@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -0,0 +1,115 @@
+// Verifies the core promise: set a tenant's tenant-settings:config:currency
+// to CHF, and a new entity without an explicit currency inherits CHF instead
+// of a hard-coded EUR literal.
+
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import {
+  configValuesTable,
+  createConfigAccessorFactory,
+  createConfigFeature,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createEntity,
+  createMoneyField,
+  createSelectField,
+  createTextField,
+  defineFeature,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  pushEntityProjectionTables,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTenantSettingsFeature } from "../feature";
+import { defineCreateWithTenantDefaults } from "../tenant-defaults";
+
+const invoiceEntity = createEntity({
+  table: "read_invoices",
+  fields: {
+    title: createTextField({ required: true }),
+    amount: createMoneyField({ required: true }),
+    language: createSelectField({ options: ["en", "de"] as const }),
+  },
+});
+
+const ACCESS = { roles: ["Admin"] } as const;
+
+const invoiceFeature = defineFeature("invoice", (r) => {
+  r.entity("invoice", invoiceEntity);
+  r.writeHandler(
+    defineCreateWithTenantDefaults("invoice", invoiceEntity, {
+      access: ACCESS,
+      currencyFields: ["amount"],
+      localeField: "language",
+    }),
+  );
+});
+
+const tenantId = testTenantId(1);
+const admin: SessionUser = { id: "admin-1", tenantId, roles: ["Admin"] };
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createTenantSettingsFeature(), invoiceFeature],
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await unsafeCreateEntityTable(stack.db, invoiceEntity);
+  await createEventsTable(stack.db);
+  await pushEntityProjectionTables(stack, stack.registry);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+test("ohne Tenant-Override übernimmt eine neue Entity den Feature-Default (EUR/en)", async () => {
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string }; language: string };
+  }>("invoice:write:invoice:create", { title: "Rechnung 1", amount: { amount: 1000 } }, admin);
+  expect(invoice.data.amount).toEqual({ amount: 1000, currency: "EUR" });
+  expect(invoice.data.language).toBe("en");
+});
+
+test("Tenant setzt CHF/de — neue Entity ohne explizite Werte übernimmt die Tenant-Config, nicht das Feature-Default", async () => {
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: "tenant-settings:config:currency", value: "CHF" },
+    admin,
+  );
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: "tenant-settings:config:locale", value: "de" },
+    admin,
+  );
+
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string }; language: string };
+  }>("invoice:write:invoice:create", { title: "Rechnung 2", amount: { amount: 2000 } }, admin);
+
+  expect(invoice.data.amount).toEqual({ amount: 2000, currency: "CHF" });
+  expect(invoice.data.language).toBe("de");
+});
+
+test("expliziter Wert im Payload gewinnt gegen die Tenant-Config", async () => {
+  const invoice = await stack.http.writeOk<{
+    data: { amount: { amount: number; currency: string } };
+  }>(
+    "invoice:write:invoice:create",
+    { title: "Rechnung 3", amount: { amount: 3000, currency: "USD" } },
+    admin,
+  );
+  expect(invoice.data.amount).toEqual({ amount: 3000, currency: "USD" });
+});

