@cosmicdrift/kumiko-bundled-features 0.215.0 → 0.215.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.0",
+  "version": "0.215.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.0",
-    "@cosmicdrift/kumiko-framework": "0.215.0",
-    "@cosmicdrift/kumiko-headless": "0.215.0",
-    "@cosmicdrift/kumiko-renderer": "0.215.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.0",
-    "@cosmicdrift/kumiko-types": "0.215.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.2",
+    "@cosmicdrift/kumiko-framework": "0.215.2",
+    "@cosmicdrift/kumiko-headless": "0.215.2",
+    "@cosmicdrift/kumiko-renderer": "0.215.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.215.2",
+    "@cosmicdrift/kumiko-types": "0.215.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.0"
+    "@cosmicdrift/kumiko-locale-de": "0.215.2"
   }
 }

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -40,6 +40,7 @@ import { apiTokenEntity, apiTokenTable } from "../../personal-access-tokens/sche
 import { createTenantFeature } from "../../tenant";
 import { tenantInvitationEntity } from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { seedTenantMembership } from "../../tenant/seeding";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { seedUser } from "../../user/seeding";
@@ -116,20 +117,47 @@ describe("crypto-shredding :: forget-subject", () => {
     });
   });
 
-  test("tenant subject shreds the same way", async () => {
-    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
-    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+  test("tenant subject shreds the same way (DPO's own tenant)", async () => {
+    const subject = { kind: "tenant", tenantId: TENANT } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TENANT });
 
     const result = await stack.http.writeOk<{ subjectKey: string }>(
       FORGET,
       { subject, reason: REASON },
       dpoUser,
     );
-    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
+    expect(result.subjectKey).toBe(`tenant:${TENANT}`);
+
+    await expect(kms.getKey({ kind: "tenant", tenantId: TENANT })).rejects.toThrow(
+      "Subject key erased",
+    );
+  });
+
+  // mh#349: DataProtectionOfficer is tenant-scoped — a DPO who learns a
+  // foreign tenant's id (export, support ticket, log line) must not be able
+  // to destroy that tenant's subject key.
+  test("DPO cannot forget a different tenant's subject → 403", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const err = await stack.http.writeErr(FORGET, { subject, reason: REASON }, dpoUser);
+    expect(err.httpStatus).toBe(403);
 
     await expect(
       kms.getKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId }),
-    ).rejects.toThrow("Subject key erased");
+    ).resolves.toBeTruthy();
+  });
+
+  test("SystemAdmin bypasses the tenant-scope guard", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      TestUsers.systemAdmin,
+    );
+    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
   });
 
   test("repeat forget: erase is a no-op but each attempt is audited", async () => {
@@ -307,6 +335,31 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
   let kms: InMemoryKmsAdapter;
   const TENANT_B = testTenantId(3);
 
