@cosmicdrift/kumiko-bundled-features 0.110.0 → 0.112.0

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -0,0 +1,152 @@
+// Art. 20 + encrypted entity fields: export hooks read raw rows past the
+// executor's decrypt layer, so runUserExport must decrypt encrypted fields
+// centrally — plaintext with a configured cipher, an explicit marker
+// (never the raw ciphertext) without one.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  buildEntityTable,
+  configureEntityFieldEncryption,
+  resetEntityFieldEncryptionCacheForTests,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createRegistry,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runUserExport } from "../run-user-export";
+
+const TENANT = "00000000-0000-4000-8000-00000000000a";
+const USER_ID = "cccccccc-cccc-4ccc-8ccc-000000000001";
+const PLAINTEXT_NOTE = "my private vault note";
+
+const cipher = createTestEnvelopeCipher();
+
+const vaultNoteEntity = createEntity({
+  table: "read_vault_notes",
+  fields: {
+    ownerId: createTextField({ required: true }),
+    note: createTextField({ encrypted: true }),
+  },
+});
+
+const vaultNotesTableRef = buildEntityTable("vault-note", vaultNoteEntity);
+
+// Export hook mirrors real hooks (folders-user-data pattern): raw select,
+// no decrypt of its own.
+const vaultExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, vaultNotesTableRef, {
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return { entity: "vault-note", rows };
+};
+
+const vaultFeature = defineFeature("vault", (r) => {
+  const entity = r.entity("vault-note", vaultNoteEntity);
+  r.useExtension(EXT_USER_DATA, entity, {
+    export: vaultExportHook,
+    delete: async () => undefined,
+  });
+});
+
+let stack: TestStack;
+let registry: ReturnType<typeof createRegistry>;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [] });
+  // user-data-rights hosts EXT_USER_DATA — without it the vault feature's
+  // useExtension reference fails registry creation. Its hard requires
+  // (user/data-retention/compliance-profiles/sessions) come along.
+  registry = createRegistry([
+    createUserFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createSessionsFeature(),
+    createUserDataRightsFeature(),
+    vaultFeature,
+  ]);
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_tenant_memberships (tenant_id, user_id) VALUES ('${TENANT}', '${USER_ID}')
+     ON CONFLICT DO NOTHING`,
+  );
+
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_vault_notes (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      owner_id TEXT NOT NULL,
+      note TEXT
+    )
+  `);
+  const storedNote = await cipher.encrypt(PLAINTEXT_NOTE);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO read_vault_notes (tenant_id, owner_id, note) VALUES ('${TENANT}', '${USER_ID}', '${storedNote.replaceAll("'", "''")}')`,
+  );
+});
+
+afterEach(() => {
+  resetEntityFieldEncryptionCacheForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function exportedNote(): Promise<unknown> {
+  const bundle = await runUserExport({
+    db: stack.db,
+    registry,
+    userId: USER_ID,
+    now: getTemporal().Now.instant(),
+  });
+  const snippet = bundle.tenants.flatMap((t) => t.entities).find((e) => e.entity === "vault-note");
+  return snippet?.rows[0]?.["note"];
+}
+
+describe("user export with encrypted entity fields", () => {
+  test("decrypts encrypted fields when the cipher is configured", async () => {
+    configureEntityFieldEncryption(cipher);
+    expect(await exportedNote()).toBe(PLAINTEXT_NOTE);
+  });
+
+  test("exports an explicit marker — never ciphertext — without a cipher", async () => {
+    const value = await exportedNote();
+    expect(value).toBe("[encrypted:unavailable]");
+  });
+});

