@cosmicdrift/kumiko-bundled-features 0.113.1 → 1.0.0

package/src/user-data-rights/web/i18n.ts

@@ -74,6 +74,11 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Konto wirklich löschen?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Mit dem Bestätigen startet die Lösch-Frist. Du kannst die Löschung bis zu ihrem Ablauf wieder abbrechen.",
+
+    "userDataRights.privacyCenter.audit.title": "Aktivitätsprotokoll (Art. 15)",
+    "userDataRights.privacyCenter.audit.intro":
+      "Die letzten Ereignisse zu deinem Konto über alle Tenants hinweg.",
+    "userDataRights.privacyCenter.audit.empty": "Noch keine Ereignisse.",
   },
   en: {
     "userDataRights.deletion.request.title": "Request account deletion",
@@ -141,5 +146,10 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Delete your account?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
+
+    "userDataRights.privacyCenter.audit.title": "Activity log (Art. 15)",
+    "userDataRights.privacyCenter.audit.intro":
+      "The most recent events on your account across all tenants.",
+    "userDataRights.privacyCenter.audit.empty": "No events yet.",
   },
 };

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -162,7 +162,6 @@ describe("S2.H1 :: userExportHook", () => {
 
     const result = await userExportHook({
       db: stack.db,
-      registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1001),
     });
@@ -183,7 +182,6 @@ describe("S2.H1 :: userExportHook", () => {
   test("returns null wenn User nicht existiert", async () => {
     const result = await userExportHook({
       db: stack.db,
-      registry: stack.registry,
       tenantId: TENANT_A,
       userId: uuid(1002),
     });
@@ -195,10 +193,7 @@ describe("S2.H1 :: userDeleteHook", () => {
   test('strategy="delete" → softDelete + email/displayName anonymisiert + status=deleted', async () => {
     await seedUser(uuid(1003));
 
-    await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1003) },
-      "delete",
-    );
+    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1003) }, "delete");
 
     const row = await fetchUser(uuid(1003));
     expect(row).not.toBeNull();
@@ -214,10 +209,7 @@ describe("S2.H1 :: userDeleteHook", () => {
   test('strategy="anonymize" → email/displayName anonymisiert aber status bleibt active', async () => {
     await seedUser(uuid(1004));
 
-    await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1004) },
-      "anonymize",
-    );
+    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1004) }, "anonymize");
 
     const row = await fetchUser(uuid(1004));
     if (!row) throw new Error("row should exist");
@@ -230,19 +222,13 @@ describe("S2.H1 :: userDeleteHook", () => {
   test("idempotent: zweiter delete-Call crasht nicht UND State bleibt korrekt deleted", async () => {
     await seedUser(uuid(1005));
 
-    await userDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
-      "delete",
-    );
+    await userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1005) }, "delete");
     const afterFirst = await fetchUser(uuid(1005));
     if (!afterFirst) throw new Error("user should exist after first delete");
 
     // Zweiter Call: kein Crash + State unverändert
     await expect(
-      userDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: uuid(1005) },
-        "delete",
-      ),
+      userDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: uuid(1005) }, "delete"),
     ).resolves.toBeUndefined();
 
     // State-Verifikation (S2.H1+H2-Audit N3): Row weiterhin deleted,
@@ -263,7 +249,6 @@ describe("S2.H2 :: fileRefExportHook", () => {
 
     const result = await fileRefExportHook({
       db: stack.db,
-      registry: stack.registry,
       tenantId: TENANT_A,
       userId: "user-files-1",
     });
@@ -278,7 +263,6 @@ describe("S2.H2 :: fileRefExportHook", () => {
   test("returns null wenn User keine Files hat", async () => {
     const result = await fileRefExportHook({
       db: stack.db,
-      registry: stack.registry,
       tenantId: TENANT_A,
       userId: "ghost-user-no-files",
     });
@@ -292,7 +276,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(202), TENANT_A, "user-delete-files", "f2.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-delete-files" },
+      { db: stack.db, tenantId: TENANT_A, userId: "user-delete-files" },
       "delete",
     );
 
