@cosmicdrift/kumiko-bundled-features 0.125.2 → 0.127.0

package/src/tenant-lifecycle/stages.ts

@@ -0,0 +1,206 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  EXT_EXTERNAL_RESOURCE,
+  EXT_INFRA_RESOURCE,
+  EXT_SEARCH_ADAPTER,
+  EXT_STORAGE_PROVIDER,
+  EXT_TENANT_DATA,
+  type Registry,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  tenantEntity,
+  tenantMembershipEntity,
+  tenantMembershipsTable,
+  tenantTable,
+} from "../tenant";
+import type { TenantDestructionStageName } from "./constants";
+import { invalidateTenantLifecycleGate } from "./lifecycle-gate";
+
+export type DestructionStageCtx = {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly tenantId: TenantId;
+  readonly log?: (message: string) => void;
+};
+
+export type DestructionStage = {
+  readonly name: TenantDestructionStageName;
+  readonly maxAttempts: number;
+  readonly run: (ctx: DestructionStageCtx) => Promise<void>;
+};
+
+const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
+const tenantMembershipCrud = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  {
+    entityName: "tenant-membership",
+  },
+);
+
+async function runExtensionDestroyHooks(
+  registry: Registry,
+  extensionName: string,
+  hookKey: "destroyTenant",
+  ctx: DestructionStageCtx,
+): Promise<void> {
+  const usages = registry.getExtensionUsages(extensionName);
+  for (const usage of usages) {
+    const hook = usage.options?.[hookKey];
+    if (typeof hook !== "function") continue;
+    await (hook as (tenantId: TenantId, hookCtx: DestructionStageCtx) => Promise<void>)(
+      ctx.tenantId,
+      ctx,
+    );
+  }
+}
+
+async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
+  const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
+  for (const usage of usages) {
+    const destroy = usage.options?.["destroy"] as
+      | ((ctx: DestructionStageCtx) => Promise<void>)
+      | undefined;
+    if (!destroy) continue;
+    await destroy(ctx);
+  }
+}
+
+async function eraseSubjectKeys(ctx: DestructionStageCtx): Promise<void> {
+  const kms = configuredPiiSubjectKms();
+  if (!kms) {
+    ctx.log?.("[tenant-lifecycle] subject-keys stage skipped: no KMS adapter configured");
+    // skip: KMS optional — apps without crypto-shredding still run other destroy stages
+    return;
+  }
+  const memberships = await selectMany<{ userId: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  const subjects: SubjectId[] = [
+    { kind: "tenant", tenantId: ctx.tenantId },
+    ...memberships.map((m) => ({ kind: "user" as const, userId: m.userId })),
+  ];
+  for (const subject of subjects) {
+    await kms.eraseKey(subject, {
+      requestId: `tenant-lifecycle:destroy:${ctx.tenantId}`,
+      eraseReason: "tenant-destroy stage subject-keys",
+    });
+  }
+}
+
+async function purgeTenantCache(ctx: DestructionStageCtx): Promise<void> {
+  // ponytail: Redis SCAN+DEL is wired when ctx carries a redis client; until
+  // then this stage is a documented no-op (no cache layer in test stack).
+  ctx.log?.("[tenant-lifecycle] cache stage: no redis client in ctx — skipped");
+}
+
+async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<void> {
+  const now = getTemporal().Now.instant();
+  const user = createSystemUser(ctx.tenantId);
+  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  // Per-row forget() through the executor, not a bulk deleteMany: memberships
+  // are an ES-managed projection (add/remove/update-roles all go through
+  // tenantMembershipCrud), so a raw table write here is eventless — a future
+  // projection rebuild would replay the historical add-member events and
+  // resurrect rows this stage removed. forget() (Art.17 hard-purge) keeps the
+  // erasure rebuild-safe and gives each membership its own audit event.
+  const memberships = await selectMany<{ id: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  for (const membership of memberships) {
+    const result = await tenantMembershipCrud.forget({ id: membership.id }, user, db);
+    // executor writes return {isSuccess:false} on failure, they don't throw —
+    // a silently-discarded result here would report this stage "succeeded"
+    // while membership PII survives. Throw so the pipeline's retry/abandon
+    // handling (runNextDestructionStage) sees it instead.
+    if (!result.isSuccess) {
+      throw new Error(
+        `tenant-lifecycle: failed to forget membership ${membership.id} for tenant ${ctx.tenantId}: ${result.error.message}`,
+      );
+    }
+  }
+  await tenantCrud.update(
+    {
+      id: ctx.tenantId,
+      changes: {
+        status: "destroyed",
+        destroyedAt: now,
+        isEnabled: false,
+      },
+    },
+    user,
+    db,
+    { skipOptimisticLock: true },
+  );
+  invalidateTenantLifecycleGate(ctx.tenantId);
+}
+
+export const DESTRUCTION_STAGES: readonly DestructionStage[] = [
+  {
+    name: "external-resources",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_EXTERNAL_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "search-indices",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_SEARCH_ADAPTER, "destroyTenant", ctx),
+  },
+  {
+    name: "cache",
+    maxAttempts: 1,
+    run: purgeTenantCache,
+  },
+  {
+    name: "app-data",
+    maxAttempts: 3,
+    run: runTenantDataHooks,
+  },
+  {
+    name: "subject-keys",
+    maxAttempts: 3,
+    run: eraseSubjectKeys,
+  },
+  {
+    name: "files",
+    maxAttempts: 3,
+    run: (ctx) =>
+      runExtensionDestroyHooks(ctx.registry, EXT_STORAGE_PROVIDER, "destroyTenant", ctx),
+  },
+  {
+    name: "infra-resources",
+    maxAttempts: 3,
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_INFRA_RESOURCE, "destroyTenant", ctx),
+  },
+  {
+    name: "tenant-row",
+    maxAttempts: 1,
+    run: tombstoneTenantRow,
+  },
+];
+
+export function pickNextStage(
+  completedStages: ReadonlySet<string>,
+  abandonedStages: ReadonlySet<string>,
+): DestructionStage | null {
+  if (abandonedStages.size > 0) return null;
+  for (const stage of DESTRUCTION_STAGES) {
+    if (completedStages.has(stage.name)) continue;
+    return stage;
+  }
+  return null;
+}
+
+export function isDestructionPipelineComplete(completedStages: ReadonlySet<string>): boolean {
+  return DESTRUCTION_STAGES.every((stage) => completedStages.has(stage.name));
+}

