@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -80,7 +80,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (!jobRow || jobRow.userId !== userId) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "notFound",
@@ -98,7 +98,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (jobRow.status !== EXPORT_JOB_STATUS.Done) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "failed",
@@ -115,7 +115,7 @@ export const downloadByJobQuery = defineQueryHandler({
     }
     if (!jobRow.downloadStorageKey) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "expired",
@@ -138,13 +138,13 @@ export const downloadByJobQuery = defineQueryHandler({
       registry: ctx.registry,
       configResolver: ctx.configResolver,
       secrets: ctx.secrets,
-      db: ctx.db.raw,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
       userId: SYSTEM_USER_ID,
       handlerName: "user-data-rights:query:download-by-job",
     })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "signedUrlNotSupported",
@@ -181,7 +181,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (tokenRow) {
       await recordDownloadUse({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tokenId: tokenRow.id,
         tokenVersion: tokenRow.version,
         tokenUseCount: tokenRow.useCount ?? 0,

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -123,7 +123,7 @@ export const downloadByTokenQuery = defineQueryHandler({
       );
       if (jobForAudit) {
         await recordInvalidAttempt({
-          db: ctx.db.raw,
+          db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
           tenantId: jobForAudit.requestedFromTenantId,
           now,
           result: "expired",
@@ -152,7 +152,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     }
     if (jobRow.status !== EXPORT_JOB_STATUS.Done) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "failed",
@@ -169,7 +169,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     }
     if (!jobRow.downloadStorageKey) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "expired",
@@ -192,13 +192,13 @@ export const downloadByTokenQuery = defineQueryHandler({
       registry: ctx.registry,
       configResolver: ctx.configResolver,
       secrets: ctx.secrets,
-      db: ctx.db.raw,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
       userId: SYSTEM_USER_ID,
       handlerName: "user-data-rights:query:download-by-token",
     })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "signedUrlNotSupported",
@@ -229,7 +229,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Wrapper (trusted-source). Direct-API-caller koennen luegen, aber
     // Audit ist nicht security-relevant.
     await recordDownloadUse({
-      db: ctx.db.raw,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
       tokenId: tokenRow.id,
       tokenVersion: tokenRow.version,
       tokenUseCount: tokenRow.useCount ?? 0,

package/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,8 +1,14 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  AccessDeniedError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { tenantMembershipsTable } from "../../tenant";
 import { USER_STATUS, userTable } from "../../user";
+import { isSystemAdminActor } from "../lib/is-admin-actor";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/lift-restriction (S2.U6) — DSGVO Art. 18 Reverse.
@@ -13,6 +19,16 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 // endpoint. There is no self-service path today, so lifting a restriction
 // always targets someone else's account by id.
 //
+// Tenant scope: `access.admin` includes TenantAdmin, which is tenant-
+// scoped even though the User-entity lookup below uses `ctx.db.raw`
+// (bypasses the auto-tenant-filter, same as restrict-account.write.ts —
+// User status is intentionally global, see user-data-rights.md
+// "Cross-Tenant-Semantik"). Without a membership check, a TenantAdmin
+// from tenant A could unrestrict/reactivate a user who has never been a
+// member of tenant A. Only SystemAdmin (platform-wide) skips the check;
+// TenantAdmin/Admin must have an active membership in the target's own
+// tenantId.
+//
 // State-Transitions:
 //   Restricted → Active        ✓
 //   Active → ...               ✗ 422 not_restricted (Idempotenz-Guard)
@@ -20,10 +36,25 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 not_restricted
 export const liftRestrictionWrite = defineWriteHandler({
   name: "lift-restriction",
-  schema: z.object({ userId: z.string() }),
+  schema: z.object({ userId: z.string().uuid() }),
   access: { roles: access.admin },
   handler: async (event, ctx) => {
     const targetUserId = event.payload.userId;
+
+    if (!isSystemAdminActor(event.user)) {
+      const membership = await fetchOne(ctx.db.raw, tenantMembershipsTable, {
+        userId: targetUserId,
+        tenantId: event.user.tenantId,
+      });
+      if (!membership) {
+        return writeFailure(
+          new AccessDeniedError({
+            details: { reason: "target_user_not_in_admin_tenant" },
+          }),
+        );
+      }
+    }
+
     const userRow = await fetchOne<{ status: string }>(ctx.db.raw, userTable, {
       id: targetUserId,
     });

