@cosmicdrift/kumiko-bundled-features 0.115.1 → 0.116.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.115.1",
+  "version": "0.116.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.115.1",
-    "@cosmicdrift/kumiko-framework": "0.115.1",
-    "@cosmicdrift/kumiko-headless": "0.115.1",
-    "@cosmicdrift/kumiko-renderer": "0.115.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.115.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.116.0",
+    "@cosmicdrift/kumiko-framework": "0.116.0",
+    "@cosmicdrift/kumiko-headless": "0.116.0",
+    "@cosmicdrift/kumiko-renderer": "0.116.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.116.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/config/index.ts

@@ -23,7 +23,7 @@ export {
 } from "./handlers/readiness.query";
 export type { AppConfigOverrides, ConfigResolver } from "./resolver";
 export { buildEnvConfigOverrides, createConfigResolver, validateAppOverrides } from "./resolver";
-export { configValuesTable } from "./table";
+export { configValueEntity, configValuesTable } from "./table";
 
 // Boot helper for runDevApp / runProdApp: pulls every ConfigSeedDef from
 // the registry and writes the matching system/tenant/user rows via the

package/src/config/table.ts

@@ -25,7 +25,7 @@ export const configValueEntity = createEntity({
     // breaking the null-vs-missing distinction the resolver already draws.
     value: createTextField({}),
     // user-scope row: userId populated. tenant- / system-scope: null.
-    userId: createTextField({}),
+    userId: createTextField({ pii: true }),
   },
   indexes: [
     { unique: true, columns: ["key", "tenantId", "userId"], name: "read_config_values_unique" },

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -55,10 +55,9 @@ const staleEntity = createEntity({
 });
 
 // blockDelete = Aufbewahrungspflicht (HGB/DSGVO-Presets: invoice/booking/
-// contract). Der Cleanup-Job muss diese Rows IGNORIEREN — nur user-forget
-// darf sie anonymisieren. Ein Regress im switch-Default oder im blockDelete-
-// Case, der sie trotzdem löscht, wäre schwerwiegender als ein verpasstes
-// hardDelete (Aufbewahrungspflicht-Verletzung statt nur "zu spät aufgeräumt").
+// contract). Während keepFor muss der Cleanup diese Rows IGNORIEREN (löschen
+// wäre eine Aufbewahrungspflicht-Verletzung); NACH Ablauf laufen die
+// anonymize-Feld-Funktionen — Row bleibt, Personen-Bezug raus (fields.ts).
 const retainedEntity = createEntity({
   table: "read_c7_retained",
   fields: {
@@ -67,12 +66,33 @@ const retainedEntity = createEntity({
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
 
+// anonymize-Strategie: label wird nach Ablauf ueberschrieben, note traegt
+// keine anonymize-Funktion und muss unangetastet bleiben (Geschaeftsdaten).
+const anonEntity = createEntity({
+  table: "read_c7_anon",
+  fields: {
+    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+    note: createTextField({ allowPlaintext: "is-business-data" }),
+  },
+  retention: { keepFor: "30d", strategy: "anonymize" },
+});
+
+// anonymize-Strategie OHNE anonymize-Felder — der Runner kann nichts tun und
+// muss das als skip melden statt still nichts zu tun.
+const bareEntity = createEntity({
+  table: "read_c7_bare",
+  fields: { label: createTextField({ required: true, allowPlaintext: "is-business-data" }) },
+  retention: { keepFor: "30d", strategy: "anonymize" },
+});
+
 const c7Feature = defineFeature("c7-retention-fixtures", (r) => {
   r.entity("c7-widget", widgetEntity);
   r.entity("c7-gadget", gadgetEntity);
   r.entity("c7-plain", plainEntity);
   r.entity("c7-stale", staleEntity);
   r.entity("c7-retained", retainedEntity);
+  r.entity("c7-anon", anonEntity);
+  r.entity("c7-bare", bareEntity);
 });
 
 const noopLogger: JobContext["log"] = {
@@ -102,6 +122,8 @@ beforeAll(async () => {
     plainEntity,
     staleEntity,
     retainedEntity,
+    anonEntity,
+    bareEntity,
   ]) {
     await unsafeCreateEntityTable(stack.db, e);
   }
@@ -144,6 +166,8 @@ beforeEach(async () => {
     "read_c7_plain",
     "read_c7_stale",
     "read_c7_retained",
+    "read_c7_anon",
+    "read_c7_bare",
   ]) {
     await asRawClient(stack.db).unsafe(`DELETE FROM ${t}`);
   }
@@ -244,8 +268,9 @@ describe("runRetentionCleanup :: real postgres", () => {
     expect(await labels("read_c7_widget", T1)).toEqual(["fresh-via-handler"]);
   });
 
