@cosmicdrift/kumiko-bundled-features 0.2.2 → 0.3.0

package/src/user-data-rights/__tests__/export-job-idempotency.integration.ts

@@ -0,0 +1,244 @@
+// ExportJob Partial-UNIQUE-Index Integration-Test (S2.U3 Atom 1b).
+//
+// Pinst die DB-Constraint die Atom-2's request-export-Handler nutzt:
+// `UNIQUE(userId) WHERE status IN ('pending', 'running')`. Pro User
+// kann es maximal EINEN aktiven Job geben — done/failed-Historie ist
+// unbeschraenkt.
+//
+// Plus DB-Roundtrip-Test fuer bigInt-Spalte (bytesWritten >2^31), der
+// in Atom 1a's pure unit-Test absichtlich ausgelassen wurde weil er
+// reale Postgres + Drizzle-customType-Codec-Path braucht.
+
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { eq, sql } from "drizzle-orm";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "vitest";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createUserFeature } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import {
+  ACTIVE_JOB_CONSTRAINT,
+  EXPORT_JOB_STATUS,
+  exportJobEntity,
+  exportJobsTable,
+} from "../schema/export-job";
+
+let stack: TestStack;
+
+const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const ALICE_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000001";
+const BOB_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000002";
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createUserDataRightsFeature(),
+    ],
+  });
+
+  await unsafeCreateEntityTable(stack.db, exportJobEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await stack.db.delete(exportJobsTable);
+});
+
+const NOW = () => getTemporal().Now.instant();
+
+// Drizzle wraps PostgresError mit "Failed query: ..."; die original
+// PG-Message ist im `cause`. Unique-Violation hat sqlstate 23505.
+//
+// Constraint-Name pinnen damit der Test nur unsere Idempotency-
+// Constraint pinst, nicht zufaellig eine andere unique-violation
+// (z.B. UUID-Kollision auf id-PK durch wiederholtes Test-Setup) —
+// silent-Pass durch fremden Constraint waere falsche Bestaetigung.
+async function expectUniqueViolation(
+  promise: Promise<unknown>,
+  expectedConstraint: string,
+): Promise<void> {
+  let caught: unknown;
+  try {
+    await promise;
+  } catch (e) {
+    caught = e;
+  }
+  expect(caught).toBeDefined();
+  const cause = (caught as { cause?: { code?: string; constraint_name?: string } }).cause;
+  expect(cause?.code).toBe("23505");
+  expect(cause?.constraint_name).toBe(expectedConstraint);
+}
+
+// Re-Export aus dem Schema — Single source of truth, Rename hier
+// braeuche kein Test-Edit.
+const IDEMPOTENCY_CONSTRAINT = ACTIVE_JOB_CONSTRAINT;
+
+async function insertJob(
+  userId: string,
+  status: string,
+  overrides: { bytesWritten?: number } = {},
+): Promise<string> {
+  const id = crypto.randomUUID();
+  const values: Record<string, unknown> = {
+    id,
+    tenantId: TENANT_SYSTEM,
+    userId,
+    requestedFromTenantId: TENANT_SYSTEM,
+    status,
+    requestedAt: NOW(),
+  };
+  if (overrides.bytesWritten !== undefined) {
+    values["bytesWritten"] = overrides.bytesWritten;
+  }
+  await stack.db.insert(exportJobsTable).values(values);
+  return id;
+}
+
+describe("ExportJob :: Partial-UNIQUE-Index", () => {
+  test("zwei pending-Jobs fuer denselben User → DB lehnt zweiten ab", async () => {
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+
+    await expectUniqueViolation(
+      insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending),
+      IDEMPOTENCY_CONSTRAINT,
+    );
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(1);
+  });
+
+  test("pending + running fuer denselben User → DB lehnt running ab", async () => {
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+
+    // Zweiter "aktiver" Status (running) ist auch gesperrt — der Index
+    // greift fuer alle Status-Werte im WHERE-Set.
