@cosmicdrift/kumiko-bundled-features 0.195.0 → 0.196.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.195.0",
+  "version": "0.196.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -125,12 +125,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.195.0",
-    "@cosmicdrift/kumiko-framework": "0.195.0",
-    "@cosmicdrift/kumiko-headless": "0.195.0",
-    "@cosmicdrift/kumiko-renderer": "0.195.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.195.0",
-    "@cosmicdrift/kumiko-types": "0.195.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.196.1",
+    "@cosmicdrift/kumiko-framework": "0.196.1",
+    "@cosmicdrift/kumiko-headless": "0.196.1",
+    "@cosmicdrift/kumiko-renderer": "0.196.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.196.1",
+    "@cosmicdrift/kumiko-types": "0.196.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",

package/src/file-derivatives/__tests__/public-variant-query-gating.integration.test.ts

@@ -0,0 +1,39 @@
+// Proves #1977/2: createFileDerivativesFeature() mounted WITHOUT
+// resolveApexTenant must not expose `publicVariant` via ANY path — not just
+// "the httpRoute isn't mounted" (already true before the fix), but also not
+// via the generic `/api/query` dispatch an anonymous, host-only-scoped
+// consumer can reach. Before the fix, `r.queryHandler(publicVariantQuery)`
+// ran unconditionally, registering the handler into the feature's dispatch
+// table as a side effect regardless of what its return value was used for
+// — so `PUBLIC_VARIANT_QN` was dispatchable even with no resolveApexTenant,
+// and `ctx.user.tenantId` then came from anonymousAccess resolution instead
+// of the host, bypassing the "tenantId only from the host" invariant.
+
+import { describe, expect, test } from "bun:test";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
+import { createConfigFeature } from "../../config";
+import { fileFoundationFeature } from "../../file-foundation";
+import { createFileDerivativesFeature } from "../feature";
+import { PUBLIC_VARIANT_QN } from "../handlers/public-variant.query";
+
+describe("file-derivatives :: publicVariant query gating without resolveApexTenant", () => {
+  test("PUBLIC_VARIANT_QN is not dispatchable via the generic /api/query path — 404, same as any unknown query", async () => {
+    const stack: TestStack = await setupTestStack({
+      features: [createConfigFeature(), fileFoundationFeature, createFileDerivativesFeature()],
+      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
+    });
+
+    try {
+      const res = await stack.http.raw("POST", "/api/query", {
+        type: PUBLIC_VARIANT_QN,
+        payload: { fileRefId: "00000000-0000-4000-8000-000000000000", variant: "thumb" },
+      });
+
+      expect(res.status).toBe(404);
+      expect(stack.registry.getQueryHandler(PUBLIC_VARIANT_QN)).toBeUndefined();
+    } finally {
+      await stack.cleanup();
+    }
+  });
+});

package/src/file-derivatives/feature.ts

@@ -44,8 +44,10 @@ export type PublicVariantResolveApexTenant = (
 
 export type FileDerivativesOptions = {
   /** Host → tenantId for the anonymous `/media/:fileRefId/:variant` route.
-   *  Without this option the route is NOT mounted — existing consumers that
-   *  only need `ctx.derivatives` are unaffected. */
+   *  Without this option, neither the httpRoute NOR the `publicVariant`
+   *  query is registered — it is unreachable via the httpRoute path and via
+   *  the generic `/api` query dispatch. Existing consumers that only need
+   *  `ctx.derivatives` are unaffected. */
   readonly resolveApexTenant?: PublicVariantResolveApexTenant;
   /** Base path of the public variant route. Default "/media". */
   readonly basePath?: string;
@@ -102,11 +104,21 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
       },
     });
 
-    const queries = { publicVariant: r.queryHandler(publicVariantQuery) };
+    // Registered ONLY when resolveApexTenant is supplied — r.queryHandler
+    // registers publicVariantQuery into the feature's dispatch table as a
+    // side effect of being called, independent of what's done with its
+    // return value. Calling it unconditionally would make `publicVariant`
+    // (access: ["anonymous", ...]) reachable via the generic `/api` query
+    // dispatch even when the httpRoute below isn't mounted, bypassing the
+    // "tenantId comes from the host, never the payload" invariant that only
+    // `resolveApexTenant` enforces.
+    const queries: { publicVariant?: ReturnType<typeof r.queryHandler> } = {};
 
     if (opts.resolveApexTenant) {
       const resolveApexTenant = opts.resolveApexTenant;
 
