@cosmicdrift/kumiko-bundled-features 0.105.1 → 0.105.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.105.1",
+  "version": "0.105.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -93,11 +93,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.105.1",
-    "@cosmicdrift/kumiko-framework": "0.105.1",
-    "@cosmicdrift/kumiko-headless": "0.105.1",
-    "@cosmicdrift/kumiko-renderer": "0.105.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.105.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.105.2",
+    "@cosmicdrift/kumiko-framework": "0.105.2",
+    "@cosmicdrift/kumiko-headless": "0.105.2",
+    "@cosmicdrift/kumiko-renderer": "0.105.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.105.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -15,7 +15,7 @@
 //   5. DB-State + Membership + Cookies/JWT verifizieren
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createSystemUser,
   type SessionUser,
@@ -38,7 +38,11 @@ import { createRendererFoundationFeature } from "../../renderer-foundation/featu
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
-import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import {
+  INVITATION_STATUS,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+} from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
@@ -46,6 +50,7 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
+import { storeInviteToken } from "../invite-token-store";
 import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
@@ -254,6 +259,12 @@ describe("invite-create", () => {
     const rows = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["role"]).toBe("Editor");
+
+    // inviteEmail() only reads emailTransport.sent.at(-1) — a silent second-
+    // dispatch failure would still leave sent.length===1 and .at(-1) pointing
+    // at the FIRST mail, making secondToken===firstToken pass for the wrong
+    // reason. Assert an actual second dispatch happened.
+    expect(emailTransport.sent).toHaveLength(2);
   });
 });
 
@@ -403,6 +414,105 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
   });
 });
 
+describe("invite-accept defense-in-depth (assertAssignableMembershipRoles)", () => {
+  test("a forbidden role planted directly on the invitation row (bug/migration) is rejected, not silently granted", async () => {
+    // Simulates the ONE scenario this depth-layer exists for: a forbidden role
+    // reaching the invitation row through some path OTHER than invite-create
+    // (which already validates at request time — see "privilege escalation"
+    // below). A DB migration or direct write is the only realistic vector.
+    const fakeInvitationId = crypto.randomUUID();
+    await insertOne(stack.db, tenantInvitationsTable, {
+      id: fakeInvitationId,
+      tenantId: TENANT_A_ID,
+      email: BOB_EMAIL,
+      role: "SystemAdmin",
+      status: INVITATION_STATUS.pending,
+      invitedBy: aliceId,
+      expiresAt: "2030-01-01T00:00:00Z",
+    });
+    const token = crypto.randomUUID();
+    await storeInviteToken(stack.redis.redis, {
+      invitationId: fakeInvitationId,
+      token,
+      ttlSeconds: 3600,
+    });
+
+    const res = await authedRaw("POST", "/api/auth/invite-accept", { token }, bobSession());
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error?: { code?: string } };
+    expect(body.error?.code).toBe("access_denied");
+
+    // No membership was granted.
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, { userId: bobId });
+    expect(memberships).toHaveLength(1); // only the seeded Tenant-B membership
+  });
+});
+
+describe("invite-accept-with-login/signup-complete defense-in-depth (637/1)", () => {
+  // Branch 1 (invite-accept, logged-in) and Branch 3 (invite-signup-complete)
+  // both route every new membership through seedTenantMembership, which
+  // calls assertAssignableMembershipRoles unconditionally (tenant/seeding.ts)
+  // — a forbidden invitation role is rejected outright, 403, before it ever
+  // reaches stripForbiddenMembershipRoles. Branch 2 (invite-accept-with-login)
+  // is different: it skips seedTenantMembership entirely when the user is
+  // ALREADY a member of the invited tenant (idempotent-accept path) — for
+  // that one case, stripForbiddenMembershipRoles at the session mint is the
+  // ONLY protection. Removing that call would silently mint a
+  // SystemAdmin-carrying session with no other test catching it.
+  test("invite-accept-with-login: already-member path strips a forbidden invitation role (seedTenantMembership's guard is skipped here)", async () => {
+    // Bob already has a (legitimate) membership in TENANT_A_ID — the
+    // handler's alreadyMember check short-circuits before seedTenantMembership,
+    // so assertAssignableMembershipRoles never runs for this accept.
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    // Create through the real command (valid role → real stream + version),
+    // then corrupt the row directly — the migration/DB-surgery scenario this
+    // depth-layer guards against, same framing as the Branch-1 test above.
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${tenantInvitationsTable.tableName}" SET "role" = 'SystemAdmin' WHERE "email" = $1`,
+      [BOB_EMAIL],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user: { roles: string[] } };
+    expect(body.user.roles).toEqual([]);
+  });
+
+  test("invite-signup-complete: a brand-new user always hits seedTenantMembership's guard — forbidden role rejected, not silently stripped", async () => {
+    // Unlike Branch 2, a brand-new user can never be "already a member" —
+    // seedTenantMembership (and its assertAssignableMembershipRoles guard)
+    // runs unconditionally. Pins that this branch is NOT exposed to the
+    // Branch-2 gap, so a future refactor that adds an alreadyMember-style
+    // skip here would be caught immediately.
+    const daveEmail = "dave@example.com";
+    const token = await inviteEmail(daveEmail, "Admin");
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${tenantInvitationsTable.tableName}" SET "role" = 'SystemAdmin' WHERE "email" = $1`,
+      [daveEmail],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "dave-new-pw-1234",
+    });
+    expect(res.status).toBe(403);
+
+    // No user or membership was created — the whole write rolled back.
+    const daveRows = await selectMany(stack.db, userTable, { email: daveEmail });
+    expect(daveRows).toHaveLength(0);
+  });
+});
+
 describe("Single-Use-Burn (alle Branches)", () => {
   test("Branch 1: zweiter accept mit gleichem Token → invalid", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");