+    await expectUniqueViolation(
+      insertJob(ALICE_ID, EXPORT_JOB_STATUS.Running),
+      IDEMPOTENCY_CONSTRAINT,
+    );
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(1);
+  });
+
+  test("pending fuer User A + pending fuer User B → beide erlaubt (per-User-scoped)", async () => {
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+    await insertJob(BOB_ID, EXPORT_JOB_STATUS.Pending);
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(2);
+  });
+
+  test("done + neuer pending fuer denselben User → erlaubt (Done ausserhalb des Index-Filters)", async () => {
+    // Erster Job done (Audit-Historie)
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done);
+    // Zweiter pending-Job fuer denselben User — neue Anfrage nach
+    // erfolgreichem Download
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(2);
+  });
+
+  test("failed + neuer pending fuer denselben User → erlaubt (Retry-Pfad)", async () => {
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Failed);
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(2);
+  });
+
+  test("zwei done-Jobs fuer denselben User → erlaubt (Audit-Historie)", async () => {
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done);
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done);
+
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(2);
+  });
+
+  test("Lifecycle: pending → running blockt weitere pending-Inserts; nach running → done wieder erlaubt", async () => {
+    // Alice pending insert
+    const aliceJobId = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+    // Worker pickt auf — Status flip
+    await stack.db
+      .update(exportJobsTable)
+      .set({ status: EXPORT_JOB_STATUS.Running })
+      .where(eq(exportJobsTable.id, aliceJobId));
+
+    // Zweiter pending-Insert fuer Alice → faellt weiter, weil bestehender
+    // Job in running auch im Index-Filter ist.
+    await expectUniqueViolation(
+      insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending),
+      IDEMPOTENCY_CONSTRAINT,
+    );
+
+    // Aber wenn der running-Job fertig wird (done), darf User wieder pending starten
+    await stack.db
+      .update(exportJobsTable)
+      .set({ status: EXPORT_JOB_STATUS.Done })
+      .where(eq(exportJobsTable.id, aliceJobId));
+
+    await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Pending);
+    const rows = await stack.db.select().from(exportJobsTable);
+    expect(rows).toHaveLength(2);
+  });
+});
+
+describe("ExportJob :: bigInt bytesWritten DB-Roundtrip", () => {
+  test("bytesWritten >2^31 schreibt + liest identisch zurueck", async () => {
+    const TWO_GB_PLUS = 3_000_000_000; // ~2.8 GB, weit ueber integer-Cap
+    const id = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done, {
+      bytesWritten: TWO_GB_PLUS,
+    });
+
+    const [row] = await stack.db
+      .select({ bytesWritten: exportJobsTable["bytesWritten"] })
+      .from(exportJobsTable)
+      .where(eq(exportJobsTable["id"], id));
+
+    expect(row?.bytesWritten).toBe(TWO_GB_PLUS);
+  });
+
+  test("bytesWritten 2^50 (~1 PB) schreibt + liest identisch zurueck", async () => {
+    const ONE_PB_PLUS = 2 ** 50;
+    const id = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done, {
+      bytesWritten: ONE_PB_PLUS,
+    });
+
+    const [row] = await stack.db
+      .select({ bytesWritten: exportJobsTable["bytesWritten"] })
+      .from(exportJobsTable)
+      .where(eq(exportJobsTable["id"], id));
+
+    expect(row?.bytesWritten).toBe(ONE_PB_PLUS);
+  });
+
+  test("bytesWritten als raw-SQL geprueft → DB-Spalte ist tatsaechlich BIGINT", async () => {
+    const id = await insertJob(ALICE_ID, EXPORT_JOB_STATUS.Done, {
+      bytesWritten: 1,
+    });
+    // information_schema-Lookup pinst den DB-Typ unabhaengig vom JS-
+    // Driver-Mapping — wenn jemand `case "bigInt"` zu `integer` zurueck-
+    // refactored, faellt dieser Test um obwohl die JS-Werte sich
+    // numerisch verhalten.
+    const result = await stack.db.execute(sql`
+      SELECT data_type FROM information_schema.columns
+      WHERE table_name = 'read_export_jobs' AND column_name = 'bytes_written'
+    `);
+    // biome-ignore lint/suspicious/noExplicitAny: drizzle-execute typing
+    const rows = ((result as any).rows ?? result) as Array<{ data_type: string }>;
+    expect(rows[0]?.data_type).toBe("bigint");
+    void id;
+  });
+});

package/src/user-data-rights/__tests__/export-job-schema.test.ts

@@ -0,0 +1,163 @@
+// Drift-Guard fuer ExportJob-Schema (S2.U3+U4 Atom 1).
+//
+// Pinst dass:
+//   - EXPORT_JOB_STATUS Constants stabil bleiben (Worker-State-Machine
+//     + UI-Polling lesen die Werte als Magic-Strings, jede Aenderung
+//     ist ein Breaking-Change).
+//   - Export-Konstanten haben sinnvolle Werte (TTL > 0, Stale-Timeout
+//     > 0, Cleanup-Grace > 0).
+//   - exportJobEntity hat alle Felder die Worker + Handler erwarten —
+//     wenn jemand `expiresAt` umbenennt, faellt dieser Test um statt
+//     der Worker erst in Production.
