;
+        }
+        return writeFailure(new NotFoundError(entityName, id));
+    }
     // update and delete funnel through here, so custom handlers and nested writes cannot
     // bypass the lock whatever they return. Setting the lock (unlocked row) passes.
     // Framework system writes that name a writePurpose (retention, erasure) are exempt:
@@ -487,6 +496,9 @@ export function createWriteVerbs(ctx) {
             });
             if (!previous)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, updateOptions?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = updateOptions?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, previous, streamTenantId);
             if (streamTenantMismatch)
@@ -561,6 +573,9 @@ export function createWriteVerbs(ctx) {
             const existing = await loadById(payload.id, db);
             if (!existing)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = options?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, existing, streamTenantId);
             if (streamTenantMismatch)
@@ -645,6 +660,9 @@ export function createWriteVerbs(ctx) {
             const raw = await db.fetchOne(table, { id: payload.id });
             if (!raw)
                 return writeFailure(new NotFoundError(entityName, payload.id));
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const streamTenantId = options?.streamTenantId;
             const streamTenantMismatch = streamTenantOverrideFailure(db, raw, streamTenantId);
             if (streamTenantMismatch)
@@ -716,6 +734,11 @@ export function createWriteVerbs(ctx) {
             }
             const runner = tenantDbWriteRunner(db, "ctx.db executor restore");
             const streamTenantId = options?.streamTenantId;
+            // Before loadSoftDeletedRow: its not_deleted answer would confirm that an unreadable
+            // live row exists.
+            const unreadable = await unreadableRowFailure(payload.id, user, db, options?.parentVisibility);
+            if (unreadable)
+                return unreadable;
             const target = await loadSoftDeletedRow(db, payload.id, streamTenantId);
             if ("failure" in target)
                 return target.failure;

package/dist/engine/entity-handlers.js

@@ -289,6 +289,7 @@ export function defineEntityWriteHandler(name, entity, options) {
                 // they rely on to intentionally force a fresh event/ciphertext.
                 return executor.update(payload, event.user, db, {
                     streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
                     skipUnchanged: true,
                     preSave: runPreSave &&
                         ((changes, previous, isNew) => runPreSave(event.type, changes, previous, isNew)),
@@ -301,7 +302,10 @@ export function defineEntityWriteHandler(name, entity, options) {
                 const db = dbFor(ctx);
                 const payload = event.payload; // @cast-boundary engine-payload
                 const streamTenantId = await foreignRowTenantFor(event.user, payload.id, db, ctx);
-                return executor.delete(payload, event.user, db, { streamTenantId });
+                return executor.delete(payload, event.user, db, {
+                    streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
+                });
             };
             break;
         case "restore":
@@ -310,7 +314,10 @@ export function defineEntityWriteHandler(name, entity, options) {
                 const db = dbFor(ctx);
                 const payload = event.payload; // @cast-boundary engine-payload
                 const streamTenantId = await foreignRowTenantFor(event.user, payload.id, db, ctx);
-                return executor.restore(payload, event.user, db, { streamTenantId });
+                return executor.restore(payload, event.user, db, {
+                    streamTenantId,
+                    parentVisibility: { entities: ctx.registry.getAllEntities() },
+                });
             };
             break;
         default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.395.0",
+  "version": "0.396.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -203,7 +203,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.395.0",
+    "@cosmicdrift/kumiko-types": "0.396.0",
     "bullmq": "^5.76.7",
     "hono": "^4.13.1",
     "i18next": "^26.1.0",
@@ -225,7 +225,7 @@
     }
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.395.0",
+    "@cosmicdrift/kumiko-testing": "0.396.0",
     "bun-types": "^1.4.4",
     "fflate": "^0.8.2",
     "meilisearch": "^0.58.0",

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.396.0",
+    "type": "breaking",
+    "title": "Entity writes on a row the caller cannot read fail with not_found",
+    "detail": "update, delete, restore and forget only checked access.write, so on an entity with an owner access.read rule and no access.write any tenant member with handler access could change or delete another member's row, and delete returned the decrypted row. They now apply the same access.read rule and parentRef host-visibility gate as detail and answer not_found, so the row's existence stays hidden. Framework system writes are exempt. A write the caller could not read but that failed the write rule before now reports not_found instead of ownership_denied.",
+    "migration": "Writes on rows the caller cannot read now fail with not_found; give such writers read access or run them as system. Custom handlers that call the executor directly get the parentRef gate by passing parentVisibility: { entities: ctx.registry.getAllEntities() }, as the generated handlers do."
+  },
   {
     "version": "0.395.0",
     "type": "fix",