@cosmicdrift/kumiko-bundled-features 0.149.2 → 0.150.0

package/src/legal-pages/feature.ts

@@ -97,7 +97,8 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
               { slug: route.slug, lang: route.lang },
               SYSTEM_TENANT_ID,
             )) as TextBlockQueryResult;
-          } catch {
+          } catch (err) {
+            console.error(`legal-pages: text-content query failed for slug="${route.slug}"`, err);
             return c.text("legal page unavailable", 503);
           }
 

package/src/managed-pages/feature.ts

@@ -15,6 +15,7 @@ import {
   renderSafeMarkdown,
   wrapInLayout,
 } from "../page-render";
+import type { SystemQueryFn } from "../shared";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding";
 import { createBrandingQuery } from "./handlers/branding.query";
 import { bySlugQuery } from "./handlers/by-slug.query";
@@ -38,12 +39,6 @@ const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 // Handlers, symmetrisch zum legal-pages-Muster).
 const BY_SLUG_QN = "managed-pages:query:by-slug";
 
-// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
-// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
-// isn't part of the engine's public surface (only the httpRoute-
-// registration types are; same convention as seo/feature.ts's FetchApp).
-type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
-
 // Raw Handler-Return von bySlugQuery (published-only) — systemQuery dispatcht
 // direkt gegen den Handler, keine `{data}`-Envelope wie am /api/query-Wire.
 type BySlugQueryResult = {

package/src/seo/feature.ts

@@ -6,6 +6,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { LEGAL_ROUTES } from "../legal-pages";
 import { cachedSecurePageResponse } from "../page-render";
+import type { SystemQueryFn } from "../shared";
 import { SEO_CONFIG_KEYS, SEO_DEFAULT_PATHS } from "./constants";
 import { seoConfigQuery } from "./handlers/seo-config.query";
 import { buildLlmsTxt } from "./llms-txt";
@@ -19,12 +20,6 @@ const SEO_CACHE = { kind: "revalidate", maxAgeSeconds: 300 } as const;
 const MANAGED_PAGES_BY_TENANT_PUBLISHED_QN = "managed-pages:query:by-tenant-published";
 const SEO_CONFIG_QUERY_QN = "seo:query:config";
 
-// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — just
-// enough to force a specific tenant in-process. Not importing
-// HttpRouteHandlerDeps itself: it isn't part of the engine's public surface
-// (only the httpRoute-registration types are).
-type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
-
 export type ManagedPagesDiscoveryOptions = {
   /** Same per-host tenant resolver the app already passes to
    *  createManagedPagesFeature — needed to X-Tenant-scope the anonymous

package/src/sessions/__tests__/sessions-screens.boot.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config/feature";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID } from "../constants";
+import { createSessionsFeature } from "../feature";
+
+describe("sessions screens + query access alignment (kumiko-framework#255)", () => {
+  const features = [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    createSessionsFeature(),
+  ];
+
+  test("boot-validates with session-list/session-detail screens registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("session-list is projectionList, session-detail is projectionDetail, both admin-gated", () => {
+    const sessions = createSessionsFeature();
+    const list = sessions.screens[SESSION_LIST_SCREEN_ID];
+    expect(list?.type).toBe("projectionList");
+    const detail = sessions.screens[SESSION_DETAIL_SCREEN_ID];
+    expect(detail?.type).toBe("projectionDetail");
+    for (const screen of [list, detail]) {
+      if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+        expect(screen.access.roles).toEqual(["TenantAdmin", "Admin", "SystemAdmin"]);
+      }
+    }
+  });
+
+  test("session-list row-action navigates to session-detail with entityId 'id'", () => {
+    const sessions = createSessionsFeature();
+    const list = sessions.screens[SESSION_LIST_SCREEN_ID];
+    if (list?.type !== "projectionList") throw new Error("expected projectionList");
+    const openAction = list.rowActions?.find((a) => a.id === "open");
+    if (openAction?.kind !== "navigate") throw new Error("expected a navigate rowAction");
+    expect(openAction.screen).toBe(SESSION_DETAIL_SCREEN_ID);
+    expect(openAction.entityId).toBe("id");
+  });
+
+  test("sessions queries share the admin-or-higher access rule", () => {
+    const sessions = createSessionsFeature();
+    const roles = ["TenantAdmin", "Admin", "SystemAdmin"];
+    expect(rolesOf(sessions.queryHandlers["user-session:list"]?.access)).toEqual(roles);
+    expect(rolesOf(sessions.queryHandlers["user-session:detail"]?.access)).toEqual(roles);
+  });
+});