+//
+// Schema-Snapshot, kein Behavior-Test. Behavior-Tests kommen mit Atom 2
+// (request-export.write.ts) + Atom 3 (Worker).
+
+import { COMPLIANCE_PROFILES } from "@cosmicdrift/kumiko-framework/compliance";
+import { describe, expect, test } from "vitest";
+import { EXPORT_JOB_STATUS, exportJobEntity } from "../schema/export-job";
+
+describe("EXPORT_JOB_STATUS Drift-Guard", () => {
+  test("hat genau 4 Werte (pending/running/done/failed)", () => {
+    const values = Object.values(EXPORT_JOB_STATUS);
+    expect(values).toHaveLength(4);
+    expect(values).toContain("pending");
+    expect(values).toContain("running");
+    expect(values).toContain("done");
+    expect(values).toContain("failed");
+  });
+
+  test("Status-Strings sind lowercase + nur a-z (Convention-Check, keine Sortier-Aussage)", () => {
+    // Test-Name ist bewusst praezise: wir checken Format, NICHT
+    // alphabetische Sortierung — die State-Machine kuemmert sich nicht
+    // um Sort-Order, ein Re-Order der Konstanten waere kein Bug.
+    for (const value of Object.values(EXPORT_JOB_STATUS)) {
+      expect(value).toBe(value.toLowerCase());
+      expect(value).toMatch(/^[a-z]+$/);
+    }
+  });
+});
+
+describe("Export-Konfig in compliance-profiles", () => {
+  // Atom 1c: TTL-Konstanten wandern aus user-data-rights/constants.ts
+  // ins compliance-profile.userRights — pro Profile konfigurierbar +
+  // per-Tenant-Override. Tests pinnen dass die Defaults pro Profile
+  // sinnvoll sind.
+
+  for (const profileKey of [
+    "eu-dsgvo",
+    "swiss-dsg",
+    "de-hr-dsgvo-hgb",
+    "minimal-no-region",
+  ] as const) {
+    test(`${profileKey}: exportDownloadTtl gesetzt + > 0`, () => {
+      const profile = COMPLIANCE_PROFILES[profileKey];
+      const ttl = profile.userRights.exportDownloadTtl;
+      expect(ttl).toBeDefined();
+      // DurationSpec hat entweder days oder hours.
+      const hasDuration = ("days" in ttl && ttl.days > 0) || ("hours" in ttl && ttl.hours > 0);
+      expect(hasDuration).toBe(true);
+    });
+
+    test(`${profileKey}: exportStaleTimeoutMinutes > 0`, () => {
+      expect(COMPLIANCE_PROFILES[profileKey].userRights.exportStaleTimeoutMinutes).toBeGreaterThan(
+        0,
+      );
+    });
+
+    test(`${profileKey}: exportStorageCleanupGraceHours > 0`, () => {
+      expect(
+        COMPLIANCE_PROFILES[profileKey].userRights.exportStorageCleanupGraceHours,
+      ).toBeGreaterThan(0);
+    });
+  }
+
+  test("eu-dsgvo Default-TTL ist 7 Tage (sanity-Pin)", () => {
+    expect(COMPLIANCE_PROFILES["eu-dsgvo"].userRights.exportDownloadTtl).toEqual({
+      days: 7,
+    });
+  });
+
+  test("Download-TTL <= 30d in jedem Profile (DSGVO-Auskunftsfrist als sanity-cap)", () => {
+    // Auskunftsfrist ist 30d — Download laenger zu halten als die
+    // Antwort-Pflicht macht keinen Sinn.
