@mettlecast/domain-cdk-packer 0.2.60 → 0.2.62

package/dist/__tests__/registry.test.js

@@ -5,7 +5,6 @@ describe('DomainRegistry type', () => {
             schemaVersion: '1',
             domainRoot: '/workspace/my-domain',
             domain: { id: 'my-domain', kind: 'domain', name: 'My Domain', tenancy: 'required' },
-            apis: [],
             webhooks: [],
             subscribers: [],
             schedules: [],
@@ -19,12 +18,12 @@ describe('DomainRegistry type', () => {
     });
     it('discriminates RegistryEntry union by kind', () => {
         const entries = [
-            { id: 'test-api', kind: 'api', handlerFile: 'src/api.ts', path: '/test', method: 'GET', authType: 'jwt' },
+            { id: 'test-action', kind: 'action', handlerFile: 'src/action.ts', backendAccess: 'domain', exposure: { type: 'api', path: '/test', method: 'GET', auth: 'required', tenancy: 'none' }, idempotent: true },
             { id: 'test-job', kind: 'job', handlerFile: 'src/job.ts', maxRetries: 3, visibilityTimeoutSeconds: 30 },
         ];
         for (const entry of entries) {
-            if (entry.kind === 'api') {
-                expect(entry.path).toBeDefined();
+            if (entry.kind === 'action') {
+                expect(entry.exposure).toBeDefined();
             }
             if (entry.kind === 'job') {
                 expect(entry.maxRetries).toBeDefined();
@@ -32,3 +31,111 @@ describe('DomainRegistry type', () => {
         }
     });
 });
+/**
+ * Action-first migration (#4619, Wave 1 Task 1.2):
+ *
+ * ActionRegistryEntry must surface `backendAccess` and `exposure` so the
+ * registry builder can carry them through to CDK/contract generation.
+ * The legacy `visibility` field stays optional during the migration window.
+ */
+describe('ActionRegistryEntry type (action-first migration)', () => {
+    it('requires backendAccess and exposure on every action entry', () => {
+        const entry = {
+            id: 'charge-card',
+            kind: 'action',
+            handlerFile: 'src/actions/charge-card.ts',
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: true,
+        };
+        expect(entry.backendAccess).toBe('domain');
+        expect(entry.exposure).toEqual({ type: 'internal' });
+    });
+    it('accepts the full backendAccess scope union', () => {
+        const scopes = ['private', 'domain', 'platform'];
+        for (const backendAccess of scopes) {
+            const entry = {
+                id: `a-${backendAccess}`,
+                kind: 'action',
+                handlerFile: 'a.ts',
+                backendAccess,
+                exposure: { type: 'internal' },
+                idempotent: false,
+            };
+            expect(entry.backendAccess).toBe(backendAccess);
+        }
+    });
+    it('accepts an api exposure with all optional metadata', () => {
+        const exposure = {
+            type: 'api',
+            path: '/v1/tenants/{tenantId}/billing/invoices',
+            method: 'POST',
+            auth: 'required',
+            tenancy: 'required',
+            roles: ['billing-admin'],
+            securityException: { reason: 'bootstrap path before tenant exists' },
+        };
+        const entry = {
+            id: 'create-invoice',
+            kind: 'action',
+            handlerFile: 'src/actions/create-invoice.ts',
+            backendAccess: 'domain',
+            exposure,
+            idempotent: true,
+        };
+        expect(entry.exposure.type).toBe('api');
+        if (entry.exposure.type === 'api') {
+            expect(entry.exposure.path).toContain('{tenantId}');
+            expect(entry.exposure.method).toBe('POST');
+            expect(entry.exposure.auth).toBe('required');
+            expect(entry.exposure.tenancy).toBe('required');
+            expect(entry.exposure.roles).toEqual(['billing-admin']);
+            expect(entry.exposure.securityException?.reason).toMatch(/bootstrap/);
+        }
+    });
+    it('discriminates the ActionExposure union by type', () => {
+        const samples = [
+            { type: 'internal' },
+            { type: 'api', path: '/v1/x', method: 'GET', auth: 'none', tenancy: 'none' },
+        ];
+        for (const exposure of samples) {
+            if (exposure.type === 'api') {
+                expect(exposure.path).toBeDefined();
+                expect(exposure.method).toBe('GET');
+            }
+            else {
+                expect(exposure.type).toBe('internal');
+            }
+        }
+    });
+    it('keeps legacy visibility as an optional field during the migration', () => {
+        // The legacy field must remain present-but-optional on the type so
+        // existing CDK constructs (e.g. action-construct.ts) keep compiling
+        // until they are updated to consume backendAccess directly.
+        const entry = {
+            id: 'legacy',
+            kind: 'action',
+            handlerFile: 'src/actions/legacy.ts',
+            backendAccess: 'private',
+            exposure: { type: 'internal' },
+            visibility: 'workspace',
+            idempotent: false,
+        };
+        expect(entry.visibility).toBe('workspace');
+        expect(entry.backendAccess).toBe('private');
+    });
+    it('preserves input/output schema snapshot fields', () => {
+        const entry = {
+            id: 'with-schemas',
+            kind: 'action',
+            handlerFile: 'src/actions/with-schemas.ts',
+            backendAccess: 'domain',
+            exposure: { type: 'internal' },
+            idempotent: false,
+            inputSchema: { type: 'object', properties: { amount: { type: 'number' } } },
+            outputSchema: { type: 'object', properties: { id: { type: 'string' } } },
+        };
+        expect(entry.inputSchema).toBeDefined();
+        expect(entry.outputSchema).toBeDefined();
+    });
+});