package/src/tenant-settings/config.ts

@@ -0,0 +1,44 @@
+import {
+  access,
+  type ConfigKeyDefinition,
+  createTenantConfig,
+  DEFAULT_CURRENCIES,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// ISO-639-1, optional ISO-3166-1 region ("de" or "de-DE") — apps constrain
+// further via their own i18n setup; this only guards against garbage input.
+const LOCALE_PATTERN = { regex: "^[a-z]{2}(-[A-Z]{2})?$" } as const;
+
+export type TenantSettingsKeyOptions = {
+  /** Selectable currencies. Default: DEFAULT_CURRENCIES (engine). */
+  readonly currencies?: readonly string[];
+  /** Fallback when a tenant never set the key. Default: "EUR". */
+  readonly defaultCurrency?: string;
+  /** Fallback when a tenant never set the key. Default: "en". */
+  readonly defaultLocale?: string;
+  /** Who may change the tenant's settings. Default: access.admin. */
+  readonly write?: readonly string[];
+};
+
+export function buildTenantSettingsKeys(
+  opts: TenantSettingsKeyOptions = {},
+): Record<string, ConfigKeyDefinition> {
+  const write = opts.write ?? access.admin;
+  return {
+    // `mask` surfaces the key in the self-populating Settings-Hub (Tenant-
+    // Audience) without a hand-written r.screen/r.nav — see
+    // samples/recipes/managed-config for the mechanism.
+    currency: createTenantConfig("select", {
+      default: opts.defaultCurrency ?? "EUR",
+      options: opts.currencies ?? DEFAULT_CURRENCIES,
+      write,
+      mask: { title: "tenant-settings.currency", icon: "coins", order: 1 },
+    }),
+    locale: createTenantConfig("text", {
+      default: opts.defaultLocale ?? "en",
+      pattern: LOCALE_PATTERN,
+      write,
+      mask: { title: "tenant-settings.locale", icon: "languages", order: 2 },
+    }),
+  } satisfies Record<string, ConfigKeyDefinition>;
+}

package/src/tenant-settings/constants.ts

@@ -0,0 +1,16 @@
+// tenant-settings bundle constants — feature-name + qualified config names.
+//
+// Motivation (solon#P19): apps kept hard-coding a single currency/locale
+// literal per money/select field ("EUR", "de") instead of one per-tenant
+// setting — expensive to retrofit once a second tenant needs a different
+// default. This bundle is the one place that setting lives.
+
+export const TENANT_SETTINGS_FEATURE_NAME = "tenant-settings";
+
+// Qualified config key names (QN format: scope:config:name) for
+// ctx.config(...) reads. Clients reference the object instead of magic
+// strings (mirror tags' Handlers/Queries constants).
+export const TenantSettingsConfig = {
+  currency: "tenant-settings:config:currency",
+  locale: "tenant-settings:config:locale",
+} as const;

package/src/tenant-settings/feature.ts

@@ -0,0 +1,49 @@
+// tenant-settings — per-tenant Currency + Locale defaults.
+//
+// Any handler that needs a default (money-field currency, a locale-select
+// field, ...) reads it via `ctx.config(TenantSettingsConfig.currency)` /
+// `ctx.config(TenantSettingsConfig.locale)` — or use
+// `defineCreateWithTenantDefaults` (tenant-defaults.ts) to wire it into an
+// entity's create-handler without writing that plumbing by hand.
+//
+// No entities, no hand-written screen — `mask` on both keys makes them
+// surface in the self-populating Settings-Hub (Tenant-Audience) instead;
+// `buildConfigFeatureSchema` (config feature) derives the configEdit
+// screen + nav entry from the key's scope/type/mask, same mechanism as
+// samples/recipes/managed-config.
+
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+import { TENANT_SETTINGS_FEATURE_NAME } from "./constants";
+
+export type TenantSettingsFeatureOptions = TenantSettingsKeyOptions;
+
+export function createTenantSettingsFeature(
+  opts: TenantSettingsFeatureOptions = {},
+): FeatureDefinition {
+  return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
+    r.requires("config");
+    r.describe(
+      "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+    );
+    r.config({ keys: buildTenantSettingsKeys(opts) });
+    r.translations({
+      keys: {
+        "tenant-settings.currency": { de: "Standard-Währung", en: "Default Currency" },
+        "tenant-settings.locale": { de: "Standard-Sprache", en: "Default Locale" },
+        // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
+        // required by the i18n boot-validator whenever a feature masks config keys.
+        "screen:tenant-settings-system.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+        "screen:tenant-settings-tenant.title": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+        },
+      },
+    });
+  });
+}
+
+export const tenantSettingsFeature: FeatureDefinition = createTenantSettingsFeature();

