@cosmicdrift/kumiko-bundled-features 0.215.2 → 0.215.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.2",
+  "version": "0.215.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.2",
-    "@cosmicdrift/kumiko-framework": "0.215.2",
-    "@cosmicdrift/kumiko-headless": "0.215.2",
-    "@cosmicdrift/kumiko-renderer": "0.215.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.2",
-    "@cosmicdrift/kumiko-types": "0.215.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.3",
+    "@cosmicdrift/kumiko-framework": "0.215.3",
+    "@cosmicdrift/kumiko-headless": "0.215.3",
+    "@cosmicdrift/kumiko-renderer": "0.215.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.215.3",
+    "@cosmicdrift/kumiko-types": "0.215.3",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.2"
+    "@cosmicdrift/kumiko-locale-de": "0.215.3"
   }
 }

package/src/config/i18n.ts

@@ -4,6 +4,6 @@ type LocalizedString = { readonly en: string };
 export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
   "config.settings.title": { en: "Settings" },
   "config.settings.system": { en: "Platform" },
-  "config.settings.tenant": { en: "Organization" },
+  "config.settings.tenant": { en: "Tenant" },
   "config.settings.user": { en: "Personal" },
 };

package/src/config/web/i18n.ts

@@ -13,7 +13,7 @@ export const defaultTranslations: TranslationsByLocale = {
   en: {
     "config.settings.title": "Settings",
     "config.settings.system": "Platform",
-    "config.settings.tenant": "Organization",
+    "config.settings.tenant": "Tenant",
     "config.settings.user": "Personal",
     "config.errors.systemOnly": "This value can only be set by the system.",
     "config.errors.invalidScope": "This scope is not allowed for this key.",

package/src/custom-fields/web/client-plugin.tsx

@@ -6,7 +6,7 @@
 // referenzieren den Namen im Screen-Schema:
 //
 //   layout: { sections: [
-//     { kind: "extension", title: "...", component: {
+//     { kind: "extension", title: "...", contributesToFormSubmit: true, component: {
 //       react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME }
 //     } },
 //   ]}

package/src/notes-history/__tests__/add-note-author-name-kms.integration.test.ts

@@ -0,0 +1,89 @@
+// add-note's authorName stamping (see add-note.write.ts): the handler reads
+// the caller's own read_users row (ctx.db.raw, tenant-agnostic self-lookup —
+// same pattern as user-data-rights/handlers/cancel-deletion.write.ts) and
+// decrypts displayName before writing it as authorName. Pinned with a real
+// KMS adapter so the round-trip is proven end-to-end, not assumed from a
+// no-op-encrypt test env — a later refactor that silently reintroduces the
+// raw UUID or gets stuck on the placeholder would fail this.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { NotesHistoryHandlers, NotesHistoryQueries } from "../constants";
+import { noteEntryEntity } from "../entity";
+import { createNotesHistoryFeature } from "../feature";
+
+const notesHistoryFeature = createNotesHistoryFeature();
+const tenantId = testTenantId(1);
+
+let stack: TestStack;
+
+function memberUser(userId: string): SessionUser {
+  return { id: userId, tenantId, roles: ["TenantMember"] };
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [notesHistoryFeature] });
+  await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, userEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+describe("add-note — authorName stamped from the writer's own user row", () => {
+  test("with an active KMS, the written note carries the writer's decrypted displayName — not the UUID, not the placeholder", async () => {
+    // KMS active BEFORE the seed — seedUser runs through the executor, so
+    // the row reflects the encrypted prod state.
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    const { id: userId } = await seedUser(stack.db, {
+      email: "notes-author@example.com",
+      displayName: "Priya Natarajan",
+      emailVerified: true,
+    });
+
+    // Prove the row is actually ciphertext at rest — otherwise a no-op
+    // encrypt path would make this test pass while proving nothing.
+    const rawUserRows = await selectMany<{ displayName: unknown }>(stack.db, userTable, {
+      id: userId,
+    });
+    expect(isPiiCiphertext(rawUserRows[0]?.displayName)).toBe(true);
+
+    const { id: noteId } = await stack.http.writeOk<{ id: string }>(
+      NotesHistoryHandlers.addNote,
+      { entityType: "contact", entityId: "contact-kms-author", body: "Called back." },
+      memberUser(userId),
+    );
+
+    const { rows } = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
+      NotesHistoryQueries.noteList,
+      { filter: { field: "entityId", op: "eq", value: "contact-kms-author" } },
+      memberUser(userId),
+    );
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["id"]).toBe(noteId);
+    expect(rows[0]?.["authorName"]).toBe("Priya Natarajan");
+    expect(rows[0]?.["authorName"]).not.toBe(userId);
+    expect(rows[0]?.["authorName"]).not.toBe("Unknown author");
+  });
+});

