@cosmicdrift/kumiko-bundled-features 0.159.1 → 0.161.0

package/src/config/__tests__/backing-secrets.integration.test.ts

@@ -203,6 +203,24 @@ describe("config backing=secrets — fail-loud when secrets unwired", () => {
       await unwired.cleanup();
     }
   });
+
+  test("cascade read on backing=secrets without secretsReader throws", async () => {
+    // Write succeeds on the wired stack; then resolve via a bare resolver
+    // (no secretsReader) so readBackingSecret fails loud on the cascade path.
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: API_KEY, value: "sk-live-planted", scope: "system" },
+      systemAdmin,
+    );
+
+    const bare = createConfigResolver();
+    const keyDef = stack.registry.getConfigKey(API_KEY);
+    expect(keyDef).toBeDefined();
+
+    await expect(
+      bare.getCascade(API_KEY, keyDef!, systemAdmin.tenantId, systemAdmin.id, stack.db),
+    ).rejects.toThrow(/backing="secrets".*without a secrets/);
+  });
 });
 
 describe("config backing=secrets — reset dispatch", () => {

package/src/config/__tests__/cascade.integration.test.ts

@@ -527,3 +527,42 @@ describe("config:query:cascade handler", () => {
     expect(data[TENANT_KEY]).toBeDefined();
   });
 });
+
+// getAll / getAllWithSource are bulk readers used by admin UIs — never
+// reached via the cascade query handlers above, so they stay uncovered
+// unless called directly on the resolver.
+describe("getAll / getAllWithSource", () => {
+  test("getAll picks the most specific row (user > tenant > system)", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: TENANT_KEY, value: "TENANT_BULK" },
+      tenantAdmin,
+    );
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: USER_KEY, value: "USER_BULK" },
+      tenantAdmin,
+    );
+
+    const all = await resolver.getAll(tenantAdmin.tenantId, tenantAdmin.id, db);
+    // getAll returns raw stored strings (JSON-serialized); deserialize for asserts.
+    expect(JSON.parse(all.get(TENANT_KEY)?.value ?? "null")).toBe("TENANT_BULK");
+    expect(JSON.parse(all.get(USER_KEY)?.value ?? "null")).toBe("USER_BULK");
+    // System seed still present for keys without a more-specific row.
+    expect(JSON.parse(all.get(SYSTEM_KEY)?.value ?? "null")).toBe("SEED_SYSTEM");
+  });
+
+  test("getAllWithSource tags the winning row's source", async () => {
+    const withSource = await resolver.getAllWithSource(tenantAdmin.tenantId, tenantAdmin.id, db);
+
+    const userRow = withSource.get(USER_KEY);
+    expect(userRow?.source).toBe("user-row");
+    expect(JSON.parse(userRow?.value ?? "null")).toBe("USER_BULK");
+
+    const tenantRow = withSource.get(TENANT_KEY);
+    expect(tenantRow?.source).toBe("tenant-row");
+
+    const systemRow = withSource.get(SYSTEM_KEY);
+    expect(systemRow?.source).toBe("system-row");
+  });
+});

package/src/config/__tests__/pii-encrypted.integration.test.ts

@@ -156,4 +156,24 @@ describe("piiEncrypted config keys", () => {
       configurePiiSubjectKms(kms);
     }
   });
+
+  test("read of stored piiEncrypted ciphertext without KMS fails loud", async () => {
+    // Plant ciphertext while KMS is wired, then strip it so the READ path
+    // (decryptPiiEncrypted) — not just the write path — fails loud.
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: BILLING_ADDRESS_KEY, value: "planted-for-read" },
+      tenantAdmin,
+    );
+
+    resetPiiSubjectKmsForTests();
+    expect(configuredPiiSubjectKms()).toBeUndefined();
+
+    try {
+      const res = await stack.http.query(ConfigQueries.values, {}, tenantAdmin);
+      expect(res.status).toBe(500);
+    } finally {
+      configurePiiSubjectKms(kms);
+    }
+  });
 });

