@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/user-data-rights/boot-checks.ts

@@ -0,0 +1,86 @@
+import {
+  type EntityDefinition,
+  EXT_USER_DATA,
+  type FeatureDefinition,
+  type PiiAnnotations,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// r.entity(...) is not the only way a feature exposes an entity shape:
+// r.projection(...) can carry an optional `entity` too (raw read-models with
+// no executor, e.g. billing-foundation's subscription table). V3 below needs
+// every entity a feature declares, not just the r.entity ones, or a pii/
+// userOwned field on a projection-only entity is invisible to the guard it
+// was annotated for.
+function entitiesOf(
+  feature: FeatureDefinition,
+): ReadonlyArray<readonly [string, EntityDefinition]> {
+  const fromEntities = Object.entries(feature.entities ?? {});
+  const fromProjections = Object.values(feature.projections ?? {})
+    .filter((p): p is typeof p & { entity: EntityDefinition } => p.entity !== undefined)
+    .map((p) => [p.name, p.entity] as const);
+  return [...fromEntities, ...fromProjections];
+}
+
+// V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
+// export hook without a matching delete hook exports data under Art.20 but
+// never erases it on forget — an Art.17 violation. Hard boot failure: no app
+// should ship a GDPR export path with no erase path. Registry-level signal
+// only; runtime no-ops (a delete hook that silently skips) are not detectable
+// here — those are covered by the export/forget integration tests.
+//
+// Registered as an `r.bootCheck()` by this feature (#1314) — EXT_USER_DATA is
+// owned by user-data-rights (r.extendsRegistrar(EXT_USER_DATA, {})), so any
+// r.useExtension(EXT_USER_DATA, ...) usage across the app already requires
+// user-data-rights to be mounted (boot-validator's extension-provider check
+// fails otherwise); running this from user-data-rights' own bootCheck is
+// equivalent to the framework-internal call it replaces.
+export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_USER_DATA) continue;
+      const hasExport = typeof usage.options?.["export"] === "function";
+      const hasDelete = typeof usage.options?.["delete"] === "function";
+      if (hasExport && !hasDelete) {
+        throw new Error(
+          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+        );
+      }
+    }
+  }
+}
+
+// V3: PII-entity-without-hook gate. V2 checks registered hooks for
+// completeness; V3 catches the entity nobody registered at all — fields
+// annotated as user-subject data (pii / userOwned) yet invisible to the
+// Art.15/20 export and Art.17 forget pipeline. Hard boot failure: a
+// subject-data entity that skips the pipeline is exactly the "feature built
+// past GDPR" leak this gate exists to stop. No "is user-data-rights mounted"
+// guard needed here (unlike the framework-internal predecessor) — this runs
+// as user-data-rights' own bootCheck, so it's only reachable when mounted.
+// Matching is by entity name across all features (usage.entityName is
+// unqualified); a same-named entity in another feature can mask a gap —
+// accepted, as the common case is a distinct entity name.
+export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition[]): void {
+  const hookedEntities = new Set<string>();
+  for (const f of features) {
+    for (const usage of f.extensionUsages) {
+      if (usage.extensionName === EXT_USER_DATA) hookedEntities.add(usage.entityName);
+    }
+  }
+
+  for (const feature of features) {
+    for (const [entityName, entity] of entitiesOf(feature)) {
+      if (hookedEntities.has(entityName)) continue;
+      const subjectFields = Object.entries(entity.fields)
+        .filter(([, field]) => {
+          const annot = field as PiiAnnotations; // @cast-boundary schema-walk
+          return Boolean(annot.pii) || Boolean(annot.userOwned);
+        })
+        .map(([name]) => name);
+      if (subjectFields.length === 0) continue;
+      throw new Error(
+        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+      );
+    }
+  }
+}

package/src/user-data-rights/feature.ts

@@ -5,6 +5,7 @@ import {
   type FeatureDefinition,
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks";
 import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
@@ -87,7 +88,7 @@ export type UserDataRightsOptions = {
   readonly sendExportFailedEmail?: SendExportFailedEmailFn;
   /** Base-URL fuer den Magic-Link, z.B.
    *  "https://app.example.com/user-export/by-token". Worker bauen
-   *  `${appExportDownloadUrl}?token=<plain>`. Required wenn
+   *  a URL fragment (`#token=<plain>`, issue #1271). Required wenn
    *  sendExportReadyEmail gesetzt. Per-Tenant via reverse-proxy host
    *  routing — nicht via per-Tenant-config-key (App-Author-Decision). */
   readonly appExportDownloadUrl?: string;
@@ -155,6 +156,13 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     r.extendsRegistrar(EXT_USER_DATA, {});
 
