@cosmicdrift/kumiko-bundled-features 0.154.1 → 0.154.2

package/src/inbound-provider-imap/__tests__/imap-foundation.integration.test.ts

@@ -0,0 +1,306 @@
+// Full-stack IMAP integration: setupTestStack + secrets + inbound-provider-imap
+// + watch-supervisor against greenmail. Proves the production path
+// (connect → credential secret → poll fetch → ingest projection), not the
+// plugin-only live suite in imap-live.integration.test.ts.
+//
+// Opt-in via greenmail (same as imap-live):
+//   docker start cdgs-greenmail
+//   # or: docker run -d --name cdgs-greenmail -p 3025:3025 -p 3143:3143 \
+//   #   -e GREENMAIL_OPTS="-Dgreenmail.setup.test.all -Dgreenmail.users=testuser:testpass@example.com" \
+//   #   greenmail/standalone:2.1.0
+//
+// When greenmail is down the suite skips (visible), never fakes IMAP.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { connect } from "node:net";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createMutableMasterKeyProvider,
+  type MutableMasterKeyProvider,
+  waitFor,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createTransport } from "nodemailer";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import {
+  createInboundMailSupervisor,
+  InboundMailAccountStatuses,
+  InboundMailFoundationHandlers,
+  InboundMailFoundationQueries,
+  inboundCredentialSecretKey,
+  inboundMailFoundationFeature,
+  mailAccountsProjectionTable,
+  seenMessageEntity,
+  syncCursorEntity,
+} from "../../inbound-mail-foundation";
+import { createSecretsContext, createSecretsFeature, tenantSecretsTable } from "../../secrets";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { inboundProviderImapFeature } from "../feature";
+
+const HOST = process.env["IMAP_LIVE_HOST"] ?? "127.0.0.1";
+const IMAP_PORT = Number(process.env["IMAP_LIVE_PORT"] ?? 3143);
+const SMTP_PORT = Number(process.env["IMAP_LIVE_SMTP_PORT"] ?? 3025);
+const USER = "testuser";
+const PASSWORD = "testpass";
+const ADDRESS = "testuser@example.com";
+
+function probe(host: string, port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const socket = connect({ host, port, timeout: 1500 });
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once("error", () => resolve(false));
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+}
+
+const available = await probe(HOST, IMAP_PORT);
+const liveTest = available ? test : test.skip;
+if (!available) {
+  console.warn(
+    `imap-foundation: kein IMAP-Server auf ${HOST}:${IMAP_PORT} — Suite wird geskippt (greenmail starten)`,
+  );
+}
+
+let stack: TestStack;
+let db: DbConnection;
+let secrets: ReturnType<typeof createSecretsContext>;
+let providerRef: MutableMasterKeyProvider;
+
+beforeAll(async () => {
+  const initialKp = createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  });
+  providerRef = createMutableMasterKeyProvider(initialKp);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createSecretsFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      inboundMailFoundationFeature,
+      inboundProviderImapFeature,
+    ],
+    masterKeyProvider: providerRef,
+    extraContext: ({ db: stackDb }) => ({
+      secrets: createSecretsContext({ db: stackDb, masterKeyProvider: providerRef }),
+    }),
+  });
+  db = stack.db;
+  secrets = createSecretsContext({ db, masterKeyProvider: providerRef });
+
+  await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, syncCursorEntity);
+  await unsafeCreateEntityTable(db, seenMessageEntity);
+  await unsafePushTables(db, { tenant_secrets: tenantSecretsTable });
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+function credentialJson(): string {
+  return JSON.stringify({
+    host: HOST,
+    port: IMAP_PORT,
+    secure: false,
+    user: USER,
+    password: PASSWORD,
+  });
+}
+
+async function sendTestMail(subject: string, text: string): Promise<void> {
+  const transport = createTransport({ host: HOST, port: SMTP_PORT, secure: false });
+  await transport.sendMail({
+    from: "Sender <sender@example.com>",
+    to: ADDRESS,
+    subject,
+    text,
+  });
+  transport.close();
+}
+
+function createSupervisor() {
+  return createInboundMailSupervisor({
+    providerCtx: {
+      registry: stack.registry,
+      secrets,
