@cosmicdrift/kumiko-bundled-features 0.221.0 → 0.223.0

package/src/channel-email/__tests__/email-channel.test.ts

@@ -65,6 +65,25 @@ describe("email channel envelope", () => {
     expect(sent.headers).toBeUndefined();
   });
 
+  test("non-string header values are filtered out", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: {
+        subject: "t",
+        body: "b",
+        headers: { "X-Ok": "v", "X-Bad": 42 },
+      },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers).toEqual({ "X-Ok": "v" });
+  });
+
   test("a non-object headers value is ignored, not forwarded", async () => {
     const transport = createInMemoryTransport();
     const message: ChannelMessage = {

package/src/channel-email/__tests__/pii-guard.test.ts

@@ -45,6 +45,17 @@ describe("guardEmailMessage", () => {
     ).toThrow(/from address is a PII ciphertext/);
   });
 
+  test("ciphertext in a custom header is refused", () => {
+    expect(() =>
+      guardEmailMessage({
+        to: "ok@example.com",
+        headers: { "In-Reply-To": CIPHERTEXT },
+        subject: "Hi",
+        html: "x",
+      }),
+    ).toThrow(/header "In-Reply-To" is a PII ciphertext/);
+  });
+
   test("ciphertext Reply-To is refused", () => {
     expect(() =>
       guardEmailMessage({ to: "ok@example.com", replyTo: CIPHERTEXT, subject: "Hi", html: "x" }),

package/src/channel-email/email-channel.ts

@@ -13,19 +13,26 @@ import type { EmailTransport } from "./types";
 // the notification's email template echoes it out of the notify() call, since
 // buildMessage collapses the raw data to the template's result. Content
 // (subject, html) is rendered; these three are copied straight to the message.
+function stringHeaders(raw: unknown): Readonly<Record<string, string>> | undefined {
+  if (raw === undefined || raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return undefined;
+  }
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === "string") out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
 function emailEnvelopeFrom(data: Readonly<Record<string, unknown>> | undefined): {
   from?: string;
   replyTo?: string;
   headers?: Readonly<Record<string, string>>;
 } {
   if (!data) return {};
-  const from = typeof data["from"] === "string" ? (data["from"] as string) : undefined;
-  const replyTo = typeof data["replyTo"] === "string" ? (data["replyTo"] as string) : undefined;
-  const raw = data["headers"];
-  const headers =
-    raw && typeof raw === "object" && !Array.isArray(raw)
-      ? (raw as Readonly<Record<string, string>>)
-      : undefined;
+  const from = typeof data["from"] === "string" ? data["from"] : undefined;
+  const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
+  const headers = stringHeaders(data["headers"]);
   return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
 }
 

package/src/channel-email/pii-guard.ts

@@ -26,6 +26,14 @@ export function guardEmailMessage(message: EmailMessage): EmailMessage {
       );
     }
   }
+  for (const [headerName, headerValue] of Object.entries(message.headers ?? {})) {
+    if (typeof headerValue === "string" && headerValue.includes(CIPHERTEXT_MARKER)) {
+      throw new Error(
+        `[channel-email] refusing to send: header "${headerName}" is a PII ciphertext ` +
+          `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
+      );
+    }
+  }
   const leaking =
     message.subject.includes(CIPHERTEXT_MARKER) || message.html.includes(CIPHERTEXT_MARKER);
   if (!leaking) return message;

package/src/compliance-profiles/handlers/set-profile.write.ts

@@ -87,10 +87,7 @@ export const setProfileWrite = defineWriteHandler({
         const parseError = e instanceof Error ? e.message : String(e);
         return writeFailure(
           new UnprocessableError("compliance_override_invalid_json", {
-            details: {
-              reason: "compliance_override_invalid_json",
-              parseError,
-            },
+            details: { parseError },
           }),
         );
       }

package/src/crypto-shredding/constants.ts

@@ -1,6 +1,7 @@
 export const CRYPTO_SHREDDING_FEATURE_NAME = "crypto-shredding";
 
