@cosmicdrift/kumiko-bundled-features 0.215.1 → 0.215.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.1",
+  "version": "0.215.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.1",
-    "@cosmicdrift/kumiko-framework": "0.215.1",
-    "@cosmicdrift/kumiko-headless": "0.215.1",
-    "@cosmicdrift/kumiko-renderer": "0.215.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.1",
-    "@cosmicdrift/kumiko-types": "0.215.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.3",
+    "@cosmicdrift/kumiko-framework": "0.215.3",
+    "@cosmicdrift/kumiko-headless": "0.215.3",
+    "@cosmicdrift/kumiko-renderer": "0.215.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.215.3",
+    "@cosmicdrift/kumiko-types": "0.215.3",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.1"
+    "@cosmicdrift/kumiko-locale-de": "0.215.3"
   }
 }

package/src/config/i18n.ts

@@ -4,6 +4,6 @@ type LocalizedString = { readonly en: string };
 export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
   "config.settings.title": { en: "Settings" },
   "config.settings.system": { en: "Platform" },
-  "config.settings.tenant": { en: "Organization" },
+  "config.settings.tenant": { en: "Tenant" },
   "config.settings.user": { en: "Personal" },
 };

package/src/config/web/i18n.ts

@@ -13,7 +13,7 @@ export const defaultTranslations: TranslationsByLocale = {
   en: {
     "config.settings.title": "Settings",
     "config.settings.system": "Platform",
-    "config.settings.tenant": "Organization",
+    "config.settings.tenant": "Tenant",
     "config.settings.user": "Personal",
     "config.errors.systemOnly": "This value can only be set by the system.",
     "config.errors.invalidScope": "This scope is not allowed for this key.",

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -40,6 +40,7 @@ import { apiTokenEntity, apiTokenTable } from "../../personal-access-tokens/sche
 import { createTenantFeature } from "../../tenant";
 import { tenantInvitationEntity } from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { seedTenantMembership } from "../../tenant/seeding";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { seedUser } from "../../user/seeding";
@@ -116,20 +117,47 @@ describe("crypto-shredding :: forget-subject", () => {
     });
   });
 
-  test("tenant subject shreds the same way", async () => {
-    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
-    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+  test("tenant subject shreds the same way (DPO's own tenant)", async () => {
+    const subject = { kind: "tenant", tenantId: TENANT } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TENANT });
 
     const result = await stack.http.writeOk<{ subjectKey: string }>(
       FORGET,
       { subject, reason: REASON },
       dpoUser,
     );
-    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
+    expect(result.subjectKey).toBe(`tenant:${TENANT}`);
+
+    await expect(kms.getKey({ kind: "tenant", tenantId: TENANT })).rejects.toThrow(
+      "Subject key erased",
+    );
+  });
+
+  // mh#349: DataProtectionOfficer is tenant-scoped — a DPO who learns a
+  // foreign tenant's id (export, support ticket, log line) must not be able
+  // to destroy that tenant's subject key.
+  test("DPO cannot forget a different tenant's subject → 403", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const err = await stack.http.writeErr(FORGET, { subject, reason: REASON }, dpoUser);
+    expect(err.httpStatus).toBe(403);
 
     await expect(
       kms.getKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId }),
-    ).rejects.toThrow("Subject key erased");
+    ).resolves.toBeTruthy();
+  });
+
+  test("SystemAdmin bypasses the tenant-scope guard", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      TestUsers.systemAdmin,
+    );
+    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
   });
 
   test("repeat forget: erase is a no-op but each attempt is audited", async () => {
@@ -307,6 +335,31 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
   let kms: InMemoryKmsAdapter;
   const TENANT_B = testTenantId(3);
 
