@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/user/schema/user.ts

@@ -71,9 +71,8 @@ export const userEntity = createEntity({
       format: "email",
       maxLength: 320,
       personal: "self",
-      find: "exact",
-      // Roster search needs email hits; find:"exact" alone is blind-index only.
-      searchable: true,
+      // Roster search needs email hits — fuzzy expands to lookupable+searchable.
+      find: "fuzzy",
       access: { write: access.privileged },
     }),
 

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -34,6 +34,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
+  expectSuccess,
   resetBlindIndexKeyForTests,
   resetPiiSubjectKmsForTests,
   resetTestTables,
@@ -447,8 +448,8 @@ describe("runUserExport :: tenant-invitation PII export (#1937)", () => {
       systemUser,
       tenantDb,
     );
-    expect(createResult.isSuccess).toBe(true);
-    const invitationId = (createResult as { data: { id: string } }).data.id;
+    expectSuccess(createResult);
+    const invitationId = createResult.data.id;
 
     const rawRows = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
       `SELECT email, email_bidx FROM read_tenant_invitations WHERE id = $1`,

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -24,6 +24,7 @@ import {
   EXT_USER_DATA,
   type JobContext,
   SYSTEM_USER_ID,
+  type TenantId,
   type UserDataDeleteHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -245,16 +246,13 @@ describe("forget pipeline honours the effective tenant model", () => {
     // `tenant-membership.created` events, so FORGET_USER needs its own
     // `.created` event too, or the tenant would only ever show 1 distinct
     // historical member (CO_MEMBER) even after it truly had 2.
-    // Explicit `by`: streamTenantFor(user) keys each event's OWN tenantId
-    // column off the acting user, not the payload's tenantId — the
-    // seedTenantMembership default (TestUsers.systemAdmin) lives on a
-    // different tenant, which would emit .created under the wrong tenantId
-    // and make it invisible to everHadMultipleMembers' tenant-scoped query.
+    // seedTenantMembership defaults `by` to createSystemUser(tenantId), so
+    // the stream tenant matches TENANT (unlike seedTenant, which defaults
+    // to TestUsers.systemAdmin).
     await seedTenantMembership(stack.db, {
       userId: FORGET_USER,
       tenantId: TENANT,
       roles: ["Member"],
-      by: createSystemUser(TENANT),
     });
 
     // CO_MEMBER joins for real (emits tenant-membership.created) and is then
@@ -265,7 +263,6 @@ describe("forget pipeline honours the effective tenant model", () => {
       userId: CO_MEMBER,
       tenantId: TENANT,
       roles: ["Member"],
-      by: createSystemUser(TENANT),
     });
     const deleteResult = await membershipExecutor.delete(
       { id: created.id },
@@ -299,6 +296,47 @@ describe("forget pipeline honours the effective tenant model", () => {
     // historical check must still resolve multi-user here.
     expect(await rowCount()).toBe(1);
   });
+
+  test("single-user history latch uses payload tenantId (cross-tenant SystemAdmin actor)", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c6");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    const OTHER_TENANT = "dddddddd-dddd-4ddd-8ddd-0000000000aa" as TenantId;
+
+    // Membership events billed to a foreign actor tenant — mirrors real
+    // SystemAdmin addMember (event.tenant_id ≠ payload.tenantId).
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(OTHER_TENANT),
+    });
+    const created = await seedTenantMembership(stack.db, {
+      userId: CO_MEMBER,
+      tenantId: TENANT,
+      roles: ["Member"],
+      by: createSystemUser(OTHER_TENANT),
+    });
+    const deleteResult = await membershipExecutor.delete(
+      { id: created.id },
+      createSystemUser(OTHER_TENANT),
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!deleteResult.isSuccess) {
+      throw new Error(`test setup: co-member delete failed: ${deleteResult.error.code}`);
+    }
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    // Payload-tenant latch must still see 2 historical members.
+    expect(await rowCount()).toBe(1);
+  });
 });
 
 describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {

package/src/user-data-rights/run-forget-cleanup.ts

@@ -41,6 +41,7 @@ import {
 import {
   type DbRunner,
   entityEventName,
+  executeRawQuery,
   nullBlindIndexesForSubject,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -53,7 +54,6 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -519,12 +519,12 @@ async function runInSubTransaction(
     begin?: (f: (tx: DbRunner) => Promise<void>) => Promise<void>;
     savepoint?: (f: (tx: DbRunner) => Promise<void>) => Promise<void>;
   };
-  // savepoint-FIRST — empirisch (Bun 1.4.0) sind die Flächen NICHT
-  // mutually exclusive: eine TransactionSql exposed begin UND savepoint,
-  // nur die Top-Level-Connection hat ausschließlich begin. begin-first
-  // wählte im Tx-Fall das nested BEGIN (Prod-Incident-Klasse, s. Header);
-  // savepoint-first trifft im Tx-Fall den Savepoint und fällt top-level
-  // sauber auf begin zurück.
+  // savepoint-FIRST — empirisch (Bun 1.3.14, unter 1.4.0 nicht neu geprüft)
+  // sind die Flächen NICHT mutually exclusive: eine TransactionSql exposed
+  // begin UND savepoint, nur die Top-Level-Connection hat ausschließlich
+  // begin. begin-first wählte im Tx-Fall das nested BEGIN (Prod-Incident-
+  // Klasse, s. Header); savepoint-first trifft im Tx-Fall den Savepoint
+  // und fällt top-level sauber auf begin zurück.
   const open = runner.savepoint ?? runner.begin;
   if (!open) {
     throw new Error(
@@ -570,26 +570,36 @@ async function resolveEffectiveTenantModel(
 // enough: a tenant that ever had >1 distinct member must stay multi-user for
 // the forget path even after everyone but one is removed, or the sole
 // remaining member's forget request wipes the departed co-member's leftover
-// rows. LIMIT chosen generously for a nominally single-user tenant; hitting
-// it is itself a multi-user signal, so it also resolves to "multi-user".
-const MAX_MEMBERSHIP_CREATED_EVENTS = 1000;
-
+// rows.
+//
+// Filter by payload->>'tenantId' (not the event column tenant_id): cross-
+// tenant SystemAdmin adds land under the actor's tenant_id (#2347). SQL
+// aggregation stays fail-safe when userId payloads are unreadable: more
+// created-rows than distinct userIds ⇒ treat as multi-user.
 async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise<boolean> {
-  const createdEvents = await selectMany<{ payload: Record<string, unknown> }>(
+  const eventType = entityEventName("tenant-membership", "created");
+  const rows = await executeRawQuery<{
+    event_count: number;
+    distinct_users: number;
+  }>(
     db,
-    eventsTable,
-    {
-      tenantId,
-      aggregateType: "tenant-membership",
-      type: entityEventName("tenant-membership", "created"),
-    },
-    { limit: MAX_MEMBERSHIP_CREATED_EVENTS },
-  );
-  if (createdEvents.length >= MAX_MEMBERSHIP_CREATED_EVENTS) return true;
-  const distinctUserIds = new Set(
-    createdEvents.map((e) => e.payload["userId"]).filter((v): v is string => typeof v === "string"),
+    `SELECT
+       COUNT(*)::int AS event_count,
+       COUNT(DISTINCT payload->>'userId')::int AS distinct_users
+     FROM kumiko_events
+     WHERE aggregate_type = 'tenant-membership'
+       AND type = $1
+       AND payload->>'tenantId' = $2`,
+    [eventType, tenantId],
   );
-  return distinctUserIds.size > 1;
+  const row = rows[0];
+  if (!row) return false;
+  if (row.distinct_users > 1) return true;
+  // Unreadable / missing userId payloads: fail-safe to multi-user
+  // (including a lone created-event with no readable userId).
+  if (row.event_count >= 1 && row.distinct_users < 1) return true;
+  if (row.event_count > 1 && row.distinct_users <= 1) return true;
+  return false;
 }
 
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.

package/src/user-data-rights/web/__tests__/privacy-center-screen.test.tsx

@@ -273,6 +273,29 @@ describe("PrivacyCenterScreen", () => {
       assign.mockRestore();
     }
   });
+
+  test("Download-Button does not navigate when downloadByJob returns no url", async () => {
+    const assign = spyOn(window.location, "assign").mockImplementation(() => {});
+    try {
+      const { view } = renderCenter({
+        me: activeMe,
+        downloadUrl: undefined,
+        exportStatus: {
+          hasJob: true,
+          job: { id: "job-123", status: EXPORT_JOB_STATUS.Done, expiresAt: "2026-07-11T00:00:00Z" },
+        },
+      });
+      await waitForDownloadReady(view);
+      fireEvent.click(view.getByTestId("privacy-export-download"));
+      // Banner uses t(i18nKey) — assert the resolved EN copy, not the raw key.
+      await waitFor(() => {
+        expect(view.container.textContent).toContain("Download unavailable — please try again.");
+      });
+      expect(assign).not.toHaveBeenCalled();
+    } finally {
+      assign.mockRestore();
+    }
+  });
 });
 
 describe("QN-Drift-Pins (client-Konstanten vs. Feature-Originale)", () => {

package/src/user-data-rights/web/privacy-center-screen.tsx

@@ -387,7 +387,7 @@ export function PrivacyCenterScreen({
   };
 
   return (
-    <FormScreenShell className="flex flex-col gap-6" testId="privacy-center-screen">
+    <FormScreenShell className="flex flex-col gap-6" testId="privacy-center-screen" maxWidth="3xl">
       <Heading variant="page">{t("userDataRights.privacyCenter.title")}</Heading>
       <p className="text-sm text-muted-foreground">{t("userDataRights.privacyCenter.intro")}</p>
       <ExportSection />

