@cosmicdrift/kumiko-bundled-features 0.188.0 → 0.190.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.188.0",
+  "version": "0.190.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -67,6 +67,7 @@
     "./document-ingest-foundation": "./src/document-ingest-foundation/index.ts",
     "./file-provider-s3-env": "./src/file-provider-s3-env/index.ts",
     "./file-provider-inmemory": "./src/file-provider-inmemory/index.ts",
+    "./file-derivatives": "./src/file-derivatives/index.ts",
     "./files": "./src/files/index.ts",
     "./user-data-rights": "./src/user-data-rights/index.ts",
     "./user-data-rights/web": "./src/user-data-rights/web/index.ts",
@@ -123,12 +124,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.188.0",
-    "@cosmicdrift/kumiko-framework": "0.188.0",
-    "@cosmicdrift/kumiko-headless": "0.188.0",
-    "@cosmicdrift/kumiko-renderer": "0.188.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.188.0",
-    "@cosmicdrift/kumiko-types": "0.188.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.190.0",
+    "@cosmicdrift/kumiko-framework": "0.190.0",
+    "@cosmicdrift/kumiko-headless": "0.190.0",
+    "@cosmicdrift/kumiko-renderer": "0.190.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.190.0",
+    "@cosmicdrift/kumiko-types": "0.190.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -282,4 +282,20 @@ describe("auth flows with active KMS + blind index", () => {
     });
     expect(loginRes.status).toBe(200);
   });
+
+  test("tenant:query:invitations decrypts the invited email under active KMS (#1931)", async () => {
+    await inviteEmail(CAROL_EMAIL, "Editor");
+
+    const list = (await stack.http.queryOk(
+      "tenant:query:invitations",
+      {},
+      aliceSession(),
+    )) as Array<{ email: string; invitedBy: string; status: string }>;
+
+    expect(list).toHaveLength(1);
+    expect(isPiiCiphertext(list[0]?.email)).toBe(false);
+    expect(list[0]?.email).toBe(CAROL_EMAIL);
+    expect(isPiiCiphertext(list[0]?.invitedBy)).toBe(false);
+    expect(list[0]?.invitedBy).toBe(aliceId);
+  });
 });

package/src/file-derivatives/changes.json

@@ -0,0 +1 @@
+[]

package/src/file-derivatives/feature.ts

@@ -0,0 +1,33 @@
+// kumiko-feature-version: 1
+//
+// Same extension-point/provider-feature pattern as file-foundation — see
+// r.describe below for what this feature does. Unlike `fileProvider`,
+// renderer selection is MIME-type-deterministic, not per-tenant
+// configurable, so this feature has no `r.config` and no
+// `r.extensionSelector`.
+
+import { defineFeature, EXT_DERIVATIVE_RENDERER } from "@cosmicdrift/kumiko-framework/engine";
+
+const FEATURE_NAME = "file-derivatives";
+
+export const fileDerivativesFeature = defineFeature(FEATURE_NAME, (r) => {
+  r.describe(
+    "Declares the `derivativeRenderer` extension point. `ctx.derivatives.variant(fileRefId, spec, name)` derives a variant of a tracked FileRef the first time it's requested and reuses the stored result afterwards (derive-on-first-use, keyed by a hash of the spec). Mount at least one `derivatives-*` renderer feature alongside this one — without a registered renderer for the FileRef's MIME type, every `variant(...)` call throws.",
+  );
+  r.uiHints({
+    displayLabel: "File Derivatives",
+    category: "storage",
+    recommended: false,
+  });
+  // Needs a storage provider to read the original + write the variant —
+  // without file-foundation there's nothing to derive from or write to.
+  r.requires("file-foundation");
+
+  r.extendsRegistrar(EXT_DERIVATIVE_RENDERER, {
+    onRegister: () => {
+      // No side-effects at register-time — resolution (exact MIME match,
+      // then `<type>/*` wildcard) happens at request-time in
+      // resolveRenderer, mirrors file-foundation's fileProvider point.
+    },
+  });
+});

package/src/file-derivatives/index.ts

@@ -0,0 +1,2 @@
+export { fileDerivativesFeature } from "./feature";
+export { card, full, hero, thumb } from "./presets";

package/src/file-derivatives/presets.ts

@@ -0,0 +1,6 @@
+import type { VariantSpec } from "@cosmicdrift/kumiko-types/derivatives-types";
+
+export const thumb = { maxEdge: 160, fit: "cover", format: "webp" } as const satisfies VariantSpec;
+export const card = { maxEdge: 640, fit: "inside", format: "webp" } as const satisfies VariantSpec;
+export const hero = { maxEdge: 1600, fit: "inside", format: "webp" } as const satisfies VariantSpec;
+export const full = { maxEdge: 2560, fit: "inside", format: "webp" } as const satisfies VariantSpec;

package/src/tenant/handlers/invitations.query.ts

@@ -35,9 +35,14 @@ export const invitationsQuery = defineQueryHandler({
         typeof email === "string"
           ? await decryptStoredPii(email, "email", "tenant:invitations")
           : email;
-      // invitedBy is a plain userId (invitation-table.ts: no `pii: true`) —
-      // never encrypted at write time, so it needs no decrypt (#1252).
-      return { ...row, email: decryptedEmail };
+      const invitedBy = row["invitedBy"];
+      // `userOwned` alone marks a field as a PII subject field, so invitedBy
+      // is encrypted at write time even without `pii: true`.
+      const decryptedInvitedBy =
+        typeof invitedBy === "string"
+          ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
+          : invitedBy;
+      return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
     });
   },
 });

