@cosmicdrift/kumiko-bundled-features 0.226.0 → 0.227.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.226.0",
+  "version": "0.227.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.226.0",
-    "@cosmicdrift/kumiko-framework": "0.226.0",
-    "@cosmicdrift/kumiko-headless": "0.226.0",
-    "@cosmicdrift/kumiko-renderer": "0.226.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.226.0",
-    "@cosmicdrift/kumiko-types": "0.226.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.227.0",
+    "@cosmicdrift/kumiko-framework": "0.227.0",
+    "@cosmicdrift/kumiko-headless": "0.227.0",
+    "@cosmicdrift/kumiko-renderer": "0.227.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.227.0",
+    "@cosmicdrift/kumiko-types": "0.227.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.226.0",
-    "@cosmicdrift/kumiko-locale-es": "0.226.0"
+    "@cosmicdrift/kumiko-locale-de": "0.227.0",
+    "@cosmicdrift/kumiko-locale-es": "0.227.0"
   }
 }

package/src/auth-email-password/__tests__/seed-admin-guarded.integration.test.ts

@@ -0,0 +1,183 @@
+// offlot#114 — DB integration for seedAdminGuarded, the boot-seed variant
+// of seedAdmin that survives a blind-index miss on an otherwise-existing
+// account. Runs against a KMS + blind-index setup, which is the only
+// configuration where the bug reproduces: `email` holds per-row ciphertext,
+// so seedAdmin's idempotency check can only match through the deterministic
+// `email_bidx` companion column.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { seedAdmin, seedAdminGuarded } from "../seeding";
+
+const BLIND_INDEX_KEY_B64 = Buffer.alloc(32, 14).toString("base64");
+const TENANT_114: TenantId = "00000000-0000-4000-8000-0000000001d4" as TenantId;
+const SYSADMIN_EMAIL = "sysadmin@offlot.app";
+
+const seedOptions = {
+  email: SYSADMIN_EMAIL,
+  password: "sysadmin-pw-114",
+  displayName: "Sysadmin",
+  globalRoles: ["SystemAdmin"],
+  memberships: [
+    { tenantId: TENANT_114, tenantKey: "demo-114", tenantName: "Demo 114", roles: ["TenantAdmin"] },
+  ],
+} as const;
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  const resolver = createConfigResolver();
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature()],
+    extraContext: { configResolver: resolver },
+  });
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+}, 60_000);
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${eventsTable.tableName}"`);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+  configureBlindIndexKey(BLIND_INDEX_KEY_B64);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+async function userIds(): Promise<readonly string[]> {
+  const rows = await selectMany<{ id: string }>(stack.db, userTable);
+  return rows.map((r) => r.id);
+}
+
+async function membershipUserIds(): Promise<readonly string[]> {
+  const rows = await selectMany<{ userId: string }>(stack.db, tenantMembershipsTable);
+  return rows.map((r) => r.userId);
+}
+
+/** Reproduces the offlot#112 row shape in prod: the email column keeps its
+ *  ciphertext, but the blind index is blank — as it is for rows written
+ *  before KUMIKO_BLIND_INDEX_KEY existed, or after a subject-key erase. */
+async function blankBlindIndex(): Promise<void> {
+  await asRawClient(stack.db).unsafe(`UPDATE "${userTable.tableName}" SET email_bidx = NULL`);
+}
+
+describe("seedAdminGuarded (offlot#114)", () => {
+  test("re-seeding twice on an empty DB stays idempotent", async () => {
+    const first = await seedAdminGuarded(stack.db, seedOptions);
