@cosmicdrift/kumiko-bundled-features 0.197.1 → 0.199.0

package/src/tenant/invitation-table.ts

@@ -71,7 +71,14 @@ export const tenantInvitationEntity = createEntity({
     }),
     // userId des einladenden Admins (für Audit-Trail "wer hat eingeladen").
     // Self-referencing ownerField: the field's own value IS the owner userId.
-    invitedBy: createTextField({ required: true, userOwned: { ownerField: "invitedBy" } }),
+    // lookupable: the delete-hook filters "invitations sent by this user"
+    // via the generated blind-index column instead of a full-tenant
+    // decrypt-and-scan (see user-data-rights-defaults' invitation hook).
+    invitedBy: createTextField({
+      required: true,
+      userOwned: { ownerField: "invitedBy" },
+      lookupable: true,
+    }),
     // UI-Anzeige — Wahrheit liegt in Redis-TTL.
     expiresAt: createTimestampField({ required: true }),
   },

package/src/user/__tests__/user.integration.test.ts

@@ -1,10 +1,12 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
   TestUsers,
+  testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { expectErrorIncludes, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
@@ -151,6 +153,25 @@ describe("scenario 2b: find-for-auth is system-only", () => {
     expect(body).toContain("access_denied");
     expect(body).not.toContain("must-never-leave-the-server");
   });
+
+  // The "system" role reaches find-for-auth from any tenant — user rows are
+  // tenant-agnostic identity records, not scoped to the caller's own tenant.
+  test("system caller from a different tenant still resolves the user", async () => {
+    const created = await seedUser({
+      email: "cross-tenant@example.com",
+      displayName: "CrossTenant",
+      passwordHash: "cross-tenant-hash",
+    });
+
+    const foreignSystemCaller = createSystemUser(testTenantId(99));
+    const result = await stack.http.queryOk<{ id: number } | null>(
+      UserQueries.findForAuth,
+      { email: "cross-tenant@example.com" },
+      foreignSystemCaller,
+    );
+
+    expect(result).toMatchObject({ id: created.id });
+  });
 });
 
 // --- Scenario 3: user edits own profile, email/passwordHash are system-locked ---

package/src/user/handlers/create.write.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
@@ -35,7 +35,14 @@ export const createWrite = defineWriteHandler({
   }),
   access: { roles: ["system", "SystemAdmin"] },
   handler: async (event, ctx) => {
-    const existing = await fetchOne<{ id: string }>(ctx.db, userTable, {
+    if (!ctx.systemDb) {
+      throw new InternalError({ message: "user:create requires r.systemScope()" });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(
+      "user rows are tenant-agnostic identity records; uniqueness check and create need no tenant filter",
+    );
+
+    const existing = await fetchOne<{ id: string }>(db, userTable, {
       email: event.payload.email,
     });
 
@@ -49,6 +56,6 @@ export const createWrite = defineWriteHandler({
       );
     }
 
-    return crud.create(event.payload, event.user, ctx.db);
+    return crud.create(event.payload, event.user, db);
   },
 });

package/src/user/handlers/find-for-auth.query.ts

@@ -1,5 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { userTable } from "../schema/user";
 
@@ -33,6 +34,13 @@ export const findForAuthQuery = defineQueryHandler({
         ? { email: query.payload.email }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload
 
-    return (await fetchOne(ctx.db, userTable, where)) ?? null;
+    if (!ctx.systemDb) {
+      throw new InternalError({ message: "user:find-for-auth requires r.systemScope()" });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(
+      "identity resolution for auth is intentionally cross-tenant",
+    );
+
+    return (await fetchOne(db, userTable, where)) ?? null;
   },
 });

package/src/user/handlers/me.query.ts

@@ -1,5 +1,6 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { userEntity, userTable } from "../schema/user";
 
