@cosmicdrift/kumiko-bundled-features 0.156.2 → 0.156.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.156.2",
+  "version": "0.156.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -116,11 +116,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.156.2",
-    "@cosmicdrift/kumiko-framework": "0.156.2",
-    "@cosmicdrift/kumiko-headless": "0.156.2",
-    "@cosmicdrift/kumiko-renderer": "0.156.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.156.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.156.3",
+    "@cosmicdrift/kumiko-framework": "0.156.3",
+    "@cosmicdrift/kumiko-headless": "0.156.3",
+    "@cosmicdrift/kumiko-renderer": "0.156.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.156.3",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-mfa/handlers/verify.write.ts

@@ -139,6 +139,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // now. Deliberately NOT re-checking strictEmailVerification here:
       // MfaVerifyOptions has no such flag, and email verification can't
       // regress between login and verify within the 10-minute window.
+      if (!userRow) return invalidChallengeToken();
       if (
         userRow?.status === USER_STATUS.Restricted ||
         userRow?.status === USER_STATUS.DeletionRequested ||

package/src/cap-counter/__tests__/entity-ddl.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { capCounterEntity } from "../entity";
+
+function pgTypeOf(table: unknown, dbName: string): string | undefined {
+  const cols = (table as { columns?: ReadonlyArray<{ name: string; pgType?: string }> }).columns;
+  return cols?.find((c) => c.name === dbName)?.pgType;
+}
+
+describe("capCounterEntity — DDL (#1205 regression)", () => {
+  test("value column is bigint, not double precision", () => {
+    const table = buildEntityTable("cap-counter", capCounterEntity);
+    expect(pgTypeOf(table, "value")).toBe("bigint");
+  });
+});

package/src/cap-counter/entity.ts

@@ -1,6 +1,6 @@
 import {
+  createBigIntField,
   createEntity,
-  createNumberField,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -41,7 +41,7 @@ export const capCounterEntity = createEntity({
   table: "read_cap_counters",
   fields: {
     capName: createTextField({ required: true, maxLength: 100, sortable: true, searchable: true }),
-    value: createNumberField({ required: true, default: 0 }),
+    value: createBigIntField({ required: true, default: 0 }),
     periodStart: createTimestampField({ required: true }),
     lastSoftWarnedAt: createTimestampField(),
   },

package/src/inbound-mail-foundation/entities.ts

@@ -164,5 +164,9 @@ export const seenMessageEntity = createEntity({
 // Plain EntityTableMeta (kein branded EntityTable) — unmanaged Direct-
 // Write-Stores, Handler schreiben via ctx.db (siehe user-session.ts-
 // Rationale).
-export const syncCursorTable = buildEntityTableMeta("mail-sync-cursor", syncCursorEntity);
-export const seenMessageTable = buildEntityTableMeta("mail-seen-message", seenMessageEntity);
+export const syncCursorTable = buildEntityTableMeta("mail-sync-cursor", syncCursorEntity, {
+  source: "unmanaged",
+});
+export const seenMessageTable = buildEntityTableMeta("mail-seen-message", seenMessageEntity, {
+  source: "unmanaged",
+});

package/src/jobs/__tests__/entity-ddl.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { jobRunEntity } from "../job-run-table";
+
+function pgTypeOf(table: unknown, dbName: string): string | undefined {
+  const cols = (table as { columns?: ReadonlyArray<{ name: string; pgType?: string }> }).columns;
+  return cols?.find((c) => c.name === dbName)?.pgType;
+}
+
+describe("jobRunEntity — DDL (#1205 regression)", () => {
+  test("duration column is integer, not double precision", () => {
+    const table = buildEntityTable("read_job_runs", jobRunEntity);
+    expect(pgTypeOf(table, "duration")).toBe("integer");
+  });
+});

package/src/jobs/job-run-table.ts

@@ -48,7 +48,7 @@ export const jobRunEntity = createEntity({
     attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),
-    duration: createNumberField(),
+    duration: createNumberField({ integer: true }),
     triggeredById: createTextField(),
   },
 });

package/src/personal-access-tokens/feature.ts

@@ -53,7 +53,7 @@ export function createPersonalAccessTokensFeature(
     // Direct-write store like read_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
     // whose replay (no token events) would wipe every live token (#498/#494).
-    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity), {
+    r.rawTable(buildEntityTableMeta("api-token", apiTokenEntity, { source: "unmanaged" }), {
       reason: "read_side.api_tokens_direct_write",
       // create.write encrypts `name` via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/personal-access-tokens/schema/api-token.ts