+  // mh#349: a "user"-kind subject isn't always a real user — a share-token
+  // recipient or email subscriber self-owns its PII the same way
+  // (personal: "self", its own row id is the subject) but has no tenant-
+  // membership row. The guard must fall back to the subject row's own
+  // tenant_id for these.
+  const shareLikeEntity = createEntity({
+    table: "read_forget_subject_share_like_probe",
+    fields: {
+      recipientName: createTextField({
+        required: true,
+        maxLength: 100,
+        personal: "self",
+        find: "exact",
+      }),
+    },
+  });
+  const shareLikeTable = buildEntityTable("forgetSubjectShareLikeProbe", shareLikeEntity);
+  const shareLikeFeature = defineFeature("forget-subject-share-like-probe", (r) => {
+    r.entity("probe", shareLikeEntity);
+  });
+
+  function shareLikeProbeExecutor() {
+    return createEventStoreExecutor(shareLikeTable, shareLikeEntity, { entityName: "probe" });
+  }
+
   beforeAll(async () => {
     stack = await setupTestStack({
       features: [
@@ -316,6 +369,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
         createConfigFeature(),
         authFoundationFeature,
         createPersonalAccessTokensFeature({ scopes: {} }),
+        shareLikeFeature,
       ],
     });
     await unsafeCreateEntityTable(stack.db, userEntity);
@@ -323,6 +377,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     // tenant feature's only lookupable entity — the blind-index sweep
     // touches it; without the table the handler 500s on `read_tenant_invitations`.
     await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+    await unsafeCreateEntityTable(stack.db, shareLikeEntity, "probe");
     await unsafePushTables(stack.db, { tenantMembershipsTable });
     await createEventsTable(stack.db);
   });
@@ -336,6 +391,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
       userTable,
       apiTokenTable,
       tenantMembershipsTable,
+      shareLikeTable,
       eventsTable,
     ]);
     kms = new InMemoryKmsAdapter();
@@ -352,6 +408,7 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
       displayName: "Forgotten User",
       emailVerified: true,
     });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT, roles: ["Member"] });
     // No explicit createKey: seedUser's PII-encrypt (email) already created
     // the subject key implicitly via getOrCreateDek.
     await insertOne(stack.db, apiTokenTable, {
@@ -378,4 +435,84 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     expect(tokens).toHaveLength(1);
     expect(tokens[0]?.["revokedAt"]).not.toBeNull();
   });
+
+  // mh#349: a DPO must not be able to forget a user who has no membership in
+  // their own tenant (e.g. a Tenant-A DPO who learned a Tenant-B user id).
+  test("DPO cannot forget a user with no membership in their tenant → 403", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user@example.com",
+      displayName: "Foreign Tenant User",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).not.toBe(USER_STATUS.Deleted);
+  });
+
+  test("SystemAdmin can forget a user with no membership in any tenant", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "system-admin-forgets@example.com",
+      displayName: "System Admin Forgets",
+      emailVerified: true,
+    });
+
+    await stack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      TestUsers.systemAdmin,
+    );
+
+    const userRow = await fetchOne<Record<string, unknown>>(stack.db, userTable, { id: userId });
+    expect(userRow?.["status"]).toBe(USER_STATUS.Deleted);
+  });
+
+  test("DPO can forget a self-owned PII subject (share-token-like) in their own tenant", async () => {
+    const created = await shareLikeProbeExecutor().create(
+      { recipientName: "Tommy Recipient" },
+      dpoUser,
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const subjectId = String(created.data.id);
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject: { kind: "user", userId: subjectId }, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`user:${subjectId}`);
+  });
+
+  test("DPO cannot forget another tenant's self-owned PII subject → 403", async () => {
+    // create()'s event stream is tenant-scoped to the AUTHOR, not the
+    // tenantDb override — an actor whose own tenantId is TENANT_B is
+    // required to actually seed the row under the foreign tenant.
+    const foreignTenantAuthor = {
+      id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000f2",
+      tenantId: TENANT_B,
+      roles: ["Member"],
+    };
+    const created = await shareLikeProbeExecutor().create(
+      { recipientName: "Peter Recipient" },
+      foreignTenantAuthor,
+      createTenantDb(stack.db, TENANT_B, "system"),
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const subjectId = String(created.data.id);
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: subjectId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+  });
 });

package/src/crypto-shredding/constants.ts

@@ -3,3 +3,5 @@ export const CRYPTO_SHREDDING_FEATURE_NAME = "crypto-shredding";
 export const SUBJECT_FORGOTTEN_EVENT_NAME = "crypto-shredding:event:subject-forgotten";
 
 export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";
+
+export const TARGET_TENANT_NOT_ADMIN_TENANT = "target_tenant_not_admin_tenant" as const;

