@cosmicdrift/kumiko-bundled-features 0.235.0 → 0.235.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.235.0",
+  "version": "0.235.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.235.0",
-    "@cosmicdrift/kumiko-framework": "0.235.0",
-    "@cosmicdrift/kumiko-headless": "0.235.0",
-    "@cosmicdrift/kumiko-renderer": "0.235.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.235.0",
-    "@cosmicdrift/kumiko-types": "0.235.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.235.2",
+    "@cosmicdrift/kumiko-framework": "0.235.2",
+    "@cosmicdrift/kumiko-headless": "0.235.2",
+    "@cosmicdrift/kumiko-renderer": "0.235.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.235.2",
+    "@cosmicdrift/kumiko-types": "0.235.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.235.0",
-    "@cosmicdrift/kumiko-locale-es": "0.235.0"
+    "@cosmicdrift/kumiko-locale-de": "0.235.2",
+    "@cosmicdrift/kumiko-locale-es": "0.235.2"
   }
 }

package/src/cap-counter/__tests__/cap-list.security.integration.test.ts

@@ -1,12 +1,13 @@
-import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import {
   createTestUser,
   setupTestStack,
   type TestStack,
+  testTenantId,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
-import { CAP_COUNTER_LIST_SCREEN_ID, CapCounterQueries } from "../constants";
+import { CAP_COUNTER_LIST_SCREEN_ID, CapCounterHandlers, CapCounterQueries } from "../constants";
 import { capCounterEntity } from "../entity";
 import { capCounterFeature } from "../feature";
 
@@ -23,6 +24,14 @@ afterAll(async () => {
   await stack.cleanup();
 });
 
+function tenantAdminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin"],
+  });
+}
+
 describe("cap-counter access matrix", () => {
   test("cap-list screen and list query are SystemAdmin-only", () => {
     expect(rolesOf(stack.registry.getQueryHandler(CapCounterQueries.list)?.access)).toEqual([
@@ -51,3 +60,56 @@ describe("cap-counter list HTTP access", () => {
     expect((await stack.http.query(CapCounterQueries.list, {}, user)).status).toBe(403);
   });
 });
+
+describe("cap-counter list cross-tenant read", () => {
+  const CAP_NAME = "cross-tenant-list-probe";
+
+  beforeEach(async () => {
+    // increment access is SystemAdmin-only (see increment.write.ts) — tenant
+    // scoping on the write side comes from the actor's tenantId, not the
+    // role, so a SystemAdmin actor per seed-tenant still writes into that
+    // tenant's own row.
+    const seedTenantA = createTestUser({
+      id: 201,
+      tenantId: testTenantId(201),
+      roles: ["SystemAdmin"],
+    });
+    const seedTenantB = createTestUser({
+      id: 202,
+      tenantId: testTenantId(202),
+      roles: ["SystemAdmin"],
+    });
+    await stack.http.writeOk(
+      CapCounterHandlers.increment,
+      { capName: CAP_NAME, amount: 11, periodStartIso: "2026-05-01T00:00:00Z" },
+      seedTenantA,
+    );
+    await stack.http.writeOk(
+      CapCounterHandlers.increment,
+      { capName: CAP_NAME, amount: 22, periodStartIso: "2026-05-01T00:00:00Z" },
+      seedTenantB,
+    );
+  });
+
+  test("SystemAdmin sees rows from BOTH tenants, not just its own", async () => {
+    const sysadmin = createTestUser({ id: 43, roles: ["SystemAdmin"] });
+    const res = await stack.http.queryOk<{ rows: readonly Record<string, unknown>[] }>(
+      CapCounterQueries.list,
+      { filter: { field: "capName", op: "eq", value: CAP_NAME } },
+      sysadmin,
+    );
+
+    const tenantIds = res.rows.map((row) => row["tenantId"]);
+    expect(tenantIds).toContain(testTenantId(201));
+    expect(tenantIds).toContain(testTenantId(202));
+    // Neither seeded tenant matches the querying SystemAdmin's own
+    // tenantId — proves this isn't accidentally passing via tenant-match.
+    expect(sysadmin.tenantId).not.toBe(testTenantId(201));
+    expect(sysadmin.tenantId).not.toBe(testTenantId(202));
+  });
+
+  test("TenantAdmin still gets 403 on list (cross-tenant read stays SystemAdmin-only)", async () => {
+    const tenantAdmin = tenantAdminFor(201);
+    expect((await stack.http.query(CapCounterQueries.list, {}, tenantAdmin)).status).toBe(403);
+  });
+});