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -87,6 +87,11 @@ describe("notes-history integration — add + list", () => {
     expect(rows[0]?.["body"]).toBe("Called about renewal");
     expect(rows[0]?.["authorId"]).toBe(member.id);
     expect(rows[0]?.["insertedAt"]).toBeTruthy();
+    // member is a synthetic SessionUser (createTestUser) with no backing
+    // read_users row, so add-note's self-lookup finds nothing to stamp — see
+    // add-note-author-name-kms.integration.test.ts for the seeded-user path
+    // where a real displayName does land in authorName.
+    expect(rows[0]?.["authorName"]).toBeNull();
   });
 
   test("a client-supplied authorId in the payload is ignored", async () => {
@@ -98,6 +103,15 @@ describe("notes-history integration — add + list", () => {
     expect(rows[0]?.["authorId"]).toBe(member.id);
   });
 
+  test("a client-supplied authorName in the payload is ignored", async () => {
+    await addNote("contact", "contact-2b", "note", member, { authorName: "Fake Display Name" });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2b" });
+    // Same guard as authorId above: addNotePayloadSchema doesn't accept an
+    // authorName field, so a smuggled value never survives to the write —
+    // the name (once stamped) can only come from the caller's own session.
+    expect(rows[0]?.["authorName"]).not.toBe("Fake Display Name");
+  });
+
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {
     await addNote("contact", "contact-3", "first");
     await addNote("contact", "contact-3", "second");