package/src/tier-engine/feature.ts

@@ -73,6 +73,7 @@ import { tierAssignmentEntity } from "./entity";
 import { getActiveTierQuery } from "./handlers/active-tier.query";
 import { getTenantTierQuery } from "./handlers/get-tenant-tier.query";
 import { createSetTenantTierWrite } from "./handlers/set-tenant-tier.write";
+import { TIER_ENGINE_I18N } from "./i18n";
 import { isTrialActive, type TrialPolicy } from "./trial";
 
 // Drizzle-table for the tier-assignment-entity. Built once at module-load
@@ -234,6 +235,7 @@ export function createTierEngineFeature<
     // verdrahtet (Platform-Admin-Hoheit, nicht App-konfigurierbar). App
     // platziert ihn nur via r.nav("tier-engine:screen:tier-admin"); die
     // Komponente liefert tierEngineClient() aus dem ./web-subpath.
+    r.translations({ keys: TIER_ENGINE_I18N });
     r.screen({
       id: TIER_ADMIN_SCREEN_ID,
       type: "custom",

package/src/tier-engine/i18n.ts

@@ -5,8 +5,15 @@
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tier-admin.title": { de: "Tier manuell zuweisen", en: "Assign tier manually" },
+};
+
 export const defaultTranslations: TranslationsByLocale = {
   de: {
+    "screen:tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.explainer":
       "Weise einem Tenant ein Tier ohne Kauf zu. Der Grant wird als „manuell“ markiert und von einem späteren Billing-Sync nicht überschrieben.",
@@ -22,6 +29,7 @@ export const defaultTranslations: TranslationsByLocale = {
       "Diese App hat keine TierMap konfiguriert — es gibt keine zuweisbaren Tiers.",
   },
   en: {
+    "screen:tier-admin.title": "Assign tier manually",
     "tier-admin.title": "Assign tier manually",
     "tier-admin.explainer":
       "Grant a tenant a tier without a purchase. The grant is marked as “manual” and a later billing sync won't overwrite it.",

package/src/tier-engine/web/tier-admin-screen.tsx

@@ -37,7 +37,7 @@ type Status =
 
 export function TierAdminScreen(): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button, Banner, Heading, Text } = usePrimitives();
+  const { Field, Input, Button, Banner, Form, Text } = usePrimitives();
   const dispatcher = useDispatcher();
 
