@cosmicdrift/kumiko-bundled-features 0.172.0 → 0.173.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.172.0",
+  "version": "0.173.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,12 +119,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.172.0",
-    "@cosmicdrift/kumiko-framework": "0.172.0",
-    "@cosmicdrift/kumiko-headless": "0.172.0",
-    "@cosmicdrift/kumiko-renderer": "0.172.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.172.0",
-    "@cosmicdrift/kumiko-types": "0.172.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.173.1",
+    "@cosmicdrift/kumiko-framework": "0.173.1",
+    "@cosmicdrift/kumiko-headless": "0.173.1",
+    "@cosmicdrift/kumiko-renderer": "0.173.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.173.1",
+    "@cosmicdrift/kumiko-types": "0.173.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/audit/__tests__/audit.integration.test.ts

@@ -245,7 +245,6 @@ describe("audit: list query", () => {
     );
     expect(untilBefore.rows).toHaveLength(1);
     const untilRow = untilBefore.rows[0];
-    expect(untilRow).toBeDefined();
     if (!untilRow) throw new Error("expected untilBefore row");
     expect((untilRow.payload as { name?: string }).name).toBe("before-window");
   });

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -55,8 +55,7 @@ describe("login.write gates (fw#1284)", () => {
       ["User"],
       "Asia/Tokyo",
     );
-    expect(g.ok).toBe(true);
-    if (g.ok) expect(g.value.session.timezone).toBe("Asia/Tokyo");
+    expect(g.session.timezone).toBe("Asia/Tokyo");
   });
 
   test("gateBuildSession omits timezone when the user never set one (fw#1636)", async () => {
@@ -67,7 +66,6 @@ describe("login.write gates (fw#1284)", () => {
       ["User"],
       null,
     );
-    expect(g.ok).toBe(true);
-    if (g.ok) expect(g.value.session.timezone).toBeUndefined();
+    expect(g.session.timezone).toBeUndefined();
   });
 });

package/src/auth-email-password/__tests__/seed-admin.integration.test.ts

@@ -111,6 +111,33 @@ describe("seedAdmin", () => {
     expect(betaMembership[0]?.["roles"]).toBe(JSON.stringify(["User"]));
   });
 
+  test("emailVerified: true wird an seedUserWithPassword durchgereicht", async () => {
+    await seedAdmin(stack.db, {
+      email: "verified@example.com",
+      password: "secret-pw",
+      displayName: "Verified Admin",
+      emailVerified: true,
+      memberships: [
+        { tenantId: TENANT_DEV, tenantKey: "dev", tenantName: "Dev", roles: ["Admin"] },
+      ],
+    });
+    const [user] = await selectMany(stack.db, userTable, { email: "verified@example.com" });
+    expect(user?.["emailVerified"]).toBe(true);
+  });
+
+  test("emailVerified: ohne Flag bleibt der User unverifiziert (Default)", async () => {
+    await seedAdmin(stack.db, {
+      email: "unverified@example.com",
+      password: "secret-pw",
+      displayName: "Unverified Admin",
+      memberships: [
+        { tenantId: TENANT_DEV, tenantKey: "dev", tenantName: "Dev", roles: ["Admin"] },
+      ],
+    });
+    const [user] = await selectMany(stack.db, userTable, { email: "unverified@example.com" });
+    expect(user?.["emailVerified"]).toBe(false);
+  });
+
   test("idempotent: zweiter Aufruf no-op (kein Crash, Stand bleibt)", async () => {
     // Erstaufruf
     const { id: userId1 } = await seedAdmin(stack.db, {

package/src/auth-email-password/handlers/login.write.ts

@@ -206,16 +206,16 @@ export async function gateEnforceMfa(
   userId: string,
   tenantId: TenantId,
   mergedRoles: readonly string[],
-): Promise<GateOutcome<LoginResult | undefined>> {
-  if (!opts.mfaStatusChecker) return ok(undefined);
+): Promise<LoginResult | undefined> {
+  if (!opts.mfaStatusChecker) return undefined;
   const mfaStatus = await opts.mfaStatusChecker(ctx, userId, tenantId, mergedRoles);
   if ("challengeToken" in mfaStatus) {
-    return ok({ kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken });
+    return { kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken };
   }
   if ("setupRequired" in mfaStatus) {
-    return ok({ kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken });
+    return { kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken };
   }
-  return ok(undefined);
+  return undefined;
 }
 