+      // Worker-identity for requireSecretsContext audit on IMAP credential reads.
+      _userId: "imap-foundation-supervisor",
+    },
+    db,
+    dispatchWrite: ({ handlerQn, payload, tenantId }) =>
+      stack.dispatcher.write(
+        handlerQn,
+        payload,
+        createSystemUser(tenantId as TenantId, [ROLES.SystemAdmin]),
+      ),
+    pollIntervalMs: 60_000,
+  });
+}
+
+describe("imap-foundation — greenmail + supervisor", () => {
+  liveTest(
+    "connect + credential secret + pollOnce ingests a real IMAP message",
+    async () => {
+      const admin = adminFor(4301);
+      const connected = (await stack.http.writeOk(
+        InboundMailFoundationHandlers.connectAccount,
+        {
+          provider: "imap",
+          authMethod: "password",
+          displayName: "Greenmail Inbox",
+          address: ADDRESS,
+          scope: "shared",
+        },
+        admin,
+      )) as { accountId: string };
+
+      await secrets.set(
+        admin.tenantId,
+        inboundCredentialSecretKey(connected.accountId),
+        credentialJson(),
+        {
+          redact: (plaintext) => `${plaintext.slice(0, 4)}…`,
+          hint: "IMAP live test credentials",
+        },
+      );
+
+      const supervisor = createSupervisor();
+      // Drain existing mailbox first so a dirty greenmail INBOX (>maxMessages
+      // backfill budget) cannot hide the message we are about to send.
+      await supervisor.pollOnce();
+
+      const subject = `foundation-poll-${crypto.randomUUID()}`;
+      await sendTestMail(subject, "Hallo aus dem Foundation-Live-Test");
+
+      await waitFor(async () => {
+        await supervisor.pollOnce();
+        const list = (await stack.http.queryOk(
+          InboundMailFoundationQueries.listMessages,
+          { accountId: connected.accountId },
+          admin,
+        )) as { rows: Array<Record<string, unknown>> };
+        expect(list.rows.some((r) => r["subject"] === subject)).toBe(true);
+      });
+
+      const accounts = await selectMany(db, mailAccountsProjectionTable, {
+        id: connected.accountId,
+      });
+      expect(accounts[0]?.["status"]).toBe(InboundMailAccountStatuses.active);
+      expect(accounts[0]?.["provider"]).toBe("imap");
+    },
+    45_000,
+  );
+
+  liveTest(
+    "wrong IMAP password → pollOnce marks account auth_error",
+    async () => {
+      const admin = adminFor(4302);
+      const connected = (await stack.http.writeOk(
+        InboundMailFoundationHandlers.connectAccount,
+        {
+          provider: "imap",
+          authMethod: "password",
+          displayName: "Bad Creds",
+          address: ADDRESS,
+          scope: "shared",
+        },
+        admin,
+      )) as { accountId: string };
+
+      await secrets.set(
+        admin.tenantId,
+        inboundCredentialSecretKey(connected.accountId),
+        JSON.stringify({
+          host: HOST,
+          port: IMAP_PORT,
+          secure: false,
+          user: USER,
+          password: "definitely-wrong",
+        }),
+      );
+
+      const supervisor = createSupervisor();
+      await supervisor.pollOnce();
+
+      const accounts = await selectMany(db, mailAccountsProjectionTable, {
+        id: connected.accountId,
+      });
+      expect(accounts[0]?.["status"]).toBe(InboundMailAccountStatuses.authError);
+    },
+    30_000,
+  );
+
+  liveTest(
+    "missing credential secret → pollOnce marks account auth_error",
+    async () => {
+      const admin = adminFor(4303);
+      const connected = (await stack.http.writeOk(
+        InboundMailFoundationHandlers.connectAccount,
+        {
+          provider: "imap",
+          authMethod: "password",
+          displayName: "No Secret",
+          address: ADDRESS,
+          scope: "shared",
+        },
+        admin,
+      )) as { accountId: string };
+
+      // No secrets.set — production path when connect succeeded but slot empty.
+      const supervisor = createSupervisor();
+      await supervisor.pollOnce();
+
+      const accounts = await selectMany(db, mailAccountsProjectionTable, {
+        id: connected.accountId,
+      });
+      expect(accounts[0]?.["status"]).toBe(InboundMailAccountStatuses.authError);
+    },
+    30_000,
+  );
+});

