@cosmicdrift/kumiko-bundled-features 0.118.0 → 0.120.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.118.0",
+  "version": "0.120.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -21,6 +21,7 @@
     "./audit": "./src/audit/index.ts",
     "./compliance-profiles": "./src/compliance-profiles/index.ts",
     "./config": "./src/config/index.ts",
+    "./crypto-shredding": "./src/crypto-shredding/index.ts",
     "./config/web": "./src/config/web/index.ts",
     "./data-retention": "./src/data-retention/index.ts",
     "./readiness": "./src/readiness/index.ts",
@@ -95,11 +96,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.118.0",
-    "@cosmicdrift/kumiko-framework": "0.118.0",
-    "@cosmicdrift/kumiko-headless": "0.118.0",
-    "@cosmicdrift/kumiko-renderer": "0.118.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.118.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.120.0",
+    "@cosmicdrift/kumiko-framework": "0.120.0",
+    "@cosmicdrift/kumiko-headless": "0.120.0",
+    "@cosmicdrift/kumiko-renderer": "0.120.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.120.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -0,0 +1,283 @@
+// Auth-Flows mit aktivem PII-KMS + Blind-Index (#818 PR 2): user.email und
+// invitation.email liegen als Ciphertext in der DB. Login und alle drei
+// Invite-Accept-Branches müssen über die generierte email_bidx-Spalte
+// (Equality-Lookup) bzw. decryptStoredEmail (Vergleich/Weiterverwendung)
+// unverändert funktionieren — vor diesem PR war jeder dieser Pfade mit
+// KMS silently broken.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+import { hashPassword } from "../password-hashing";
+import { seedUser } from "../seeding";
+
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+const BOB_EMAIL = "bob.kms@example.com";
+const BOB_PASSWORD = "bob-existing-pw-1234";
+const CAROL_EMAIL = "carol.kms@example.com";
+const CAROL_PASSWORD = "carol-new-pw-1234";
+const BIDX_KEY = Buffer.alloc(32, 7).toString("base64");
+
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+let aliceId: string;
+let bobId: string;
+let TENANT_A_ID: TenantId;
+let TENANT_B_ID: TenantId;
+
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in invite mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  // KMS + bidx-Key MUESSEN vor den Seeds stehen — seedUser läuft über den
+  // Executor, die Rows sollen den verschlüsselten Prod-Zustand abbilden.
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+  configureBlindIndexKey(BIDX_KEY);
+
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const allKeys = await stack.redis.redis.keys("invite:*");
+  if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
+
+  TENANT_A_ID = crypto.randomUUID() as TenantId;
+  TENANT_B_ID = crypto.randomUUID() as TenantId;
+  await seedTenant(stack.db, {
+    id: TENANT_A_ID,
+    key: `kms-a-${TENANT_A_ID.slice(0, 8)}`,
+    name: "KMS Tenant A",
+  });
+  await seedTenant(stack.db, {
+    id: TENANT_B_ID,
+    key: `kms-b-${TENANT_B_ID.slice(0, 8)}`,
+    name: "KMS Tenant B",
+  });
+
+  ({ id: aliceId } = await seedUser(stack.db, {
+    email: "alice.kms@example.com",
+    displayName: "Alice",
+    passwordHash: await hashPassword("alice-pw-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: aliceId,
+    tenantId: TENANT_A_ID,
+    roles: ["Admin"],
+  });
+
+  ({ id: bobId } = await seedUser(stack.db, {
+    email: BOB_EMAIL,
+    displayName: "Bob",
+    passwordHash: await hashPassword(BOB_PASSWORD),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: bobId,
+    tenantId: TENANT_B_ID,
+    roles: ["User"],
+  });
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+function aliceSession(): SessionUser {
+  return { id: aliceId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+}
+
+function bobSession(): SessionUser {
+  return { id: bobId, tenantId: TENANT_B_ID, roles: ["User"] };
+}
+
+async function inviteEmail(email: string, role: string): Promise<string> {
+  await stack.http.writeOk(AuthHandlers.inviteCreate, { email, role }, aliceSession());
+  const sent = emailTransport.sent.at(-1);
+  if (!sent) throw new Error("invite-create didn't send a mail");
+  return extractTokenFromMail(sent.html);
+}
+
+async function rawUserRow(id: string): Promise<Record<string, unknown>> {
+  const rows = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
+    `SELECT * FROM "${userTable.tableName}" WHERE id = $1`,
+    [id],
+  );
+  const row = rows[0];
+  if (!row) throw new Error(`no user row for ${id}`);
+  return row;
+}
+
+describe("auth flows with active KMS + blind index", () => {
+  test("seeded user row: ciphertext email + populated bidx column", async () => {
+    const row = await rawUserRow(bobId);
+    expect(isPiiCiphertext(row["email"])).toBe(true);
+    expect(String(row["email_bidx"])).toStartWith("kumiko-bidx:v1:");
+  });
+
+  test("login with plaintext email finds the encrypted row via bidx", async () => {
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; token?: string };
+    expect(body.isSuccess).toBe(true);
+    expect(body.token).toBeTruthy();
+  });
+
+  test("Branch 1: logged-in accept matches emails across two ciphertexts", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const invitations = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
+    expect(invitations).toHaveLength(1);
+
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteAccept,
+      { token },
+      bobSession(),
+    )) as {
+      tenantId: string;
+      alreadyMember: boolean;
+    };
+    expect(result.tenantId).toBe(TENANT_A_ID);
+    expect(result.alreadyMember).toBe(false);
+  });
+
+  test("Branch 2: invite-accept-with-login (anon + password)", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; tenantId: string };
+    expect(body.isSuccess).toBe(true);
+    expect(body.tenantId).toBe(TENANT_A_ID);
+
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, { userId: bobId });
+    expect(memberships).toHaveLength(2);
+  });
+
+  test("Branch 3: invite-signup-complete creates the user from the DECRYPTED invitation email", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Admin");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: CAROL_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; user: { id: string } };
+    expect(body.isSuccess).toBe(true);
+
+    // Carol-Row: eigener user-Subject-Ciphertext (nicht der invitation-
+    // Ciphertext durchgereicht) + Klartext-abgeleiteter displayName.
+    const row = await rawUserRow(body.user.id);
+    expect(isPiiCiphertext(row["email"])).toBe(true);
+    expect(String(row["email"])).toContain(body.user.id);
+    const decrypted = await decryptPiiFieldValues(
+      { displayName: row["display_name"] },
+      ["displayName"],
+      kms,
+      { requestId: "test" },
+    );
+    expect(decrypted["displayName"]).toBe("carol.kms");
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: CAROL_EMAIL,
+      password: CAROL_PASSWORD,
+    });
+    expect(loginRes.status).toBe(200);
+  });
+});