package/src/custom-fields/web/__tests__/custom-fields-form-section.test.tsx

@@ -300,11 +300,17 @@ describe("CustomFieldsFormSection — clear-Pfad", () => {
     );
 
     const vendorInput = document.getElementById("custom-field-vendor") as HTMLInputElement;
+    const saveBtn = screen.getByTestId("custom-fields-form-save") as HTMLButtonElement;
     // Tippen + zurück auf den Bestandswert → nicht dirty, kein Write.
     await user.type(vendorInput, "2");
     await user.type(vendorInput, "{Backspace}");
-    await user.click(screen.getByTestId("custom-fields-form-save"));
-    await waitFor(() => expect(dispatchSpy).not.toHaveBeenCalled());
+    // Positiver Anker: erst abwarten, dass der Save-Button wieder disabled ist
+    // (beweist, dass die dirty-Neuberechnung durchgelaufen ist), statt direkt
+    // eine negative Assertion in waitFor zu pollen (die beim ersten Tick
+    // trivial besteht und keine ausstehenden Async-Effekte abwartet).
+    await waitFor(() => expect(saveBtn.disabled).toBe(true));
+    await user.click(saveBtn);
+    expect(dispatchSpy).not.toHaveBeenCalled();
   });
 });
 

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -13,12 +13,14 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../feature";
 import { runRetentionCleanup } from "../run-retention-cleanup";
@@ -52,13 +54,37 @@ const staleEntity = createEntity({
   retention: { keepFor: "30d", strategy: "hardDelete", reference: "lastSeenAt" },
 });
 
+// blockDelete = Aufbewahrungspflicht (HGB/DSGVO-Presets: invoice/booking/
+// contract). Der Cleanup-Job muss diese Rows IGNORIEREN — nur user-forget
+// darf sie anonymisieren. Ein Regress im switch-Default oder im blockDelete-
+// Case, der sie trotzdem löscht, wäre schwerwiegender als ein verpasstes
+// hardDelete (Aufbewahrungspflicht-Verletzung statt nur "zu spät aufgeräumt").
+const retainedEntity = createEntity({
+  table: "read_c7_retained",
+  fields: {
+    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+  },
+  retention: { keepFor: "30d", strategy: "blockDelete" },
+});
+
 const c7Feature = defineFeature("c7-retention-fixtures", (r) => {
   r.entity("c7-widget", widgetEntity);
   r.entity("c7-gadget", gadgetEntity);
   r.entity("c7-plain", plainEntity);
   r.entity("c7-stale", staleEntity);
+  r.entity("c7-retained", retainedEntity);
 });
 
+const noopLogger: JobContext["log"] = {
+  info() {},
+  warn() {},
+  error() {},
+  debug() {},
+  child() {
+    return noopLogger;
+  },
+};
+
 const T1 = "11111111-1111-1111-1111-111111111111";
 const T2 = "22222222-2222-2222-2222-222222222222";
 