 export const SUBJECT_FORGOTTEN_EVENT_NAME = "crypto-shredding:event:subject-forgotten";
+export const SUBJECT_FORGET_DENIED_EVENT_NAME = "crypto-shredding:event:forget-denied";
 
 export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";
 

package/src/crypto-shredding/feature.ts

@@ -1,6 +1,10 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants";
-import { forgetSubjectWrite, subjectForgottenSchema } from "./handlers/forget-subject.write";
+import {
+  forgetSubjectWrite,
+  subjectForgetDeniedSchema,
+  subjectForgottenSchema,
+} from "./handlers/forget-subject.write";
 
 export function createCryptoShreddingFeature(): FeatureDefinition {
   return defineFeature(CRYPTO_SHREDDING_FEATURE_NAME, (r) => {
@@ -13,6 +17,7 @@ export function createCryptoShreddingFeature(): FeatureDefinition {
     });
 
     r.defineEvent("subject-forgotten", subjectForgottenSchema);
+    r.defineEvent("forget-denied", subjectForgetDeniedSchema);
     r.writeHandler(forgetSubjectWrite);
   });
 }

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -33,6 +33,7 @@ import {
 } from "../../user-data-rights";
 import {
   CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  SUBJECT_FORGET_DENIED_EVENT_NAME,
   SUBJECT_FORGOTTEN_EVENT_NAME,
   TARGET_TENANT_NOT_ADMIN_TENANT,
 } from "../constants";
@@ -53,6 +54,14 @@ export const subjectForgottenSchema = z.object({
   forgottenBy: z.string().min(1),
 });
 
+export const subjectForgetDeniedSchema = z.object({
+  subjectKey: z.string().min(1),
+  reason: z.string().min(10),
+  forgottenBy: z.string().min(1),
+  actorTenantId: z.string().min(1),
+  denial: z.string().min(1),
+});
+
 type SubjectIdInput = z.infer<typeof subjectIdSchema>;
 
 // Tenant-scope guard (mh#349): DataProtectionOfficer is a tenant-scoped role,
@@ -128,7 +137,22 @@ export const forgetSubjectWrite = defineWriteHandler({
       event.user,
       raw,
     );
-    if (tenantScopeDenial) return tenantScopeDenial;
+    if (tenantScopeDenial) {
+      // Denied cross-tenant probes must still leave an audit trail (fw#2348).
+      await ctx.unsafeAppendEvent({
+        aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
+        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+        type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+        payload: {
+          subjectKey,
+          reason: event.payload.reason,
+          forgottenBy: event.user.id,
+          actorTenantId: event.user.tenantId,
+          denial: tenantScopeDenial.error.code,
+        },
+      });
+      return tenantScopeDenial;
+    }
 
     // Erase BEFORE the audit append: if the append throws, the key is gone
     // but no event exists — a retry is a no-op erase plus the event. The

package/src/crypto-shredding/index.ts

@@ -1,11 +1,13 @@
 export {
   CRYPTO_SHREDDING_AGGREGATE_TYPE,
   CRYPTO_SHREDDING_FEATURE_NAME,
+  SUBJECT_FORGET_DENIED_EVENT_NAME,
   SUBJECT_FORGOTTEN_EVENT_NAME,
 } from "./constants";
 export { createCryptoShreddingFeature } from "./feature";
 export {
   forgetSubjectSchema,
+  subjectForgetDeniedSchema,
   subjectForgottenSchema,
   subjectIdSchema,
 } from "./handlers/forget-subject.write";

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -31,6 +31,8 @@ import {
 import { z } from "zod";
 import { AuditQueries } from "../../audit/constants";
 import { createAuditFeature } from "../../audit/feature";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant";
 import { fieldDefinitionEntity } from "../entity";
 import { createCustomFieldsFeature } from "../feature";
 import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
@@ -79,7 +81,13 @@ let stack: TestStack;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [customFieldsFeature, propertyFeature, createAuditFeature()],
+    features: [
+      customFieldsFeature,
+      propertyFeature,
+      createConfigFeature(),
+      createTenantFeature(),
+      createAuditFeature(),
+    ],
   });
   await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, propertyEntity);

package/src/file-derivatives/feature.ts

@@ -58,7 +58,7 @@ export type FileDerivativesOptions = {
 type PublicVariantQueryResult = {
   readonly dataBase64: string;
   readonly mimeType: string;
-  readonly storageKey: string;
+  readonly revision: string;
 } | null;
 
