@cosmicdrift/kumiko-bundled-features 0.110.0 → 0.111.0

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -0,0 +1,152 @@
+// Art. 20 + encrypted entity fields: export hooks read raw rows past the
+// executor's decrypt layer, so runUserExport must decrypt encrypted fields
+// centrally — plaintext with a configured cipher, an explicit marker
+// (never the raw ciphertext) without one.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  buildEntityTable,
+  configureEntityFieldEncryption,
+  resetEntityFieldEncryptionCacheForTests,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createRegistry,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runUserExport } from "../run-user-export";
+
+const TENANT = "00000000-0000-4000-8000-00000000000a";
+const USER_ID = "cccccccc-cccc-4ccc-8ccc-000000000001";
+const PLAINTEXT_NOTE = "my private vault note";
+
+const cipher = createTestEnvelopeCipher();
+
+const vaultNoteEntity = createEntity({
+  table: "read_vault_notes",
+  fields: {
+    ownerId: createTextField({ required: true }),
+    note: createTextField({ encrypted: true }),
+  },
+});
+
+const vaultNotesTableRef = buildEntityTable("vault-note", vaultNoteEntity);
+
+// Export hook mirrors real hooks (folders-user-data pattern): raw select,
+// no decrypt of its own.
+const vaultExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, vaultNotesTableRef, {
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return { entity: "vault-note", rows };
+};
+
+const vaultFeature = defineFeature("vault", (r) => {
+  const entity = r.entity("vault-note", vaultNoteEntity);
+  r.useExtension(EXT_USER_DATA, entity, {
+    export: vaultExportHook,
+    delete: async () => undefined,
+  });
+});
+
+let stack: TestStack;
+let registry: ReturnType<typeof createRegistry>;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [] });
+  // user-data-rights hosts EXT_USER_DATA — without it the vault feature's
+  // useExtension reference fails registry creation. Its hard requires
+  // (user/data-retention/compliance-profiles/sessions) come along.
+  registry = createRegistry([
+    createUserFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createSessionsFeature(),
+    createUserDataRightsFeature(),
+    vaultFeature,
+  ]);
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_tenant_memberships (tenant_id, user_id) VALUES ('${TENANT}', '${USER_ID}')
+     ON CONFLICT DO NOTHING`,
+  );
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_vault_notes (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      owner_id TEXT NOT NULL,
+      note TEXT
+    )
+  `);
+  const storedNote = await cipher.encrypt(PLAINTEXT_NOTE);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_vault_notes (tenant_id, owner_id, note) VALUES ('${TENANT}', '${USER_ID}', '${storedNote.replaceAll("'", "''")}')`,
+  );
+});
+
+afterEach(() => {
+  resetEntityFieldEncryptionCacheForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function exportedNote(): Promise<unknown> {
+  const bundle = await runUserExport({
+    db: stack.db,
+    registry,
+    userId: USER_ID,
+    now: getTemporal().Now.instant(),
+  });
+  const snippet = bundle.tenants.flatMap((t) => t.entities).find((e) => e.entity === "vault-note");
+  return snippet?.rows[0]?.["note"];
+}
+
+describe("user export with encrypted entity fields", () => {
+  test("decrypts encrypted fields when the cipher is configured", async () => {
+    configureEntityFieldEncryption(cipher);
+    expect(await exportedNote()).toBe(PLAINTEXT_NOTE);
+  });
+
+  test("exports an explicit marker — never ciphertext — without a cipher", async () => {
+    const value = await exportedNote();
+    expect(value).toBe("[encrypted:unavailable]");
+  });
+});

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -14,7 +14,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
   type Registry,
@@ -40,6 +39,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -97,8 +97,8 @@ function buildFeatures() {
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -13,7 +13,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -26,6 +25,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -65,8 +65,8 @@ const ALICE_EMAIL = "alice.restrict@example.com";
 const ALICE_PW = "alice-pw-long-enough";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/run-user-export.ts

@@ -22,6 +22,11 @@
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  collectEncryptedFieldNames,
+  configuredEntityFieldEncryption,
+  decryptEntityFieldValues,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   type Registry,
@@ -137,8 +142,9 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({ db, tenantId, userId });
-      if (snippet === null) continue;
+      const rawSnippet = await entry.exportHook({ db, tenantId, userId });
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -169,12 +175,13 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   if (tenantList.length === 0 && hookEntries.length > 0) {
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({
+      const rawSnippet = await entry.exportHook({
         db,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,
       });
-      if (snippet === null) continue;
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       orphanEntities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -203,6 +210,37 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   };
 }
 
+// Art. 20 verlangt die DATEN, nicht deren Ciphertext: Export-Hooks lesen
+// raw rows an der Executor-Decrypt-Schicht vorbei, darum entschluesselt
+// dieser zentrale Pass encrypted entity fields nach jedem Hook. Ohne
+// konfigurierten Cipher wird ein expliziter Marker exportiert statt den
+// base64-Blob als "Wert" auszuliefern (leak-by-confusion).
+const ENCRYPTED_UNAVAILABLE = "[encrypted:unavailable]";
+
+async function decryptSnippetFields(
+  registry: Registry,
+  hookEntityName: string,
+  snippet: UserDataExportSnippet,
+): Promise<UserDataExportSnippet> {
+  const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
+  if (!entity) return snippet;
+  const encryptedFields = collectEncryptedFieldNames(entity);
+  if (encryptedFields.size === 0) return snippet;
+
+  const cipher = configuredEntityFieldEncryption();
+  const rows = await Promise.all(
+    snippet.rows.map(async (row) => {
+      if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
+      const out = { ...row };
+      for (const name of encryptedFields) {
+        if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+      }
+      return out;
+    }),
+  );
+  return { ...snippet, rows };
+}
+
 // Pseudo-Tenant fuer User ohne aktive Memberships. Identisch zum
 // Pattern in run-forget-cleanup.ts — RFC4122-Null-UUID. Tenant-scoped
 // Hooks finden hier nichts (no-op).