@@ -75,6 +101,7 @@ beforeAll(async () => {
     gadgetEntity,
     plainEntity,
     staleEntity,
+    retainedEntity,
   ]) {
     await unsafeCreateEntityTable(stack.db, e);
   }
@@ -111,7 +138,13 @@ async function liveGadgetLabels(tenantId: string): Promise<string[]> {
 }
 
 beforeEach(async () => {
-  for (const t of ["read_c7_widget", "read_c7_gadget", "read_c7_plain", "read_c7_stale"]) {
+  for (const t of [
+    "read_c7_widget",
+    "read_c7_gadget",
+    "read_c7_plain",
+    "read_c7_stale",
+    "read_c7_retained",
+  ]) {
     await asRawClient(stack.db).unsafe(`DELETE FROM ${t}`);
   }
 });
@@ -185,4 +218,46 @@ describe("runRetentionCleanup :: real postgres", () => {
     });
     expect(result.hardDeleted).toBe(0);
   });
+
+  test("the registered job handler resolves ctx.systemUser.tenantId and actually cleans up (not runRetentionCleanup called directly)", async () => {
+    // cleanup-cron-registration.test.ts only pins job metadata; runRetentionCleanup
+    // tests above call it directly, bypassing the handler body entirely — a bug in
+    // the ctx.systemUser?.tenantId ?? ctx._tenantId resolution or the throw-guard
+    // would be invisible to both. Invoke the ACTUAL registered handler.
+    await seed("read_c7_widget", T1, "expired-via-handler", pastIso);
+    await seed("read_c7_widget", T1, "fresh-via-handler", withinIso);
+
+    const job = stack.registry.getJob("data-retention:job:retention-cleanup");
+    expect(job).toBeDefined();
+    if (!job) return;
+
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      systemUser: { id: "system", tenantId: T1, roles: ["all"] },
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await job.handler({}, ctx);
+
+    expect(await labels("read_c7_widget", T1)).toEqual(["fresh-via-handler"]);
+  });
+
+  test("blockDelete: past-cutoff rows are never touched by the cleanup job", async () => {
+    await seed("read_c7_retained", T1, "should-survive", pastIso);
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(await labels("read_c7_retained", T1)).toEqual(["should-survive"]);
+    expect(result.hardDeleted).toBe(0);
+    expect(result.softDeleted).toBe(0);
+    expect(result.anonymizeDeferred).not.toContain("c7-retained");
+  });
 });

package/src/folders/__tests__/folders.integration.test.ts

@@ -18,6 +18,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { folderAssignmentDeleteHook, folderDeleteHook } from "../../folders-user-data/hooks";
 import { FoldersHandlers, FoldersQueries } from "../constants";
 import { folderAssignmentEntity, folderEntity } from "../entity";
 import { createFoldersFeature } from "../feature";
@@ -288,3 +289,57 @@ describe("folders integration — openToAll access model", () => {
     expect(denied.httpStatus).toBe(403);
   });
 });
+
+// GDPR Art. 17 forget: the folder tables are tenant-scoped (no per-user owner
+// column), so per-user erasure via these hooks is only safe when the tenant
+// is effectively single-user. A wrong/missing guard here would delete
+// co-members' folders on a shared tenant — exercise the hooks directly
+// (not a synthetic stand-in) against real seeded rows.
+describe("folders-user-data — tenantScopedDelete hooks", () => {
+  async function seedOneFolderWithAssignment(): Promise<void> {
+    const f = await createFolder("to-be-erased");
+    await setFolder(f, "credit-erase");
+  }
+
+  test("multi-user tenant: no-op, rows survive", async () => {
+    await seedOneFolderWithAssignment();
+    const ctx = {
+      db: stack.db,
+      tenantId: admin.tenantId,
+      userId: admin.id,
+      tenantModel: "multi-user" as const,
+    };
+    await folderDeleteHook(ctx, "delete");
+    await folderAssignmentDeleteHook(ctx, "delete");
+    expect(await listFolders()).toHaveLength(1);
+    expect(await countAssignments(admin.tenantId)).toBe(1);
+  });
+
+  test("anonymize strategy: no-op even on a single-user tenant", async () => {
+    await seedOneFolderWithAssignment();
+    const ctx = {
+      db: stack.db,
+      tenantId: admin.tenantId,
+      userId: admin.id,
+      tenantModel: "single-user" as const,
+    };
+    await folderDeleteHook(ctx, "anonymize");
+    await folderAssignmentDeleteHook(ctx, "anonymize");
+    expect(await listFolders()).toHaveLength(1);
+    expect(await countAssignments(admin.tenantId)).toBe(1);
+  });
+
+  test("single-user tenant + delete: rows are purged", async () => {
+    await seedOneFolderWithAssignment();
+    const ctx = {
+      db: stack.db,
+      tenantId: admin.tenantId,
+      userId: admin.id,
+      tenantModel: "single-user" as const,
+    };
+    await folderDeleteHook(ctx, "delete");
+    await folderAssignmentDeleteHook(ctx, "delete");
+    expect(await listFolders()).toHaveLength(0);
+    expect(await countAssignments(admin.tenantId)).toBe(0);
+  });
+});