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -5,15 +5,37 @@ import {
   type SubjectId,
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  type DbRunner,
+  nullBlindIndexesForSubject,
+  subjectRowExistsInTenant,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  defineWriteHandler,
+  type FeatureDefinition,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  InternalError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { z } from "zod";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
 import { USER_STATUS } from "../../user";
-import { updateUserLifecycle } from "../../user-data-rights";
-import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import {
+  denyIfTargetOutsideAdminTenant,
+  isSystemAdminActor,
+  updateUserLifecycle,
+} from "../../user-data-rights";
+import {
+  CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  SUBJECT_FORGOTTEN_EVENT_NAME,
+  TARGET_TENANT_NOT_ADMIN_TENANT,
+} from "../constants";
 
 export const subjectIdSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("user"), userId: z.uuid() }),
@@ -31,6 +53,43 @@ export const subjectForgottenSchema = z.object({
   forgottenBy: z.string().min(1),
 });
 
+type SubjectIdInput = z.infer<typeof subjectIdSchema>;
+
+// Tenant-scope guard (mh#349): DataProtectionOfficer is a tenant-scoped role,
+// but the handler otherwise erases ANY subject cross-tenant on a raw
+// (un-scoped) client — a Tenant-A DPO who learns a Tenant-B subject id
+// (export, support ticket, log line) could destroy it. SystemAdmin
+// (platform-wide) always bypasses.
+async function resolveTenantScopeDenial(
+  db: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  user: SessionUser,
+  raw: SubjectIdInput,
+): Promise<WriteFailure | undefined> {
+  if (isSystemAdminActor(user)) return undefined;
+
+  if (raw.kind === "tenant") {
+    if (raw.tenantId === user.tenantId) return undefined;
+    return writeFailure(
+      new AccessDeniedError({ details: { reason: TARGET_TENANT_NOT_ADMIN_TENANT } }),
+    );
+  }
+
+  // Without the tenant feature there's no membership table to check against —
+  // no scoping concept exists to enforce (single/no-tenant apps only;
+  // ponytail: fail-open here, not a gap in multi-tenant apps).
+  if (!features.has("tenant")) return undefined;
+
+  const memberDenied = await denyIfTargetOutsideAdminTenant(db, user, raw.userId);
+  if (!memberDenied) return undefined;
+
+  // Not a real user in the actor's tenant — raw.userId may still be a
+  // self-owned PII subject (share-token recipient, email subscriber, ...)
+  // whose own row carries a real tenant_id.
+  const ownedInTenant = await subjectRowExistsInTenant(db, features, raw.userId, user.tenantId);
+  return ownedInTenant ? undefined : memberDenied;
+}
+
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -63,6 +122,14 @@ export const forgetSubjectWrite = defineWriteHandler({
         : { kind: "tenant", tenantId: raw.tenantId as TenantId }; // @cast-boundary uuid-validated command payload → branded id
     const subjectKey = subjectIdToKey(subject);
 
+    const tenantScopeDenial = await resolveTenantScopeDenial(
+      ctx.db.raw,
+      ctx.registry.features,
+      event.user,
+      raw,
+    );
+    if (tenantScopeDenial) return tenantScopeDenial;
+
     // Erase BEFORE the audit append: if the append throws, the key is gone
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never

package/src/custom-fields/web/client-plugin.tsx

@@ -6,7 +6,7 @@
 // referenzieren den Namen im Screen-Schema:
 //
 //   layout: { sections: [
-//     { kind: "extension", title: "...", component: {
+//     { kind: "extension", title: "...", contributesToFormSubmit: true, component: {
 //       react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME }
 //     } },
 //   ]}