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -467,6 +467,50 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     // silent orderBy removal.
     expect(body.data[0]?.id).toBe(aliceAsAdmin.sid);
   });
+
+  // Single-row inspector backing the session-detail screen (kumiko-framework#255).
+  // Same access-gate as session:list (admin-or-higher); verifies field-shape,
+  // decryption of ip/userAgent, and the "unknown id" not-found path.
+  test("session:detail returns one decrypted row for admins, null for an unknown id", async () => {
+    const { userId: aliceId } = await h.seedUser("alice3@example.com", "pw-long-enough");
+
+    await updateRows(
+      stack.db,
+      tenantMembershipsTable,
+      { roles: JSON.stringify(["Admin"]) },
+      { userId: aliceId, tenantId: TENANT },
+    );
+    const aliceAsAdmin = await h.login("alice3@example.com", "pw-long-enough");
+
+    const res = await h.authedPost("/api/query", aliceAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: aliceAsAdmin.sid },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: { id: string; userId: string; revokedAt: string | null } | null;
+    };
+    expect(body.data?.id).toBe(aliceAsAdmin.sid);
+    expect(body.data?.userId).toBe(aliceId);
+    expect(body.data?.revokedAt).toBeNull();
+
+    const missing = await h.authedPost("/api/query", aliceAsAdmin.token, {
+      type: SessionQueries.detail,
+      payload: { id: "00000000-0000-4000-8000-0000deadbeef" },
+    });
+    expect(missing.status).toBe(200);
+    const missingBody = (await missing.json()) as { data: unknown };
+    expect(missingBody.data).toBeNull();
+
+    // Plain User gets the same 403 as session:list — same access-gate.
+    await h.seedUser("bob3@example.com", "pw-long-enough");
+    const bob = await h.login("bob3@example.com", "pw-long-enough");
+    const asUser = await h.authedPost("/api/query", bob.token, {
+      type: SessionQueries.detail,
+      payload: { id: aliceAsAdmin.sid },
+    });
+    expect(asUser.status).toBe(403);
+  });
 });
 
 // Defense-in-depth: the sessionChecker refuses a live sid once the user it

package/src/sessions/__tests__/test-helpers.ts

@@ -12,7 +12,7 @@ import { expect } from "bun:test";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import * as jose from "jose";
-import { hashPassword } from "../../auth-email-password/password-hashing";
+import { hashPassword } from "../../shared";
 import { seedTenantMembership } from "../../tenant/seeding";
 import { UserHandlers } from "../../user";
 

package/src/sessions/constants.ts

@@ -17,6 +17,8 @@ export const SessionQueries = {
   // Admin-scoped: all sessions in the caller's tenant (live + revoked).
   // Tenant isolation comes from ctx.db; access-gate is admin-or-higher.
   list: "sessions:query:user-session:list",
+  // Admin-scoped single-session inspector, backs the session-detail screen.
+  detail: "sessions:query:user-session:detail",
 } as const;
 
 export const SessionErrors = {
@@ -45,3 +47,6 @@ export const DEFAULT_SESSION_CACHE_TTL_MS = 60_000;
 // longer so refresh can rotate the token without requiring a new password).
 // MVP ships a single window; per-app overrides can come later.
 export const DEFAULT_SESSION_EXPIRY_MS = 30 * 24 * 60 * 60 * 1000;
+
+export const SESSION_LIST_SCREEN_ID = "session-list" as const;
+export const SESSION_DETAIL_SCREEN_ID = "session-detail" as const;

package/src/sessions/feature.ts

@@ -1,11 +1,18 @@
 import { buildEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SessionQueries } from "./constants";
 import { cleanupJob } from "./handlers/cleanup.job";
+import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
 import { mineQuery } from "./handlers/mine.query";
 import { revokeWrite } from "./handlers/revoke.write";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
+import { SESSIONS_I18N } from "./i18n";
 import { userSessionEntity } from "./schema/user-session";
 import type { SessionAllOthersRevoker, SessionMassRevoker } from "./session-callbacks";
 