package/src/tenant-settings/index.ts

@@ -0,0 +1,8 @@
+export { buildTenantSettingsKeys, type TenantSettingsKeyOptions } from "./config";
+export { TENANT_SETTINGS_FEATURE_NAME, TenantSettingsConfig } from "./constants";
+export {
+  createTenantSettingsFeature,
+  type TenantSettingsFeatureOptions,
+  tenantSettingsFeature,
+} from "./feature";
+export { defineCreateWithTenantDefaults } from "./tenant-defaults";

package/src/tenant-settings/tenant-defaults.ts

@@ -0,0 +1,67 @@
+// Wrapper around defineEntityCreateHandler: fills currency/locale fields from
+// tenant-settings config when the caller omits them — instead of repeating
+// field literals ("EUR"/"de") on every entity.
+//
+// buildInsertSchema always requires `currency` inside a money field (even when
+// the field itself is optional), so the caller cannot simply omit currency
+// without failing schema validation before the handler runs. This helper uses
+// a schema extension that makes those sub-keys optional, instead of the
+// generic defineEntityCreateHandler.
+
+import {
+  type AccessRule,
+  buildInsertSchema,
+  createEntityExecutor,
+  type EntityDefinition,
+  type WriteHandlerDef,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { TenantSettingsConfig } from "./constants";
+
+const OPTIONAL_CURRENCY_MONEY = z.object({ amount: z.number(), currency: z.string().optional() });
+
+export function defineCreateWithTenantDefaults(
+  entityName: string,
+  entity: EntityDefinition,
+  options: {
+    readonly access?: AccessRule;
+    /** Money field names whose `currency` is filled from tenant-settings when missing. */
+    readonly currencyFields?: readonly string[];
+    /** Field name (select/text) that receives the tenant locale when missing. */
+    readonly localeField?: string;
+  },
+): WriteHandlerDef {
+  const { executor } = createEntityExecutor(entityName, entity);
+  const relax: Record<string, z.ZodTypeAny> = {};
+  for (const field of options.currencyFields ?? []) {
+    const def = entity.fields[field];
+    if (!def) throw new Error(`defineCreateWithTenantDefaults: unknown field "${field}"`);
+    const isRequired = "required" in def && def.required === true;
+    relax[field] = isRequired ? OPTIONAL_CURRENCY_MONEY : OPTIONAL_CURRENCY_MONEY.optional();
+  }
+  const baseSchema = buildInsertSchema(entity);
+  const schema = Object.keys(relax).length > 0 ? baseSchema.extend(relax) : baseSchema;
+
+  return {
+    name: `${entityName}:create`,
+    schema,
+    ...(options.access && { access: options.access }),
+    handler: async (event, ctx) => {
+      const payload = { ...(event.payload as Record<string, unknown>) };
+
+      for (const field of options.currencyFields ?? []) {
+        const value = payload[field] as { amount?: number; currency?: string } | undefined;
+        if (value && typeof value === "object" && !value.currency) {
+          const currency = await ctx.config?.(TenantSettingsConfig.currency);
+          if (typeof currency === "string") payload[field] = { ...value, currency };
+        }
+      }
+      if (options.localeField && !payload[options.localeField]) {
+        const locale = await ctx.config?.(TenantSettingsConfig.locale);
+        if (typeof locale === "string") payload[options.localeField] = locale;
+      }
+
+      return executor.create(payload, event.user, ctx.db);
+    },
+  };
+}

package/src/user/handlers/find-for-auth.query.ts

@@ -28,7 +28,7 @@ export const findForAuthQuery = defineQueryHandler({
     ),
   access: { roles: access.system },
   handler: async (query, ctx) => {
-    const where =
+    const where: { email: string } | { id: string } =
       query.payload.email !== undefined
         ? { email: query.payload.email }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload

package/src/user/seeding.ts

@@ -18,6 +18,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+// kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
+import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding";
 import { userEntity, userTable } from "./schema/user";
 