package/dist/__tests__/security-assertion-aspect.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/security-assertion-aspect.test.js

@@ -0,0 +1,222 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import * as cdk from 'aws-cdk-lib';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DomainStack } from '../DomainStack.js';
+const DOMAIN_ROOT = path.join(process.cwd(), '.test-security-aspect');
+const baseRegistry = {
+    schemaVersion: '1',
+    domainRoot: DOMAIN_ROOT,
+    domain: { id: 'sec-domain', kind: 'domain', name: 'Sec Domain', tenancy: 'none' },
+    webhooks: [],
+    subscribers: [],
+    schedules: [],
+    jobs: [],
+    actions: [],
+    integrations: [],
+    events: [],
+};
+/**
+ * Build a stack, force synth, and return its error annotations so each
+ * test can assert specifically on the codes emitted by
+ * `SecurityAssertionAspect`. CDK aspects only run during synth, so the
+ * helper must call `app.synth()`. Annotations attached by aspects to
+ * child constructs (e.g. a `CfnRoute`) live on the child's metadata,
+ * not the stack's — we walk the construct tree to aggregate them.
+ */
+function buildStackAndGetErrors(registry) {
+    const app = new cdk.App();
+    const stack = new DomainStack(app, 'SecAspectStack', {
+        registry,
+        eventBusArn: 'arn:aws:events:eu-north-1:123456789012:event-bus/tib-event-bus',
+    });
+    // Force synthesis so the aspect's visit() fires.
+    try {
+        app.synth();
+    }
+    catch {
+        // Synth may throw when the aspect emits a hard error; we still want
+        // to read the metadata so the assertion can find the error code.
+    }
+    const errorMessages = [];
+    const collect = (construct) => {
+        for (const m of construct.node.metadata) {
+            if (m.type === 'aws:cdk:error') {
+                errorMessages.push(typeof m.data === 'string' ? m.data : JSON.stringify(m.data));
+            }
+        }
+        for (const child of construct.node.children) {
+            collect(child);
+        }
+    };
+    collect(stack);
+    return { stack, errorMessages };
+}
+beforeAll(() => {
+    const handlerDir = path.join(DOMAIN_ROOT, 'src', 'handlers');
+    fs.mkdirSync(handlerDir, { recursive: true });
+    // The CDK grouped-lambda-factory derives the named export from the
+    // entry id (`list-users` -> `listUsers`). We provide every named export
+    // the security-aspect test uses so each test can pick the same handler
+    // file regardless of which entry id it instantiates.
+    //
+    // Issue #4689: defineApi was removed; HTTP endpoints are now declared
+    // as actions with `exposure.type === 'api'`. Each named export below
+    // matches one of the action ids used in the test fixtures.
+    fs.writeFileSync(path.join(handlerDir, 'noop.ts'), [
+        // Match the grouped-lambda-factory's export-name conversion so the
+        // bundler can resolve the import for every test fixture.
+        'export const listUsers = { id: "list-users", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/users", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
+        'export const listAll = { id: "list-all", backendAccess: "domain", exposure: { type: "api", path: "/v1/tenants/{tenantId}/all", method: "GET", auth: "required", tenancy: "required" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
+        'export const noopAction = { id: "noop-action", backendAccess: "private", exposure: { type: "internal" }, input: { parse: (x) => x }, output: { parse: (x) => x }, idempotent: false, handler: async () => ({ ok: true }) };',
+    ].join('\n') + '\n');
+});
+afterAll(() => {
+    fs.rmSync(DOMAIN_ROOT, { recursive: true, force: true });
+});
+/**
+ * Issue #4662 Task D — deployment-time assertions. The CDK aspect is the
+ * last line of defence: it walks the synthesised tree and verifies the
+ * invariants the CLI validator already enforces. These tests pin each
+ * invariant independently so a regression in any single check is caught.
+ */
+describe('SecurityAssertionAspect (#4662 Task D, #4689)', () => {
+    it('does not emit errors for an empty registry', () => {
+        const { errorMessages } = buildStackAndGetErrors(baseRegistry);
+        // The base stack emits zero routes / zero Function URLs, so the aspect
+        // should have nothing to complain about.
+        const aspectCodes = ['SECURITY_MISSING_JWT_AUTHORIZER', 'SECURITY_MISSING_TENANT_PATH', 'SECURITY_ACTION_FUNCTION_URL', 'SECURITY_MISSING_SECURITY_EXCEPTION'];