package/src/folders/web/__tests__/folder-manager.test.tsx

@@ -203,5 +203,67 @@ describe("FolderManager filing mode", () => {
         entityId: "c-1",
       }),
     );
+
+    // Dropping the per-leaf-override entity onto the unfiled bucket clears it
+    // with ITS OWN entityType, not the tree default — same override/fallback
+    // resolution the folder-drop above proved, now exercised on clearFolder.
+    dropLeaf("folder-node-unfiled", "b-1");
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(FoldersHandlers.clearFolder, {
+        entityType: "bauspar",
+        entityId: "b-1",
+      }),
+    );
+  });
+
+  test("dragLeave onto a child element keeps the highlight; leaving the row entirely clears it", () => {
+    folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
+    render(
+      <Wrapper>
+        <FolderManager filing={filingWith(() => {})} />
+      </Wrapper>,
+    );
+    const row = screen.getByTestId("folder-node-f1");
+    const childButton = screen.getByTestId("folder-delete-f1");
+
+    fireEvent.dragOver(row, { dataTransfer: {} });
+    expect(row.className).toContain("ring-primary/40");
+
+    // jsdom/happy-dom's DragEvent constructor ignores `relatedTarget` in the
+    // init dict (unlike real browsers), so it has to be forced on via
+    // defineProperty rather than passed through fireEvent.dragLeave(el, init).
+    const leaveTo = (relatedTarget: Element): void => {
+      const evt = new DragEvent("dragleave", { bubbles: true, cancelable: true });
+      Object.defineProperty(evt, "relatedTarget", { value: relatedTarget, configurable: true });
+      fireEvent(row, evt);
+    };
+
+    // Regression #671/3: bubbling from a child (chevron/icon/label) must NOT
+    // clear the highlight — onDragOver re-sets it a micro-task later anyway,
+    // so an unconditional clear here just flickers.
+    leaveTo(childButton);
+    expect(row.className).toContain("ring-primary/40");
+
+    leaveTo(document.body);
+    expect(row.className).not.toContain("ring-primary/40");
+  });
+
+  test("the unfiled bucket stays a drop target even when nothing is currently unfiled", () => {
+    folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
+    const allFiled: FolderFiling = {
+      entityType: "credit",
+      leavesByFolder: new Map([["f1", [{ id: "c-1", label: "Credit 1" }]]]),
+      unfiled: [],
+      unfiledLabel: "Unfiled",
+      onReassigned: () => {},
+    };
+    render(
+      <Wrapper>
+        <FolderManager filing={allFiled} />
+      </Wrapper>,
+    );
+    // Regression #671/5: an empty `unfiled` array must not remove the bucket —
+    // it's the only drop target to un-file a leaf back out of its folder.
+    expect(screen.getByTestId("folder-node-unfiled")).toBeTruthy();
   });
 });

package/src/folders/web/folder-manager.tsx

@@ -267,7 +267,10 @@ export function FolderManager({
             e.dataTransfer.dropEffect = "move";
             setDragOverKey(key);
           },
-          onDragLeave: () => setDragOverKey((cur) => (cur === key ? null : cur)),
+          onDragLeave: (e: DragEvent<HTMLDivElement>) => {
+            if (!e.currentTarget.contains(e.relatedTarget as Node))
+              setDragOverKey((cur) => (cur === key ? null : cur));
+          },
           onDrop: (e: DragEvent<HTMLDivElement>) => {
             e.preventDefault();
             setDragOverKey(null);
@@ -509,7 +512,11 @@ export function FolderManager({
   };
   walk(tree, 0);
 