-  test("blockDelete: past-cutoff rows are never touched by the cleanup job", async () => {
-    await seed("read_c7_retained", T1, "should-survive", pastIso);
+  test("blockDelete: within keepFor untouched, after expiry anonymized — row NEVER deleted", async () => {
+    await seed("read_c7_retained", T1, "in-hold", withinIso);
+    await seed("read_c7_retained", T1, "hold-expired", pastIso);
 
     const result = await runRetentionCleanup({
       db: stack.db,
@@ -255,9 +280,121 @@ describe("runRetentionCleanup :: real postgres", () => {
       now,
     });
 
-    expect(await labels("read_c7_retained", T1)).toEqual(["should-survive"]);
+    // Beide Rows physisch da — blockDelete darf NIE loeschen.
+    expect((await labels("read_c7_retained", T1)).sort()).toEqual(["[ANONYMIZED]", "in-hold"]);
     expect(result.hardDeleted).toBe(0);
     expect(result.softDeleted).toBe(0);
-    expect(result.anonymizeDeferred).not.toContain("c7-retained");
+    expect(result.anonymized).toBe(1);
+  });
+
+  test("anonymize: expired row gets field functions applied, other fields + fresh rows untouched", async () => {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'old-pii', 'business-note', $2::timestamptz)`,
+      [T1, pastIso],
+    );
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'fresh-pii', 'fresh-note', $2::timestamptz)`,
+      [T1, withinIso],
+    );
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(result.anonymized).toBe(1);
+    const rows = (await asRawClient(stack.db).unsafe(
+      `SELECT label, note FROM read_c7_anon WHERE tenant_id = $1 ORDER BY note`,
+      [T1],
+    )) as { label: string; note: string }[];
+    expect(rows).toEqual([
+      { label: "[ANONYMIZED]", note: "business-note" }, // PII raus, Geschaeftsdaten bleiben
+      { label: "fresh-pii", note: "fresh-note" }, // innerhalb keepFor: unangetastet
+    ]);
+  });
+
+  test("anonymize is idempotent: second run appends ZERO events (no daily event spam)", async () => {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'old-pii', 'n', $2::timestamptz)`,
+      [T1, pastIso],
+    );
+
+    const first = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+    expect(first.anonymized).toBe(1);
+
+    const eventsAfterFirst = (await asRawClient(stack.db).unsafe(
+      `SELECT count(*)::int AS n FROM kumiko_events`,
+    )) as { n: number }[];
+
+    const second = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+    expect(second.anonymized).toBe(0);
+
+    const eventsAfterSecond = (await asRawClient(stack.db).unsafe(
+      `SELECT count(*)::int AS n FROM kumiko_events`,
+    )) as { n: number }[];
+    expect(eventsAfterSecond[0]?.n).toBe(eventsAfterFirst[0]?.n);
+  });
+
+  test("anonymize converges under batchLimit=1: cursor pages past already-anonymized rows", async () => {
+    for (const label of ["a-pii", "b-pii", "c-pii"]) {
+      await asRawClient(stack.db).unsafe(
+        `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, $2, $3, $4::timestamptz)`,
+        [T1, label, `note-${label}`, pastIso],
+      );
+    }
+
+    const run = () =>
+      runRetentionCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        tenantId: T1,
+        tenantPreset: null,
+        now,
+        batchLimit: 1,
+      });
+
+    expect((await run()).anonymized).toBe(1);
+    expect((await run()).anonymized).toBe(1); // Cursor muss ueber die erledigte Row hinweg
+    expect((await run()).anonymized).toBe(1);
+    expect((await run()).anonymized).toBe(0); // konvergiert
+
+    const rows = (await asRawClient(stack.db).unsafe(
+      `SELECT label FROM read_c7_anon WHERE tenant_id = $1`,
+      [T1],
+    )) as { label: string }[];
+    expect(rows.map((r) => r.label)).toEqual(["[ANONYMIZED]", "[ANONYMIZED]", "[ANONYMIZED]"]);
+  });
+
+  test("anonymize strategy without anonymize fields → skipped with reason, rows untouched", async () => {
+    await seed("read_c7_bare", T1, "survives", pastIso);
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(await labels("read_c7_bare", T1)).toEqual(["survives"]);
+    expect(result.skipped).toContainEqual({
+      entityName: "c7-bare",
+      reason: "missing_anonymize_fields",
+    });
   });
 });

