@cosmicdrift/kumiko-framework 0.87.1 → 0.87.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.87.1",
+  "version": "0.87.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.87.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.87.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/engine/cross-tenant.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import { AccessDeniedError } from "../errors";
+import { crossTenantOverrideDenied } from "./cross-tenant";
+import type { SessionUser } from "./types";
+
+const KEY = "feature.errors.tenantOverrideRequiresSystemAdmin";
+
+function user(roles: string[]): SessionUser {
+  return { id: "u", tenantId: "t1" as SessionUser["tenantId"], roles };
+}
+
+describe("crossTenantOverrideDenied", () => {
+  test("allows when no override is requested", () => {
+    expect(crossTenantOverrideDenied(user(["TenantAdmin"]), undefined, KEY)).toBeUndefined();
+  });
+
+  test("allows a SystemAdmin to target another tenant", () => {
+    expect(crossTenantOverrideDenied(user(["SystemAdmin"]), "other-tenant", KEY)).toBeUndefined();
+  });
+
+  test("denies a TenantAdmin targeting another tenant", () => {
+    const denied = crossTenantOverrideDenied(user(["TenantAdmin"]), "other-tenant", KEY);
+    expect(denied).toBeInstanceOf(AccessDeniedError);
+    expect(denied?.code).toBe("access_denied");
+  });
+
+  test("denies an Admin too — only SystemAdmin clears the override", () => {
+    expect(crossTenantOverrideDenied(user(["Admin", "TenantAdmin"]), "other", KEY)).toBeInstanceOf(
+      AccessDeniedError,
+    );
+  });
+});

package/src/engine/cross-tenant.ts

@@ -0,0 +1,22 @@
+import { AccessDeniedError } from "../errors";
+import type { SessionUser } from "./types";
+
+// A payload-supplied target tenant (tenantIdOverride) on a TenantAdmin-reachable
+// handler is the cross-tenant escape hatch: hasAccess passes the handler for any
+// TenantAdmin, so without a SystemAdmin gate a TenantAdmin could act on another
+// tenant. Centralizes the check the override handlers used to inline. Returns
+// the denial to `throw` (queries) or wrap in `writeFailure` (writes), or
+// undefined when allowed. The i18nKey stays per-feature so existing
+// translations keep resolving.
+export function crossTenantOverrideDenied(
+  user: SessionUser,
+  tenantIdOverride: string | undefined,
+  i18nKey: string,
+): AccessDeniedError | undefined {
+  if (tenantIdOverride === undefined) return undefined;
+  if (user.roles.includes("SystemAdmin")) return undefined;
+  return new AccessDeniedError({
+    i18nKey,
+    details: { reason: "tenant_override_requires_system_admin" },
+  });
+}

package/src/engine/index.ts

@@ -38,6 +38,7 @@ export {
 } from "./constants";
 export type { App, AppConfig } from "./create-app";
 export { createApp } from "./create-app";
+export { crossTenantOverrideDenied } from "./cross-tenant";
 export { defineFeature } from "./define-feature";
 export type {
   QueryHandlerDefinition,