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -52,6 +54,11 @@ export type SeedUserOptions = {
 export async function seedUser(
   db: DbConnection,
   options: SeedUserOptions,
+  // Optional, append-only — same rationale as tenant/seeding's seedTenant
+  // hooks param (#1478): fires user's postSave hooks (e.g. a Welcome-
+  // notification hook keyed off `allOf: "user"`) for fixtures/self-signup
+  // that opt in. Omit to keep today's hook-less behavior.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   const by = options.by ?? TestUsers.systemAdmin;
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
@@ -81,6 +88,7 @@ export async function seedUser(
       `seedUser failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+  await fireEntityPostSave(hooks, "user:seed", result.data);
   return { id: extractId(result.data, "seedUser") };
 }
 

package/src/user-data-rights/COMPLIANCE.md

@@ -20,7 +20,7 @@ Dieses Dokument bündelt die **technischen Fakten** zur DSGVO-Pipeline
 |---------|-------------------|--------------|--------------|
 | **Art. 15 (Auskunft, light)** | `user-data-rights:query:my-audit-log` | User | Liest eigene Framework-Events aus `kumiko_events` (account-weit über alle Memberships). Filterbar nach `eventType`, `aggregateType`, `from`/`to`. Domain-Entities ohne `ctx.appendEvent` erscheinen NICHT — die kommen im Export-Bundle (Art. 20). |
 | **Art. 15 + 20 (Auskunft + Portabilität)** | `user-data-rights:write:request-export` | User | Async Job → ZIP mit user-Profil + fileRefs + alle EXT_USER_DATA-Provider-Daten (cross-tenant) + signed Magic-Link per Email. Idempotent: nur 1 active Job pro User (`ACTIVE_JOB_CONSTRAINT`). |
-| **Art. 15 + 20** | `GET /user-export/by-token?token=…` | Anonym (Magic-Link-Pfad) | Token-Hash-Lookup → 302-Redirect auf signed Storage-URL. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
+| **Art. 15 + 20** | `GET /user-export/by-token` (interstitial) + `POST /user-export/by-token` (exchange) | Anonym (Magic-Link-Pfad) | Email-Link trägt den Token als URL-Fragment (`#token=`, nie an den Server gesendet, issue #1271); Interstitial-Script liest das Fragment client-seitig und tauscht es per POST-Body gegen die signed Storage-URL. Kein `?token=`-Query-Fallback (#1512) — Query-Param landet unveränderlich in Proxy-/Access-Logs. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
 | **Art. 15 + 20** | `GET /user-export/by-job/:jobId` | User (Session-Auth) | UI-Klick-Pfad. Cross-tenant-same-user: User in Tenant B kann Job aus Tenant A laden wenn er der Owner ist. |
 | **Art. 17 (Löschung)** | `user-data-rights:write:request-deletion` | User | Soft-Delete: `status=DeletionRequested` + `gracePeriodEnd = now + profile.gracePeriod`. Cron `run-forget-cleanup` führt nach Grace die Anonymisierung durch. |
 | **Art. 17** | `user-data-rights:write:cancel-deletion` | User | Während Grace: status zurück auf `Active`. |

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -22,6 +22,8 @@ import { createSessionsFeature } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
+import { listDownloadAttemptsQuery } from "../handlers/list-download-attempts.query";
+import { myAuditLogQuery } from "../handlers/my-audit-log.query";
 import { downloadAttemptEntity, downloadAttemptsTable } from "../schema/download-attempt";
 
 const MY_AUDIT = "user-data-rights:query:my-audit-log";
@@ -158,6 +160,69 @@ describe("my-audit-log", () => {
   });
 });
 
