@cosmicdrift/kumiko-samples 0.387.0 → 0.389.0

package/packages/bundled-features/src/template-resolver/handlers/diff-to-system.query.ts

@@ -2,8 +2,9 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { buildOverrideDiff } from "./override-diff.ts";
 
@@ -21,7 +22,7 @@ export const diffToSystemQuery = defineQueryHandler({
       !tenantRow ||
       tenantRow.tenantId !== query.user.tenantId ||
       tenantRow.scope !== "tenant" ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, tenantRow)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, tenantRow))
     ) {
       throw new NotFoundError("template-resource", query.payload.id);
     }

package/packages/bundled-features/src/template-resolver/handlers/document-base.ts

@@ -5,8 +5,9 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import type { DocumentHtmlKind } from "../web/constants.ts";
@@ -50,7 +51,7 @@ export async function loadDocumentBase(
   const ownIsVisible =
     own !== undefined &&
     !isSystemOnlyTemplateHiddenFrom(user, ctx.registry, own) &&
-    isRowServedTo(deliveryPolicyOf(ctx.registry), user, own);
+    (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, own));
   if (own !== undefined && ownIsVisible) {
     const working = toWorkingRow(own, user.tenantId);
     return {

package/packages/bundled-features/src/template-resolver/handlers/find-by-id.query.ts

@@ -1,8 +1,9 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { draftViewerTenantId, isHiddenSystemDraft, toWorkingRow } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 
@@ -25,7 +26,7 @@ export const findByIdQuery = defineQueryHandler({
       !stored ||
       isHiddenSystemDraft(query.user, stored) ||
       isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, stored) ||
-      !isRowServedTo(deliveryPolicyOf(ctx.registry), query.user, stored)
+      !(await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), query.user, stored))
     ) {
       return null;
     }

package/packages/bundled-features/src/template-resolver/handlers/layout-source.query.ts

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { filterDeliveredTo } from "../api.ts";
 import { type LayoutRegions, readLayoutRegions } from "../layout-regions.ts";
@@ -14,6 +15,7 @@ import {
 } from "../template-draft.ts";
 import { type MailLayoutMeta, readMailLayoutMeta } from "../template-meta.ts";
 import { FALLBACK_LOCALE } from "../web/constants.ts";
+import { TemplateResolverErrors } from "../web/qualified-names.ts";
 import { localeSchema, templateSlugSchema } from "./shared.ts";
 import { parseStoredJson } from "./template-gates.ts";
 
@@ -66,20 +68,29 @@ function layoutFormat(row: WorkingRow): "html" | "mjml" | null {
   return row.contentFormat === "html" || row.contentFormat === "mjml" ? row.contentFormat : null;
 }
 
