@cosmicdrift/kumiko-bundled-features 0.174.0 → 0.176.0

package/src/user/seeding.ts

@@ -69,7 +69,31 @@ export async function seedUser(
   const existing = await fetchOne(db, userTable, { email: options.email });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
-  if (existing) return { id: existing["id"] as string };
+  if (existing) {
+    const id = existing["id"] as string;
+    // Reconcile emailVerified on an already-seeded row: a persistent dev DB
+    // (or a re-run bootstrap) can carry a User seeded before this flag
+    // existed or before it flipped to true — without this, "seed with
+    // emailVerified: true" only ever takes effect on the very first insert
+    // and the flag silently does nothing on every re-run after (#1687).
+    // Goes through the executor (a real `.updated` event), never a direct
+    // write.
+    if (options.emailVerified === true && existing["emailVerified"] !== true) {
+      const result = await userExecutor.update(
+        { id, version: existing["version"] as number, changes: { emailVerified: true } },
+        by,
+        tdb,
+      );
+      // version_conflict = a concurrent write already changed the row —
+      // fine for a seed helper, don't fail the whole seed run over it.
+      if (!result.isSuccess && result.error.code !== "version_conflict") {
+        throw new Error(
+          `seedUser emailVerified reconcile failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
+        );
+      }
+    }
+    return { id };
+  }
 
   const result = await userExecutor.create(
     {

package/src/user-data-rights/__tests__/anonymous-deletion-kms.integration.test.ts

@@ -103,7 +103,7 @@ afterEach(() => {
 
 function tokenFromLastVerifyCall(): string {
   const url = new URL(verifyCalls[0]?.verifyUrl ?? "");
-  return url.searchParams.get("token") ?? "";
+  return new URLSearchParams(url.hash.slice(1)).get("token") ?? "";
 }
 
 describe("anonymous deletion flow with active KMS", () => {

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -95,7 +95,7 @@ async function seedAlice(status: string = USER_STATUS.Active, email: string = AL
 
 function tokenFromLastVerifyCall(): string {
   const url = new URL(verifyCalls[0]?.verifyUrl ?? "");
-  return url.searchParams.get("token") ?? "";
+  return new URLSearchParams(url.hash.slice(1)).get("token") ?? "";
 }
 
 async function statusOf(): Promise<string | undefined> {
@@ -118,7 +118,7 @@ describe("anonymous deletion flow", () => {
 
     expect(verifyCalls).toHaveLength(1);
     expect(verifyCalls[0]?.email).toBe(ALICE_EMAIL);
-    expect(verifyCalls[0]?.verifyUrl.startsWith(`${VERIFY_URL}?token=`)).toBe(true);
+    expect(verifyCalls[0]?.verifyUrl.startsWith(`${VERIFY_URL}#token=`)).toBe(true);
     expect(tokenFromLastVerifyCall().length).toBeGreaterThan(0);
     // Status noch NICHT geflipt — erst confirm startet die Grace-Period.
     expect(await statusOf()).toBe(USER_STATUS.Active);

package/src/user-data-rights/__tests__/request-deletion-url.test.ts

@@ -2,20 +2,23 @@ import { describe, expect, test } from "bun:test";
 import { buildDeletionVerifyUrl } from "../handlers/request-deletion-by-email.write";
 
 describe("buildDeletionVerifyUrl", () => {
-  test("appends ?token to a plain base URL", () => {
-    expect(buildDeletionVerifyUrl("https://app.example.com/delete/confirm", "tok-123")).toBe(
-      "https://app.example.com/delete/confirm?token=tok-123",
-    );
+  // fw#1554: the token goes in the URL fragment, not a query param —
+  // fragments never leave the browser, so they never land in proxy/access
+  // logs (unlike ?token=, which does).
+  test("puts the token in the URL fragment, not a query param", () => {
+    const url = buildDeletionVerifyUrl("https://app.example.com/delete/confirm", "tok-123");
+    expect(url).toBe("https://app.example.com/delete/confirm#token=tok-123");
+    expect(new URL(url).search).toBe("");
   });
 