package/src/user-data-rights/__tests__/forget-hook-registry.integration.test.ts

@@ -0,0 +1,108 @@
+// A forget delete-hook receives the app registry so it can cascade custom child
+// projections for the executor's `<entity>.forgotten` event (runProjectionsForEvent).
+// executor.forget purges only the entity's OWN projection, and the forget pipeline
+// is a job — not a dispatched command — so the dispatcher's post-command projection
+// pass never fires. Without registry in the hook ctx the cascade is unreachable and
+// child read-model rows (m:n joins, per-parent detail projections) are orphaned on
+// live forget (a DSGVO gap). This pins that the plumbing delivers the real,
+// functional registry instance; the end-to-end cascade is covered consumer-side.
+
+import { afterAll, beforeAll, beforeEach, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type Registry,
+  type UserDataDeleteHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature, userEntity } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runForgetCleanup } from "../run-forget-cleanup";
+import {
+  createForgetSeeders,
+  nowInstant,
+  READ_TENANT_MEMBERSHIPS_DDL,
+  TENANT_SYSTEM,
+} from "./forget-test-helpers";
+
+const PROBE = "forget-registry-probe";
+let capturedRegistry: Registry | undefined;
+
+const captureHook: UserDataDeleteHook = async (ctx) => {
+  capturedRegistry = ctx.registry;
+};
+
+const probeEntity = createEntity({
+  table: `read_${PROBE.replace(/-/g, "_")}`,
+  fields: { name: createTextField({ required: true }) },
+});
+
+const probeFeature = defineFeature(PROBE, (r) => {
+  r.entity(PROBE, probeEntity);
+  r.useExtension(EXT_USER_DATA, PROBE, {
+    export: async () => null,
+    delete: captureHook,
+  });
+});
+
+const FORGET_USER = "cccccccc-cccc-4ccc-8ccc-0000000000b1";
+let stack: TestStack;
+const seed = (db: unknown) =>
+  // biome-ignore lint/suspicious/noExplicitAny: dummy writer; this seeder never writes binaries.
+  createForgetSeeders(db as any, { write: async () => {} });
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createSessionsFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createUserDataRightsFeature(),
+      probeFeature,
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
+  await unsafeCreateEntityTable(stack.db, probeEntity);
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(() => {
+  capturedRegistry = undefined;
+});
+
+test("forget delete-hook receives the app registry instance", async () => {
+  await seed(stack.db).seedForgetUser(FORGET_USER);
+  await seed(stack.db).seedMembership(FORGET_USER, TENANT_SYSTEM);
+
+  const result = await runForgetCleanup({
+    db: stack.db,
+    registry: stack.registry,
+    now: nowInstant(),
+  });
+
+  expect(result.errors, JSON.stringify(result.errors)).toHaveLength(0);
+  expect(result.processedUserIds).toContain(FORGET_USER);
+  // The hook ran and got the exact registry passed to runForgetCleanup — not
+  // undefined, not a stand-in — so runProjectionsForEvent(event, ctx.registry, db)
+  // reaches the real projections.
+  expect(capturedRegistry).toBe(stack.registry);
+  expect(capturedRegistry?.getProjectionsForSource(PROBE)).toBeDefined();
+});

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -14,7 +14,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
   type Registry,
@@ -40,6 +39,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -97,8 +97,8 @@ function buildFeatures() {
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -13,7 +13,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -26,6 +25,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
@@ -65,8 +65,8 @@ const ALICE_EMAIL = "alice.restrict@example.com";
 const ALICE_PW = "alice-pw-long-enough";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({

package/src/user-data-rights/run-forget-cleanup.ts

@@ -316,6 +316,7 @@ async function processUser(args: {
           await entry.deleteHook(
             {
               db: tx,
+              registry,
               tenantId,
               userId,
               buildStorageProvider,

package/src/user-data-rights/run-user-export.ts

@@ -22,6 +22,11 @@
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  collectEncryptedFieldNames,
+  configuredEntityFieldEncryption,
+  decryptEntityFieldValues,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   type Registry,
@@ -137,8 +142,9 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({ db, tenantId, userId });
-      if (snippet === null) continue;
+      const rawSnippet = await entry.exportHook({ db, registry, tenantId, userId });
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -169,12 +175,14 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   if (tenantList.length === 0 && hookEntries.length > 0) {
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({
+      const rawSnippet = await entry.exportHook({
         db,
+        registry,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,
       });
-      if (snippet === null) continue;
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       orphanEntities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -203,6 +211,37 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   };
 }
 
+// Art. 20 verlangt die DATEN, nicht deren Ciphertext: Export-Hooks lesen
+// raw rows an der Executor-Decrypt-Schicht vorbei, darum entschluesselt
+// dieser zentrale Pass encrypted entity fields nach jedem Hook. Ohne
+// konfigurierten Cipher wird ein expliziter Marker exportiert statt den
+// base64-Blob als "Wert" auszuliefern (leak-by-confusion).
+const ENCRYPTED_UNAVAILABLE = "[encrypted:unavailable]";
+
+async function decryptSnippetFields(
+  registry: Registry,
+  hookEntityName: string,
+  snippet: UserDataExportSnippet,
+): Promise<UserDataExportSnippet> {
+  const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
+  if (!entity) return snippet;
+  const encryptedFields = collectEncryptedFieldNames(entity);
+  if (encryptedFields.size === 0) return snippet;
+
+  const cipher = configuredEntityFieldEncryption();
+  const rows = await Promise.all(
+    snippet.rows.map(async (row) => {
+      if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
+      const out = { ...row };
+      for (const name of encryptedFields) {
+        if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+      }
+      return out;
+    }),
+  );
+  return { ...snippet, rows };
+}
+
 // Pseudo-Tenant fuer User ohne aktive Memberships. Identisch zum
 // Pattern in run-forget-cleanup.ts — RFC4122-Null-UUID. Tenant-scoped
 // Hooks finden hier nichts (no-op).

