@i4e/invest4edu-access-core 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Shared access-control primitives (Track 3: tenant keystone, role capabilities, reportee tree, feature flags) for NeoFindesk backends.",
   "type": "module",
   "exports": {

package/src/index.js

@@ -3,7 +3,7 @@
  * Tenant isolation (D1 keystone) + role capabilities (G7).
  */
 export { default as als, runWithTenant, runAsSystem, getTenantStore } from "./tenant-context.js";
-export { default as tenantPlugin } from "./tenant-plugin.js";
+export { default as tenantPlugin, setTenantMode, getTenantMode } from "./tenant-plugin.js";
 export {
   CAPABILITY_FLAGS,
   DEFAULT_ROLE_CAPABILITIES,

package/src/tenant-plugin.js

@@ -20,7 +20,27 @@
 import als from "./tenant-context.js";
 
 const READ_OPS = ["find", "findOne", "countDocuments"];
-const mode = () => (process.env.TENANT_ENFORCEMENT || "off").toLowerCase();
+const VALID = new Set(["off", "warn", "enforce"]);
+
+// Enforcement mode is resolvable from TWO places, so it can be flipped from the admin UI
+// (DB) WITHOUT a restart, while the env var stays the infra-level emergency override.
+//   Precedence:  env TENANT_ENFORCEMENT (if valid)  >  DB value (setTenantMode)  >  "off"
+let dbMode = null;
+
+/** Called by the backend from the `accessconfig` DB doc so a UI toggle takes effect (~refresh). */
+export function setTenantMode(m) {
+  const v = m ? String(m).toLowerCase() : "";
+  dbMode = VALID.has(v) ? v : null;
+}
+
+/** Effective mode. */
+export function getTenantMode() {
+  const env = (process.env.TENANT_ENFORCEMENT || "").toLowerCase();
+  if (VALID.has(env)) return env; // explicit env wins (emergency / infra)
+  return dbMode || "off";
+}
+
+const mode = getTenantMode;
 
 function tenantHook() {
   if (mode() === "off") return; // literal no-op — identical to pre-Track-3