@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -13,6 +13,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createRegistry,
@@ -58,7 +59,7 @@ import { createDataRetentionFeature } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -91,6 +92,7 @@ function buildFeatures() {
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
     createAuthEmailPasswordFeature(),
+    authFoundationFeature,
     createSessionsFeature(),
     createUserDataRightsFeature(),
   ];
@@ -137,6 +139,12 @@ beforeEach(async () => {
   ]);
 });
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired.
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
   test("Restricted-Status ueberlebt einen Projection-Rebuild (T_create != T_active)", async () => {
     // Diskriminierende Praemisse: user.created landet auf systemAdmin.tenantId
@@ -149,7 +157,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     // Mitgliedschaft + Lifecycle auf einem ANDEREN, aktiven Tenant.
     await seedTenantMembership(stack.db, {
@@ -158,7 +166,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
       roles: ["Member"],
     });
 
-    const aliceActive = { id: created.id, tenantId: T_ACTIVE, roles: ["Member"] };
+    const aliceActive = await mintActor({ id: created.id, tenantId: T_ACTIVE, roles: ["Member"] });
     const restricted = await stack.http.writeOk<{ status: string }>(RESTRICT, {}, aliceActive);
     expect(restricted.status).toBe(USER_STATUS.Restricted);
 
@@ -187,7 +195,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "grace.rebuild@example.com", passwordHash: hash, displayName: "Grace" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     const T = getTemporal();
@@ -218,7 +226,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "legacy.rebuild@example.com", passwordHash: hash, displayName: "Legacy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     // Prae-Fix-Zustand simulieren: roher Write OHNE Event.
@@ -256,14 +264,14 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const goodRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
 
     const badRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
     // userEntity is systemStream:true (schema/user.ts) — its event stream

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -10,6 +10,7 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -57,6 +58,7 @@ const features = [
   createUserFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  authFoundationFeature,
   createSessionsFeature(),
 
   createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -8,6 +8,7 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -64,6 +65,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature({ sendDeletionRequestedEmail }),

package/src/user-data-rights/__tests__/request-export.integration.test.ts

@@ -18,6 +18,7 @@
 //     hasJob=false wenn nichts da
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -53,6 +54,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -12,6 +12,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -44,7 +45,7 @@ import { createSessionsFeature } from "../../sessions";
 import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -77,6 +78,7 @@ beforeAll(async () => {
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
     ],
@@ -115,10 +117,14 @@ async function seedAliceWithMembership(
   status: string = USER_STATUS.Active,
 ): Promise<{ userId: string }> {
   const hash = await hashPassword(ALICE_PW);
+  const actor = await withMintedSession(
+    (user, meta) => callbacks.get().sessionCreator(user, meta),
+    TestUsers.systemAdmin,
+  );
   const created = await stack.http.writeOk<{ id: string }>(
     UserHandlers.create,
     { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-    TestUsers.systemAdmin,
+    actor,
   );
   if (status !== USER_STATUS.Active) {
     await updateRows(stack.db, userTable, { status }, { id: created.id });
@@ -136,6 +142,12 @@ async function login(email: string, password: string): Promise<{ status: number;
   return { status: res.status, body: await res.json() };
 }
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired (same gate as seedAliceWithMembership's bootstrap actor above).
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 function reasonOf(err: { details?: unknown }): string | undefined {
   return (err.details as { reason?: string } | undefined)?.reason;
 }
@@ -156,11 +168,11 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsBefore.every((s) => s.revokedAt === null)).toBe(true);
 
     // Restrict-Account.
-    const aliceUser = {
+    const aliceUser = await mintActor({
       id: userId,
       tenantId: TENANT,
       roles: ["Member"],
-    };
+    });
     const result = await stack.http.writeOk<{ userId: string; status: string }>(
       RESTRICT,
       {},
@@ -182,17 +194,36 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
   });
 
+  test("non-admin targets another user's account: 403 admin_required_for_other_user", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const attacker = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, attacker);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("admin_required_for_other_user");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
   test("Restricted → Restricted (Idempotenz-Guard): 422 already_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
+    // Alice's own session is blocked while Restricted — an admin targets
+    // her account instead, same as production would have to.
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(RESTRICT, { userId }, admin);
     expect(err.httpStatus).toBe(422);
     expect(reasonOf(err)).toBe("already_restricted");
   });
 
   test("DeletionRequested → restrict-account: 422 user_not_in_active_state", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    const aliceUser = await mintActor({ id: userId, tenantId: TENANT, roles: ["Member"] });
     const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
     expect(reasonOf(err)).toBe("user_not_in_active_state");
   });
@@ -201,9 +232,11 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
 describe("S2.U6 :: lift-restriction state-transitions", () => {
   test("Restricted → Active: status flippt zurueck", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    // lift-restriction is operator-only (access.admin) — Alice's own
+    // session is blocked while Restricted anyway.
+    const admin = await mintActor(TestUsers.admin);
 