 // file-derivatives — derive-on-first-use file variants (thumbnails,
@@ -168,7 +168,7 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
           if (!result) return c.text("not found", 404);
 
           const bytes = Buffer.from(result.dataBase64, "base64");
-          const etag = computeRevisionEtag([tenantId, fileRefId, variant, result.storageKey]);
+          const etag = computeRevisionEtag([tenantId, fileRefId, variant, result.revision]);
           return cachedResponse(c.req.raw, {
             body: bytes,
             etag,

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -17,6 +17,7 @@
 // `anonymousAccess` resolution — tenant provenance there depends on the
 // consumer's `resolverTrust`/anonymousAccess setup, not the host.
 
+import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { resolveFieldVariant } from "@cosmicdrift/kumiko-framework/derivatives";
 import {
@@ -35,10 +36,7 @@ type FileRefRow = {
   readonly fieldName: string | null;
 };
 
-// A declared variant with no explicit gate in `isPublic` is implicitly
-// public as soon as the entityType-level check returns `true` — `fieldName`
-// and `variant` let a predicate opt individual fields/variants out (e.g. a
-// cheap `thumb` served publicly while an expensive `full` stays gated).
+// Declared variants are implicitly public once the entityType check passes — `fieldName`/`variant` allow per-variant opt-out.
 export type DerivativePublicPredicateArgs = {
   readonly entityId: string;
   readonly tenantId: TenantId;
@@ -136,7 +134,8 @@ export const publicVariantQuery = defineQueryHandler({
     return {
       dataBase64: Buffer.from(bytes).toString("base64"),
       mimeType: result.mimeType,
-      storageKey: result.storageKey,
+      // Opaque revision for ETag — never expose the internal storageKey over /api/query.
+      revision: computeRevisionEtag([result.storageKey]),
     };
   },
 });

package/src/files-provider-s3/__tests__/s3-provider.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, test } from "bun:test";
 import type { S3ProviderConfig } from "../s3-provider";
-import { createS3Provider, resolveForcePathStyle, resolveVirtualHostedStyle } from "../s3-provider";
+import {
+  collectPaginatedKeys,
+  createS3Provider,
+  resolveForcePathStyle,
+  resolveVirtualHostedStyle,
+} from "../s3-provider";
 
 const baseConfig: S3ProviderConfig = {
   bucket: "b",
@@ -66,6 +71,58 @@ describe("resolveVirtualHostedStyle (inverse of forcePathStyle)", () => {
   });
 });
 