package/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,5 +1,6 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { downloadAttemptsTable } from "../schema/download-attempt";
 

package/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -1,6 +1,7 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -1,12 +1,14 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,
   UnprocessableError,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { tenantMembershipsTable } from "../../tenant";
 import { USER_STATUS, userTable } from "../../user";
+import { isAdminActor, isSystemAdminActor } from "../lib/is-admin-actor";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
 // POST /api/user/restrict (S2.U6) — DSGVO Art. 18 Account-Freeze.
@@ -25,6 +27,16 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 // sessionChecker and they can no longer call this (or any) endpoint
 // themselves; only an operator path reaches it at that point.
 //
+// Tenant scope: `isAdminActor` accepts access.admin, which includes
+// TenantAdmin — tenant-scoped, even though the User-entity lookup below
+// uses `ctx.db.raw` (bypasses the auto-tenant-filter, same as
+// lift-restriction.write.ts — User status is intentionally global, see
+// user-data-rights.md "Cross-Tenant-Semantik"). Without a membership
+// check, a TenantAdmin from tenant A could restrict/unrestrict a user who
+// has never been a member of tenant A. Only SystemAdmin (platform-wide)
+// skips the check; TenantAdmin/Admin must have an active membership in
+// the target's own tenantId.
+//
 // State-Transitions:
 //   Active → Restricted        ✓ (dieser Handler)
 //   Restricted → Restricted    ✗ 422 already_restricted (Idempotenz-Guard)
@@ -32,19 +44,36 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 //   Deleted → ...              ✗ 422 user_not_in_active_state
 export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
-  schema: z.object({ userId: z.string().optional() }),
+  schema: z.object({ userId: z.string().uuid().optional() }),
   access: { openToAll: true },
   handler: async (event, ctx) => {
     const targetUserId = event.payload.userId ?? event.user.id;
     if (targetUserId !== event.user.id) {
-      const isAdmin = event.user.roles.some((role) => access.admin.includes(role));
-      if (!isAdmin) {
+      if (!isAdminActor(event.user)) {
         return writeFailure(
           new AccessDeniedError({
             details: { reason: "admin_required_for_other_user" },
           }),
         );
       }
+      // Same cross-tenant guard as lift-restriction.write.ts: only
+      // SystemAdmin (platform-wide) may target a user without an active
+      // membership in the caller's own tenant. Without this, a TenantAdmin
+      // from tenant A could restrict — and force-revoke the sessions of —
+      // a user who has never been a member of tenant A.
+      if (!isSystemAdminActor(event.user)) {
+        const membership = await fetchOne(ctx.db.raw, tenantMembershipsTable, {
+          userId: targetUserId,
+          tenantId: event.user.tenantId,
+        });
+        if (!membership) {
+          return writeFailure(
+            new AccessDeniedError({
+              details: { reason: "target_user_not_in_admin_tenant" },
+            }),
+          );
+        }
+      }
     }
 
     // ctx.db.raw weil User-Entity tenant-agnostisch ist (analog

package/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -77,6 +77,8 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
           hookCallsAttempted: result.hookCallsAttempted,
           errorCount: result.errors.length,
           errors: result.errors,
+          incompleteCount: result.incomplete.length,
+          incomplete: result.incomplete,
         },
       };
     },

package/src/user-data-rights/lib/is-admin-actor.ts

@@ -0,0 +1,19 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { access } from "@cosmicdrift/kumiko-framework/engine";
+
+const ADMIN_ROLES: ReadonlySet<string> = new Set(access.admin);
+const SYSTEM_ADMIN_ROLES: ReadonlySet<string> = new Set(access.systemAdmin);
+
+// Reused by handlers that are `openToAll: true` but still need a manual
+// self-or-admin gate (e.g. restrict-account.write.ts) — Set-lookup instead
+// of the O(n·m) `roles.some(role => access.admin.includes(role))` re-scan.
+export function isAdminActor(user: Pick<SessionUser, "roles">): boolean {
+  return user.roles.some((role) => ADMIN_ROLES.has(role));
+}
+
+// Platform-wide operator role — exempt from the cross-tenant membership
+// check that otherwise gates the tenant-scoped admin roles (TenantAdmin/
+// Admin) before they act on another tenant's user.
+export function isSystemAdminActor(user: Pick<SessionUser, "roles">): boolean {
+  return user.roles.some((role) => SYSTEM_ADMIN_ROLES.has(role));
+}