 /** Auth-claims hooks → session. */
@@ -225,7 +225,7 @@ export async function gateBuildSession(
   tenantId: TenantId,
   mergedRoles: readonly string[],
   timezone?: string | null,
-): Promise<GateOutcome<{ readonly kind: "auth-session"; readonly session: SessionUser }>> {
+): Promise<{ readonly kind: "auth-session"; readonly session: SessionUser }> {
   const baseSession: SessionUser = {
     id: userId,
     tenantId,
@@ -235,7 +235,7 @@ export async function gateBuildSession(
   const claims = await ctx.resolveAuthClaims(baseSession);
   const session: SessionUser =
     Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
-  return ok({ kind: "auth-session", session });
+  return { kind: "auth-session", session };
 }
 
 // Login — unauthenticated entry point. The route is wired public (no JWT
@@ -291,20 +291,18 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       const { chosen, mergedRoles } = membershipGate.value;
 
       const mfaGate = await gateEnforceMfa(ctx, opts, found.id, chosen.tenantId, mergedRoles);
-      if (!mfaGate.ok) return mfaGate.result;
-      if (mfaGate.value !== undefined) {
-        return { isSuccess: true, data: mfaGate.value };
+      if (mfaGate !== undefined) {
+        return { isSuccess: true, data: mfaGate };
       }
 
-      const sessionGate = await gateBuildSession(
+      const session = await gateBuildSession(
         ctx,
         found.id,
         chosen.tenantId,
         mergedRoles,
         found.timezone,
       );
-      if (!sessionGate.ok) return sessionGate.result;
-      return { isSuccess: true, data: sessionGate.value };
+      return { isSuccess: true, data: session };
     },
   });
 }

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -10,9 +10,25 @@
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  buildEntityTable,
+  createEventStoreExecutor,
+  createTenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { setupTestStack, type TestStack, testTenantId } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
@@ -142,3 +158,128 @@ describe("crypto-shredding :: forget-subject", () => {
     expect(err.httpStatus).toBe(400);
   });
 });
+
+// fw#1611: forget-subject's ctx.searchAdapter wiring (forget-subject.write.ts
+// → purgeSearchDocumentsForSubject) had zero end-to-end coverage — a broken
+// extension registration would silently turn the whole GDPR search purge
+// into a no-op. Own stack (own entity feature) so it doesn't perturb the
+// scenarios above.
+describe("crypto-shredding :: forget-subject purges the derived search index (#1611)", () => {
+  const probeEntity = createEntity({
+    table: "read_forget_subject_search_probe",
+    fields: {
+      ownerId: createTextField({ required: true }),
+      userNote: createTextField({
+        required: true,
+        maxLength: 100,
+        userOwned: { ownerField: "ownerId" },
+        searchable: true,
+      }),
+      tenantNote: createTextField({
+        required: true,
+        maxLength: 100,
+        tenantOwned: true,
+        searchable: true,
+      }),
+    },
+  });
+  const probeTable = buildEntityTable("forgetSubjectSearchProbe", probeEntity);
+  const probeFeature = defineFeature("forget-subject-search-probe", (r) => {
+    r.entity("probe", probeEntity);
+  });
+
+  let searchStack: TestStack;
+  let searchKms: InMemoryKmsAdapter;
+  const admin = TestUsers.admin;
+
+  beforeAll(async () => {
+    searchStack = await setupTestStack({
+      features: [createCryptoShreddingFeature(), probeFeature],
+    });
+    await unsafeCreateEntityTable(searchStack.db, probeEntity, "probe");
+    await createEventsTable(searchStack.db);
+  });
+
+  afterAll(async () => {
+    await searchStack.cleanup();
+  });
+
+  beforeEach(() => {
+    searchKms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(searchKms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  function probeExecutor() {
+    return createEventStoreExecutor(probeTable, probeEntity, {
+      entityName: "probe",
+      searchAdapter: searchStack.search,
+    });
+  }
+
+  function probeTenantDb() {
+    return createTenantDb(searchStack.db, admin.tenantId, "system");
+  }
+
+  test("forget-subject over HTTP purges userOwned rows from the search index", async () => {
+    const ownerId = crypto.randomUUID();
+    const userNote = "UniqueUserOwnedNote1611";
+    const created = await probeExecutor().create(
+      { ownerId, userNote, tenantNote: "irrelevant-tenant-note" },
+      admin,
+      probeTenantDb(),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+
+    await searchStack.eventDispatcher?.runOnce();
+    expect(
+      (await searchStack.search.search(admin.tenantId, userNote, { filterType: "probe" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    await searchStack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId: ownerId }, reason: REASON },
+      dpoUser,
+    );
+
+    const after = await searchStack.search.search(admin.tenantId, userNote, {
+      filterType: "probe",
+    });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+
+  test("forget-subject over HTTP purges tenantOwned rows from the search index", async () => {
+    const tenantNote = "UniqueTenantOwnedNote1611";
+    const created = await probeExecutor().create(
+      { ownerId: crypto.randomUUID(), userNote: "irrelevant-user-note", tenantNote },
+      admin,
+      probeTenantDb(),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+
+    await searchStack.eventDispatcher?.runOnce();
+    expect(
+      (await searchStack.search.search(admin.tenantId, tenantNote, { filterType: "probe" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    await searchStack.http.writeOk(
+      FORGET,
+      { subject: { kind: "tenant", tenantId: admin.tenantId }, reason: REASON },
+      dpoUser,
+    );
+
+    const after = await searchStack.search.search(admin.tenantId, tenantNote, {
+      filterType: "probe",
+    });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+});