@@ -11,5 +12,13 @@ export const meQuery = defineQueryHandler({
   name: "user:me",
   schema: z.object({}),
   access: { openToAll: true },
-  handler: async (query, ctx) => crud.detail({ id: query.user.id }, query.user, ctx.db), // @wrapper-known semantic-alias
+  handler: async (query, ctx) => {
+    if (!ctx.systemDb) {
+      throw new InternalError({ message: "user:me requires r.systemScope()" });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(
+      "user rows are tenant-agnostic identity records; self-lookup by id needs no tenant filter",
+    );
+    return crud.detail({ id: query.user.id }, query.user, db); // @wrapper-known semantic-alias
+  },
 });

package/src/user/handlers/update.write.ts

@@ -1,6 +1,10 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, hasAccess } from "@cosmicdrift/kumiko-framework/engine";
-import { AccessDeniedError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  AccessDeniedError,
+  InternalError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
@@ -51,6 +55,12 @@ export const updateWrite = defineWriteHandler({
         }),
       );
     }
-    return crud.update(event.payload, event.user, ctx.db);
+    if (!ctx.systemDb) {
+      throw new InternalError({ message: "user:update requires r.systemScope()" });
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(
+      "user rows are tenant-agnostic identity records; self/admin update needs no tenant filter",
+    );
+    return crud.update(event.payload, event.user, db);
   },
 });

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -489,11 +489,10 @@ describe("runUserExport :: tenant-invitation PII export (#1937)", () => {
     );
     expect(foreignTenantResult.isSuccess).toBe(true);
 
-    // Pins the hook boundary directly: tenantInvitationExportHook itself must
-    // hand back ciphertext, not plaintext — decryption is the central sweep's
-    // job (decryptSnippetFields in run-user-export.ts), not the hook's. If the
-    // hook ever started decrypting locally, this assertion would catch it even
-    // though the runUserExport() assertion below would stay green either way.
+    // Pins the hook boundary: invitation `email` is subject-KMS PII, not a
+    // field-encrypted column, so decryptSnippetFields would leave ciphertext
+    // in the GDPR bundle. The hook decrypts locally (same as invitations
+    // query) — assert plaintext here so a regression to raw ciphertext fails.
     const hookCtx: UserDataHookCtx = {
       db: stack.db,
       registry: stack.registry,
@@ -501,7 +500,8 @@ describe("runUserExport :: tenant-invitation PII export (#1937)", () => {
       userId: ALICE_ID,
     };
     const rawSnippet = await tenantInvitationExportHook(hookCtx);
-    expect(isPiiCiphertext(rawSnippet?.rows[0]?.["email"])).toBe(true);
+    expect(isPiiCiphertext(rawSnippet?.rows[0]?.["email"])).toBe(false);
+    expect(rawSnippet?.rows[0]?.["email"]).toBe(INVITE_EMAIL);
 
     const bundle = await runUserExport({
       db: stack.db,

package/src/user-data-rights/feature.ts

@@ -281,18 +281,21 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     r.translations({ keys: USER_DATA_RIGHTS_I18N });
 
-    // Dormant Self-Service-Screen (Art. 15/17/18/20): Export, Aktivitäts-
-    // protokoll, Einschränkung, Löschung in einem Screen. Kein r.nav — die
-    // App platziert ihn im eingeloggten Bereich. Die React-Component kommt
-    // client-seitig aus userDataRightsClient() (web/). access openToAll, weil
-    // kein App-Rollenname portabel ist; die per-User-Handler erzwingen Auth
-    // server-seitig, und der Screen ist ohne r.nav nirgends sichtbar bis die
-    // App ihn aktiv im authed-Bereich verlinkt.
+    // Dormant self-service screen (Art. 15/17/18/20): export, activity log,
+    // restriction, deletion in one screen. No r.nav — the app places it in
+    // its logged-in area. The React component comes from userDataRightsClient()
+    // (web/) client-side. access is openToAll because no app role name is
+    // portable; the per-user handlers enforce auth server-side, and the
+    // screen is invisible without r.nav until the app actively links it in
+    // its authed area. dormant: true so createKumikoApp's boot diagnostic
+    // (#2025) doesn't flag apps that haven't (yet) navved the screen as
+    // having a missing client plugin (#2034).
     r.screen({
       id: PRIVACY_CENTER_SCREEN_ID,
       type: "custom",
       renderer: { react: { __component: "PrivacyCenterScreen" } },
       access: { openToAll: true },
+      dormant: true,
     });
 