+describe("my-audit-log — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without deleting globalThis.Temporal for handler-internal state", async () => {
+    // Seed with Temporal intact — only the handler call runs ambient-free,
+    // mirroring the audit feature's #1525 regression test (going through
+    // full HTTP dispatch would also break buildHandlerContext's unrelated
+    // ctx.tz setup, which isn't what this pins down).
+    await seedEvent(alice.id, tenantA, "user.x", { from: "range-test" });
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await myAuditLogQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: alice,
+        } as Parameters<typeof myAuditLogQuery.handler>[0],
+        { db: { raw: stack.db } } as unknown as Parameters<typeof myAuditLogQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
+describe("list-download-attempts — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without relying on globalThis.Temporal", async () => {
+    const T = await import("@cosmicdrift/kumiko-framework/time");
+    const now = T.getTemporal().Now.instant();
+    await seedRows(stack.db, downloadAttemptsTable, [
+      {
+        id: "33333333-3333-4333-8333-333333333333",
+        tenantId: tenantA,
+        result: "notFound",
+        via: "token",
+        tokenHash: "abc",
+        jobId: null,
+        attemptedByUserId: null,
+        ip: "1.2.3.4",
+        userAgent: "test",
+        attemptedAt: now,
+      },
+    ]);
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await listDownloadAttemptsQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: admin,
+        } as Parameters<typeof listDownloadAttemptsQuery.handler>[0],
+        { db: stack.db } as unknown as Parameters<typeof listDownloadAttemptsQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 describe("download-attempt retention :: disk-bomb-Schutz bei Brute-Force", () => {
   test("Entity-Default ist 90d hardDelete (kein unbounded growth)", () => {
     expect(downloadAttemptEntity.retention).toBeDefined();

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -10,13 +10,22 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
 import { z } from "zod";
-import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createSessionsFeature } from "../../sessions/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle/feature";
+
+function projectionProbeTable(name: string): SchemaTable {
+  return table(name, {
+    id: uuid("id").primaryKey(),
+    count: integer("count").notNull().default(0),
+  }) as unknown as SchemaTable; // @cast-boundary test-fixture — minimal probe shape, real schema-table irrelevant here
+}
+
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -30,18 +39,13 @@ import { createUserDataRightsFeature } from "../feature";
 // Unlike the old direct-function tests, these only run inside a real
 // validateBoot() pass — exercising the actual `r.bootCheck()` plumbing, not
 // just the guard logic.
-// Stub instead of the real auth-foundation — these boot-checks are about
-// GDPR-storage guards, not auth; only sessions' sessionStore registration
-// needs an owner present.
-const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
-  r.extendsRegistrar(EXT_SESSION_STORE, {});
-});
-
 function baseFeatures() {
   return [
     createConfigFeature(),
     createUserFeature(),
-    sessionStoreOwnerStub,
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
@@ -84,10 +88,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   });
 
   test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
-    const projectionTable = table("crm_contact_summary", {
-      id: uuid("id").primaryKey(),
-      count: integer("count").notNull().default(0),
-    }) as unknown as SchemaTable;
+    const projectionTable = projectionProbeTable("crm_contact_summary");
     const bad = defineFeature("crm", (r) => {
       const contactCreated = r.defineEvent("contact-created", z.unknown());
       r.projection({
@@ -102,10 +103,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   });
 
   test("V3: projection-only pii entity WITH EXT_USER_DATA hook registered for its entity name → no throw", () => {
-    const projectionTable = table("crm_contact_summary_hooked", {
-      id: uuid("id").primaryKey(),
-      count: integer("count").notNull().default(0),
-    }) as unknown as SchemaTable;
+    const projectionTable = projectionProbeTable("crm_contact_summary_hooked");
     const hooked = defineFeature("crm-hooked", (r) => {
       r.requires("user-data-rights");
       const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -155,11 +155,15 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     }
 
     const res = await stack.app.fetch(
-      new Request(`http://test/user-export/by-token?token=${plainToken}`, { method: "GET" }),
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: plainToken }),
+      }),
     );
-    expect(res.status).toBe(302);
-    const location = res.headers.get("location");
-    expect(location).toMatch(/^memory:\/\//);
-    expect(location).toContain(`${jobTenant}/exports/${jobId}.zip`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data?: { url?: string } };
+    expect(body.data?.url).toMatch(/^memory:\/\//);
+    expect(body.data?.url).toContain(`${jobTenant}/exports/${jobId}.zip`);
   });
 });

