@cosmicdrift/kumiko-bundled-features 0.202.0 → 0.203.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.202.0",
+  "version": "0.203.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.202.0",
-    "@cosmicdrift/kumiko-framework": "0.202.0",
-    "@cosmicdrift/kumiko-headless": "0.202.0",
-    "@cosmicdrift/kumiko-renderer": "0.202.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.202.0",
-    "@cosmicdrift/kumiko-types": "0.202.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.203.0",
+    "@cosmicdrift/kumiko-framework": "0.203.0",
+    "@cosmicdrift/kumiko-headless": "0.203.0",
+    "@cosmicdrift/kumiko-renderer": "0.203.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.203.0",
+    "@cosmicdrift/kumiko-types": "0.203.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -8,7 +8,7 @@
 //   - Member role → 403 (DPO/SystemAdmin only)
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   buildEntityTable,
@@ -28,8 +28,21 @@ import {
   TestUsers,
   testTenantId,
   unsafeCreateEntityTable,
+  unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "temporal-polyfill";
+import { authFoundationFeature } from "../../auth-foundation";
+import { createConfigFeature } from "../../config";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens/feature";
+import { apiTokenEntity, apiTokenTable } from "../../personal-access-tokens/schema/api-token";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { seedUser } from "../../user/seeding";
 import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 
@@ -283,3 +296,86 @@ describe("crypto-shredding :: forget-subject purges the derived search index (#1
     expect(after.some((h) => String(h.entityId) === id)).toBe(false);
   });
 });
+
+// The P2 audit finding: forget-subject shredded the DEK but left status +
+// PATs untouched — a forgotten user's credentials stayed live (PAT resolver
+// checks revokedAt/expiresAt, never user.status). Own stack with user +
+// personal-access-tokens mounted (the handler's user-lifecycle + PAT-revoke
+// branches guard on those features).
+describe("crypto-shredding :: forget-subject closes the login door (user feature mounted)", () => {
+  let stack: TestStack;
+  let kms: InMemoryKmsAdapter;
+  const TENANT_B = testTenantId(3);
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [
+        createCryptoShreddingFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createConfigFeature(),
+        authFoundationFeature,
+        createPersonalAccessTokensFeature({ scopes: {} }),
+      ],
+    });
+    await unsafeCreateEntityTable(stack.db, userEntity);
+    await unsafeCreateEntityTable(stack.db, apiTokenEntity);
+    // tenant feature's only lookupable entity — the blind-index sweep
+    // touches it; without the table the handler 500s on `read_tenant_invitations`.
+    await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+    await unsafePushTables(stack.db, { tenantMembershipsTable });
+    await createEventsTable(stack.db);
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await resetTestTables(stack.db, [
+      userTable,
+      apiTokenTable,
+      tenantMembershipsTable,
+      eventsTable,
+    ]);
+    kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("user forget flips status to Deleted and revokes existing PATs", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "forgotten@example.com",
+      displayName: "Forgotten User",
+      emailVerified: true,
+    });
+    // No explicit createKey: seedUser's PII-encrypt (email) already created
+    // the subject key implicitly via getOrCreateDek.
+    await insertOne(stack.db, apiTokenTable, {
+      id: generateId(),
+      userId,
+      tenantId: TENANT_B,
+      name: "legacy-pat",
+      tokenHash: "a".repeat(64),
+      prefix: "ktest",
+      scopes: "[]",
+      createdAt: Temporal.Now.instant(),
+    });
+
+    await stack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).toBe(USER_STATUS.Deleted);
+
+    const tokens = await selectMany(stack.db, apiTokenTable, { userId });
+    expect(tokens).toHaveLength(1);
+    expect(tokens[0]?.["revokedAt"]).not.toBeNull();
+  });
+});

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -10,6 +10,9 @@ import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { z } from "zod";
+import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
+import { USER_STATUS } from "../../user";
+import { updateUserLifecycle } from "../../user-data-rights";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 
 export const subjectIdSchema = z.discriminatedUnion("kind", [
@@ -70,10 +73,10 @@ export const forgetSubjectWrite = defineWriteHandler({
       eraseReason: event.payload.reason,
     });
 
-    // Blind-Index-Sweep (#818): bidx-Spalten des erased Subjects sofort
-    // nullen — sonst bliebe der deterministische HMAC bis zum nächsten
-    // Rebuild equality-matchbar. Bewusst ctx.db.raw: der Ciphertext-Prefix
-    // adressiert das Subject tenant-übergreifend.
+    // Blind-index sweep (#818): null the erased subject's bidx columns now —
+    // otherwise the deterministic HMAC stays equality-matchable until the next
+    // rebuild. Deliberately ctx.db.raw: the ciphertext prefix addresses the
+    // subject across tenants.
     await nullBlindIndexesForSubject(ctx.db.raw, ctx.registry.features, subjectKey);
 
     // Derived search index still holds plaintext (#1610) — purge next to the
@@ -88,6 +91,28 @@ export const forgetSubjectWrite = defineWriteHandler({
       );
     }
 
+    // User subject: close the login door. DEK-erase makes the passwordHash
+    // ciphertext unreadable, but status + PATs are standalone credentials —
+    // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
+    // (resolver.ts). Without this block a forgotten user with a live PAT stays
+    // callable. Mirror of the automated Art.-17 path (userDeleteHook:
+    // status=Deleted; apiTokenDeleteHook: revoke):
+    //   - user.updated as lifecycle event (updateUserLifecycle), so a
+    //     read_users rebuild doesn't wipe the flip (#494)
+    //   - sessions don't need active revocation — session-callbacks
+    //     re-validate user.status on every request (isPrincipalBlocked
+    //     blocks Deleted).
+    // Both idempotent (status set / revokedAt IS NULL filter), retry after
+    // crash recovery is safe. User-feature guard: without the user feature
+    // read_users doesn't exist (crypto-only stack). Tenant subjects have no
+    // credentials.
+    if (raw.kind === "user" && ctx.registry.features.has("user")) {
+      await updateUserLifecycle(ctx.db.raw, raw.userId, { status: USER_STATUS.Deleted });
+      if (ctx.registry.features.has("personal-access-tokens")) {
+        await revokeAllPatTokensForUser(ctx.db.raw, raw.userId);
+      }
+    }
+
     await ctx.unsafeAppendEvent({
       aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
       aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,

package/src/personal-access-tokens/revoke-for-user.ts

@@ -1,5 +1,5 @@
 import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "temporal-polyfill";
 import { apiTokenTable } from "./schema/api-token";
 
@@ -7,7 +7,7 @@ import { apiTokenTable } from "./schema/api-token";
 // level security events, not scoped to one tenant. Mirrors sessions'
 // sessionMassRevoker (session-callbacks.ts) which passes the boot-time
 // DbConnection directly — not ctx.db, which would be tenant-scoped in a hook.
-export async function revokeAllPatTokensForUser(db: DbConnection, userId: string): Promise<number> {
+export async function revokeAllPatTokensForUser(db: DbRunner, userId: string): Promise<number> {
   const updated = await updateMany<{ id: string }>(
     db,
     apiTokenTable,

package/src/user-data-rights/index.ts

@@ -2,7 +2,7 @@ export { createUserDataRightsFeature, type UserDataRightsOptions } from "./featu
 export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write";
 // #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
 // von read_users-Rebuilds (siehe lib-Doc).
-export { backfillUserLifecycleEvents } from "./lib/update-user-lifecycle";
+export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle";
 export type {
   SendExportFailedEmailFn,
   SendExportReadyEmailFn,