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,6 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -106,7 +107,10 @@ export function createInviteAcceptWithLoginHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(
+          invitation.email,
+          "auth:invite-accept-with-login",
+        );
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -24,6 +24,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import {
   INVITATION_STATUS,
@@ -100,7 +101,7 @@ export function createInviteAcceptHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(invitation.email, "auth:invite-accept");
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
@@ -110,7 +111,9 @@ export function createInviteAcceptHandler() {
         const userRow = await fetchOne<UserEmailRow>(ctx.db.raw, userTable, {
           id: event.user.id,
         });
-        const userEmail = userRow?.email;
+        const userEmail = userRow?.email
+          ? await decryptStoredPii(userRow.email, "auth:invite-accept")
+          : undefined;
         if (!userRow || !userEmail || userEmail.toLowerCase() !== invitationEmail) {
           return inviteEmailMismatch();
         }

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -32,6 +32,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -109,7 +110,10 @@ export function createInviteSignupCompleteHandler() {
           return invalidInviteToken();
 
         const invitationTenantId = invitation.tenantId;
-        const invitationEmail = invitation.email;
+        const invitationEmail = await decryptStoredPii(
+          invitation.email,
+          "auth:invite-signup-complete",
+        );
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -125,7 +125,9 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
           renderContent: spec.renderContent,
         },
         {
-          email: user.email,
+          // Row value is ciphertext with an active KMS; the byte-exact
+          // lookup above guarantees the payload IS the stored plaintext.
+          email: event.payload.email,
           appUrl: opts.appUrl,
           token,
           expiresAt: expiresAt.toString(),
@@ -136,7 +138,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
 
       const data: TokenRequestData<TSuccessKind> = {
         kind: spec.successKind,
-        email: user.email,
+        email: event.payload.email,
         token,
         expiresAt: expiresAt.toString(),
       };