+    // GDPR-storage guards V2+V3 (#1314) — moved off the framework-internal
+    // boot-validator onto this feature's own r.bootCheck(), since it's the
+    // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
+    // usage already requires user-data-rights to be mounted.
+    r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
+    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
     // (would harm co-members). An app with one user per tenant sets this to
@@ -282,10 +290,16 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       access: { openToAll: true },
     });
 
-    // Magic-Link-Pfad (anonymous): GET /user-export/by-token?token=<plain>.
-    // Ruft via app.fetch /api/query → success: 302-Redirect zur signed-URL →
-    // Browser folgt → Download startet beim Object-Store. Bei error:
-    // passthrough (404/410/501) als JSON.
+    // Magic-link path (anonymous): the email link carries the token as a
+    // URL fragment (`#token=<plain>`) instead of a query param — fragments
+    // never leave the browser, so they never hit proxy/access logs
+    // (issue #1271). This route only serves the interstitial page; the
+    // external script reads the fragment client-side and exchanges the
+    // token via POST for the signed URL.
+    //
+    // The old token-in-query format stays supported as a fallback (not a
+    // transitional shim — permanent): emails sent before this deploy still
+    // use the old format and must keep working until their TTL expires.
     //
     // Path liegt AUSSERHALB /api/* weil r.httpRoute den /api-namespace nicht
     // claimen darf (reserved fuer write/query/batch/auth/sse-dispatcher).
@@ -302,7 +316,9 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         const url = new URL(c.req.url);
         const token = url.searchParams.get("token");
         if (!token) {
-          return c.json({ error: "missing_token" }, 400);
+          return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
+            "content-type": "text/html; charset=utf-8",
+          });
         }
         const queryRes = await app.fetch(
           new Request(`${url.origin}/api/query`, {
@@ -318,6 +334,59 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       },
     });
 
+    // External script for the interstitial page above — same-origin file
+    // instead of inline <script>, so the page also works under a strict
+    // `script-src 'self'` CSP (apps set CSP via the security-headers
+    // option, without assuming `unsafe-inline`).
+    r.httpRoute({
+      method: "GET",
+      path: "/user-export/by-token.js",
+      anonymous: true,
+      handler: async (c) => {
+        return c.body(TOKEN_EXCHANGE_PAGE_JS, 200, {
+          "content-type": "application/javascript; charset=utf-8",
+        });
+      },
+    });
+
+    // Exchange endpoint for the interstitial page: the token arrives here
+    // as a POST body instead of a query string (issue #1271). A dedicated
+    // route rather than letting the browser JS call /api/query directly,
+    // for two reasons:
+    //   1. IP/UA audit — extractAuditMeta needs the raw request headers,
+    //      which only the server has, not the browser (see the GET path
+    //      above). Without this route every fragment-path download would
+    //      land in download-attempt with lastUsedFromIp/UA = null.
+    //   2. /api/query is the reserved dispatcher namespace for
+    //      authenticated writes/queries — an anonymous cross-origin POST
+    //      there isn't guaranteed to be reachable (origin guard).
+    r.httpRoute({
+      method: "POST",
+      path: "/user-export/by-token",
+      anonymous: true,
+      handler: async (c, { app }) => {
+        const url = new URL(c.req.url);
+        const parsedBody = await c.req.json().catch(() => null);
+        const token =
+          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
+            ? (parsedBody as { token?: unknown }).token
+            : undefined;
+        if (typeof token !== "string" || token.length === 0) {
+          return c.json({ error: "missing_token" }, 400);
+        }
+        return app.fetch(
+          new Request(`${url.origin}/api/query`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              type: "user-data-rights:query:download-by-token",
+              payload: { token, auditMeta: extractAuditMeta(c.req.raw.headers) },
+            }),
+          }),
+        );
+      },
+    });
+
     // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
     r.job(
       "run-export-jobs",
@@ -504,3 +573,44 @@ function extractAuditMeta(headers: Headers): { ip: string | null; userAgent: str
   }
   return { ip, userAgent: headers.get("user-agent") };
 }
+
+// Interstitial page for the magic-link fragment exchange (see the
+// httpRoute above). Plain static markup — no build step, no i18n lookup
+// (the server doesn't know a user locale here; anonymous path).
+const TOKEN_EXCHANGE_PAGE_HTML = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Export Download</title></head>
+<body>
+<p id="status">Preparing your download…</p>
+<script src="/user-export/by-token.js"></script>
+</body>
+</html>`;
+
+// Reads the token client-side from the URL fragment (never sent to the
+// server) and exchanges it via POST for the signed URL. Same-origin
+// external file instead of inline <script>, so the page also works under
+// a strict `script-src 'self'` CSP.
+const TOKEN_EXCHANGE_PAGE_JS = `(async () => {
+  const status = document.getElementById("status");
+  const params = new URLSearchParams(location.hash.slice(1));
+  const token = params.get("token");
+  if (!token) {
+    status.textContent = "Invalid download link.";
+    return;
+  }
+  try {
+    const res = await fetch("/user-export/by-token", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token }),
+    });
+    const body = await res.json();
+    if (!res.ok || !body || !body.data || !body.data.url) {
+      status.textContent = "This download link is invalid or has expired.";
+      return;
+    }
+    location.href = body.data.url;
+  } catch {
+    status.textContent = "Could not start the download.";
+  }
+})();`;