     // Magic-link path (anonymous): the email link carries the token as a

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -6,7 +6,7 @@ import {
   type UserDataExportHook,
   type UserDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
 import { userTable } from "../../user";
 import { featureMounted } from "./feature-mounted";
@@ -34,6 +34,11 @@ const crud = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEn
 
 const INVITED_BY_ANONYMIZED = "anonymized";
 
+// Bounded, not Promise.all — each decrypt hits the KMS adapter's own small
+// dedicated pool (PgKmsAdapter default max: 4). Same reasoning as
+// tenant/handlers/invitations.query.ts's KMS_POOL_CONCURRENCY.
+const KMS_POOL_CONCURRENCY = 4;
+
 async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
   if (ctx.userEmailBeforeDelete) return ctx.userEmailBeforeDelete.toLowerCase();
   const row = (await fetchOne(ctx.db, userTable, { id: ctx.userId })) as {
@@ -59,12 +64,23 @@ export const tenantInvitationExportHook: UserDataExportHook = async (ctx) => {
   if (rows.length === 0) return null;
   return {
     entity: "tenant-invitation",
-    rows: rows.map((r) => ({
-      email: r["email"],
-      role: r["role"],
-      status: r["status"],
-      expiresAt: String(r["expiresAt"] ?? ""),
-    })),
+    // Stored `email` is subject-KMS ciphertext (pii:true, not field-encrypted).
+    // decryptSnippetFields only sweeps collectEncryptedFieldNames — it would
+    // leave this as a base64 blob in the GDPR export. Decrypt here, same as
+    // invitations.query.ts and resolveUserEmail above.
+    rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, async (r) => {
+      const rawEmail = r["email"];
+      const decryptedEmail =
+        typeof rawEmail === "string"
+          ? await decryptStoredPii(rawEmail, "email", "user-data-rights:invitation-hook")
+          : rawEmail;
+      return {
+        email: decryptedEmail,
+        role: r["role"],
+        status: r["status"],
+        expiresAt: String(r["expiresAt"] ?? ""),
+      };
+    }),
   };
 };
 
@@ -98,28 +114,19 @@ export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strate
     }
   }
 
-  // `invitedBy` has no `lookupable`/blind-index column — it's ciphertext
-  // under an active KMS, so `{ invitedBy: ctx.userId }` would compare a
-  // plaintext userId against an encrypted column and always match zero
-  // rows. Load every invitation in the tenant instead (small per-tenant
-  // row count) and decrypt `invitedBy` per row to find this user's own
-  // invites-sent. See tenant/handlers/invitations.query.ts for the same
-  // decrypt-on-read pattern.
-  const tenantInvitations = await selectMany<Record<string, unknown>>(
-    ctx.db,
-    tenantInvitationsTable,
-    { tenantId: ctx.tenantId },
-  );
-  for (const row of tenantInvitations) {
+  // `invitedBy` is `lookupable` — the query compiler matches the plaintext
+  // filter value against the generated blind-index column
+  // (`invitedByBidx`), so this selects only this user's own invites-sent
+  // without loading + decrypting every invitation in the tenant. See
+  // tenant/handlers/invitations.query.ts for the same lookupable-filter
+  // pattern on `email`.
+  const inviterRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    invitedBy: ctx.userId,
+  });
+  for (const row of inviterRows) {
     const id = row["id"]; // @cast-boundary db-row
-    const invitedByRaw = row["invitedBy"];
-    if (typeof id !== "string" || typeof invitedByRaw !== "string") continue;
-    const invitedBy = await decryptStoredPii(
-      invitedByRaw,
-      "invitedBy",
-      "user-data-rights:invitation-hook",
-    );
-    if (invitedBy !== ctx.userId) continue;
+    if (typeof id !== "string") continue;
     await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, tdb, {
       skipOptimisticLock: true,
     });