+      queries.publicVariant = r.queryHandler(publicVariantQuery);
+
       r.httpRoute({
         method: "GET",
         path: `${basePath}/:fileRefId/:variant`,

package/src/form-draft/__tests__/cleanup.integration.test.ts

@@ -10,7 +10,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { qn, type TenantId, toKebab } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createInMemoryFileProvider,
@@ -30,7 +30,7 @@ import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory, createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
-import { FormDraftHandlers } from "../constants";
+import { FORM_DRAFT_FEATURE_NAME, FormDraftHandlers } from "../constants";
 import { formDraftEntity } from "../entity";
 import { formDraftFeature } from "../feature";
 import { FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY } from "../handlers/cleanup.job";
@@ -164,6 +164,18 @@ async function dispatchCleanup(): Promise<void> {
 }
 
 describe("form-draft cleanup job", () => {
+  // FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY (cleanup.job.ts) is a hardcoded
+  // literal that must match the qualified name r.config({ keys: {
+  // retentionDays: ... } }) derives internally in feature.ts — nothing
+  // else ties the two together, so a rename of the `retentionDays` config
+  // key there would silently desync them. This recomputes the derivation
+  // and fails loudly if that ever happens.
+  test("FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY matches the qualified name feature.ts derives for retentionDays", () => {
+    expect(FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY).toBe(
+      qn(toKebab(FORM_DRAFT_FEATURE_NAME), "config", toKebab("retentionDays")),
+    );
+  });
+
   test("deletes a draft older than the default retention window, leaves a fresh one alone", async () => {
     await saveDraft("wizard:old");
     await backdate("wizard:old", 31);

package/src/form-draft/__tests__/discard-file-refs.integration.test.ts

@@ -187,4 +187,34 @@ describe("form-draft discard — FileRef release", () => {
 
     expect(provider.keys()).toContain(key);
   });
+
+  // fw#1922: a released FileRef must go through the fileRef executor
+  // (fileRef.forgotten event), not a raw provider.delete() that bypasses
+  // the event store; the file_refs row itself must be purged, not just
+  // the storage binary.
+  test("discarding with releaseFiles: true hard-purges the file_refs row through the event store, not just the storage binary", async () => {
+    const key = "tenant/vehicle/photo/row-purge.jpg";
+    await saveDraft("wizard:row-purge", {});
+    await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
+    await seedFileRef(key);
+    await saveDraft("wizard:row-purge", { photo: fileRefPointer(key) });
+
+    const before = await asRawClient(stack.db).unsafe(
+      `SELECT "id" FROM "file_refs" WHERE "storage_key" = $1`,
+      [key],
+    );
+    expect(before).toHaveLength(1);
+
+    await discardDraft("wizard:row-purge", true);
+
+    const after = await asRawClient(stack.db).unsafe(
+      `SELECT "id" FROM "file_refs" WHERE "storage_key" = $1`,
+      [key],
+    );
+    expect(after).toHaveLength(0);
+    const forgottenEvents = await asRawClient(stack.db).unsafe(
+      `SELECT "type" FROM "kumiko_events" WHERE "aggregate_type" = 'fileRef' AND "type" = 'fileRef.forgotten'`,
+    );
+    expect(forgottenEvents.length).toBeGreaterThan(0);
+  });
 });

package/src/form-draft/db/queries/owned-file-refs.ts

@@ -25,13 +25,32 @@ export async function filterOwnedStorageKeys(
   candidateKeys: readonly string[],
   draftInsertedAt: Temporal.Instant,
 ): Promise<readonly string[]> {
+  const rows = await filterOwnedFileRefs(db, tenantId, ownerId, candidateKeys, draftInsertedAt);
+  return rows.map((row) => row.storageKey);
+}
+
+// Same ownership boundary as filterOwnedStorageKeys, but also returns the
+// file_refs row id — a hard-erasure call (executor.forget) addresses the
+// row by id, not by storageKey.
+export type OwnedFileRef = {
+  readonly id: string;
+  readonly storageKey: string;
+};
+
+export async function filterOwnedFileRefs(
+  db: DbRunner,
+  tenantId: TenantId,
+  ownerId: string,
+  candidateKeys: readonly string[],
+  draftInsertedAt: Temporal.Instant,
+): Promise<readonly OwnedFileRef[]> {
   if (candidateKeys.length === 0) return [];
   const rows = (await asRawClient(db).unsafe(
-    `SELECT "storage_key" FROM "file_refs"
+    `SELECT "id", "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
        AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
        AND "inserted_at" > $4::timestamptz`,
     [tenantId, ownerId, candidateKeys, draftInsertedAt.toString()],
-  )) as readonly { storage_key: string }[];
-  return rows.map((row) => row.storage_key);
+  )) as readonly { id: string; storage_key: string }[];
+  return rows.map((row) => ({ id: row.id, storageKey: row.storage_key }));
 }