package/src/cap-counter/feature.ts

@@ -46,7 +46,11 @@
 // config, kein secrets, kein tenant-feature nötig. Tenant-Scoping kommt
 // vom Framework-Default (Base-Column tenantId).
 
-import { defineEntityListHandler, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineEntityListHandler,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   CAP_COUNTER_FEATURE,
   CAP_COUNTER_LIST_SCREEN_ID,
@@ -62,7 +66,7 @@ import {
 import { markSoftWarnedHandler } from "./handlers/mark-soft-warned.write";
 import { CAP_COUNTER_I18N } from "./i18n";
 
-const sysadminAccess = { access: { roles: ["SystemAdmin"] } } as const;
+const sysadminAccess = { access: { roles: access.systemAdmin }, crossTenant: true } as const;
 
 export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
   r.describe(
@@ -101,7 +105,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: CAP_COUNTER_LIST_SCREEN_ID,
     type: "entityList",
     entity: "cap-counter",
-    columns: ["capName", "value", "periodStart", "lastSoftWarnedAt"],
+    columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
     defaultSort: { field: "capName", dir: "asc" },
     searchable: true,
     access: { roles: ["SystemAdmin"] },
@@ -117,6 +121,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     keys: {
       ...CAP_COUNTER_I18N,
       "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
+      "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
     },
   });
 });

package/src/cap-counter/i18n.ts

@@ -2,6 +2,7 @@ type LocalizedString = { readonly en: string };
 
 export const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:cap-list.title": { en: "Usage caps" },
+  "cap-counter:entity:cap-counter:field:tenantId": { en: "Tenant" },
   "cap-counter:entity:cap-counter:field:capName": { en: "Cap" },
   "cap-counter:entity:cap-counter:field:value": { en: "Value" },
   "cap-counter:entity:cap-counter:field:periodStart": { en: "Period start" },

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -46,7 +46,7 @@ import { seedTenantMembership } from "../../tenant/seeding";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { seedUser } from "../../user/seeding";
-import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import { SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
 import { createCryptoShreddingFeature } from "../feature";
 
 const FORGET = "crypto-shredding:write:forget-subject";
@@ -96,6 +96,17 @@ async function forgottenEvents(): Promise<Array<{ payload: Record<string, unknow
   })) as Array<{ payload: Record<string, unknown> }>;
 }
 
+// Parameterized (unlike forgottenEvents) because the denial-audit tests
+// below run against both this file's top-level stack and the separate
+// tenant+user-mounted stack further down — each has its own events table.
+async function deniedEvents(
+  db: TestStack["db"] = stack.db,
+): Promise<Array<{ payload: Record<string, unknown> }>> {
+  return (await selectMany(db, eventsTable, {
+    type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+  })) as Array<{ payload: Record<string, unknown> }>;
+}
+
 describe("crypto-shredding :: forget-subject", () => {
   test("DPO forgets a user subject → key erased + audit event", async () => {
     const subject = { kind: "user", userId: TARGET_USER_ID } as const;
@@ -150,6 +161,26 @@ describe("crypto-shredding :: forget-subject", () => {
     ).resolves.toBeTruthy();
   });
 