+  // mh#349: a "user"-kind subject isn't always a real user — a share-token
+  // recipient or email subscriber self-owns its PII the same way
+  // (personal: "self", its own row id is the subject) but has no tenant-
+  // membership row. The guard must fall back to the subject row's own
+  // tenant_id for these.
+  const shareLikeEntity = createEntity({
+    table: "read_forget_subject_share_like_probe",
+    fields: {
+      recipientName: createTextField({
+        required: true,
+        maxLength: 100,
+        personal: "self",
+        find: "exact",
+      }),
+    },
+  });
+  const shareLikeTable = buildEntityTable("forgetSubjectShareLikeProbe", shareLikeEntity);
+  const shareLikeFeature = defineFeature("forget-subject-share-like-probe", (r) => {
+    r.entity("probe", shareLikeEntity);
+  });
+
+  function shareLikeProbeExecutor() {
+    return createEventStoreExecutor(shareLikeTable, shareLikeEntity, { entityName: "probe" });
+  }
+
   beforeAll(async () => {
     stack = await setupTestStack({
       features: [
@@ -316,6 +369,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
         createConfigFeature(),
         authFoundationFeature,
         createPersonalAccessTokensFeature({ scopes: {} }),
+        shareLikeFeature,
       ],
     });
     await unsafeCreateEntityTable(stack.db, userEntity);
@@ -323,6 +377,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     // tenant feature's only lookupable entity — the blind-index sweep
     // touches it; without the table the handler 500s on `read_tenant_invitations`.
     await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+    await unsafeCreateEntityTable(stack.db, shareLikeEntity, "probe");
     await unsafePushTables(stack.db, { tenantMembershipsTable });
     await createEventsTable(stack.db);
   });
@@ -336,6 +391,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
       userTable,
       apiTokenTable,
       tenantMembershipsTable,
+      shareLikeTable,
       eventsTable,
     ]);
     kms = new InMemoryKmsAdapter();
@@ -352,6 +408,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
       displayName: "Forgotten User",
       emailVerified: true,
     });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT, roles: ["Member"] });
     // No explicit createKey: seedUser's PII-encrypt (email) already created
     // the subject key implicitly via getOrCreateDek.
     await insertOne(stack.db, apiTokenTable, {
@@ -378,4 +435,84 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     expect(tokens).toHaveLength(1);
     expect(tokens[0]?.["revokedAt"]).not.toBeNull();
   });
+
+  // mh#349: a DPO must not be able to forget a user who has no membership in
+  // their own tenant (e.g. a Tenant-A DPO who learned a Tenant-B user id).
+  test("DPO cannot forget a user with no membership in their tenant → 403", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user@example.com",
+      displayName: "Foreign Tenant User",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).not.toBe(USER_STATUS.Deleted);
+  });
+
+  test("SystemAdmin can forget a user with no membership in any tenant", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "system-admin-forgets@example.com",
+      displayName: "System Admin Forgets",
+      emailVerified: true,
+    });
+
+    await stack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      TestUsers.systemAdmin,
+    );
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).toBe(USER_STATUS.Deleted);
+  });
+
+  test("DPO can forget a self-owned PII subject (share-token-like) in their own tenant", async () => {
+    const created = await shareLikeProbeExecutor().create(
+      { recipientName: "Tommy Recipient" },
+      dpoUser,
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const subjectId = String(created.data.id);
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject: { kind: "user", userId: subjectId }, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`user:${subjectId}`);
+  });
+
+  test("DPO cannot forget another tenant's self-owned PII subject → 403", async () => {
+    // create()'s event stream is tenant-scoped to the AUTHOR, not the
+    // tenantDb override — an actor whose own tenantId is TENANT_B is
+    // required to actually seed the row under the foreign tenant.
+    const foreignTenantAuthor = {
+      id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000f2",
+      tenantId: TENANT_B,
+      roles: ["Member"],
+    };
+    const created = await shareLikeProbeExecutor().create(
+      { recipientName: "Peter Recipient" },
+      foreignTenantAuthor,
+      createTenantDb(stack.db, TENANT_B, "system"),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const subjectId = String(created.data.id);
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: subjectId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+  });
 });

package/src/crypto-shredding/constants.ts

@@ -3,3 +3,5 @@ export const CRYPTO_SHREDDING_FEATURE_NAME = "crypto-shredding";
 export const SUBJECT_FORGOTTEN_EVENT_NAME = "crypto-shredding:event:subject-forgotten";
 
 export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";
+
+export const TARGET_TENANT_NOT_ADMIN_TENANT = "target_tenant_not_admin_tenant" as const;

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -5,15 +5,37 @@ import {
   type SubjectId,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  type DbRunner,
+  nullBlindIndexesForSubject,
+  subjectRowExistsInTenant,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  defineWriteHandler,
+  type FeatureDefinition,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  InternalError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { z } from "zod";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
 import { USER_STATUS } from "../../user";
-import { updateUserLifecycle } from "../../user-data-rights";
-import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import {
+  denyIfTargetOutsideAdminTenant,
+  isSystemAdminActor,
+  updateUserLifecycle,
+} from "../../user-data-rights";
+import {
+  CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  SUBJECT_FORGOTTEN_EVENT_NAME,
+  TARGET_TENANT_NOT_ADMIN_TENANT,
+} from "../constants";
 
 export const subjectIdSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("user"), userId: z.uuid() }),
@@ -31,6 +53,43 @@ export const subjectForgottenSchema = z.object({
   forgottenBy: z.string().min(1),
 });
 