@@ -304,7 +288,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(203), TENANT_A, "user-anon-files", "shared.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-anon-files" },
+      { db: stack.db, tenantId: TENANT_A, userId: "user-anon-files" },
       "anonymize",
     );
 
@@ -321,10 +305,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(302), TENANT_B, "shared-user", "tenantB.pdf");
 
     // Tenant A loescht alle Files von "shared-user"
-    await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "shared-user" },
-      "delete",
-    );
+    await fileRefDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: "shared-user" }, "delete");
 
     const aRemaining = await fetchFileRefs(TENANT_A, "shared-user");
     const bRemaining = await fetchFileRefs(TENANT_B, "shared-user");
@@ -338,7 +319,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
     await seedFileRef(uuid(401), TENANT_A, "user-idem-files", "f.pdf");
 
     await fileRefDeleteHook(
-      { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
+      { db: stack.db, tenantId: TENANT_A, userId: "user-idem-files" },
       "delete",
     );
     const afterFirst = await fetchFileRefs(TENANT_A, "user-idem-files");
@@ -346,10 +327,7 @@ describe("S2.H2 :: fileRefDeleteHook", () => {
 
     // Zweiter Call: kein Crash + State weiter 0 Files
     await expect(
-      fileRefDeleteHook(
-        { db: stack.db, registry: stack.registry, tenantId: TENANT_A, userId: "user-idem-files" },
-        "delete",
-      ),
+      fileRefDeleteHook({ db: stack.db, tenantId: TENANT_A, userId: "user-idem-files" }, "delete"),
     ).resolves.toBeUndefined();
     const afterSecond = await fetchFileRefs(TENANT_A, "user-idem-files");
     expect(afterSecond).toHaveLength(0);

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -76,10 +76,6 @@ describe("ProfileScreen", () => {
     expect(view.getByTestId("profile-email")).toBeTruthy();
     expect(view.getByTestId("profile-password")).toBeTruthy();
     expect(view.getByTestId("profile-danger")).toBeTruthy();
-    // 607/4: page heading is <h1> (Heading variant="page") — the danger-zone
-    // title must be <h2>, not Card's default <h3>, so the levels don't skip.
-    expect(view.getByTestId("profile-danger").querySelector("h2")).not.toBeNull();
-    expect(view.getByTestId("profile-danger").querySelector("h3")).toBeNull();
     expect(view.getByTestId("profile-email-current").textContent).toContain("marc@example.com");
     expect(view.getByTestId("profile-danger-delete")).toBeTruthy();
     // Echte i18n: kein einziger roher Key im sichtbaren Text.

package/src/user-profile/handlers/change-email.write.ts

@@ -1,13 +1,9 @@
-import {
-  access,
-  createSystemUser,
-  defineWriteHandler,
-  SYSTEM_TENANT_ID,
-} from "@cosmicdrift/kumiko-framework/engine";
+import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
 import { z } from "zod";
 import { AuthErrors, verifyPassword } from "../../auth-email-password";
-import { UserErrors, UserHandlers, UserQueries } from "../../user";
+import { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 
 // Gleiche Failure-Shape wie auth-email-password (anti-enumeration):
@@ -70,10 +66,11 @@ export const changeEmailWrite = defineWriteHandler({
       );
     }
 
-    // user ist systemStream (#497): der Event-Stream liegt deterministisch
-    // auf SYSTEM_TENANT_ID. Pre-#497-Streams brauchen einmalig
-    // backfillUserStreamTenants (#762).
-    const writer = createSystemUser(SYSTEM_TENANT_ID);
+    // Stream-Tenant-Auflösung wie in change-password: das user-Aggregate
+    // ist systemScope, sein Event-Stream kann in einem anderen Tenant
+    // liegen als die Session — optimistic locking braucht den echten.
+    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
+    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
 