+    for (const profileKey of [
+      "eu-dsgvo",
+      "swiss-dsg",
+      "de-hr-dsgvo-hgb",
+      "minimal-no-region",
+    ] as const) {
+      const ttl = COMPLIANCE_PROFILES[profileKey].userRights.exportDownloadTtl;
+      const days = "days" in ttl ? ttl.days : Math.ceil(ttl.hours / 24);
+      expect(days).toBeLessThanOrEqual(30);
+    }
+  });
+});
+
+describe("exportJobEntity Schema-Shape", () => {
+  test("hat alle Worker-relevanten Felder", () => {
+    const fieldNames = Object.keys(exportJobEntity.fields);
+    expect(fieldNames).toEqual(
+      expect.arrayContaining([
+        "userId",
+        "requestedFromTenantId",
+        "status",
+        "requestedAt",
+        "startedAt",
+        "completedAt",
+        "downloadStorageKey",
+        "expiresAt",
+        "errorMessage",
+        "bytesWritten",
+      ]),
+    );
+  });
+
+  test("Tabellen-Name ist read_export_jobs (snake_case-Convention)", () => {
+    expect(exportJobEntity.table).toBe("read_export_jobs");
+  });
+
+  test("status-Default ist pending (neue Job-Rows starten dort)", () => {
+    const statusField = exportJobEntity.fields["status"];
+    expect(statusField).toBeDefined();
+    if (statusField && "default" in statusField) {
+      expect(statusField.default).toBe(EXPORT_JOB_STATUS.Pending);
+    }
+  });
+
+  test("status-Optionen matchen die EXPORT_JOB_STATUS-Constants", () => {
+    const statusField = exportJobEntity.fields["status"];
+    if (statusField && "options" in statusField) {
+      const options = (statusField as { options: readonly string[] }).options;
+      expect([...options].sort()).toEqual(Object.values(EXPORT_JOB_STATUS).slice().sort());
+    }
+  });
+
+  test("bytesWritten ist bigInt-Field (NICHT number) — pinst Atom-1b-Migration", () => {
+    // Drift-Guard: wenn jemand zurueck auf createNumberField refactored,
+    // faellt der DB-Roundtrip-Test um (gut), aber das dauert >1s. Hier
+    // <1s + klare Fehlermeldung was das Problem ist.
+    expect(exportJobEntity.fields.bytesWritten.type).toBe("bigInt");
+  });
+
+  test("userId + requestedFromTenantId + status + requestedAt sind required", () => {
+    expect(exportJobEntity.fields["userId"]?.required).toBe(true);
+    // requestedFromTenantId ist load-bearing: Atom 3b's Worker liest es
+    // fuer Profile-Resolution. Ohne required wuerde ein Insert ohne
+    // Wert silent NULL setzen + der Worker crashed bei queryAs(systemUserOf(null), ...).
+    expect(exportJobEntity.fields["requestedFromTenantId"]?.required).toBe(true);
+    expect(exportJobEntity.fields["status"]?.required).toBe(true);
+    expect(exportJobEntity.fields["requestedAt"]?.required).toBe(true);
+  });
+
+  test("Lifecycle-Felder sind nullable (startedAt/completedAt/expiresAt/errorMessage/bytesWritten/downloadStorageKey)", () => {
+    // Diese Felder werden vom Worker gesetzt, sind beim Insert null.
+    // required ist undefined oder false — beides bedeutet nullable.
+    expect(exportJobEntity.fields.startedAt.required).not.toBe(true);
+    expect(exportJobEntity.fields.completedAt.required).not.toBe(true);
+    expect(exportJobEntity.fields.expiresAt.required).not.toBe(true);
+    expect(exportJobEntity.fields.errorMessage.required).not.toBe(true);
+    expect(exportJobEntity.fields.bytesWritten.required).not.toBe(true);
+    expect(exportJobEntity.fields.downloadStorageKey.required).not.toBe(true);
+  });
+});

package/src/user-data-rights/__tests__/policy-to-strategy.test.ts

@@ -0,0 +1,30 @@
+// Unit-Test fuer policyToStrategy — die Mapping-Tafel zwischen
+// retention-strategy und user-data-rights-Forget-Strategy. Load-bearing
+// weil es entscheidet ob Daten physisch geloescht oder anonymisiert
+// werden. Memory `feedback_no_fake_tests`: das Mapping IST die Logik,
+// nicht ein Detail.
+
+import { describe, expect, test } from "vitest";
+import { policyToStrategy } from "../run-forget-cleanup";
+
+describe("policyToStrategy", () => {
+  test("hardDelete → delete (Default-Pfad: Row physisch entfernen)", () => {
+    expect(policyToStrategy("hardDelete")).toBe("delete");
+  });
+
+  test("softDelete → delete (Row markieren via softDelete-Mechanik des Frameworks)", () => {
+    expect(policyToStrategy("softDelete")).toBe("delete");
+  });
+
+  test("anonymize → anonymize (Row bleibt, PII raus)", () => {
+    expect(policyToStrategy("anonymize")).toBe("anonymize");
+  });
+
+  test("blockDelete → anonymize (Aufbewahrungs-Pflicht respektieren, Row bleibt physisch)", () => {
+    expect(policyToStrategy("blockDelete")).toBe("anonymize");
+  });
+
+  test("null (keine Policy konfiguriert) → delete (Default = Row weg)", () => {
+    expect(policyToStrategy(null)).toBe("delete");
+  });
+});