+type EditScope = "tenant" | "system";
+
 function pickEditedRows(
   rows: readonly TemplateResourceRow[],
-  user: { readonly tenantId: string; readonly roles: readonly string[] },
+  caller: { readonly tenantId: string; readonly roles: readonly string[] },
+  scope: EditScope,
   locale: string | undefined,
 ): {
   readonly tenantRow: WorkingRow | null;
   readonly systemRow: WorkingRow | null;
 } {
-  const tenantRow = user.roles.includes("SystemAdmin")
-    ? null
-    : pickByLocale(
-        rows.filter((row) => row.scope === "tenant"),
-        locale,
-      );
+  // A SystemAdmin editing the tenant layout sees the system version like a tenant does: served only, no draft.
+  const user =
+    scope === "system"
+      ? caller
+      : { ...caller, roles: caller.roles.filter((role) => role !== "SystemAdmin") };
+  const tenantRow =
+    scope === "system"
+      ? null
+      : pickByLocale(
+          rows.filter((row) => row.scope === "tenant"),
+          locale,
+        );
   const systemRow = pickByLocale(
     rows.filter((row) => row.scope === "system" && !isHiddenSystemDraft(user, row)),
     locale,
@@ -136,13 +147,21 @@ export const layoutSourceQuery = defineQueryHandler({
     kind: z.enum(["mail-layout", "pdf-layout"]),
     slug: templateSlugSchema.default("default"),
     locale: localeSchema.optional(),
+    scope: z.enum(["tenant", "system"]).optional(),
   }),
   access: { roles: ["TenantAdmin", "SystemAdmin"] },
   description:
-    "Reads the layout the caller edits: the tenant's own version and the system version of one layout slug (each the open draft if there is one, else the stored version, with `active` naming the served version), the header, signature and footer regions of the effective html version, and the locale a save has to use; a SystemAdmin edits the system version and also receives its mjml source. Use it to load the layout editor.",
+    "Reads the layout the caller edits: the tenant's own version and the system version of one layout slug (each the open draft if there is one, else the stored version, with `active` naming the served version), the header, signature and footer regions of the effective html version, and the locale a save has to use; a SystemAdmin edits the system version by default and also receives its mjml source; scope tenant loads the SystemAdmin's own tenant layout instead, and scope system is refused for everyone else. Use it to load the layout editor.",
   handler: async (query, ctx): Promise<LayoutSourceResponse> => {
     const { kind, slug, locale } = query.payload;
-    const isSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const callerIsSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const scope = query.payload.scope ?? (callerIsSystemAdmin ? "system" : "tenant");
+    if (scope === "system" && !callerIsSystemAdmin) {
+      throw new AccessDeniedError({
+        i18nKey: "errors.access.denied",
+        details: { reason: TemplateResolverErrors.systemAdminRequired },
+      });
+    }
     const policy = deliveryPolicyOf(ctx.registry);
     const rows = await filterDeliveredTo(
       ctx.db,
@@ -150,7 +169,13 @@ export const layoutSourceQuery = defineQueryHandler({
       query.user,
       await selectMany<TemplateResourceRow>(ctx.db, templateResourcesTable, { kind, slug }),
     );
-    const { tenantRow, systemRow } = pickEditedRows(rows, query.user, locale);
-    return buildLayoutSource({ kind, locale, isSystemAdmin, tenantRow, systemRow });
+    const { tenantRow, systemRow } = pickEditedRows(rows, query.user, scope, locale);
+    return buildLayoutSource({
+      kind,
+      locale,
+      isSystemAdmin: scope === "system",
+      tenantRow,
+      systemRow,
+    });
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/list.query.ts

@@ -1,8 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { filterDeliveredTo } from "../api.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isHiddenSystemDraft } from "../template-draft.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { TEMPLATE_KINDS, TEMPLATE_STATUSES } from "../web/constants.ts";
@@ -47,23 +48,21 @@ export const listQuery = defineQueryHandler({
     })) as TemplateResourceRow[];
 
     const deliveryPolicy = deliveryPolicyOf(ctx.registry);
-    return rows
-      .filter(
-        (row) =>
-          !isHiddenSystemDraft(query.user, row) &&
-          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-          isRowServedTo(deliveryPolicy, query.user, row),
-      )
-      .map((row) => ({
-        id: String(row.id),
-        tenantId: row.tenantId,
-        slug: row.slug,
-        kind: row.kind,
-        locale: row.locale,
-        scope: row.scope,
-        status: row.status,
-        contentFormat: row.contentFormat,
-        modifiedAt: row.modifiedAt,
-      }));
+    const candidates = rows.filter(
+      (row) =>
+        !isHiddenSystemDraft(query.user, row) &&
+        !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row),
+    );
+    return (await filterDeliveredTo(ctx.db, deliveryPolicy, query.user, candidates)).map((row) => ({
+      id: String(row.id),
+      tenantId: row.tenantId,
+      slug: row.slug,
+      kind: row.kind,
+      locale: row.locale,
+      scope: row.scope,
+      status: row.status,
+      contentFormat: row.contentFormat,
+      modifiedAt: row.modifiedAt,
+    }));
   },
 });

package/packages/bundled-features/src/template-resolver/handlers/overview.query.ts

