@cosmicdrift/kumiko-bundled-features 0.125.1 → 0.126.0

package/src/tenant-lifecycle/stages.ts

@@ -0,0 +1,176 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+  deleteMany,
+  type EntityTableMeta,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  EXT_EXTERNAL_RESOURCE,
+  EXT_INFRA_RESOURCE,
+  EXT_SEARCH_ADAPTER,
+  EXT_STORAGE_PROVIDER,
+  EXT_TENANT_DATA,
+  type Registry,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { tenantEntity, tenantMembershipsTable, tenantTable } from "../tenant";
+import type { TenantDestructionStageName } from "./constants";
+
+export type DestructionStageCtx = {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly tenantId: TenantId;
+  readonly log?: (message: string) => void;
+};
+
+export type DestructionStage = {
+  readonly name: TenantDestructionStageName;
+  readonly maxAttempts: number;
+  readonly run: (ctx: DestructionStageCtx) => Promise<void>;
+};
+
+const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
+
+async function runExtensionDestroyHooks(
+  registry: Registry,
+  extensionName: string,
+  hookKey: "destroyTenant",
+  ctx: DestructionStageCtx,
+): Promise<void> {
+  const usages = registry.getExtensionUsages(extensionName);
+  for (const usage of usages) {
+    const hook = usage.options?.[hookKey];
+    if (typeof hook !== "function") continue;
+    await (hook as (tenantId: TenantId, hookCtx: DestructionStageCtx) => Promise<void>)(
+      ctx.tenantId,
+      ctx,
+    );
+  }
+}
+
+async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
+  const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
+  for (const usage of usages) {
+    const destroy = usage.options?.["destroy"] as
+      | ((ctx: DestructionStageCtx) => Promise<void>)
+      | undefined;
+    if (!destroy) continue;
+    await destroy(ctx);
+  }
+}
+
+async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<void> {
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    ctx.log?.("[tenant-lifecycle] subject-keys stage skipped: no KMS adapter configured");
+    // skip: KMS optional — apps without crypto-shredding still run other destroy stages
+    return;
+  }
+  const memberships = await selectMany<{ userId: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  const subjects: SubjectId[] = [
+    { kind: "tenant", tenantId: ctx.tenantId },
+    ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
+  ];
+  for (const subject of subjects) {
+    await kms.eraseKey(subject, {
+      requestId: `tenant-lifecycle:destroy:${ctx.tenantId}`,
+      eraseReason: "tenant-destroy stage subject-keys",
+    });
+  }
+}
+
+async function purgeTenantCache(ctx: DestructionStageCtx): Promise<void> {
+  // ponytail: Redis SCAN+DEL is wired when ctx carries a redis client; until
+  // then this stage is a documented no-op (no cache layer in test stack).
+  ctx.log?.("[tenant-lifecycle] cache stage: no redis client in ctx — skipped");
+}
+
+async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<void> {
+  const now = getTemporal().Now.instant();
+  const user = createSystemUser(ctx.tenantId);
+  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  await tenantCrud.update(
+    {
+      id: ctx.tenantId,
+      changes: {
+        status: "destroyed",
+        destroyedAt: now,
+        isEnabled: false,
+      },
+    },
+    user,
+    db,
+    { skipOptimisticLock: true },
+  );
+  await deleteMany(ctx.db, tenantMembershipsTable as EntityTableMeta, {
+    tenantId: ctx.tenantId,
+  });
+}
+
+export const DESTRUCTION_STAGES: readonly DestructionStage[] = [
+  {
+    name: "external-resources",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_EXTERNAL_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "search-indices",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_SEARCH_ADAPTER, "destroyTenant", ctx),
+  },
+  {
+    name: "cache",
+    maxAttempts: 1,
+    run: purgeTenantCache,
+  },
+  {
+    name: "app-data",
+    maxAttempts: 3,
+    run: runTenantDataHooks,
+  },
+  {
+    name: "subject-keys",
+    maxAttempts: 3,
+    run: eraseSubjectKeys,
+  },
+  {
+    name: "files",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_STORAGE_PROVIDER, "destroyTenant", ctx),
+  },
+  {
+    name: "infra-resources",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_INFRA_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "tenant-row",
+    maxAttempts: 1,
+    run: tombstoneTenantRow,
+  },
+];
+
+export function pickNextStage(
+  completedStages: ReadonlySet<string>,
+  abandonedStages: ReadonlySet<string>,
+): DestructionStage | null {
+  if (abandonedStages.size > 0) return null;
+  for (const stage of DESTRUCTION_STAGES) {
+    if (completedStages.has(stage.name)) continue;
+    return stage;
+  }
+  return null;
+}
+
+export function isDestructionPipelineComplete(completedStages: ReadonlySet<string>): boolean {
+  return DESTRUCTION_STAGES.every((stage) => completedStages.has(stage.name));
+}

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,10 +1,12 @@
 import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
 import { createSessionsFeature } from "../../sessions/feature";
 import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
 
 // Read-only GDPR inspector screens live IN user-data-rights (the boot-validator
@@ -16,13 +18,19 @@ import { createUserDataRightsFeature } from "../feature";
 // so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
 
 describe("user-data-rights read-only inspector screens", () => {
+  // A realistic assembly: mounting user-data-rights without its default hooks
+  // now fails the V3 boot gate (the framework `user` entity holds PII with no
+  // erase path). Real apps mount the defaults (which hard-require `files`)
+  // alongside — so this set mirrors that.
   const features = [
     createConfigFeature(),
     createUserFeature(),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
+    createFilesFeature(),
     createUserDataRightsFeature(),
+    createUserDataRightsDefaultsFeature(),
   ];
 
   test("the assembled feature set boot-validates", () => {

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -791,6 +791,10 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
             },
           ],
         }),
+        // no-op: this fixture exercises only the export/file path; the erase
+        // side is covered by forget-*.integration.test.ts. Required so the
+        // V2 boot gate (export-without-erase) does not reject the stack.
+        delete: async () => {},
       });
     });