package/src/notes-history/__tests__/add-note-author-name-kms.integration.test.ts

@@ -0,0 +1,89 @@
+// add-note's authorName stamping (see add-note.write.ts): the handler reads
+// the caller's own read_users row (ctx.db.raw, tenant-agnostic self-lookup —
+// same pattern as user-data-rights/handlers/cancel-deletion.write.ts) and
+// decrypts displayName before writing it as authorName. Pinned with a real
+// KMS adapter so the round-trip is proven end-to-end, not assumed from a
+// no-op-encrypt test env — a later refactor that silently reintroduces the
+// raw UUID or gets stuck on the placeholder would fail this.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { NotesHistoryHandlers, NotesHistoryQueries } from "../constants";
+import { noteEntryEntity } from "../entity";
+import { createNotesHistoryFeature } from "../feature";
+
+const notesHistoryFeature = createNotesHistoryFeature();
+const tenantId = testTenantId(1);
+
+let stack: TestStack;
+
+function memberUser(userId: string): SessionUser {
+  return { id: userId, tenantId, roles: ["TenantMember"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [notesHistoryFeature] });
+  await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, userEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+describe("add-note — authorName stamped from the writer's own user row", () => {
+  test("with an active KMS, the written note carries the writer's decrypted displayName — not the UUID, not the placeholder", async () => {
+    // KMS active BEFORE the seed — seedUser runs through the executor, so
+    // the row reflects the encrypted prod state.
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    const { id: userId } = await seedUser(stack.db, {
+      email: "notes-author@example.com",
+      displayName: "Priya Natarajan",
+      emailVerified: true,
+    });
+
+    // Prove the row is actually ciphertext at rest — otherwise a no-op
+    // encrypt path would make this test pass while proving nothing.
+    const rawUserRows = await selectMany<{ displayName: unknown }>(stack.db, userTable, {
+      id: userId,
+    });
+    expect(isPiiCiphertext(rawUserRows[0]?.displayName)).toBe(true);
+
+    const { id: noteId } = await stack.http.writeOk<{ id: string }>(
+      NotesHistoryHandlers.addNote,
+      { entityType: "contact", entityId: "contact-kms-author", body: "Called back." },
+      memberUser(userId),
+    );
+
+    const { rows } = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      NotesHistoryQueries.noteList,
+      { filter: { field: "entityId", op: "eq", value: "contact-kms-author" } },
+      memberUser(userId),
+    );
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["id"]).toBe(noteId);
+    expect(rows[0]?.["authorName"]).toBe("Priya Natarajan");
+    expect(rows[0]?.["authorName"]).not.toBe(userId);
+    expect(rows[0]?.["authorName"]).not.toBe("Unknown author");
+  });
+});

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -87,6 +87,11 @@ describe("notes-history integration — add + list", () => {
     expect(rows[0]?.["body"]).toBe("Called about renewal");
     expect(rows[0]?.["authorId"]).toBe(member.id);
     expect(rows[0]?.["insertedAt"]).toBeTruthy();
+    // member is a synthetic SessionUser (createTestUser) with no backing
+    // read_users row, so add-note's self-lookup finds nothing to stamp — see
+    // add-note-author-name-kms.integration.test.ts for the seeded-user path
+    // where a real displayName does land in authorName.
+    expect(rows[0]?.["authorName"]).toBeNull();
   });
 
   test("a client-supplied authorId in the payload is ignored", async () => {
@@ -98,6 +103,15 @@ describe("notes-history integration — add + list", () => {
     expect(rows[0]?.["authorId"]).toBe(member.id);
   });
 