@@ -105,6 +112,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     const queries = {
       mine: r.queryHandler(mineQuery),
       list: r.queryHandler(listQuery),
+      detail: r.queryHandler(detailQuery),
     };
 
     // Retention: chunked DELETE of expired/revoked rows. Manual trigger
@@ -143,6 +151,64 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
       autoRevoke ??= revoker;
     };
 
+    r.translations({ keys: SESSIONS_I18N });
+
+    const listAccess = { roles: access.admin };
+
+    r.screen({
+      id: SESSION_LIST_SCREEN_ID,
+      type: "projectionList",
+      query: SessionQueries.list,
+      columns: [
+        { field: "id", label: "sessions.list.col.id" },
+        { field: "userId", label: "sessions.list.col.userId" },
+        { field: "createdAt", label: "sessions.list.col.createdAt" },
+        { field: "expiresAt", label: "sessions.list.col.expiresAt" },
+        { field: "revokedAt", label: "sessions.list.col.revokedAt" },
+      ],
+      rowActions: [
+        {
+          kind: "navigate",
+          id: "open",
+          label: "sessions.list.action.open",
+          screen: SESSION_DETAIL_SCREEN_ID,
+          entityId: "id",
+          rowClick: true,
+        },
+      ],
+      access: listAccess,
+    });
+    r.screen({
+      id: SESSION_DETAIL_SCREEN_ID,
+      type: "projectionDetail",
+      query: SessionQueries.detail,
+      listScreenId: SESSION_LIST_SCREEN_ID,
+      layout: {
+        sections: [
+          {
+            fields: ["id", "userId", "createdAt", "expiresAt", "revokedAt", "ip", "userAgent"],
+          },
+        ],
+      },
+      fieldLabels: {
+        id: "sessions.detail.field.id",
+        userId: "sessions.detail.field.userId",
+        createdAt: "sessions.detail.field.createdAt",
+        expiresAt: "sessions.detail.field.expiresAt",
+        revokedAt: "sessions.detail.field.revokedAt",
+        ip: "sessions.detail.field.ip",
+        userAgent: "sessions.detail.field.userAgent",
+      },
+      access: listAccess,
+    });
+    r.nav({
+      id: "session-list",
+      label: "sessions:nav.sessionList",
+      icon: "list",
+      screen: "sessions:screen:session-list",
+      order: 10,
+    });
+
     return { handlers, queries, bindAutoRevokeOnPasswordChange };
   });
 }

package/src/sessions/handlers/detail.query.ts

@@ -0,0 +1,36 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
+import { userSessionTable } from "../schema/user-session";
+
+// Admin single-session inspector — mirrors list.query's decrypt handling for
+// the one-row case. ctx.db (TenantDb) applies tenant-scoping automatically.
+export const detailQuery = defineQueryHandler({
+  name: "user-session:detail",
+  schema: z.object({ id: z.uuid() }),
+  access: { roles: access.admin },
+  handler: async (query, ctx) => {
+    const row = await fetchOne<{
+      id: string;
+      userId: string;
+      createdAt: unknown;
+      expiresAt: unknown;
+      revokedAt: unknown;
+      ip: string | null;
+      userAgent: string | null;
+    }>(ctx.db, userSessionTable, { id: query.payload.id });
+    if (!row) return null;
+    return {
+      id: row.id,
+      userId: row.userId,
+      createdAt: row.createdAt,
+      expiresAt: row.expiresAt,
+      revokedAt: row.revokedAt,
+      ip: row.ip ? await decryptStoredPii(row.ip, "sessions:detail") : row.ip,
+      userAgent: row.userAgent
+        ? await decryptStoredPii(row.userAgent, "sessions:detail")
+        : row.userAgent,
+    };
+  },
+});

