@cosmicdrift/kumiko-bundled-features 0.234.0 → 0.235.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.234.0",
+  "version": "0.235.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.234.0",
-    "@cosmicdrift/kumiko-framework": "0.234.0",
-    "@cosmicdrift/kumiko-headless": "0.234.0",
-    "@cosmicdrift/kumiko-renderer": "0.234.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.234.0",
-    "@cosmicdrift/kumiko-types": "0.234.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.235.1",
+    "@cosmicdrift/kumiko-framework": "0.235.1",
+    "@cosmicdrift/kumiko-headless": "0.235.1",
+    "@cosmicdrift/kumiko-renderer": "0.235.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.235.1",
+    "@cosmicdrift/kumiko-types": "0.235.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.234.0",
-    "@cosmicdrift/kumiko-locale-es": "0.234.0"
+    "@cosmicdrift/kumiko-locale-de": "0.235.1",
+    "@cosmicdrift/kumiko-locale-es": "0.235.1"
   }
 }

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -1,6 +1,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
@@ -16,6 +21,9 @@ import {
   expectErrorIncludes,
   getSetCookieRaw,
   getSetCookieValue,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+  updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -215,6 +223,50 @@ describe("scenario 3: login without membership", () => {
   });
 });
 
+// --- Scenario 3b: login resolves the live account when its email is shared
+// with a soft-deleted row (fw#2464 partial bidx index only covers live rows) ---
+
+describe("scenario 3b: login with an email shared by a soft-deleted row", () => {
+  // The DB-level dedup that lets a soft-deleted row and a live row share an
+  // email only exists on the blind-index column (see
+  // email-unique-blind-index.integration.test.ts) — without a configured
+  // key, email_bidx stays NULL and the plaintext-fallback unique index
+  // blocks the second create outright, never reaching the login path.
+  beforeAll(() => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    configureBlindIndexKey(Buffer.alloc(32, 7).toString("base64"));
+  });
+
+  afterAll(() => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+  });
+
+  test("new account wins the login, not the soft-deleted original", async () => {
+    const original = await seedLoginUser({
+      email: "reused-login@example.com",
+      password: "original-password-123",
+    });
+    await updateRows(stack.db, userTable, { isDeleted: true }, { id: original.id });
+
+    const recreated = await seedLoginUser({
+      email: "reused-login@example.com",
+      password: "new-account-password-123",
+    });
+    expect(recreated.id).not.toBe(original.id);
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "reused-login@example.com",
+      password: "new-account-password-123",
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(body.user.id).toBe(recreated.id);
+  });
+});
+
 // --- Scenario 4 + 5: change-password flow ---
 
 describe("scenario 4: change-password with wrong old password", () => {

package/src/auth-email-password/seeding.ts

@@ -139,11 +139,13 @@ export async function provisionSignupAccount(
   // create paths (#1478 — this was only wired for tenant before).
   hooks?: SeedTenantHooks,
 ): Promise<{ readonly userId: string; readonly tenantId: TenantId }> {
-  // Create-only-Guard VOR seedTenant: bei bereits registrierter Email hart
-  // abbrechen, sonst entstünde ein verwaister Tenant und seedUser (idempotent
-  // add-only) gäbe still die bestehende userId zurück → Confirm mintet eine
-  // Session für den fremden Account (#365).
-  const existingUser = await fetchOne(db, userTable, { email: options.email });
+  // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
+  // email, otherwise an orphaned tenant would be created and seedUser
+  // (idempotent add-only) would silently return the existing userId ->
+  // confirm mints a session for the wrong account (#365).
+  // isDeleted: false — the partial bidx unique index only covers live rows,
+  // so a soft-deleted row must not block re-registering its email.
+  const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   if (existingUser) {
     throw new ConflictError({ message: "signup: email already registered" });
   }

package/src/cap-counter/__tests__/cap-list.security.integration.test.ts

@@ -1,12 +1,13 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
+  testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
-import { CAP_COUNTER_LIST_SCREEN_ID, CapCounterQueries } from "../constants";
+import { CAP_COUNTER_LIST_SCREEN_ID, CapCounterHandlers, CapCounterQueries } from "../constants";
 import { capCounterEntity } from "../entity";
 import { capCounterFeature } from "../feature";
 
