@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -123,7 +123,21 @@ describe("C6 default mail bridge :: forget cron sends deletion-executed without
     expect(job).toBeDefined();
 
     // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
-    const jobCtx = { db: stack.db, registry: stack.registry, configResolver };
+    // log required since #1572 persists incomplete[] via ctx.log.warn.
+    const jobCtx = {
+      db: stack.db,
+      registry: stack.registry,
+      configResolver,
+      log: {
+        info() {},
+        warn() {},
+        error() {},
+        debug() {},
+        child() {
+          return this;
+        },
+      },
+    };
     await job?.handler({}, jobCtx as never);
 
     // Loeschung lief autonom durch.

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -45,6 +45,10 @@ import { createSessionsFeature } from "../../sessions";
 import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
+import {
+  SESSION_REVOKED_EVENT_QN,
+  type SessionRevokedPayload,
+} from "../../sessions/session-revoked-event";
 import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
@@ -211,6 +215,36 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(userRow[0]?.status).toBe(USER_STATUS.Active);
   });
 
+  // kumiko-framework#1545: mirrors the lift-restriction cross-tenant guard
+  // below — an isAdminActor check alone lets an Admin/TenantAdmin from a
+  // DIFFERENT tenant restrict (and force-revoke the sessions of) a user
+  // who was never a member of the admin's tenant.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(RESTRICT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Restricted);
+  });
+
   test("Restricted → Restricted (Idempotenz-Guard): 422 already_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
     // Alice's own session is blocked while Restricted — an admin targets
@@ -227,6 +261,51 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
     expect(reasonOf(err)).toBe("user_not_in_active_state");
   });
+
+  // kumiko-framework#1540: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the isAdminActor gate and flip the target's
+  // status. Mirrors the sibling lift-restriction fix (kumiko-framework#1342).
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator) + revoked Sessions", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const loginRes = await login(ALICE_EMAIL, ALICE_PW);
+    expect(loginRes.status).toBe(200);
+
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ userId: string; status: string }>(
+      RESTRICT,
+      { userId: targetId },
+      systemAdmin,
+    );
+    expect(result.status).toBe(USER_STATUS.Restricted);
+
+    const sessionsAfter = (await selectMany(stack.db, userSessionTable, {
+      userId: targetId,
+    })) as Array<{ revokedAt: unknown }>;
+    expect(sessionsAfter.length).toBeGreaterThanOrEqual(1);
+    expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
+  });
 });
 
 describe("S2.U6 :: lift-restriction state-transitions", () => {
@@ -258,6 +337,37 @@ describe("S2.U6 :: lift-restriction state-transitions", () => {
     const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
+
+  // kumiko-framework#1342: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the access-gate and flip the target's status.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Restricted", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(LIFT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Restricted);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend liften (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Active);
+  });
 });
 
 describe("S2.U6 :: Login-Block fuer Restricted/DeletionRequested/Deleted", () => {
@@ -337,5 +447,15 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
       revokedAt: unknown;
     }>;
     expect(revoked.every((s) => s.revokedAt !== null)).toBe(true);
+
+    // #1559 — cross-tenant privileged revoke uses the low-level append(),
+    // not ctx.unsafeAppendEvent (see revoke-all-for-user.write.ts for why:
+    // the SystemAdmin caller's own tenantId has no relationship to the
+    // target user's session tenant). One event, both sids listed.
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1);
+    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    expect(payload.userId).toBe(userId);
+    expect(new Set(payload.sessionIds)).toEqual(new Set(liveBefore.map((s) => s.id)));
   });
 });