+        expect(errorMessages.filter(m => aspectCodes.some(c => m.includes(c)))).toHaveLength(0);
+    });
+    it('emits SECURITY_MISSING_TENANT_PATH when an action API path lacks the tenant placeholder', () => {
+        // Issue #4689: the canonical HTTP endpoint surface is the action
+        // array with `exposure.type === 'api'`. The aspect now reads from
+        // `actions[]` rather than `apis[]`.
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH') && m.includes('list-users'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_TENANT_PATH when the action API path includes the placeholder', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        // We expect the JWT authorizer error (because no Cognito is provided),
+        // but NOT the tenant path error.
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH'))).toBe(false);
+    });
+    it('emits SECURITY_MISSING_JWT_AUTHORIZER when an action API is declared without Cognito config', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-users', kind: 'action', handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_JWT_AUTHORIZER') || m.includes('JWT-protected routes'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_SECURITY_EXCEPTION when authType is none but the route is the health probe', () => {
+        // The DomainStack installs the health/ready probes as `authType: 'none'` routes.
+        // Because they are special-cased in the aspect (and CLI validator
+        // ignores them), the aspect must NOT fire for them.
+        const registry = {
+            ...baseRegistry,
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_SECURITY_EXCEPTION'))).toBe(false);
+    });
+    it('does NOT emit Function URL error for the existing health/ready probes', () => {
+        // HealthConstruct attaches `Lambda::Url` to its functions. The aspect
+        // exempts them via fn-name regex; we must not regress that exemption.
+        const registry = { ...baseRegistry };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        // HealthConstruct uses NodejsFunction which DOES NOT create Lambda::Url
+        // (URLs are only created when fn.addFunctionUrl is called). So there
+        // should be no Function URL errors at all on the base stack.
+        expect(errorMessages.some(m => m.includes('SECURITY_ACTION_FUNCTION_URL'))).toBe(false);
+    });
+    it('emits SECURITY_MISSING_TENANT_PATH for an action exposure with tenancy=required but bad path', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-all',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/admin/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_TENANT_PATH') && m.includes('list-all'))).toBe(true);
+    });
+    it('emits SECURITY_MISSING_JWT_AUTHORIZER for an action exposure with auth=required but no Cognito', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'list-users',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'domain',
+                    exposure: { type: 'api', path: '/v1/tenants/{tenantId}/users', method: 'GET', auth: 'required', tenancy: 'required' },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_JWT_AUTHORIZER') && m.includes('list-users'))).toBe(true);
+    });
+    it('does NOT emit SECURITY_MISSING_SECURITY_EXCEPTION for an action with auth=none AND securityException.reason', () => {
+        const registry = {
+            ...baseRegistry,
+            actions: [
+                {
+                    id: 'noop-action',
+                    kind: 'action',
+                    handlerFile: 'src/handlers/noop.ts',
+                    backendAccess: 'platform',
+                    exposure: {
+                        type: 'api',
+                        path: '/v1/health',
+                        method: 'GET',
+                        auth: 'none',
+                        tenancy: 'none',
+                        securityException: { reason: 'public liveness probe; ticket OPS-123' },
+                    },
+                    idempotent: false,
+                },
+            ],
+        };
+        const { errorMessages } = buildStackAndGetErrors(registry);
+        // Note: the CLI validator's AUTH_NONE_REQUIRES_EXCEPTION rule mirrors
+        // this; we only check that the *aspect* does not block a well-formed
+        // action.
+        expect(errorMessages.some(m => m.includes('SECURITY_MISSING_SECURITY_EXCEPTION'))).toBe(false);
+    });
+});