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import {
@@ -16,7 +17,11 @@ import {
   parseTemplateDraft,
   servedVersionOf,
 } from "../template-draft.ts";
-import { mayEditTemplate, type TemplateEditPolicy } from "../template-edit-policy.ts";
+import {
+  mayEditTemplate,
+  type TemplateEditPolicy,
+  templateEditAccess,
+} from "../template-edit-policy.ts";
 import { isSystemOnlyTemplateHiddenFrom } from "../template-system-only.ts";
 import { collectTemplateUsage, type EffectiveMailLayoutSlugs } from "../template-usage.ts";
 import {
@@ -155,6 +160,19 @@ function effectiveRowsOf(
     : null;
 }
 
+export function isRowVisibleToCaller(
+  policy: TemplateEditPolicy,
+  user: Parameters<typeof isHiddenSystemDraft>[0],
+  registry: Parameters<typeof isSystemOnlyTemplateHiddenFrom>[1],
+  row: TemplateResourceRow,
+): boolean {
+  return (
+    !isHiddenSystemDraft(user, row) &&
+    !isSystemOnlyTemplateHiddenFrom(user, registry, row) &&
+    mayEditTemplate(policy, user, row)
+  );
+}
+
 export function effectiveMailLayoutSlugs(
   rows: readonly TemplateResourceRow[],
   policy: TemplateDeliveryPolicy,
@@ -191,7 +209,15 @@ function splitDocumentSlug(slug: string): { feature: string; notification: strin
     : { feature: slug.slice(0, separator), notification: slug.slice(separator + 1) };
 }
 
-function compareBy(field: SortField, a: OverviewRow, b: OverviewRow): number {
+type ShownTitle = (row: OverviewRow) => string;
+
+function compareBy(
+  field: SortField,
+  a: OverviewRow,
+  b: OverviewRow,
+  shownTitle: ShownTitle,
+): number {
+  if (field === "title") return shownTitle(a).localeCompare(shownTitle(b));
   return String(a[field]).localeCompare(String(b[field]));
 }
 
@@ -338,11 +364,17 @@ function filterRows(
   search: string | undefined,
   filters: readonly OverviewFilter[],
   layoutSlug: string | undefined,
+  shownTitle: ShownTitle,
 ): OverviewRow[] {
   const needle = search?.trim().toLowerCase() ?? "";
   return rows.filter((row) => {
     if (layoutSlug !== undefined && row.layoutSlug !== layoutSlug) return false;
-    if (needle !== "" && !`${row.title} ${row.slug}`.toLowerCase().includes(needle)) return false;
+    if (
+      needle !== "" &&
+      !`${shownTitle(row)} ${row.title} ${row.slug}`.toLowerCase().includes(needle)
+    ) {
+      return false;
+    }
     return filters.every((filter) => filter.value.includes(String(row[filter.field])));
   });
 }
@@ -366,7 +398,7 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
       offset: z.number().int().min(0).optional(),
       totalCount: z.boolean().optional(),
     }),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    access: templateEditAccess(policy.tenantEditable),
     description:
       "Lists mail, PDF and layout templates as one row per slug and kind for the caller's tenant (optionally only the mails and PDFs using one layout slug): where the effective version comes from (own override or system), its locales, status and version (the served one; `draftVersion` is set when an unpublished draft waits beside it, `activeSince` says since when the served version applies), the system version it overrides, the layout it uses and which notifications or templates use it; templates of notifications registered with `systemOnly` are listed for SystemAdmins only, and a TenantAdmin sees only the templates the app lists in tenantEditable; a tenant override of a template that is not listed is not delivered, so the row shows the system version with `lockedOverride` true (SystemAdmin only); use it to browse and filter all templates at a glance.",
     handler: async (query, ctx) => {
@@ -385,11 +417,8 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
         });
       }
 
