@cosmicdrift/kumiko-bundled-features 0.163.2 → 0.164.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.163.2",
+  "version": "0.164.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -117,11 +117,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.163.2",
-    "@cosmicdrift/kumiko-framework": "0.163.2",
-    "@cosmicdrift/kumiko-headless": "0.163.2",
-    "@cosmicdrift/kumiko-renderer": "0.163.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.163.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.164.0",
+    "@cosmicdrift/kumiko-framework": "0.164.0",
+    "@cosmicdrift/kumiko-headless": "0.164.0",
+    "@cosmicdrift/kumiko-renderer": "0.164.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.164.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -749,6 +749,70 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
       ).delete = originalUserDelete;
     }
   });
+
+  test("Hook meldet {status:'incomplete'} → kein Rollback, User trotzdem Deleted, im result.incomplete gesammelt", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    const originalUserDelete = (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete;
+    (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete = async (ctx: { userId: string; tenantId: string; db: unknown }, strategy: string) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    try {
+      const result = await runForgetCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        now: NOW(),
+      });
+
+      // No hard failure: user flipped, no errors entry.
+      expect(result.processedUserIds).toContain(ALICE_ID);
+      expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(false);
+
+      // But collected in the incomplete set with reason + tenant + entity.
+      const aliceIncomplete = result.incomplete.find((i) => i.userId === ALICE_ID);
+      expect(aliceIncomplete?.reason).toBe("synthetic partial cleanup for alice");
+      expect(aliceIncomplete?.tenantId).toBe(TENANT_A);
+      expect(aliceIncomplete?.entityName).toBe("user");
+
+      // Status flip proceeded despite the incomplete report.
+      const aliceRow = await fetchUser(ALICE_ID);
+      expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+    } finally {
+      (
+        userUsage.options as {
+          delete: (
+            ctx: { userId: string; tenantId: string; db: unknown },
+            strategy: string,
+          ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+        }
+      ).delete = originalUserDelete;
+    }
+  });
 });
 
 // eraseKey never fails in the in-memory adapter, so the rollback test

package/src/user-data-rights/run-forget-cleanup.ts

@@ -133,6 +133,17 @@ export interface ForgetCleanupError {
   readonly message: string;
 }
 
+/** A hook reporting `{status:"incomplete", reason}` — no throw, no
+ *  rollback, the user still gets flipped to Deleted (see Header
+ *  "incomplete is not a hard failure"). Collected for operator
+ *  visibility, NOT in `errors` (those stand for hook throws + rollback). */
+export interface ForgetCleanupIncomplete {
+  readonly userId: string;
+  readonly tenantId: TenantId;
+  readonly entityName: string;
+  readonly reason: string;
+}
+
 export interface RunForgetCleanupResult {
   /** User die in diesem Lauf von DeletionRequested → Deleted geflippt wurden. */
   readonly processedUserIds: readonly string[];
@@ -140,6 +151,8 @@ export interface RunForgetCleanupResult {
   readonly hookCallsAttempted: number;
   /** Hook-Errors fuer Operator-Visibility. Lauf bricht nicht ab — siehe Header. */
   readonly errors: readonly ForgetCleanupError[];
+  /** Hooks that reported `{status:"incomplete"}` — partial success, user still Deleted. */
+  readonly incomplete: readonly ForgetCleanupIncomplete[];
 }
 
 interface HookEntry {
@@ -170,7 +183,7 @@ export async function runForgetCleanup(
   );
 
   if (dueUsers.length === 0) {
-    return { processedUserIds: [], hookCallsAttempted: 0, errors: [] };
+    return { processedUserIds: [], hookCallsAttempted: 0, errors: [], incomplete: [] };
   }
 
   // Step 2: Sammle alle EXT_USER_DATA-Usages einmalig — Liste der
@@ -192,6 +205,7 @@ export async function runForgetCleanup(
     .sort((a, b) => a.order - b.order);
 
   const errors: ForgetCleanupError[] = [];
+  const incomplete: ForgetCleanupIncomplete[] = [];
   const processedUserIds: string[] = [];
   let hookCallsAttempted = 0;
 
@@ -208,6 +222,7 @@ export async function runForgetCleanup(
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
+    incomplete.push(...userResult.incomplete);
     if (userResult.success) {
       processedUserIds.push(user.id);
 
@@ -241,13 +256,14 @@ export async function runForgetCleanup(
     }
   }
 
-  return { processedUserIds, hookCallsAttempted, errors };
+  return { processedUserIds, hookCallsAttempted, errors, incomplete };
 }
 
 interface ProcessUserResult {
   readonly success: boolean;
   readonly hookCallsAttempted: number;
   readonly errors: readonly ForgetCleanupError[];
+  readonly incomplete: readonly ForgetCleanupIncomplete[];
   /** Atom 5b: userEmail VOR Tx gecacht (user-Hook anonymisiert in Tx).
    *  null wenn user-Row beim Pre-Tx-Lookup nicht (mehr) existiert oder
    *  email leer ist. */
@@ -269,6 +285,7 @@ async function processUser(args: {
 }): Promise<ProcessUserResult> {
   const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
+  const incomplete: ForgetCleanupIncomplete[] = [];
   let hookCallsAttempted = 0;
 
   // Atom 5b — userEmail VOR der Tx cachen. user-Hook (user-data-rights-
@@ -333,7 +350,7 @@ async function processUser(args: {
           const strategy = policyToStrategy(policy.policy?.strategy ?? null);
 
           hookCallsAttempted++;
-          await entry.deleteHook(
+          const hookResult = await entry.deleteHook(
             {
               db: tx,
               registry,
@@ -345,6 +362,21 @@ async function processUser(args: {
             },
             strategy,
           );
+          // "incomplete" is not a hard failure (see Header): no throw,
+          // no rollback, eraseKey + status flip proceed unchanged.
+          // Only collected + logged for operator visibility.
+          if (hookResult?.status === "incomplete") {
+            incomplete.push({
+              userId,
+              tenantId,
+              entityName: entry.entityName,
+              reason: hookResult.reason,
+            });
+            // biome-ignore lint/suspicious/noConsole: operator-visibility for partial hook completion
+            console.warn(
+              `[user-data-rights:run-forget-cleanup] hook incomplete userId=${userId} tenantId=${tenantId} entityName=${entry.entityName} reason=${hookResult.reason}`,
+            );
+          }
         }
       }
 
@@ -399,6 +431,10 @@ async function processUser(args: {
     success: txSucceeded,
     hookCallsAttempted,
     errors,
+    // Only surfaced on a committed sub-tx — a later throw in the same
+    // user's loop rolls this back too, so a rolled-back "incomplete"
+    // report would misreport a non-deleted user as partially cleaned up.
+    incomplete: txSucceeded ? incomplete : [],
     userEmailBeforeDelete,
     userLocaleBeforeDelete,
     tenantIdsBeforeDelete,