+  // fw#2592 regression: the denial audit event used to be appended via
+  // ctx.unsafeAppendEvent, inside the same tx the denial then rolled back —
+  // the store stayed empty even though a cross-tenant probe was denied.
+  test("cross-tenant denial (kind=tenant) still leaves an audit event that survives the rollback", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const err = await stack.http.writeErr(FORGET, { subject, reason: REASON }, dpoUser);
+    expect(err.httpStatus).toBe(403);
+
+    const denied = await deniedEvents();
+    expect(denied).toHaveLength(1);
+    expect(denied[0]?.payload).toMatchObject({
+      subjectKind: "tenant",
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+      actorTenantId: dpoUser.tenantId,
+    });
+  });
+
   test("SystemAdmin bypasses the tenant-scope guard", async () => {
     const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
     await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
@@ -479,6 +510,64 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     expect(userRow?.["status"]).not.toBe(USER_STATUS.Deleted);
   });
 
+  // fw#2592 regression, kind=user variant of the top-level "cross-tenant
+  // denial ... survives the rollback" test: before the fix, deniedEvents()
+  // would come back empty here too.
+  test("cross-tenant denial (kind=user) still leaves an audit event that survives the rollback", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user-2592@example.com",
+      displayName: "Foreign Tenant User 2592",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+
+    const denied = await deniedEvents(stack.db);
+    expect(denied).toHaveLength(1);
+    expect(denied[0]?.payload).toMatchObject({
+      subjectKind: "user",
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+      actorTenantId: dpoUser.tenantId,
+    });
+  });
+
+  // fw#2591 payload-hardening coverage (previously untested): the denial
+  // event must carry only a digest, never the foreign user id or a
+  // plaintext subject key.
+  test("denial payload carries only the digest, never the foreign subject id or a plaintext key", async () => {
+    const { id: userId } = await seedUser(stack.db, {
+      email: "foreign-tenant-user-2591@example.com",
+      displayName: "Foreign Tenant User 2591",
+      emailVerified: true,
+    });
+    await seedTenantMembership(stack.db, { userId, tenantId: TENANT_B, roles: ["Member"] });
+
+    await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      dpoUser,
+    );
+
+    const denied = await deniedEvents(stack.db);
+    expect(denied).toHaveLength(1);
+    const payload = denied[0]?.payload ?? {};
+    expect(payload["subjectKeyDigest"]).toBeTruthy();
+    expect(payload["subjectKind"]).toBe("user");
+    expect(payload).not.toHaveProperty("subjectKey");
+    expect(payload["actorTenantId"]).toBe(dpoUser.tenantId);
+
+    const serialized = JSON.stringify(payload);
+    expect(serialized).not.toContain(userId);
+    expect(serialized).not.toContain(TENANT_B);
+  });
+
   test("SystemAdmin can forget a user with no membership in any tenant", async () => {
     const { id: userId } = await seedUser(stack.db, {
       email: "system-admin-forgets@example.com",

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -14,8 +14,10 @@ import {
 import {
   defineWriteHandler,
   type FeatureDefinition,
+  type HandlerContext,
   type SessionUser,
   type TenantId,
+  type WriteEvent,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,
@@ -23,7 +25,9 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens";
 import { USER_STATUS } from "../../user";
@@ -101,6 +105,75 @@ async function resolveTenantScopeDenial(
   return ownedInTenant ? undefined : memberDenied;
 }
 
