@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.108.0

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -1,11 +1,24 @@
-import { deleteMany, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type {
-  UserDataDeleteHook,
-  UserDataExportHook,
-  UserDataHookCtx,
-  UserDataStorageProvider,
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type SessionUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+  type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+
+// Forget writes go through the executor (events), not deleteMany/updateMany:
+// a projection rebuild replays the events, so the erasure survives. Eventless
+// writes are wiped/resurrected on rebuild — the Art.17 hole this fixes. Bounded:
+// per-user forget flows are rare, so per-row events are acceptable.
+const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
 // userData-Hook fuer fileRef-entity (S2.H2).
 //
@@ -27,7 +40,7 @@ import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 //
 // **Zwei Fehlerklassen, bewusst verschieden behandelt:**
 //   1. Resolution schlaegt fehl (kein Provider konfiguriert / configResolver
-//      fehlt) → NICHT fail-closed: EIN Warn pro Process + row-only-delete. Ein
+//      fehlt) → NICHT fail-closed: Warn pro Aufruf + row-only-delete. Ein
 //      fehlkonfigurierter Store darf die Art.-17-Loeschung nicht DAUERHAFT
 //      blockieren (sonst haengt jeder User fuer immer in DeletionRequested);
 //      der Boot-Guard macht die Fehlkonfiguration sichtbar, Binaries werden
@@ -94,8 +107,6 @@ export const fileRefExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-let missingStorageWarned = false;
-
 // Resolve the per-tenant provider the forget orchestrator injected. A
 // resolution failure (no provider configured / configResolver absent) collapses
 // to `undefined` so the hook degrades to a row-only delete instead of throwing —
@@ -107,58 +118,95 @@ async function resolveProvider(ctx: UserDataHookCtx): Promise<UserDataStoragePro
     return await ctx.buildStorageProvider(ctx.tenantId);
   } catch {
     // skip: provider unresolvable (not configured) → fall through to row-only
-    // delete; warn-once below gives operator visibility, boot guard catches it.
+    // delete; the warn below gives operator visibility, boot guard catches it.
     return undefined;
   }
 }
 