+  test("a client-supplied authorName in the payload is ignored", async () => {
+    await addNote("contact", "contact-2b", "note", member, { authorName: "Fake Display Name" });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2b" });
+    // Same guard as authorId above: addNotePayloadSchema doesn't accept an
+    // authorName field, so a smuggled value never survives to the write —
+    // the name (once stamped) can only come from the caller's own session.
+    expect(rows[0]?.["authorName"]).not.toBe("Fake Display Name");
+  });
+
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {
     await addNote("contact", "contact-3", "first");
     await addNote("contact", "contact-3", "second");

package/src/notes-history/__tests__/notes-section.test.tsx

@@ -0,0 +1,171 @@
+// @runtime client
+// DOM test for the notes-history entry display: body/meta must render as two
+// visually separate lines, the author must never be the raw authorId, and the
+// timestamp must be human-formatted — not the concatenated single-line dump
+// this test guards against (see notes-section.tsx for the fix).
+// Provider wrapper is local — renderer-web → bundled-features forbids importing
+// renderer-web test-utils from here.
+
+import { describe, expect, test } from "bun:test";
+import { createStore, type Dispatcher, type DispatcherStatus } from "@cosmicdrift/kumiko-headless";
+import {
+  createStaticLocaleResolver,
+  DispatcherProvider,
+  formatWhen,
+  kumikoDefaultTranslations,
+  type LiveEventSubscriber,
+  LiveEventsProvider,
+  LocaleProvider,
+  PrimitivesProvider,
+  TokensProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives, defaultTokens } from "@cosmicdrift/kumiko-renderer-web";
+import { render, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { NotesHistoryQueries } from "../constants";
+import { defaultTranslations } from "../web/i18n";
+import { NotesSection } from "../web/notes-section";
+
+if (typeof globalThis.ResizeObserver === "undefined") {
+  globalThis.ResizeObserver = class {
+    observe(): void {}
+    unobserve(): void {}
+    disconnect(): void {}
+  } as unknown as typeof ResizeObserver;
+}
+
+const stubLiveEvents: LiveEventSubscriber = () => () => {};
+const stubTokens = {
+  tokens: defaultTokens,
+  mode: "light" as const,
+  setMode: () => {},
+  toggleMode: () => {},
+};
+const stubResolver = createStaticLocaleResolver();
+
+type NoteRowFixture = {
+  readonly id: string;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly authorId: string;
+  readonly authorName: string | null;
+  readonly body: string;
+  readonly insertedAt: string;
+};
+
+const AUTHOR_ID = "01a0244b-71f2-76e4-854f-e360584f01e9";
+const AUTHOR_NAME = "Jamie Vance";
+const INSERTED_AT = "2026-08-21T12:28:41.580Z";
+const NOTE_BODY = "Vertragsunterlagen per Post verschickt.";
+
+const NOTE_ROWS: readonly NoteRowFixture[] = [
+  {
+    id: "note-1",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: AUTHOR_ID,
+    authorName: AUTHOR_NAME,
+    body: NOTE_BODY,
+    insertedAt: INSERTED_AT,
+  },
+  {
+    id: "note-2",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: "02b1355c-8203-87f5-9650-f471695002f0",
+    authorName: null,
+    body: "Legacy entry predating authorName.",
+    insertedAt: "2026-07-01T09:00:00.000Z",
+  },
+];
+
+function makeDispatcher(): Dispatcher {
+  const statusStore = createStore<DispatcherStatus>("online");
+  const query = (async (type: string) => {
+    if (type === NotesHistoryQueries.noteList) {
+      return { isSuccess: true, data: { rows: NOTE_ROWS } };
+    }
+    return { isSuccess: true, data: null };
+  }) as unknown as Dispatcher["query"];
+  return {
+    write: (async () => ({ isSuccess: true, data: null })) as unknown as Dispatcher["write"],
+    query,
+    batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
+    statusStore,
+    async *stream() {},
+    pendingWrites: () => [],
+    pendingFiles: () => [],
+  } as unknown as Dispatcher; // @cast-boundary test-stub
+}
+
+function renderSection(): ReturnType<typeof render> {
+  const wrapper = ({ children }: { readonly children: ReactNode }): ReactNode => (
+    <TokensProvider value={stubTokens}>
+      <LocaleProvider
+        resolver={stubResolver}
+        fallbackBundles={[defaultTranslations, kumikoDefaultTranslations]}
+      >
+        <PrimitivesProvider value={defaultPrimitives}>
+          <LiveEventsProvider value={stubLiveEvents}>
+            <DispatcherProvider dispatcher={makeDispatcher()}>{children}</DispatcherProvider>
+          </LiveEventsProvider>
+        </PrimitivesProvider>
+      </LocaleProvider>
+    </TokensProvider>
+  );
+  return render(<NotesSection entityName="contact" entityId="contact-1" />, { wrapper });
+}
+
+describe("NotesSection — entry display", () => {
+  test("note body and meta line render as two distinct nodes, not one run-on line", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-body") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const bodyEl = view.getByTestId("notes-section-row-note-1-body");
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(bodyEl).not.toBe(metaEl);
+    expect(bodyEl.textContent).toBe(NOTE_BODY);
+    expect(metaEl.textContent).not.toContain(NOTE_BODY);
+
+    const row = view.getByTestId("notes-section-row-note-1");
+    expect(row.className).toContain("flex-col");
+  });
+
+  test("a stamped authorName renders as the author, never the raw authorId", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(metaEl.textContent).not.toContain(AUTHOR_ID);
+    expect(metaEl.textContent).toContain(AUTHOR_NAME);
+  });
+
+  test("a null authorName (legacy row, or shredded author) renders the placeholder", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-2-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-2-meta");
+    expect(metaEl.textContent).toContain("Unknown author");
+  });
+
+  test("date renders formatted, never the raw ISO timestamp", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(metaEl.textContent).not.toContain(INSERTED_AT);
+    expect(metaEl.textContent).toContain(formatWhen(INSERTED_AT));
+  });
+});

