@tumbaland/backend-core 1.37.0 → 1.39.0

package/src/audit/reads.ts

@@ -0,0 +1,88 @@
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+import { AuditEvent } from './AuditEvent';
+import { actorOf, type Actor } from './actor';
+import logger from '../logging/logger';
+
+/**
+ * Record what software read, and only what software read.
+ *
+ * A person browsing their own journal generates nothing here. That is not a
+ * shortcut: one dashboard load hits half a dozen endpoints, so logging it would
+ * bury the interesting rows under thousands of uninteresting ones and put a
+ * database write behind every page view.
+ *
+ * What an assistant read is the part worth keeping, because it is the part that
+ * left the server. A created entry leaves a record behind either way; a read
+ * leaves nothing at all, and it is exactly what the privacy page warns about —
+ * ask an assistant what you did last month and those entries go to whoever runs
+ * it. This is the only place that becomes visible.
+ */
+/**
+ * Arm the read trail for one request, if it is one worth recording.
+ *
+ * Nothing is written here — the listener fires when the response finishes, so a
+ * refused request is not recorded as a read and the count reflects what was
+ * actually sent.
+ */
+export function recordRead(req: Request, res: Response, actor: Actor, service: string): void {
+  if (req.method !== 'GET' || actor.kind === 'person') return;
+
+  res.on('finish', () => {
+    if (res.statusCode >= 400) return;
+
+    void AuditEvent.create({
+      at: new Date(),
+      service,
+      action: 'read',
+      resource: resourceOf(req.baseUrl + req.path),
+      actorKind: actor.kind,
+      userId: actor.userId,
+      actorLabel: actor.label,
+      actorCredentialId: actor.credentialId,
+      tenant: actor.tenant,
+      count: res.locals.auditCount as number | undefined
+    }).catch((error) => {
+      logger.warn('Could not record a read', { error: (error as Error)?.message });
+    });
+  });
+}
+
+/**
+ * The same thing as standalone middleware, for anything that authenticates its
+ * own way rather than through `authenticateAgent`.
+ */
+export const auditReads =
+  (service: string): RequestHandler =>
+  (req: Request, res: Response, next: NextFunction): void => {
+    const actor = actorOf(req);
+    if (actor) recordRead(req, res, actor, service);
+    next();
+  };
+
+/**
+ * What a path was asking for, in one word.
+ *
+ * The first path segment, which is the collection on every route here —
+ * `/api/activities/68d6…` is about activities. Deliberately crude: a trail
+ * naming the resource is readable, and one naming the full path with ids in it
+ * is a request log wearing an audit log's clothes.
+ */
+export function resourceOf(path: string): string {
+  const segments = path.split('/').filter((segment) => segment && segment !== 'api');
+  return segments[0]?.replace(/-/g, '_') ?? 'unknown';
+}
+
+/**
+ * How many records a response carried.
+ *
+ * Set by a handler that knows; absent otherwise. The size of what left the
+ * server is most of what makes a read worth recording — "read the journal" and
+ * "read four hundred entries of the journal" are different events.
+ */
+export const countRead = (res: Response, count: number): void => {
+  // Guarded for the same reason recording is fire-and-forget: instrumentation
+  // must not be able to fail the thing it instruments. Express always provides
+  // `locals`, but a handler called directly does not have to.
+  if (!res?.locals) return;
+  res.locals.auditCount = count;
+};

