@cosmicdrift/kumiko-bundled-features 0.215.0 → 0.215.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.0",
+  "version": "0.215.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.0",
-    "@cosmicdrift/kumiko-framework": "0.215.0",
-    "@cosmicdrift/kumiko-headless": "0.215.0",
-    "@cosmicdrift/kumiko-renderer": "0.215.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.0",
-    "@cosmicdrift/kumiko-types": "0.215.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.1",
+    "@cosmicdrift/kumiko-framework": "0.215.1",
+    "@cosmicdrift/kumiko-headless": "0.215.1",
+    "@cosmicdrift/kumiko-renderer": "0.215.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.215.1",
+    "@cosmicdrift/kumiko-types": "0.215.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.0"
+    "@cosmicdrift/kumiko-locale-de": "0.215.1"
   }
 }

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -15,8 +15,10 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
+  createSystemUser,
   createTextField,
   defineFeature,
   EXT_USER_DATA,
@@ -38,6 +40,8 @@ import { buildEnvConfigOverrides, createConfigResolver } from "../../config/reso
 import { configValueEntity } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
+import { tenantMembershipEntity, tenantMembershipsTable } from "../../tenant";
+import { seedTenantMembership } from "../../tenant/seeding";
 import { createUserFeature, userEntity } from "../../user";
 import { TENANT_MODEL_CONFIG_KEY } from "../constants";
 import { createUserDataRightsFeature } from "../feature";
@@ -74,6 +78,14 @@ const contributorFeature = defineFeature("dsgvo-tenant-scoped", (r) => {
   });
 });
 
+const membershipExecutor = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  {
+    entityName: "tenant-membership",
+  },
+);
+
 let stack: TestStack;
 const seed = (db: unknown) =>
   // biome-ignore lint/suspicious/noExplicitAny: dummy writer; this contributor has no binaries.
@@ -224,6 +236,69 @@ describe("forget pipeline honours the effective tenant model", () => {
     expect(result.errors).toHaveLength(0);
     expect(await rowCount()).toBe(1);
   });
+
+  test("single-user, sole live member, but a departed co-member's history remains → rows preserved (ent#346)", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c5");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    // Both memberships go through the REAL event-store executor (not the
+    // raw-INSERT seedMembership() helper) — the historical check reads
+    // `tenant-membership.created` events, so FORGET_USER needs its own
+    // `.created` event too, or the tenant would only ever show 1 distinct
+    // historical member (CO_MEMBER) even after it truly had 2.
+    // Explicit `by`: streamTenantFor(user) keys each event's OWN tenantId
+    // column off the acting user, not the payload's tenantId — the
+    // seedTenantMembership default (TestUsers.systemAdmin) lives on a
+    // different tenant, which would emit .created under the wrong tenantId
+    // and make it invisible to everHadMultipleMembers' tenant-scoped query.
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(TENANT),
+    });
+
+    // CO_MEMBER joins for real (emits tenant-membership.created) and is then
+    // removed for real (emits tenant-membership.deleted, deletes the
+    // projection row) — mirrors removeMemberWrite exactly, so the created
+    // event survives in kumiko_events even though the live row is gone.
+    const created = await seedTenantMembership(stack.db, {
+      userId: CO_MEMBER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(TENANT),
+    });
+    const deleteResult = await membershipExecutor.delete(
+      { id: created.id },
+      createSystemUser(TENANT),
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!deleteResult.isSuccess) {
+      throw new Error(`test setup: co-member delete failed: ${deleteResult.error.code}`);
+    }
+
+    // Pins the test's premise: exactly 1 live membership row, so a live-count-
+    // only check would call this tenant single-user (and the fix must reject
+    // that call via history instead).
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    // Only 1 live membership remains (FORGET_USER) — the OLD live-only check
+    // would have called this single-user and wiped the co-member's row. The
+    // historical check must still resolve multi-user here.
+    expect(await rowCount()).toBe(1);
+  });
 });
 
 describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {

package/src/user-data-rights/run-forget-cleanup.ts

@@ -38,7 +38,11 @@ import {
   type KmsAdapter,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { type DbRunner, nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
+import {
+  type DbRunner,
+  entityEventName,
+  nullBlindIndexesForSubject,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
@@ -49,6 +53,7 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -554,7 +559,37 @@ async function resolveEffectiveTenantModel(
     { tenantId },
     { limit: 2 },
   );
-  return members.length === 1 ? "single-user" : "multi-user";
+  if (members.length !== 1) return "multi-user";
+  return (await everHadMultipleMembers(db, tenantId)) ? "multi-user" : "single-user";
+}
+
+// removeMemberWrite only deletes the tenant-membership PROJECTION row — the
+// event history survives forever, and a departed member's own tenant-scoped
+// data rows (contributor-style records with no per-user column) can
+// outlive their membership (ent#346). A live count of 1 is therefore not
+// enough: a tenant that ever had >1 distinct member must stay multi-user for
+// the forget path even after everyone but one is removed, or the sole
+// remaining member's forget request wipes the departed co-member's leftover
+// rows. LIMIT chosen generously for a nominally single-user tenant; hitting
+// it is itself a multi-user signal, so it also resolves to "multi-user".
+const MAX_MEMBERSHIP_CREATED_EVENTS = 1000;
+
+async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise<boolean> {
+  const createdEvents = await selectMany<{ payload: Record<string, unknown> }>(
+    db,
+    eventsTable,
+    {
+      tenantId,
+      aggregateType: "tenant-membership",
+      type: entityEventName("tenant-membership", "created"),
+    },
+    { limit: MAX_MEMBERSHIP_CREATED_EVENTS },
+  );
+  if (createdEvents.length >= MAX_MEMBERSHIP_CREATED_EVENTS) return true;
+  const distinctUserIds = new Set(
+    createdEvents.map((e) => e.payload["userId"]).filter((v): v is string => typeof v === "string"),
+  );
+  return distinctUserIds.size > 1;
 }
 
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.