@i4e/invest4edu-access-core 0.4.0 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Shared access-control primitives (Track 3: tenant keystone, role capabilities, reportee tree, feature flags) for NeoFindesk backends.",
   "type": "module",
   "exports": {

package/src/index.js

@@ -3,7 +3,7 @@
  * Tenant isolation (D1 keystone) + role capabilities (G7).
  */
 export { default as als, runWithTenant, runAsSystem, getTenantStore } from "./tenant-context.js";
-export { default as tenantPlugin } from "./tenant-plugin.js";
+export { default as tenantPlugin, setTenantMode, getTenantMode } from "./tenant-plugin.js";
 export {
   CAPABILITY_FLAGS,
   DEFAULT_ROLE_CAPABILITIES,

package/src/tenant-plugin.js

@@ -5,9 +5,11 @@
  * injects `account_id` from the request's ALS store (tenant-context.js), so a query cannot
  * reach Mongo without the caller's tenant boundary — even if the controller forgot it.
  *
- * Modes (env `TENANT_ENFORCEMENT`, default `warn`):
- *   - identity present → inject `account_id` unconditionally (BOTH modes)
- *   - identity absent  → `enforce`: THROW (fail-closed) · `warn`: log + do not scope (burn-in)
+ * Modes (env `TENANT_ENFORCEMENT`, default `off`):
+ *   - `off` (DEFAULT)  → literal no-op; behaviour identical to pre-Track-3. Safe merge baseline.
+ *   - `warn`           → inject `account_id` when identity present; log identity-less reads.
+ *   - `enforce`        → inject when present; THROW on identity-less reads (fail-closed).
+ * Rollout ladder: off → warn (burn-in, watch `[tenant] identity-less`) → enforce.
  *
  * Bypass: `runAsSystem(fn)` or `.setOptions({ skipTenant: true })` for legitimately
  * cross-tenant reads. NOT covered: aggregation pipelines and write ops (reads are C0 scope).
@@ -18,9 +20,31 @@
 import als from "./tenant-context.js";
 
 const READ_OPS = ["find", "findOne", "countDocuments"];
-const mode = () => (process.env.TENANT_ENFORCEMENT || "warn").toLowerCase();
+const VALID = new Set(["off", "warn", "enforce"]);
+
+// Enforcement mode is resolvable from TWO places, so it can be flipped from the admin UI
+// (DB) WITHOUT a restart, while the env var stays the infra-level emergency override.
+//   Precedence:  env TENANT_ENFORCEMENT (if valid)  >  DB value (setTenantMode)  >  "off"
+let dbMode = null;
+
+/** Called by the backend from the `accessconfig` DB doc so a UI toggle takes effect (~refresh). */
+export function setTenantMode(m) {
+  const v = m ? String(m).toLowerCase() : "";
+  dbMode = VALID.has(v) ? v : null;
+}
+
+/** Effective mode. */
+export function getTenantMode() {
+  const env = (process.env.TENANT_ENFORCEMENT || "").toLowerCase();
+  if (VALID.has(env)) return env; // explicit env wins (emergency / infra)
+  return dbMode || "off";
+}
+
+const mode = getTenantMode;
 
 function tenantHook() {
+  if (mode() === "off") return; // literal no-op — identical to pre-Track-3
+
   const opts = typeof this.getOptions === "function" ? this.getOptions() : this.options || {};
   if (opts && opts.skipTenant) return;