package/src/sessions/i18n.ts

@@ -0,0 +1,23 @@
+// @runtime client
+// Server + client i18n for the sessions operator screens.
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const SESSIONS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:session-list.title": { de: "Sitzungen", en: "Sessions" },
+  "screen:session-detail.title": { de: "Sitzung", en: "Session" },
+  "sessions:nav.sessionList": { de: "Sitzungen", en: "Sessions" },
+  "sessions.list.col.id": { de: "ID", en: "ID" },
+  "sessions.list.col.userId": { de: "User-ID", en: "User ID" },
+  "sessions.list.col.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.list.col.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.list.col.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.list.action.open": { de: "Details", en: "Details" },
+  "sessions.detail.field.id": { de: "ID", en: "ID" },
+  "sessions.detail.field.userId": { de: "User-ID", en: "User ID" },
+  "sessions.detail.field.createdAt": { de: "Erstellt", en: "Created" },
+  "sessions.detail.field.expiresAt": { de: "Läuft ab", en: "Expires" },
+  "sessions.detail.field.revokedAt": { de: "Widerrufen", en: "Revoked" },
+  "sessions.detail.field.ip": { de: "IP-Adresse", en: "IP address" },
+  "sessions.detail.field.userAgent": { de: "User-Agent", en: "User agent" },
+};

package/src/shared/index.ts

@@ -9,4 +9,5 @@ export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export type { SystemQueryFn } from "./system-query";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/shared/system-query.ts

@@ -0,0 +1,5 @@
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — mirrors
+// http-route.ts's signature. Not importing HttpRouteHandlerDeps itself: it
+// isn't part of the engine's public surface (only the httpRoute-
+// registration types are).
+export type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;

package/src/tenant/__tests__/tenant-security.integration.test.ts

@@ -14,7 +14,6 @@ import {
 import { expectErrorIncludes, rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -23,6 +22,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -0,0 +1,163 @@
+// #1057 regression: anonymous GDPR magic-link download under
+// `resolverTrust: "authoritative"` WITHOUT `defaultTenantId` (publicstatus's
+// real prod config — Host-Resolver-only, no single-tenant fallback).
+//
+// The tenantResolver derives the ambient tenant from the request Host — here
+// it always resolves to `hostTenant`, DIFFERENT from the tenant the export
+// job actually belongs to (`jobTenant`). Before the fix, `download-by-token`
+// resolved the file-storage-provider *selection* via `ctx.config`, which is
+// bound to the ambient (resolved) tenant — `hostTenant` has no provider
+// configured at all here, so the download 500s even though the token/job
+// themselves are perfectly valid. The fix resolves the provider explicitly
+// for `jobRow.requestedFromTenantId` instead.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createInMemoryFileProvider,
+  type FileStorageProvider,
+} from "@cosmicdrift/kumiko-framework/files";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { ConfigHandlers } from "../../config/constants";
+import { createConfigAccessorFactory } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDataRetentionFeature } from "../../data-retention";
+import { fileFoundationFeature } from "../../file-foundation";
+import { fileProviderInMemoryFeature } from "../../file-provider-inmemory";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runExportJobs } from "../run-export-jobs";
+import { exportDownloadTokenEntity } from "../schema/download-token";
+import { exportJobEntity } from "../schema/export-job";
+
+const jobTenant = testTenantId(1);
+const hostTenant = testTenantId(2);
+const jobTenantAdmin = createTestUser({ id: 99, tenantId: jobTenant, roles: ["TenantAdmin"] });
+const aliceUser = createTestUser({ id: 42, tenantId: jobTenant, roles: ["Member"] });
+
+const providerPerTenant = new Map<string, ReturnType<typeof createInMemoryFileProvider>>();
+function buildProvider(tenantId: string): Promise<FileStorageProvider> {
+  let p = providerPerTenant.get(tenantId);
+  if (!p) {
+    p = createInMemoryFileProvider();
+    providerPerTenant.set(tenantId, p);
+  }
+  return Promise.resolve(p);
+}
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      fileFoundationFeature,
+      fileProviderInMemoryFeature,
+      createSessionsFeature(),
+      createUserDataRightsFeature(),
+    ],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      configEncryption: encryption,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+    // publicstatus prod: Host-Resolver-only, NO defaultTenantId. Resolver
+    // always answers `hostTenant` here — jobTenant never appears as the
+    // ambient/resolved tenant, only ever as jobRow.requestedFromTenantId.
+    anonymousAccess: {
+      tenantResolver: () => hostTenant,
+      resolverTrust: "authoritative",
+      tenantExists: async (id) => id === jobTenant || id === hostTenant,
+    },
+  });
+  await unsafeCreateEntityTable(stack.db, exportJobEntity);
+  await unsafeCreateEntityTable(stack.db, exportDownloadTokenEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+
+  // Only jobTenant gets a provider configured — hostTenant deliberately has
+  // NONE, so a pre-fix ambient-tenant read would hard-fail with "no provider
+  // selected", not just pick the wrong one.
+  await stack.http.writeOk(
+    ConfigHandlers.set,
+    { key: "file-foundation:config:provider", value: "inmemory" },
+    jobTenantAdmin,
+  );
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("download-by-token under resolverTrust: authoritative, no defaultTenantId", () => {
+  test("magic-link download succeeds via the job's own tenant, not the Host-resolved ambient tenant", async () => {
+    const requestRes = await stack.http.writeOk<{ jobId: string }>(
+      "user-data-rights:write:request-export",
+      {},
+      aliceUser,
+    );
+    const jobId = requestRes.jobId;
+    const provider = await buildProvider(jobTenant);
+    await provider.write(`${jobTenant}/exports/${jobId}.zip`, new Uint8Array([1, 2, 3]));
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: getTemporal().Now.instant(),
+    });
+    const plainToken = result.tokenByJobId.get(jobId);
+    if (!plainToken) {
+      throw new Error("token-create failed in worker run");
+    }
+
+    const res = await stack.app.fetch(
+      new Request(`http://test/user-export/by-token?token=${plainToken}`, { method: "GET" }),
+    );
+    expect(res.status).toBe(302);
+    const location = res.headers.get("location");
+    expect(location).toMatch(/^memory:\/\//);
+    expect(location).toContain(`${jobTenant}/exports/${jobId}.zip`);
+  });
+});