-      const visibleRows = rows.filter(
-        (row) =>
-          !isHiddenSystemDraft(query.user, row) &&
-          !isSystemOnlyTemplateHiddenFrom(query.user, ctx.registry, row) &&
-          mayEditTemplate(policy, query.user, row),
+      const visibleRows = rows.filter((row) =>
+        isRowVisibleToCaller(policy, query.user, ctx.registry, row),
       );
       const deliveryPolicy = deliveryPolicyOf(ctx.registry);
       const { drafts, layoutSlugByDocument } = buildDrafts(
@@ -409,17 +438,23 @@ export function makeOverviewQuery(policy: TemplateEditPolicy) {
             ),
           )
         : rowsWithUsage;
+      // A seeded title can be an i18n key; search and sort must see what the admin sees.
+      const i18n = createI18n(ctx.registry, { defaultLocale: "en" });
+      const shownTitle: ShownTitle = (row) => i18n.t(row.title, ctx.locale);
       const filtered = filterRows(
         overviewRows,
         payload.search,
         payload.filters ?? [],
         payload.layoutSlug,
+        shownTitle,
       );
 
       const sortField: SortField =
         payload.sort !== undefined && isSortField(payload.sort) ? payload.sort : "modifiedAt";
       const direction = (payload.sortDirection ?? "desc") === "desc" ? -1 : 1;
-      filtered.sort((a, b) => direction * compareBy(sortField, a, b) || a.id.localeCompare(b.id));
+      filtered.sort(
+        (a, b) => direction * compareBy(sortField, a, b, shownTitle) || a.id.localeCompare(b.id),
+      );
 
       const offset = payload.offset ?? 0;
       return {

package/packages/bundled-features/src/template-resolver/handlers/patch-draft.write.ts

@@ -40,7 +40,7 @@ export function makePatchDraftWrite(policy: TemplateEditPolicy) {
     }),
     access: templateEditAccess(policy.tenantEditable),
     description:
-      "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
+      "Changes a mail or PDF document template with structured operations instead of a full rewrite and saves the result as the caller's tenant draft (never published, an active version keeps being served until publish): insertBlock after a block id (null = at the start; paragraph, heading, image, button, divider, pageBreak), replaceText inside one block (the text must occur exactly once within one formatting run and cannot contain a {{placeholder}}: a find across a formatting change fails with text_spans_formatting, a find with a placeholder with placeholder_not_replaceable, and the formatting of the replaced text is kept), removeBlock, setResource on an image block, setMeta (flat merge, null removes a key) and setVariable (adds, replaces or with null removes a variable definition; refused when a notification declares the variables). Block ids and base come from document-blocks and refer to the state that was read; if the template changed since, the call fails with version_conflict and nothing is written. A patch that removes a required placeholder is refused. A TenantAdmin may patch only templates the app lists in tenantEditable, otherwise SystemAdmin only. Returns the written row.",
     handler: async (event, ctx) => {
       const { slug, kind, locale, base, ops } = event.payload;
       const refused = refuseTemplateEdit(policy, event.user, { slug, kind });

package/packages/bundled-features/src/template-resolver/handlers/send-test-status.query.ts

@@ -1,5 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { type TemplateEditPolicy, templateEditAccess } from "../template-edit-policy.ts";
 import {
   emailChannelOf,
   resolveTestMailAddress,
@@ -10,22 +11,24 @@ export type SendTestStatus =
   | { readonly canSend: true; readonly reason: null }
   | { readonly canSend: false; readonly reason: "no_channel" | "no_address" };
 
