@cosmicdrift/kumiko-bundled-features 0.109.0 → 0.111.0

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -20,7 +20,7 @@ import {
   type SubscriptionProviderPlugin,
   subscriptionAggregateId,
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
@@ -31,6 +31,7 @@ import {
   testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { Hono } from "hono";
 import Stripe from "stripe";
 import { configValuesTable, createConfigFeature } from "../../config";
@@ -79,8 +80,8 @@ beforeAll(async () => {
     priceToTier: PRICE_TO_TIER,
   });
 
-  const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
   const masterKeyProvider = createEnvMasterKeyProvider({
     env: {
       KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
@@ -470,8 +471,8 @@ describe("scenario 6: billing-live gate end-to-end (#104)", () => {
 
   beforeAll(async () => {
     const stripeFeature = createSubscriptionStripeFeature({ priceToTier: PRICE_TO_TIER });
-    const encryption = createEncryptionProvider(randomBytes(32).toString("base64"));
-    const resolver = createConfigResolver({ encryption });
+    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ cipher: encryption });
     const masterKeyProvider = createEnvMasterKeyProvider({
       env: {
         KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),

package/src/tenant/__tests__/tenant.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -10,7 +10,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+  rolesOf,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigAccessor, createConfigFeature } from "../../config";
 import { ConfigHandlers, ConfigQueries } from "../../config/constants";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
@@ -33,8 +37,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature],

package/src/tier-engine/__tests__/tier-engine.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { createEncryptionProvider, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -11,7 +11,10 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { expectErrorIncludes } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -38,8 +41,8 @@ const tenantFeature = createTenantFeature();
 const testEncryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [configFeature, tenantFeature, tierEngineFeature],

package/src/user/__tests__/user.integration.test.ts

@@ -109,6 +109,32 @@ describe("scenario 2: field-level read access", () => {
   });
 });
 
+// --- find-for-auth is system-only: it returns the raw row incl. passwordHash,
+// and every query handler is reachable via POST /api/query — so even a
+// SystemAdmin (assignable app role) must be denied over HTTP. ---
+
+describe("scenario 2b: find-for-auth is system-only", () => {
+  test("SystemAdmin over HTTP is denied — passwordHash must not leak", async () => {
+    await seedUser({
+      email: "auth-lookup@example.com",
+      displayName: "AuthLookup",
+      passwordHash: "must-never-leave-the-server",
+    });
+
+    const res = await stack.http.queryWithHeaders(
+      UserQueries.findForAuth,
+      { email: "auth-lookup@example.com" },
+      systemAdmin,
+      {},
+    );
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    const body = await res.text();
+    expect(body).toContain("access_denied");
+    expect(body).not.toContain("must-never-leave-the-server");
+  });
+});
+
 // --- Scenario 3: user edits own profile, email/passwordHash are system-locked ---
 
 describe("scenario 3: self-update + field-level write access", () => {

package/src/user/handlers/find-for-auth.query.ts

@@ -7,10 +7,12 @@ import { userTable } from "../schema/user";
 // by email OR id (exactly one, enforced by the schema). Used by the auth
 // features via ctx.queryAs(systemUser, ...).
 //
-// Field-level read rules allow passwordHash for the "privileged" role set,
-// so system callers see everything; any other caller is filtered even if
-// they somehow reach this handler. Access is also restricted to privileged
-// — regular users or tenant admins cannot call this at all.
+// Access is system-only, NOT access.privileged: every query handler is
+// reachable via POST /api/query, and "SystemAdmin" is an assignable app
+// role — privileged would hand any SystemAdmin the raw passwordHash over
+// HTTP. The "system" role can't be minted into a session (only
+// createSystemUser() carries it), so system-only keeps this handler
+// internal to ctx.queryAs(systemUser, ...) callers.
 export const findForAuthQuery = defineQueryHandler({
   name: "user:find-for-auth",
   schema: z
@@ -24,7 +26,7 @@ export const findForAuthQuery = defineQueryHandler({
       (v) => (v.email !== undefined) !== (v.id !== undefined),
       { message: "exactly one of email or id must be set" },
     ),
-  access: { roles: access.privileged },
+  access: { roles: access.system },
   handler: async (query, ctx) => {
     const where =
       query.payload.email !== undefined

