@cosmicdrift/kumiko-bundled-features 0.156.1 → 0.156.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.156.1",
+  "version": "0.156.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -116,11 +116,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.156.1",
-    "@cosmicdrift/kumiko-framework": "0.156.1",
-    "@cosmicdrift/kumiko-headless": "0.156.1",
-    "@cosmicdrift/kumiko-renderer": "0.156.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.156.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.156.3",
+    "@cosmicdrift/kumiko-framework": "0.156.3",
+    "@cosmicdrift/kumiko-headless": "0.156.3",
+    "@cosmicdrift/kumiko-renderer": "0.156.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.156.3",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-mfa/handlers/verify.write.ts

@@ -139,6 +139,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // now. Deliberately NOT re-checking strictEmailVerification here:
       // MfaVerifyOptions has no such flag, and email verification can't
       // regress between login and verify within the 10-minute window.
+      if (!userRow) return invalidChallengeToken();
       if (
         userRow?.status === USER_STATUS.Restricted ||
         userRow?.status === USER_STATUS.DeletionRequested ||

package/src/cap-counter/__tests__/entity-ddl.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { capCounterEntity } from "../entity";
+
+function pgTypeOf(table: unknown, dbName: string): string | undefined {
+  const cols = (table as { columns?: ReadonlyArray<{ name: string; pgType?: string }> }).columns;
+  return cols?.find((c) => c.name === dbName)?.pgType;
+}
+
+describe("capCounterEntity — DDL (#1205 regression)", () => {
+  test("value column is bigint, not double precision", () => {
+    const table = buildEntityTable("cap-counter", capCounterEntity);
+    expect(pgTypeOf(table, "value")).toBe("bigint");
+  });
+});

package/src/cap-counter/entity.ts

@@ -1,6 +1,6 @@
 import {
+  createBigIntField,
   createEntity,
-  createNumberField,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -41,7 +41,7 @@ export const capCounterEntity = createEntity({
   table: "read_cap_counters",
   fields: {
     capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
-    value: createNumberField({ required: true, default: 0 }),
+    value: createBigIntField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),
   },

package/src/inbound-mail-foundation/entities.ts

@@ -164,5 +164,9 @@ export const seenMessageEntity = createEntity({
 // Plain EntityTableMeta (kein branded EntityTable) — unmanaged Direct-
 // Write-Stores, Handler schreiben via ctx.db (siehe user-session.ts-
 // Rationale).
-export const syncCursorTable = buildEntityTableMeta("mail-sync-cursor", syncCursorEntity);
-export const seenMessageTable = buildEntityTableMeta("mail-seen-message", seenMessageEntity);
+export const syncCursorTable = buildEntityTableMeta("mail-sync-cursor", syncCursorEntity, {
+  source: "unmanaged",
+});
+export const seenMessageTable = buildEntityTableMeta("mail-seen-message", seenMessageEntity, {
+  source: "unmanaged",
+});

package/src/jobs/__tests__/entity-ddl.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { jobRunEntity } from "../job-run-table";
+
+function pgTypeOf(table: unknown, dbName: string): string | undefined {
+  const cols = (table as { columns?: ReadonlyArray<{ name: string; pgType?: string }> }).columns;
+  return cols?.find((c) => c.name === dbName)?.pgType;
+}
+
+describe("jobRunEntity — DDL (#1205 regression)", () => {
+  test("duration column is integer, not double precision", () => {
+    const table = buildEntityTable("read_job_runs", jobRunEntity);
+    expect(pgTypeOf(table, "duration")).toBe("integer");
+  });
+});

package/src/jobs/job-run-table.ts

@@ -48,7 +48,7 @@ export const jobRunEntity = createEntity({
     attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),
-    duration: createNumberField(),
+    duration: createNumberField({ integer: true }),
     triggeredById: createTextField(),
   },
 });

package/src/personal-access-tokens/feature.ts

@@ -53,7 +53,7 @@ export function createPersonalAccessTokensFeature(
     // Direct-write store like read_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
-    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity), {
+    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
       reason: "read_side.api_tokens_direct_write",
       // create.write encrypts `name` via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/personal-access-tokens/schema/api-token.ts