package/dist/aspects/index.d.ts

@@ -3,3 +3,7 @@ export type { TibTaggingAspectProps } from './tagging-aspect.js';
 export { LogRetentionAspect } from './log-retention-aspect.js';
 export { IamBoundariesAspect } from './iam-boundaries-aspect.js';
 export type { IamBoundariesAspectProps } from './iam-boundaries-aspect.js';
+export { SecurityAssertionAspect } from './security-assertion-aspect.js';
+export type { SecurityAssertionAspectProps } from './security-assertion-aspect.js';
+export { SECURITY_ASSERTION_CODES } from './security-assertion-aspect.js';
+export type { SecurityAssertionCode } from './security-assertion-aspect.js';

package/dist/aspects/index.js

@@ -1,3 +1,5 @@
 export { TibTaggingAspect } from './tagging-aspect.js';
 export { LogRetentionAspect } from './log-retention-aspect.js';
 export { IamBoundariesAspect } from './iam-boundaries-aspect.js';
+export { SecurityAssertionAspect } from './security-assertion-aspect.js';
+export { SECURITY_ASSERTION_CODES } from './security-assertion-aspect.js';

package/dist/aspects/security-assertion-aspect.d.ts

@@ -0,0 +1,161 @@
+import * as cdk from 'aws-cdk-lib';
+import { IConstruct } from 'constructs';
+import type { DomainRegistry } from '../registry.js';
+/**
+ * Properties for {@link SecurityAssertionAspect}.
+ *
+ * The aspect reads the `DomainRegistry` exactly once at synthesis time and
+ * then walks every CDK construct for violations. All checks are read-only —
+ * the aspect never modifies the synthesized graph, only emits annotations.
+ *
+ * Issue #4662 Task D — deployment-time assertions. The CLI validator at
+ * `packages/domain-cli` already enforces the same rules against the
+ * `DomainRegistry` before synth, but the aspect is the last line of defence:
+ * it runs even if the CLI was skipped, and it can catch regressions in the
+ * synthesized graph itself (e.g. a route accidentally wired without an
+ * authorizer, or a Lambda exposed via Function URL).
+ */
+export interface SecurityAssertionAspectProps {
+    /** The compiled domain registry — source of truth for what was declared. */
+    registry: DomainRegistry;
+    /**
+     * When true, missing JWT authorizer on a JWT-required route is reported
+     * as a synth-blocking error rather than a warning. Default: true.
+     *
+     * Set to false during the Wave 4 Task 4.1 roll-out so we could ship
+     * fix-ups one stack at a time. New deployments should leave it on.
+     */
+    failOnMissingAuthorizer?: boolean;
+    /**
+     * When true, an API-exposed action whose handler Lambda is reachable
+     * through a `Lambda::Url` resource is a synth-blocking error rather
+     * than a warning. Default: true — Function URLs create public, IAM-
+     * or NONE-authenticated endpoints that bypass API Gateway entirely.
+     */
+    failOnFunctionUrl?: boolean;
+}
+/**
+ * Result codes emitted by the aspect. Mirrored in the CLI validator so
+ * downstream tooling can correlate synth-time annotations with build-time
+ * validation errors. Each code corresponds to a single, narrowly-scoped
+ * invariant — see the per-method docstrings for the exact contract.
+ */
+export declare const SECURITY_ASSERTION_CODES: {
+    /**
+     * A JWT-required route (api.authType='jwt' or action.exposure.auth='required')
+     * was synthesised without an attached `CfnAuthorizer` ID. Synth blocks.
+     */
+    readonly MISSING_JWT_AUTHORIZER: "SECURITY_MISSING_JWT_AUTHORIZER";
+    /**
+     * A tenancy-required route (api requiring a tenant, or action.exposure.tenancy='required')
+     * does not include the canonical tenant placeholder
+     * (`/v1/tenants/{tenantId}/`) in its path. The runtime cannot bind
+     * `ctx.tenant.id` from a path that does not carry the placeholder, so
+     * this would silently produce a tenant-less route. Synth blocks.
+     */
+    readonly MISSING_TENANT_PATH: "SECURITY_MISSING_TENANT_PATH";
+    /**
+     * An action Lambda is reachable through a `Lambda::Url` resource. This
+     * creates a public-or-IAM endpoint that bypasses API Gateway, the JWT
+     * authorizer, and the registry's exposure metadata. Synth blocks.
+     */
+    readonly ACTION_FUNCTION_URL: "SECURITY_ACTION_FUNCTION_URL";
+    /**
+     * An API route is declared `auth: 'none'` or `authType: 'none'` without