     const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
       id: me.id,

package/src/user-profile/web/profile-screen.tsx

@@ -246,17 +246,6 @@ function DangerZoneSection({
 }): ReactNode {
   const t = useTranslation();
   const { Button, Banner, Dialog, Card } = usePrimitives();
-  // Card.slots.title always renders <h3> — with the page's <h1> (variant="page")
-  // as this screen's only other heading, that skips <h2> (607/4). An explicit
-  // header slot with a real <h2> keeps the levels contiguous; layout mirrors
-  // DefaultCard's own default-header markup.
-  const dangerZoneHeader = (
-    <div className="flex flex-wrap items-start justify-between gap-3 px-6 pt-6 pb-4">
-      <h2 className="text-base font-semibold leading-none tracking-tight">
-        {t("profile.danger.title")}
-      </h2>
-    </div>
-  );
   const dispatcher = useDispatcher();
   const [dialogOpen, setDialogOpen] = useState(false);
   const [status, setStatus] = useState<SectionStatus>({ kind: "idle" });
@@ -301,7 +290,7 @@ function DangerZoneSection({
     <Card
       testId="profile-danger"
       className="border-destructive/40"
-      slots={{ header: dangerZoneHeader, footer }}
+      slots={{ title: t("profile.danger.title"), footer }}
     >
       <div className="flex flex-col gap-4">
         {deletionRequested ? (

package/src/auth-email-password/__tests__/feature-options.test.ts

@@ -1,33 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { MIN_HMAC_SECRET_LENGTH } from "../constants";
-import { createAuthEmailPasswordFeature } from "../feature";
-
-// A short HMAC secret makes reset/verify tokens forgeable (account takeover),
-// so the factory must fail fast — same bar as the ≥32-char JWT_SECRET check.
-
-const okSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH);
-const shortSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH - 1);
-const appUrl = "https://app.example.com/flow";
-
-describe("createAuthEmailPasswordFeature hmacSecret validation", () => {
-  test("rejects a short passwordReset.hmacSecret", () => {
-    expect(() =>
-      createAuthEmailPasswordFeature({ passwordReset: { hmacSecret: shortSecret, appUrl } }),
-    ).toThrow(/passwordReset\.hmacSecret must be/);
-  });
-
-  test("rejects a short emailVerification.hmacSecret", () => {
-    expect(() =>
-      createAuthEmailPasswordFeature({ emailVerification: { hmacSecret: shortSecret, appUrl } }),
-    ).toThrow(/emailVerification\.hmacSecret must be/);
-  });
-
-  test("accepts secrets at the minimum length", () => {
-    expect(() =>
-      createAuthEmailPasswordFeature({
-        passwordReset: { hmacSecret: okSecret, appUrl },
-        emailVerification: { hmacSecret: okSecret, appUrl },
-      }),
-    ).not.toThrow();
-  });
-});

package/src/auth-email-password/password-hashing.test.ts

@@ -1,35 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
-
-const medianMs = async (fn: () => Promise<unknown>, runs = 5): Promise<number> => {
-  const samples: number[] = [];
-  for (let i = 0; i < runs; i++) {
-    const start = performance.now();
-    await fn();
-    samples.push(performance.now() - start);
-  }
-  samples.sort((a, b) => a - b);
-  return samples[Math.floor(samples.length / 2)] ?? 0;
-};
-
-// #774: the login no-user path must cost the same argon2 latency as a real
-// verify, otherwise response timing leaks whether an email is registered.
-describe("verifyDummyPassword (anti-enumeration timing)", () => {
-  test("resolves to void, never matches", async () => {
-    expect(await verifyDummyPassword("whatever")).toBeUndefined();
-  });
-
-  test("burns real argon2 cost, comparable to a failed verify (not a no-op)", async () => {
-    const realHash = await hashPassword("correct-horse-battery");
-    // warm the lazily-cached dummy hash so we time the verify, not the one-off hash
-    await verifyDummyPassword("warmup");
-
-    const realMs = await medianMs(() => verifyPassword(realHash, "wrong-password"));
-    const dummyMs = await medianMs(() => verifyDummyPassword("wrong-password"));
-
-    // A skipped miss-path (the bug) is sub-millisecond; a real argon2 verify
-    // is ~20ms. A half-of-real floor is a wide, non-flaky bound that still
-    // fails hard if the dummy verify is ever removed.
-    expect(dummyMs).toBeGreaterThan(realMs * 0.5);
-  });
-});