@@ -58,4 +58,6 @@ export const apiTokenEntity = createEntity({
 // buildEntityTableMeta (not buildEntityTable): this is a direct-write store, so
 // the table must be a WritableTable (post ES-write-brand #742) — same as
 // sessions' userSessionTable. buildEntityTable is branded executor-only.
-export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity);
+export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity, {
+  source: "unmanaged",
+});

package/src/secrets/__tests__/rotate.integration.test.ts

@@ -5,11 +5,12 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { deleteMany, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createEnvMasterKeyProvider,
-  encryptValue,
+  decodeStoredEnvelope,
+  decryptValue,
   type MasterKeyProvider,
 } from "@cosmicdrift/kumiko-framework/secrets";
 import {
@@ -21,7 +22,7 @@ import {
 import { createSecretsFeature } from "../feature";
 import { rotateJob } from "../handlers/rotate.job";
 import { createSecretsContext } from "../secrets-context";
-import { tenantSecretsTable } from "../table";
+import { type StoredEnvelope, tenantSecretsTable } from "../table";
 
 const admin = createTestUser({
   id: "00000000-0000-4000-8000-000000000010",
@@ -29,6 +30,15 @@ const admin = createTestUser({
   roles: ["TenantAdmin"],
 });
 
+// Captured so the happy-path rotation test can build a provider whose V1
+// key matches the seeded rows exactly — a fresh random V1 would fail the
+// GCM auth tag on every unwrap.
+const SEED_V1_KEY = randomBytes(32).toString("base64");
+// Shared with the happy-path test's rotator AND its verifier — the verifier
+// must decrypt with ONLY this key so a rewrap that bumps kek_version but
+// leaves the envelope V1-wrapped fails loud instead of silently passing.
+const ROTATED_V2_KEY = randomBytes(32).toString("base64");
+
 // A provider that encrypts happily on wrapDek but always rejects
 // unwrapDek. Simulates "KEK is unreachable / corrupt" — the failure mode
 // the circuit-breaker exists to contain. The returned object carries a
@@ -64,7 +74,7 @@ beforeAll(async () => {
   // Seeding the table uses a sane V1-only provider so writes land on V1.
   const seedProvider = createEnvMasterKeyProvider({
     env: {
-      KUMIKO_SECRETS_MASTER_KEY_V1: randomBytes(32).toString("base64"),
+      KUMIKO_SECRETS_MASTER_KEY_V1: SEED_V1_KEY,
       KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
     },
   });
@@ -80,21 +90,12 @@ beforeAll(async () => {
     tenant_secrets: tenantSecretsTable,
   });
 
-  // Seed 20 V1 rows directly — too many for any maxFailures default.
+  // Seed 20 V1 rows through the real write path (executor.create) instead
+  // of a raw insertOne — the rotate job's executor.update needs an actual
+  // event stream to update against, which a headless projection row lacks.
+  const seedSecrets = createSecretsContext({ db: stack.db, masterKeyProvider: seedProvider });
   for (let i = 0; i < 20; i++) {
-    const envelope = await encryptValue(`secret-${i}`, seedProvider);
-    await insertOne(stack.db, tenantSecretsTable, {
-      tenantId: admin.tenantId,
-      key: `test:secret:k-${i}`,
-      envelope: {
-        ciphertext: envelope.ciphertext.toString("base64"),
-        iv: envelope.iv.toString("base64"),
-        authTag: envelope.authTag.toString("base64"),
-        encryptedDek: envelope.encryptedDek.toString("base64"),
-        kekVersion: envelope.kekVersion,
-      },
-      kekVersion: envelope.kekVersion,
-    });
+    await seedSecrets.set(admin.tenantId, `test:secret:k-${i}`, `secret-${i}`);
   }
 });
 