-export const sendTestStatusQuery = defineQueryHandler({
-  name: "send-test-status",
-  schema: z.object({}),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
-  handler: async (query, ctx): Promise<SendTestStatus> => {
-    const channel = emailChannelOf(ctx.registry);
-    if (channel === undefined) return { canSend: false, reason: "no_channel" };
-    const address = await resolveTestMailAddress(
-      channel,
-      testMailChannelContext(ctx, query.user),
-      query.user,
-    );
-    return address === null
-      ? { canSend: false, reason: "no_address" }
-      : { canSend: true, reason: null };
-  },
-});
+export function makeSendTestStatusQuery(policy: TemplateEditPolicy) {
+  return defineQueryHandler({
+    name: "send-test-status",
+    schema: z.object({}),
+    access: templateEditAccess(policy.tenantEditable),
+    description:
+      "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
+    handler: async (query, ctx): Promise<SendTestStatus> => {
+      const channel = emailChannelOf(ctx.registry);
+      if (channel === undefined) return { canSend: false, reason: "no_channel" };
+      const address = await resolveTestMailAddress(
+        channel,
+        testMailChannelContext(ctx, query.user),
+        query.user,
+      );
+      return address === null
+        ? { canSend: false, reason: "no_address" }
+        : { canSend: true, reason: null };
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/tenant-override-counts.query.ts

@@ -8,6 +8,11 @@ import {
   TENANT_OVERRIDES_REASON,
 } from "./tenant-override-selection.ts";
 
+type OverrideCountRow = Pick<
+  TemplateResourceRow,
+  "tenantId" | "slug" | "kind" | "status" | "version"
+>;
+
 export const tenantOverrideCountsResultSchema = z.object({
   totalTenants: z.number().nullable(),
   counts: z.array(z.object({ slug: z.string(), kind: z.string(), activeOverrides: z.number() })),
@@ -21,18 +26,17 @@ export const tenantOverrideCountsQuery = defineQueryHandler({
     "Counts, per template slug and kind, the enabled tenants that override it with an active version, next to the number of enabled tenants; one query for the whole template overview instead of one tenant-overrides call per row.",
   escapeHatch: { grants: ["unsafeRaw"], reason: TENANT_OVERRIDES_REASON },
   handler: async (_query, ctx) => {
-    const found = await selectMany<TemplateResourceRow>(
+    const found = await selectMany<OverrideCountRow>(
       ctx.db.unsafeRaw(),
       templateResourcesTable,
-      {
-        scope: "tenant",
-      },
+      { scope: "tenant" },
+      { fields: ["tenantId", "slug", "kind", "status", "version"] },
     );
     const enabledTenantIds = await loadEnabledTenantIds(ctx);
 
     const rowsBySlugAndKind = new Map<
       string,
-      { slug: string; kind: string; rows: TemplateResourceRow[] }
+      { slug: string; kind: string; rows: OverrideCountRow[] }
     >();
     for (const row of found) {
       const key = `${row.kind}|${row.slug}`;

package/packages/bundled-features/src/template-resolver/handlers/tenant-override-selection.ts

@@ -21,8 +21,10 @@ export async function loadEnabledTenantIds(
   return new Set(tenantIdsSchema.parse(await ctx.query(TenantQueries.activeTenantIds, {})));
 }
 
+export type OverrideCandidate = Pick<TemplateResourceRow, "tenantId" | "status" | "version">;
+
 // One row per tenant: its active override wins over a draft, then the newest version.
-function isBetterRow(candidate: TemplateResourceRow, current: TemplateResourceRow): boolean {
+function isBetterRow(candidate: OverrideCandidate, current: OverrideCandidate): boolean {
   if ((candidate.status === "active") !== (current.status === "active")) {
     return candidate.status === "active";
   }
@@ -30,18 +32,18 @@ function isBetterRow(candidate: TemplateResourceRow, current: TemplateResourceRo
 }
 
 function isCountedTenantRow(
-  row: TemplateResourceRow,
+  row: OverrideCandidate,
   enabledTenantIds: ReadonlySet<string> | null,
 ): boolean {
   if (row.tenantId === SYSTEM_TENANT_ID || row.status === "archived") return false;
   return enabledTenantIds === null || enabledTenantIds.has(row.tenantId);
 }
 
