@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/subscription-stripe/__tests__/feature.test.ts

@@ -1,8 +1,18 @@
 // feature.ts contract tests for subscription-stripe.
 
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import Stripe from "stripe";
+import { describeSubscriptionProviderContract } from "../../billing-foundation/__tests__/subscription-provider-contract";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE } from "../constants";
 import { createSubscriptionStripeFeature } from "../feature";
+import {
+  createStripeCancelSubscription,
+  createStripeCheckoutSession,
+  createStripePortalSession,
+} from "../plugin-methods";
+import type { StripeCtxRuntime } from "../runtime";
+import { verifyAndParseStripeWebhook } from "../verify-webhook";
 
 const OPTIONS = {
   priceToTier: { price_test: "pro" },
@@ -69,6 +79,8 @@ describe("subscription-stripe — plugin-registration", () => {
     // "method not supported"-error brechen — type-check würde es nicht
     // fangen weil die useExtension-options als `unknown` durchgereicht
     // werden.
+    // Checks the mounted feature — the contract below builds its plugin
+    // by hand-wiring, so it would not catch a wiring gap here.
     const feature = createSubscriptionStripeFeature(OPTIONS);
     const usage = feature.extensionUsages.find((u) => u.entityName === STRIPE_PROVIDER_NAME);
     expect(usage).toBeDefined();
@@ -100,3 +112,110 @@ describe("constants — Stripe-event-types die wir mappen", () => {
     ]);
   });
 });
+
+// =============================================================================
+// SubscriptionProviderPlugin contract
+// =============================================================================
+//
+// Built directly from the plugin-method constructors (not from
+// createSubscriptionStripeFeature's mounted plugin) — the mounted plugin
+// resolves its Stripe client per-call from ctx.config/ctx.secrets, which
+// can't be spied on from outside. plugin-methods.test.ts already exercises
+// this same runtime-injection pattern for the individual methods.
+
+const CONTRACT_API_KEY = "sk_test_contract_dummy";
+const CONTRACT_WEBHOOK_SECRET = "whsec_contract_test_secret";
+
+function contractCtxRuntime(stripe: Stripe): StripeCtxRuntime {
+  return { clientForCtx: async () => stripe, assertBillingLive: async () => {} };
+}
+
+async function buildStripeContractFixture() {
+  const stripe = new Stripe(CONTRACT_API_KEY);
+  spyOn(stripe.checkout.sessions, "create").mockResolvedValue({
+    url: "https://checkout.stripe.com/c/pay/contract-test",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  spyOn(stripe.billingPortal.sessions, "create").mockResolvedValue({
+    url: "https://billing.stripe.com/p/session/contract-test",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  spyOn(stripe.subscriptions, "cancel").mockResolvedValue({
+    id: "sub_contract",
+    status: "canceled",
+    // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+  } as any);
+  const runtime = contractCtxRuntime(stripe);
+
+  const stripeForWebhookFixture = new Stripe(CONTRACT_API_KEY);
+  const webhookEvent = {
+    id: "evt_contract_001",
+    object: "event",
+    api_version: "2026-04-22.dahlia",
+    created: 1_770_000_000,
+    type: StripeEventTypes.customerSubscriptionCreated,
+    livemode: false,
+    pending_webhooks: 1,
+    request: { id: null, idempotency_key: null },
+    data: {
+      object: {
+        id: "sub_contract_001",
+        object: "subscription",
+        customer: "cus_contract_001",
+        status: "active",
+        metadata: { tenantId: "tenant-contract" },
+        items: {
+          object: "list",
+          data: [
+            {
+              id: "si_contract",
+              object: "subscription_item",
+              current_period_end: 1_780_000_000,
+              price: { id: "price_test", object: "price" },
+            },
+          ],
+          has_more: false,
+        },
+      },
+    },
+  };
+  const rawBody = JSON.stringify(webhookEvent);
+  const signature = await stripeForWebhookFixture.webhooks.generateTestHeaderStringAsync({
+    payload: rawBody,
+    secret: CONTRACT_WEBHOOK_SECRET,
+  });
+
+  return {
+    plugin: {
+      verifyAndParseWebhook: verifyAndParseStripeWebhook(
+        {
+          resolve: async () => ({
+            stripe: stripeForWebhookFixture,
+            webhookSecret: CONTRACT_WEBHOOK_SECRET,
+          }),
+        },
+        { priceToTier: OPTIONS.priceToTier },
+      ),
+      createCheckoutSession: createStripeCheckoutSession(runtime),
+      createPortalSession: createStripePortalSession(runtime),
+      cancelSubscription: createStripeCancelSubscription(runtime),
+    },
+    ctx: {} as HandlerContext,
+    checkout: {
+      priceId: "price_test",
+      tenantId: "tenant-contract",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+    },
+    portal: { providerCustomerId: "cus_contract", returnUrl: "https://example.com/return" },
+    cancelSubscriptionId: "sub_contract",
+    webhook: {
+      rawBody,
+      headers: { "stripe-signature": signature },
+      expectedTenantId: "tenant-contract",
+      expectedTier: "pro",
+    },
+  };
+}
+
+describeSubscriptionProviderContract("subscription-stripe", buildStripeContractFixture);