@@ -23,6 +24,14 @@ afterAll(async () => {
   await stack.cleanup();
 });
 
+function tenantAdminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin"],
+  });
+}
+
 describe("cap-counter access matrix", () => {
   test("cap-list screen and list query are SystemAdmin-only", () => {
     expect(rolesOf(stack.registry.getQueryHandler(CapCounterQueries.list)?.access)).toEqual([
@@ -51,3 +60,56 @@ describe("cap-counter list HTTP access", () => {
     expect((await stack.http.query(CapCounterQueries.list, {}, user)).status).toBe(403);
   });
 });
+
+describe("cap-counter list cross-tenant read", () => {
+  const CAP_NAME = "cross-tenant-list-probe";
+
+  beforeEach(async () => {
+    // increment access is SystemAdmin-only (see increment.write.ts) — tenant
+    // scoping on the write side comes from the actor's tenantId, not the
+    // role, so a SystemAdmin actor per seed-tenant still writes into that
+    // tenant's own row.
+    const seedTenantA = createTestUser({
+      id: 201,
+      tenantId: testTenantId(201),
+      roles: ["SystemAdmin"],
+    });
+    const seedTenantB = createTestUser({
+      id: 202,
+      tenantId: testTenantId(202),
+      roles: ["SystemAdmin"],
+    });
+    await stack.http.writeOk(
+      CapCounterHandlers.increment,
+      { capName: CAP_NAME, amount: 11, periodStartIso: "2026-05-01T00:00:00Z" },
+      seedTenantA,
+    );
+    await stack.http.writeOk(
+      CapCounterHandlers.increment,
+      { capName: CAP_NAME, amount: 22, periodStartIso: "2026-05-01T00:00:00Z" },
+      seedTenantB,
+    );
+  });
+
+  test("SystemAdmin sees rows from BOTH tenants, not just its own", async () => {
+    const sysadmin = createTestUser({ id: 43, roles: ["SystemAdmin"] });
+    const res = await stack.http.queryOk<{ rows: readonly Record<string, unknown>[] }>(
+      CapCounterQueries.list,
+      { filter: { field: "capName", op: "eq", value: CAP_NAME } },
+      sysadmin,
+    );
+
+    const tenantIds = res.rows.map((row) => row["tenantId"]);
+    expect(tenantIds).toContain(testTenantId(201));
+    expect(tenantIds).toContain(testTenantId(202));
+    // Neither seeded tenant matches the querying SystemAdmin's own
+    // tenantId — proves this isn't accidentally passing via tenant-match.
+    expect(sysadmin.tenantId).not.toBe(testTenantId(201));
+    expect(sysadmin.tenantId).not.toBe(testTenantId(202));
+  });
+
+  test("TenantAdmin still gets 403 on list (cross-tenant read stays SystemAdmin-only)", async () => {
+    const tenantAdmin = tenantAdminFor(201);
+    expect((await stack.http.query(CapCounterQueries.list, {}, tenantAdmin)).status).toBe(403);
+  });
+});

package/src/cap-counter/feature.ts

@@ -46,7 +46,11 @@
 // config, kein secrets, kein tenant-feature nötig. Tenant-Scoping kommt
 // vom Framework-Default (Base-Column tenantId).
 