+     * a `securityException.reason`. Public routes must document the
+     * exception so security reviewers can audit the relaxation. Synth
+     * blocks — anonymous routes are the exception, not the default.
+     */
+    readonly MISSING_SECURITY_EXCEPTION: "SECURITY_MISSING_SECURITY_EXCEPTION";
+};
+export type SecurityAssertionCode = typeof SECURITY_ASSERTION_CODES[keyof typeof SECURITY_ASSERTION_CODES];
+/**
+ * CDK Aspect that performs deployment-time security assertions against
+ * the synthesised {@link DomainStack}.
+ *
+ * The aspect complements the CLI validator at `packages/domain-cli`. Both
+ * layers run from the same source of truth (`DomainRegistry`), but they
+ * fail at different points in the pipeline:
+ *
+ *   - The CLI validator fails the build BEFORE synth, so the developer
+ *     gets a structured error code in their terminal and CI fails on
+ *     `mc-domain-module validate`.
+ *   - The aspect fails synth AFTER the stack has been assembled. It can
+ *     detect runtime regressions (e.g. a route accidentally synthesised
+ *     without an authorizer because a feature flag silently skipped the
+ *     wiring) that the CLI cannot see.
+ *
+ * Adding the aspect to a stack is a one-liner:
+ *
+ * ```ts
+ * cdk.Aspects.of(stack).add(new SecurityAssertionAspect({ registry }));
+ * ```
+ *
+ * The {@link DomainStack} constructor already wires this aspect in for
+ * every domain, so most code does not need to interact with the class
+ * directly.
+ */
+export declare class SecurityAssertionAspect implements cdk.IAspect {
+    private readonly props;
+    constructor(props: SecurityAssertionAspectProps);
+    /**
+     * CDK calls this for every node in the construct tree. The aspect is
+     * intentionally narrow: it inspects the synthesised graph for the
+     * specific invariants listed above. It does NOT validate the registry
+     * itself — the CLI owns that responsibility and emitting duplicate
+     * errors here would be noisy.
+     *
+     * @param node - The CDK construct being visited.
+     */
+    visit(node: IConstruct): void;
+    /**
+     * Walk every `CfnRoute` in the construct tree and verify the security
+     * invariants in one pass:
+     *
+     * 1. Routes declared as JWT-protected actually carry an `AuthorizerId`.
+     *    Covers action API exposures (`exposure.auth === 'required'`).
+     * 2. Routes declared as tenant-required include the canonical
+     *    `/v1/tenants/{tenantId}/` placeholder in their path.
+     *
+     * Both checks fail synth by default; the authorizer check can be
+     * downgraded to a warning via {@link SecurityAssertionAspectProps.failOnMissingAuthorizer}
+     * for incremental rollouts.
+     */
+    private assertRouteSecurity;
+    /**
+     * Walk every `CfnUrl` in the construct tree and verify no action
+     * Lambda is reachable through a `Lambda::Url`. Wave 4 Task 4.2 (#4619)
+     * explicitly removed Function URL exposure because the resulting
+     * endpoints bypass API Gateway, the JWT authorizer, and the
+     * `backendAccess` / `exposure` policy gates.
+     *
+     * Health and readiness probes are explicitly exempted — they use
+     * `Lambda::Url` for cheap internal polling and the runtime never
+     * routes tenant traffic through them.
+     */
+    private assertNoFunctionUrls;
+    /**
+     * Walk every `CfnRoute` whose action registry counterpart declares
+     * `auth: 'none'` and verify that the action exposure carries a
+     * `securityException.reason`. Public routes must document the exception
+     * so security reviewers can audit the relaxation.
+     */
+    private assertAnonymousRoutesHaveException;
+    /**
+     * Find the registry action whose `exposure.path` matches a synthesised
+     * route for action API exposures.
+     */
+    private findActionRegistryEntryForRoute;
+    /**
+     * Predicate — does the action registry entry carry a securityException
+     * on its exposure block?
+     */
+    private hasActionSecurityException;
+    /**
+     * Predicate — does the path contain `/v1/tenants/{tenantId}/`?
+     *
+     * We do not use a regex because the placeholder is a literal string
+     * and the runtime extractor performs an identical literal match.
+     */
+    private hasTenantPlaceholder;
+}