package/src/audit/service.test.ts

@@ -0,0 +1,115 @@
+import mongoose from 'mongoose';
+import { MongoMemoryServer } from 'mongodb-memory-server';
+
+import { AuditEvent } from './AuditEvent';
+import { listAuditEvents } from './service';
+
+let mongo: MongoMemoryServer;
+
+const event = (over: Record<string, unknown> = {}) => ({
+  at: new Date('2026-09-05T10:00:00Z'),
+  service: 'relationship-service',
+  action: 'create' as const,
+  resource: 'activity',
+  actorKind: 'assistant' as const,
+  userId: 'u1',
+  actorLabel: 'Claude',
+  actorCredentialId: 'client-1',
+  tenant: 'g1',
+  ...over
+});
+
+beforeAll(async () => {
+  mongo = await MongoMemoryServer.create();
+  await mongoose.connect(mongo.getUri());
+});
+
+afterAll(async () => {
+  await mongoose.disconnect();
+  await mongo.stop();
+});
+
+beforeEach(() => AuditEvent.deleteMany({}));
+
+describe('listAuditEvents', () => {
+  it('returns one account’s trail and never anyone else’s', async () => {
+    await AuditEvent.insertMany([event(), event({ userId: 'u2', actorLabel: 'Someone else' })]);
+
+    const { events, total } = await listAuditEvents({ userId: 'u1' });
+
+    // Scoped by the query rather than filtered afterwards: the trail carries old
+    // values of journal entries, so a wider read must not be one forgotten
+    // condition away.
+    expect(total).toBe(1);
+    expect(events[0].actorLabel).toBe('Claude');
+  });
+
+  it('returns newest first, which is the only order anyone reads a trail in', async () => {
+    await AuditEvent.insertMany([
+      event({ at: new Date('2026-09-01T10:00:00Z'), resource: 'older' }),
+      event({ at: new Date('2026-09-05T10:00:00Z'), resource: 'newer' })
+    ]);
+
+    const { events } = await listAuditEvents({ userId: 'u1' });
+    expect(events.map((e) => e.resource)).toEqual(['newer', 'older']);
+  });
+
+  it('narrows to one assistant, which is the question people actually ask', async () => {
+    await AuditEvent.insertMany([
+      event({ actorCredentialId: 'client-1', actorLabel: 'Claude' }),
+      event({ actorCredentialId: 'client-2', actorLabel: 'ChatGPT' })
+    ]);
+
+    const { events } = await listAuditEvents({ userId: 'u1', credentialId: 'client-1' });
+
+    expect(events).toHaveLength(1);
+    expect(events[0].actorLabel).toBe('Claude');
+  });
+
+  it('separates what software did from what a person did', async () => {
+    await AuditEvent.insertMany([
+      event({ actorKind: 'assistant' }),
+      event({ actorKind: 'person', actorLabel: 'Tom' })
+    ]);
+
+    const { events } = await listAuditEvents({ userId: 'u1', actorKind: 'person' });
+    expect(events.map((e) => e.actorLabel)).toEqual(['Tom']);
+  });
+
+  it('narrows by action and by date range', async () => {
+    await AuditEvent.insertMany([
+      event({ action: 'delete', at: new Date('2026-09-01T10:00:00Z') }),
+      event({ action: 'delete', at: new Date('2026-09-05T10:00:00Z') }),
+      event({ action: 'read', at: new Date('2026-09-05T11:00:00Z') })
+    ]);
+
+    const { events } = await listAuditEvents({
+      userId: 'u1',
+      action: 'delete',
+      from: new Date('2026-09-03T00:00:00Z')
+    });
+
+    expect(events).toHaveLength(1);
+    expect(events[0].at).toBe('2026-09-05T10:00:00.000Z');
+  });
+
+  it('hands back the change detail, which is the reason to look', async () => {
+    await AuditEvent.insertMany([event({ action: 'update', changes: { hours: { from: 3, to: 2 } } })]);
+
+    const { events } = await listAuditEvents({ userId: 'u1' });
+    expect(events[0].changes).toEqual({ hours: { from: 3, to: 2 } });
+  });
+
+  it('pages, and caps a caller asking for everything at once', async () => {
+    await AuditEvent.insertMany(Array.from({ length: 5 }, (_, i) => event({ resource: `r${i}` })));
+
+    const { events, total, totalPages } = await listAuditEvents({ userId: 'u1', limit: 2, page: 2 });
+
+    expect(events).toHaveLength(2);
+    expect(total).toBe(5);
+    expect(totalPages).toBe(3);
+
+    const capped = await listAuditEvents({ userId: 'u1', limit: 5000 });
+    expect(capped.events.length).toBeLessThanOrEqual(200);
+  });
+});

