@cosmicdrift/kumiko-bundled-features 0.183.2 → 0.185.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.183.2",
+  "version": "0.185.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -121,12 +121,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.183.2",
-    "@cosmicdrift/kumiko-framework": "0.183.2",
-    "@cosmicdrift/kumiko-headless": "0.183.2",
-    "@cosmicdrift/kumiko-renderer": "0.183.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.183.2",
-    "@cosmicdrift/kumiko-types": "0.183.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.185.0",
+    "@cosmicdrift/kumiko-framework": "0.185.0",
+    "@cosmicdrift/kumiko-headless": "0.185.0",
+    "@cosmicdrift/kumiko-renderer": "0.185.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.185.0",
+    "@cosmicdrift/kumiko-types": "0.185.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/channel-email/__tests__/email-channel.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from "bun:test";
+import type {
+  ChannelContext,
+  ChannelMessage,
+  NotificationRenderer,
+  RenderedMessage,
+} from "../../delivery";
+import { createEmailChannel } from "../email-channel";
+import { createInMemoryTransport } from "../types";
+
+const stubRenderer: NotificationRenderer = {
+  name: "stub",
+  render: async () => "<p>rendered</p>",
+};
+const resolveEmail = async () => "user@example.com";
+// send() never touches ctx — only render()/resolve() would, and this test
+// passes `rendered` so render() is skipped.
+const ctx = {} as unknown as ChannelContext;
+const rendered: RenderedMessage = { html: "<p>x</p>", subject: "Re: Wasserschaden" };
+
+function channelWith(transport: ReturnType<typeof createInMemoryTransport>) {
+  return createEmailChannel({ transport, renderer: stubRenderer, resolveEmail });
+}
+
+describe("email channel envelope", () => {
+  test("from / replyTo / headers from channel data reach the transport", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "inbound-reply-sent",
+      title: "Re: Wasserschaden",
+      body: "Danke für Ihre Nachricht.",
+      data: {
+        subject: "Re: Wasserschaden",
+        body: "Danke für Ihre Nachricht.",
+        from: "verwaltung@haus.de",
+        replyTo: "verwaltung@haus.de",
+        headers: { "In-Reply-To": "<abc@mail>", References: "<abc@mail>" },
+      },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    expect(transport.sent).toHaveLength(1);
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.to).toBe("mieter@example.com");
+    expect(sent.from).toBe("verwaltung@haus.de");
+    expect(sent.replyTo).toBe("verwaltung@haus.de");
+    expect(sent.headers).toEqual({ "In-Reply-To": "<abc@mail>", References: "<abc@mail>" });
+  });
+
+  test("no envelope keys → transport gets none and falls back to its default From", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: { subject: "t", body: "b" },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.from).toBeUndefined();
+    expect(sent.replyTo).toBeUndefined();
+    expect(sent.headers).toBeUndefined();
+  });
+
+  test("a non-object headers value is ignored, not forwarded", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: { subject: "t", body: "b", from: 42, headers: "not-an-object" },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.from).toBeUndefined();
+    expect(sent.headers).toBeUndefined();
+  });
+});

package/src/channel-email/__tests__/pii-guard.test.ts

@@ -39,6 +39,29 @@ describe("guardEmailMessage", () => {
     expect(out.subject).toBe("Re: [pii-redacted]");
     expect(out.html).toBe("<p>[pii-redacted]</p>");
   });
+  test("ciphertext From is refused like a ciphertext recipient", () => {
+    expect(() =>
+      guardEmailMessage({ to: "ok@example.com", from: CIPHERTEXT, subject: "Hi", html: "x" }),
+    ).toThrow(/from address is a PII ciphertext/);
+  });
+
+  test("ciphertext Reply-To is refused", () => {
+    expect(() =>
+      guardEmailMessage({ to: "ok@example.com", replyTo: CIPHERTEXT, subject: "Hi", html: "x" }),
+    ).toThrow(/reply-to address is a PII ciphertext/);
+  });
+
+  test("clean message with an envelope passes through untouched", () => {
+    const msg = {
+      to: "ok@example.com",
+      from: "verwaltung@haus.de",
+      replyTo: "verwaltung@haus.de",
+      headers: { "In-Reply-To": "<abc@mail>" },
+      subject: "Hi",
+      html: "<p>Hi</p>",
+    };
+    expect(guardEmailMessage(msg)).toBe(msg);
+  });
 });
 
 describe("withPiiCiphertextGuard", () => {

package/src/channel-email/email-channel.ts

@@ -9,6 +9,26 @@ import type {
 import { guardEmailMessage } from "./pii-guard";
 import type { EmailTransport } from "./types";
 