package/src/user-data-rights/handlers/deletion-grace-period.ts

@@ -75,7 +75,7 @@ export async function startDeletionGracePeriod(
     ok: true,
     gracePeriodEnd,
     userEmail: userRow["email"]
-      ? await decryptStoredPii(userRow["email"], "user-data-rights:grace-period")
+      ? await decryptStoredPii(userRow["email"], "email", "user-data-rights:grace-period")
       : "",
     userLocale: userRow["locale"] ?? null,
   };

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -1,7 +1,7 @@
 // GET /api/query → user-data-rights:query:download-by-token (S2.U3 Atom 4b).
 //
 // **Magic-Link-Pfad** (anonymous): User klickt Email-Link mit
-// `?token=<plain>`. Worker hat beim done-flip Token-Hash in DB
+// `#token=<plain>` (URL fragment, issue #1271). Worker hat beim done-flip Token-Hash in DB
 // persistiert (Atom 4a). Verify-Pipeline:
 //
 //   1. hashDownloadToken(plain) → fetchOne in download-tokens

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,5 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { USER_STATUS, userTable } from "../../user";
@@ -7,18 +7,11 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
 //
-// **Wichtige Eigenheit:** Der User kann diesen Endpoint NICHT selber
-// aufrufen weil sein Login geblockt ist (Restricted-Status, siehe
-// login.write.ts Atom 3). Wer ein Restricted-Konto wieder aktiviert,
-// muss dafuer einen anderen Pfad nutzen — typisch Operator-Tool oder
-// Email-Magic-Link an die User-Email. App-Author entscheidet das per
-// access-Konfig oder Custom-Wrapper.
-//
-// MVP-Default: openToAll mit Self-Service-Semantik. Die Asymmetrie
-// (User koennte sich selbst freischalten WENN er einen Weg ohne Login
-// hat — z.B. valid Magic-Link aus pre-Restriction) ist akzeptabel:
-// Restriction ist *Verarbeitungs-Pause*, nicht *Sperre durch Operator*.
-// User der "ich will doch wieder mitmachen" sagt, soll das koennen.
+// Operator-only. A Restricted user's own session is unconditionally
+// rejected by sessionChecker (BLOCKED_STATUSES) the moment their status
+// flips — their JWT/login can't reach this or any other authenticated
+// endpoint. There is no self-service path today, so lifting a restriction
+// always targets someone else's account by id.
 //
 // State-Transitions:
 //   Restricted → Active        ✓
@@ -27,17 +20,18 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 not_restricted
 export const liftRestrictionWrite = defineWriteHandler({
   name: "lift-restriction",
-  schema: z.object({}),
-  access: { openToAll: true },
+  schema: z.object({ userId: z.string() }),
+  access: { roles: access.admin },
   handler: async (event, ctx) => {
+    const targetUserId = event.payload.userId;
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
-      id: event.user.id,
+      id: targetUserId,
     });
 
     if (!userRow) {
       return writeFailure(
         new UnprocessableError("user_not_found", {
-          details: { reason: "user_not_found", userId: event.user.id },
+          details: { reason: "user_not_found", userId: targetUserId },
         }),
       );
     }
@@ -51,12 +45,12 @@ export const liftRestrictionWrite = defineWriteHandler({
       );
     }
 