-export function pickBestRowPerTenant(
-  found: readonly TemplateResourceRow[],
+export function pickBestRowPerTenant<TRow extends OverrideCandidate>(
+  found: readonly TRow[],
   enabledTenantIds: ReadonlySet<string> | null,
-): Map<string, TemplateResourceRow> {
-  const bestByTenant = new Map<string, TemplateResourceRow>();
+): Map<string, TRow> {
+  const bestByTenant = new Map<string, TRow>();
   for (const row of found) {
     if (!isCountedTenantRow(row, enabledTenantIds)) continue;
     const current = bestByTenant.get(row.tenantId);

package/packages/bundled-features/src/template-resolver/handlers/tenant-overrides.query.ts

@@ -1,5 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/db";
-import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  MAX_LIST_LIMIT,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
@@ -18,8 +22,39 @@ const directorySchema = z.object({
 
 type OverrideStatus = "active" | "draft";
 
-function labelsOf(raw: unknown): ReadonlyMap<string, string> {
-  return new Map(directorySchema.parse(raw).rows.map((row) => [row.id, row.label]));
+function chunksOf<T>(items: readonly T[], size: number): T[][] {
+  const chunks: T[][] = [];
+  for (let start = 0; start < items.length; start += size) {
+    chunks.push(items.slice(start, start + size));
+  }
+  return chunks;
+}
+
+type DirectoryQueryContext = {
+  readonly query: (name: string, payload: { ids: string[] }) => Promise<unknown>;
+};
+
+// Looks up only the ids the overrides need, so labels never depend on the directory's default cap.
+async function labelsFor(
+  ctx: DirectoryQueryContext,
+  queryName: string,
+  ids: ReadonlySet<string>,
+): Promise<ReadonlyMap<string, string>> {
+  const labels = new Map<string, string>();
+  for (const chunk of chunksOf([...ids], MAX_LIST_LIMIT)) {
+    const raw = await ctx.query(queryName, { ids: chunk });
+    for (const row of directorySchema.parse(raw).rows) labels.set(row.id, row.label);
+  }
+  return labels;
+}
+
+function changerIdsOf(rows: readonly TemplateResourceRow[]): ReadonlySet<string> {
+  const ids = new Set<string>();
+  for (const row of rows) {
+    const changedById = row.modifiedById ?? row.insertedById;
+    if (changedById !== null) ids.add(changedById);
+  }
+  return ids;
 }
 
 function statusOf(row: TemplateResourceRow): OverrideStatus {
@@ -73,10 +108,14 @@ export const tenantOverridesQuery = defineQueryHandler({
     const bestByTenant = pickBestRowPerTenant(found, enabledTenantIds);
     const best = [...bestByTenant.values()];
     const tenantLabels = hasTenantFeature
-      ? labelsOf(await ctx.query(TenantQueries.tenantDirectory, {}))
+      ? await labelsFor(
+          ctx,
+          TenantQueries.tenantDirectory,
+          new Set(best.map((row) => row.tenantId)),
+        )
       : new Map<string, string>();
     const userLabels = hasTenantFeature
-      ? labelsOf(await ctx.query(TenantQueries.memberDirectory, {}))
+      ? await labelsFor(ctx, TenantQueries.memberDirectory, changerIdsOf(best))
       : new Map<string, string>();
 
     const rows = best

package/packages/bundled-features/src/template-resolver/handlers/usage.query.ts

@@ -3,35 +3,46 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
 import { deliveryPolicyOf } from "../template-delivery-policy.ts";
+import type { TemplateEditPolicy } from "../template-edit-policy.ts";
 import { templateSlugSchema } from "../template-meta.ts";
 import { collectTemplateUsage } from "../template-usage.ts";
 import { TEMPLATE_KINDS } from "../web/constants.ts";
-import { effectiveMailLayoutSlugs } from "./overview.query.ts";
+import { effectiveMailLayoutSlugs, isRowVisibleToCaller } from "./overview.query.ts";
 
 const MAIL_ROW_LIMIT = 5000;
 