-import { defineEntityListHandler, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineEntityListHandler,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   CAP_COUNTER_FEATURE,
   CAP_COUNTER_LIST_SCREEN_ID,
@@ -62,7 +66,7 @@ import {
 import { markSoftWarnedHandler } from "./handlers/mark-soft-warned.write";
 import { CAP_COUNTER_I18N } from "./i18n";
 
-const sysadminAccess = { access: { roles: ["SystemAdmin"] } } as const;
+const sysadminAccess = { access: { roles: access.systemAdmin }, crossTenant: true } as const;
 
 export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
   r.describe(
@@ -101,7 +105,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: CAP_COUNTER_LIST_SCREEN_ID,
     type: "entityList",
     entity: "cap-counter",
-    columns: ["capName", "value", "periodStart", "lastSoftWarnedAt"],
+    columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
     defaultSort: { field: "capName", dir: "asc" },
     searchable: true,
     access: { roles: ["SystemAdmin"] },
@@ -117,6 +121,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     keys: {
       ...CAP_COUNTER_I18N,
       "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
+      "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
     },
   });
 });

package/src/cap-counter/i18n.ts

@@ -2,6 +2,7 @@ type LocalizedString = { readonly en: string };
 
 export const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:cap-list.title": { en: "Usage caps" },
+  "cap-counter:entity:cap-counter:field:tenantId": { en: "Tenant" },
   "cap-counter:entity:cap-counter:field:capName": { en: "Cap" },
   "cap-counter:entity:cap-counter:field:value": { en: "Value" },
   "cap-counter:entity:cap-counter:field:periodStart": { en: "Period start" },

package/src/config/i18n.ts

@@ -1,9 +1,4 @@
-type LocalizedString = { readonly en: string };
+import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 
 /** Server boot keys for the auto-generated Settings-Hub (mirrors web/i18n.ts). */
-export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
-  "config.settings.title": { en: "Settings" },
-  "config.settings.system": { en: "Platform" },
-  "config.settings.tenant": { en: "Tenant" },
-  "config.settings.user": { en: "Personal" },
-};
+export const CONFIG_FEATURE_I18N = SETTINGS_HUB_I18N;

package/src/config/web/i18n.ts

@@ -11,6 +11,13 @@ import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 export const defaultTranslations: TranslationsByLocale = {
   en: {
+    "config.secrets.delete": "Delete",
+    "config.secrets.notSet": "Not set",
+    "config.secrets.placeholder": "Enter a value",
+    "config.secrets.replacePlaceholder": "Enter a new value to replace",
+    "config.secrets.required": "Required",
+    "config.secrets.set": "Set",
+    "config.secrets.title": "Secrets",
     "config.settings.title": "Settings",
     "config.settings.system": "Platform",
     "config.settings.tenant": "Tenant",
@@ -18,5 +25,9 @@ export const defaultTranslations: TranslationsByLocale = {
     "config.errors.systemOnly": "This value can only be set by the system.",
     "config.errors.invalidScope": "This scope is not allowed for this key.",
     "config.errors.unknownKey": "Unknown configuration key.",
+    // Required by every generated screen (screenTitleKey, required-surface-keys.ts) —
+    // the secrets screen has a fixed id ("secrets"), so the framework ships its
+    // title translation directly instead of asking every app to declare it.
+    "screen:secrets.title": "Secrets",
   },
 };

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -46,7 +46,7 @@ import { seedTenantMembership } from "../../tenant/seeding";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { seedUser } from "../../user/seeding";
-import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import { SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 
 const FORGET = "crypto-shredding:write:forget-subject";
@@ -96,6 +96,17 @@ async function forgottenEvents(): Promise<Array<{ payload: Record<string, unknow
   })) as Array<{ payload: Record<string, unknown> }>;
 }
 
+// Parameterized (unlike forgottenEvents) because the denial-audit tests
+// below run against both this file's top-level stack and the separate
+// tenant+user-mounted stack further down — each has its own events table.
+async function deniedEvents(
+  db: TestStack["db"] = stack.db,
+): Promise<Array<{ payload: Record<string, unknown> }>> {
+  return (await selectMany(db, eventsTable, {
+    type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+  })) as Array<{ payload: Record<string, unknown> }>;
+}
+
 describe("crypto-shredding :: forget-subject", () => {
   test("DPO forgets a user subject → key erased + audit event", async () => {
     const subject = { kind: "user", userId: TARGET_USER_ID } as const;
@@ -150,6 +161,26 @@ describe("crypto-shredding :: forget-subject", () => {
     ).resolves.toBeTruthy();
   });
 