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -559,4 +559,43 @@ describe("download-by-job :: cross-user + cross-tenant", () => {
     );
     expect(result.url).toMatch(/^memory:\/\//);
   });
+
+  test("cross-tenant same-user: provider is resolved for the job's tenant, not the ambient session tenant", async () => {
+    // #1057 regression: createFileProviderForTenant used to read the
+    // provider *selection* from the ambient session's ctx.config — here
+    // Tenant B (Alice's session tenant) — instead of the job's own
+    // Tenant A. Give Tenant A a provider WITHOUT getSignedUrl while
+    // Tenant B keeps "inmemory" (default from beforeEach): if the bug
+    // resurfaces, the wrong (Tenant B) provider is picked and the
+    // request succeeds with 200 instead of 422.
+    const { jobId } = await seedDoneJobWithToken();
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: "file-foundation:config:provider", value: "no-signed-url" },
+      tenantAdmin, // Tenant A admin
+    );
+    const aliceFromTenantB = createTestUser({
+      id: 42,
+      tenantId: tenantB,
+      roles: ["Member"],
+    });
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_tenant_memberships (tenant_id, user_id)
+      VALUES ($1, $2)
+      ON CONFLICT (user_id, tenant_id) DO NOTHING
+    `,
+      [tenantB, String(aliceUser.id)],
+    );
+
+    const res = await stack.http.query(
+      "user-data-rights:query:download-by-job",
+      { jobId },
+      aliceFromTenantB,
+    );
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error: { code: string; i18nKey: string } };
+    expect(body.error.code).toBe("unprocessable");
+    expect(body.error.i18nKey).toBe("userDataRights.errors.download.signedUrlNotSupported");
+  });
 });

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -46,7 +46,6 @@ import {
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -60,6 +59,7 @@ import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
 import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -31,7 +31,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -46,6 +45,7 @@ import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
 import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -29,8 +29,8 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 
@@ -127,7 +127,10 @@ export const downloadByJobQuery = defineQueryHandler({
       });
     }
 
-    const provider = await createFileProviderForTenant(
+    // Provider bound explicitly to the job's tenant — NOT the ambient
+    // session tenant (cross-tenant-same-user: job.requestedFromTenantId
+    // can differ from query.user.tenantId).
+    const provider = await resolveTenantFileProvider(
       ctx,
       jobRow.requestedFromTenantId,
       "user-data-rights:query:download-by-job",