-export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
-  if (strategy === "delete") {
-    const storageProvider = await resolveProvider(ctx);
-    if (storageProvider) {
-      const rows = await selectMany(ctx.db, fileRefsTable, {
-        tenantId: ctx.tenantId,
-        insertedById: ctx.userId,
-      });
-      const failedKeys: string[] = [];
-      for (const row of rows) {
-        const key = (row as Record<string, unknown>)["storageKey"]; // @cast-boundary db-row
-        if (typeof key !== "string" || key.length === 0) continue;
-        try {
-          await storageProvider.delete(key);
-        } catch (err) {
-          // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
-          console.warn(
-            `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
-          );
-          failedKeys.push(key);
-        }
-      }
-      // Fail-closed: abort before the row hard-delete so the sub-tx rolls back
-      // and the next forget run retries (delete is idempotent → converges).
-      if (failedKeys.length > 0) {
-        throw new Error(
-          `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
-        );
-      }
-    } else if (!missingStorageWarned) {
-      missingStorageWarned = true;
-      // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+// Delete every row's binary via the provider. Returns the keys whose delete
+// threw — the caller fails closed on a non-empty list so the sub-tx rolls back
+// and the next forget run retries (delete is idempotent → converges).
+async function deleteBinaries(
+  rows: readonly Record<string, unknown>[],
+  provider: UserDataStorageProvider,
+): Promise<readonly string[]> {
+  const failedKeys: string[] = [];
+  for (const row of rows) {
+    const key = row["storageKey"]; // @cast-boundary db-row
+    if (typeof key !== "string" || key.length === 0) continue;
+    try {
+      await provider.delete(key);
+    } catch (err) {
+      // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
       console.warn(
-        "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
+        `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
+      );
+      failedKeys.push(key);
+    }
+  }
+  return failedKeys;
+}
+
+// Null the person-link on every row via the executor (event → rebuild-safe).
+// tdb: the executor needs a TenantDb (loadById → db.fetchOne), not the raw
+// ctx.db runner.
+async function severPersonLink(
+  tdb: TenantDb,
+  systemUser: SessionUser,
+  rows: readonly Record<string, unknown>[],
+): Promise<void> {
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
+      skipOptimisticLock: true,
+    });
+  }
+}
+
+export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, fileRefsTable, {
+    tenantId: ctx.tenantId,
+    insertedById: ctx.userId,
+  });
+
+  if (strategy !== "delete") {
+    // anonymize: insertedById=null, FileRef + binary bleiben. Use-case: shared
+    // chat-Attachment im Multi-User-Channel — Author-ID raus, Datei bleibt sichtbar.
+    await severPersonLink(tdb, systemUser, rows);
+    // skip: anonymize is complete — the hard-delete path below runs only for strategy "delete".
+    return;
+  }
+
+  const storageProvider = await resolveProvider(ctx);
+  if (storageProvider) {
+    const failedKeys = await deleteBinaries(rows, storageProvider);
+    if (failedKeys.length > 0) {
+      throw new Error(
+        `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
       );
     }
-    await deleteMany(ctx.db, fileRefsTable, { tenantId: ctx.tenantId, insertedById: ctx.userId });
   } else {
-    // anonymize: insertedById=null, FileRef + binary bleiben.
-    // Use-case: shared chat-Attachment in einem Multi-User-Channel —
-    // Author-Identifikation raus, Datei bleibt fuer andere User
-    // sichtbar.
-    await updateMany(
-      ctx.db,
-      fileRefsTable,
-      { insertedById: null },
-      { tenantId: ctx.tenantId, insertedById: ctx.userId },
+    // No warn-once guard: a forget-cleanup cron runs rarely enough (not a hot
+    // path) that logging every occurrence is fine, and an operator who fixes the
+    // provider config mid-process sees the warning stop on the very next run —
+    // a module-level "warned once" flag would silence it for the rest of the
+    // process even after the misconfiguration is corrected.
+    // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+    console.warn(
+      "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
     );
   }
+  // Hard-purge each row via the executor forget-verb: emits fileRef.forgotten,
+  // which hard-deletes the row even though fileRef is softDelete — and, being an
+  // auto-verb, the erasure replays on rebuild (created → forgotten → row gone).
+  // The old hard deleteMany was resurrected on rebuild; this closes that Art.17
+  // hole without a direct write.
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
 };

package/src/user-data-rights-defaults/hooks/user.userdata-hook.ts

@@ -1,5 +1,10 @@
-import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   USER_ANONYMIZED_DISPLAY_NAME,
   USER_ANONYMIZED_EMAIL_DOMAIN,
@@ -7,9 +12,14 @@ import {
   USER_DELETED_DISPLAY_NAME,
   USER_DELETED_EMAIL_PREFIX,
   USER_STATUS,
+  userEntity,
   userTable,
 } from "../../user";
-import { anonymizeDeletedUser } from "../db/queries/user-hook";
+
+// Forget writes go through the executor (events), not a raw UPDATE: a
+// projection rebuild replays the events, so the anonymization survives it.
+// A direct write would be wiped on rebuild — the Art.17 hole this fixes.
+const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 
 // userData-Hook fuer user-entity (S2.H1).
 //
@@ -63,27 +73,55 @@ export const userDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   // korrelieren — user.id ist tenant-agnostic (User kann in mehreren
   // Tenants Member sein), kein tenantId-Filter noetig.
 