-    await updateUserLifecycle(ctx.db.raw, event.user.id, { status: USER_STATUS.Active });
+    await updateUserLifecycle(ctx.db.raw, targetUserId, { status: USER_STATUS.Active });
 
     return {
       isSuccess: true as const,
       data: {
-        userId: event.user.id,
+        userId: targetUserId,
         status: USER_STATUS.Active,
       },
     };

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -1,6 +1,10 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
@@ -15,6 +19,12 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //     muss gemountet sein). App-Author ohne sessions-feature kriegt einen
 //     Boot-Resolver-Error via r.usesApi("sessions.revokeAllForUser").
 //
+// Self-service by default (userId omitted → event.user.id). An admin can
+// also target someone else's account — needed once a user is already
+// Restricted, since their own session is then unconditionally rejected by
+// sessionChecker and they can no longer call this (or any) endpoint
+// themselves; only an operator path reaches it at that point.
+//
 // State-Transitions:
 //   Active → Restricted        ✓ (dieser Handler)
 //   Restricted → Restricted    ✗ 422 already_restricted (Idempotenz-Guard)
@@ -22,19 +32,31 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 user_not_in_active_state
 export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
-  schema: z.object({}),
+  schema: z.object({ userId: z.string().optional() }),
   access: { openToAll: true },
   handler: async (event, ctx) => {
+    const targetUserId = event.payload.userId ?? event.user.id;
+    if (targetUserId !== event.user.id) {
+      const isAdmin = event.user.roles.some((role) => access.admin.includes(role));
+      if (!isAdmin) {
+        return writeFailure(
+          new AccessDeniedError({
+            details: { reason: "admin_required_for_other_user" },
+          }),
+        );
+      }
+    }
+
     // ctx.db.raw weil User-Entity tenant-agnostisch ist (analog
     // request-deletion.write.ts Cross-Tenant-Section).
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
-      id: event.user.id,
+      id: targetUserId,
     });
 
     if (!userRow) {
       return writeFailure(
         new UnprocessableError("user_not_found", {
-          details: { reason: "user_not_found", userId: event.user.id },
+          details: { reason: "user_not_found", userId: targetUserId },
         }),
       );
     }
@@ -55,7 +77,7 @@ export const restrictAccountWrite = defineWriteHandler({
       );
     }
 
-    await updateUserLifecycle(ctx.db.raw, event.user.id, { status: USER_STATUS.Restricted });
+    await updateUserLifecycle(ctx.db.raw, targetUserId, { status: USER_STATUS.Restricted });
 
     // Cross-Feature: alle live sessions revoken — sonst koennte der User
     // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
@@ -63,13 +85,13 @@ export const restrictAccountWrite = defineWriteHandler({
     // System-User-Roles im access-gate hat.
     const systemUser = createSystemUser(event.user.tenantId);
     await ctx.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
-      userId: event.user.id,
+      userId: targetUserId,
     });
 
     return {
       isSuccess: true as const,
       data: {
-        userId: event.user.id,
+        userId: targetUserId,
         status: USER_STATUS.Restricted,
       },
     };

package/src/user-data-rights/run-export-jobs.ts

@@ -152,7 +152,7 @@ export interface RunExportJobsArgs {
   readonly sendExportFailedEmail?: SendExportFailedEmailFn;
   /** Base-URL fuer den Magic-Link. App-Author setzt das (z.B.
    *  "https://app.example.com/user-export/by-token"). Worker baut
-   *  `${appExportDownloadUrl}?token=<plain>` und reicht das im
+   *  a URL fragment (not a query param — see issue #1271) and passes that
    *  Callback durch. Required wenn sendExportReadyEmail gesetzt. */
   readonly appExportDownloadUrl?: string;
 }
@@ -801,7 +801,7 @@ async function lookupUserContact(
     locale: string | null;
   } | null;
   if (!row?.email) return null;
-  const email = await decryptStoredPii(row.email, "user-data-rights:export-ready");
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:export-ready");
   if (email === PII_ERASED_SENTINEL) return null;
   return { email, locale: row.locale ?? null };
 }
@@ -844,7 +844,7 @@ async function fireExportReadyCallback(args: {
       "user-data-rights: sendExportReadyEmail gesetzt aber appExportDownloadUrl fehlt — beide muessen zusammen konfiguriert sein",
     );
   }
-  const downloadUrl = `${baseUrl}?token=${encodeURIComponent(args.plainToken)}`;
+  const downloadUrl = `${baseUrl}#token=${encodeURIComponent(args.plainToken)}`;
   await args.send({
     userId: args.job.userId,
     userEmail: contact.email,

