@i4e/invest4edu-access-core 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Shared access-control primitives (Track 3: tenant keystone, role capabilities, reportee tree, feature flags) for NeoFindesk backends.",
   "type": "module",
   "exports": {

package/src/tenant-plugin.js

@@ -5,9 +5,11 @@
  * injects `account_id` from the request's ALS store (tenant-context.js), so a query cannot
  * reach Mongo without the caller's tenant boundary — even if the controller forgot it.
  *
- * Modes (env `TENANT_ENFORCEMENT`, default `warn`):
- *   - identity present → inject `account_id` unconditionally (BOTH modes)
- *   - identity absent  → `enforce`: THROW (fail-closed) · `warn`: log + do not scope (burn-in)
+ * Modes (env `TENANT_ENFORCEMENT`, default `off`):
+ *   - `off` (DEFAULT)  → literal no-op; behaviour identical to pre-Track-3. Safe merge baseline.
+ *   - `warn`           → inject `account_id` when identity present; log identity-less reads.
+ *   - `enforce`        → inject when present; THROW on identity-less reads (fail-closed).
+ * Rollout ladder: off → warn (burn-in, watch `[tenant] identity-less`) → enforce.
  *
  * Bypass: `runAsSystem(fn)` or `.setOptions({ skipTenant: true })` for legitimately
  * cross-tenant reads. NOT covered: aggregation pipelines and write ops (reads are C0 scope).
@@ -18,9 +20,11 @@
 import als from "./tenant-context.js";
 
 const READ_OPS = ["find", "findOne", "countDocuments"];
-const mode = () => (process.env.TENANT_ENFORCEMENT || "warn").toLowerCase();
+const mode = () => (process.env.TENANT_ENFORCEMENT || "off").toLowerCase();
 
 function tenantHook() {
+  if (mode() === "off") return; // literal no-op — identical to pre-Track-3
+
   const opts = typeof this.getOptions === "function" ? this.getOptions() : this.options || {};
   if (opts && opts.skipTenant) return;