+type SubjectIdInput = z.infer<typeof subjectIdSchema>;
+
+// Tenant-scope guard (mh#349): DataProtectionOfficer is a tenant-scoped role,
+// but the handler otherwise erases ANY subject cross-tenant on a raw
+// (un-scoped) client — a Tenant-A DPO who learns a Tenant-B subject id
+// (export, support ticket, log line) could destroy it. SystemAdmin
+// (platform-wide) always bypasses.
+async function resolveTenantScopeDenial(
+  db: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  user: SessionUser,
+  raw: SubjectIdInput,
+): Promise<WriteFailure | undefined> {
+  if (isSystemAdminActor(user)) return undefined;
+
+  if (raw.kind === "tenant") {
+    if (raw.tenantId === user.tenantId) return undefined;
+    return writeFailure(
+      new AccessDeniedError({ details: { reason: TARGET_TENANT_NOT_ADMIN_TENANT } }),
+    );
+  }
+
+  // Without the tenant feature there's no membership table to check against —
+  // no scoping concept exists to enforce (single/no-tenant apps only;
+  // ponytail: fail-open here, not a gap in multi-tenant apps).
+  if (!features.has("tenant")) return undefined;
+
+  const memberDenied = await denyIfTargetOutsideAdminTenant(db, user, raw.userId);
+  if (!memberDenied) return undefined;
+
+  // Not a real user in the actor's tenant — raw.userId may still be a
+  // self-owned PII subject (share-token recipient, email subscriber, ...)
+  // whose own row carries a real tenant_id.
+  const ownedInTenant = await subjectRowExistsInTenant(db, features, raw.userId, user.tenantId);
+  return ownedInTenant ? undefined : memberDenied;
+}
+
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -63,6 +122,14 @@ export const forgetSubjectWrite = defineWriteHandler({
         : { kind: "tenant", tenantId: raw.tenantId as TenantId }; // @cast-boundary uuid-validated command payload → branded id
     const subjectKey = subjectIdToKey(subject);
 
+    const tenantScopeDenial = await resolveTenantScopeDenial(
+      ctx.db.raw,
+      ctx.registry.features,
+      event.user,
+      raw,
+    );
+    if (tenantScopeDenial) return tenantScopeDenial;
+
     // Erase BEFORE the audit append: if the append throws, the key is gone
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never

package/src/tenant-settings/__tests__/settings-hub-i18n.test.ts

@@ -55,4 +55,42 @@ describe("tenant-settings — Settings-Hub nav/section labels", () => {
     if (sectionTitle === undefined) throw new Error("unreachable");
     expect(translate(translations, sectionTitle)).not.toBe(sectionTitle);
   });
+
+  test("every Settings-Hub label the schema renders resolves in es, distinct from en", () => {
+    const registry = createRegistry([createConfigFeature(), createTenantSettingsFeature()]);
+    const schema = buildConfigFeatureSchema(registry);
+    const translations = registry.getFeature("tenant-settings")?.translations ?? {};
+
+    const renderedKeys: string[] = [];
+    for (const screenId of ["tenant-settings-system", "tenant-settings-tenant"]) {
+      const nav = schema.navs.find((n) => n.id === screenId);
+      const screen = schema.screens.find((s) => s.id === screenId);
+      expect(nav).toBeDefined();
+      expect(screen).toBeDefined();
+      if (nav === undefined || screen === undefined || screen.type !== "configEdit") {
+        throw new Error("unreachable");
+      }
+      const section = screen.layout.sections[0];
+      const sectionTitle = section !== undefined && "title" in section ? section.title : undefined;
+      expect(sectionTitle).toBeDefined();
+      if (sectionTitle === undefined) throw new Error("unreachable");
+
+      renderedKeys.push(nav.label, `screen:${screenId}.title`, sectionTitle);
+      renderedKeys.push(...Object.values(screen.fieldLabels ?? {}));
+    }
+
+    // The Settings-Hub renders exactly these label surfaces per scope: nav
+    // entry, screen title, section heading and one label per masked config
+    // key (currency + locale) — six distinct keys across both scopes.
+    expect(new Set(renderedKeys).size).toBe(6);
+
+    for (const key of renderedKeys) {
+      expect(translate(translations, key, "es")).not.toBe(key);
+      expect(translate(translations, key, "es")).not.toBe(translate(translations, key, "en"));
+    }
+
+    const systemLabel = translate(translations, "tenant-settings.settings.system", "es");
+    const tenantLabel = translate(translations, "tenant-settings.settings", "es");
+    expect(systemLabel).not.toBe(tenantLabel);
+  });
 });

package/src/tenant-settings/feature.ts

@@ -29,21 +29,35 @@ export function createTenantSettingsFeature(
     r.config({ keys: buildTenantSettingsKeys(opts) });
     r.translations({
       keys: {
-        "tenant-settings.currency": { de: "Standard-Währung", en: "Default Currency" },
-        "tenant-settings.locale": { de: "Standard-Sprache", en: "Default Locale" },
+        "tenant-settings.currency": {
+          de: "Standard-Währung",
+          en: "Default Currency",
+          es: "Moneda predeterminada",
+        },
+        "tenant-settings.locale": {
+          de: "Standard-Sprache",
+          en: "Default Locale",
+          es: "Idioma predeterminado",
+        },
         // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
         // required by the i18n boot-validator whenever a feature masks config keys.
         "screen:tenant-settings-system.title": {
           de: "Tenant-Einstellungen",
           en: "Tenant Settings",
+          es: "Ajustes de la organización",
         },
         "screen:tenant-settings-tenant.title": {
           de: "Tenant-Einstellungen",
           en: "Tenant Settings",
+          es: "Ajustes de la organización",
         },
         // Settings-Hub nav label + configEdit section heading (same key, both
         // scopes fall back here — see buildConfigFeatureSchema).
-        "tenant-settings.settings": { de: "Tenant-Einstellungen", en: "Tenant Settings" },
+        "tenant-settings.settings": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+          es: "Ajustes de la organización",
+        },
         // Both currency/locale are tenant-home with admin write access, which
         // cascades a SystemAdmin-only "set the platform default" screen up to
         // the system audience — scoped override so its nav entry reads
@@ -52,6 +66,7 @@ export function createTenantSettingsFeature(
         "tenant-settings.settings.system": {
           de: "Tenant-Einstellungen (Plattform-Standard)",
           en: "Tenant Settings (Platform Default)",
+          es: "Ajustes de la organización (valor predeterminado de la plataforma)",
         },
       },
     });

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -15,8 +15,10 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
+  createSystemUser,
   createTextField,
   defineFeature,
   EXT_USER_DATA,
@@ -38,6 +40,8 @@ import { buildEnvConfigOverrides, createConfigResolver } from "../../config/reso
 import { configValueEntity } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
+import { tenantMembershipEntity, tenantMembershipsTable } from "../../tenant";
+import { seedTenantMembership } from "../../tenant/seeding";
 import { createUserFeature, userEntity } from "../../user";
 import { TENANT_MODEL_CONFIG_KEY } from "../constants";
 import { createUserDataRightsFeature } from "../feature";
@@ -74,6 +78,14 @@ const contributorFeature = defineFeature("dsgvo-tenant-scoped", (r) => {
   });
 });
 
+const membershipExecutor = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  {
+    entityName: "tenant-membership",
+  },
+);
+
 let stack: TestStack;
 const seed = (db: unknown) =>
   // biome-ignore lint/suspicious/noExplicitAny: dummy writer; this contributor has no binaries.
@@ -224,6 +236,69 @@ describe("forget pipeline honours the effective tenant model", () => {
     expect(result.errors).toHaveLength(0);
     expect(await rowCount()).toBe(1);
   });
+
+  test("single-user, sole live member, but a departed co-member's history remains → rows preserved (ent#346)", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c5");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    // Both memberships go through the REAL event-store executor (not the
+    // raw-INSERT seedMembership() helper) — the historical check reads
+    // `tenant-membership.created` events, so FORGET_USER needs its own
+    // `.created` event too, or the tenant would only ever show 1 distinct
+    // historical member (CO_MEMBER) even after it truly had 2.
+    // Explicit `by`: streamTenantFor(user) keys each event's OWN tenantId
+    // column off the acting user, not the payload's tenantId — the
+    // seedTenantMembership default (TestUsers.systemAdmin) lives on a
+    // different tenant, which would emit .created under the wrong tenantId
+    // and make it invisible to everHadMultipleMembers' tenant-scoped query.
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(TENANT),
+    });
+
+    // CO_MEMBER joins for real (emits tenant-membership.created) and is then
+    // removed for real (emits tenant-membership.deleted, deletes the
+    // projection row) — mirrors removeMemberWrite exactly, so the created
+    // event survives in kumiko_events even though the live row is gone.
+    const created = await seedTenantMembership(stack.db, {
+      userId: CO_MEMBER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(TENANT),
+    });
+    const deleteResult = await membershipExecutor.delete(
+      { id: created.id },
+      createSystemUser(TENANT),
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!deleteResult.isSuccess) {
+      throw new Error(`test setup: co-member delete failed: ${deleteResult.error.code}`);
+    }
+
+    // Pins the test's premise: exactly 1 live membership row, so a live-count-
+    // only check would call this tenant single-user (and the fix must reject
+    // that call via history instead).
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    // Only 1 live membership remains (FORGET_USER) — the OLD live-only check
+    // would have called this single-user and wiped the co-member's row. The
+    // historical check must still resolve multi-user here.
+    expect(await rowCount()).toBe(1);
+  });
 });
 
 describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {

package/src/user-data-rights/index.ts

@@ -1,5 +1,10 @@
 export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature";
 export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write";
+export {
+  denyIfTargetOutsideAdminTenant,
+  TARGET_USER_NOT_IN_ADMIN_TENANT,
+} from "./lib/deny-if-target-outside-admin-tenant";
+export { isSystemAdminActor } from "./lib/is-admin-actor";
 // #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
 // von read_users-Rebuilds (siehe lib-Doc).
 export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle";

package/src/user-data-rights/run-forget-cleanup.ts

@@ -38,7 +38,11 @@ import {
   type KmsAdapter,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { type DbRunner, nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
+import {
+  type DbRunner,
+  entityEventName,
+  nullBlindIndexesForSubject,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
@@ -49,6 +53,7 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -554,7 +559,37 @@ async function resolveEffectiveTenantModel(
     { tenantId },
     { limit: 2 },
   );
-  return members.length === 1 ? "single-user" : "multi-user";
+  if (members.length !== 1) return "multi-user";
+  return (await everHadMultipleMembers(db, tenantId)) ? "multi-user" : "single-user";
+}
+
+// removeMemberWrite only deletes the tenant-membership PROJECTION row — the
+// event history survives forever, and a departed member's own tenant-scoped
+// data rows (contributor-style records with no per-user column) can
+// outlive their membership (ent#346). A live count of 1 is therefore not
+// enough: a tenant that ever had >1 distinct member must stay multi-user for
+// the forget path even after everyone but one is removed, or the sole
+// remaining member's forget request wipes the departed co-member's leftover
+// rows. LIMIT chosen generously for a nominally single-user tenant; hitting
+// it is itself a multi-user signal, so it also resolves to "multi-user".
+const MAX_MEMBERSHIP_CREATED_EVENTS = 1000;
+
+async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise<boolean> {
+  const createdEvents = await selectMany<{ payload: Record<string, unknown> }>(
+    db,
+    eventsTable,
+    {
+      tenantId,
+      aggregateType: "tenant-membership",
+      type: entityEventName("tenant-membership", "created"),
+    },
+    { limit: MAX_MEMBERSHIP_CREATED_EVENTS },
+  );
+  if (createdEvents.length >= MAX_MEMBERSHIP_CREATED_EVENTS) return true;
+  const distinctUserIds = new Set(
+    createdEvents.map((e) => e.payload["userId"]).filter((v): v is string => typeof v === "string"),
+  );
+  return distinctUserIds.size > 1;
 }
 
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.