-  const hasUnfiled = filing !== undefined && filing.unfiled.length > 0;
+  // The bucket itself must stay in the tree even when nothing is currently
+  // unfiled — it's the only drop target to un-file a leaf back out of a
+  // folder. Regression: #671/5 — an empty `unfiled` array made the bucket
+  // vanish entirely, silently removing that escape hatch.
+  const hasUnfiled = filing !== undefined;
   if (hasUnfiled) {
     out.push(bucketRow(stripeNext()));
     if (!collapsed.has(UNFILED))

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -160,6 +160,16 @@ describe("managed-pages :: Cache + Security-Header", () => {
     });
     expect(second.status).toBe(304);
   });
+
+  test("HEAD → 200 without body, etag present", async () => {
+    // legal-pages got this HEAD-early-exit test alongside its identical
+    // Cache/Header pattern; managed-pages received the same HEAD codepath
+    // in the same PR but not the test.
+    const res = await stack.app.request("http://a.example.com/p/about", { method: "HEAD" });
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe("");
+    expect(res.headers.get("etag")).toBeTruthy();
+  });
 });
 
 describe("managed-pages :: XSS-Härtung", () => {

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -500,6 +500,22 @@ describe("sessions feature — locked accounts blocked on a live session", () =>
     expect(body.error?.details?.reason).toBe("blocked");
   });
 
+  test("fail-open invariant: read_users row hard-gone (not soft-deleted) → session stays live", async () => {
+    // The defense-in-depth read_users lookup must fail OPEN on a miss —
+    // revocation is the primary control. If `if (user && ...)` ever regressed
+    // to `if (!user || ...)`, a missing user row would turn this second layer
+    // into a global lockout for every affected session instead of a no-op.
+    const { userId } = await h.seedUser("hardgone@example.com", "pw-long-enough");
+    const { token } = await h.login("hardgone@example.com", "pw-long-enough");
+    await deleteMany(stack.db, userTable, { id: userId });
+
+    const res = await h.authedPost("/api/query", token, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(res.status).toBe(200);
+  });
+
   test("deletionRequested keeps its session live — reversible grace period", async () => {
     const { userId } = await h.seedUser("leaving@example.com", "pw-long-enough");
     const { token } = await h.login("leaving@example.com", "pw-long-enough");

package/src/user/__tests__/user.integration.test.ts

@@ -197,3 +197,39 @@ describe("scenario 4: detail + list access", () => {
     expect(res.status).toBe(403);
   });
 });
+
+// --- Scenario 8 (575/1): entityEdit round-trip via convention QNs ---
+//
+// The boot-validator does not check that an entityEdit has a matching
+// update/detail handler — the tenant feature closes this gap with its own
+// scenario 8 (create -> detail -> update -> reload -> assert); user had no
+// equivalent. Scenarios 3/4 exercise update and detail separately (update
+// verified via the `me` query, detail verified as a read-only fetch) but
+// never chain detail -> update -> detail the way the entityEdit screen
+// actually drives its data — this is that missing round-trip proof.
+
+describe("scenario 8: entityEdit round-trip via convention QNs", () => {
+  test("user:query:user:detail + user:write:user:update round-trip (entityEdit save persists)", async () => {
+    const created = await seedUser({ email: "roundtrip@example.com", displayName: "Before" });
+
+    const loaded = await stack.http.queryOk<Record<string, unknown>>(
+      UserQueries.detail,
+      { id: created.id },
+      systemAdmin,
+    );
+    expect(loaded["displayName"]).toBe("Before");
+
+    await stack.http.writeOk(
+      UserHandlers.update,
+      { id: created.id, changes: { displayName: "After" }, version: loaded["version"] },
+      systemAdmin,
+    );
+
+    const reloaded = await stack.http.queryOk<Record<string, unknown>>(
+      UserQueries.detail,
+      { id: created.id },
+      systemAdmin,
+    );
+    expect(reloaded["displayName"]).toBe("After");
+  });
+});

package/src/user-data-rights/__tests__/file-binary-forget-cleanup.integration.test.ts

