@cosmicdrift/kumiko-framework 0.56.1 → 0.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.56.1",
+  "version": "0.57.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -2,6 +2,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { asRawClient } from "../../db/query";
 import { createBooleanField, createEntity, createTextField } from "../../engine";
 import { append, createEventsTable } from "../../event-store";
+import type { EntityCache } from "../../pipeline/entity-cache";
 import {
   createTestDb,
   type TestDb,
@@ -285,3 +286,48 @@ describe("event-store-executor — detail liefert die Stream-Version", () => {
     expect(updated.isSuccess).toBe(true);
   });
 });
+
+describe("event-store-executor — entity cache read-through", () => {
+  // In-memory stand-in for EntityCache — no Redis needed.
+  const store = new Map<string, Record<string, unknown>>();
+  const entityCache: EntityCache = {
+    get: async (tenantId, name, id) => store.get(`${tenantId}:${name}:${id}`) ?? null,
+    mget: async () => new Map(),
+    set: async (tenantId, name, id, data) => {
+      store.set(`${tenantId}:${name}:${id}`, data);
+    },
+    mset: async (tenantId, name, entries) => {
+      for (const { id, data } of entries) store.set(`${tenantId}:${name}:${id}`, data);
+    },
+    del: async (tenantId, name, id) => {
+      store.delete(`${tenantId}:${name}:${id}`);
+    },
+  };
+  const cachedCrud = createEventStoreExecutor(table, entity, {
+    entityName: "esExecUser",
+    entityCache,
+  });
+
+  beforeEach(() => store.clear());
+
+  test("first detail populates cache; second detail is served from cache", async () => {
+    const created = await cachedCrud.create({ email: "cache@test.de" }, adminUser, tdb);
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = created.data.id;
+    const storeKey = `${adminUser.tenantId}:esExecUser:${id}`;
+
+    // create() calls del() — cache must be empty after create.
+    expect(store.has(storeKey)).toBe(false);
+
+    // First detail: miss → DB → populates cache.
+    const first = await cachedCrud.detail({ id }, adminUser, tdb);
+    expect(first).not.toBeNull();
+    expect(store.has(storeKey)).toBe(true);
+
+    // Poison the cache entry — proves the second detail reads from cache, not DB.
+    store.set(storeKey, { ...store.get(storeKey)!, email: "from-cache@test.de" });
+
+    const second = await cachedCrud.detail({ id }, adminUser, tdb);
+    expect(second?.["email"]).toBe("from-cache@test.de");
+  });
+});

package/src/engine/config-helpers.ts

@@ -1,4 +1,5 @@
 import type { ConfigScope } from "./constants";
+import { SYSTEM_ROLE } from "./system-user";
 import type {
   ConfigBacking,
   ConfigBounds,
@@ -27,6 +28,13 @@ export const access = {
   authenticated: ["User", "Admin", "SystemAdmin"] as readonly string[], // @cast-boundary schema-walk
   anonymous: ["anonymous"] as readonly string[], // @cast-boundary schema-walk
   roles: (...roles: string[]): readonly string[] => roles,
+  // Tenant self-service roles PLUS the system actor — for tenant-scope keys a
+  // tenant edits itself (configEdit) but that provisioning/migration/jobs must
+  // also set via ctx.systemWriteAs (roles = [SYSTEM_ROLE]). Stays human-writable
+  // because checkWriteAccess only collapses to system-only when system is the
+  // SOLE writer (humanWriters empty). Composes any preset, so apps with custom
+  // roles get the same provisioning path (issue #396).
+  withSystem: (roles: readonly string[]): readonly string[] => [SYSTEM_ROLE, ...roles],
 } as const;
 
 // --- Config Key Options ---