package/src/tags/web/__tests__/tag-manager.test.tsx

@@ -5,31 +5,65 @@ import {
   PrimitivesProvider,
 } from "@cosmicdrift/kumiko-renderer";
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
-import { fireEvent, render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
+import { TagsHandlers, TagsQueries } from "../../constants";
 import { defaultTranslations } from "../i18n";
 import { TagManager } from "../tag-manager";
 
 type TagRow = { id: string; name: string; color?: string; scope?: string; version: number };
+type AssignmentRow = { tagId: string };
 
 let catalogRows: readonly TagRow[] = [];
+let assignmentRows: readonly AssignmentRow[] = [];
+let catalogLoading = false;
+let catalogData: { rows: readonly TagRow[] } | null = { rows: catalogRows };
+let catalogError: { i18nKey: string; i18nParams?: Record<string, unknown> } | null = null;
+let assignmentError: { i18nKey: string; i18nParams?: Record<string, unknown> } | null = null;
 
 beforeEach(() => {
   catalogRows = [{ id: "t1", name: "urgent", color: "#ef4444", version: 1 }];
+  assignmentRows = [{ tagId: "t1" }, { tagId: "t1" }];
+  catalogLoading = false;
+  catalogData = { rows: catalogRows };
+  catalogError = null;
+  assignmentError = null;
+  dispatchSpy.mockClear();
+  catalogRefetch.mockClear();
+  assignmentsRefetch.mockClear();
 });
 
-const dispatchSpy = mock(async () => ({ isSuccess: true, data: undefined }));
+const dispatchSpy = mock(async (type: string) =>
+  type === TagsHandlers.createTag
+    ? { isSuccess: true, data: { id: "tag-new" } }
+    : { isSuccess: true, data: undefined },
+);
+
+const catalogRefetch = mock(async () => {});
+const assignmentsRefetch = mock(async () => {});
+
+const useQuerySpy = mock((type: string) => {
+  if (type === TagsQueries.tagList) {
+    return {
+      data: catalogData,
+      loading: catalogLoading,
+      error: catalogError,
+      refetch: catalogRefetch,
+    };
+  }
+  return {
+    data: { rows: assignmentRows },
+    loading: false,
+    error: assignmentError,
+    refetch: assignmentsRefetch,
+  };
+});
 
 const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
 mock.module("@cosmicdrift/kumiko-renderer", () => ({
   ...actual_renderer,
   useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
-  useQuery: mock(() => ({
-    data: { rows: catalogRows },
-    loading: false,
-    error: null,
-    refetch: mock(),
-  })),
+  useQuery: useQuerySpy,
 }));
 
 function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
@@ -40,6 +74,174 @@ function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
   );
 }
 