@@ -58,4 +58,6 @@ export const apiTokenEntity = createEntity({
 // buildEntityTableMeta (not buildEntityTable): this is a direct-write store, so
 // the table must be a WritableTable (post ES-write-brand #742) — same as
 // sessions' userSessionTable. buildEntityTable is branded executor-only.
-export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity);
+export const apiTokenTable = buildEntityTableMeta("api-token", apiTokenEntity, {
+  source: "unmanaged",
+});

package/src/secrets/__tests__/rotate.integration.test.ts

@@ -175,8 +175,16 @@ describe("rotate-job circuit-breaker", () => {
   // Happy-path counterpart to the failure tests above: a working provider
   // that actually rewraps. Run last — it's the only test that mutates the
   // shared 20-row fixture, so the earlier "stays at 20" assertions must
-  // see it before this runs.
+  // see it before this runs. Enforced below, not just documented: a
+  // precondition check fails loud (not silently-wrong) if a test inserted
+  // between this and the circuit-breaker tests already touched the
+  // fixture — rotateJob's batch scan has no per-row exclusion/ordering
+  // to fall back on, so isolating this test onto a second tenant doesn't
+  // help (rotator would just exhaust maxFailures on the other tenant's
+  // still-V1 rows before ever reaching its own).
   test("successful rotation rewraps the DEK, bumps kekVersion, and preserves plaintext", async () => {
+    expect(await countV1Rows()).toBe(20);
+
     const rotator = createEnvMasterKeyProvider({
       env: {
         KUMIKO_SECRETS_MASTER_KEY_V1: SEED_V1_KEY,
@@ -185,6 +193,17 @@ describe("rotate-job circuit-breaker", () => {
       },
     });
 
+    // Snapshot pre-rotation ciphertext — rotate.job.ts's header comment
+    // claims "the ciphertext itself never changes, only the DEK wrapper".
+    // Assert that invariant below instead of only checking kekVersion/
+    // plaintext, which a rewrap-that-re-encrypts would also satisfy.
+    const preRotation = await selectMany<{ key: string; envelope: StoredEnvelope }>(
+      stack.db,
+      tenantSecretsTable,
+      { tenantId: admin.tenantId },
+    );
+    const ciphertextByKey = new Map(preRotation.map((row) => [row.key, row.envelope.ciphertext]));
+
     await rotateJob({ batchSize: 10, maxFailures: 5 }, jobCtx(rotator));
 
     expect(await countV1Rows()).toBe(0);
@@ -209,6 +228,9 @@ describe("rotate-job circuit-breaker", () => {
     expect(rows).toHaveLength(20);
     for (const row of rows) {
       expect(row.kekVersion).toBe(2);
+      const expectedCiphertext = ciphertextByKey.get(row.key);
+      expect(expectedCiphertext).toBeDefined();
+      expect(row.envelope.ciphertext).toBe(expectedCiphertext as string);
       const expectedIndex = row.key.split("-").at(-1);
       const plaintext = await decryptValue(decodeStoredEnvelope(row.envelope), verifier);
       expect(plaintext).toBe(`secret-${expectedIndex}`);

package/src/sessions/feature.ts

@@ -96,7 +96,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // (#498/#494). r.rawTable keeps the migration DDL but opts the
     // table out of implicit rebuild, like jobs/channel-in-app/feature-toggles
     // which are direct-write stores too.
-    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity), {
+    r.rawTable(buildEntityTableMeta("user-session", userSessionEntity, { source: "unmanaged" }), {
       reason: "read_side.user_sessions_direct_write",
       // sessionCreator encrypts ip/userAgent via encryptForDirectWrite (#820).
       piiEncryptedOnWrite: true,

package/src/sessions/schema/user-session.ts

@@ -74,4 +74,6 @@ export const userSessionEntity = createEntity({
 // handlers write it directly via ctx.db; the meta carries no executor-only
 // brand so those writes stay legal. See feature.ts for the rebuild-exclusion
 // rationale (#494/#498).
-export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity);
+export const userSessionTable = buildEntityTableMeta("user-session", userSessionEntity, {
+  source: "unmanaged",
+});