+// collectPaginatedKeys owns the isTruncated/startAfter loop `list()` runs on
+// top of a live client.list() — tested hermetically here (a real 1000+ key
+// bucket would make this slow and flaky) so a regression in the loop itself
+// (dropped page, infinite loop, wrong startAfter) fails fast without MinIO.
+type FakePage = {
+  readonly contents?: ReadonlyArray<{ readonly key: string }>;
+  readonly isTruncated?: boolean;
+};
+
+describe("collectPaginatedKeys", () => {
+  test("stops after a single non-truncated page", async () => {
+    const keys = await collectPaginatedKeys(async () => ({
+      contents: [{ key: "a" }, { key: "b" }],
+      isTruncated: false,
+    }));
+    expect(keys).toEqual(["a", "b"]);
+  });
+
+  test("follows isTruncated across multiple pages, passing the last key as startAfter", async () => {
+    const requestedStartAfters: Array<string | undefined> = [];
+    const pages: readonly FakePage[] = [
+      { contents: [{ key: "a" }, { key: "b" }], isTruncated: true },
+      { contents: [{ key: "c" }, { key: "d" }], isTruncated: true },
+      { contents: [{ key: "e" }], isTruncated: false },
+    ];
+    let call = 0;
+    const keys = await collectPaginatedKeys(async (startAfter) => {
+      requestedStartAfters.push(startAfter);
+      const page = pages[call];
+      call += 1;
+      if (!page) throw new Error("unexpected extra page request");
+      return page;
+    });
+
+    expect(keys).toEqual(["a", "b", "c", "d", "e"]);
+    expect(requestedStartAfters).toEqual([undefined, "b", "d"]);
+  });
+
+  test("an empty page stops the loop even if isTruncated is (incorrectly) true", async () => {
+    const keys = await collectPaginatedKeys(async () => ({
+      contents: [],
+      isTruncated: true,
+    }));
+    expect(keys).toEqual([]);
+  });
+
+  test("a page with no contents field is treated as empty", async () => {
+    const keys = await collectPaginatedKeys(async () => ({}));
+    expect(keys).toEqual([]);
+  });
+});
+
 // presign is a pure local signing operation (HMAC, no network), so it tests
 // hermetically with dummy credentials. Proves Bun actually signs contentDisposition
 // as the response-content-disposition query param — otherwise a download would

package/src/files-provider-s3/s3-provider.ts

@@ -29,6 +29,15 @@ import {
 // AWS-CLI: `aws s3api put-bucket-lifecycle-configuration --bucket <name>
 // --lifecycle-configuration file://lifecycle.json`. Hetzner Object Storage
 // + R2 + Minio supporten dieselbe Syntax.
+//
+// =============================================================================
+// Operator-Pflicht-Setup (IAM: list permission)
+// =============================================================================
+//
+// GDPR-forget/tenant-destroy erasure (user-data-rights-defaults) calls
+// `list()` to find derivative/variant keys alongside the original. A bucket
+// policy granting only `s3:DeleteObject` (no `s3:ListBucket`) makes every
+// forget run fail — grant both, not just delete.
 
 const STREAM_PART_SIZE = 5 * 1024 * 1024;
 
@@ -48,6 +57,32 @@ export type S3ProviderConfig = {
   readonly forcePathStyle?: boolean;
 };
 
+// A single S3 list() page, generalized just enough that collectPaginatedKeys
+// can be tested against a fake sequence of pages, no live bucket needed.
+type S3ListPage = {
+  readonly contents?: ReadonlyArray<{ readonly key: string }>;
+  readonly isTruncated?: boolean;
+};
+
+// Exported for unit testing — the loop is the load-bearing part of `list`:
+// S3 caps a page at 1000 keys, and a derivative set for a heavily-rendered
+// original can exceed that. Owns only the isTruncated/startAfter pagination;
+// `fetchPage` closes over prefix/maxKeys/credentials.
+export async function collectPaginatedKeys(
+  fetchPage: (startAfter: string | undefined) => Promise<S3ListPage>,
+): Promise<readonly string[]> {
+  const keys: string[] = [];
+  let startAfter: string | undefined;
+  for (;;) {
+    const page = await fetchPage(startAfter);
+    const contents = page.contents ?? [];
+    for (const obj of contents) keys.push(obj.key);
+    if (!page.isTruncated || contents.length === 0) break;
+    startAfter = contents[contents.length - 1]?.key;
+  }
+  return keys;
+}
+
 // Exported for unit testing — the branch logic (explicit override vs.
 // auto-detect from endpoint) is small but load-bearing: Minio/R2 break
 // silently if the virtual-host-style is picked.
@@ -130,6 +165,16 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
       return client.exists(key);
     },
 
+    async list(prefix): Promise<readonly string[]> {
+      return collectPaginatedKeys((startAfter) =>
+        client.list({
+          prefix,
+          maxKeys: 1000,
+          ...(startAfter !== undefined && { startAfter }),
+        }),
+      );
+    },
+
     async getSignedUrl(
       key: string,
       expiresInSeconds: number,