@cosmicdrift/kumiko-bundled-features 0.156.0 → 0.156.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.156.0",
+  "version": "0.156.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -116,11 +116,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.156.0",
-    "@cosmicdrift/kumiko-framework": "0.156.0",
-    "@cosmicdrift/kumiko-headless": "0.156.0",
-    "@cosmicdrift/kumiko-renderer": "0.156.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.156.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.156.1",
+    "@cosmicdrift/kumiko-framework": "0.156.1",
+    "@cosmicdrift/kumiko-headless": "0.156.1",
+    "@cosmicdrift/kumiko-renderer": "0.156.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.156.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/config/__tests__/reencrypt-job-kek-rotation.integration.test.ts

@@ -0,0 +1,171 @@
+// Regression guard for kumiko-framework#1187: proves the config
+// KEK-rotation job handles a real version-N → version-N+1 rotation, not
+// just legacy-format → envelope (see encrypted-legacy-migration.integration
+// .test.ts for that story). Modeled directly on auth-mfa's
+// reencrypt-job.integration.test.ts, which is the reference regression
+// guard for this exact bug class (kumiko-framework#266 Step 8): rotation
+// must go through executor.update() (a real event), not a raw UPDATE on
+// the projection table — otherwise a full projection rebuild replays the
+// OLD event and resurrects the pre-rotation kekVersion.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  createSystemConfig,
+  createSystemUser,
+  defineFeature,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../feature";
+import { reencryptJob } from "../handlers/reencrypt.job";
+import { createConfigResolver } from "../resolver";
+import { configValueEntity, configValuesTable } from "../table";
+
+const KEY = "kek-rot:config:secret-pass";
+const PLAINTEXT = "rotate-me-please";
+const PROJECTION_NAME = "config:projection:config-value-entity";
+
+const v1Key = randomBytes(32).toString("base64");
+const v2Key = randomBytes(32).toString("base64");
+const mutableProvider = createMutableMasterKeyProvider(
+  createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  }),
+);
+const cipher = createEnvelopeCipher(mutableProvider, {});
+const resolver = createConfigResolver({ cipher });
+
+const keyDef = createSystemConfig("text", {
+  encrypted: true,
+  read: access.systemAdmin,
+  write: access.systemAdmin,
+});
+
+const rotFeature = defineFeature("kek-rot", (r) => {
+  r.requires("config");
+  r.config({ keys: { "secret-pass": keyDef } });
+});
+
+const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+let stack: TestStack;
+
+async function seedV1Row(): Promise<void> {
+  const envelope = await cipher.encrypt(JSON.stringify(PLAINTEXT), { tenantId: SYSTEM_TENANT_ID });
+  const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+  const tdb = createTenantDb(stack.db, SYSTEM_TENANT_ID, "system");
+  const result = await executor.create(
+    { key: KEY, value: envelope, tenantId: SYSTEM_TENANT_ID, userId: null },
+    systemUser,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
+}
+
+type RawConfigRow = { value: string };
+
+async function readRawValue(): Promise<RawConfigRow> {
+  const rows = await selectMany<RawConfigRow>(stack.db, configValuesTable, { key: KEY });
+  const row = rows[0];
+  if (!row) throw new Error("no config row");
+  return row;
+}
+
+const noopLog = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  child: () => noopLog,
+};
+
+function jobCtx(): Parameters<typeof reencryptJob>[1] {
+  return {
+    db: stack.db,
+    registry: stack.registry,
+    masterKeyProvider: mutableProvider,
+    configEncryption: cipher,
+    log: noopLog,
+  } as unknown as Parameters<typeof reencryptJob>[1]; // @cast-boundary test-seam — job only reads db/registry/masterKeyProvider/configEncryption/log
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), rotFeature],
+    masterKeyProvider: mutableProvider,
+    extraContext: { configResolver: resolver, configEncryption: cipher },
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await seedV1Row();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("config KEK-rotation job — version-N to version-N+1 (kumiko-framework#1187)", () => {
+  test("rotation rewraps the value onto the current KEK, and a full projection rebuild still lands on it", async () => {
+    const beforeRow = await readRawValue();
+    expect(JSON.parse(beforeRow.value).kekVersion).toBe(1);
+
+    // "ops added a new master key version and flipped CURRENT=2" —
+    // same simulate-rotation-without-restart shape auth-mfa's test uses.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_V2: v2Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+        },
+      }),
+    );
+
+    await reencryptJob({}, jobCtx());
+
+    const afterJobRow = await readRawValue();
+    expect(JSON.parse(afterJobRow.value).kekVersion).toBe(2);
+
+    // Vacuous-rebuild guard: confirm the projection name actually exists
+    // before trusting a silent no-op rebuild as a pass.
+    expect(stack.registry.getAllProjections().has(PROJECTION_NAME)).toBe(true);
+
+    const rebuildResult = await rebuildProjection(PROJECTION_NAME, {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(rebuildResult.eventsProcessed).toBeGreaterThan(0);
+
+    // The regression guard itself: a from-scratch rebuild replays every
+    // event for this row and must land on the V2 envelope from the
+    // rotation job's own .updated event — NOT a resurrected V1 wrap from
+    // the original seed event. Kept alive with the V1 key still present
+    // in the env on purpose: a resurrected V1 row would still decrypt
+    // cleanly, so only this version-tag check (not the decrypt below)
+    // catches the regression this issue describes.
+    const afterRebuildRow = await readRawValue();
+    expect(JSON.parse(afterRebuildRow.value).kekVersion).toBe(2);
+
+    // Decrypt-level proof, not just the version tag: the plaintext
+    // survived rotation + rebuild byte-identically.
+    expect(await resolver.get(KEY, keyDef, SYSTEM_TENANT_ID, "u1", stack.db)).toBe(PLAINTEXT);
+  });
+});