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -12,7 +12,7 @@
 //      downloadStorageKey wird genullt + storage-key geloescht
 //   6. Idempotency: 2× run → kein Re-Processing von done/failed-Jobs
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -818,7 +818,10 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     const calls: string[] = [];
     // Should not throw despite job A's callback throwing — the try/catch
     // around fireExportFailedCallback swallows it (operator-visibility
-    // via console.warn only) and the loop continues to job B.
+    // via console.warn only) and the loop continues to job B. A regress to
+    // a fully silent swallow (no log call at all) would still pass every
+    // assertion below unless the warn itself is pinned.
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     const result = await runExportJobs({
       db: stack.db,
       registry: stack.registry,
@@ -833,6 +836,8 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     });
     expect(result.failedJobIds).toEqual(expect.arrayContaining([jobAId, jobBId]));
     expect(calls.sort()).toEqual([jobAId, jobBId].sort());
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
   });
 
   test("failed-Job, user ohne email → sendExportFailedEmail skipped (kein Throw)", async () => {
@@ -840,7 +845,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
-      email: "" as string,
+      email: "", // empty string — lookupUserEmail returns null
       passwordHash: "hashed",
       displayName: "Alice",
       locale: "de",
@@ -1270,7 +1275,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
-      email: "" as string, // empty string — lookupUserEmail returnt null
+      email: "" as string, // empty string — lookupUserEmail returns null
       passwordHash: "h",
       displayName: "Alice",
       locale: "de",

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -282,6 +282,22 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
   // getJob undefined und die Loeschung laeuft nach Grace-Ablauf NIE. Wir
   // treiben den ECHTEN registrierten Job durch den echten JobContext (db +
   // registry, kein config) — nicht den inneren runForgetCleanup-Helper.
+  function capturingJobLog() {
+    const warns: string[] = [];
+    const log: JobContext["log"] = {
+      info() {},
+      warn(message: string) {
+        warns.push(message);
+      },
+      error() {},
+      debug() {},
+      child(): JobContext["log"] {
+        return this;
+      },
+    };
+    return { log, warns };
+  }
+
   test("registered job exists + erases through the real JobContext", async () => {
     const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
     expect(job).toBeTruthy();
@@ -295,10 +311,8 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     });
     await seedMembership(CRON_USER, TENANT_A);
 
-    const jobCtx = { db: stack.db, registry: stack.registry };
-    // jobCtx is a deliberately minimal prod-context replica (missing
-    // systemUser/log/triggeredBy) — double-cast at this test boundary since
-    // the handler under test never touches those fields.
+    const { log } = capturingJobLog();
+    const jobCtx = { db: stack.db, registry: stack.registry, log };
     await job?.handler({}, jobCtx as unknown as JobContext);
 
     const row = await fetchUser(CRON_USER);
@@ -306,6 +320,52 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     expect(row?.email).not.toContain("cron-delete@example.com");
     expect(row?.email).toContain("anonymized.invalid");
   });
+
+  test("incomplete hooks are written to ctx.log (job-run audit trail, #1572)", async () => {
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeTruthy();
+
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    type DeleteHook = (
+      ctx: { userId: string; tenantId: string; db: unknown },
+      strategy: string,
+    ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+    const originalUserDelete = (userUsage.options as { delete: DeleteHook }).delete;
+    (userUsage.options as { delete: DeleteHook }).delete = async (ctx, strategy) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    const { log, warns } = capturingJobLog();
+    try {
+      await job?.handler({}, {
+        db: stack.db,
+        registry: stack.registry,
+        log,
+      } as unknown as JobContext);
+    } finally {
+      (userUsage.options as { delete: DeleteHook }).delete = originalUserDelete;
+    }
+
+    const hit = warns.find((w) => w.includes("incomplete hook") && w.includes(ALICE_ID));
+    expect(hit).toBeDefined();
+    expect(hit).toContain("entityName=user");
+    expect(hit).toContain("rolledBack=false");
+    expect(hit).toContain("reason=synthetic partial cleanup for alice");
+
+    const aliceRow = await fetchUser(ALICE_ID);
+    expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+  });
 });
 
 describe("runForgetCleanup :: time-window guards", () => {
@@ -798,6 +858,7 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
       expect(aliceIncomplete?.reason).toBe("synthetic partial cleanup for alice");
       expect(aliceIncomplete?.tenantId).toBe(TENANT_A);
       expect(aliceIncomplete?.entityName).toBe("user");
+      expect(aliceIncomplete?.rolledBack).toBe(false);
 