@@ -8,7 +8,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
   type FileStorageProvider,
@@ -21,7 +21,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { bridgeStub, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createConfigAccessorFactory } from "../../config/feature";
@@ -53,6 +53,7 @@ let seed: ForgetSeeders;
 // Per-tenant resolver the forget pipeline uses — built from the stack's
 // configResolver, resolves "test" → the test provider plugin → `provider`.
 let buildStorageProvider: (tenantId: string) => Promise<FileStorageProvider>;
+let configResolverForJobCtx: ReturnType<typeof createConfigResolver>;
 
 const TENANT = "00000000-0000-4000-8000-00000000000c";
 
@@ -67,6 +68,7 @@ beforeAll(async () => {
   // via a config app-override (no admin write needed).
   const appOverrides = new Map<string, string>([[FILE_PROVIDER_CONFIG_KEY, "test"]]);
   const resolver = createConfigResolver({ appOverrides });
+  configResolverForJobCtx = resolver;
   stack = await setupTestStack({
     features: [
       createConfigFeature(),
@@ -176,3 +178,43 @@ describe("forget-binary-cleanup :: storage.delete fires before row hard-delete",
     expect(await provider.exists(otherKey)).toBe(true);
   });
 });
+
+describe("run-forget-cleanup :: registered cron actually erases binaries (not just row-only)", () => {
+  test("the registered job — via a real configResolver + file-provider — deletes the binary", async () => {
+    // The dedicated cron-registration test (run-forget-cleanup.integration.test.ts)
+    // drives the job with `{ db, registry }` only — no configResolver, no file
+    // provider registered. `resolveProvider` throws internally, `resolveProvider`
+    // failure is caught and the hook does a row-only delete. So the cron proves
+    // status-flip + PII-anonymize but NEVER the actual Art.17 binary-erasure path.
+    const userId = uuid(4);
+    await seed.seedForgetUser(userId);
+    await seed.seedMembership(userId, TENANT);
+    const key = await seed.seedFile(uuid(401), TENANT, userId);
+    expect(await provider.exists(key)).toBe(true);
+
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeDefined();
+    if (!job) return;
+
+    const ctx: JobContext = {
+      db,
+      registry: stack.registry,
+      configResolver: configResolverForJobCtx,
+      systemUser: { id: SYSTEM_USER_ID, tenantId: TENANT, roles: ["all"] },
+      log: {
+        info() {},
+        warn() {},
+        error() {},
+        debug() {},
+        child(): JobContext["log"] {
+          return this;
+        },
+      },
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await job.handler({}, ctx);
+
+    expect(await provider.exists(key)).toBe(false);
+  });
+});

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
@@ -36,7 +36,7 @@ describe("user-data-rights read-only inspector screens", () => {
     );
     const list = f.screens["export-job-list"];
     expect(list?.type).toBe("entityList");
-    expect(list?.access).toEqual({ roles: ["SystemAdmin"] });
+    expect(list?.access).toEqual({ roles: access.systemAdmin });
   });
 
   test("export-job detail is strictly read-only (no create/delete, every field readOnly)", () => {