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -43,6 +43,7 @@ import {
   InboundCursorInvalidError,
   InboundMailAccountStatuses,
   InboundMailFoundationHandlers,
+  InboundRateLimitError,
   inboundMailFoundationFeature,
   inboundMessagesProjectionTable,
   mailAccountsProjectionTable,
@@ -268,4 +269,157 @@ describe("watch-supervisor — error semantics", () => {
       "cursor-ok-2@example.com",
     ]);
   });
+
+  test("InboundRateLimitError on fetch keeps the account active for the next tick", async () => {
+    const admin = adminFor(4107);
+    const accountId = await connectSharedAccount(admin);
+    failNextFetchWith(accountId, new InboundRateLimitError("slow down", 30_000));
+
+    const supervisor = createSupervisor();
+    await supervisor.pollOnce();
+
+    const accounts = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+    expect(accounts[0]?.["status"]).toBe(InboundMailAccountStatuses.active);
+  });
+});
+
+describe("watch-supervisor — watch restart + ingest resilience", () => {
+  test("transient watch error schedules backoff restart and re-arms watch", async () => {
+    const admin = adminFor(4108);
+    const accountId = await connectSharedAccount(admin);
+    const supervisor = createSupervisor();
+    try {
+      await supervisor.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      emitWatchError(accountId, new Error("socket dropped"));
+
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      const accounts = await selectMany(db, mailAccountsProjectionTable, { id: accountId });
+      expect(accounts[0]?.["status"]).toBe(InboundMailAccountStatuses.active);
+      expect(String(accounts[0]?.["watchState"])).toMatch(/^watching|backoff:/);
+    } finally {
+      await supervisor.stop();
+    }
+  });
+
+  test("watch-ingest failure is logged; poll reconciliation still ingests", async () => {
+    const admin = adminFor(4109);
+    const accountId = await connectSharedAccount(admin);
+    let ingestCalls = 0;
+    const supervisor = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: ({ handlerQn, payload, tenantId }) => {
+        if (handlerQn === InboundMailFoundationHandlers.ingestMessage) {
+          ingestCalls += 1;
+          if (ingestCalls === 1) {
+            return Promise.resolve({ isSuccess: false, error: { code: "simulated" } });
+          }
+        }
+        return stack.dispatcher.write(
+          handlerQn,
+          payload,
+          createSystemUser(tenantId as TenantId, [ROLES.SystemAdmin]),
+        );
+      },
+      pollIntervalMs: 60_000,
+      watchBackoffInitialMs: 50,
+      watchBackoffMaxMs: 200,
+    });
+    try {
+      await supervisor.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      await seedInboundMessage(
+        accountId,
+        rawMsg({ providerMessageId: "watch-ingest-fail-1", subject: "via watch" }),
+      );
+
+      await supervisor.pollOnce();
+
+      const rows = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+      expect(rows.some((r) => r["messageIdHeader"] === "watch-ingest-fail-1@example.com")).toBe(
+        true,
+      );
+    } finally {
+      await supervisor.stop();
+    }
+  });
+
+  test("storeBody hook persists raw MIME references on poll ingest", async () => {
+    const admin = adminFor(4110);
+    const accountId = await connectSharedAccount(admin);
+    const stored: string[] = [];
+    const supervisor = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: ({ handlerQn, payload, tenantId }) =>
+        stack.dispatcher.write(
+          handlerQn,
+          payload,
+          createSystemUser(tenantId as TenantId, [ROLES.SystemAdmin]),
+        ),
+      storeBody: async (_account, msg) => {
+        stored.push(msg.providerMessageId);
+        return `body-ref:${msg.providerMessageId}`;
+      },
+      pollIntervalMs: 60_000,
+    });
+    await seedInboundMessage(
+      accountId,
+      rawMsg({
+        providerMessageId: "body-store-1",
+        rawMime: new TextEncoder().encode("raw-mime-bytes"),
+      }),
+    );
+    await supervisor.pollOnce();
+    expect(stored).toEqual(["body-store-1"]);
+  });
+
+  test("disconnecting an account tears down its watcher on the next pollOnce", async () => {
+    const admin = adminFor(4111);
+    const accountId = await connectSharedAccount(admin);
+    const supervisor = createSupervisor();
+    try {
+      await supervisor.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      await stack.http.writeOk(
+        InboundMailFoundationHandlers.disconnectAccount,
+        { accountId, reason: "test" },
+        admin,
+      );
+      await supervisor.pollOnce();
+
+      expect(isWatching(accountId)).toBe(false);
+    } finally {
+      await supervisor.stop();
+    }
+  });
+
+  test("start() is idempotent — second start keeps the watcher armed", async () => {
+    const admin = adminFor(4112);
+    const accountId = await connectSharedAccount(admin);
+    const supervisor = createSupervisor();
+    try {
+      await supervisor.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+      await supervisor.start();
+      expect(isWatching(accountId)).toBe(true);
+    } finally {
+      await supervisor.stop();
+    }
+  });
 });