+describe("TagManager — loading and errors", () => {
+  test("shows loading banner while catalog is loading with no data yet", () => {
+    catalogLoading = true;
+    catalogData = null;
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-loading")).toBeTruthy();
+  });
+
+  test("shows error banner when catalog query fails", () => {
+    catalogError = { i18nKey: "tags.section.empty" };
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-error")).toBeTruthy();
+    expect(screen.getByText("No tags found.")).toBeTruthy();
+  });
+
+  test("shows empty banner when catalog has no rows", () => {
+    catalogRows = [];
+    catalogData = { rows: catalogRows };
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-empty")).toBeTruthy();
+  });
+});
+
+describe("TagManager — catalog CRUD", () => {
+  test("renders tag row with scope label and usage count", () => {
+    catalogRows = [{ id: "t2", name: "note-tag", color: "#22c55e", scope: "note", version: 1 }];
+    catalogData = { rows: catalogRows };
+    assignmentRows = [{ tagId: "t2" }];
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-row-t2")).toBeTruthy();
+    expect(screen.getByText("@note")).toBeTruthy();
+    expect(screen.getByText("1×")).toBeTruthy();
+  });
+
+  test("create dispatches write with trimmed name/color/scope and refetches", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "  new-tag  " },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-new-color-swatch-#22c55e"));
+    fireEvent.change(document.getElementById("tag-manager-new-scope") as HTMLInputElement, {
+      target: { value: " note " },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.createTag, {
+        name: "new-tag",
+        color: "#22c55e",
+        scope: "note",
+      }),
+    );
+    await waitFor(() => expect(catalogRefetch).toHaveBeenCalled());
+    await waitFor(() => expect(assignmentsRefetch).toHaveBeenCalled());
+  });
+
+  test("create button stays disabled for empty trimmed name", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    const create = screen.getByTestId("tag-manager-create") as HTMLButtonElement;
+    expect(create.disabled).toBe(true);
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "   " },
+    });
+    expect(create.disabled).toBe(true);
+  });
+
+  test("save edit dispatches update and closes edit form", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+    expect(screen.getByTestId("tag-manager-edit-t1")).toBeTruthy();
+
+    fireEvent.change(document.getElementById("tag-edit-name-t1") as HTMLInputElement, {
+      target: { value: "renamed" },
+    });
+    fireEvent.click(screen.getByTestId("tag-edit-color-t1-swatch-#3b82f6"));
+    fireEvent.click(screen.getByTestId("tag-manager-save-t1"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.updateTag, {
+        id: "t1",
+        version: 1,
+        name: "renamed",
+        color: "#3b82f6",
+        scope: "",
+      }),
+    );
+    await waitFor(() => expect(screen.queryByTestId("tag-manager-edit-t1")).toBeNull());
+  });
+
+  test("cancel edit closes edit form without write", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+    fireEvent.click(screen.getByText("Cancel"));
+    expect(screen.queryByTestId("tag-manager-edit-t1")).toBeNull();
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
+  test("delete confirm dispatches deleteTag and refetches", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-delete-btn-t1"));
+    expect(screen.getByTestId("tag-manager-delete-dialog")).toBeTruthy();
+    fireEvent.click(screen.getByTestId("tag-manager-delete-dialog-confirm"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.deleteTag, { id: "t1" }),
+    );
+    await waitFor(() => expect(catalogRefetch).toHaveBeenCalled());
+  });
+
+  test("failed write shows action error banner", async () => {
+    dispatchSpy.mockImplementationOnce(
+      async () =>
+        ({ isSuccess: false, error: { i18nKey: "tags.section.empty" } }) as {
+          isSuccess: boolean;
+          data?: { id: string } | undefined;
+          error?: { i18nKey: string };
+        },
+    );
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "fail-tag" },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() => expect(screen.getByTestId("tag-manager-action-error")).toBeTruthy());
+  });
+});
+
 // 695/4: saveEdit silently no-ops on an empty trimmed name — the Save button
 // must reflect that in its disabled state, not just in the click handler.
 describe("TagManager — edit Save button", () => {
@@ -62,3 +264,70 @@ describe("TagManager — edit Save button", () => {
     expect(save.disabled).toBe(false);
   });
 });
+
+describe("TagManager — selection mode", () => {
+  test("filters tags by entityType scope and toggles selection", () => {
+    catalogRows = [
+      { id: "t1", name: "global", version: 1 },
+      { id: "t2", name: "note-only", scope: "note", version: 1 },
+      { id: "t3", name: "other", scope: "task", version: 1 },
+    ];
+    catalogData = { rows: catalogRows };
+    const onChange = mock((next: readonly string[]) => next);
+    let selected: readonly string[] = ["t1"];
+
+    render(
+      <Wrapper>
+        <TagManager
+          entityType="note"
+          selection={{
+            value: selected,
+            onChange: (next) => {
+              selected = next;
+              onChange(next);
+            },
+          }}
+        />
+      </Wrapper>,
+    );
+
+    expect(screen.getByTestId("tag-manager-row-t1")).toBeTruthy();
+    expect(screen.getByTestId("tag-manager-row-t2")).toBeTruthy();
+    expect(screen.queryByTestId("tag-manager-row-t3")).toBeNull();
+    expect(screen.queryByTestId("tag-manager-new-scope")).toBeNull();
+
+    fireEvent.click(screen.getByTestId("tag-manager-toggle-t2"));
+    expect(onChange).toHaveBeenCalledWith(["t1", "t2"]);
+
+    fireEvent.click(screen.getByTestId("tag-manager-toggle-t1"));
+    expect(onChange).toHaveBeenCalledWith([]);
+  });
+
+  test("create in selection mode adds new tag id to selection", async () => {
+    const onChange = mock((next: readonly string[]) => next);
+    render(
+      <Wrapper>
+        <TagManager entityType="note" selection={{ value: [], onChange }} />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "picked" },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() => expect(onChange).toHaveBeenCalledWith(["tag-new"]));
+  });
+
+  test("delete removes tag from selection when it was selected", async () => {
+    const onChange = mock((next: readonly string[]) => next);
+    render(
+      <Wrapper>
+        <TagManager selection={{ value: ["t1"], onChange }} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-delete-btn-t1"));
+    fireEvent.click(screen.getByTestId("tag-manager-delete-dialog-confirm"));
+
+    await waitFor(() => expect(onChange).toHaveBeenCalledWith([]));
+  });
+});