   // ponytail: nur die erste Seite (default-limit, nextCursor ignoriert) —
@@ -92,8 +92,7 @@ export function TierAdminScreen(): ReactNode {
   const canSubmit = tenantId !== "" && tier !== "" && !submitting;
 
   return (
-    <FormScreenShell testId="tier-admin-screen" className="flex max-w-xl flex-col gap-6">
-      <Heading variant="page">{t("tier-admin.title")}</Heading>
+    <FormScreenShell testId="tier-admin-screen" className="flex flex-col gap-6">
       <Text variant="small">{t("tier-admin.explainer")}</Text>
 
       {tenantsQuery.error !== null && (
@@ -107,7 +106,23 @@ export function TierAdminScreen(): ReactNode {
         </Banner>
       )}
 
-      <Section>
+      <Form
+        testId="tier-admin-form"
+        onSubmit={(e) => {
+          e?.preventDefault();
+          void onSave();
+        }}
+        actions={
+          <Button
+            type="submit"
+            disabled={!canSubmit}
+            loading={submitting}
+            testId="tier-admin-submit"
+          >
+            {t("tier-admin.submit")}
+          </Button>
+        }
+      >
         <Field id="tier-admin-tenant" label={t("tier-admin.tenant.label")} required>
           <Input
             kind="select"
@@ -147,16 +162,7 @@ export function TierAdminScreen(): ReactNode {
             {t(status.messageKey)}
           </Banner>
         )}
-
-        <Button
-          onClick={() => void onSave()}
-          disabled={!canSubmit}
-          loading={submitting}
-          testId="tier-admin-submit"
-        >
-          {t("tier-admin.submit")}
-        </Button>
-      </Section>
+      </Form>
     </FormScreenShell>
   );
 }

package/src/user/feature.ts

@@ -5,6 +5,7 @@ import { findForAuthQuery } from "./handlers/find-for-auth.query";
 import { listQuery } from "./handlers/list.query";
 import { meQuery } from "./handlers/me.query";
 import { updateWrite } from "./handlers/update.write";
+import { USER_I18N } from "./i18n";
 import { userEntity } from "./schema/user";
 import { userEditScreen, userListScreen } from "./screens";
 
@@ -43,6 +44,8 @@ export function createUserFeature(): FeatureDefinition {
     r.screen(userListScreen);
     r.screen(userEditScreen);
 
+    r.translations({ keys: USER_I18N });
+
     return { handlers, queries };
   });
 }

package/src/user/i18n.ts

@@ -0,0 +1,20 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:user-list.title": { de: "Benutzer", en: "Users" },
+  "screen:user-edit.title": { de: "Benutzer bearbeiten", en: "Edit user" },
+  "user:entity:user:field:email": { de: "E-Mail", en: "Email" },
+  "user:entity:user:field:displayName": { de: "Anzeigename", en: "Display name" },
+  "user:entity:user:field:status": { de: "Status", en: "Status" },
+  "user:entity:user:field:emailVerified": { de: "E-Mail bestätigt", en: "Email verified" },
+  "user:entity:user:field:locale": { de: "Sprache", en: "Locale" },
+  "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "user:entity:user:field:status:option:restricted": { de: "Eingeschränkt", en: "Restricted" },
+  "user:entity:user:field:status:option:deletionRequested": {
+    de: "Löschung angefordert",
+    en: "Deletion requested",
+  },
+  "user:entity:user:field:status:option:deleted": { de: "Gelöscht", en: "Deleted" },
+  "user:entity:user:field:emailVerified:option:true": { de: "Ja", en: "Yes" },
+  "user:entity:user:field:emailVerified:option:false": { de: "Nein", en: "No" },
+};

package/src/user/schema/user.ts

@@ -136,6 +136,7 @@ export const userEntity = createEntity({
       required: true,
       default: USER_STATUS.Active,
       options: USER_STATUS_OPTIONS,
+      sortable: true,
       access: { write: access.privileged },
     }),
 

package/src/user/screens.ts

@@ -7,10 +7,6 @@ import type {
 // feature runs with `r.systemScope()`, the entityList query returns every
 // user across all tenants — the SystemAdmin platform roster. Both screens are
 // SystemAdmin-gated and stay inert until an app navs them (no auto-nav).
-//
-// Field labels come from the renderer's humanizeSlug fallback (no i18n keys
-// registered) — "Display Name", "Email Verified" etc. Apps can override via
-// their own translations under the `user:entity:user:field:*` convention.
 