package/src/user-profile/web/profile-screen.tsx

@@ -361,7 +361,7 @@ export function ProfileScreen(): ReactNode {
   };
 
   return (
-    <FormScreenShell className="flex flex-col gap-6" testId="profile-screen">
+    <FormScreenShell className="flex flex-col gap-6" testId="profile-screen" maxWidth="3xl">
       <Heading variant="page">{t("profile.title")}</Heading>
       {/* Die zwei kurzen Konto-Forms teilen sich eine Reihe (md+); die
           Danger-Zone bleibt volle Breite darunter. */}

package/src/feature-toggles/web/toggle-admin-screen.tsx

@@ -1,137 +0,0 @@
-// @runtime client
-import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
-import { type ReactNode, useCallback, useEffect, useState } from "react";
-import { FeatureToggleHandlers, FeatureToggleQueries } from "../constants";
-
-type ToggleRow = {
-  readonly name: string;
-  readonly toggleable: boolean;
-  readonly default: boolean | null;
-  readonly override: boolean | null;
-  readonly effective: boolean | null;
-};
-
-type RegisteredResponse = {
-  readonly items: readonly ToggleRow[];
-};
-
-type State =
-  | { readonly kind: "loading" }
-  | { readonly kind: "error"; readonly message: string }
-  | { readonly kind: "ready"; readonly items: readonly ToggleRow[] };
-
-export function ToggleAdminScreen(): ReactNode {
-  const t = useTranslation();
-  const { Banner, Card, DataTable, Heading, Text } = usePrimitives();
-  const dispatcher = useDispatcher();
-  const [state, setState] = useState<State>({ kind: "loading" });
-  const [actionError, setActionError] = useState<string | null>(null);
-
-  const load = useCallback(async (): Promise<void> => {
-    setState({ kind: "loading" });
-    const res = await dispatcher.query<RegisteredResponse>(FeatureToggleQueries.registered, {});
-    if (!res.isSuccess) {
-      setState({ kind: "error", message: res.error.message });
-      return;
-    }
-    setState({ kind: "ready", items: res.data.items });
-  }, [dispatcher]);
-
-  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
-  useEffect(() => {
-    void load();
-  }, [load]);
-
-  const onSet = async (featureName: string, enabled: boolean): Promise<void> => {
-    setActionError(null);
-    const res = await dispatcher.write(FeatureToggleHandlers.set, { featureName, enabled });
-    if (!res.isSuccess) {
-      setActionError(res.error.message);
-      return;
-    }
-    await load();
-  };
-
-  if (state.kind === "loading") {
-    return (
-      <FormScreenShell testId="toggle-admin-screen">
-        <Text variant="small">{t("feature-toggles.admin.loading")}</Text>
-      </FormScreenShell>
-    );
-  }
-
-  if (state.kind === "error") {
-    return (
-      <FormScreenShell testId="toggle-admin-screen">
-        <Banner variant="error">{state.message}</Banner>
-      </FormScreenShell>
-    );
-  }
-
-  return (
-    <FormScreenShell testId="toggle-admin-screen" maxWidth="4xl" className="flex flex-col gap-6">
-      <Heading variant="page">{t("feature-toggles.admin.title")}</Heading>
-
-      {actionError !== null && <Banner variant="error">{actionError}</Banner>}
-
-      <Card options={{ padded: false }}>
-        <DataTable
-          testId="toggle-admin-table"
-          columns={[
-            {
-              field: "feature",
-              label: t("feature-toggles.admin.col.feature"),
-              type: "string",
-              sortable: false,
-            },
-            {
-              field: "default",
-              label: t("feature-toggles.admin.col.default"),
-              type: "string",
-              sortable: false,
-            },
-            {
-              field: "override",
-              label: t("feature-toggles.admin.col.override"),
-              type: "string",
-              sortable: false,
-            },
-            {
-              field: "effective",
-              label: t("feature-toggles.admin.col.effective"),
-              type: "string",
-              sortable: false,
-            },
-          ]}
-          rows={state.items.map((row) => ({
-            id: row.name,
-            values: {
-              feature: row.name,
-              default: formatFlag(row.default),
-              override: formatFlag(row.override),
-              effective: formatFlag(row.effective),
-              toggleable: row.toggleable,
-              effectiveBool: row.effective ?? row.default ?? false,
-            },
-          }))}
-          rowActions={[
-            {
-              id: "toggle",
-              label: t("feature-toggles.admin.toggle"),
-              style: "secondary",
-              isVisible: (row) => row.values["toggleable"] === true,
-              onTrigger: (row) => void onSet(row.id, !(row.values["effectiveBool"] as boolean)),
-            },
-          ]}
-          rowActionMode="inline"
-        />
-      </Card>
-    </FormScreenShell>
-  );
-}
-
-function formatFlag(value: boolean | null): string {
-  if (value === null) return "inherit";
-  return value ? "on" : "off";
-}