package/src/tenant/__tests__/members-query-kms.integration.test.ts

@@ -0,0 +1,98 @@
+// members.query.ts's decrypt-on-read fix (#1252): before the fix, an
+// active PII-subject KMS meant the query returned raw ciphertext for
+// email/displayName instead of decrypting them like every other PII read
+// path. This pins the decrypt-on-read roundtrip with a real KMS adapter
+// configured, so a later refactor can't silently re-introduce the
+// ciphertext leak.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { TenantQueries } from "../constants";
+import { createTenantFeature } from "../feature";
+import { tenantMembershipsTable } from "../membership-table";
+import { tenantEntity } from "../schema/tenant";
+import { seedTenant, seedTenantMembership } from "../seeding";
+
+const tenantId = testTenantId(1) as TenantId;
+
+let stack: TestStack;
+
+function tenantAdmin(userId: string): SessionUser {
+  return { id: userId, tenantId, roles: ["TenantAdmin"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature()],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable, tenantMembershipsTable]);
+  await seedTenant(stack.db, { id: tenantId, key: "tenant-kms-members", name: "KMS Tenant" });
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("members query — decrypt-on-read with an active KMS (#1252)", () => {
+  test("email and displayName come back as plaintext, not ciphertext", async () => {
+    // KMS active BEFORE the seed — seedUser runs through the executor, so
+    // the row reflects the encrypted prod state.
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    const { id: userId } = await seedUser(stack.db, {
+      email: "kms-member@example.com",
+      displayName: "KMS Member",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId, roles: ["User"] });
+
+    // Prove the row is actually ciphertext at rest — otherwise a no-op
+    // encryption path would make this test pass while proving nothing.
+    const rawRows = await selectMany<{ email: unknown; displayName: unknown }>(
+      stack.db,
+      userTable,
+      {
+        id: userId,
+      },
+    );
+    expect(isPiiCiphertext(rawRows[0]?.email)).toBe(true);
+    expect(isPiiCiphertext(rawRows[0]?.displayName)).toBe(true);
+
+    const members = await stack.http.queryOk<
+      readonly { userId: string; email: string | null; displayName: string | null }[]
+    >(TenantQueries.members, {}, tenantAdmin(userId));
+
+    const self = members.find((m) => m.userId === userId);
+    expect(self?.email).toBe("kms-member@example.com");
+    expect(self?.displayName).toBe("KMS Member");
+  });
+});

package/src/tenant/handlers/invitations.query.ts

@@ -31,10 +31,12 @@ export const invitationsQuery = defineQueryHandler({
       const email = row["email"];
       const invitedBy = row["invitedBy"];
       const decryptedEmail =
-        typeof email === "string" ? await decryptStoredPii(email, "tenant:invitations") : email;
+        typeof email === "string"
+          ? await decryptStoredPii(email, "email", "tenant:invitations")
+          : email;
       const decryptedInvitedBy =
         typeof invitedBy === "string"
-          ? await decryptStoredPii(invitedBy, "tenant:invitations")
+          ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
           : invitedBy;
       out.push({ ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy });
     }