-    const result = await stack.http.writeOk<{ status: string }>(LIFT, {}, aliceUser);
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, admin);
     expect(result.status).toBe(USER_STATUS.Active);
 
     const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
@@ -214,15 +247,15 @@ describe("S2.U6 :: lift-restriction state-transitions", () => {
 
   test("Active → lift-restriction: 422 not_restricted (Idempotenz-Guard)", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Active);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
 
   test("DeletionRequested → lift-restriction: 422 not_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
 });
@@ -286,11 +319,11 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
     expect(liveBefore.length).toBe(2);
 
     // System-Caller.
-    const systemUser = {
+    const systemUser = await mintActor({
       id: "00000000-0000-4000-8000-000000000000",
       tenantId: TENANT,
       roles: ["SystemAdmin"],
-    };
+    });
     const result = await stack.http.writeOk<{ count: number; userId: string }>(
       SessionHandlers.revokeAllForUser,
       { userId },

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -10,6 +10,7 @@
 // jeden Export auf "failed" setzte).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -65,6 +66,7 @@ beforeAll(async () => {
       fileProviderInMemoryFeature,
       mailFoundationFeature,
       mailTransportInMemoryFeature,
+      authFoundationFeature,
       createSessionsFeature(),
       // appExportDownloadUrl set → the default export-ready mail is enabled, so
       // this also proves the export cron's mail bridge end-to-end (C6).

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -17,6 +17,7 @@ import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -59,6 +60,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -385,6 +387,47 @@ describe("runExportJobs :: storage-cleanup", () => {
     expect(result.cleanedJobIds).not.toContain(jobId);
     expect(await provider.exists(storageKey)).toBe(true);
   });
+
+  test("storage-delete Throw → Job bleibt uncleaned (retry naechster Pass)", async () => {
+    const jobId = await seedPendingJob();
+    const T = getTemporal();
+    const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
+    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const provider = await buildProvider(tenantA);
+    await provider.write(storageKey, new Uint8Array([7, 8, 9]));
+
+    await updateRows(
+      stack.db,
+      exportJobsTable,
+      {
+        status: EXPORT_JOB_STATUS.Done,
+        startedAt: longAgo,
+        completedAt: longAgo,
+        downloadStorageKey: storageKey,
+        expiresAt: longAgo,
+      },
+      { id: jobId },
+    );
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: async () => ({
+        ...provider,
+        delete: async () => {
+          throw new Error("synthetic storage delete failure");
+        },
+      }),
+      now: NOW(),
+    });
+
+    expect(result.cleanedJobIds).not.toContain(jobId);
+    expect(await provider.exists(storageKey)).toBe(true);
+    const [row] = (await selectMany(stack.db, exportJobsTable, { id: jobId })) as Array<{
+      downloadStorageKey: string | null;
+    }>;
+    expect(row?.downloadStorageKey).toBe(storageKey);
+  });
 });
 
 describe("runExportJobs :: idempotency", () => {
@@ -706,6 +749,145 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     expect(row?.errorMessage).toMatch(/Token-Creation failed/);
   });
 