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -225,6 +225,11 @@ describe("delivery attempt log under KMS", () => {
     const otherSubjectBefore = beforeErase.rows.find(
       (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
     )?.["recipientAddress"];
+    // Guard against a vacuous pass: if the row fell outside the `limit 100`
+    // window, both sides below would be `undefined` and the "unaffected"
+    // assertion would prove nothing.
+    expect(otherSubjectBefore).toBeDefined();
+    expect(otherSubjectBefore).not.toBe(PII_ERASED_SENTINEL);
 
     await kms.eraseKey({ kind: "user", userId: subjectId });
 

package/src/user/__tests__/user.integration.test.ts

@@ -69,6 +69,23 @@ describe("scenario 1: create + me", () => {
     expect(me["locale"] == null).toBe(true);
   });
 
+  test("locale sent by the client is persisted and returned via me", async () => {
+    const created = await stack.http.writeOk<{ id: number }>(
+      UserHandlers.create,
+      {
+        email: "locale@example.com",
+        displayName: "Locale User",
+        passwordHash: "seeded-hash",
+        locale: "de",
+      },
+      systemAdmin,
+    );
+
+    const signedIn = createTestUser({ id: created.id, roles: ["User"] });
+    const me = await stack.http.queryOk<Record<string, unknown>>(UserQueries.me, {}, signedIn);
+    expect(me["locale"]).toBe("de");
+  });
+
   test("normal user cannot create another user", async () => {
     const normal = createTestUser({ id: 42, roles: ["User"] });
     const error = await stack.http.writeErr(

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -129,8 +129,6 @@ describe("my-audit-log", () => {
     // ihre Payload, bob nur seine.
     const aliceRow = aliceLog.rows[0];
     const bobRow = bobLog.rows[0];
-    expect(aliceRow).toBeDefined();
-    expect(bobRow).toBeDefined();
     if (!aliceRow || !bobRow) throw new Error("expected audit rows");
     expect((aliceRow.payload as { foo: string }).foo).toBe("alice");
     expect((bobRow.payload as { foo: string }).foo).toBe("bob");

package/src/user-data-rights/__tests__/default-mailers.test.ts

@@ -91,6 +91,37 @@ describe("default-mailers dispatch", () => {
     expect(cap.sent[1]?.subject).toBe("Acme — Dein Datenexport ist bereit");
   });
 
+  test("null user.locale (der Normalfall seit fw#1637, kein Entity-Default mehr): mailDefaults.locale entscheidet, sonst en", async () => {
+    const cap = capturingTransport();
+    const resolve = async () => cap.transport;
+
+    // userLocale: null + mailDefaults.locale: "de" → German subject.
+    await makeDefaultExportReadyEmail(resolve, { locale: "de", appName: "Acme" })({
+      userId: "u1",
+      userEmail: "u1@example.com",
+      userLocale: null,
+      tenantId: TENANT_A,
+      jobId: "j1",
+      downloadUrl: "u",
+      expiresAt: "x",
+      bytesWritten: null,
+    });
+    expect(cap.sent[0]?.subject).toBe("Acme — Dein Datenexport ist bereit");
+
+    // userLocale: null + no mailDefaults.locale → template default "en".
+    await makeDefaultExportReadyEmail(resolve, { appName: "Acme" })({
+      userId: "u2",
+      userEmail: "u2@example.com",
+      userLocale: null,
+      tenantId: TENANT_A,
+      jobId: "j2",
+      downloadUrl: "u",
+      expiresAt: "x",
+      bytesWritten: null,
+    });
+    expect(cap.sent[1]?.subject).toBe("Acme — Your data export is ready");
+  });
+
   test("deletion-executed: sendet ueber den ersten Membership-Tenant", async () => {
     const cap = capturingTransport();
     const resolved: string[] = [];