package/src/tenant/handlers/members.query.ts

@@ -33,11 +33,11 @@ export const membersQuery = defineQueryHandler({
     for (const user of users) {
       const email =
         typeof user.email === "string"
-          ? await decryptStoredPii(user.email, "tenant:members")
+          ? await decryptStoredPii(user.email, "email", "tenant:members")
           : null;
       const displayName =
         typeof user.displayName === "string"
-          ? await decryptStoredPii(user.displayName, "tenant:members")
+          ? await decryptStoredPii(user.displayName, "displayName", "tenant:members")
           : null;
       decryptedByUserId.set(String(user.id), { email, displayName });
     }

package/src/tenant/seeding.ts

@@ -35,7 +35,7 @@ import {
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { assertAssignableMembershipRoles } from "./membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
@@ -99,7 +99,7 @@ export async function seedTenant(
   // (Projection-Drift nach rebuild, manuellem DELETE, oder async-lag). Wenn
   // Stream-Version > 0 → kein create() — wäre version_conflict. Caller
   // bekommt die ID, Projection wird beim nächsten Dispatcher-Cycle aufgebaut.
-  const streamVersion = await getAggregateStreamMaxVersion(db, options.id);
+  const streamVersion = await getUnscopedAggregateStreamMaxVersion(db, options.id);
   if (streamVersion > 0) return { id: options.id };
 
   const result = await tenantExecutor.create(

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -1,5 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -76,6 +77,7 @@ beforeAll(async () => {
       createUserFeature(),
       createTenantFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createTenantLifecycleFeature(),
     ],

package/src/tenant-lifecycle/boot-checks.ts

@@ -0,0 +1,53 @@
+import {
+  type EntityDefinition,
+  EXT_TENANT_DATA,
+  type FeatureDefinition,
+  type PiiAnnotations,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// r.entity(...) is not the only way a feature exposes an entity shape:
+// r.projection(...) can carry an optional `entity` too (raw read-models with
+// no executor, e.g. billing-foundation's subscription table). Need every
+// entity a feature declares, not just the r.entity ones, or a tenantOwned
+// field on a projection-only entity is invisible to the guard below.
+function entitiesOf(
+  feature: FeatureDefinition,
+): ReadonlyArray<readonly [string, EntityDefinition]> {
+  const fromEntities = Object.entries(feature.entities ?? {});
+  const fromProjections = Object.values(feature.projections ?? {})
+    .filter((p): p is typeof p & { entity: EntityDefinition } => p.entity !== undefined)
+    .map((p) => [p.name, p.entity] as const);
+  return [...fromEntities, ...fromProjections];
+}
+
+// V4: tenantOwned-entity-without-hook gate. Mirrors user-data-rights' V3
+// (validateGdprPiiHookCoverage) but for EXT_TENANT_DATA. Registered as this
+// feature's own `r.bootCheck()` (#1314, moved off the framework-internal
+// boot-validator) — tenant-lifecycle owns EXT_TENANT_DATA
+// (r.extendsRegistrar), so its own mount is the trigger, matching the
+// original guard's "tenant-lifecycle mounted" gate exactly (unlike gating on
+// a sibling feature, which would silently narrow coverage).
+export function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void {
+  const hookedEntities = new Set<string>();
+  for (const f of features) {
+    for (const usage of f.extensionUsages) {
+      if (usage.extensionName === EXT_TENANT_DATA) hookedEntities.add(usage.entityName);
+    }
+  }
+
+  for (const feature of features) {
+    for (const [entityName, entity] of entitiesOf(feature)) {
+      if (hookedEntities.has(entityName)) continue;
+      const tenantSubjectFields = Object.entries(entity.fields)
+        .filter(([, field]) => {
+          const annot = field as PiiAnnotations;
+          return Boolean(annot.tenantOwned);
+        })
+        .map(([name]) => name);
+      if (tenantSubjectFields.length === 0) continue;
+      throw new Error(
+        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has tenant-subject fields (${tenantSubjectFields.join(", ")}) but no feature registers an EXT_TENANT_DATA destroy hook for it — tenant destroy never erases this data. Register r.useExtension(EXT_TENANT_DATA, "${entityName}", { destroy }) or a documented no-op if crypto-shredding covers it.`,
+      );
+    }
+  }
+}