package/src/data-retention/feature.ts

@@ -104,10 +104,10 @@ export function createDataRetentionFeature(): FeatureDefinition {
           tenantPreset,
           now: T.Now.instant(),
         });
-        if (result.anonymizeDeferred.length > 0 || result.skipped.length > 0) {
-          // biome-ignore lint/suspicious/noConsole: operator-visibility for deferred/skipped entities
+        if (result.skipped.length > 0) {
+          // biome-ignore lint/suspicious/noConsole: operator-visibility for skipped entities
           console.warn(
-            `[data-retention:retention-cleanup] tenant=${tenantId} anonymizeDeferred=${result.anonymizeDeferred.join(",") || "-"} skipped=${result.skipped.map((s) => `${s.entityName}:${s.reason}`).join(",") || "-"}`,
+            `[data-retention:retention-cleanup] tenant=${tenantId} skipped=${result.skipped.map((s) => `${s.entityName}:${s.reason}`).join(",")}`,
           );
         }
       },

package/src/data-retention/run-retention-cleanup.ts

@@ -9,13 +9,17 @@
 //   - hardDelete  → executor.forget pro Row (Event → rebuild-safe hard purge)
 //   - softDelete  → executor.delete pro Row (Event → rebuild-safe soft-delete),
 //                   nur auf noch-nicht-geloeschte (isDeleted:false-Filter)
-//   - anonymize   → DEFERRED (siehe unten)
+//   - anonymize   → executor.update pro Row mit den Werten der per-Feld
+//                   anonymize-Funktionen; Row bleibt (fields.ts-Contract)
+//   - blockDelete → waehrend keepFor unangetastet (Aufbewahrungs-Pflicht;
+//                   user-forget loest anonymize aus). NACH Ablauf laufen die
+//                   anonymize-Funktionen — Geschaeftsdaten bleiben, Personen-
+//                   Bezug raus (fields.ts:44-47).
 //
 // Über den Executor statt Batch-deleteMany/updateMany: ein eventloser Batch-Write
 // auf die (erased) Projektions-Tabelle wird beim Projection-Rebuild
 // gewischt/resurrektiert — das #648-Loch. Kosten: N Events pro Cleanup statt ein
 // Batch-Statement (per-Row-Ceiling, Batch-Event-Variante als Follow-up).
-//   - blockDelete → ignoriert (Aufbewahrungs-Pflicht; user-forget loest anonymize)
 //
 // **Schaerfer als soft-delete-cleanup:** dieser Cron hardDeleted LIVE Rows
 // (keyed auf reference, Default createdAt), nicht bereits-soft-geloeschte.
@@ -23,12 +27,12 @@
 // reference-Spalte wuerde sonst ein malformed/all-matching WHERE ergeben und
 // pauschal loeschen.
 //
-// **anonymize deferred:** anonymize behaelt die Row. Ohne Idempotenz-Marker
-// wuerde der taegliche UPDATE jede past-cutoff Row endlos neu treffen — genau
-// der Full-Table-Scan den die Strategie vermeiden soll (hardDelete begrenzt
-// sich selbst, softDelete via isDeleted:false). Kein bundled-Entity nutzt
-// zeitgesteuertes anonymize; der user-forget-Flow (run-forget-cleanup) deckt
-// anonymize keyed auf userId ab. Follow-up fuer den Marker.
+// **anonymize-Idempotenz ohne Marker-Spalte:** die anonymize-Funktionen sind
+// row-unabhaengig (`() => unknown`) — einmal pro Entity ausgewertet ergeben
+// sie die Ziel-Werte. Eine Row die sie schon traegt wird uebersprungen, der
+// taegliche Re-Lauf appended also null Events. Der WHERE matcht anonymisierte
+// Rows weiter (reference bleibt alt), deshalb id-Cursor-Paging statt einer
+// einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
@@ -76,15 +80,18 @@ export interface RunRetentionCleanupArgs {
 
 export interface RetentionCleanupSkip {
   readonly entityName: string;
-  readonly reason: "missing_reference_column" | "missing_softdelete_columns";
+  readonly reason:
+    | "missing_reference_column"
+    | "missing_softdelete_columns"
+    | "missing_anonymize_fields";
 }
 
 export interface RunRetentionCleanupResult {
   readonly hardDeleted: number;
   readonly softDeleted: number;
-  /** Entities mit anonymize-Strategy — deferred (Header). Cron logt sie. */
-  readonly anonymizeDeferred: readonly string[];
-  /** Anomalien: Policy referenziert eine Spalte die die Tabelle nicht hat. */
+  /** Rows deren anonymize-Feld-Funktionen angewendet wurden (anonymize + abgelaufene blockDelete). */
+  readonly anonymized: number;
+  /** Anomalien: Policy referenziert eine Spalte die die Tabelle nicht hat, oder anonymize ohne anonymize-Felder. */
   readonly skipped: readonly RetentionCleanupSkip[];
 }
 