-export const usageQuery = defineQueryHandler({
-  name: "usage",
-  schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  description:
-    "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
-  handler: async (query, ctx) => {
-    const { slug, kind } = query.payload;
-    if (kind !== "mail-layout") return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
-    const mailRows = await selectMany<TemplateResourceRow>(
-      ctx.db,
-      templateResourcesTable,
-      { kind: "mail" },
-      { limit: MAIL_ROW_LIMIT },
-    );
-    return {
-      usedBy: collectTemplateUsage(
-        ctx.registry,
-        slug,
-        kind,
-        effectiveMailLayoutSlugs(mailRows, deliveryPolicyOf(ctx.registry)),
-      ),
-    };
-  },
-});
+export function makeUsageQuery(policy: TemplateEditPolicy) {
+  return defineQueryHandler({
+    name: "usage",
+    schema: z.object({ slug: templateSlugSchema, kind: z.enum(TEMPLATE_KINDS) }),
+    access: { roles: ["TenantAdmin", "SystemAdmin"] },
+    description:
+      "Lists the code-registered notifications that use one template: a mail template is used by the notification whose qualified name is its slug and that has a code template, a mail layout by every mail notification whose effective template (own override, else system) names it, or whose code meta does when no stored template exists, or that falls back to the default layout; use it to show what a change to a template affects.",
+    handler: async (query, ctx) => {
+      const { slug, kind } = query.payload;
+      if (kind !== "mail-layout") return { usedBy: collectTemplateUsage(ctx.registry, slug, kind) };
+      const fetchedRows = await selectMany<TemplateResourceRow>(
+        ctx.db,
+        templateResourcesTable,
+        { kind: "mail" },
+        { orderBy: { col: "id", direction: "asc" }, limit: MAIL_ROW_LIMIT + 1 },
+      );
+      if (fetchedRows.length > MAIL_ROW_LIMIT) {
+        ctx.log?.warn("template usage: row limit reached, result is incomplete", {
+          limit: MAIL_ROW_LIMIT,
+        });
+      }
+      const visibleRows = fetchedRows
+        .slice(0, MAIL_ROW_LIMIT)
+        .filter((row) => isRowVisibleToCaller(policy, query.user, ctx.registry, row));
+      return {
+        usedBy: collectTemplateUsage(
+          ctx.registry,
+          slug,
+          kind,
+          effectiveMailLayoutSlugs(visibleRows, deliveryPolicyOf(ctx.registry)),
+        ),
+      };
+    },
+  });
+}

package/packages/bundled-features/src/template-resolver/handlers/validate.query.ts

@@ -6,10 +6,11 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { isRowDeliveredTo } from "../api.ts";
 import type { TemplateWriteScope } from "../layout-regions.ts";
 import { imageResourceKeysOf } from "../linked-resources.ts";
 import { type TemplateResourceRow, templateResourcesTable } from "../table.ts";
-import { deliveryPolicyOf, isRowServedTo } from "../template-delivery-policy.ts";
+import { deliveryPolicyOf } from "../template-delivery-policy.ts";
 import { isSystemAdmin } from "../template-draft.ts";
 import { resolveTemplateVariables, systemPlaceholdersFor } from "../template-validation.ts";
 import type { ContentFormat, UpsertKind } from "../web/constants.ts";
@@ -69,7 +70,11 @@ export async function knownResourceKeysFor(
       locale,
     })),
     ...(scope === "tenant" &&
-    isRowServedTo(deliveryPolicyOf(ctx.registry), user, { tenantId: user.tenantId, kind, slug })
+    (await isRowDeliveredTo(ctx.db, deliveryPolicyOf(ctx.registry), user, {
+      tenantId: user.tenantId,
+      kind,
+      slug,
+    }))
       ? await knownResourceKeys(ctx.db, { tenantId: user.tenantId, slug, kind, scope, locale })
       : []),
   ];