package/src/notes-history/__tests__/notes-section.test.tsx

@@ -0,0 +1,171 @@
+// @runtime client
+// DOM test for the notes-history entry display: body/meta must render as two
+// visually separate lines, the author must never be the raw authorId, and the
+// timestamp must be human-formatted — not the concatenated single-line dump
+// this test guards against (see notes-section.tsx for the fix).
+// Provider wrapper is local — renderer-web → bundled-features forbids importing
+// renderer-web test-utils from here.
+
+import { describe, expect, test } from "bun:test";
+import { createStore, type Dispatcher, type DispatcherStatus } from "@cosmicdrift/kumiko-headless";
+import {
+  createStaticLocaleResolver,
+  DispatcherProvider,
+  formatWhen,
+  kumikoDefaultTranslations,
+  type LiveEventSubscriber,
+  LiveEventsProvider,
+  LocaleProvider,
+  PrimitivesProvider,
+  TokensProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives, defaultTokens } from "@cosmicdrift/kumiko-renderer-web";
+import { render, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { NotesHistoryQueries } from "../constants";
+import { defaultTranslations } from "../web/i18n";
+import { NotesSection } from "../web/notes-section";
+
+if (typeof globalThis.ResizeObserver === "undefined") {
+  globalThis.ResizeObserver = class {
+    observe(): void {}
+    unobserve(): void {}
+    disconnect(): void {}
+  } as unknown as typeof ResizeObserver;
+}
+
+const stubLiveEvents: LiveEventSubscriber = () => () => {};
+const stubTokens = {
+  tokens: defaultTokens,
+  mode: "light" as const,
+  setMode: () => {},
+  toggleMode: () => {},
+};
+const stubResolver = createStaticLocaleResolver();
+
+type NoteRowFixture = {
+  readonly id: string;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly authorId: string;
+  readonly authorName: string | null;
+  readonly body: string;
+  readonly insertedAt: string;
+};
+
+const AUTHOR_ID = "01a0244b-71f2-76e4-854f-e360584f01e9";
+const AUTHOR_NAME = "Jamie Vance";
+const INSERTED_AT = "2026-08-21T12:28:41.580Z";
+const NOTE_BODY = "Vertragsunterlagen per Post verschickt.";
+
+const NOTE_ROWS: readonly NoteRowFixture[] = [
+  {
+    id: "note-1",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: AUTHOR_ID,
+    authorName: AUTHOR_NAME,
+    body: NOTE_BODY,
+    insertedAt: INSERTED_AT,
+  },
+  {
+    id: "note-2",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: "02b1355c-8203-87f5-9650-f471695002f0",
+    authorName: null,
+    body: "Legacy entry predating authorName.",
+    insertedAt: "2026-07-01T09:00:00.000Z",
+  },
+];
+
+function makeDispatcher(): Dispatcher {
+  const statusStore = createStore<DispatcherStatus>("online");
+  const query = (async (type: string) => {
+    if (type === NotesHistoryQueries.noteList) {
+      return { isSuccess: true, data: { rows: NOTE_ROWS } };
+    }
+    return { isSuccess: true, data: null };
+  }) as unknown as Dispatcher["query"];
+  return {
+    write: (async () => ({ isSuccess: true, data: null })) as unknown as Dispatcher["write"],
+    query,
+    batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
+    statusStore,
+    async *stream() {},
+    pendingWrites: () => [],
+    pendingFiles: () => [],
+  } as unknown as Dispatcher; // @cast-boundary test-stub
+}
+
+function renderSection(): ReturnType<typeof render> {
+  const wrapper = ({ children }: { readonly children: ReactNode }): ReactNode => (
+    <TokensProvider value={stubTokens}>
+      <LocaleProvider
+        resolver={stubResolver}
+        fallbackBundles={[defaultTranslations, kumikoDefaultTranslations]}
+      >
+        <PrimitivesProvider value={defaultPrimitives}>
+          <LiveEventsProvider value={stubLiveEvents}>
+            <DispatcherProvider dispatcher={makeDispatcher()}>{children}</DispatcherProvider>
+          </LiveEventsProvider>
+        </PrimitivesProvider>
+      </LocaleProvider>
+    </TokensProvider>
+  );
+  return render(<NotesSection entityName="contact" entityId="contact-1" />, { wrapper });
+}
+
+describe("NotesSection — entry display", () => {
+  test("note body and meta line render as two distinct nodes, not one run-on line", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-body") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const bodyEl = view.getByTestId("notes-section-row-note-1-body");
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(bodyEl).not.toBe(metaEl);
+    expect(bodyEl.textContent).toBe(NOTE_BODY);
+    expect(metaEl.textContent).not.toContain(NOTE_BODY);
+
+    const row = view.getByTestId("notes-section-row-note-1");
+    expect(row.className).toContain("flex-col");
+  });
+
+  test("a stamped authorName renders as the author, never the raw authorId", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(metaEl.textContent).not.toContain(AUTHOR_ID);
+    expect(metaEl.textContent).toContain(AUTHOR_NAME);
+  });
+
+  test("a null authorName (legacy row, or shredded author) renders the placeholder", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-2-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-2-meta");
+    expect(metaEl.textContent).toContain("Unknown author");
+  });
+
+  test("date renders formatted, never the raw ISO timestamp", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-1-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-1-meta");
+    expect(metaEl.textContent).not.toContain(INSERTED_AT);
+    expect(metaEl.textContent).toContain(formatWhen(INSERTED_AT));
+  });
+});

package/src/notes-history/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.215.3",
+    "type": "improvement",
+    "title": "note-entry gains authorName, stamped at write time",
+    "detail": "The entry display previously had no readable author — only the internal authorId (UUID). note-entry now carries an `authorName` field (personal: { of: \"authorId\" }, same crypto-shredding subject as `body`), stamped once at add-note write time from the writer's own read_users row (self-lookup by id, decrypted displayName) so the append-only history keeps the name as it was when the note was written, not whatever the account is called later. A failed lookup, a missing displayName, and pre-field/shredded rows all read `authorName: null` — the UI falls back to a translated placeholder, never the raw id; the write itself never fails over a missing name.",
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_note_entries.authorName`. No backfill: existing rows read null and show the placeholder, same as before this change from the user's point of view."
+  }
+]

package/src/notes-history/entity.ts

@@ -31,6 +31,13 @@ export const noteEntryEntity = createEntity({
     authorId: createTextField({
       personal: "ref",
     }),
+    // Stamped once at write time, never re-resolved later — the history
+    // needs the name as it was then, not whatever the account is called now.
+    authorName: createTextField({
+      maxLength: 200,
+      personal: { of: "authorId" },
+      find: "none",
+    }),
     body: createLongTextField({
       required: true,
       maxLength: 20_000,