+  test("failed-Job: sendExportFailedEmail wird mit errorMessage + userEmail gerufen", async () => {
+    const jobId = await seedPendingJob();
+
+    // Force a deterministic failure the same way as the UNIQUE-violation
+    // test above — pre-seed a token row for this jobId so the worker's
+    // tokenCrud.create hits the unique index and the job flips to failed.
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_export_download_tokens
+        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
+      VALUES (
+        gen_random_uuid(),
+        $1,
+        $2,
+        $3,
+        now(),
+        now() + interval '7 days',
+        1,
+        now(),
+        now()
+      )
+    `,
+      [tenantA, jobId, "existing-hash"],
+    );
+
+    type SentArgs = {
+      userId: string;
+      userEmail: string;
+      jobId: string;
+      errorMessage: string;
+      tenantId: string;
+    };
+    const sentEmails: SentArgs[] = [];
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async (args) => {
+        sentEmails.push(args);
+      },
+    });
+
+    expect(result.failedJobIds).toContain(jobId);
+    expect(sentEmails).toHaveLength(1);
+    const sent = sentEmails[0];
+    if (!sent) throw new Error("expected 1 sent email");
+    expect(sent.userId).toBe(String(aliceUser.id));
+    expect(sent.userEmail).toBe("alice@example.com");
+    expect(sent.jobId).toBe(jobId);
+    expect(sent.errorMessage).toMatch(/Token-Creation failed/);
+  });
+
+  test("failed-Job ohne Callback: kein Email, Worker-Run succeeded", async () => {
+    const jobId = await seedPendingJob();
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_export_download_tokens
+        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
+      VALUES (gen_random_uuid(), $1, $2, $3, now(), now() + interval '7 days', 1, now(), now())
+    `,
+      [tenantA, jobId, "existing-hash"],
+    );
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      // Kein sendExportFailedEmail
+    });
+    expect(result.failedJobIds).toContain(jobId);
+    // Kein Email, kein Throw — Worker laeuft normal durch
+  });
+
+  test("failed-Job, sendExportFailedEmail-Throw wird abgefangen (best-effort, kein Batch-Abbruch)", async () => {
+    const jobId = await seedPendingJob();
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_export_download_tokens
+        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
+      VALUES (gen_random_uuid(), $1, $2, $3, now(), now() + interval '7 days', 1, now(), now())
+    `,
+      [tenantA, jobId, "existing-hash"],
+    );
+
+    // Should not throw despite the callback throwing — the try/catch
+    // around fireExportFailedCallback swallows it (operator-visibility
+    // via console.warn only).
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async () => {
+        throw new Error("synthetic email transport failure");
+      },
+    });
+    expect(result.failedJobIds).toContain(jobId);
+  });
+
+  test("failed-Job, user ohne email → sendExportFailedEmail skipped (kein Throw)", async () => {
+    await resetTestTables(stack.db, [userTable]);
+    await seedRow(stack.db, userTable, {
+      id: String(aliceUser.id),
+      tenantId: tenantA,
+      email: "" as string,
+      passwordHash: "hashed",
+      displayName: "Alice",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.Active,
+    });
+    const jobId = await seedPendingJob();
+    await asRawClient(stack.db).unsafe(
+      `
+      INSERT INTO read_export_download_tokens
+        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
+      VALUES (gen_random_uuid(), $1, $2, $3, now(), now() + interval '7 days', 1, now(), now())
+    `,
+      [tenantA, jobId, "existing-hash"],
+    );
+
+    let callbackInvoked = false;
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async () => {
+        callbackInvoked = true;
+      },
+    });
+    expect(result.failedJobIds).toContain(jobId);
+    expect(callbackInvoked).toBe(false);
+  });
+
   test("failed-Job mit downloadStorageKey → ZIP wird im Cleanup-Pass entfernt (orphan-fix)", async () => {
     // Atom 4a.fix orphan-cleanup: failed-Jobs haben downloadStorageKey
     // gesetzt (path-pre-claim) — der ZIP-Pfad ist persistiert ab claim.
@@ -803,6 +985,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        authFoundationFeature,
         createSessionsFeature(),
 
         createUserDataRightsFeature(),
@@ -1063,7 +1246,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     expect(sent.userEmail).toBe("alice@example.com");
     expect(sent.jobId).toBe(jobId);
     expect(sent.downloadUrl).toMatch(
-      /^https:\/\/app\.example\.com\/user-export\/by-token\?token=[A-Za-z0-9_%-]+$/,
+      /^https:\/\/app\.example\.com\/user-export\/by-token#token=[A-Za-z0-9_%-]+$/,
     );
     // plain-token aus dem callback-arg entspricht dem result.tokenByJobId
     const plainFromResult = result.tokenByJobId.get(jobId);

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -16,6 +16,7 @@
 // der end-to-end-Default-Pfad (delete).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
@@ -67,6 +68,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -15,6 +15,7 @@
 //     ueber Pseudo-Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configurePiiSubjectKms,
@@ -61,6 +62,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -13,6 +13,7 @@
 // value (the failure mode that shipped the ctx.config export bug).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEntity,
@@ -82,6 +83,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/user-data-rights.integration.test.ts

@@ -7,6 +7,7 @@
 // Sprint-2-H1/H2-Hooks) kommt in S2.T1 (Cross-Data-Matrix).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -24,7 +25,14 @@ const userDataRights = createUserDataRightsFeature();
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [userFeature, sessionsFeature, dataRetention, complianceProfiles, userDataRights],
+    features: [
+      authFoundationFeature,
+      userFeature,
+      sessionsFeature,
+      dataRetention,
+      complianceProfiles,
+      userDataRights,
+    ],
   });
 });