package/src/inbound-provider-imap/__tests__/plugin-mocked.test.ts

@@ -0,0 +1,331 @@
+// Always-on unit coverage for imapInboundMailPlugin.verify/fetch/watch.
+// Greenmail suites skip in CI when the container is down — this file mocks
+// imapflow so the plugin body stays on the coverage badge without Docker.
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import { createSecret } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  type InboundMailContext,
+  isInboundAuthError,
+  isInboundCursorInvalidError,
+  isInboundTransientError,
+  type MailAccountRecord,
+  type RawInboundMessage,
+} from "../../inbound-mail-foundation";
+
+type FakeMsg = {
+  readonly uid: number;
+  readonly source: Buffer;
+  readonly internalDate: Date;
+};
+
+type FakeState = {
+  connectError?: Error;
+  authFailed?: boolean;
+  uidValidity: string;
+  uidNext: number;
+  messages: FakeMsg[];
+  /** When set, search() returns this list instead of all message uids. */
+  searchUids?: number[];
+};
+
+let state: FakeState;
+let lastIdleClient: FakeImapFlow | undefined;
+
+class FakeImapFlow extends EventEmitter {
+  mailbox: { uidValidity: bigint; uidNext: number } | false = false;
+  private idleReject: ((err: Error) => void) | undefined;
+
+  constructor(_opts: unknown) {
+    super();
+    lastIdleClient = this;
+  }
+
+  async connect(): Promise<void> {
+    if (state.connectError) {
+      const err = state.connectError as Error & { authenticationFailed?: boolean };
+      if (state.authFailed) err.authenticationFailed = true;
+      throw err;
+    }
+  }
+
+  async logout(): Promise<void> {
+    this.idleReject?.(new Error("connection closed"));
+    this.idleReject = undefined;
+  }
+
+  async getMailboxLock(_box: string): Promise<{ release: () => void }> {
+    this.mailbox = {
+      uidValidity: BigInt(state.uidValidity),
+      uidNext: state.uidNext,
+    };
+    return { release: () => {} };
+  }
+
+  async mailboxOpen(_box: string): Promise<{ uidValidity: bigint; uidNext: number }> {
+    this.mailbox = {
+      uidValidity: BigInt(state.uidValidity),
+      uidNext: state.uidNext,
+    };
+    return this.mailbox;
+  }
+
+  async search(_query: unknown, _opts?: unknown): Promise<number[]> {
+    return state.searchUids ?? state.messages.map((m) => m.uid);
+  }
+
+  async *fetch(
+    range: string,
+    _opts?: unknown,
+    _uidOpts?: unknown,
+  ): AsyncGenerator<{
+    uid: number;
+    source: Buffer;
+    internalDate: Date;
+  }> {
+    // Real imapflow is called with either "N,M,…" (explicit uid list) or "N:*".
+    const wanted = new Set<number>();
+    if (range.includes("*")) {
+      const start = Number(range.split(":")[0]);
+      for (const m of state.messages) {
+        if (m.uid >= start) wanted.add(m.uid);
+      }
+    } else {
+      for (const part of range.split(",")) {
+        const n = Number(part.trim());
+        if (Number.isFinite(n)) wanted.add(n);
+      }
+    }
+    for (const m of state.messages) {
+      if (wanted.size > 0 && !wanted.has(m.uid)) continue;
+      yield { uid: m.uid, source: m.source, internalDate: m.internalDate };
+    }
+  }
+
+  async idle(): Promise<void> {
+    await new Promise<void>((_resolve, reject) => {
+      this.idleReject = reject;
+    });
+  }
+}
+
+mock.module("imapflow", () => ({ ImapFlow: FakeImapFlow }));
+
+const { imapInboundMailPlugin } = await import("../feature");
+
+function mime(subject: string, text: string): Buffer {
+  return Buffer.from(
+    [
+      "From: Sender <sender@example.com>",
+      "To: inbox@example.com",
+      `Subject: ${subject}`,
+      "Message-ID: <msg-1@example.com>",
+      "Date: Mon, 01 Jan 2024 12:00:00 +0000",
+      "MIME-Version: 1.0",
+      "Content-Type: text/plain; charset=utf-8",
+      "",
+      text,
+    ].join("\r\n"),
+  );
+}
+
+const account: MailAccountRecord = {
+  id: "00000000-0000-4000-8000-000000001a01",
+  tenantId: "00000000-0000-4000-8000-000000004242",
+  provider: "imap",
+  authMethod: "password",
+  ownerUserId: null,
+  address: "inbox@example.com",
+  displayName: "Mock",
+  status: "active",
+  watchState: "idle",
+};
+
+function ctxWithDoc(doc: string | null): InboundMailContext {
+  return {
+    _userId: "imap-plugin-mocked",
+    secrets: {
+      get: async () => (doc === null ? null : createSecret(doc)),
+      has: async () => doc !== null,
+      set: async () => {},
+      delete: async () => {},
+    } as unknown as import("@cosmicdrift/kumiko-framework/secrets").SecretsContext, // @cast-boundary test-double
+  };
+}
+
+const goodDoc = JSON.stringify({
+  host: "imap.example.com",
+  port: 993,
+  secure: true,
+  user: "u@example.com",
+  password: "pw",
+});
+
+beforeEach(() => {
+  lastIdleClient = undefined;
+  state = {
+    uidValidity: "17",
+    uidNext: 3,
+    messages: [
+      {
+        uid: 1,
+        source: mime("one", "hello one"),
+        internalDate: new Date("2024-01-01T12:00:00Z"),
+      },
+      {
+        uid: 2,