package/src/audit/service.ts

@@ -0,0 +1,92 @@
+import { AuditEvent, type IAuditEvent } from './AuditEvent';
+import type { ActorKind } from './actor';
+
+export interface AuditQuery {
+  userId: string;
+  /** narrow to one actor — a key's id or an OAuth client id */
+  credentialId?: string;
+  actorKind?: ActorKind;
+  action?: IAuditEvent['action'];
+  resource?: string;
+  /** narrow to one area — 'relationship-service', 'album-service' */
+  service?: string;
+  from?: Date;
+  to?: Date;
+  limit?: number;
+  page?: number;
+}
+
+export interface AuditEntry {
+  id: string;
+  at: string;
+  service: string;
+  action: IAuditEvent['action'];
+  resource: string;
+  resourceId?: string;
+  actorKind: ActorKind;
+  actorLabel: string;
+  actorCredentialId?: string;
+  tenant: string;
+  changes?: Record<string, { from: unknown; to: unknown }>;
+  snapshot?: Record<string, unknown>;
+  count?: number;
+}
+
+const toEntry = (event: IAuditEvent): AuditEntry => ({
+  id: String(event._id),
+  at: event.at.toISOString(),
+  service: event.service,
+  action: event.action,
+  resource: event.resource,
+  resourceId: event.resourceId,
+  actorKind: event.actorKind,
+  actorLabel: event.actorLabel,
+  actorCredentialId: event.actorCredentialId,
+  tenant: event.tenant,
+  changes: event.changes,
+  snapshot: event.snapshot,
+  count: event.count
+});
+
+/**
+ * One account's trail, newest first.
+ *
+ * Always scoped to `userId` by the query rather than filtered afterwards, so
+ * there is no path where a wider read is one forgotten condition away. The trail
+ * carries old values of journal entries, which makes it as sensitive as the
+ * journal itself.
+ */
+export const listAuditEvents = async (
+  query: AuditQuery
+): Promise<{ events: AuditEntry[]; total: number; page: number; totalPages: number }> => {
+  const limit = Math.min(query.limit ?? 50, 200);
+  const page = Math.max(query.page ?? 1, 1);
+
+  const filter: Record<string, unknown> = { userId: query.userId };
+  if (query.credentialId) filter.actorCredentialId = query.credentialId;
+  if (query.actorKind) filter.actorKind = query.actorKind;
+  if (query.action) filter.action = query.action;
+  if (query.resource) filter.resource = query.resource;
+  if (query.service) filter.service = query.service;
+  if (query.from || query.to) {
+    const at: Record<string, Date> = {};
+    if (query.from) at.$gte = query.from;
+    if (query.to) at.$lte = query.to;
+    filter.at = at;
+  }
+
+  const [events, total] = await Promise.all([
+    AuditEvent.find(filter)
+      .sort({ at: -1 })
+      .skip((page - 1) * limit)
+      .limit(limit),
+    AuditEvent.countDocuments(filter)
+  ]);
+
+  return {
+    events: events.map(toEntry),
+    total,
+    page,
+    totalPages: Math.ceil(total / limit)
+  };
+};

package/src/index.ts

@@ -35,6 +35,7 @@ export * from './apiKeys';
 
 // OAuth 2.1 authorization server, for assistants connecting over MCP
 export * from './oauth';
+export * from './audit';
 
 // Middleware
 export { authenticateToken, optionalAuth } from './middleware/authMiddleware';

package/src/middleware/authMiddleware.test.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from 'express';
 import jwt from 'jsonwebtoken';
 import { authenticateToken, optionalAuth } from './authMiddleware';
+import { PERSONAL_TENANT } from '../apiKeys/types';
 import { mintAccessToken } from '../oauth/tokens';
 import { UserPayload } from '../types/auth';
 
@@ -192,7 +193,11 @@ describe('OAuth access tokens are not sessions', () => {
       resource: 'https://mcp.example.com',
       issuer: 'https://auth.example.com',
       scopes: ['relationship:read'],
-      groupId: null
+      tenants: [PERSONAL_TENANT],
+      defaultTenant: PERSONAL_TENANT,
+      tenantNames: {},
+      clientId: 'client-1',
+      clientName: 'Claude'
     }).accessToken;
 
   it('refuses one on a session-only route', () => {

package/src/oauth/models.ts

@@ -1,4 +1,6 @@
 import mongoose, { Document, Schema } from 'mongoose';
+import { auditPlugin } from '../audit/plugin';
+import { PERSONAL_TENANT, type Tenant } from '../apiKeys/types';
 