+  // fw#2592 regression: the denial audit event used to be appended via
+  // ctx.unsafeAppendEvent, inside the same tx the denial then rolled back —
+  // the store stayed empty even though a cross-tenant probe was denied.
+  test("cross-tenant denial (kind=tenant) still leaves an audit event that survives the rollback", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const err = await stack.http.writeErr(FORGET, { subject, reason: REASON }, dpoUser);
+    expect(err.httpStatus).toBe(403);
+
+    const denied = await deniedEvents();
+    expect(denied).toHaveLength(1);
+    expect(denied[0]?.payload).toMatchObject({
+      subjectKind: "tenant",
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+      actorTenantId: dpoUser.tenantId,
+    });
+  });
+
   test("SystemAdmin bypasses the tenant-scope guard", async () => {
     const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
     await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
@@ -479,6 +510,64 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     expect(userRow?.["status"]).not.toBe(USER_STATUS.Deleted);
   });
 
+  // fw#2592 regression, kind=user variant of the top-level "cross-tenant
+  // denial ... survives the rollback" test: before the fix, deniedEvents()
+  // would come back empty here too.
+  test("cross-tenant denial (kind=user) still leaves an audit event that survives the rollback", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user-2592@example.com",
+      displayName: "Foreign Tenant User 2592",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+
+    const denied = await deniedEvents(stack.db);
+    expect(denied).toHaveLength(1);
+    expect(denied[0]?.payload).toMatchObject({
+      subjectKind: "user",
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+      actorTenantId: dpoUser.tenantId,
+    });
+  });
+
+  // fw#2591 payload-hardening coverage (previously untested): the denial
+  // event must carry only a digest, never the foreign user id or a
+  // plaintext subject key.
+  test("denial payload carries only the digest, never the foreign subject id or a plaintext key", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user-2591@example.com",
+      displayName: "Foreign Tenant User 2591",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+
+    const denied = await deniedEvents(stack.db);
+    expect(denied).toHaveLength(1);
+    const payload = denied[0]?.payload ?? {};
+    expect(payload["subjectKeyDigest"]).toBeTruthy();
+    expect(payload["subjectKind"]).toBe("user");
+    expect(payload).not.toHaveProperty("subjectKey");
+    expect(payload["actorTenantId"]).toBe(dpoUser.tenantId);
+
+    const serialized = JSON.stringify(payload);
+    expect(serialized).not.toContain(userId);
+    expect(serialized).not.toContain(TENANT_B);
+  });
+
   test("SystemAdmin can forget a user with no membership in any tenant", async () => {
     const { id: userId } = await seedUser(stack.db, {
       email: "system-admin-forgets@example.com",

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import {
@@ -13,8 +14,10 @@ import {
 import {
   defineWriteHandler,
   type FeatureDefinition,
+  type HandlerContext,
   type SessionUser,
   type TenantId,
+  type WriteEvent,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,
@@ -22,7 +25,9 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
 import { USER_STATUS } from "../../user";
@@ -55,7 +60,8 @@ export const subjectForgottenSchema = z.object({
 });
 
 export const subjectForgetDeniedSchema = z.object({
-  subjectKey: z.string().min(1),
+  subjectKeyDigest: z.string().min(1),
+  subjectKind: z.enum(["user", "tenant"]),
   reason: z.string().min(10),
   forgottenBy: z.string().min(1),
   actorTenantId: z.string().min(1),
@@ -99,6 +105,75 @@ async function resolveTenantScopeDenial(
   return ownedInTenant ? undefined : memberDenied;
 }
 