+        source: mime("two", "hello two"),
+        internalDate: new Date("2024-01-02T12:00:00Z"),
+      },
+    ],
+  };
+});
+
+describe("imapInboundMailPlugin — mocked imapflow", () => {
+  test("verify: connect+logout happy path", async () => {
+    await expect(
+      imapInboundMailPlugin.verify(ctxWithDoc(goodDoc), account),
+    ).resolves.toBeUndefined();
+  });
+
+  test("verify: auth failure → InboundAuthError", async () => {
+    state.connectError = new Error("Authentication failed");
+    state.authFailed = true;
+    try {
+      await imapInboundMailPlugin.verify(ctxWithDoc(goodDoc), account);
+      expect.unreachable("expected verify to throw");
+    } catch (e) {
+      expect(isInboundAuthError(e)).toBe(true);
+    }
+  });
+
+  test("verify: missing credential secret → InboundAuthError", async () => {
+    try {
+      await imapInboundMailPlugin.verify(ctxWithDoc(null), account);
+      expect.unreachable("expected verify to throw");
+    } catch (e) {
+      expect(isInboundAuthError(e)).toBe(true);
+    }
+  });
+
+  test("verify: malformed credential JSON → InboundAuthError", async () => {
+    try {
+      await imapInboundMailPlugin.verify(ctxWithDoc("not-json"), account);
+      expect.unreachable("expected verify to throw");
+    } catch (e) {
+      expect(isInboundAuthError(e)).toBe(true);
+    }
+  });
+
+  test("fetch: backfill (null cursor) returns messages + nextCursor", async () => {
+    const result = await imapInboundMailPlugin.fetch(ctxWithDoc(goodDoc), account, null, {
+      backfillWindowDays: 7,
+      maxMessages: 50,
+    });
+    expect(result.messages).toHaveLength(2);
+    expect(result.messages[0]?.subject).toBe("one");
+    expect(result.nextCursor).toEqual({ uidValidity: "17", lastUid: 2 });
+    expect(result.hasMore).toBe(false);
+  });
+
+  test("fetch: incremental cursor filters uid <= lastUid + hasMore via maxMessages", async () => {
+    state.searchUids = [1, 2, 3, 4];
+    state.messages = [
+      {
+        uid: 2,
+        source: mime("two", "x"),
+        internalDate: new Date("2024-01-02T12:00:00Z"),
+      },
+      {
+        uid: 3,
+        source: mime("three", "y"),
+        internalDate: new Date("2024-01-03T12:00:00Z"),
+      },
+      {
+        uid: 4,
+        source: mime("four", "z"),
+        internalDate: new Date("2024-01-04T12:00:00Z"),
+      },
+    ];
+    const result = await imapInboundMailPlugin.fetch(
+      ctxWithDoc(goodDoc),
+      account,
+      { uidValidity: "17", lastUid: 1 },
+      { backfillWindowDays: 7, maxMessages: 2 },
+    );
+    // search returns 2,3,4 (> lastUid=1); maxMessages=2 → hasMore
+    expect(result.messages.length).toBeLessThanOrEqual(2);
+    expect(result.hasMore).toBe(true);
+    expect(result.nextCursor["uidValidity"]).toBe("17");
+  });
+
+  test("fetch: UIDVALIDITY change → InboundCursorInvalidError", async () => {
+    try {
+      await imapInboundMailPlugin.fetch(
+        ctxWithDoc(goodDoc),
+        account,
+        { uidValidity: "16", lastUid: 1 },
+        { backfillWindowDays: 7, maxMessages: 50 },
+      );
+      expect.unreachable("expected fetch to throw");
+    } catch (e) {
+      expect(isInboundCursorInvalidError(e)).toBe(true);
+    }
+  });
+
+  test("fetch: network error → InboundTransientError", async () => {
+    state.connectError = new Error("ECONNREFUSED");
+    try {
+      await imapInboundMailPlugin.fetch(ctxWithDoc(goodDoc), account, null, {
+        backfillWindowDays: 7,
+        maxMessages: 50,
+      });
+      expect.unreachable("expected fetch to throw");
+    } catch (e) {
+      expect(isInboundTransientError(e)).toBe(true);
+    }
+  });
+
+  test("watch: exists → onMessages, stop() tears down", async () => {
+    expect(imapInboundMailPlugin.watch).toBeDefined();
+    const received: RawInboundMessage[][] = [];
+    const stop = await imapInboundMailPlugin.watch!(ctxWithDoc(goodDoc), account, {
+      onMessages: async (msgs) => {
+        received.push([...msgs]);
+      },
+      onError: () => {},
+    });
+
+    // New mail above uidNext-1 (uidNext=3 → nextUid starts at 3)
+    state.messages = [
+      {
+        uid: 3,
+        source: mime("pushed", "idle body"),
+        internalDate: new Date("2024-01-05T12:00:00Z"),
+      },
+    ];
+    lastIdleClient?.emit("exists");
+
+    await Bun.sleep(50);
+    expect(received.some((batch) => batch.some((m) => m.subject === "pushed"))).toBe(true);
+
+    await stop();
+  });
+
+  test("watch: client error → onError once", async () => {
+    let errors = 0;
+    const stop = await imapInboundMailPlugin.watch!(ctxWithDoc(goodDoc), account, {
+      onMessages: async () => {},
+      onError: () => {
+        errors += 1;
+      },
+    });
+    lastIdleClient?.emit("error", new Error("socket hang up"));
+    await Bun.sleep(20);
+    lastIdleClient?.emit("error", new Error("second"));
+    await Bun.sleep(20);
+    expect(errors).toBe(1);
+    await stop().catch(() => {});
+  });
+});