package/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,7 @@
+import { fetchOne, runInSavepoint } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { decryptStoredPii } from "../../shared";
+import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
 import { noteEntryExecutor } from "../executor";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
@@ -17,7 +20,28 @@ export function createAddNoteHandler(
     access,
     handler: async (event, ctx) => {
       const payload = event.payload as AddNotePayload; // @cast-boundary engine-payload
-      return noteEntryExecutor.create({ ...payload, authorId: event.user.id }, event.user, ctx.db);
+
+      let authorName: string | null = null;
+      try {
+        // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.
+        // Bun.SQL poisons the whole tx after any error inside it, even one that's
+        // caught — a bare try/catch here would take the note write down with it.
+        authorName = await runInSavepoint(ctx.db.raw, async (sp) => {
+          const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
+            id: event.user.id,
+          });
+          if (!userRow?.displayName) return null;
+          return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
+        });
+      } catch {
+        authorName = null;
+      }
+
+      return noteEntryExecutor.create(
+        { ...payload, authorId: event.user.id, authorName },
+        event.user,
+        ctx.db,
+      );
     },
   };
 }

package/src/notes-history/web/i18n.ts

@@ -14,5 +14,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "notesHistory.section.working": "Saving…",
     "notesHistory.section.add": "Add note",
     "notesHistory.section.meta": "{author} · {date}",
+    "notesHistory.section.authorUnknown": "Unknown author",
   },
 };

package/src/notes-history/web/notes-section.tsx

@@ -12,6 +12,7 @@
 //                   (RenderEdit passes { entityName, entityId }).
 
 import {
+  formatWhen,
   useDispatcher,
   usePrimitives,
   useQuery,
@@ -25,6 +26,8 @@ type NoteRow = {
   readonly entityType: string;
   readonly entityId: string;
   readonly authorId: string;
+  // Null for pre-authorName history and for shredded authors.
+  readonly authorName: string | null;
   readonly body: string;
   readonly insertedAt: string;
 };
@@ -136,11 +139,14 @@ export function NotesSection({
             <div
               key={n.id}
               data-testid={`notes-section-row-${n.id}`}
-              className="rounded-md border p-2"
+              className="flex flex-col gap-1 rounded-md border p-2"
             >
-              <Text>{n.body}</Text>
-              <Text variant="small">
-                {t("notesHistory.section.meta", { author: n.authorId, date: n.insertedAt })}
+              <Text testId={`notes-section-row-${n.id}-body`}>{n.body}</Text>
+              <Text variant="small" testId={`notes-section-row-${n.id}-meta`}>
+                {t("notesHistory.section.meta", {
+                  author: n.authorName ?? t("notesHistory.section.authorUnknown"),
+                  date: formatWhen(n.insertedAt),
+                })}
               </Text>
             </div>
           ))}

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -54,6 +54,9 @@ describe("noteEntryExportHook", () => {
     expect(snippet).not.toBeNull();
     const bodies = (snippet?.rows ?? []).map((r) => r["body"]);
     expect(bodies).toEqual(["by author"]);
+    // No read_users row is seeded in this stack, so add-note's self-lookup
+    // stamps authorName null — export must still carry the key.
+    expect(Object.keys(snippet?.rows?.[0] ?? {})).toContain("authorName");
   });
 
   test("returns null when the user authored no notes", async () => {

package/src/notes-history-user-data/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.215.3",
+    "type": "improvement",
+    "title": "note-entry GDPR export now includes authorName",
+    "detail": "The Art. 20 export for `note-entry` (noteEntryExportHook) enumerates fields explicitly and did not know about the new `authorName` field added alongside `body`. The export row now also carries the stamped `authorName` (null on legacy/shredded rows, same as the read path)."
+  }
+]

package/src/notes-history-user-data/hooks.ts

@@ -21,12 +21,13 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
       entityType: r["entityType"],
       entityId: r["entityId"],
       body: r["body"],
+      authorName: r["authorName"],
       insertedAt: r["insertedAt"],
     })),
   };
 };
 
-// Deliberate no-op: `body` is annotated `personal: { of: "authorId" }`
+// Deliberate no-op: `body` and `authorName` are annotated `personal: { of: "authorId" }`
 // (entity.ts), which relies on crypto-shredding (mounted KMS) for erasure —
 // destroying the author's subject key makes every note-entry event AND
 // projected row unreadable at once, without needing a physical delete