-  test("appends &token when the base already carries query params (not a second ?)", () => {
+  test("preserves an existing query param — only the token is a fragment", () => {
     const url = buildDeletionVerifyUrl("https://app.example.com/confirm?lang=de", "tok-123");
-    expect(url).toBe("https://app.example.com/confirm?lang=de&token=tok-123");
-    expect(url.match(/\?/g)).toHaveLength(1);
+    expect(url).toBe("https://app.example.com/confirm?lang=de#token=tok-123");
   });
 
   test("URL-encodes a token with reserved characters", () => {
     const url = new URL(buildDeletionVerifyUrl("https://app.example.com/c", "a b&c=d"));
-    expect(url.searchParams.get("token")).toBe("a b&c=d");
+    const params = new URLSearchParams(url.hash.slice(1));
+    expect(params.get("token")).toBe("a b&c=d");
   });
 });

package/src/user-data-rights/feature.ts

@@ -112,8 +112,9 @@ export type UserDataRightsOptions = {
    *  by-token weist generisch ab). */
   readonly deletionTokenSecret?: string;
   /** Basis-URL des Apex-Confirm-Screens, z.B.
-   *  "https://app.example.com/delete-account/confirm". Der Handler hängt
-   *  `?token=<token>` an. Required wenn deletionTokenSecret gesetzt. */
+   *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
+   *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Required wenn
+   *  deletionTokenSecret gesetzt. */
   readonly deletionVerifyUrl?: string;
   /** Versand des Verify-Magic-Links (Schritt 1 des anonymen Flows).
    *  Best-effort, app-author-wired. MUSS non-blocking sein (enqueue, z.B.

package/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -30,18 +30,20 @@ export type RequestDeletionByEmailOptions = {
    *  deaktiviert (Handler antwortet still mit success, kein Link). */
   readonly deletionTokenSecret?: string;
   /** Basis-URL des Apex-Confirm-Screens, z.B.
-   *  "https://app.example.com/delete-account/confirm". Der Handler hängt
-   *  `?token=<token>` an. Ohne URL kein Link. */
+   *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
+   *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Ohne URL kein Link. */
   readonly deletionVerifyUrl?: string;
   readonly sendDeletionVerificationEmail?: SendDeletionVerificationEmailFn;
 };
 
-// URL-safe append: handles a base URL that already carries query params
-// (`?lang=de` → `?lang=de&token=…`) instead of producing an invalid
-// `?lang=de?token=…`. searchParams.set encodes the token.
+// Token goes in the URL fragment, not a query param — fragments never leave
+// the browser (not sent to the server, so they never land in proxy/access
+// logs, unlike `?token=`). Same convention as the export-download link
+// (feature.ts, issue #1271). Preserves any existing query params on `base`
+// (`?lang=de` stays a query param; only the token is a fragment).
 export function buildDeletionVerifyUrl(base: string, token: string): string {
   const url = new URL(base);
-  url.searchParams.set("token", token);
+  url.hash = `token=${encodeURIComponent(token)}`;
   return url.toString();
 }
 

package/src/user-data-rights/web/__tests__/deletion-screens.test.tsx

@@ -79,15 +79,15 @@ describe("RequestAccountDeletionScreen", () => {
 });
 
 describe("ConfirmAccountDeletionScreen", () => {
-  test("ohne ?token → missingToken, kein Confirm-Button", () => {
+  test("ohne #token → missingToken, kein Confirm-Button", () => {
     window.history.replaceState({}, "", "/delete-account/confirm");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(true, []));
     expect(ui.getByText(/Kein Token/)).toBeTruthy();
     expect(ui.queryByRole("button")).toBeNull();
   });
 
-  test("mit ?token → Confirm dispatcht confirm-deletion-by-token + Success", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=tok-123");
+  test("mit #token → Confirm dispatcht confirm-deletion-by-token + Success", async () => {
+    window.history.replaceState({}, "", "/delete-account/confirm#token=tok-123");
     const calls: WriteCall[] = [];
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(true, calls));
     fireEvent.click(ui.getByRole("button"));
@@ -98,7 +98,7 @@ describe("ConfirmAccountDeletionScreen", () => {
   });
 
   test("write-Failure → invalidToken-Banner, kein Success", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=bad");
+    window.history.replaceState({}, "", "/delete-account/confirm#token=bad");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeDispatcher(false, []));
     fireEvent.click(ui.getByRole("button"));
     await waitFor(() => expect(ui.getByText(/ungültig oder abgelaufen/)).toBeTruthy());
@@ -106,7 +106,7 @@ describe("ConfirmAccountDeletionScreen", () => {
   });
 
   test("write wirft → generischer Error-Banner, NICHT invalidToken", async () => {
-    window.history.replaceState({}, "", "/delete-account/confirm?token=tok-123");
+    window.history.replaceState({}, "", "/delete-account/confirm#token=tok-123");
     const ui = renderWith(<ConfirmAccountDeletionScreen />, makeThrowingDispatcher());
     fireEvent.click(ui.getByRole("button"));
     await waitFor(() => expect(ui.getByText(/schief gegangen/)).toBeTruthy());