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -32,12 +32,13 @@ import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
 let testRedis: TestRedis;
+let registry: ReturnType<typeof createRegistry>;
 let logger: ReturnType<typeof createJobRunLogger>;
 
 beforeAll(async () => {
   testDb = await createTestDb();
   testRedis = await createTestRedis();
-  const registry = createRegistry([createJobsFeature()]);
+  registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
@@ -127,4 +128,39 @@ describe("jobRun event shapes", () => {
     const ids = new Set(events.map((e) => e.aggregateId));
     expect(ids.size).toBe(1);
   });
+
+  test("complete/fail without a prior start skips — does not forge a jobRun stream", async () => {
+    // State-loss path: worker restart with empty cache AND no projection row for
+    // this bullJobId. Dropping the terminal event is intentional — forging an
+    // aggregate from scratch would invent a run that never started.
+    await logger.onJobComplete?.("example:job:orphan", "bull-orphan-complete", 50, []);
+    await logger.onJobFailed?.("example:job:orphan", "bull-orphan-failed", "boom", []);
+
+    const completed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
+    const failed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable);
+
+    expect(completed).toHaveLength(0);
+    expect(failed).toHaveLength(0);
+    expect(runs).toHaveLength(0);
+  });
+
+  test("complete after cache loss recovers runId from the projection (same stream)", async () => {
+    // Simulates worker process restart: in-memory bullJobId→runId cache is gone,
+    // but the run-started projection row still has bull_job_id. A fresh logger
+    // must DB-lookup and append onto the original aggregate — not mint a second.
+    await logger.onJobStart?.("example:job:restart", "bull-restart-1", {});
+    const started = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    expect(started).toHaveLength(1);
+    const originalAggregateId = started[0]?.aggregateId;
+    expect(originalAggregateId).toBeTruthy();
+
+    const coldLogger = createJobRunLogger({ db: testDb.db, registry });
+    await coldLogger.onJobComplete?.("example:job:restart", "bull-restart-1", 42, []);
+
+    const all = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(all).toHaveLength(2);
+    expect(new Set(all.map((e) => e.aggregateId))).toEqual(new Set([originalAggregateId]));
+    expect(all.some((e) => e.type === JOB_RUN_COMPLETED_EVENT)).toBe(true);
+  });
 });

package/src/sessions/__tests__/sessions.integration.test.ts

@@ -391,6 +391,41 @@ describe("sessions feature — login → check → revoke → rejected", () => {
     expect(body.error?.details?.reason).toBe("missing");
   });
 
+  // Cross-user check: a valid JWT for Alice paired with Bob's live sid must
+  // look identical to a forged/missing sid — otherwise the checker would be
+  // an existence oracle on other users' sessions.
+  test("sid belonging to another user → 401 reason=missing (no existence oracle)", async () => {
+    const alice = await h.seedUser("alice-xuser@example.com", "pw-long-enough");
+    const bob = await h.seedUser("bob-xuser@example.com", "pw-long-enough");
+    const bobLogin = await h.login("bob-xuser@example.com", "pw-long-enough");
+
+    // Direct invariant: Bob's sid + Alice's userId → missing (not live/revoked).
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, alice.userId)).toBe("missing");
+    expect(await callbacks.get().sessionChecker(bobLogin.sid, bob.userId)).toBe("live");
+
+    // HTTP path: mint Alice's identity onto Bob's sid (stolen-sid scenario).
+    const forged = await stack.jwt.sign({
+      id: alice.userId,
+      tenantId: TENANT,
+      roles: ["User"],
+      sid: bobLogin.sid,
+    });
+    const res = await h.authedPost("/api/query", forged, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(res.status).toBe(401);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe("missing");
+
+    // Control: Bob's own JWT still authenticates — the sid itself is fine.
+    const bobOk = await h.authedPost("/api/query", bobLogin.token, {
+      type: "user:query:user:me",
+      payload: {},
+    });
+    expect(bobOk.status).toBe(200);
+  });
+
   test("expired session row → 401 with reason=expired", async () => {
     await h.seedUser("stale@example.com", "pw-long-enough");
     const { token, sid } = await h.login("stale@example.com", "pw-long-enough");