 /**
  * A client registered through RFC 7591 Dynamic Client Registration.
@@ -46,7 +48,13 @@ export interface IAuthorizationCode extends Document {
   userName: string;
   redirectUri: string;
   scopes: string[];
-  groupId: string | null;
+  /** every tenant the user approved, and the one chosen as the default */
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  /** what each approved tenant is called, snapshotted at consent */
+  tenantNames: Record<Tenant, string>;
+  /** the single tenant an older grant was pinned to; read by `readTenants` */
+  groupId?: string | null;
   /** RFC 8707: the MCP server this will be minted for */
   resource: string;
   /** PKCE, always S256 — the spec does not allow `plain` */
@@ -66,6 +74,10 @@ const AuthorizationCodeSchema = new Schema<IAuthorizationCode>(
     userName: { type: String, default: '' },
     redirectUri: { type: String, required: true },
     scopes: { type: [String], default: [] },
+    tenants: { type: [String], default: () => [PERSONAL_TENANT] },
+    defaultTenant: { type: String, default: PERSONAL_TENANT },
+    tenantNames: { type: Schema.Types.Mixed, default: () => ({}) },
+    // Written by the single-tenant model this replaced; read-only now.
     groupId: { type: String, default: null },
     resource: { type: String, required: true },
     codeChallenge: { type: String, required: true },
@@ -96,7 +108,11 @@ export interface IRefreshToken extends Document {
   clientId: string;
   userId: string;
   scopes: string[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
+  /** the single tenant an older grant was pinned to; read by `readTenants` */
+  groupId?: string | null;
   resource: string;
   /**
    * When the user actually connected this assistant.
@@ -118,6 +134,10 @@ const RefreshTokenSchema = new Schema<IRefreshToken>(
     clientId: { type: String, required: true },
     userId: { type: String, required: true, index: true },
     scopes: { type: [String], default: [] },
+    tenants: { type: [String], default: () => [PERSONAL_TENANT] },
+    defaultTenant: { type: String, default: PERSONAL_TENANT },
+    tenantNames: { type: Schema.Types.Mixed, default: () => ({}) },
+    // Written by the single-tenant model this replaced; read-only now.
     groupId: { type: String, default: null },
     resource: { type: String, required: true },
     grantedAt: { type: Date, default: Date.now },
@@ -129,6 +149,16 @@ const RefreshTokenSchema = new Schema<IRefreshToken>(
 
 RefreshTokenSchema.index({ userId: 1, createdAt: -1 });
 
+/**
+ * A grant appearing and being revoked is the shape of "who connected Claude,
+ * and when did it stop" — the question the connections page answers for the
+ * present and this answers for the past.
+ *
+ * `tokenHash` is redacted: it is the only thing standing between a copy of this
+ * collection and a working refresh token.
+ */
+RefreshTokenSchema.plugin(auditPlugin, { resource: 'connection', redact: ['tokenHash'] });
+
 export const RefreshToken = mongoose.models.RefreshToken
   ? (mongoose.models.RefreshToken as mongoose.Model<IRefreshToken>)
   : mongoose.model<IRefreshToken>('RefreshToken', RefreshTokenSchema);

package/src/oauth/service.test.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'crypto';
+import { PERSONAL_TENANT } from '../apiKeys/types';
 
 jest.mock('./models', () => ({
   OAuthClient: { create: jest.fn(), findOne: jest.fn(), find: jest.fn() },
@@ -122,13 +123,21 @@ describe('issueAuthorizationCode', () => {
       userName: 'Tester',
       redirectUri: 'https://claude.ai/callback',
       scopes: ['relationship:read'],
-      groupId: 'g1',
+      tenants: ['g1'],
+      defaultTenant: 'g1',
+      tenantNames: { g1: 'Irja & Tom' },
       resource: 'https://mcp.tumbaland.eu',
       codeChallenge: CHALLENGE
     });
 
     const [doc] = mockedCodeCreate.mock.calls[0];
-    expect(doc).toMatchObject({ userId: 'u1', groupId: 'g1', scopes: ['relationship:read'] });
+    expect(doc).toMatchObject({
+      userId: 'u1',
+      tenants: ['g1'],
+      defaultTenant: 'g1',
+      tenantNames: { g1: 'Irja & Tom' },
+      scopes: ['relationship:read']
+    });
     expect(doc.expiresAt.getTime() - before).toBeLessThanOrEqual(60_000);
   });
 });
@@ -224,7 +233,9 @@ describe('issueRefreshToken', () => {
       clientId: 'client-1',
       userId: 'u1',
       scopes: ['relationship:read'],
-      groupId: null,
+      tenants: [PERSONAL_TENANT],
+      defaultTenant: PERSONAL_TENANT,
+      tenantNames: {},
       resource: 'https://mcp.tumbaland.eu'
     });
 