+// Denied cross-tenant probes must still leave an audit trail (fw#2348).
+// Appended outside the handler tx (fw#2592): the caller's
+// `return tenantScopeDenial` rolls that tx back.
+async function appendDenialAuditEvent(
+  ctx: HandlerContext,
+  event: WriteEvent<z.infer<typeof forgetSubjectSchema>>,
+  subjectKey: string,
+  subjectKind: SubjectIdInput["kind"],
+  denialCode: string,
+): Promise<WriteFailure | null> {
+  const outsideTx = ctx.dbOutsideTransaction;
+  if (!outsideTx) {
+    return writeFailure(
+      new InternalError({
+        message:
+          "[crypto-shredding] forget-subject denial audit event cannot be appended without " +
+          "ctx.dbOutsideTransaction — dispatch wiring is missing the outside-tx db source.",
+      }),
+    );
+  }
+  const eventDef = ctx.registry.getEvent(SUBJECT_FORGET_DENIED_EVENT_NAME);
+  if (!eventDef) {
+    return writeFailure(
+      new InternalError({
+        message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
+      }),
+    );
+  }
+  const payload = subjectForgetDeniedSchema.parse({
+    // The denial lands in the REQUESTING actor's own tenant-scoped stream —
+    // it must never materialise the foreign subject's identifiers there. A
+    // plaintext subjectKey/aggregateId would survive as a permanent record
+    // for the prober and would still be present when the owning tenant
+    // later runs its own (legitimate) forget-subject for that subject. The
+    // digest still lets an operator correlate repeated probes of the same
+    // subject without exposing it (fw#2452).
+    subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
+    subjectKind,
+    reason: event.payload.reason,
+    forgottenBy: event.user.id,
+    actorTenantId: event.user.tenantId,
+    denial: denialCode,
+  });
+  const reqCtx = requestContext.get();
+  // This event is the only proof the denial happened. Skipping
+  // runProjectionsForEvent here is fine — nothing projects
+  // crypto-shredding:event:forget-denied.
+  await append(outsideTx.raw, {
+    aggregateId: generateId(),
+    aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+    // MUST be event.user.tenantId (the prober's own tenant), never
+    // SYSTEM_TENANT_ID — .raw bypasses TenantDb's scoping wrapper, so this
+    // is the only thing keeping the denial event out of the foreign
+    // subject's tenant (fw#2452).
+    tenantId: event.user.tenantId,
+    expectedVersion: 0,
+    type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+    eventVersion: eventDef.version,
+    payload,
+    metadata: {
+      userId: event.user.id,
+      ...(reqCtx?.requestId ? { requestId: reqCtx.requestId } : {}),
+      ...(reqCtx?.correlationId ? { correlationId: reqCtx.correlationId } : {}),
+      ...(reqCtx?.causationId ? { causationId: reqCtx.causationId } : {}),
+    },
+  });
+  return null;
+}
+
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -138,20 +213,14 @@ export const forgetSubjectWrite = defineWriteHandler({
       raw,
     );
     if (tenantScopeDenial) {
-      // Denied cross-tenant probes must still leave an audit trail (fw#2348).
-      await ctx.unsafeAppendEvent({
-        aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
-        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
-        type: SUBJECT_FORGET_DENIED_EVENT_NAME,
-        payload: {
-          subjectKey,
-          reason: event.payload.reason,
-          forgottenBy: event.user.id,
-          actorTenantId: event.user.tenantId,
-          denial: tenantScopeDenial.error.code,
-        },
-      });
-      return tenantScopeDenial;
+      const auditFailure = await appendDenialAuditEvent(
+        ctx,
+        event,
+        subjectKey,
+        raw.kind,
+        tenantScopeDenial.error.code,
+      );
+      return auditFailure ?? tenantScopeDenial;
     }
 
     // Erase BEFORE the audit append: if the append throws, the key is gone

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -451,10 +451,12 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
   const RETRY_USER_ID = "u-pii-retry-1";
   const RETRY_JOB_NAME = "retryapp:job:capture-import";
   const capturedPayloads: Record<string, unknown>[] = [];
+  const capturedTriggeredBy: (string | null)[] = [];
 
   const retryAppFeature = defineFeature("retryapp", (r) => {
-    r.job("captureImport", { trigger: { manual: true } }, async (payload) => {
+    r.job("captureImport", { trigger: { manual: true } }, async (payload, ctx) => {
       capturedPayloads.push(payload);
+      capturedTriggeredBy.push(ctx.triggeredBy?.id ?? null);
     });
   });
 