package/src/user-data-rights/web/confirm-deletion-screen.tsx

@@ -1,6 +1,7 @@
 // @runtime client
 // ConfirmAccountDeletionScreen — anonymer Apex-Screen Schritt 2. Liest das
-// `?token` aus der Verify-Link-URL und dispatcht beim Bestätigen
+// Token aus dem URL-Fragment (`#token=…`, nie an den Server gesendet — landet
+// so nicht in Proxy-/Access-Logs, fw#1554) und dispatcht beim Bestätigen
 // user-data-rights:write:confirm-deletion-by-token → startet die Grace-Period.
 //
 // App mountet den Screen unter der deletionVerifyUrl-Route (z.B.
@@ -15,7 +16,7 @@ type Phase = "idle" | "submitting" | "success" | "missing" | "invalid" | "error"
 
 function readToken(): string {
   if (typeof window === "undefined") return "";
-  return new URLSearchParams(window.location.search).get("token") ?? "";
+  return new URLSearchParams(window.location.hash.slice(1)).get("token") ?? "";
 }
 
 export type ConfirmAccountDeletionScreenProps = {

package/src/text-content/README.md

@@ -1,197 +0,0 @@
-# text-content
-
-Generic Markdown text container — exactly one block per
-`(tenantId, slug, lang)`. Use cases: imprint, privacy policy, FAQ,
-about, ToS, marketing snippets. Foundation for
-[`legal-pages`](../legal-pages/), but also usable standalone.
-
-**Opt-in.** If you don't need static texts (internal tools, pure API
-apps), simply don't activate the feature.
-
----
-
-## Setup
-
-```typescript
-import { createTextContentFeature } from "@cosmicdrift/kumiko-bundled-features/text-content";
-
-runProdApp({
-  features: [createTextContentFeature(), /* ... */],
-});
-```
-
-### Production table setup
-
-Each app creates the `read_text_blocks` table via a schema migration:
-
-```bash
-# In the app workspace (legacy drizzle.config.ts apps):
-bun kumiko migrate generate    # detects the new r.entity("text-block")
-bun kumiko migrate apply       # pre-deploy step in prod
-
-# New apps (kumiko/schema.ts):
-bun kumiko schema generate text-content
-bun kumiko schema apply
-```
-
-The boot gate (`runProdApp`) checks hard: missing table = `SchemaDriftError`,
-container exits. No auto-heal in production. See
-[docs/plans/architecture/migrations.md](../../../../docs/plans/architecture/migrations.md).
-
-In integration tests (`bun test`) it's enough to do:
-
-```typescript
-import { unsafeCreateEntityTable } from "@cosmicdrift/kumiko-framework/stack";
-import { textBlockEntity } from "@cosmicdrift/kumiko-bundled-features/text-content";
-
-await unsafeCreateEntityTable(stack.db, textBlockEntity);
-```
-
-The `unsafe` prefix is intentional — it bypasses the projection
-registry and is reserved for test setup and framework-internals. Apps
-declare data via `r.entity(...)` everywhere else.
-
-## Use cases
-
-text-content is generic — anything that's static Markdown text per
-`(tenantId, slug, lang)` fits. Examples from real life:
-
-| Slug example | Use case | Tenant scope |
-|---|---|---|
-| `imprint`, `privacy` | Imprint, privacy (DACH) | SYSTEM_TENANT_ID (app-wide) |
-| `terms-of-service`, `eula` | Terms of service | SYSTEM_TENANT_ID or tenant-owned |
-| `faq-billing`, `faq-onboarding`, `faq-troubleshooting` | FAQ sections | SYSTEM_TENANT_ID |
-| `about-team`, `about-mission` | About pages | SYSTEM_TENANT_ID |
-| `help-shortcuts`, `help-search` | In-app help texts | SYSTEM_TENANT_ID |
-| `welcome-email-body`, `password-reset-body` | Email templates (Markdown body) | SYSTEM_TENANT_ID or tenant branding |
-| `marketing-pricing-cta`, `marketing-feature-list` | Marketing snippets for landing pages | SYSTEM_TENANT_ID |
-| `tenant-welcome-message` | Tenant-specific text | TenantId (each tenant maintains their own) |
-
-Convention for slugs: `kebab-case`, hierarchy via `area-topic`
-(e.g. `faq-billing` rather than `billing-faq` so list aggregation by
-prefix is straightforward).
-
----
-
-## API
-
-### `text-content:write:set` — upsert per block
-