@@ -311,7 +322,9 @@ describe('refresh tokens', () => {
       clientId: 'client-1',
       userId: 'u1',
       scopes: ['relationship:read'],
-      groupId: null,
+      tenants: [PERSONAL_TENANT],
+      defaultTenant: PERSONAL_TENANT,
+      tenantNames: {},
       resource: 'https://mcp.tumbaland.eu'
     });
 
@@ -324,7 +337,9 @@ describe('refresh tokens', () => {
     mockedRefreshFindOne.mockResolvedValue({
       userId: 'u1',
       scopes: ['relationship:read'],
-      groupId: 'g1',
+      tenants: [PERSONAL_TENANT, 'g1'],
+      defaultTenant: 'g1',
+      tenantNames: { g1: 'Irja & Tom' },
       resource: 'https://mcp.tumbaland.eu',
       grantedAt: new Date(),
       save: jest.fn()
@@ -333,7 +348,44 @@ describe('refresh tokens', () => {
     await expect(redeemRefreshToken('tok', 'client-1')).resolves.toMatchObject({
       ok: true,
       userId: 'u1',
-      groupId: 'g1'
+      tenants: { allowed: [PERSONAL_TENANT, 'g1'], default: 'g1' }
+    });
+  });
+
+  it('carries the tenants through rotation rather than re-deriving them', async () => {
+    mockedRefreshFindOne.mockResolvedValue({
+      userId: 'u1',
+      scopes: ['relationship:read'],
+      tenants: [PERSONAL_TENANT, 'g1'],
+      defaultTenant: 'g1',
+      tenantNames: { g1: 'Irja & Tom' },
+      resource: 'https://mcp.tumbaland.eu',
+      grantedAt: new Date(),
+      save: jest.fn()
+    });
+
+    await redeemRefreshToken('tok', 'client-1');
+
+    // Rotation reissues the same grant; re-deriving would quietly narrow a
+    // connection every time it refreshed.
+    const [doc] = mockedRefreshCreate.mock.calls.at(-1)!;
+    expect(doc.tenants).toEqual([PERSONAL_TENANT, 'g1']);
+    expect(doc.defaultTenant).toBe('g1');
+    expect(doc.tenantNames).toEqual({ g1: 'Irja & Tom' });
+  });
+
+  it('reads a grant issued before tenants were a set', async () => {
+    mockedRefreshFindOne.mockResolvedValue({
+      userId: 'u1',
+      scopes: ['relationship:read'],
+      groupId: 'g1',
+      resource: 'https://mcp.tumbaland.eu',
+      grantedAt: new Date(),
+      save: jest.fn()
+    });
+
+    await expect(redeemRefreshToken('tok', 'client-1')).resolves.toMatchObject({
+      tenants: { allowed: ['g1'], default: 'g1' }
     });
   });
 

package/src/oauth/service.ts

@@ -1,6 +1,11 @@
 import { createHash, randomBytes, timingSafeEqual } from 'crypto';
 import { AuthorizationCode, IAuthorizationCode, OAuthClient, RefreshToken } from './models';
-import type { ApiKeyScope } from '../apiKeys/types';
+import {
+  readTenants,
+  type ApiKeyScope,
+  type ApiKeyTenant,
+  type Tenant
+} from '../apiKeys/types';
 