       // Status flip proceeded despite the incomplete report.
       const aliceRow = await fetchUser(ALICE_ID);
@@ -814,7 +875,7 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
     }
   });
 
-  test("hook incomplete on one tenant, then throws on a later tenant → the incomplete report is discarded by the rollback", async () => {
+  test("hook incomplete on one tenant, then throws on a later tenant → the incomplete report survives, flagged rolledBack (#1489)", async () => {
     await seedUser(ALICE_ID, {
       status: USER_STATUS.DeletionRequested,
       gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
@@ -857,9 +918,14 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
         now: NOW(),
       });
 
-      // The whole per-user sub-tx rolled back — no incomplete entry from
-      // tenant A survives, and the failure surfaces as a hard error instead.
-      expect(result.incomplete.some((i) => i.userId === ALICE_ID)).toBe(false);
+      // The whole per-user sub-tx rolled back — the DB rows (including the
+      // status flip) are undone, and the failure surfaces as a hard error
+      // too. But tenant A's "incomplete" report describes an external,
+      // non-transactional side effect (already ran, not rolled back by a
+      // DB rollback) — it must still reach the operator, just marked
+      // rolledBack so they know the user itself is still DeletionRequested.
+      const aliceIncomplete = result.incomplete.find((i) => i.userId === ALICE_ID);
+      expect(aliceIncomplete?.rolledBack).toBe(true);
       expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(true);
       expect(result.processedUserIds).not.toContain(ALICE_ID);
 

package/src/user-data-rights/db/queries/__tests__/forget-cleanup.integration.test.ts

@@ -0,0 +1,69 @@
+// kumiko-framework#1525: selectUsersDueForForgetCleanup must not rely on
+// globalThis.Temporal when the caller passes a string cutoff (the
+// run-forget-cleanup.integration.test.ts suite exercises the full
+// pipeline; this is the narrow seam for the ambient-global regression).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../../../user";
+import { selectUsersDueForForgetCleanup } from "../forget-cleanup";
+
+let stack: TestStack;
+
+const TENANT = "00000000-0000-4000-8000-00000000000a";
+const USER_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000001";
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createUserFeature()] });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable]);
+});
+
+describe("selectUsersDueForForgetCleanup — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("string cutoff resolves without relying on globalThis.Temporal", async () => {
+    const pastGracePeriodEnd = getTemporal().Now.instant().subtract({ hours: 1 });
+    await seedRow(stack.db, userTable, {
+      id: USER_ID,
+      tenantId: TENANT,
+      email: "due@example.com",
+      passwordHash: "hashed",
+      displayName: "Due User",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: pastGracePeriodEnd,
+    });
+
+    // Computed with Temporal intact — only the query call itself runs
+    // ambient-free below.
+    const cutoffIso = getTemporal().Now.instant().toString();
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const due = await selectUsersDueForForgetCleanup(
+        stack.db,
+        USER_STATUS.DeletionRequested,
+        cutoffIso,
+      );
+      expect(due.map((u) => u.id)).toContain(USER_ID);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});

package/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,15 +1,22 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+// Value-only import, aliased to avoid shadowing the ambient global
+// `Temporal` TYPE that gracePeriodEndCutoff's parameter type resolves
+// against (same #1438 dual-package-hazard pattern as event-store.ts).
+import { Temporal as TemporalPolyfill } from "temporal-polyfill";
 import { userTable } from "../../../user";
 