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -15,8 +15,17 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { randomBytes } from "node:crypto";
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
-import { createRegistry, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createRegistry,
+  type Registry,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  archiveStream,
+  createEventsTable,
+  eventsTable,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createProjectionStateTable,
   rebuildProjection,
@@ -232,4 +241,54 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     }>;
     expect(survived[0]?.status).toBe(USER_STATUS.Restricted);
   });
+
+  test("a corrupt row (stream archived out from under it) is reported in `failed` — the rest of the estate still backfills", async () => {
+    // Real-world corruption: a stale tenant-lifecycle cleanup or an operator
+    // mistake archives a user's event stream while the read_users row still
+    // physically exists. This must land in `failed`, not abort the whole run
+    // — everything after it in the estate scan would otherwise silently miss
+    // its user.updated backfill (DSGVO data-loss on an unrelated row).
+    const hash = await hashPassword(ALICE_PW);
+    const goodRow = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
+      TestUsers.systemAdmin,
+    );
+    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
+
+    const badRow = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
+      TestUsers.systemAdmin,
+    );
+    await updateMany(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
+    // userEntity is systemStream:true (schema/user.ts) — its event stream
+    // lives on SYSTEM_TENANT_ID regardless of the creating tenant. Archiving
+    // under any other tenant would be a silent no-op against assertStreamWritable.
+    await archiveStream(stack.db, {
+      tenantId: SYSTEM_TENANT_ID,
+      aggregateId: badRow.id,
+      aggregateType: "user",
+      archivedBy: "test-corruption",
+    });
+
+    const { backfilled, failed } = await backfillUserLifecycleEvents(stack.db);
+
+    expect(failed).toHaveLength(1);
+    expect(failed[0]?.id).toBe(badRow.id);
+    expect(backfilled).toBeGreaterThanOrEqual(1);
+
+    // Proof the loop didn't abort at the corrupt row: rebuild the projection —
+    // goodRow got its user.updated event (survives), badRow never did (wiped
+    // back to Active, exactly the data-loss this backfill exists to prevent).
+    await rebuildProjection(USER_PROJECTION, { db: stack.db, registry });
+    const rows = (await selectMany(stack.db, userTable, {})) as Array<{
+      id: string;
+      status: string;
+    }>;
+    const good = rows.find((r) => r.id === goodRow.id);
+    const bad = rows.find((r) => r.id === badRow.id);
+    expect(good?.status).toBe(USER_STATUS.Restricted);
+    expect(bad?.status).toBe(USER_STATUS.Active);
+  });
 });

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -19,6 +19,7 @@ import {
   createTextField,
   defineFeature,
   EXT_USER_DATA,
+  type JobContext,
   SYSTEM_USER_ID,
   type UserDataDeleteHook,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -29,6 +30,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -199,3 +201,43 @@ describe("forget pipeline honours the effective tenant model", () => {
     expect(await rowCount()).toBe(1);
   });
 });
+
+describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {
+  test("the registered job resolves tenantModel via resolveAppTenantModel and actually erases", async () => {
+    // Every test above passes tenantModel as a literal string straight into
+    // runForgetCleanup — none exercise the job's OWN glue (feature.ts:
+    // resolveAppTenantModel(...) → runForgetCleanup({..., tenantModel})). A
+    // key-mismatch, forgotten argument, or wrong db-handle at either call site
+    // would pass every test above and still be broken in production.
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c4");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    await seed(stack.db).seedMembership(FORGET_USER, TENANT);
+
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeDefined();
+    if (!job) return;
+
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      configResolver: createConfigResolver({
+        appOverrides: new Map([[TENANT_MODEL_CONFIG_KEY, "single-user"]]),
+      }),
+      systemUser: { id: SYSTEM_USER_ID, tenantId: TENANT, roles: ["all"] },
+      log: {
+        info() {},
+        warn() {},
+        error() {},
+        debug() {},
+        child(): JobContext["log"] {
+          return this;
+        },
+      },
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await job.handler({}, ctx);
+
+    expect(await rowCount()).toBe(0);
+  });
+});

package/src/user-data-rights/run-forget-cleanup.ts

@@ -314,7 +314,14 @@ async function processUser(args: {
 
           hookCallsAttempted++;
           await entry.deleteHook(
-            { db: tx, tenantId, userId, buildStorageProvider, tenantModel },
+            {
+              db: tx,
+              tenantId,
+              userId,
+              buildStorageProvider,
+              tenantModel,
+              userEmailBeforeDelete,
+            },
             strategy,
           );
         }

package/src/user-data-rights/screens.ts

@@ -1,6 +1,7 @@
-import type {
-  EntityEditScreenDefinition,
-  EntityListScreenDefinition,
+import {
+  access,
+  type EntityEditScreenDefinition,
+  type EntityListScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 
 // Read-only operator inspector for the GDPR data-rights read-models. All
@@ -28,7 +29,7 @@ export const exportJobListScreen: EntityListScreenDefinition = {
     },
   ],
   searchable: false,
-  access: { roles: ["SystemAdmin"] },
+  access: { roles: access.systemAdmin },
 };
 
 export const exportJobDetailScreen: EntityEditScreenDefinition = {
@@ -58,7 +59,7 @@ export const exportJobDetailScreen: EntityEditScreenDefinition = {
   // exists, and the export lifecycle is driven by the worker, not an operator.
   allowCreate: false,
   allowDelete: false,
-  access: { roles: ["SystemAdmin"] },
+  access: { roles: access.systemAdmin },
 };
 