@@ -170,4 +171,69 @@ describe("rotate-job circuit-breaker", () => {
     expect(await countV1Rows()).toBe(20);
     expect(broken.calls()).toBe(25);
   });
+
+  // Happy-path counterpart to the failure tests above: a working provider
+  // that actually rewraps. Run last — it's the only test that mutates the
+  // shared 20-row fixture, so the earlier "stays at 20" assertions must
+  // see it before this runs. Enforced below, not just documented: a
+  // precondition check fails loud (not silently-wrong) if a test inserted
+  // between this and the circuit-breaker tests already touched the
+  // fixture — rotateJob's batch scan has no per-row exclusion/ordering
+  // to fall back on, so isolating this test onto a second tenant doesn't
+  // help (rotator would just exhaust maxFailures on the other tenant's
+  // still-V1 rows before ever reaching its own).
+  test("successful rotation rewraps the DEK, bumps kekVersion, and preserves plaintext", async () => {
+    expect(await countV1Rows()).toBe(20);
+
+    const rotator = createEnvMasterKeyProvider({
+      env: {
+        KUMIKO_SECRETS_MASTER_KEY_V1: SEED_V1_KEY,
+        KUMIKO_SECRETS_MASTER_KEY_V2: ROTATED_V2_KEY,
+        KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+      },
+    });
+
+    // Snapshot pre-rotation ciphertext — rotate.job.ts's header comment
+    // claims "the ciphertext itself never changes, only the DEK wrapper".
+    // Assert that invariant below instead of only checking kekVersion/
+    // plaintext, which a rewrap-that-re-encrypts would also satisfy.
+    const preRotation = await selectMany<{ key: string; envelope: StoredEnvelope }>(
+      stack.db,
+      tenantSecretsTable,
+      { tenantId: admin.tenantId },
+    );
+    const ciphertextByKey = new Map(preRotation.map((row) => [row.key, row.envelope.ciphertext]));
+
+    await rotateJob({ batchSize: 10, maxFailures: 5 }, jobCtx(rotator));
+
+    expect(await countV1Rows()).toBe(0);
+
+    // Decrypt with a V2-ONLY provider — no V1 key available. A rewrap
+    // that only bumped the kek_version column but left the envelope
+    // wrapped under V1 would throw "no KEK for version 1" here instead
+    // of silently passing, which a decrypt via `rotator` (V1+V2) can't
+    // catch since it still holds V1.
+    const verifier = createEnvMasterKeyProvider({
+      env: {
+        KUMIKO_SECRETS_MASTER_KEY_V2: ROTATED_V2_KEY,
+        KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+      },
+    });
+
+    const rows = await selectMany<{ key: string; envelope: StoredEnvelope; kekVersion: number }>(
+      stack.db,
+      tenantSecretsTable,
+      { tenantId: admin.tenantId },
+    );
+    expect(rows).toHaveLength(20);
+    for (const row of rows) {
+      expect(row.kekVersion).toBe(2);
+      const expectedCiphertext = ciphertextByKey.get(row.key);
+      expect(expectedCiphertext).toBeDefined();
+      expect(row.envelope.ciphertext).toBe(expectedCiphertext as string);
+      const expectedIndex = row.key.split("-").at(-1);
+      const plaintext = await decryptValue(decodeStoredEnvelope(row.envelope), verifier);
+      expect(plaintext).toBe(`secret-${expectedIndex}`);
+    }
+  });
 });

package/src/sessions/feature.ts

@@ -96,7 +96,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // (#498/#494). r.rawTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity), {
+    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
       reason: "read_side.user_sessions_direct_write",
       // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/sessions/schema/user-session.ts

@@ -74,4 +74,6 @@ export const userSessionEntity = createEntity({
 // handlers write it directly via ctx.db; the meta carries no executor-only
 // brand so those writes stay legal. See feature.ts for the rebuild-exclusion
 // rationale (#494/#498).
-export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity);
+export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity, {
+  source: "unmanaged",
+});