@@ -476,6 +478,7 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
 
   beforeEach(() => {
     capturedPayloads.length = 0;
+    capturedTriggeredBy.length = 0;
     retryKms = new InMemoryKmsAdapter();
     configurePiiSubjectKms(retryKms);
   });
@@ -527,6 +530,40 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
     expect(errInfo.details).toMatchObject({ reason: "job_payload_erased" });
   });
 
+  // #2469: retry dispatched without a `meta` argument, so the retried run
+  // carried no triggeredById at all — job-run-logger's onJobStart then saw
+  // triggeredById: null, skipped encryption entirely, and the retried run's
+  // payload landed in job_runs as unshreddable plaintext. The asserted
+  // invariant is the input to that chain: the retried BullMQ job must carry
+  // the ORIGINAL run's owner, not the retrying SystemAdmin and not null.
+  // (Asserting the retried run's job_runs row directly is not possible here:
+  // this stack wires no job-run-logger into the runner, so a real dispatch
+  // writes no row — every other row in this file is seeded by calling
+  // retryLogger.onJobStart by hand.)
+  test("retry re-dispatches with the original run's triggeredById so the new run's payload stays encrypted", async () => {
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-5", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryLogger.onJobFailed?.(RETRY_JOB_NAME, "bull-retry-5", "boom", []);
+
+    const originalRow = await fetchOne(retryStack.db, jobRunsTable, { bullJobId: "bull-retry-5" });
+    expect(isPiiCiphertext(originalRow?.["payload"])).toBe(true);
+    expect(originalRow?.["triggeredById"]).toBe(RETRY_USER_ID);
+
+    await retryStack.http.writeOk<{
+      jobName: string;
+      bullJobId: string;
+      retriedFromRunId: string;
+    }>(JobHandlers.retry, { runId: originalRow?.["id"] }, TestUsers.systemAdmin);
+
+    await sleep(1000);
+
+    expect(capturedTriggeredBy).toEqual([RETRY_USER_ID]);
+    expect(capturedTriggeredBy[0]).not.toBe(TestUsers.systemAdmin.id);
+    expect(capturedPayloads).toEqual([JSON.parse(SECRET_PAYLOAD)]);
+  });
+
   // The other producer of PII_ERASED_SENTINEL: job-run-logger writes the
   // literal "[[erased]]" string (not ciphertext) when the key is already
   // gone at onJobStart time (see the mirrored case above this describe

package/src/jobs/handlers/retry.write.ts

@@ -18,6 +18,7 @@ type JobRunRow = {
   readonly status: string;
   readonly jobName: string;
   readonly payload: string | null;
+  readonly triggeredById: string | null;
 };
 
 export const retryWrite = defineWriteHandler({
@@ -61,6 +62,7 @@ export const retryWrite = defineWriteHandler({
     // PII_ERASED_SENTINEL, which is not JSON; reject the retry rather than
     // dispatch it with a silently emptied payload.
     let payload: Record<string, unknown> = {};
+    let decryptedPayloadJson: string | null = null;
     if (run.payload) {
       const decryptedPayload = await decryptStoredPii(
         run.payload,
@@ -78,9 +80,14 @@ export const retryWrite = defineWriteHandler({
         decryptedPayload,
         `job run ${event.payload.runId} payload`,
       );
+      decryptedPayloadJson = decryptedPayload;
     }
 
-    const bullJobId = await jobRunner.dispatch(run.jobName, payload);
+    // Retry re-uses the original run's DEK owner so the retry's logs/payload stay encrypted.
+    const bullJobId = await jobRunner.dispatch(run.jobName, payload, {
+      triggeredById: run.triggeredById ?? undefined,
+      ...(decryptedPayloadJson !== null && { payload: decryptedPayloadJson }),
+    });
 
     return {
       isSuccess: true,