package/src/user-data-rights/run-forget-cleanup.ts

@@ -281,7 +281,7 @@ async function processUser(args: {
   });
   const userEmailBeforeDelete =
     userPreTx?.email && userPreTx.email.length > 0
-      ? await decryptStoredPii(userPreTx.email, "user-data-rights:forget-cleanup")
+      ? await decryptStoredPii(userPreTx.email, "email", "user-data-rights:forget-cleanup")
       : null;
   const userLocaleBeforeDelete = userPreTx?.locale ?? null;
 

package/src/user-data-rights/web/__tests__/privacy-center-screen.test.tsx

@@ -71,6 +71,7 @@ function makeDispatcher(
     query,
     batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
     statusStore,
+    async *stream() {},
     pendingWrites: () => [],
     pendingFiles: () => [],
   } as unknown as Dispatcher; // @cast-boundary test-stub

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -19,6 +19,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createChannelInAppFeature, inAppMessagesTable } from "../../channel-in-app";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { configValueEntity, createConfigFeature } from "../../config";
@@ -72,6 +73,7 @@ beforeAll(async () => {
       createConfigFeature(),
       createTenantFeature(),
       createPersonalAccessTokensFeature({ scopes: PAT_SCOPES }),
+      authFoundationFeature,
       createDeliveryFeature(),
       createChannelInAppFeature(),
       createJobsFeature(),
@@ -93,6 +95,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights-defaults/__tests__/feature-mounted.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "bun:test";
+import type { UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+import { featureMounted } from "../hooks/feature-mounted";
+
+function ctxWithFeatures(mounted: readonly string[]): UserDataHookCtx {
+  return {
+    registry: {
+      getFeature: (name: string) => (mounted.includes(name) ? { name } : undefined),
+      // @cast-boundary test fixture — featureMounted only reads ctx.registry.getFeature
+    } as unknown as UserDataHookCtx["registry"],
+  } as unknown as UserDataHookCtx;
+}
+
+describe("featureMounted", () => {
+  test("returns true when the feature is registered", () => {
+    const ctx = ctxWithFeatures(["sessions"]);
+    expect(featureMounted(ctx, "sessions")).toBe(true);
+  });
+
+  test("returns false when the feature is not registered", () => {
+    const ctx = ctxWithFeatures(["sessions"]);
+    expect(featureMounted(ctx, "channel-email")).toBe(false);
+  });
+});

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -11,6 +11,7 @@
 //     fileRef-Forget beruehrt Tenant B's Files nicht)
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -43,6 +44,7 @@ const features = [
   createFilesFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  authFoundationFeature,
   createSessionsFeature(),
   createUserDataRightsFeature(),
   createUserDataRightsDefaultsFeature(),

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -42,7 +42,7 @@ async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
   if (!row) return null;
   // Stored value is ciphertext with an active KMS; lowercasing a base64
   // blob would break both lookup arms — decrypt first.
-  const email = await decryptStoredPii(row.email, "user-data-rights:invitation-hook");
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:invitation-hook");
   return email.toLowerCase();
 }
 

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -4,6 +4,7 @@
 // dispatcht genau diese Strings).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -60,6 +61,7 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createFilesFeature(),
       createUserDataRightsFeature(),

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -37,6 +37,7 @@ function makeDispatcher(me: Record<string, unknown>): Dispatcher {
     query: (async () => ({ isSuccess: true, data: me })) as unknown as Dispatcher["query"],
     batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
     statusStore,
+    async *stream() {},
     pendingWrites: () => [],
     pendingFiles: () => [],
   } as unknown as Dispatcher; // @cast-boundary test-stub

package/src/user-profile/handlers/change-email.write.ts

@@ -54,7 +54,7 @@ export const changeEmailWrite = defineWriteHandler({
     }
 
     const newEmail = event.payload.newEmail.toLowerCase();
-    const currentEmail = await decryptStoredPii(me.email, "user-profile:change-email");
+    const currentEmail = await decryptStoredPii(me.email, "email", "user-profile:change-email");
     if (newEmail === currentEmail.toLowerCase()) {
       return writeFailure(
         new UnprocessableError(UserProfileErrors.emailUnchanged, {