+  // System actor + skipOptimisticLock: the forget pipeline has no read
+  // version and writes privileged identity columns ("system" is privileged).
+  // The executor needs a TenantDb (loadById → db.fetchOne); ctx.db is a raw
+  // runner, so wrap it. "system" mode = no tenant filter — user is a systemStream
+  // entity (tenant-agnostic) and forget must reach the row in any tenant.
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+
   if (strategy === "delete") {
-    await anonymizeDeletedUser(ctx.db, {
-      email: `${USER_DELETED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
-      displayName: USER_DELETED_DISPLAY_NAME,
-      status: USER_STATUS.Deleted,
-      userId: ctx.userId,
-    });
+    // PII raus + status=deleted (Login geblockt) via Event → Rebuild spielt den
+    // Forget mit. KEIN softDelete: user ist systemStream (eine tenant-agnostische
+    // Row), der Forget laeuft pro Tenant — wuerde isDeleted gesetzt, faende der
+    // loadById (isDeleted:false) die Row beim zweiten Tenant nicht mehr
+    // (not_found). status=Deleted blockt Login; die Row bleibt findbar +
+    // idempotent ueber mehrere Tenant-Durchlaeufe (wie der alte raw UPDATE).
+    await crud.update(
+      {
+        id: ctx.userId,
+        changes: {
+          email: `${USER_DELETED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
+          displayName: USER_DELETED_DISPLAY_NAME,
+          passwordHash: null,
+          status: USER_STATUS.Deleted,
+          // deleted_at as an audit timestamp only — NOT isDeleted (see above).
+          // Frozen into the event payload, so a rebuild replays the same value.
+          deletedAt: Temporal.Now.instant(),
+        },
+      },
+      systemUser,
+      tdb,
+      { skipOptimisticLock: true },
+    );
   } else {
     // anonymize: PII raus, aber Row bleibt active (damit FK-References
     // weiter aufloesbar sind). Account ist effektiv weiter nutzbar
     // wenn der User sich neu authentifiziert — pragmatisch akzeptabel
     // weil "anonymize" auf user-entity ein seltener Edge-Case ist
     // (typisch hard-delete fuer User).
-    await updateMany(
-      ctx.db,
-      userTable,
+    await crud.update(
       {
-        email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
-        displayName: USER_ANONYMIZED_DISPLAY_NAME,
+        id: ctx.userId,
+        changes: {
+          email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
+          displayName: USER_ANONYMIZED_DISPLAY_NAME,
+        },
       },
-      { id: ctx.userId },
+      systemUser,
+      tdb,
+      { skipOptimisticLock: true },
     );
   }
 };

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -88,6 +88,15 @@ describe("ProfileScreen", () => {
     expect(cardCount(view.getByTestId("profile-password"))).toBe(1);
   });
 
+  test("Passwort- und Email-Section rendern auf einem echten <form> (Enter-to-submit, Password-Manager-Boundary) (555/1)", async () => {
+    const view = renderProfile(activeMe);
+    await waitFor(() => {
+      if (view.queryByTestId("profile-screen") === null) throw new Error("not mounted yet");
+    });
+    expect(view.getByTestId("profile-password").tagName).toBe("FORM");
+    expect(view.getByTestId("profile-email").tagName).toBe("FORM");
+  });
+
   test("deletionRequested: Frist-Banner + Abbrechen statt Lösch-Button", async () => {
     const view = renderProfile({
       ...activeMe,

package/src/user-profile/handlers/change-email.write.ts

@@ -1,9 +1,13 @@
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createSystemUser,
+  defineWriteHandler,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
 import { z } from "zod";
 import { AuthErrors, verifyPassword } from "../../auth-email-password";
-import { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "../../user";
+import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 
 // Gleiche Failure-Shape wie auth-email-password (anti-enumeration):
@@ -66,11 +70,10 @@ export const changeEmailWrite = defineWriteHandler({
       );
     }
 
-    // Stream-Tenant-Auflösung wie in change-password: das user-Aggregate
-    // ist systemScope, sein Event-Stream kann in einem anderen Tenant
-    // liegen als die Session — optimistic locking braucht den echten.
-    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
-    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
+    // user ist systemStream (#497): der Event-Stream liegt deterministisch
+    // auf SYSTEM_TENANT_ID. Pre-#497-Streams brauchen einmalig
+    // backfillUserStreamTenants (#762).
+    const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
       id: me.id,

package/src/user-profile/web/profile-screen.tsx

@@ -59,7 +59,7 @@ function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode
 
 function ChangePasswordSection(): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button } = usePrimitives();
+  const { Form, Field, Input, Button } = usePrimitives();
   const dispatcher = useDispatcher();
   const [oldPassword, setOldPassword] = useState("");
   const [newPassword, setNewPassword] = useState("");
@@ -90,11 +90,12 @@ function ChangePasswordSection(): ReactNode {
 