package/src/personal-access-tokens/feature.ts

@@ -47,7 +47,7 @@ export function createPersonalAccessTokensFeature(
     r.describe(
       "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
-    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
+    r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: true });
     // Opt-in tier-gating (mirrors ledger/tags): when set, the feature declares
     // itself r.toggleable so the dispatcher gate + tier-engine can switch PAT
     // on/off per tenant. { default: false } = fail-closed until a tier grants it.

package/src/sessions/feature.ts

@@ -42,6 +42,9 @@ export type SessionsFeatureOptions = {
   // only to supply a custom revoker — an explicit value wins over the
   // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
+  // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
+  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  readonly expiresInMs?: number;
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
@@ -120,12 +123,16 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // via resolveSessionStore().
     r.useExtension(EXT_SESSION_STORE, "default", {
       build: (deps): SessionStore => {
-        const callbacks = createSessionCallbacks({ db: deps.db });
+        const callbacks = createSessionCallbacks({
+          db: deps.db,
+          ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
+        });
         return {
           creator: callbacks.sessionCreator,
           revoker: callbacks.sessionRevoker,
           checker: callbacks.sessionChecker,
           massRevoker: callbacks.sessionMassRevoker,
+          revokeAllOthers: callbacks.sessionRevokeAllOthers,
         };
       },
     } satisfies SessionStoreProvider);