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -272,6 +272,57 @@ describe("legal-pages :: SYSTEM_TENANT-routing (production-bug-regression)", ()
   });
 });
 
+describe("legal-pages :: wrapLayout erhält route.slug (alt-lang-switch-regression)", () => {
+  test("custom wrapLayout bekommt den passenden slug pro Route, nicht immer imprint", async () => {
+    const seenSlugs: (string | undefined)[] = [];
+    const customStack = await setupTestStack({
+      features: [
+        createTextContentFeature(),
+        createLegalPagesFeature({
+          wrapLayout: (opts) => {
+            seenSlugs.push(opts.slug);
+            return `<html data-slug="${opts.slug ?? ""}">${opts.bodyHtml}</html>`;
+          },
+        }),
+      ],
+      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
+      extraContext: ({ db }) => ({
+        textContent: createTextContentApi(db),
+      }),
+    });
+    try {
+      await unsafeCreateEntityTable(customStack.db, textBlockEntity);
+      await createEventsTable(customStack.db);
+      await seedTextBlock(customStack.db, {
+        tenantId: SYSTEM_TENANT_ID,
+        slug: "imprint",
+        lang: "de",
+        title: "Impressum",
+        body: "Body",
+      });
+      await seedTextBlock(customStack.db, {
+        tenantId: SYSTEM_TENANT_ID,
+        slug: "privacy",
+        lang: "de",
+        title: "Datenschutzerklärung",
+        body: "Body",
+      });
+
+      const imprintRes = await customStack.app.request("/legal/impressum");
+      expect(imprintRes.status).toBe(200);
+      expect(await imprintRes.text()).toContain('data-slug="imprint"');
+
+      const privacyRes = await customStack.app.request("/legal/datenschutz");
+      expect(privacyRes.status).toBe(200);
+      expect(await privacyRes.text()).toContain('data-slug="privacy"');
+
+      expect(seenSlugs).toEqual(["imprint", "privacy"]);
+    } finally {
+      await customStack.cleanup();
+    }
+  });
+});
+
 describe("legal-pages :: runLegalPagesBootCheck (direct unit-tests)", () => {
   // Direkter Test der Boot-Check-Logik mit constructed ctx-Objects —
   // keine JobRunner-Coupling, keine Test-Stacks. Das ist die echte

package/src/legal-pages/feature.ts

@@ -50,6 +50,7 @@ export type LegalPagesWrapLayout = (opts: {
   readonly title: string;
   readonly bodyHtml: string;
   readonly lang: string;
+  readonly slug?: "imprint" | "privacy" | "terms";
 }) => string;
 
 export type LegalPagesOptions = {
@@ -98,6 +99,7 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
               SYSTEM_TENANT_ID,
             )) as TextBlockQueryResult;
           } catch (err) {
+            // biome-ignore lint/suspicious/noConsole: ops-visible fallback, no logger wired into HttpRouteHandlerDeps
             console.error(`legal-pages: text-content query failed for slug="${route.slug}"`, err);
             return c.text("legal page unavailable", 503);
           }
@@ -134,6 +136,7 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
             title: data.title || route.titleFallback,
             bodyHtml: renderMarkdownToHtml(data.body),
             lang: route.lang,
+            slug: route.slug,
           });
 
           return cachedSecurePageResponse(c.req.raw, {

package/src/sessions/feature.ts

@@ -132,7 +132,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // we want to skip on. Works for both direct user:update calls and any
     // other handler that happens to write the column.
     let autoRevoke = options?.autoRevokeOnPasswordChange;
-    r.entityHook("postSave", "user", async (ctx) => {
+    r.hook("postSave", { allOf: "user" }, async (ctx) => {
       // skip: nothing bound — stateless-JWT deployments without a runtime
       // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
       if (!autoRevoke) return;

package/src/tier-engine/feature.ts

@@ -290,7 +290,7 @@ export function createTierEngineFeature<
     };
 
     // Invalidation: tier-assignment events update the cache.
-    r.entityHook("postSave", "tier-assignment", async (result) => {
+    r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
       // result.data has tenantId + tier (after entity-update merge)
       const data = result.data as { tenantId?: unknown; tier?: unknown }; // @cast-boundary engine-payload
       // skip: defensive type-guard auf payload-shape. Bei korrekt gerenderten
@@ -302,7 +302,7 @@ export function createTierEngineFeature<
       const tenantId = data.tenantId as TenantId;
       cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
     });
-    r.entityHook("postDelete", "tier-assignment", async (payload) => {
+    r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
       const data = payload.data as { tenantId?: unknown }; // @cast-boundary engine-payload
       // skip: gleiche type-guard semantik wie postSave-hook oben.
       if (typeof data.tenantId !== "string") return;
@@ -323,9 +323,9 @@ export function createTierEngineFeature<
     // neuer Tenant (Memory `feedback_event_store_tenant_consistency`).
     if (opts.defaultTier !== undefined) {
       const defaultTier = opts.defaultTier;
-      r.entityHook(
+      r.hook(
         "postSave",
-        "tenant",
+        { allOf: "tenant" },
         async (result, ctx) => {
           // result-shape: kumiko-framework's SaveContext mit isNew + data
           const saveResult = result as { isNew?: unknown; data?: unknown }; // @cast-boundary engine-payload