@cosmicdrift/kumiko-bundled-features 0.115.0 → 0.116.0

package/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -0,0 +1,56 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { notificationPreferenceEntity, notificationPreferencesTable } from "../../delivery";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for delivery's notification-preference rows. Event-sourced
+// entity → forget goes through the executor so a rebuild replays the erasure.
+// A preference without its user is meaningless, so both strategies purge via
+// the forget verb.
+//
+// The delivery ATTEMPTS log (read_delivery_attempts, recipientAddress) is NOT
+// covered here: it is an events-only aggregate whose payload lives in the
+// append-only event store — per-user redaction there needs the event-store
+// redaction epic; a read-side UPDATE would be wiped on rebuild.
+
+const crud = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, {
+  entityName: "notification-preference",
+});
+
+export const notificationPreferenceExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "notification-preference",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      enabled: r["enabled"],
+    })),
+  };
+};
+
+export const notificationPreferenceDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "delivery")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
+};

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -0,0 +1,107 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
+import { userTable } from "../../user";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for tenant-invitation rows. Event-sourced entity → all
+// forget writes go through the executor so a projection rebuild replays the
+// erasure (a direct write would be wiped — the Art.17 hole the user/fileRef
+// hooks already close).
+//
+// Two subject paths in one hook:
+//   invitee — rows whose `email` is the user's email. delete → executor
+//             forget (row purged); anonymize → email pseudonymized.
+//   inviter — rows whose `invitedBy` is the user. The row belongs to the
+//             invitee, so both strategies only sever the person-link
+//             (invitedBy → pseudonym; the field is required, null not
+//             allowed).
+//
+// Email source: on forget the user hook may already have anonymized the
+// user row, so ctx.userEmailBeforeDelete (captured by runForgetCleanup
+// before the transaction) takes precedence over a live lookup.
+
+const crud = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
+  entityName: "tenant-invitation",
+});
+
+const INVITED_BY_ANONYMIZED = "anonymized";
+
+async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
+  if (ctx.userEmailBeforeDelete) return ctx.userEmailBeforeDelete.toLowerCase();
+  const row = (await fetchOne(ctx.db, userTable, { id: ctx.userId })) as {
+    email: string;
+  } | null; // @cast-boundary db-runner
+  return row ? row.email.toLowerCase() : null;
+}
+
+export const tenantInvitationExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "tenant")) return null;
+  const email = await resolveUserEmail(ctx);
+  if (!email) return null;
+  // Invitation emails are lowercase-normalized on insert, so an exact match
+  // is a case-insensitive match.
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    email,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "tenant-invitation",
+    rows: rows.map((r) => ({
+      email: r["email"],
+      role: r["role"],
+      status: r["status"],
+      expiresAt: String(r["expiresAt"] ?? ""),
+    })),
+  };
+};
+
+export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  // skip: tenant not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "tenant")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+
+  const email = await resolveUserEmail(ctx);
+  if (email) {
+    const inviteeRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+      tenantId: ctx.tenantId,
+      email,
+    });
+    for (const row of inviteeRows) {
+      const id = row["id"]; // @cast-boundary db-row
+      if (typeof id !== "string") continue;
+      if (strategy === "delete") {
+        await crud.forget({ id }, systemUser, tdb);
+      } else {
+        // Row-id in the pseudonym keeps the (tenantId, email) unique index
+        // collision-free when a user has invitations in several states.
+        await crud.update(
+          { id, changes: { email: `forgotten-${id}@anonymized.invalid` } },
+          systemUser,
+          tdb,
+          { skipOptimisticLock: true },
+        );
+      }
+    }
+  }
+
+  const inviterRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    invitedBy: ctx.userId,
+  });
+  for (const row of inviterRows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, tdb, {
+      skipOptimisticLock: true,
+    });
+  }
+};

package/src/user-data-rights-defaults/hooks/user-session.userdata-hook.ts

@@ -0,0 +1,42 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { userSessionTable } from "../../sessions";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for the sessions feature's user-session rows (ip, userAgent).
+//
+// user-session is an unmanaged direct-write store (no event stream, excluded
+// from projection rebuilds — see sessions/feature.ts #494/#498), so a direct
+// DELETE is legal here and survives rebuilds; the executor path the ES
+// entities use does not apply.
+//
+// Both forget strategies hard-delete: a session row without its user is
+// worthless (revocation audit trail loses its subject), and ip/userAgent are
+// pure PII with no shared-data value to preserve via anonymization.
+
+export const userSessionExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "sessions")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, userSessionTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-session",
+    // sid (row id) stays out of the bundle — it is the JWT jti and
+    // token-shaped, not portable personal data.
+    rows: rows.map((r) => ({
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: String(r["expiresAt"] ?? ""),
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+      ip: r["ip"] ?? null,
+      userAgent: r["userAgent"] ?? null,
+    })),
+  };
+};
+
+export const userSessionDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: sessions not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "sessions")) return;
+  await deleteMany(ctx.db, userSessionTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/src/user-data-rights-defaults/index.ts

@@ -1,6 +1,27 @@
 export { createUserDataRightsDefaultsFeature } from "./feature";
+export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook";
+export {
+  configValueDeleteHook,
+  configValueExportHook,
+} from "./hooks/config-value.userdata-hook";
 export {
   fileRefDeleteHook,
   fileRefExportHook,
 } from "./hooks/file-ref.userdata-hook";
+export {
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+} from "./hooks/in-app-message.userdata-hook";
+export {
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+} from "./hooks/notification-preference.userdata-hook";
+export {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "./hooks/tenant-invitation.userdata-hook";
 export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
+export {
+  userSessionDeleteHook,
+  userSessionExportHook,
+} from "./hooks/user-session.userdata-hook";