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -10,7 +10,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -25,7 +24,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables, updateRows } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
@@ -100,8 +103,8 @@ const noSignedUrlProviderFeature = defineFeature("test-no-signed-url-provider",
 });
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(testEncryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(testEncryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -0,0 +1,152 @@
+// Art. 20 + encrypted entity fields: export hooks read raw rows past the
+// executor's decrypt layer, so runUserExport must decrypt encrypted fields
+// centrally — plaintext with a configured cipher, an explicit marker
+// (never the raw ciphertext) without one.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  buildEntityTable,
+  configureEntityFieldEncryption,
+  resetEntityFieldEncryptionCacheForTests,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createRegistry,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runUserExport } from "../run-user-export";
+
+const TENANT = "00000000-0000-4000-8000-00000000000a";
+const USER_ID = "cccccccc-cccc-4ccc-8ccc-000000000001";
+const PLAINTEXT_NOTE = "my private vault note";
+
+const cipher = createTestEnvelopeCipher();
+
+const vaultNoteEntity = createEntity({
+  table: "read_vault_notes",
+  fields: {
+    ownerId: createTextField({ required: true }),
+    note: createTextField({ encrypted: true }),
+  },
+});
+
+const vaultNotesTableRef = buildEntityTable("vault-note", vaultNoteEntity);
+
+// Export hook mirrors real hooks (folders-user-data pattern): raw select,
+// no decrypt of its own.
+const vaultExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, vaultNotesTableRef, {
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return { entity: "vault-note", rows };
+};
+
+const vaultFeature = defineFeature("vault", (r) => {
+  const entity = r.entity("vault-note", vaultNoteEntity);
+  r.useExtension(EXT_USER_DATA, entity, {
+    export: vaultExportHook,
+    delete: async () => undefined,
+  });
+});
+
+let stack: TestStack;
+let registry: ReturnType<typeof createRegistry>;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [] });
+  // user-data-rights hosts EXT_USER_DATA — without it the vault feature's
+  // useExtension reference fails registry creation. Its hard requires
+  // (user/data-retention/compliance-profiles/sessions) come along.
+  registry = createRegistry([
+    createUserFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createSessionsFeature(),
+    createUserDataRightsFeature(),
+    vaultFeature,
+  ]);
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_tenant_memberships (tenant_id, user_id) VALUES ('${TENANT}', '${USER_ID}')
+     ON CONFLICT DO NOTHING`,
+  );
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_vault_notes (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      owner_id TEXT NOT NULL,
+      note TEXT
+    )
+  `);
+  const storedNote = await cipher.encrypt(PLAINTEXT_NOTE);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_vault_notes (tenant_id, owner_id, note) VALUES ('${TENANT}', '${USER_ID}', '${storedNote.replaceAll("'", "''")}')`,
+  );
+});
+
+afterEach(() => {
+  resetEntityFieldEncryptionCacheForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function exportedNote(): Promise<unknown> {
+  const bundle = await runUserExport({
+    db: stack.db,
+    registry,
+    userId: USER_ID,
+    now: getTemporal().Now.instant(),
+  });
+  const snippet = bundle.tenants.flatMap((t) => t.entities).find((e) => e.entity === "vault-note");
+  return snippet?.rows[0]?.["note"];
+}
+
+describe("user export with encrypted entity fields", () => {
+  test("decrypts encrypted fields when the cipher is configured", async () => {
+    configureEntityFieldEncryption(cipher);
+    expect(await exportedNote()).toBe(PLAINTEXT_NOTE);
+  });
+
+  test("exports an explicit marker — never ciphertext — without a cipher", async () => {
+    const value = await exportedNote();
+    expect(value).toBe("[encrypted:unavailable]");
+  });
+});

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -14,7 +14,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
   type Registry,
@@ -40,6 +39,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -97,8 +97,8 @@ function buildFeatures() {
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -13,7 +13,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -26,6 +25,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -65,8 +65,8 @@ const ALICE_EMAIL = "alice.restrict@example.com";
 const ALICE_PW = "alice-pw-long-enough";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/run-user-export.ts

@@ -22,6 +22,11 @@
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  collectEncryptedFieldNames,
+  configuredEntityFieldEncryption,
+  decryptEntityFieldValues,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   type Registry,
@@ -137,8 +142,9 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({ db, tenantId, userId });
-      if (snippet === null) continue;
+      const rawSnippet = await entry.exportHook({ db, tenantId, userId });
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -169,12 +175,13 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   if (tenantList.length === 0 && hookEntries.length > 0) {
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({
+      const rawSnippet = await entry.exportHook({
         db,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,
       });
-      if (snippet === null) continue;
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       orphanEntities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -203,6 +210,37 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   };
 }
 
+// Art. 20 verlangt die DATEN, nicht deren Ciphertext: Export-Hooks lesen
+// raw rows an der Executor-Decrypt-Schicht vorbei, darum entschluesselt
+// dieser zentrale Pass encrypted entity fields nach jedem Hook. Ohne
+// konfigurierten Cipher wird ein expliziter Marker exportiert statt den
+// base64-Blob als "Wert" auszuliefern (leak-by-confusion).
+const ENCRYPTED_UNAVAILABLE = "[encrypted:unavailable]";
+
+async function decryptSnippetFields(
+  registry: Registry,
+  hookEntityName: string,
+  snippet: UserDataExportSnippet,
+): Promise<UserDataExportSnippet> {
+  const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
+  if (!entity) return snippet;
+  const encryptedFields = collectEncryptedFieldNames(entity);
+  if (encryptedFields.size === 0) return snippet;
+
+  const cipher = configuredEntityFieldEncryption();
+  const rows = await Promise.all(
+    snippet.rows.map(async (row) => {
+      if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
+      const out = { ...row };
+      for (const name of encryptedFields) {
+        if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+      }
+      return out;
+    }),
+  );
+  return { ...snippet, rows };
+}
+
 // Pseudo-Tenant fuer User ohne aktive Memberships. Identisch zum
 // Pattern in run-forget-cleanup.ts — RFC4122-Null-UUID. Tenant-scoped
 // Hooks finden hier nichts (no-op).