package/src/auth-email-password/web/__tests__/use-url-token.test.tsx

@@ -1,29 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { renderHook } from "@testing-library/react";
-import { useUrlToken } from "../auth-form-primitives";
-
-// #774: magic-link tokens must not linger in browser history / Referer.
-// useUrlToken reads the token once, then scrubs the param via replaceState.
-// (dom.preload resets window.location to http://localhost/ after each test.)
-describe("useUrlToken (magic-link history hygiene)", () => {
-  test("reads ?token= and strips it from the URL, keeping other params", () => {
-    window.history.replaceState(null, "", "http://localhost/reset?token=secret-abc&keep=1");
-    const { result } = renderHook(() => useUrlToken());
-    expect(result.current).toBe("secret-abc");
-    expect(window.location.search).toBe("?keep=1");
-  });
-
-  test("no token param → URL untouched", () => {
-    window.history.replaceState(null, "", "http://localhost/reset?keep=1");
-    const { result } = renderHook(() => useUrlToken());
-    expect(result.current).toBe("");
-    expect(window.location.search).toBe("?keep=1");
-  });
-
-  test("explicit override short-circuits both URL read and scrub", () => {
-    window.history.replaceState(null, "", "http://localhost/reset?token=url-token");
-    const { result } = renderHook(() => useUrlToken("prop-token"));
-    expect(result.current).toBe("prop-token");
-    expect(window.location.search).toBe("?token=url-token");
-  });
-});