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -14,14 +14,18 @@
 //   - Orphan-User (0 Memberships): user-Profil-Hook laeuft trotzdem
 //     ueber Pseudo-Tenant.
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
+  configureBlindIndexKey,
   configurePiiSubjectKms,
   encryptPiiFieldValues,
   InMemoryKmsAdapter,
+  isPiiCiphertext,
 } from "@cosmicdrift/kumiko-framework/crypto";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, type UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -30,17 +34,21 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
+  resetBlindIndexKeyForTests,
   resetPiiSubjectKmsForTests,
   resetTestTables,
   seedRow,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { configValueEntity, createConfigFeature } from "../../config";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
 import { createSessionsFeature, userSessionEntity } from "../../sessions";
+import { createTenantFeature, tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
+import { tenantInvitationExportHook } from "../../user-data-rights-defaults/hooks/tenant-invitation.userdata-hook";
 import { createUserDataRightsFeature } from "../feature";
 import { runUserExport } from "../run-user-export";
 
@@ -67,6 +75,8 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       authFoundationFeature,
       createSessionsFeature(),
+      createConfigFeature(),
+      createTenantFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],
@@ -74,6 +84,8 @@ beforeAll(async () => {
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(stack.db, configValueEntity);
   await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -101,7 +113,12 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  await resetTestTables(stack.db, [userTable, "read_tenant_memberships", fileRefsTable]);
+  await resetTestTables(stack.db, [
+    userTable,
+    "read_tenant_memberships",
+    fileRefsTable,
+    tenantInvitationsTable,
+  ]);
 });
 
 const NOW = () => getTemporal().Now.instant();
@@ -365,3 +382,88 @@ describe("runUserExport :: PII-Subject-Ciphertexte (#820)", () => {
     expect(json).toContain("[encrypted:unavailable]");
   });
 });
+
+describe("runUserExport :: tenant-invitation PII export (#1937)", () => {
+  const BIDX_KEY = Buffer.alloc(32, 9).toString("base64");
+  const INVITE_EMAIL = "alice.invite@example.com";
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+  });
+
+  test("tenant-invitation export snippet contains plaintext email even though the hook does not decrypt locally", async () => {
+    // KMS + bidx MUST be configured before the executor write so the row
+    // lands encrypted with a real blind index, matching the KMS-active
+    // production shape (order matches anonymous-deletion-kms.integration.test.ts).
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    configureBlindIndexKey(BIDX_KEY);
+
+    await seedUser(ALICE_ID, { email: INVITE_EMAIL, displayName: "Alice Invite" });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    // Real executor write path — the same one tenantInvitationExportHook's
+    // sibling delete hook and the invite-create handler use — so the row
+    // carries genuine ciphertext + a real email_bidx, not a hand-seeded stand-in.
+    const invitationExecutor = createEventStoreExecutor(
+      tenantInvitationsTable,
+      tenantInvitationEntity,
+      {
+        entityName: "tenant-invitation",
+      },
+    );
+    const systemUser = createSystemUser(TENANT_A);
+    const tenantDb = createTenantDb(stack.db, TENANT_A, "system");
+    const createResult = await invitationExecutor.create(
+      {
+        email: INVITE_EMAIL,
+        role: "Member",
+        status: "pending",
+        invitedBy: ALICE_ID,
+        expiresAt: NOW().add({ seconds: 7 * 24 * 60 * 60 }),
+      },
+      systemUser,
+      tenantDb,
+    );
+    expect(createResult.isSuccess).toBe(true);
+    const invitationId = (createResult as { data: { id: string } }).data.id;
+
+    const rawRows = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
+      `SELECT email, email_bidx FROM read_tenant_invitations WHERE id = $1`,
+      [invitationId],
+    );
+    expect(isPiiCiphertext(rawRows[0]?.["email"])).toBe(true);
+    expect(String(rawRows[0]?.["email_bidx"])).toStartWith("kumiko-bidx:v1:");
+
+    // Pins the hook boundary directly: tenantInvitationExportHook itself must
+    // hand back ciphertext, not plaintext — decryption is the central sweep's
+    // job (decryptSnippetFields in run-user-export.ts), not the hook's. If the
+    // hook ever started decrypting locally, this assertion would catch it even
+    // though the runUserExport() assertion below would stay green either way.
+    const hookCtx: UserDataHookCtx = {
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: TENANT_A,
+      userId: ALICE_ID,
+    };
+    const rawSnippet = await tenantInvitationExportHook(hookCtx);
+    expect(isPiiCiphertext(rawSnippet?.rows[0]?.["email"])).toBe(true);
+
+    const bundle = await runUserExport({
+      db: stack.db,
+      registry: stack.registry,
+      userId: ALICE_ID,
+      now: NOW(),
+    });
+
+    const tenantA = bundle.tenants.find((t) => t.tenantId === TENANT_A);
+    expect(tenantA).toBeDefined();
+    // Critical check: the entity-name-keyed selectMany lookup must actually
+    // find the row via the blind-index OR-branch — a silent miss here would
+    // mean the hook found nothing and the bidx hypothesis is wrong.
+    const invitationSnippet = tenantA?.entities.find((e) => e.entity === "tenant-invitation");
+    expect(invitationSnippet).toBeDefined();
+    expect(invitationSnippet?.rows).toHaveLength(1);
+    expect(invitationSnippet?.rows[0]?.["email"]).toBe(INVITE_EMAIL);
+  });
+});