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -162,6 +162,7 @@ describe("S2.H1 :: userExportHook", () => {
 
     const result = await userExportHook({
       db: stack.db,
+      registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1001),
     });
@@ -182,6 +183,7 @@ describe("S2.H1 :: userExportHook", () => {
   test("returns null wenn User nicht existiert", async () => {
     const result = await userExportHook({
       db: stack.db,
+      registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1002),
     });
@@ -193,7 +195,10 @@ describe("S2.H1 :: userDeleteHook", () => {
   test('strategy="delete" → softDelete + email/displayName anonymisiert + status=deleted', async () => {
     await seedUser(uuid(1003));
 
-    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1003) }, "delete");
+    await userDeleteHook(
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1003) },
+      "delete",
+    );
 
     const row = await fetchUser(uuid(1003));
     expect(row).not.toBeNull();
@@ -209,7 +214,10 @@ describe("S2.H1 :: userDeleteHook", () => {
   test('strategy="anonymize" → email/displayName anonymisiert aber status bleibt active', async () => {
     await seedUser(uuid(1004));
 
-    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1004) }, "anonymize");
+    await userDeleteHook(
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1004) },
+      "anonymize",
+    );
 
     const row = await fetchUser(uuid(1004));
     if (!row) throw new Error("row should exist");
@@ -222,13 +230,19 @@ describe("S2.H1 :: userDeleteHook", () => {
   test("idempotent: zweiter delete-Call crasht nicht UND State bleibt korrekt deleted", async () => {
     await seedUser(uuid(1005));
 
-    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1005) }, "delete");
+    await userDeleteHook(
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+      "delete",
+    );
     const afterFirst = await fetchUser(uuid(1005));
     if (!afterFirst) throw new Error("user should exist after first delete");
 
     // Zweiter Call: kein Crash + State unverändert
     await expect(
-      userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1005) }, "delete"),
+      userDeleteHook(
+        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
+        "delete",
+      ),
     ).resolves.toBeUndefined();
 
     // State-Verifikation (S2.H1+H2-Audit N3): Row weiterhin deleted,
@@ -249,6 +263,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
 
     const result = await fileRefExportHook({
       db: stack.db,
+      registry: stack.registry,
       tenantId: TENANT_A,
       userId: "user-files-1",
     });
@@ -263,6 +278,7 @@ describe("S2.H2 :: fileRefExportHook", () => {
   test("returns null wenn User keine Files hat", async () => {
     const result = await fileRefExportHook({
       db: stack.db,
+      registry: stack.registry,
       tenantId: TENANT_A,
       userId: "ghost-user-no-files",
     });
@@ -276,7 +292,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(202), TENANT_A, "user-delete-files", "f2.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, tenantId: TENANT_A, userId: "user-delete-files" },
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-delete-files" },
       "delete",
     );
 
@@ -288,7 +304,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(203), TENANT_A, "user-anon-files", "shared.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, tenantId: TENANT_A, userId: "user-anon-files" },
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-anon-files" },
       "anonymize",
     );
 
@@ -305,7 +321,10 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(302), TENANT_B, "shared-user", "tenantB.pdf");
 
     // Tenant A loescht alle Files von "shared-user"
-    await fileRefDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: "shared-user" }, "delete");
+    await fileRefDeleteHook(
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "shared-user" },
+      "delete",
+    );
 
     const aRemaining = await fetchFileRefs(TENANT_A, "shared-user");
     const bRemaining = await fetchFileRefs(TENANT_B, "shared-user");
@@ -319,7 +338,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(401), TENANT_A, "user-idem-files", "f.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, tenantId: TENANT_A, userId: "user-idem-files" },
+      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
       "delete",
     );
     const afterFirst = await fetchFileRefs(TENANT_A, "user-idem-files");
@@ -327,7 +346,10 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
 
     // Zweiter Call: kein Crash + State weiter 0 Files
     await expect(
-      fileRefDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: "user-idem-files" }, "delete"),
+      fileRefDeleteHook(
+        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+        "delete",
+      ),
     ).resolves.toBeUndefined();
     const afterSecond = await fetchFileRefs(TENANT_A, "user-idem-files");
     expect(afterSecond).toHaveLength(0);