 /** How long a user has between approving and the client exchanging the code. */
 const CODE_TTL_MS = 60 * 1000;
@@ -84,7 +89,9 @@ export interface IssueCodeInput {
   userName: string;
   redirectUri: string;
   scopes: ApiKeyScope[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
   resource: string;
   codeChallenge: string;
 }
@@ -166,7 +173,9 @@ export const issueRefreshToken = async (input: {
   clientId: string;
   userId: string;
   scopes: ApiKeyScope[];
-  groupId: string | null;
+  tenants: Tenant[];
+  defaultTenant: Tenant;
+  tenantNames: Record<Tenant, string>;
   resource: string;
 }): Promise<IssuedRefreshToken> => {
   await RefreshToken.updateMany(
@@ -185,7 +194,8 @@ export interface RefreshRedemption {
   reused?: boolean;
   userId?: string;
   scopes?: ApiKeyScope[];
-  groupId?: string | null;
+  tenants?: ApiKeyTenant;
+  tenantNames?: Record<Tenant, string>;
   resource?: string;
   /** the replacement the client must store; the presented one is now dead */
   rotatedToken?: string;
@@ -233,7 +243,11 @@ export const redeemRefreshToken = async (
     clientId,
     userId: record.userId,
     scopes: record.scopes,
-    groupId: record.groupId ?? null,
+    // Carried, not reset: rotation reissues the same grant, and re-deriving the
+    // tenants would quietly narrow a connection every time it refreshed.
+    tenants: record.tenants,
+    defaultTenant: record.defaultTenant,
+    tenantNames: record.tenantNames,
     resource: record.resource,
     // Carried, not reset: this is still the grant the user approved.
     grantedAt: record.grantedAt ?? record.createdAt
@@ -243,7 +257,8 @@ export const redeemRefreshToken = async (
     ok: true,
     userId: record.userId,
     scopes: record.scopes as ApiKeyScope[],
-    groupId: record.groupId ?? null,
+    tenants: readTenants(record),
+    tenantNames: record.tenantNames ?? {},
     resource: record.resource,
     rotatedToken: rotated
   };
@@ -271,7 +286,10 @@ export const listConnections = async (userId: string) => {
     clientId: token.clientId,
     clientName: nameById.get(token.clientId) ?? 'Unknown app',
     scopes: token.scopes,
-    groupId: token.groupId ?? null,
+    ...(({ allowed, default: fallback }) => ({ tenants: allowed, defaultTenant: fallback }))(
+      readTenants(token)
+    ),
+    tenantNames: token.tenantNames ?? {},
     createdAt: (token.grantedAt ?? token.createdAt).toISOString(),
     // Set when the refresh token is exchanged, not when a tool runs — access
     // tokens are validated statelessly, so the server never sees ordinary use.

package/src/oauth/tokens.test.ts

@@ -1,6 +1,7 @@
 const ORIGINAL_ENV = process.env;
 
 import jwt from 'jsonwebtoken';
+import { PERSONAL_TENANT } from '../apiKeys/types';
 import { mintAccessToken, verifyAccessToken, parseScopes } from './tokens';
 
 const RESOURCE = 'https://mcp.tumbaland.eu';
@@ -14,7 +15,11 @@ const mint = (over: Partial<Parameters<typeof mintAccessToken>[0]> = {}) =>
     resource: RESOURCE,
     issuer: ISSUER,
     scopes: ['relationship:read', 'relationship:write'],
-    groupId: null,
+    tenants: [PERSONAL_TENANT],
+    defaultTenant: PERSONAL_TENANT,
+    tenantNames: { [PERSONAL_TENANT]: 'My own data' },
+    clientId: 'client-1',
+    clientName: 'Claude',
     ...over
   });
 
@@ -38,9 +43,21 @@ describe('mintAccessToken', () => {
     expect(expiresIn).toBe(3600);
   });
 
-  it('carries the tenant pin, so a token cannot wander between groups', () => {
-    const claims = jwt.decode(mint({ groupId: 'g1' }).accessToken) as Record<string, unknown>;
-    expect(claims.groupId).toBe('g1');
+  it('carries the granted tenants, so a token cannot wander outside them', () => {
+    const claims = jwt.decode(
+      mint({ tenants: [PERSONAL_TENANT, 'g1'], defaultTenant: 'g1' }).accessToken
+    ) as Record<string, unknown>;
+
+    expect(claims.tenants).toEqual([PERSONAL_TENANT, 'g1']);
+    expect(claims.defaultTenant).toBe('g1');
+  });
+
+  it('carries what each tenant is called, since nothing downstream can look it up', () => {
+    const claims = jwt.decode(
+      mint({ tenants: ['g1'], defaultTenant: 'g1', tenantNames: { g1: 'Irja & Tom' } }).accessToken
+    ) as Record<string, unknown>;
+
+    expect(claims.tenantNames).toEqual({ g1: 'Irja & Tom' });
   });
 
   it('gives every token a distinct id', () => {
@@ -59,7 +76,7 @@ describe('verifyAccessToken', () => {
       userId: 'u1',
       email: 'u1@example.com',
       scopes: ['relationship:read', 'relationship:write'],
-      groupId: null
+      tenants: { allowed: [PERSONAL_TENANT], default: PERSONAL_TENANT }
     });
   });