package/src/notes-history/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.215.3",
+    "type": "improvement",
+    "title": "note-entry gains authorName, stamped at write time",
+    "detail": "The entry display previously had no readable author — only the internal authorId (UUID). note-entry now carries an `authorName` field (personal: { of: \"authorId\" }, same crypto-shredding subject as `body`), stamped once at add-note write time from the writer's own read_users row (self-lookup by id, decrypted displayName) so the append-only history keeps the name as it was when the note was written, not whatever the account is called later. A failed lookup, a missing displayName, and pre-field/shredded rows all read `authorName: null` — the UI falls back to a translated placeholder, never the raw id; the write itself never fails over a missing name.",
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_note_entries.authorName`. No backfill: existing rows read null and show the placeholder, same as before this change from the user's point of view."
+  }
+]

package/src/notes-history/entity.ts

@@ -31,6 +31,13 @@ export const noteEntryEntity = createEntity({
     authorId: createTextField({
       personal: "ref",
     }),
+    // Stamped once at write time, never re-resolved later — the history
+    // needs the name as it was then, not whatever the account is called now.
+    authorName: createTextField({
+      maxLength: 200,
+      personal: { of: "authorId" },
+      find: "none",
+    }),
     body: createLongTextField({
       required: true,
       maxLength: 20_000,

package/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,7 @@
+import { fetchOne, runInSavepoint } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { decryptStoredPii } from "../../shared";
+import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
 import { noteEntryExecutor } from "../executor";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
@@ -17,7 +20,28 @@ export function createAddNoteHandler(
     access,
     handler: async (event, ctx) => {
       const payload = event.payload as AddNotePayload; // @cast-boundary engine-payload
-      return noteEntryExecutor.create({ ...payload, authorId: event.user.id }, event.user, ctx.db);
+
+      let authorName: string | null = null;
+      try {
+        // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.
+        // Bun.SQL poisons the whole tx after any error inside it, even one that's
+        // caught — a bare try/catch here would take the note write down with it.
+        authorName = await runInSavepoint(ctx.db.raw, async (sp) => {
+          const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
+            id: event.user.id,
+          });
+          if (!userRow?.displayName) return null;
+          return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
+        });
+      } catch {
+        authorName = null;
+      }
+
+      return noteEntryExecutor.create(
+        { ...payload, authorId: event.user.id, authorName },
+        event.user,
+        ctx.db,
+      );
     },
   };
 }

package/src/notes-history/web/i18n.ts

@@ -14,5 +14,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "notesHistory.section.working": "Saving…",
     "notesHistory.section.add": "Add note",
     "notesHistory.section.meta": "{author} · {date}",
+    "notesHistory.section.authorUnknown": "Unknown author",
   },
 };

package/src/notes-history/web/notes-section.tsx

@@ -12,6 +12,7 @@
 //                   (RenderEdit passes { entityName, entityId }).
 