package/src/user-data-rights/run-forget-cleanup.ts

@@ -142,6 +142,13 @@ export interface ForgetCleanupIncomplete {
   readonly tenantId: TenantId;
   readonly entityName: string;
   readonly reason: string;
+  /** True when a LATER hook in the same user's sub-tx threw, rolling back
+   *  the DB rows (including the status flip) — but this hook's own
+   *  non-transactional side effect (e.g. an already-issued S3 delete,
+   *  a provider API call) already ran and does NOT get undone by that
+   *  rollback. The user is still DeletionRequested and will retry, but
+   *  this partial external effect needs its own operator follow-up. */
+  readonly rolledBack: boolean;
 }
 
 export interface RunForgetCleanupResult {
@@ -168,6 +175,15 @@ interface HookEntry {
 // hook that nulls that column. See custom-fields wire-user-data-rights.ts.
 const HOOK_ORDER_DEFAULT = EXT_USER_DATA_ORDER.DEFAULT;
 
+// Hook-reported reasons are external input (provider error messages can embed
+// user-controlled filenames/emails) — strip newlines before a single-line
+// console.warn so a crafted reason can't forge extra log lines, and cap the
+// length against a log-flood. The unsanitized reason still lands in the
+// returned `incomplete` entry untouched.
+export function sanitizeReasonForLog(reason: string): string {
+  return reason.replace(/[\r\n]+/g, " ").slice(0, 500);
+}
+
 export async function runForgetCleanup(
   args: RunForgetCleanupArgs,
 ): Promise<RunForgetCleanupResult> {
@@ -177,7 +193,7 @@ export async function runForgetCleanup(
 
   // Step 1: Find users with expired grace period.
   const dueUsers = await selectUsersDueForForgetCleanup(
-    db,
+    db as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
     USER_STATUS.DeletionRequested,
     now.toString(),
   );
@@ -285,7 +301,7 @@ async function processUser(args: {
 }): Promise<ProcessUserResult> {
   const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
-  const incomplete: ForgetCleanupIncomplete[] = [];
+  const incomplete: Omit<ForgetCleanupIncomplete, "rolledBack">[] = [];
   let hookCallsAttempted = 0;
 
   // Atom 5b — userEmail VOR der Tx cachen. user-Hook (user-data-rights-
@@ -374,7 +390,7 @@ async function processUser(args: {
             });
             // biome-ignore lint/suspicious/noConsole: operator-visibility for partial hook completion
             console.warn(
-              `[user-data-rights:run-forget-cleanup] hook incomplete userId=${userId} tenantId=${tenantId} entityName=${entry.entityName} reason=${hookResult.reason}`,
+              `[user-data-rights:run-forget-cleanup] hook incomplete userId=${userId} tenantId=${tenantId} entityName=${entry.entityName} reason=${sanitizeReasonForLog(hookResult.reason)}`,
             );
           }
         }
@@ -431,10 +447,14 @@ async function processUser(args: {
     success: txSucceeded,
     hookCallsAttempted,
     errors,
-    // Only surfaced on a committed sub-tx — a later throw in the same
-    // user's loop rolls this back too, so a rolled-back "incomplete"
-    // report would misreport a non-deleted user as partially cleaned up.
-    incomplete: txSucceeded ? incomplete : [],
+    // Reported either way — a rolled-back sub-tx doesn't undo an
+    // "incomplete" hook's own non-transactional side effect (S3 delete,
+    // provider call), so dropping the report entirely would hide exactly
+    // the case its own reason string describes ("would report a
+    // not-yet-deleted user as partially cleaned up" — true of the DB rows,
+    // not of that external effect). `rolledBack` lets the operator tell
+    // the two situations apart instead of losing the signal outright.
+    incomplete: incomplete.map((i) => ({ ...i, rolledBack: !txSucceeded })),
     userEmailBeforeDelete,
     userLocaleBeforeDelete,
     tenantIdsBeforeDelete,