@cosmicdrift/kumiko-bundled-features 0.155.0 → 0.156.0

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -25,12 +25,16 @@
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
-import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 
@@ -130,11 +134,14 @@ export const downloadByJobQuery = defineQueryHandler({
     // Provider bound explicitly to the job's tenant — NOT the ambient
     // session tenant (cross-tenant-same-user: job.requestedFromTenantId
     // can differ from query.user.tenantId).
-    const provider = await resolveTenantFileProvider(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-job",
-    );
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-job",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
         db: ctx.db.raw,

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -27,12 +27,16 @@
 // startet. Dieser query-handler liefert nur das JSON.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
-import { resolveTenantFileProvider } from "../lib/tenant-file-provider";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -184,11 +188,14 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Step 5: signed-URL via provider, explicitly bound to the job's
     // tenant — NOT the ambient request tenant (anonymous magic-link path
     // has none under resolverTrust: "authoritative").
-    const provider = await resolveTenantFileProvider(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-token",
-    );
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-token",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
         db: ctx.db.raw,

package/src/user-data-rights/lib/storage-provider-resolver.ts

@@ -4,8 +4,9 @@
 // construction). Extracted from the export cron so both crons + the manual
 // forget handler share one construction site instead of inlining it three times.
 
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { createConfigAccessor } from "../../config";
@@ -18,7 +19,7 @@ export interface TenantStorageResolverCtx {
   // Undefined → the returned resolver throws (callers decide fail-loud vs skip).
   readonly configResolver: ConfigResolver | undefined;
   readonly secrets: SecretsContext | undefined;
-  readonly db: DbConnection;
+  readonly db: DbConnection | TenantDb;
   readonly userId: string;
   readonly handlerName: string;
 }
@@ -28,9 +29,9 @@ export function makeTenantStorageProviderResolver(
 ): (tenantId: TenantId) => Promise<FileStorageProvider> {
   return async (tenantId) => {
     if (!ctx.configResolver) {
-      throw new Error(
-        `${ctx.handlerName}: ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
-      );
+      throw new InternalError({
+        message: `[${ctx.handlerName}] ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+      });
     }
     const config = createConfigAccessor(
       ctx.registry,

package/src/user-data-rights/lib/tenant-file-provider.ts

@@ -1,62 +0,0 @@
-// Resolves the GDPR-download file-storage provider explicitly for
-// `jobRow.requestedFromTenantId` instead of the ambient request tenant.
-//
-// Both download handlers (by-token, by-job) used to call
-// `createFileProviderForTenant(ctx, jobRow.requestedFromTenantId, ...)`,
-// which reads the PROVIDER SELECTION from `ctx.config` — bound to the
-// caller's own ambient tenant, not the job's tenant:
-//   - by-token (anonymous magic-link, httpRoute): under
-//     `resolverTrust: "authoritative"` without `defaultTenantId` there is
-//     no ambient tenant at all — `ctx.config` throws, 500s the whole
-//     GDPR download flow.
-//   - by-job (session-authed): a user can own jobs across tenants
-//     (cross-tenant-same-user); the ambient session tenant silently
-//     picks the WRONG tenant's provider config for a job requested from
-//     a different tenant.
-//
-// Fix: build a fresh config accessor bound explicitly to the given
-// tenantId (same construction as `makeTenantStorageProviderResolver`,
-// which the export/forget crons already use), instead of the ambient
-// `ctx.config`. Deliberately NOT `ctx._fileProviderResolver` — that
-// resolver is boot-built and per-tenant-cached for the process lifetime,
-// so an operator switching `file-foundation:config:provider` mid-session
-// wouldn't take effect until the cache evicts.
-import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
-import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
-import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { createConfigAccessor } from "../../config";
-import { createFileProviderForTenant } from "../../file-foundation";
-
-export interface TenantFileProviderCtx {
-  readonly registry?: Registry;
-  readonly configResolver?: ConfigResolver;
-  readonly secrets?: SecretsContext;
-  readonly db: { readonly raw: DbConnection | TenantDb };
-}
-
-export async function resolveTenantFileProvider(
-  ctx: TenantFileProviderCtx,
-  tenantId: string,
-  handlerName: string,
-): Promise<FileStorageProvider> {
-  if (!ctx.registry || !ctx.configResolver) {
-    throw new Error(
-      `${handlerName}: ctx.registry/ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
-    );
-  }
-  const config = createConfigAccessor(
-    ctx.registry,
-    ctx.configResolver,
-    tenantId as TenantId, // @cast-boundary engine-payload: TenantId brand
-    SYSTEM_USER_ID,
-    ctx.db.raw,
-    ctx.secrets,
-  );
-  return createFileProviderForTenant(
-    { config, registry: ctx.registry, secrets: ctx.secrets, _userId: SYSTEM_USER_ID },
-    tenantId,
-    handlerName,
-  );
-}