 import {
+  formatWhen,
   useDispatcher,
   usePrimitives,
   useQuery,
@@ -25,6 +26,8 @@ type NoteRow = {
   readonly entityType: string;
   readonly entityId: string;
   readonly authorId: string;
+  // Null for pre-authorName history and for shredded authors.
+  readonly authorName: string | null;
   readonly body: string;
   readonly insertedAt: string;
 };
@@ -136,11 +139,14 @@ export function NotesSection({
             <div
               key={n.id}
               data-testid={`notes-section-row-${n.id}`}
-              className="rounded-md border p-2"
+              className="flex flex-col gap-1 rounded-md border p-2"
             >
-              <Text>{n.body}</Text>
-              <Text variant="small">
-                {t("notesHistory.section.meta", { author: n.authorId, date: n.insertedAt })}
+              <Text testId={`notes-section-row-${n.id}-body`}>{n.body}</Text>
+              <Text variant="small" testId={`notes-section-row-${n.id}-meta`}>
+                {t("notesHistory.section.meta", {
+                  author: n.authorName ?? t("notesHistory.section.authorUnknown"),
+                  date: formatWhen(n.insertedAt),
+                })}
               </Text>
             </div>
           ))}

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -54,6 +54,9 @@ describe("noteEntryExportHook", () => {
     expect(snippet).not.toBeNull();
     const bodies = (snippet?.rows ?? []).map((r) => r["body"]);
     expect(bodies).toEqual(["by author"]);
+    // No read_users row is seeded in this stack, so add-note's self-lookup
+    // stamps authorName null — export must still carry the key.
+    expect(Object.keys(snippet?.rows?.[0] ?? {})).toContain("authorName");
   });
 
   test("returns null when the user authored no notes", async () => {

package/src/notes-history-user-data/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.215.3",
+    "type": "improvement",
+    "title": "note-entry GDPR export now includes authorName",
+    "detail": "The Art. 20 export for `note-entry` (noteEntryExportHook) enumerates fields explicitly and did not know about the new `authorName` field added alongside `body`. The export row now also carries the stamped `authorName` (null on legacy/shredded rows, same as the read path)."
+  }
+]

package/src/notes-history-user-data/hooks.ts

@@ -21,12 +21,13 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
       entityType: r["entityType"],
       entityId: r["entityId"],
       body: r["body"],
+      authorName: r["authorName"],
       insertedAt: r["insertedAt"],
     })),
   };
 };
 
-// Deliberate no-op: `body` is annotated `personal: { of: "authorId" }`
+// Deliberate no-op: `body` and `authorName` are annotated `personal: { of: "authorId" }`
 // (entity.ts), which relies on crypto-shredding (mounted KMS) for erasure —
 // destroying the author's subject key makes every note-entry event AND
 // projected row unreadable at once, without needing a physical delete