package/src/sessions/session-checker-fail-open.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, spyOn, test } from "bun:test";
+import * as bunDb from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { Temporal } from "temporal-polyfill";
+import { USER_STATUS, userTable } from "../user/schema/user";
+import { userSessionTable } from "./schema/user-session";
+import { createSessionCallbacks } from "./session-callbacks";
+
+// Unit-only: the fail-open-on-throw branch cannot be provoked through real
+// Postgres without faking infrastructure failure. Integration tests forbid
+// mocks, so this lives next to the source as a plain *.test.ts.
+
+type FetchOne = typeof bunDb.fetchOne;
+
+describe("sessionChecker fail-open on user-lookup throw", () => {
+  test("read_users THROW → live (not 500 / not blocked)", async () => {
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid1";
+    const userId = "00000000-0000-4000-8000-00000000user";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const originalFetchOne = bunDb.fetchOne;
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        throw new Error("simulated pool exhaustion");
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("live");
+    } finally {
+      spy.mockRestore();
+      // Sanity: restore must put the real export back (guards against spy leak).
+      expect(bunDb.fetchOne).toBe(originalFetchOne);
+    }
+  });
+
+  test("control: Restricted user without throw → blocked (spy must hit userTable)", async () => {
+    // If the spy somehow skipped the userTable branch, Restricted would still
+    // be "live" via fail-open-on-null — this control pins that the throw path
+    // is what we exercise above, not an accidental miss.
+    const db = {} as DbConnection;
+    const cbs = createSessionCallbacks({ db });
+    const sid = "00000000-0000-4000-8000-00000000sid2";
+    const userId = "00000000-0000-4000-8000-00000000usr2";
+    const farFutureMs = Temporal.Now.instant().add({ hours: 1 }).epochMilliseconds;
+
+    const spy = spyOn(bunDb, "fetchOne").mockImplementation((async (_db, table) => {
+      if (table === userSessionTable) {
+        return {
+          userId,
+          revokedAt: null,
+          expiresAt: { epochMilliseconds: farFutureMs },
+        };
+      }
+      if (table === userTable) {
+        return { status: USER_STATUS.Restricted };
+      }
+      throw new Error("unexpected table in sessionChecker spy");
+    }) as FetchOne);
+
+    try {
+      expect(await cbs.sessionChecker(sid, userId)).toBe("blocked");
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -26,6 +26,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createFilesFeature } from "../../files";
 import { createSessionsFeature } from "../../sessions";
 import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
@@ -36,6 +37,7 @@ import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { createUserDataRightsFeature } from "../../user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import {
   UserDataRightsHandlers,
   UserProfileErrors,
@@ -59,7 +61,9 @@ beforeAll(async () => {
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createSessionsFeature(),
+      createFilesFeature(),
       createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
       createUserProfileFeature(),
     ],
     authConfig: {

package/src/user-profile/feature.ts

@@ -11,7 +11,9 @@ export function createUserProfileFeature(): FeatureDefinition {
         "change-email and account deletion (user-data-rights request/cancel with " +
         "grace period) into one screen. Apps register the screen as " +
         '`type: "custom"` with `__component: "UserProfileScreen"`. Requires `user`, ' +
-        "`auth-email-password`, and `user-data-rights`.",
+        "`auth-email-password`, `user-data-rights`, and `user-data-rights-defaults` " +
+        "(so the GDPR boot-validator finds export/delete hooks for `user`'s PII " +
+        "fields once user-data-rights is mounted).",
     );
     r.uiHints({
       displayLabel: "User Profile · Self-Service",
@@ -21,6 +23,7 @@ export function createUserProfileFeature(): FeatureDefinition {
     r.requires("user");
     r.requires("auth-email-password");
     r.requires("user-data-rights");
+    r.requires("user-data-rights-defaults");
 
     const handlers = {
       changeEmail: r.writeHandler(changeEmailWrite),