+// Envelope (From / Reply-To / threading headers) rides on the channel data —
+// the notification's email template echoes it out of the notify() call, since
+// buildMessage collapses the raw data to the template's result. Content
+// (subject, html) is rendered; these three are copied straight to the message.
+function emailEnvelopeFrom(data: Readonly<Record<string, unknown>> | undefined): {
+  from?: string;
+  replyTo?: string;
+  headers?: Readonly<Record<string, string>>;
+} {
+  if (!data) return {};
+  const from = typeof data["from"] === "string" ? (data["from"] as string) : undefined;
+  const replyTo = typeof data["replyTo"] === "string" ? (data["replyTo"] as string) : undefined;
+  const raw = data["headers"];
+  const headers =
+    raw && typeof raw === "object" && !Array.isArray(raw)
+      ? (raw as Readonly<Record<string, string>>)
+      : undefined;
+  return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
+}
+
 export type EmailChannelOptions = {
   readonly transport: EmailTransport;
   readonly renderer: NotificationRenderer;
@@ -54,7 +74,8 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
 
     async send(address, message, _ctx, rendered) {
       const { html, subject } = rendered ?? (await renderMessage(message));
-      await transport.send(guardEmailMessage({ to: address, subject, html }));
+      const envelope = emailEnvelopeFrom(message.data);
+      await transport.send(guardEmailMessage({ to: address, subject, html, ...envelope }));
       return { status: "sent", address };
     },
   };

package/src/channel-email/pii-guard.ts

@@ -12,11 +12,19 @@ const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
 export function guardEmailMessage(message: EmailMessage): EmailMessage {
-  if (message.to.includes(CIPHERTEXT_MARKER)) {
-    throw new Error(
-      "[channel-email] refusing to send: recipient address is a PII ciphertext " +
-        `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
-    );
+  // Every envelope address, not just `to`: a ciphertext From or Reply-To is
+  // the same garbage as a ciphertext recipient — refuse rather than mail it.
+  for (const [label, address] of [
+    ["recipient", message.to],
+    ["from", message.from],
+    ["reply-to", message.replyTo],
+  ] as const) {
+    if (address?.includes(CIPHERTEXT_MARKER)) {
+      throw new Error(
+        `[channel-email] refusing to send: ${label} address is a PII ciphertext ` +
+          `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
+      );
+    }
   }
   const leaking =
     message.subject.includes(CIPHERTEXT_MARKER) || message.html.includes(CIPHERTEXT_MARKER);

package/src/channel-email/smtp-transport.ts

@@ -35,10 +35,10 @@ export type SmtpTransportOptions = {
     readonly user: string;
     readonly pass: string;
   };
-  /** Standard-From-Adresse für jede Mail. EmailMessage hat kein from-
-   *  Feld — die Auswahl gehört zur Transport-Konfig (App-weit, nicht
-   *  pro Mail). Format akzeptiert beides: "noreply@ex.com" oder
-   *  "Name <noreply@ex.com>". */
+  /** Default From-Adresse, app-weit. Eine einzelne Mail kann sie über
+   *  `EmailMessage.from` überschreiben (Reply aus einem bestimmten
+   *  Postfach); ohne Override greift diese. Format akzeptiert beides:
+   *  "noreply@ex.com" oder "Name <noreply@ex.com>". */
   readonly from: string;
 };
 
@@ -55,10 +55,12 @@ export function createSmtpTransport(options: SmtpTransportOptions): EmailTranspo
   return {
     async send(message: EmailMessage): Promise<void> {
       await transporter.sendMail({
-        from: options.from,
+        from: message.from ?? options.from,
         to: message.to,
         subject: message.subject,
         html: message.html,
+        ...(message.replyTo && { replyTo: message.replyTo }),
+        ...(message.headers && { headers: message.headers }),
       });
     },
   };

package/src/channel-email/types.ts

@@ -3,6 +3,15 @@ export type EmailMessage = {
   readonly to: string;
   readonly subject: string;
   readonly html: string;
+  // Per-message From override. Absent → the transport's configured From (the
+  // app-wide default). Set when one send must originate from a specific
+  // mailbox — a reply from the address the original mail reached, not noreply@.
+  readonly from?: string;
+  // Reply-To header: where a recipient's answer goes when it differs from From.
+  readonly replyTo?: string;
+  // Extra RFC-5322 headers — In-Reply-To / References thread a reply into the
+  // conversation it answers.
+  readonly headers?: Readonly<Record<string, string>>;
 };
 
 export type EmailTransport = {

package/src/delivery/delivery-service.ts

@@ -161,7 +161,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     // @cast-boundary engine-payload — generic query-handler return for typed convention
     return (await handler.handler(
       { type: tenantUserIdsQuery, payload: { tenantId }, user: systemUser },
-      { db: tenantDb, registry, ...bridgeStub() },
+      { db: tenantDb, dbOutsideTransaction: tenantDb, registry, ...bridgeStub() },
     )) as readonly string[];
   }
 

package/src/jobs/__tests__/job-system-user.integration.test.ts

@@ -77,6 +77,7 @@ const billingFeature = defineFeature("billing", (r) => {
         { type: "config:write:set", payload: parsed, user: systemUser },
         {
           db: tenantDb,
+          dbOutsideTransaction: tenantDb,
           registry: reg,
           configResolver: ctx["configResolver"] as ConfigResolver,
           ...bridgeStub(),
@@ -164,6 +165,7 @@ describe("SYSTEM_USER in jobs", () => {
       { type: ConfigHandlers.set, payload: parsed, user: adminUser },
       {
         db: createTenantDb(db, adminUser.tenantId, "system"),
+        dbOutsideTransaction: createTenantDb(db, adminUser.tenantId, "system"),
         registry,
         configResolver: resolver,
         ...bridgeStub(),

package/src/tenant/__tests__/multi-tenant.integration.test.ts

@@ -92,6 +92,11 @@ beforeAll(async () => {
         },
         {
           db: createTenantDb(db, "00000000-0000-4000-8000-000000000000", "system"),
+          dbOutsideTransaction: createTenantDb(
+            db,
+            "00000000-0000-4000-8000-000000000000",
+            "system",
+          ),
           registry,
           ...bridgeStub(),
         },