package/src/tenant-settings/__tests__/settings-hub-i18n.test.ts

@@ -55,4 +55,42 @@ describe("tenant-settings — Settings-Hub nav/section labels", () => {
     if (sectionTitle === undefined) throw new Error("unreachable");
     expect(translate(translations, sectionTitle)).not.toBe(sectionTitle);
   });
+
+  test("every Settings-Hub label the schema renders resolves in es, distinct from en", () => {
+    const registry = createRegistry([createConfigFeature(), createTenantSettingsFeature()]);
+    const schema = buildConfigFeatureSchema(registry);
+    const translations = registry.getFeature("tenant-settings")?.translations ?? {};
+
+    const renderedKeys: string[] = [];
+    for (const screenId of ["tenant-settings-system", "tenant-settings-tenant"]) {
+      const nav = schema.navs.find((n) => n.id === screenId);
+      const screen = schema.screens.find((s) => s.id === screenId);
+      expect(nav).toBeDefined();
+      expect(screen).toBeDefined();
+      if (nav === undefined || screen === undefined || screen.type !== "configEdit") {
+        throw new Error("unreachable");
+      }
+      const section = screen.layout.sections[0];
+      const sectionTitle = section !== undefined && "title" in section ? section.title : undefined;
+      expect(sectionTitle).toBeDefined();
+      if (sectionTitle === undefined) throw new Error("unreachable");
+
+      renderedKeys.push(nav.label, `screen:${screenId}.title`, sectionTitle);
+      renderedKeys.push(...Object.values(screen.fieldLabels ?? {}));
+    }
+
+    // The Settings-Hub renders exactly these label surfaces per scope: nav
+    // entry, screen title, section heading and one label per masked config
+    // key (currency + locale) — six distinct keys across both scopes.
+    expect(new Set(renderedKeys).size).toBe(6);
+
+    for (const key of renderedKeys) {
+      expect(translate(translations, key, "es")).not.toBe(key);
+      expect(translate(translations, key, "es")).not.toBe(translate(translations, key, "en"));
+    }
+
+    const systemLabel = translate(translations, "tenant-settings.settings.system", "es");
+    const tenantLabel = translate(translations, "tenant-settings.settings", "es");
+    expect(systemLabel).not.toBe(tenantLabel);
+  });
 });

package/src/tenant-settings/feature.ts

@@ -29,21 +29,35 @@ export function createTenantSettingsFeature(
     r.config({ keys: buildTenantSettingsKeys(opts) });
     r.translations({
       keys: {
-        "tenant-settings.currency": { de: "Standard-Währung", en: "Default Currency" },
-        "tenant-settings.locale": { de: "Standard-Sprache", en: "Default Locale" },
+        "tenant-settings.currency": {
+          de: "Standard-Währung",
+          en: "Default Currency",
+          es: "Moneda predeterminada",
+        },
+        "tenant-settings.locale": {
+          de: "Standard-Sprache",
+          en: "Default Locale",
+          es: "Idioma predeterminado",
+        },
         // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
         // required by the i18n boot-validator whenever a feature masks config keys.
         "screen:tenant-settings-system.title": {
           de: "Tenant-Einstellungen",
           en: "Tenant Settings",
+          es: "Ajustes de la organización",
         },
         "screen:tenant-settings-tenant.title": {
           de: "Tenant-Einstellungen",
           en: "Tenant Settings",
+          es: "Ajustes de la organización",
         },
         // Settings-Hub nav label + configEdit section heading (same key, both
         // scopes fall back here — see buildConfigFeatureSchema).
-        "tenant-settings.settings": { de: "Tenant-Einstellungen", en: "Tenant Settings" },
+        "tenant-settings.settings": {
+          de: "Tenant-Einstellungen",
+          en: "Tenant Settings",
+          es: "Ajustes de la organización",
+        },
         // Both currency/locale are tenant-home with admin write access, which
         // cascades a SystemAdmin-only "set the platform default" screen up to
         // the system audience — scoped override so its nav entry reads
@@ -52,6 +66,7 @@ export function createTenantSettingsFeature(
         "tenant-settings.settings.system": {
           de: "Tenant-Einstellungen (Plattform-Standard)",
           en: "Tenant Settings (Platform Default)",
+          es: "Ajustes de la organización (valor predeterminado de la plataforma)",
         },
       },
     });

package/src/user-data-rights/index.ts

@@ -1,5 +1,10 @@
 export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature";
 export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write";
+export {
+  denyIfTargetOutsideAdminTenant,
+  TARGET_USER_NOT_IN_ADMIN_TENANT,
+} from "./lib/deny-if-target-outside-admin-tenant";
+export { isSystemAdminActor } from "./lib/is-admin-actor";
 // #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
 // von read_users-Rebuilds (siehe lib-Doc).
 export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle";