@cosmicdrift/kumiko-bundled-features 0.171.0 → 0.171.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.171.0",
+  "version": "0.171.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,12 +119,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.171.0",
-    "@cosmicdrift/kumiko-framework": "0.171.0",
-    "@cosmicdrift/kumiko-headless": "0.171.0",
-    "@cosmicdrift/kumiko-renderer": "0.171.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.171.0",
-    "@cosmicdrift/kumiko-types": "0.171.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.171.2",
+    "@cosmicdrift/kumiko-framework": "0.171.2",
+    "@cosmicdrift/kumiko-headless": "0.171.2",
+    "@cosmicdrift/kumiko-renderer": "0.171.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.171.2",
+    "@cosmicdrift/kumiko-types": "0.171.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -68,6 +68,23 @@ const appFeature = defineFeature("app", (r) => {
       access: { openToAll: true },
     }),
   );
+
+  r.writeHandler(
+    defineWriteHandler({
+      name: "ping-direct",
+      schema: z.object({ email: z.string(), subjectId: z.string() }),
+      handler: async (event, ctx) => {
+        const notify = ctx.notify as NotifyFn;
+        await notify(qn("app", "notify", "pinged"), {
+          route: { email: event.payload.email },
+          recipientId: event.payload.subjectId,
+          data: { title: "Ping", body: "Du wurdest angepingt" },
+        });
+        return { isSuccess: true, data: { sent: true } };
+      },
+      access: { openToAll: true },
+    }),
+  );
 });
 
 let stack: TestStack;
@@ -168,4 +185,64 @@ describe("delivery attempt log under KMS", () => {
     );
     expect(erased?.["recipientAddress"]).toBe(PII_ERASED_SENTINEL);
   });
+
+  // money-horse#330: route:{email} (no user account, e.g. a share-token
+  // recipient) carries recipientId so recipientAddress is encrypted under
+  // that subject too, not left plaintext.
+  test("route:{email} with recipientId ciphers recipientAddress under that subject; erasing it doesn't touch other subjects", async () => {
+    const directEmail = "share-recipient@test.com";
+    const subjectId = "share-token-330";
+
+    await stack.http.writeOk(
+      qn("app", "write", "ping-direct"),
+      { email: directEmail, subjectId },
+      admin,
+    );
+    await pingRecipient();
+
+    const events = await selectMany(stack.db, eventsTable, { type: DELIVERY_ATTEMPT_EVENT });
+    const direct = events
+      .map((e) => e.payload as Record<string, unknown>)
+      .find((p) => p["channel"] === "email" && p["recipientId"] === subjectId);
+    expect(direct).toBeDefined();
+    expect(isPiiCiphertext(direct?.["recipientAddress"])).toBe(true);
+    expect(String(direct?.["recipientAddress"])).toContain(`user:${subjectId}`);
+
+    const rowsBefore = await selectMany(stack.db, deliveryAttemptsTable, {
+      recipientId: subjectId,
+      channel: "email",
+    });
+    expect(rowsBefore.length).toBeGreaterThan(0);
+    expect(isPiiCiphertext(rowsBefore[0]?.["recipientAddress"])).toBe(true);
+
+    // Snapshot the plain `to:` recipient's entry before erasing the
+    // share-token subject, to prove the erase below is subject-scoped.
+    const beforeErase = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const otherSubjectBefore = beforeErase.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    )?.["recipientAddress"];
+
+    await kms.eraseKey({ kind: "user", userId: subjectId });
+
+    const after = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const shredded = after.rows.find(
+      (r) => r["recipientId"] === subjectId && r["channel"] === "email",
+    );
+    expect(shredded?.["recipientAddress"]).toBe(PII_ERASED_SENTINEL);
+
+    // Other subjects (e.g. the plain `to:` recipient) are unaffected by the
+    // share-token subject's erasure.
+    const otherSubjectAfter = after.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    )?.["recipientAddress"];
+    expect(otherSubjectAfter).toBe(otherSubjectBefore);
+  });
 });

package/src/delivery/delivery-service.ts

@@ -422,6 +422,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     data: Readonly<Record<string, unknown>> | undefined,
     tenantId: TenantId,
     priority: NotifyPriority,
+    recipientId: string | null,
   ): Promise<void> {
     const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId);
 
@@ -439,7 +440,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
             tenantId,
             notificationType,
             channel: channel.name,
-            recipientId: null,
+            recipientId,
             recipientAddress: address,
             status: "skipped",
             error: "rate_limited",
@@ -456,7 +457,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           message,
           channelCtx,
           tenantId,
-          recipientId: null,
+          recipientId,
           notificationType,
           priority,
         });
@@ -465,7 +466,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           tenantId,
           notificationType,
           channel: channel.name,
-          recipientId: null,
+          recipientId,
           recipientAddress: address,
           status: "failed",
           error: err instanceof Error ? err.message : String(err),
@@ -499,7 +500,14 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       }
 
       if (route) {
-        await deliverDirect(route, notificationType, data, tenantId, priority);
+        await deliverDirect(
+          route,
+          notificationType,
+          data,
+          tenantId,
+          priority,
+          options.recipientId ?? null,
+        );
         // skip: direct route delivered, no recipient resolution needed
         return;
       }