@cosmicdrift/kumiko-bundled-features 0.116.1 → 0.119.0

package/src/user-data-rights/run-user-export.ts

@@ -21,6 +21,11 @@
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectEncryptedFieldNames,
@@ -223,20 +228,42 @@ async function decryptSnippetFields(
   hookEntityName: string,
   snippet: UserDataExportSnippet,
 ): Promise<UserDataExportSnippet> {
+  let rows = snippet.rows;
+
   const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
-  if (!entity) return snippet;
-  const encryptedFields = collectEncryptedFieldNames(entity);
-  if (encryptedFields.size === 0) return snippet;
-
-  const cipher = configuredEntityFieldEncryption();
-  const rows = await Promise.all(
-    snippet.rows.map(async (row) => {
-      if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
-      const out = { ...row };
-      for (const name of encryptedFields) {
-        if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+  if (entity) {
+    const encryptedFields = collectEncryptedFieldNames(entity);
+    if (encryptedFields.size > 0) {
+      const cipher = configuredEntityFieldEncryption();
+      rows = await Promise.all(
+        rows.map(async (row) => {
+          if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
+          const out = { ...row };
+          for (const name of encryptedFields) {
+            if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+          }
+          return out;
+        }),
+      );
+    }
+  }
+
+  // PII-Subject-Ciphertexte (kumiko-pii:) sind self-describing — kein
+  // Entity-Kontext noetig, deckt jeden heutigen und kuenftigen Hook ab.
+  // Erased Subject → Sentinel (ehrlich: der Wert ist geshreddet).
+  const kms = configuredPiiSubjectKms();
+  rows = await Promise.all(
+    rows.map(async (row) => {
+      const piiKeys = Object.keys(row).filter((k) => isPiiCiphertext(row[k]));
+      if (piiKeys.length === 0) return row;
+      if (!kms) {
+        const out = { ...row };
+        for (const k of piiKeys) out[k] = ENCRYPTED_UNAVAILABLE;
+        return out;
       }
-      return out;
+      return decryptPiiFieldValues(row, piiKeys, kms, {
+        requestId: "user-data-rights:export",
+      });
     }),
   );
   return { ...snippet, rows };

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -6,6 +6,7 @@ import {
   type UserDataExportHook,
   type UserDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { decryptStoredPii } from "../../shared";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
 import { userTable } from "../../user";
 import { featureMounted } from "./feature-mounted";
@@ -38,7 +39,11 @@ async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
   const row = (await fetchOne(ctx.db, userTable, { id: ctx.userId })) as {
     email: string;
   } | null; // @cast-boundary db-runner
-  return row ? row.email.toLowerCase() : null;
+  if (!row) return null;
+  // Stored value is ciphertext with an active KMS; lowercasing a base64
+  // blob would break both lookup arms — decrypt first.
+  const email = await decryptStoredPii(row.email, "user-data-rights:invitation-hook");
+  return email.toLowerCase();
 }
 
 export const tenantInvitationExportHook: UserDataExportHook = async (ctx) => {

package/src/user-profile/handlers/change-email.write.ts

@@ -7,6 +7,7 @@ import {
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { AuthErrors, verifyPassword } from "../../auth-email-password";
+import { decryptStoredPii } from "../../shared";
 import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 
@@ -53,7 +54,8 @@ export const changeEmailWrite = defineWriteHandler({
     }
 
     const newEmail = event.payload.newEmail.toLowerCase();
-    if (newEmail === me.email.toLowerCase()) {
+    const currentEmail = await decryptStoredPii(me.email, "user-profile:change-email");
+    if (newEmail === currentEmail.toLowerCase()) {
       return writeFailure(
         new UnprocessableError(UserProfileErrors.emailUnchanged, {
           i18nKey: "profile.errors.emailUnchanged",