 export async function selectUsersDueForForgetCleanup(
   db: DbConnection,
   status: string,
-  gracePeriodEndCutoff: Temporal.Instant | string,
+  gracePeriodEndCutoff: InstanceType<typeof TemporalPolyfill.Instant> | string,
 ): Promise<readonly { id: string }[]> {
+  // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
+  // at runtime, distinct nominal types across the two .d.ts sources (see
+  // event-store.ts). Only ever consumed via the `lte` comparison below.
   const cutoff =
     typeof gracePeriodEndCutoff === "string"
-      ? Temporal.Instant.from(gracePeriodEndCutoff)
+      ? TemporalPolyfill.Instant.from(gracePeriodEndCutoff)
       : gracePeriodEndCutoff;
   return selectMany<{ id: string }>(db, userTable, {
     status,

package/src/user-data-rights/feature.ts

@@ -45,7 +45,11 @@ import {
   type SendExportFailedEmailFn,
   type SendExportReadyEmailFn,
 } from "./run-export-jobs";
-import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "./run-forget-cleanup";
+import {
+  runForgetCleanup,
+  type SendDeletionExecutedEmailFn,
+  sanitizeReasonForLog,
+} from "./run-forget-cleanup";
 import { downloadAttemptEntity } from "./schema/download-attempt";
 import { exportDownloadTokenEntity } from "./schema/download-token";
 import { exportJobEntity } from "./schema/export-job";
@@ -297,9 +301,13 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // external script reads the fragment client-side and exchanges the
     // token via POST for the signed URL.
     //
-    // The old token-in-query format stays supported as a fallback (not a
-    // transitional shim — permanent): emails sent before this deploy still
-    // use the old format and must keep working until their TTL expires.
+    // No `?token=` query fallback: framework is zero-legacy (#1512) — no
+    // live customer data / no pre-#1271 emails in flight that would need
+    // bridging, so there's nothing a fallback would need to cover. A query
+    // param reaches the server as part of the request URL and gets written
+    // to proxy/access logs regardless of what the handler does with it
+    // afterward (a redirect doesn't undo an already-logged request) — the
+    // only leak-proof fix is to never accept the token that way.
     //
     // Path liegt AUSSERHALB /api/* weil r.httpRoute den /api-namespace nicht
     // claimen darf (reserved fuer write/query/batch/auth/sse-dispatcher).
@@ -312,25 +320,10 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       method: "GET",
       path: "/user-export/by-token",
       anonymous: true,
-      handler: async (c, { app }) => {
-        const url = new URL(c.req.url);
-        const token = url.searchParams.get("token");
-        if (!token) {
-          return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
-            "content-type": "text/html; charset=utf-8",
-          });
-        }
-        const queryRes = await app.fetch(
-          new Request(`${url.origin}/api/query`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({
-              type: "user-data-rights:query:download-by-token",
-              payload: { token, auditMeta: extractAuditMeta(c.req.raw.headers) },
-            }),
-          }),
-        );
-        return mapQueryResponseToRedirect(c, queryRes);
+      handler: async (c) => {
+        return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
+          "content-type": "text/html; charset=utf-8",
+        });
       },
     });
 
@@ -374,13 +367,26 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         if (typeof token !== "string" || token.length === 0) {
           return c.json({ error: "missing_token" }, 400);
         }
+        const auditMeta = extractAuditMeta(c.req.raw.headers);
         return app.fetch(
           new Request(`${url.origin}/api/query`, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+              "content-type": "application/json",
+              // download-by-token.query.ts's `rateLimit: { per: "ip", limit: 30 }`
+              // keys off request-id-middleware's own x-forwarded-for read on
+              // THIS internal request — without forwarding it, every fragment-
+              // POST download shares the request's own (empty/localhost) IP,
+              // turning the per-user 30/min backstop into one global bucket
+              // (#1307). Forwarding the same value extractAuditMeta already
+              // computed from the original request's headers doesn't widen the
+              // trust boundary: it's the identical XFF-trusts-first-hop model
+              // request-id-middleware.ts already applies framework-wide.
+              ...(auditMeta.ip ? { "x-forwarded-for": auditMeta.ip } : {}),
+            },
             body: JSON.stringify({
               type: "user-data-rights:query:download-by-token",
-              payload: { token, auditMeta: extractAuditMeta(c.req.raw.headers) },
+              payload: { token, auditMeta },
             }),
           }),
         );
@@ -513,7 +519,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
             ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
             : undefined);
 