@@ -106,6 +113,65 @@ async function purgeMatchingRows(
   return count;
 }
 
+// PiiAnnotations.anonymize — structural view, avoids reaching into the
+// engine's field-type internals from here.
+type AnonymizeCapableField = { readonly anonymize?: () => unknown | Promise<unknown> };
+
+// Evaluate the entity's per-field anonymize functions ONCE — they are
+// row-independent by signature, so the result doubles as the idempotency
+// probe: a row already carrying these values needs no event.
+async function resolveAnonymizeTargets(
+  fields: Readonly<Record<string, unknown>>,
+): Promise<Record<string, unknown> | null> {
+  const targets: Record<string, unknown> = {};
+  for (const [name, field] of Object.entries(fields)) {
+    const annot = field as AnonymizeCapableField; // @cast-boundary schema-walk
+    if (typeof annot.anonymize === "function") targets[name] = await annot.anonymize();
+  }
+  return Object.keys(targets).length > 0 ? targets : null;
+}
+
+function rowNeedsAnonymize(
+  row: Record<string, unknown>,
+  targets: Record<string, unknown>,
+): boolean {
+  return Object.entries(targets).some(([field, value]) => row[field] !== value);
+}
+
+// Anonymize every matching row via the executor (event → rebuild-safe).
+// id-Cursor-paged because the where keeps matching already-anonymized rows;
+// the diff-check keeps the daily re-run event-free. batchLimit bounds the
+// UPDATES per run, not the scan.
+// ponytail: scans all past-cutoff rows per run — add an anonymized-marker
+// column if a hot entity accumulates millions of held rows.
+async function anonymizeMatchingRows(
+  db: DbRunner,
+  table: Parameters<typeof selectMany>[1],
+  where: WhereObject,
+  batchLimit: number,
+  targets: Record<string, unknown>,
+  op: (id: EntityId, changes: Record<string, unknown>) => Promise<{ readonly isSuccess: boolean }>,
+): Promise<number> {
+  let count = 0;
+  let cursor: EntityId | null = null;
+  while (count < batchLimit) {
+    const pageWhere: WhereObject = cursor === null ? where : { ...where, id: { gt: cursor } };
+    const rows = await selectMany<Record<string, unknown>>(db, table, pageWhere, {
+      limit: batchLimit,
+      orderBy: { col: "id" },
+    });
+    if (rows.length === 0) break;
+    for (const row of rows) {
+      cursor = row["id"] as EntityId; // @cast-boundary db-row
+      if (!rowNeedsAnonymize(row, targets)) continue;
+      const res = await op(cursor, targets);
+      if (res.isSuccess) count++;
+      if (count >= batchLimit) break;
+    }
+  }
+  return count;
+}
+
 export async function runRetentionCleanup(
   args: RunRetentionCleanupArgs,
 ): Promise<RunRetentionCleanupResult> {
@@ -114,7 +180,7 @@ export async function runRetentionCleanup(
 
   let hardDeleted = 0;
   let softDeleted = 0;
-  const anonymizeDeferred: string[] = [];
+  let anonymized = 0;
   const skipped: RetentionCleanupSkip[] = [];
 
   // Retention writes go through the executor (events) so a projection rebuild
@@ -198,16 +264,33 @@ export async function runRetentionCleanup(
         );
         break;
       }
-      case "anonymize": {
-        anonymizeDeferred.push(entityName);
-        break;
-      }
+      // blockDelete = Legal-Hold: rows stay untouched during keepFor (the
+      // cutoff-WHERE guarantees that), user-forget anonymizes instead of
+      // deleting (run-forget-cleanup maps blockDelete → anonymize). AFTER the
+      // hold expires the anonymize-field functions run — business data stays,
+      // the person link goes (fields.ts contract). Same executor path as the
+      // anonymize strategy, so both cases share it.
+      case "anonymize":
       case "blockDelete": {
-        // skip: Aufbewahrungs-Pflicht — Cleanup ignoriert, user-forget anonymisiert
+        const targets = await resolveAnonymizeTargets(entity.fields);
+        if (!targets) {
+          skipped.push({ entityName, reason: "missing_anonymize_fields" });
+          break;
+        }
+        const executor = createEventStoreExecutor(proj.table, entity, { entityName });
+        anonymized += await anonymizeMatchingRows(
+          db,
+          proj.table,
+          where,
+          batchLimit,
+          targets,
+          (id, changes) =>
+            executor.update({ id, changes }, systemUser, tdb, { skipOptimisticLock: true }),
+        );
         break;
       }
     }
   }
 