package/src/channel-email/__tests__/pii-guard.test.ts

@@ -0,0 +1,56 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { guardEmailMessage, withPiiCiphertextGuard } from "../pii-guard";
+import { createInMemoryTransport } from "../types";
+
+const CIPHERTEXT = "kumiko-pii:v1:user:6b2f4a0e-1c9d-4f3a-9d2e-00000000000a:8e2Rkjj+ww==";
+const originalNodeEnv = process.env["NODE_ENV"];
+
+afterEach(() => {
+  if (originalNodeEnv === undefined) delete process.env["NODE_ENV"];
+  else process.env["NODE_ENV"] = originalNodeEnv;
+});
+
+describe("guardEmailMessage", () => {
+  test("clean message passes through untouched", () => {
+    const msg = { to: "marc@example.com", subject: "Hi", html: "<p>Hi</p>" };
+    expect(guardEmailMessage(msg)).toBe(msg);
+  });
+
+  test("ciphertext recipient is always refused — even in production", () => {
+    process.env["NODE_ENV"] = "production";
+    expect(() => guardEmailMessage({ to: CIPHERTEXT, subject: "Hi", html: "x" })).toThrow(
+      /recipient address is a PII ciphertext/,
+    );
+  });
+
+  test("ciphertext in body fails loud outside production", () => {
+    expect(() =>
+      guardEmailMessage({ to: "marc@example.com", subject: "Hi", html: `<p>${CIPHERTEXT}</p>` }),
+    ).toThrow(/subject\/body contains a PII ciphertext/);
+  });
+
+  test("production redacts body/subject instead of throwing", () => {
+    process.env["NODE_ENV"] = "production";
+    const out = guardEmailMessage({
+      to: "marc@example.com",
+      subject: `Re: ${CIPHERTEXT}`,
+      html: `<p>${CIPHERTEXT}</p>`,
+    });
+    expect(out.subject).toBe("Re: [pii-redacted]");
+    expect(out.html).toBe("<p>[pii-redacted]</p>");
+  });
+});
+
+describe("withPiiCiphertextGuard", () => {
+  test("wrapped transport refuses a ciphertext recipient before sending", async () => {
+    const inner = createInMemoryTransport();
+    const guarded = withPiiCiphertextGuard(inner);
+    await expect(guarded.send({ to: CIPHERTEXT, subject: "x", html: "y" })).rejects.toThrow(
+      /recipient address is a PII ciphertext/,
+    );
+    expect(inner.sent).toHaveLength(0);
+
+    await guarded.send({ to: "ok@example.com", subject: "x", html: "y" });
+    expect(inner.sent).toHaveLength(1);
+  });
+});

package/src/channel-email/email-channel.ts

@@ -6,6 +6,7 @@ import type {
   NotificationRenderer,
   RenderedMessage,
 } from "../delivery";
+import { guardEmailMessage } from "./pii-guard";
 import type { EmailTransport } from "./types";
 
 export type EmailChannelOptions = {
@@ -53,7 +54,7 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
 
     async send(address, message, _ctx, rendered) {
       const { html, subject } = rendered ?? (await renderMessage(message));
-      await transport.send({ to: address, subject, html });
+      await transport.send(guardEmailMessage({ to: address, subject, html }));
       return { status: "sent", address };
     },
   };

package/src/channel-email/index.ts

@@ -1,5 +1,6 @@
 export { createEmailChannel, type EmailChannelOptions } from "./email-channel";
 export { createChannelEmailFeature } from "./feature";
+export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard";
 export {
   createSmtpTransport,
   createSmtpTransportFromEnv,

package/src/channel-email/pii-guard.ts

@@ -0,0 +1,36 @@
+import { PII_CIPHERTEXT_PREFIX } from "@cosmicdrift/kumiko-framework/crypto";
+import type { EmailMessage, EmailTransport } from "./types";
+
+const isProductionEnv = () => process.env["NODE_ENV"] === "production";
+const CIPHERTEXT_RE = /kumiko-pii:v1:[^"\s<>\\]*/g;
+
+// A PII ciphertext never belongs in an outgoing mail. A ciphertext RECIPIENT
+// is always refused (the address is garbage — better no mail than a leaked
+// blob); ciphertext in subject/body fails loud in dev and is redacted+logged
+// in prod.
+export function guardEmailMessage(message: EmailMessage): EmailMessage {
+  if (message.to.includes(PII_CIPHERTEXT_PREFIX)) {
+    throw new Error(
+      "[channel-email] refusing to send: recipient address is a PII ciphertext " +
+        `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
+    );
+  }
+  const leaking =
+    message.subject.includes(PII_CIPHERTEXT_PREFIX) || message.html.includes(PII_CIPHERTEXT_PREFIX);
+  if (!leaking) return message;
+  const detail =
+    "[channel-email] mail subject/body contains a PII ciphertext " +
+    `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before rendering.`;
+  if (!isProductionEnv()) throw new Error(detail);
+  // biome-ignore lint/suspicious/noConsole: operator-visibility for a redacted prod leak
+  console.error(detail);
+  return {
+    ...message,
+    subject: message.subject.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+    html: message.html.replace(CIPHERTEXT_RE, "[pii-redacted]"),
+  };
+}
+
+export function withPiiCiphertextGuard(transport: EmailTransport): EmailTransport {
+  return { ...transport, send: async (message) => transport.send(guardEmailMessage(message)) };
+}

package/src/config/table.ts

@@ -25,7 +25,7 @@ export const configValueEntity = createEntity({
     // breaking the null-vs-missing distinction the resolver already draws.
     value: createTextField({}),
     // user-scope row: userId populated. tenant- / system-scope: null.
-    userId: createTextField({ pii: true }),
+    userId: createTextField({ allowPlaintext: "pseudonymous-fk" }),
   },
   indexes: [
     { unique: true, columns: ["key", "tenantId", "userId"], name: "read_config_values_unique" },