-        await runForgetCleanup({
+        const forgetResult = await runForgetCleanup({
           db: forgetDb,
           registry: forgetRegistry,
           now: T.Now.instant(),
@@ -530,30 +536,24 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           }),
           ...(sendDeletionExecutedEmail && { sendDeletionExecutedEmail }),
         });
+
+        // Persist each incomplete report on the job-run log (#1572). The write
+        // handler returns incomplete[] in its response; the cron path used to
+        // discard the array (only a console.warn for rolledBack cases).
+        // ctx.log feeds createJobRunLogger → store_job_run_logs.
+        for (const entry of forgetResult.incomplete) {
+          ctx.log?.warn?.(
+            `[user-data-rights:run-forget-cleanup] incomplete hook ` +
+              `userId=${entry.userId} tenantId=${entry.tenantId} ` +
+              `entityName=${entry.entityName} rolledBack=${entry.rolledBack} ` +
+              `reason=${sanitizeReasonForLog(entry.reason)}`,
+          );
+        }
       },
     );
   });
 }
 
-// Map /api/query-Response auf 302-Redirect oder Error-Passthrough.
-async function mapQueryResponseToRedirect(
-  c: import("hono").Context,
-  queryRes: Response,
-): Promise<Response> {
-  if (!queryRes.ok) {
-    const errorBody = await queryRes.text();
-    const statusCode = queryRes.status as 400 | 401 | 404 | 410 | 500; // @cast-boundary engine-payload
-    return c.body(errorBody, statusCode, {
-      "content-type": queryRes.headers.get("content-type") ?? "application/json",
-    });
-  }
-  const body = (await queryRes.json()) as { data?: { url?: string } }; // @cast-boundary engine-payload
-  if (!body.data?.url) {
-    return c.json({ error: "download_resolution_failed" }, 500);
-  }
-  return c.redirect(body.data.url, 302);
-}
-
 // Extract Audit-Meta (IP + UA) aus den HTTP-Headers + steck es in die
 // query-payload. Der httpRoute-Wrapper ist trusted-source — er hat den
 // raw-request gesehen, nicht der direkter /api/query-Caller. User der

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -2,9 +2,12 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { isWithinGracePeriod } from "../../shared";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
+export { isWithinGracePeriod };
+
 // POST /api/user/cancel-deletion (S2.U5).
 //
 // Innerhalb der Grace-Period kann User seinen Forget-Antrag zurueck-
@@ -24,11 +27,10 @@ export const cancelDeletionWrite = defineWriteHandler({
     // ctx.db.raw (kein TenantDb-Wrapper) weil User-Entity tenant-agnostisch
     // ist — siehe request-deletion.write.ts fuer die Begruendung. Cancel
     // muss aus jedem Tenant-Mode den User finden + zuruecksetzen koennen.
-    const row = await fetchOne<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
-      ctx.db.raw,
-      userTable,
-      { id: event.user.id },
-    );
+    const row = await fetchOne<{
+      status: string;
+      gracePeriodEnd: Temporal.Instant | null;
+    }>(ctx.db.raw, userTable, { id: event.user.id });
 
     if (!row) {
       return writeFailure(
@@ -49,12 +51,7 @@ export const cancelDeletionWrite = defineWriteHandler({
       );
     }
 
-    const gracePeriodEnd = row.gracePeriodEnd;
-    const inGrace =
-      gracePeriodEnd != null &&
-      Temporal.Instant.compare(gracePeriodEnd, Temporal.Now.instant()) > 0;
-
-    if (!inGrace) {
+    if (!isWithinGracePeriod(row.gracePeriodEnd)) {
       return writeFailure(
         new UnprocessableError("grace_period_expired", {
           details: { reason: "grace_period_expired" },