-  return { hardDeleted, softDeleted, anonymizeDeferred, skipped };
+  return { hardDeleted, softDeleted, anonymized, skipped };
 }

package/src/delivery/index.ts

@@ -15,7 +15,11 @@ export {
   type RateLimitConfig,
 } from "./delivery-service";
 export { createDeliveryFeature } from "./feature";
-export { deliveryAttemptsTable, notificationPreferencesTable } from "./tables";
+export {
+  deliveryAttemptsTable,
+  notificationPreferenceEntity,
+  notificationPreferencesTable,
+} from "./tables";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing";
 export type {
   ChannelContext,

package/src/delivery/tables.ts

@@ -76,7 +76,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
 export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
-    userId: createTextField({ required: true }),
+    userId: createTextField({ required: true, pii: true }),
     notificationType: createTextField({ required: true }), // qualified name or "*"
     channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),

package/src/personal-access-tokens/schema/api-token.ts

@@ -29,7 +29,12 @@ export const apiTokenEntity = createEntity({
       maxLength: 36,
       access: { write: access.privileged },
     }),
-    name: createTextField({ required: true, maxLength: 120, access: { write: access.privileged } }),
+    name: createTextField({
+      required: true,
+      maxLength: 120,
+      access: { write: access.privileged },
+      pii: true,
+    }),
     tokenHash: createTextField({
       required: true,
       maxLength: 64,

package/src/sessions/schema/user-session.ts

@@ -56,10 +56,12 @@ export const userSessionEntity = createEntity({
     ip: createTextField({
       maxLength: 64,
       access: { write: access.privileged },
+      pii: true,
     }),
     userAgent: createTextField({
       maxLength: 512,
       access: { write: access.privileged },
+      pii: true,
     }),
   },
 });

package/src/tenant/invitation-table.ts

@@ -70,7 +70,7 @@ export const tenantInvitationEntity = createEntity({
       default: "pending",
     }),
     // userId des einladenden Admins (für Audit-Trail "wer hat eingeladen").
-    invitedBy: createTextField({ required: true }),
+    invitedBy: createTextField({ required: true, pii: true }),
     // UI-Anzeige — Wahrheit liegt in Redis-TTL.
     expiresAt: createTimestampField({ required: true }),
   },

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -36,7 +36,7 @@ import {
 } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
@@ -127,6 +127,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await asRawClient(stack.db).unsafe(`

package/src/user-data-rights/__tests__/file-binary-forget-cleanup.integration.test.ts

@@ -30,7 +30,7 @@ import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -99,6 +99,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await asRawClient(db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);

package/src/user-data-rights/__tests__/file-binary-forget-failure.integration.test.ts

@@ -34,7 +34,7 @@ import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -109,6 +109,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await asRawClient(db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);

package/src/user-data-rights/__tests__/file-retention.integration.test.ts

@@ -36,7 +36,7 @@ import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { tenantRetentionOverrideTable } from "../../data-retention/schema/tenant-retention-override";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -76,6 +76,7 @@ beforeAll(async () => {
   db = stack.db;
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable });
   await asRawClient(db).unsafe(`

package/src/user-data-rights/__tests__/file-storage-unification.integration.test.ts

@@ -40,7 +40,7 @@ import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -117,6 +117,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await createEventsTable(db);

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -26,7 +26,7 @@ import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../..
 import { createFilesFeature } from "../../files";
 import { mailFoundationFeature } from "../../mail-foundation";
 import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../../mail-transport-inmemory";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -67,6 +67,7 @@ beforeAll(async () => {
 
   await unsafePushTables(stack.db, { configValuesTable });
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -24,7 +24,7 @@ import {
   tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -70,6 +70,7 @@ beforeAll(async () => {
     ],
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await createEventsTable(stack.db);
 });

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -38,7 +38,7 @@ import {
   tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
@@ -68,6 +68,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, exportDownloadTokenEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await createEventsTable(stack.db);
   // tenant-membership-table fuer runUserExport's Cross-Tenant-Iteration.
   // Pattern matched user-data-rights-defaults integration-test.