+    const second = await seedAdminGuarded(stack.db, seedOptions);
+
+    expect(second.id).toBe(first.id);
+    expect(await userIds()).toEqual([first.id]);
+    expect(await membershipUserIds()).toEqual([first.id]);
+  });
+
+  test("a blank blind index no longer produces a second account", async () => {
+    const first = await seedAdminGuarded(stack.db, seedOptions);
+    await blankBlindIndex();
+
+    const second = await seedAdminGuarded(stack.db, seedOptions);
+
+    expect(second.id).toBe(first.id);
+    expect(await userIds()).toEqual([first.id]);
+    // Membership is reconciled onto the existing account, not a new identity.
+    expect(await membershipUserIds()).toEqual([first.id]);
+  });
+
+  test("unguarded seedAdmin still duplicates on a blank blind index — the gap seedAdminGuarded covers", async () => {
+    // Pins the framework behaviour the guard compensates for: seedUser's
+    // existence check is bidx-only, and neither unique index on the user
+    // table can catch this (the plaintext unique index sits on randomized
+    // ciphertext, the bidx unique index is partial WHERE email_bidx IS NOT
+    // NULL). If this ever fails, seedAdmin's idempotency check changed and
+    // this guard can be revisited.
+    const first = await seedAdmin(stack.db, seedOptions);
+    await blankBlindIndex();
+
+    const second = await seedAdmin(stack.db, seedOptions);
+
+    expect(second.id).not.toBe(first.id);
+    expect(await userIds()).toHaveLength(2);
+  });
+
+  test("pre-existing duplicates are reused, never extended", async () => {
+    // Build the exact prod state: two ciphertext rows for one email, the
+    // older one with a blank blind index.
+    const canonical = await seedAdmin(stack.db, seedOptions);
+    await blankBlindIndex();
+    const duplicate = await seedAdmin(stack.db, seedOptions);
+    expect(await userIds()).toHaveLength(2);
+
+    // Guards against a false pass: the canonical pick must be driven by
+    // insertedAt ordering, not a coincidental id sort — assert the rows
+    // actually carry distinct, comparable Temporal.Instant timestamps.
+    const rows = await selectMany<{ id: string; insertedAt: { epochNanoseconds: bigint } }>(
+      stack.db,
+      userTable,
+    );
+    const canonicalRow = rows.find((r) => r.id === canonical.id);
+    const duplicateRow = rows.find((r) => r.id === duplicate.id);
+    expect(typeof canonicalRow?.insertedAt.epochNanoseconds).toBe("bigint");
+    expect(typeof duplicateRow?.insertedAt.epochNanoseconds).toBe("bigint");
+    expect(
+      canonicalRow!.insertedAt.epochNanoseconds < duplicateRow!.insertedAt.epochNanoseconds,
+    ).toBe(true);
+
+    const seeded = await seedAdminGuarded(stack.db, seedOptions);
+
+    // Oldest row wins.
+    expect(seeded.id).toBe(canonical.id);
+    expect(seeded.id).not.toBe(duplicate.id);
+    // No third row: the guard refuses to add to a broken state.
+    expect(await userIds()).toHaveLength(2);
+  });
+
+  test("unrelated single-row accounts are untouched", async () => {
+    const unrelated = await seedUser(stack.db, {
+      email: "dealer@offlot.app",
+      displayName: "Dealer",
+    });
+    const admin = await seedAdminGuarded(stack.db, seedOptions);
+    await blankBlindIndex();
+    await seedAdminGuarded(stack.db, seedOptions);
+
+    expect(await userIds()).toHaveLength(2);
+    expect((await userIds()).slice().sort()).toEqual([unrelated.id, admin.id].sort());
+  });
+});

