@cosmicdrift/kumiko-bundled-features 0.149.1 → 0.150.0

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -31,8 +31,8 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -181,9 +181,10 @@ export const downloadByTokenQuery = defineQueryHandler({
       });
     }
 
-    // Step 5: signed-URL via provider. createFileProviderForTenant nutzt
-    // requestedFromTenantId (gleicher Tenant wie beim Worker-Storage-Write).
-    const provider = await createFileProviderForTenant(
+    // Step 5: signed-URL via provider, explicitly bound to the job's
+    // tenant — NOT the ambient request tenant (anonymous magic-link path
+    // has none under resolverTrust: "authoritative").
+    const provider = await resolveTenantFileProvider(
       ctx,
       jobRow.requestedFromTenantId,
       "user-data-rights:query:download-by-token",

package/src/user-data-rights/lib/tenant-file-provider.ts

@@ -0,0 +1,62 @@
+// Resolves the GDPR-download file-storage provider explicitly for
+// `jobRow.requestedFromTenantId` instead of the ambient request tenant.
+//
+// Both download handlers (by-token, by-job) used to call
+// `createFileProviderForTenant(ctx, jobRow.requestedFromTenantId, ...)`,
+// which reads the PROVIDER SELECTION from `ctx.config` — bound to the
+// caller's own ambient tenant, not the job's tenant:
+//   - by-token (anonymous magic-link, httpRoute): under
+//     `resolverTrust: "authoritative"` without `defaultTenantId` there is
+//     no ambient tenant at all — `ctx.config` throws, 500s the whole
+//     GDPR download flow.
+//   - by-job (session-authed): a user can own jobs across tenants
+//     (cross-tenant-same-user); the ambient session tenant silently
+//     picks the WRONG tenant's provider config for a job requested from
+//     a different tenant.
+//
+// Fix: build a fresh config accessor bound explicitly to the given
+// tenantId (same construction as `makeTenantStorageProviderResolver`,
+// which the export/forget crons already use), instead of the ambient
+// `ctx.config`. Deliberately NOT `ctx._fileProviderResolver` — that
+// resolver is boot-built and per-tenant-cached for the process lifetime,
+// so an operator switching `file-foundation:config:provider` mid-session
+// wouldn't take effect until the cache evicts.
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { createConfigAccessor } from "../../config";
+import { createFileProviderForTenant } from "../../file-foundation";
+
+export interface TenantFileProviderCtx {
+  readonly registry?: Registry;
+  readonly configResolver?: ConfigResolver;
+  readonly secrets?: SecretsContext;
+  readonly db: { readonly raw: DbConnection | TenantDb };
+}
+
+export async function resolveTenantFileProvider(
+  ctx: TenantFileProviderCtx,
+  tenantId: string,
+  handlerName: string,
+): Promise<FileStorageProvider> {
+  if (!ctx.registry || !ctx.configResolver) {
+    throw new Error(
+      `${handlerName}: ctx.registry/ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+    );
+  }
+  const config = createConfigAccessor(
+    ctx.registry,
+    ctx.configResolver,
+    tenantId as TenantId, // @cast-boundary engine-payload: TenantId brand
+    SYSTEM_USER_ID,
+    ctx.db.raw,
+    ctx.secrets,
+  );
+  return createFileProviderForTenant(
+    { config, registry: ctx.registry, secrets: ctx.secrets, _userId: SYSTEM_USER_ID },
+    tenantId,
+    handlerName,
+  );
+}

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -18,7 +18,6 @@ import {
 import { expectErrorIncludes, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -28,6 +27,7 @@ import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";

package/src/user-profile/handlers/change-email.write.ts

@@ -6,8 +6,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { AuthErrors, verifyPassword } from "../../auth-email-password";
-import { decryptStoredPii } from "../../shared";
+import { AuthErrors } from "../../auth-email-password";
+import { decryptStoredPii, verifyPassword } from "../../shared";
 import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 

package/src/auth-email-password/password-hashing.ts

@@ -1,4 +0,0 @@
-// Moved to shared/ — reused across admin-shell, audit, sessions, tenant,
-// user-data-rights, user-profile, and now auth-mfa. Re-exported here for the
-// existing call sites within this feature that import via "./password-hashing".
-export { hashPassword, verifyDummyPassword, verifyPassword } from "../shared/password-hashing";