 export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
@@ -26,9 +22,9 @@ export const userListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  // No SearchAdapter assumption: search is opt-in per app infra, not a
-  // universal default for a bundled screen.
-  searchable: false,
+  defaultSort: { field: "status", dir: "asc" },
+  // ponytail: screen searchable but email is encrypted PII — list search uses non-encrypted columns only.
+  searchable: true,
   access: { roles: ["SystemAdmin"] },
 };
 
@@ -44,14 +40,6 @@ export const userEditScreen: EntityEditScreenDefinition = {
       },
     ],
   },
-  // `roles` is deliberately NOT editable here: it is a raw JSON text column
-  // (`["SystemAdmin"]`) — a free-text input would let a typo corrupt the
-  // privilege column on a live platform. Role management needs a dedicated
-  // surface; the list still shows status for triage.
-  //
-  // Create dispatches user:write:user:create (email + displayName required —
-  // both in the form). Delete is suppressed: there is no user:write:user:delete
-  // — user removal is the GDPR status/forget flow, not a hard delete.
   allowDelete: false,
   access: { roles: ["SystemAdmin"] },
 };

package/src/user-data-rights/feature.ts

@@ -28,6 +28,7 @@ import {
 import { requestExportWrite } from "./handlers/request-export.write";
 import { restrictAccountWrite } from "./handlers/restrict-account.write";
 import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write";
+import { USER_DATA_RIGHTS_I18N } from "./i18n";
 import {
   type GdprMailDefaults,
   isMailTransportAvailable,
@@ -257,6 +258,22 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.screen(exportJobDetailScreen);
     r.screen(downloadAttemptListScreen);
 
+    r.nav({
+      id: "export-job-list",
+      label: "user-data-rights:nav.exportJobs",
+      icon: "download",
+      screen: "user-data-rights:screen:export-job-list",
+      order: 25,
+      access: { roles: ["SystemAdmin"] },
+    });
+
+    r.translations({
+      keys: {
+        ...USER_DATA_RIGHTS_I18N,
+        "user-data-rights:nav.exportJobs": { de: "DSGVO-Exporte", en: "GDPR exports" },
+      },
+    });
+
     // Dormant Self-Service-Screen (Art. 15/17/18/20): Export, Aktivitäts-
     // protokoll, Einschränkung, Löschung in einem Screen. Kein r.nav — die
     // App platziert ihn im eingeloggten Bereich. Die React-Component kommt

package/src/user-data-rights/i18n.ts

@@ -1,37 +1,36 @@
-// @runtime client
-//
-// Default-Translations fuer user-data-rights Error-Wire-Keys (S2.U3 Atom 4b.fix3).
-//
-// Wire-Errors aus den download-handlers tragen i18nKeys statt fixe
-// Strings — UI rendert die Keys ueber den Renderer-LocaleProvider. Apps
-// koennen einzelne Keys via `userDataRightsClient({ translations: { de:
-// {...} } })` ueberschreiben (Pattern matched auth-email-password).
-//
-// **Scope 4b.fix3:** nur die download-error-keys. Andere Keys (UI-
-// Texte fuer Forget-Pfad, Status-Labels, Banner) kommen mit Atom 6+
-// (UI-Integration).
+type LocalizedString = { readonly de: string; readonly en: string };
 