package/src/form-draft/handlers/cleanup.job.ts

@@ -142,8 +142,16 @@ export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
         db,
       )
     : undefined;
-  const retentionDays =
-    typeof resolved === "number" && resolved >= 1 ? resolved : FORM_DRAFT_DEFAULT_RETENTION_DAYS;
+  const isValidRetention = typeof resolved === "number" && resolved >= 1;
+  // configResolver missing is the legitimate no-config case (r.optionalRequires,
+  // see feature.ts) — nothing to warn about there. A resolver that IS wired but
+  // returns something unusable means an admin set an invalid value.
+  if (ctx.configResolver && !isValidRetention) {
+    ctx.log?.warn?.(
+      `[form-draft:cleanup] configResolver returned invalid retention-days value=${String(resolved)} — falling back to default=${FORM_DRAFT_DEFAULT_RETENTION_DAYS}`,
+    );
+  }
+  const retentionDays = isValidRetention ? resolved : FORM_DRAFT_DEFAULT_RETENTION_DAYS;
 
   const fileProviderResolver = ctx._fileProviderResolver;
 

package/src/form-draft/handlers/discard.write.ts

@@ -1,11 +1,22 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { FORM_DRAFT_ACCESS } from "../constants";
-import { filterOwnedStorageKeys } from "../db/queries/owned-file-refs";
+import { filterOwnedFileRefs } from "../db/queries/owned-file-refs";
 import { formDraftExecutor } from "../executor";
 import { lookupDraft } from "../lookup";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs";
 import { discardDraftPayloadSchema } from "../schemas";
 
+// Same construction as file-routes.ts/user-data-rights-defaults' fileRef
+// hook — self-contained (table + entity), no registry needed. `.forget()`
+// hard-deletes the file_refs row via a `fileRef.forgotten` event (rebuild-
+// safe), unlike a raw storage-provider delete which never touches the row
+// at all (see the ES-bypass this replaces below).
+const fileRefExecutor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
+  entityName: "fileRef",
+});
+
 // discard — the caller's own draft only. Ownership is enforced by the
 // lookup predicate (tenantId + ownerId + draftKey), not by a separate
 // permission check: a foreign user's discard call for someone else's
@@ -42,14 +53,28 @@ export const discardDraftWrite = defineWriteHandler({
       // releasable — `values` is free-form JSON the caller controls, so an
       // unverified key could target someone else's file (see
       // db/queries/owned-file-refs.ts).
-      const ownedKeys = await filterOwnedStorageKeys(
+      const ownedRefs = await filterOwnedFileRefs(
         ctx.db.raw,
         event.user.tenantId,
         ownerId,
         candidateKeys,
         existing.insertedAt,
       );
-      await releaseDraftFileRefs(ownedKeys, (key) => files.ref(key).delete(), ctx.log);
+      const refsByStorageKey = new Map(ownedRefs.map((ref) => [ref.storageKey, ref]));
+      await releaseDraftFileRefs(
+        ownedRefs.map((ref) => ref.storageKey),
+        async (key) => {
+          // Hard-erase via the executor first (fileRef.forgotten — row +
+          // event, rebuild-safe), then the binary. A raw provider.delete()
+          // alone left the file_refs row behind forever (kumiko-framework
+          // review #1922): no event, no projection update, the row just
+          // pointed at a storage key that no longer existed.
+          const ref = refsByStorageKey.get(key);
+          if (ref !== undefined) await fileRefExecutor.forget({ id: ref.id }, event.user, ctx.db);
+          await files.ref(key).delete();
+        },
+        ctx.log,
+      );
     }
     return { isSuccess: true as const, data: { discarded: true } };
   },

package/src/ledger/index.ts

@@ -35,6 +35,7 @@ export {
   reverseTransactionHandler,
 } from "./handlers/reverse-transaction.write";
 export {
+  findReversedIds,
   type LedgerTxRow,
   mergeScheduleActuals,
   type ProjectedPeriod,