+// Denied cross-tenant probes must still leave an audit trail (fw#2348).
+// Appended outside the handler tx (fw#2592): the caller's
+// `return tenantScopeDenial` rolls that tx back.
+async function appendDenialAuditEvent(
+  ctx: HandlerContext,
+  event: WriteEvent<z.infer<typeof forgetSubjectSchema>>,
+  subjectKey: string,
+  subjectKind: SubjectIdInput["kind"],
+  denialCode: string,
+): Promise<WriteFailure | null> {
+  const outsideTx = ctx.dbOutsideTransaction;
+  if (!outsideTx) {
+    return writeFailure(
+      new InternalError({
+        message:
+          "[crypto-shredding] forget-subject denial audit event cannot be appended without " +
+          "ctx.dbOutsideTransaction — dispatch wiring is missing the outside-tx db source.",
+      }),
+    );
+  }
+  const eventDef = ctx.registry.getEvent(SUBJECT_FORGET_DENIED_EVENT_NAME);
+  if (!eventDef) {
+    return writeFailure(
+      new InternalError({
+        message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
+      }),
+    );
+  }
+  const payload = subjectForgetDeniedSchema.parse({
+    // The denial lands in the REQUESTING actor's own tenant-scoped stream —
+    // it must never materialise the foreign subject's identifiers there. A
+    // plaintext subjectKey/aggregateId would survive as a permanent record
+    // for the prober and would still be present when the owning tenant
+    // later runs its own (legitimate) forget-subject for that subject. The
+    // digest still lets an operator correlate repeated probes of the same
+    // subject without exposing it (fw#2452).
+    subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
+    subjectKind,
+    reason: event.payload.reason,
+    forgottenBy: event.user.id,
+    actorTenantId: event.user.tenantId,
+    denial: denialCode,
+  });
+  const reqCtx = requestContext.get();
+  // This event is the only proof the denial happened. Skipping
+  // runProjectionsForEvent here is fine — nothing projects
+  // crypto-shredding:event:forget-denied.
+  await append(outsideTx.raw, {
+    aggregateId: generateId(),
+    aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+    // MUST be event.user.tenantId (the prober's own tenant), never
+    // SYSTEM_TENANT_ID — .raw bypasses TenantDb's scoping wrapper, so this
+    // is the only thing keeping the denial event out of the foreign
+    // subject's tenant (fw#2452).
+    tenantId: event.user.tenantId,
+    expectedVersion: 0,
+    type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+    eventVersion: eventDef.version,
+    payload,
+    metadata: {
+      userId: event.user.id,
+      ...(reqCtx?.requestId ? { requestId: reqCtx.requestId } : {}),
+      ...(reqCtx?.correlationId ? { correlationId: reqCtx.correlationId } : {}),
+      ...(reqCtx?.causationId ? { causationId: reqCtx.causationId } : {}),
+    },
+  });
+  return null;
+}
+
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -140,28 +213,14 @@ export const forgetSubjectWrite = defineWriteHandler({
       raw,
     );
     if (tenantScopeDenial) {
-      // Denied cross-tenant probes must still leave an audit trail (fw#2348),
-      // but the denial lands in the REQUESTING actor's own tenant-scoped
-      // stream — it must never materialise the foreign subject's identifiers
-      // there. A plaintext subjectKey/aggregateId would survive as a
-      // permanent record for the prober and would still be present when the
-      // owning tenant later runs its own (legitimate) forget-subject for that
-      // subject. The digest still lets an operator correlate repeated probes
-      // of the same subject without exposing it (fw#2452).
-      await ctx.unsafeAppendEvent({
-        aggregateId: event.user.id,
-        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
-        type: SUBJECT_FORGET_DENIED_EVENT_NAME,
-        payload: {
-          subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
-          subjectKind: raw.kind,
-          reason: event.payload.reason,
-          forgottenBy: event.user.id,
-          actorTenantId: event.user.tenantId,
-          denial: tenantScopeDenial.error.code,
-        },
-      });
-      return tenantScopeDenial;
+      const auditFailure = await appendDenialAuditEvent(
+        ctx,
+        event,
+        subjectKey,
+        raw.kind,
+        tenantScopeDenial.error.code,
+      );
+      return auditFailure ?? tenantScopeDenial;
     }
 
     // Erase BEFORE the audit append: if the append throws, the key is gone

package/src/workflow-runner/event-trigger.ts

@@ -4,11 +4,10 @@
 // Registration pattern:
 //   registerEventTrigger(r, myWorkflow)
 //
-// The MSP apply-fn runs in the dispatcher's own tx, so `workflow.run-started`
-// plus the synchronous portion of the pipeline land atomically. Any throw
-// from startAndRunWorkflow is recorded as `workflow.run-failed` and
-// swallowed — the failure is already durable, so the dispatcher advances
-// past the trigger event instead of redelivering it.
+// The apply-fn does NOT run in the dispatcher's cursor tx (the server's MSP
+// wiring uses the unbound pool), so `workflow.run-started` and the rest of
+// the pipeline are not atomic. A throw from startAndRunWorkflow is recorded
+// as `workflow.run-failed` and swallowed, so the dispatcher moves on.
 
 import type {
   FeatureRegistrar,