package/src/config/__tests__/encrypted-legacy-migration.integration.test.ts

@@ -1,179 +0,0 @@
-// Pins the legacy → envelope migration story for encrypted config values:
-//   1. rows written under the old CONFIG_ENCRYPTION_KEY format stay readable
-//      as long as the legacy key is wired as the cipher's fallback,
-//   2. reading an encrypted row WITHOUT any cipher throws (the pre-envelope
-//      code silently returned the ciphertext as the value),
-//   3. the reencrypt job migrates legacy rows onto the envelope format
-//      through the event-store executor (event payload carries the new
-//      envelope, so a projection rebuild no longer needs the legacy key),
-//      and is idempotent on re-run.
-
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { randomBytes } from "node:crypto";
-import { asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEncryptionProvider,
-  createEventStoreExecutor,
-  createTenantDb,
-} from "@cosmicdrift/kumiko-framework/db";
-import {
-  type AppContext,
-  access,
-  createRegistry,
-  createSystemUser,
-  createTenantConfig,
-  defineFeature,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  createEnvelopeCipher,
-  type EnvelopeCipher,
-  isStoredEnvelope,
-} from "@cosmicdrift/kumiko-framework/secrets";
-import {
-  setupTestStack,
-  type TestStack,
-  testTenantId,
-  unsafePushTables,
-} from "@cosmicdrift/kumiko-framework/stack";
-import { createTestMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
-import { createConfigFeature } from "../feature";
-import { reencryptJob } from "../handlers/reencrypt.job";
-import { createConfigResolver } from "../resolver";
-import { configValueEntity, configValuesTable } from "../table";
-
-const KEY = "enc-mig:config:secret-pass";
-const TENANT: TenantId = testTenantId(1);
-const PLAINTEXT = "legacy-smtp-password";
-
-const keyDef = createTenantConfig("text", {
-  encrypted: true,
-  read: access.all,
-  write: access.all,
-});
-
-// legacy single-key provider — the pre-envelope CONFIG_ENCRYPTION_KEY world
-const legacy = createEncryptionProvider(randomBytes(32).toString("base64"));
-const masterKeyProvider = createTestMasterKeyProvider();
-const cipherWithLegacy = createEnvelopeCipher(masterKeyProvider, { legacy });
-const cipherWithoutLegacy = createEnvelopeCipher(masterKeyProvider);
-
-const encMigFeature = defineFeature("enc-mig", (r) => {
-  r.config({ keys: { "secret-pass": keyDef } });
-});
-
-const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
-  entityName: "config-value",
-});
-
-let stack: TestStack;
-
-async function seedLegacyRow(): Promise<string> {
-  const legacyValue = legacy.encrypt(JSON.stringify(PLAINTEXT));
-  const systemUser = createSystemUser(TENANT);
-  const tdb = createTenantDb(stack.db, TENANT, "system");
-  const result = await executor.create(
-    { key: KEY, value: legacyValue, tenantId: TENANT, userId: null },
-    systemUser,
-    tdb,
-  );
-  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
-  return (result.data as { id: string }).id;
-}
-
-async function readStoredValue(): Promise<string> {
-  const row = await fetchOne<{ value: string }>(stack.db, configValuesTable, {
-    key: KEY,
-    tenantId: TENANT,
-  });
-  if (!row) throw new Error("row missing");
-  return row.value;
-}
-
-type ReencryptCtx = Pick<AppContext, "db" | "masterKeyProvider" | "configEncryption" | "registry">;
-function jobCtx(cipher: EnvelopeCipher): Parameters<typeof reencryptJob>[1] {
-  const ctx: ReencryptCtx = {
-    db: stack.db,
-    masterKeyProvider,
-    configEncryption: cipher,
-    registry: stack.registry,
-  };
-  return ctx as unknown as Parameters<typeof reencryptJob>[1];
-}
-
-beforeAll(async () => {
-  stack = await setupTestStack({ features: [createConfigFeature(), encMigFeature] });
-  await unsafePushTables(stack.db, { configValuesTable });
-  await seedLegacyRow();
-});
-
-afterAll(async () => {
-  await stack.cleanup();
-});
-
-describe("legacy encrypted config rows", () => {
-  test("stay readable through the cipher's legacy fallback (get + cascade path)", async () => {
-    const resolver = createConfigResolver({ cipher: cipherWithLegacy });
-    const value = await resolver.get(KEY, keyDef, TENANT, "u1", stack.db);
-    expect(value).toBe(PLAINTEXT);
-
-    const cascade = await resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db);
-    const active = cascade.levels.find((l) => l.hasValue);
-    expect(active?.value).toBe(PLAINTEXT);
-  });
-
-  test("throw without any cipher instead of leaking ciphertext as the value", async () => {
-    const resolver = createConfigResolver({});
-    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
-      /encrypted but no cipher/,
-    );
-    await expect(resolver.getCascade(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(
-      /encrypted but no cipher/,
-    );
-  });
-
-  test("throw with a remediation hint when the legacy key is missing", async () => {
-    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
-    await expect(resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).rejects.toThrow(/legacy/);
-  });
-});
-
-describe("config:reencrypt job", () => {
-  test("migrates the legacy row to envelope format via the executor", async () => {
-    expect((await readStoredValue()).startsWith("{")).toBe(false);
-
-    await reencryptJob({}, jobCtx(cipherWithLegacy));
-
-    const stored = await readStoredValue();
-    expect(stored.startsWith("{")).toBe(true);
-    expect(isStoredEnvelope(JSON.parse(stored))).toBe(true);
-
-    // decryptable WITHOUT the legacy key now — retiring CONFIG_ENCRYPTION_KEY
-    // after a clean run is safe
-    const resolver = createConfigResolver({ cipher: cipherWithoutLegacy });
-    expect(await resolver.get(KEY, keyDef, TENANT, "u1", stack.db)).toBe(PLAINTEXT);
-  });
-
-  test("event payload carries the new envelope — rebuild-safe without legacy key", async () => {
-    // The migration wrote a configValue.updated event whose payload holds
-    // the envelope value; replaying events verbatim reproduces the
-    // migrated state, so the final projection never needs the legacy key.
-    const registryCheck = createRegistry([createConfigFeature(), encMigFeature]);
-    expect(registryCheck.getConfigKey(KEY)?.encrypted).toBe(true);
-
-    const events = await asRawClient(stack.db).unsafe<{
-      payload: { changes?: { value?: string } };
-    }>(
-      `SELECT payload FROM kumiko_events WHERE aggregate_type = 'config-value' AND type LIKE '%.updated' ORDER BY created_at DESC LIMIT 1`,
-    );
-    const lastValue = events[0]?.payload?.changes?.value;
-    expect(typeof lastValue).toBe("string");
-    expect((lastValue as string).startsWith("{")).toBe(true);
-  });
-
-  test("is idempotent — a second run migrates nothing", async () => {
-    const before = await readStoredValue();
-    await reencryptJob({}, jobCtx(cipherWithLegacy));
-    expect(await readStoredValue()).toBe(before);
-  });
-});