 export const downloadAttemptListScreen: EntityListScreenDefinition = {
@@ -67,5 +68,5 @@ export const downloadAttemptListScreen: EntityListScreenDefinition = {
   entity: "download-attempt",
   columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
   searchable: false,
-  access: { roles: ["SystemAdmin"] },
+  access: { roles: access.systemAdmin },
 };

package/src/user-data-rights/web/__tests__/privacy-center-screen.test.tsx

@@ -48,9 +48,11 @@ type QueryResponses = {
 function makeDispatcher(
   responses: QueryResponses,
   writes: Array<{ type: string; payload: unknown }>,
+  queries: Array<{ type: string; payload: unknown }> = [],
 ): Dispatcher {
   const statusStore = createStore<DispatcherStatus>("online");
-  const query = (async (type: string) => {
+  const query = (async (type: string, payload: unknown) => {
+    queries.push({ type, payload });
     if (type === USER_ME_QUERY) return { isSuccess: true, data: responses.me };
     if (type === UserDataRightsQueries.exportStatus) {
       return { isSuccess: true, data: responses.exportStatus ?? { hasJob: false } };
@@ -74,11 +76,16 @@ function makeDispatcher(
   } as unknown as Dispatcher; // @cast-boundary test-stub
 }
 
-function renderCenter(responses: QueryResponses): {
+function renderCenter(
+  responses: QueryResponses,
+  opts: { readonly showDeletion?: boolean } = {},
+): {
   view: ReturnType<typeof render>;
   writes: Array<{ type: string; payload: unknown }>;
+  queries: Array<{ type: string; payload: unknown }>;
 } {
   const writes: Array<{ type: string; payload: unknown }> = [];
+  const queries: Array<{ type: string; payload: unknown }> = [];
   const wrapper = ({ children }: { readonly children: ReactNode }): ReactNode => (
     <TokensProvider value={stubTokens}>
       <LocaleProvider
@@ -87,7 +94,7 @@ function renderCenter(responses: QueryResponses): {
       >
         <PrimitivesProvider value={defaultPrimitives}>
           <LiveEventsProvider value={stubLiveEvents}>
-            <DispatcherProvider dispatcher={makeDispatcher(responses, writes)}>
+            <DispatcherProvider dispatcher={makeDispatcher(responses, writes, queries)}>
               {children}
             </DispatcherProvider>
           </LiveEventsProvider>
@@ -95,8 +102,10 @@ function renderCenter(responses: QueryResponses): {
       </LocaleProvider>
     </TokensProvider>
   );
-  const view = render(<PrivacyCenterScreen />, { wrapper });
-  return { view, writes };
+  const view = render(<PrivacyCenterScreen showDeletion={opts.showDeletion ?? true} />, {
+    wrapper,
+  });
+  return { view, writes, queries };
 }
 
 const activeMe = {
@@ -197,6 +206,32 @@ describe("PrivacyCenterScreen", () => {
     });
     expect(writes[0]?.type).toBe(UserDataRightsHandlers.requestExport);
   });
+
+  test("showDeletion=false: keine Lösch-Sektion", async () => {
+    const { view } = renderCenter({ me: activeMe }, { showDeletion: false });
+    await waitForMount(view);
+    expect(view.queryByTestId("privacy-deletion")).toBeNull();
+    expect(view.queryByTestId("privacy-deletion-delete")).toBeNull();
+  });
+
+  test("Download-Button dispatcht downloadByJob mit der korrekten jobId", async () => {
+    const { view, queries } = renderCenter({
+      me: activeMe,
+      exportStatus: {
+        hasJob: true,
+        job: { id: "job-123", status: EXPORT_JOB_STATUS.Done, expiresAt: "2026-07-11T00:00:00Z" },
+      },
+    });
+    await waitForMount(view);
+    fireEvent.click(view.getByTestId("privacy-export-download"));
+    await waitFor(() => {
+      if (!queries.some((q) => q.type === UserDataRightsQueries.downloadByJob)) {
+        throw new Error("no downloadByJob query dispatched");
+      }
+    });
+    const download = queries.find((q) => q.type === UserDataRightsQueries.downloadByJob);
+    expect(download?.payload).toEqual({ jobId: "job-123" });
+  });
 });
 
 describe("QN-Drift-Pins (client-Konstanten vs. Feature-Originale)", () => {