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -437,8 +437,8 @@ describe("download-by-job :: happy path", () => {
 });
 
 describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
-  test("happy: 302-Redirect mit Location-Header zur signed-URL", async () => {
-    const { plainToken } = await seedDoneJobWithToken();
+  test("`?token=` in query is ignored — serves interstitial HTML instead of resolving it (no access-log leak)", async () => {
+    const { jobId, plainToken } = await seedDoneJobWithToken();
 
     const res = await stack.app.fetch(
       new Request(`http://test/user-export/by-token?token=${plainToken}`, {
@@ -449,21 +449,15 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
         },
       }),
     );
-    expect(res.status).toBe(302);
-    const location = res.headers.get("location");
-    expect(location).toBeTruthy();
-    expect(location).toMatch(/^memory:\/\//);
-  });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/html");
+    const body = await res.text();
+    expect(body).toContain("/user-export/by-token.js");
 
-  test("invalid token → 404 passthrough mit i18nKey", async () => {
-    const res = await stack.app.fetch(
-      new Request("http://test/user-export/by-token?token=fake-xxxxx", {
-        method: "GET",
-      }),
-    );
-    expect(res.status).toBe(404);
-    const body = (await res.json()) as { error?: { i18nKey?: string } };
-    expect(body.error?.i18nKey).toBe("userDataRights.errors.download.notFound");
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
+      useCount: number;
+    }>;
+    expect(row?.useCount).toBe(0);
   });
 
   test("no query token (fragment-Pfad) → serviert Interstitial-HTML statt 400", async () => {
@@ -487,29 +481,6 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     expect(body).toContain("/user-export/by-token");
   });
 
-  test("Audit-Update: useCount + IP/UA aus httpRoute-Headers (nicht aus payload)", async () => {
-    const { jobId, plainToken } = await seedDoneJobWithToken();
-    await stack.app.fetch(
-      new Request(`http://test/user-export/by-token?token=${plainToken}`, {
-        method: "GET",
-        headers: {
-          "user-agent": "e2e-test/2.0",
-          "x-forwarded-for": "198.51.100.7, 10.0.0.1",
-        },
-      }),
-    );
-
-    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
-      useCount: number;
-      lastUsedFromIp: string | null;
-      lastUsedUserAgent: string | null;
-    }>;
-    expect(row?.useCount).toBe(1);
-    // X-Forwarded-For: erster Wert, comma-trimmed
-    expect(row?.lastUsedFromIp).toBe("198.51.100.7");
-    expect(row?.lastUsedUserAgent).toBe("e2e-test/2.0");
-  });
-
   test("POST-Exchange (Fragment-Pfad): happy-path + IP/UA-Audit aus httpRoute-Headers", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
 
@@ -569,8 +540,8 @@ describe("download-by-job :: cross-user + cross-tenant", () => {
   });
 
   test("provider ohne getSignedUrl → 422 unprocessable signedUrlNotSupported (job-Pfad)", async () => {
-    // Symmetrisch zum token-Pfad: derselbe Operator-Konfig-Bug muss auch
-    // beim UI-Klick-Pfad als 422 raus, nicht 404.
+    // Same as the token path: the operator misconfig must also surface as
+    // 422 on the UI click path, not 404.
     const { jobId } = await seedDoneJobWithToken();
     await stack.http.writeOk(
       ConfigHandlers.set,

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,11 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { access, defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
-import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createSessionsFeature } from "../../sessions/feature";
+import { createTenantFeature } from "../../tenant/feature";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -18,13 +20,6 @@ import { createUserDataRightsFeature } from "../feature";
 // entities (export-job, download-attempt) are r.entity, not direct-write stores,
 // so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
 
-// Stub instead of the real auth-foundation — this test is about screen
-// wiring, not auth; only sessions' sessionStore registration needs an owner
-// present.
-const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
-  r.extendsRegistrar(EXT_SESSION_STORE, {});
-});
-
 describe("user-data-rights read-only inspector screens", () => {
   // A realistic assembly: mounting user-data-rights without its default hooks
   // now fails the V3 boot gate (the framework `user` entity holds PII with no
@@ -33,7 +28,9 @@ describe("user-data-rights read-only inspector screens", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
-    sessionStoreOwnerStub,
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),