-The tenant admin writes a block. Idempotent: if a block already exists
-for `(tenantId, slug, lang)`, it's updated.
-
-```typescript
-import { TextContentHandlers } from "@cosmicdrift/kumiko-bundled-features/text-content";
-
-await stack.http.writeOk(TextContentHandlers.set, {
-  slug: "imprint",
-  lang: "de",
-  title: "Impressum",
-  body: "## Angaben gemäß § 5 TMG\n\nMarc Frost ...",
-}, tenantAdmin);
-```
-
-**Validation:**
-- `slug` — kebab-case (`/^[a-z0-9][a-z0-9-]*$/`), max 64 chars
-- `lang` — ISO 639-1 (`de`, `en`, `en-us`, ...)
-- `title` — 1-200 chars
-- `body` — Markdown, max 100000 chars, nullable
-
-**Access:** `roles: ["TenantAdmin"]`. Tenant scope comes automatically
-from `event.user.tenantId`. Platform admins (SystemTenant) set texts
-through the SystemAdmin role in SYSTEM_TENANT_ID.
-
-### `text-content:query:by-slug` — public read
-
-Anonymous-capable (`roles: ["anonymous", "User", "TenantAdmin",
-"SystemAdmin"]`) — visitors on marketing/legal pages should see texts
-without a login.
-
-```typescript
-import { TextContentQueries } from "@cosmicdrift/kumiko-bundled-features/text-content";
-
-const block = await stack.http.queryOk(TextContentQueries.bySlug, {
-  slug: "imprint",
-  lang: "de",
-}, anyUser);
-// → { slug, lang, title, body, updatedAt } | null
-```
-
-**Tenant scope:** comes from `query.user.tenantId`. For anonymous
-requests the server must configure `anonymousAccess` with a
-`defaultTenantId` or `tenantResolver`.
-
----
-
-## Test helper
-
-```typescript
-import { seedTextBlock } from "@cosmicdrift/kumiko-bundled-features/text-content/seeding";
-
-await seedTextBlock(db, {
-  tenantId: SYSTEM_TENANT_ID,
-  slug: "imprint",
-  lang: "de",
-  title: "Impressum",
-  body: "...",
-});
-```
-
-Idempotent: a second call updates the block.
-
----
-
-## Cross-feature API (for consuming features)
-
-When another feature (e.g. `legal-pages`) wants to read text blocks
-**without a direct code import**, there's an extraContext API:
-
-```typescript
-import { createTextContentApi, requireTextContent } from "@cosmicdrift/kumiko-bundled-features/text-content";
-
-// 1. App bootstrap wires the API:
-runProdApp({
-  features: [createTextContentFeature(), createLegalPagesFeature(), /* ... */],
-  extraContext: ({ db }) => ({
-    textContent: createTextContentApi(db),
-  }),
-});
-
-// 2. In the consumer feature (e.g. legal-pages handler / boot job):
-const textContent = requireTextContent(ctx, "my-handler");
-const block = await textContent.getBlock({
-  tenantId: SYSTEM_TENANT_ID,
-  slug: "imprint",
-  lang: "de",
-});
-```
-
-Pattern is symmetrical to `config` ↔ `tenant`: `text-content` only
-exports the type + factory, consuming features only import the type.
-This means text-content can be refactored freely without breaking
-other features — the contract is the `TextContentApi` interface.
-
-## Combining with `legal-pages`
-
-`legal-pages` is an opt-in wrapper that registers four fixed
-convenience routes (`/legal/impressum`, `/legal/datenschutz`,
-`/legal/imprint`, `/legal/privacy`) and renders Markdown→HTML. See
-[../legal-pages/README.md](../legal-pages/README.md).
-
----
-
-## Architecture
-
-- **Single source of truth:** `textBlockEntity` in `table.ts`.
-  The Drizzle table is derived via `buildEntityTable("text-block",
-  textBlockEntity)`, the unique index on `(tenantId, slug, lang)` is
-  declared via `entity.indexes`.
-- **Event-sourced:** the write path goes through
-  `createEventStoreExecutor` — `text-block.created` and
-  `text-block.updated` land in the event stream, the projection row in
-  the same TX. Subscribers (audit, search) receive the events.
-- **Storage:** one block per `(tenantId, slug, lang)`. SYSTEM_TENANT_ID
-  for app-wide texts, regular TenantId for tenant-owned ones.
-
-Cross-refs: [../../docs/plans/datenschutz/](../../../../docs/plans/datenschutz/)
-for the bigger privacy plan picture.