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-
-export const defaultTranslations: TranslationsByLocale = {
-  de: {
-    "userDataRights.errors.download.notFound":
-      "Der Download-Link ist ungültig oder gehört zu einem anderen Konto.",
-    "userDataRights.errors.download.expired":
-      "Dein Download ist abgelaufen. Bitte fordere einen neuen Export an.",
-    "userDataRights.errors.download.unavailable":
-      "Der Export ist noch nicht fertig oder fehlgeschlagen. Bitte schau im Status-Polling nach.",
-    "userDataRights.errors.download.signedUrlNotSupported":
-      "Der Download steht aufgrund einer Server-Konfiguration aktuell nicht zur Verfügung. Der Operator wurde benachrichtigt.",
+export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:export-job-list.title": { de: "DSGVO-Exporte", en: "GDPR exports" },
+  "screen:export-job-detail.title": { de: "Export-Job", en: "Export job" },
+  "screen:download-attempt-list.title": { de: "Download-Versuche", en: "Download attempts" },
+  "screen:privacy-center.title": { de: "Datenschutz", en: "Privacy" },
+  "user-data-rights:entity:export-job:field:userId": { de: "Benutzer", en: "User" },
+  "user-data-rights:entity:export-job:field:status": { de: "Status", en: "Status" },
+  "user-data-rights:entity:export-job:field:requestedAt": { de: "Angefordert", en: "Requested" },
+  "user-data-rights:entity:export-job:field:completedAt": { de: "Abgeschlossen", en: "Completed" },
+  "user-data-rights:entity:export-job:field:expiresAt": { de: "Läuft ab", en: "Expires" },
+  "user-data-rights:entity:export-job:field:requestedFromTenantId": {
+    de: "Mandant",
+    en: "Tenant",
+  },
+  "user-data-rights:entity:export-job:field:startedAt": { de: "Gestartet", en: "Started" },
+  "user-data-rights:entity:export-job:field:downloadStorageKey": {
+    de: "Speicher-Schlüssel",
+    en: "Storage key",
+  },
+  "user-data-rights:entity:export-job:field:bytesWritten": { de: "Bytes", en: "Bytes" },
+  "user-data-rights:entity:export-job:field:errorMessage": { de: "Fehler", en: "Error" },
+  "user-data-rights:entity:download-attempt:field:attemptedAt": {
+    de: "Zeitpunkt",
+    en: "Attempted at",
   },
-  en: {
-    "userDataRights.errors.download.notFound":
-      "The download link is invalid or belongs to a different account.",
-    "userDataRights.errors.download.expired":
-      "Your download has expired. Please request a new export.",
-    "userDataRights.errors.download.unavailable":
-      "The export is not yet ready or has failed. Please check the status endpoint.",
-    "userDataRights.errors.download.signedUrlNotSupported":
-      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
+  "user-data-rights:entity:download-attempt:field:result": { de: "Ergebnis", en: "Result" },
+  "user-data-rights:entity:download-attempt:field:via": { de: "Via", en: "Via" },
+  "user-data-rights:entity:download-attempt:field:ip": { de: "IP", en: "IP" },
+  "user-data-rights:entity:download-attempt:field:attemptedByUserId": {
+    de: "Benutzer",
+    en: "User",
   },
+  "user-data-rights:entity:download-attempt:field:jobId": { de: "Job", en: "Job" },
 };

package/src/user-data-rights/schema/export-job.ts

@@ -73,6 +73,7 @@ export const exportJobEntity = createEntity({
     // nur Storage.
     userId: createTextField({
       required: true,
+      searchable: true,
     }),
 
     // **requestedFromTenantId** — der Tenant aus dem der User den Antrag
@@ -102,6 +103,7 @@ export const exportJobEntity = createEntity({
     // entsteht ohne Klick.
     requestedAt: createTimestampField({
       required: true,
+      sortable: true,
     }),
 
     // Wann hat der Worker mit dem Pickup angefangen. NULL solange

package/src/user-data-rights/screens.ts

@@ -28,7 +28,8 @@ export const exportJobListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  searchable: false,
+  defaultSort: { field: "requestedAt", dir: "desc" },
+  searchable: true,
   access: { roles: access.systemAdmin },
 };
 

package/src/user-data-rights/web/i18n.ts

@@ -141,5 +141,14 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Delete your account?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
+
+    "userDataRights.errors.download.notFound":
+      "The download link is invalid or belongs to a different account.",
+    "userDataRights.errors.download.expired":
+      "Your download has expired. Please request a new export.",
+    "userDataRights.errors.download.unavailable":
+      "The export is not yet ready or has failed. Please check the status endpoint.",
+    "userDataRights.errors.download.signedUrlNotSupported":
+      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
   },
 };