release: WRNexusJS 0.8.0

packages/core/test/fullstack-primitives.test.ts

@@ -9,6 +9,9 @@ import {
   defineFeatureFlags,
   defineLoader,
   tenantFromSubdomain,
+  assertTenantAccess,
+  createTenantDirectory,
+  tenantKey,
   tracingMiddleware,
 } from "../src/index.ts";
 
@@ -37,6 +40,31 @@ test("typed endpoints validate authentication and preserve a stable JSON envelop
   });
 });
 
+test("tenant boundaries, memberships, workspaces, quotas, and audit events fail closed", async () => {
+  const events: string[] = [];
+  const directory = createTenantDirectory({
+    audit: (event) => {
+      events.push(event.action);
+    },
+    now: () => 10,
+  });
+  await directory.addMembership({ tenantId: "acme", userId: "u1", workspaceIds: ["north"] });
+  expect(await directory.switchWorkspace("acme", "u1", "north")).toEqual({
+    tenantId: "acme",
+    workspaceId: "north",
+  });
+  await expect(directory.switchWorkspace("acme", "u1", "south")).rejects.toThrow(
+    "WRN-TENANT-WORKSPACE-DENIED",
+  );
+  directory.setQuota("acme", "storage", 100);
+  expect(() => directory.enforceQuota("acme", "storage", 90, 11)).toThrow("WRN-TENANT-QUOTA");
+  expect(() => assertTenantAccess({ id: "acme" }, { tenantId: "other" })).toThrow(
+    "WRN-TENANT-CROSS-ACCESS",
+  );
+  expect(tenantKey("acme", "cache", 1)).toBe("tenant:acme:cache:1");
+  expect(events).toEqual(["membership.added", "workspace.switched"]);
+});
+
 test("loaders, actions, and request-local dedupe remain framework-agnostic", async () => {
   let calls = 0;
   const loader = defineLoader({ load: async () => ({ ready: true }) });