package/src/auth-email-password/seeding.ts

@@ -12,7 +12,12 @@
 // Damit Sample-Server und Tests keine drei sub-paths zusammensammeln
 // müssen.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  type LocalKeyKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
@@ -21,7 +26,7 @@ import { hashPassword } from "../shared";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { type SeedTenantHooks, seedTenant, seedTenantMembership } from "../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
-import { userTable } from "../user/schema/user";
+import { USER_STATUS, userTable } from "../user/schema/user";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedUser } from "../user/seeding";
 
@@ -235,3 +240,108 @@ export async function seedAdmin(
 
   return { id: userId };
 }
+
+// offlot#114 — seedAdmin's idempotency check is a plain fetchOne(email),
+// which the query layer rewrites into `(email = $plaintext OR
+// email_bidx = $hmac)` once a blind-index key is configured. Under KMS
+// encryption `email` holds per-row ciphertext, so only the bidx arm can
+// ever match — and it misses whenever a row's `email_bidx` is NULL (written
+// before the key existed, or after a subject-key erase) or was computed
+// with a since-rotated key. seedAdmin then inserts a second row for an
+// email that already has an account; neither the plaintext unique index
+// (sits on randomized ciphertext) nor the partial bidx unique index (WHERE
+// email_bidx IS NOT NULL, so a NULL row never collides) catches it.
+//
+// seedAdminGuarded is a separate, additive boot-seed guard — NOT a change
+// to seedUser/seedAdmin/provisionSignupAccount, which also run on every
+// real self-signup request and can't afford a decrypt-scan fallback there.
+// Use this only where seedAdmin already runs (dev-boot / sample-server /
+// bootstrap scripts), never as a login or signup hot path.
+
+type ActiveUserRow = {
+  readonly id: string;
+  readonly email: string;
+  readonly insertedAt: { readonly epochNanoseconds: bigint };
+};
+
+function compareInsertedAt(a: ActiveUserRow["insertedAt"], b: ActiveUserRow["insertedAt"]): number {
+  if (a.epochNanoseconds < b.epochNanoseconds) return -1;
+  if (a.epochNanoseconds > b.epochNanoseconds) return 1;
+  return 0;
+}
+
+/** Oldest row wins, tie-broken by id — the same rule a manual duplicate
+ *  cleanup would apply, so this guard and any later cleanup never disagree
+ *  on which row is the survivor. */
+function pickCanonicalUserId(rows: readonly ActiveUserRow[]): string {
+  const sorted = [...rows].sort((a, b) => {
+    const byTime = compareInsertedAt(a.insertedAt, b.insertedAt);
+    return byTime !== 0 ? byTime : a.id.localeCompare(b.id);
+  });
+  const first = sorted[0];
+  if (first === undefined) throw new Error("pickCanonicalUserId: empty group");
+  return first.id;
+}
+
+async function findExistingUserIdForEmail(
+  db: DbConnection,
+  kms: LocalKeyKmsAdapter,
+  email: string,
+): Promise<string | undefined> {
+  // ponytail: decrypts every active user row to compare emails. Fine at
+  // boot-seed scale (tens of accounts, once per boot); if the user table
+  // grows past a few thousand rows, narrow this to rows whose email_bidx is
+  // NULL or doesn't match the expected HMAC — only those need decrypting.
+  const rows = await selectMany<ActiveUserRow>(db, userTable, {
+    isDeleted: false,
+    status: { ne: USER_STATUS.Deleted },
+  });
+  const matches: ActiveUserRow[] = [];
+  for (const row of rows) {
+    // Compared byte-exact, deliberately not case-folded: email_bidx is an
+    // HMAC over the raw value and login matches case-sensitively, so a case
+    // variant is a different account to every other code path.
+    const decrypted = await decryptPiiFieldValues({ email: row.email }, ["email"], kms, {
+      requestId: "seed-admin-guarded",
+    });
+    if (decrypted["email"] === email) matches.push(row);
+  }
+  return matches.length === 0 ? undefined : pickCanonicalUserId(matches);
+}
+
+/**
+ * Boot-seed variant of seedAdmin that survives a blind-index miss on an
+ * otherwise-existing account (see the module comment above). Not for the
+ * self-signup hot path — seedAdmin/seedUser stay the unguarded entry point
+ * there.
+ *
+ * No cheap `fetchOne` fast path here on purpose: a hit there only proves
+ * SOME row matches (plaintext or bidx), never that it's the canonical one —
+ * a stale row's bidx can go NULL while a later duplicate's stays valid, so
+ * fetchOne keeps finding the duplicate forever and the seed never converges
+ * on the oldest row. The only cheap short-circuit that stays correct is
+ * skipping the scan entirely when no KMS is configured at all (plaintext
+ * DBs have no bidx ambiguity to guard against in the first place).
+ */
+export async function seedAdminGuarded(
+  db: DbConnection,
+  options: SeedAdminOptions,
+): Promise<{ id: string }> {
+  const kms = configuredPiiSubjectKms();
+  if (kms === undefined) return seedAdmin(db, options);
+
+  const existingId = await findExistingUserIdForEmail(db, kms, options.email);
+  if (existingId === undefined) return seedAdmin(db, options);
+
+  const by = options.by ?? TestUsers.systemAdmin;
+  for (const m of options.memberships) {
+    await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });
+    await seedTenantMembership(db, {
+      userId: existingId,
+      tenantId: m.tenantId,
+      roles: m.roles,
+      by,
+    });
+  }
+  return { id: existingId };
+}