   const submitting = status.kind === "submitting";
   return (
-    <Section
+    <Form
       testId="profile-password"
       title={t("profile.password.title")}
+      onSubmit={onSubmit}
       actions={
-        <Button onClick={() => onSubmit()} disabled={submitting} testId="profile-password-submit">
+        <Button type="submit" disabled={submitting} testId="profile-password-submit">
           {t("profile.password.submit")}
         </Button>
       }
@@ -136,7 +137,7 @@ function ChangePasswordSection(): ReactNode {
         />
       </Field>
       <StatusBanner status={status} />
-    </Section>
+    </Form>
   );
 }
 
@@ -148,7 +149,7 @@ function ChangeEmailSection({
   readonly onChanged: () => void;
 }): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button } = usePrimitives();
+  const { Form, Field, Input, Button } = usePrimitives();
   const dispatcher = useDispatcher();
   const [newEmail, setNewEmail] = useState("");
   const [currentPassword, setCurrentPassword] = useState("");
@@ -192,16 +193,17 @@ function ChangeEmailSection({
 
   const submitting = status.kind === "submitting";
   return (
-    <Section
+    <Form
       testId="profile-email"
       title={t("profile.email.title")}
+      onSubmit={onSubmit}
       subtitle={
         <span data-testid="profile-email-current">
           {t("profile.email.current")}: {me.email}
         </span>
       }
       actions={
-        <Button onClick={() => onSubmit()} disabled={submitting} testId="profile-email-submit">
+        <Button type="submit" disabled={submitting} testId="profile-email-submit">
           {t("profile.email.submit")}
         </Button>
       }
@@ -231,7 +233,7 @@ function ChangeEmailSection({
         />
       </Field>
       <StatusBanner status={status} />
-    </Section>
+    </Form>
   );
 }
 

package/src/auth-email-password/stream-tenant.ts

@@ -1,31 +0,0 @@
-// user-feature runs with r.systemScope() but events land on a concrete
-// tenant stream. The row.version tracks whichever stream the user's last
-// modification wrote to — and that tenant is NOT discoverable from the
-// row alone.
-//
-// Strategy: prioritize lastActiveTenantId (most likely holds the latest
-// event), fall through to the remaining memberships in insertion order,
-// and let the caller try each one in sequence. The first stream whose
-// version matches row.version wins; the rest are bypassed.
-//
-// This is pragmatic — the real fix is to scope user events to
-// SYSTEM_TENANT_ID when the feature is r.systemScope(), which is a
-// framework-level change tracked separately. Until then, "try each
-// tenant the user belongs to" is robust against non-deterministic
-// memberships-query ordering (tenant:query:memberships has no ORDER BY).
-
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-
-export function orderTenantsByPreference(
-  memberships: readonly { readonly tenantId: TenantId }[],
-  lastActiveTenantId: string | null | undefined,
-): TenantId[] {
-  if (memberships.length === 0) return [];
-  const ids = memberships.map((m) => m.tenantId);
-  if (!lastActiveTenantId) return ids;
-  // Move lastActiveTenantId to the front; preserve relative order of rest.
-  const preferred = ids.find((id) => id === lastActiveTenantId);
-  if (!preferred) return ids;
-  const rest = ids.filter((id) => id !== preferred);
-  return [preferred, ...rest];
-}

package/src/user-data-rights-defaults/db/queries/user-hook.ts

@@ -1,17 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-
-export async function anonymizeDeletedUser(
-  db: DbRunner,
-  params: {
-    readonly email: string;
-    readonly displayName: string;
-    readonly status: string;
-    readonly userId: string;
-  },
-): Promise<void> {
-  await asRawClient(db).unsafe(
-    'UPDATE "read_users" SET email = $1, display_name = $2, password_hash = $3, status = $4, deleted_at = now() WHERE id = $5',
-    [params.email, params.displayName, null, params.status, params.userId],
-  );
-}