@cosmicdrift/kumiko-bundled-features 0.252.1 → 0.253.0

package/src/tenant/membership-table.ts

@@ -18,11 +18,11 @@ import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/eng
 export const tenantMembershipEntity = createEntity({
   table: "read_tenant_memberships",
   fields: {
-    userId: createTextField({ required: true }),
+    userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     // JSON-encoded string[] — parseRoles() deserializes at read time.
     // Mirrors how roles were stored under the pre-ES row model so the
     // read-side stays byte-compatible and no MSP/consumer needs rewrites.
-    roles: createTextField({ required: true }),
+    roles: createTextField({ required: true, personal: false, reason: "technical_reference" }),
   },
   indexes: [
     { unique: true, columns: ["userId", "tenantId"], name: "read_tenant_memberships_unique" },

package/src/tenant/schema/tenant.ts

@@ -25,8 +25,23 @@ export const tenantEntity = createEntity({
   // Alle tenantId-Spalten sind UUID (Migration 2026-04-16) → tenant.id muss
   // UUID sein, sonst findet der tenants-Lookup nie. Default gen_random_uuid().
   fields: {
-    key: createTextField({ required: true, maxLength: 50 }),
-    name: createTextField({ required: true, maxLength: 200, searchable: true, sortable: true }),
+    key: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    // Workspace/company display name, not an individual's identity —
+    // same class as the `company.legalName` example in the boot-validator's
+    // own PII-heuristic doc-comment.
+    name: createTextField({
+      required: true,
+      maxLength: 200,
+      searchable: true,
+      sortable: true,
+      personal: false,
+      reason: "is_business_data",
+    }),
     isEnabled: createBooleanField({ default: true, filterable: true }),
     // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep
     // existing tenants valid when the feature is not mounted.
@@ -37,7 +52,11 @@ export const tenantEntity = createEntity({
       filterable: true,
     }),
     destroyRequestedAt: createTimestampField({}),
-    destroyRequestedBy: createTextField({ maxLength: 36 }),
+    destroyRequestedBy: createTextField({
+      maxLength: 36,
+      personal: false,
+      reason: "pseudonymous_fk",
+    }),
     gracePeriodEnd: createTimestampField({}),
     destroyStartedAt: createTimestampField({}),
     destroyedAt: createTimestampField({}),

package/src/tenant-settings/__tests__/tenant-settings.integration.test.ts

@@ -30,7 +30,7 @@ import { defineCreateWithTenantDefaults } from "../tenant-defaults";
 const invoiceEntity = createEntity({
   table: "read_invoices",
   fields: {
-    title: createTextField({ required: true }),
+    title: createTextField({ required: true, personal: false, reason: "is_business_data" }),
     amount: createMoneyField({ required: true }),
     language: createSelectField({ options: ["en", "de"] as const }),
   },

package/src/tier-engine/entity.ts

@@ -27,12 +27,22 @@ export const tierAssignmentEntity = createEntity({
   description:
     "The pricing tier currently assigned to a tenant, plus where the assignment came from (manual grant, billing sync or signup default) — one row per tenant.",
   fields: {
-    tier: createTextField({ required: true, maxLength: 50 }),
+    tier: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "catalog_label",
+    }),
     // Woher das Assignment stammt: "manual" (Admin-Grant via tier-admin-Screen),
     // "stripe" (future Billing-Sync), "default" (auto-default-on-signup-Hook).
     // Optional für Back-Compat zu bestehenden Rows ohne source. Schützt manuelle
     // Grants davor, von einem späteren Stripe→Tier-Sync geplättet zu werden.
-    source: createTextField({ required: false, maxLength: 20 }),
+    source: createTextField({
+      required: false,
+      maxLength: 20,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });
 

package/src/user/schema/user.ts

@@ -81,9 +81,19 @@ export const userEntity = createEntity({
     // Password material: only SYSTEM/SystemAdmin can read or write it.
     // auth-email-password reads it during login, writes it during registration
     // and password changes. Stripped from ordinary responses via read-access.
+    // Kept Klasse 1 deliberately: find-for-auth.query.ts reads this row via a
+    // raw fetchOne (bypassing the executor's decrypt on purpose, so a
+    // SystemAdmin session's ordinary query path never sees it) — a subject
+    // annotation would make the executor encrypt it on write while this
+    // login-critical read stays raw, so verifyPassword would compare a
+    // plaintext password against ciphertext and every login would fail once
+    // a KMS is active. Already an irreversible one-way hash, access-gated to
+    // privileged read/write — see PR body "Offene Fragen".
     passwordHash: createTextField({
       maxLength: 255,
       access: { read: access.privileged, write: access.privileged },
+      personal: false,
+      reason: "credential_hash_read_without_decrypt_2809",
     }),
 
     // Profile — user-editable. Real name in most apps → PII. Searchable via
@@ -95,7 +105,7 @@ export const userEntity = createEntity({
       find: "fuzzy",
     }),
     // No default here — tenant-settings owns the app-wide locale default; see #1637.
-    locale: createTextField({ maxLength: 10 }),
+    locale: createTextField({ maxLength: 10, personal: false, reason: "technical_reference" }),
     // No default here — mirrors locale: ctx.tz falls back to tenant.timezone
     // (then "UTC") when unset, see buildHandlerContext (fw#1636).
     timezone: createTzField(),
@@ -106,6 +116,8 @@ export const userEntity = createEntity({
     lastActiveTenantId: createTextField({
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
 
     // Email-verification flag — flipped to true by the verify-email handler
@@ -171,6 +183,8 @@ export const userEntity = createEntity({
     pendingDeletionRequestId: createTextField({
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
   },
   // fw#2134 — email is `personal: "self", find: "exact"`, so the column holds

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -37,8 +37,8 @@ const cipher = createTestEnvelopeCipher();
 const vaultNoteEntity = createEntity({
   table: "read_vault_notes",
   fields: {
-    ownerId: createTextField({ required: true }),
-    note: createTextField({ encrypted: true }),
+    ownerId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
+    note: createTextField({ encrypted: true, personal: false, reason: "technical_reference" }),
   },
 });
 

package/src/user-data-rights/__tests__/forget-cleanup-hook-ordering.integration.test.ts

@@ -101,7 +101,7 @@ function makeEntity(tableName: string) {
   return createEntity({
     table: tableName,
     fields: {
-      name: createTextField({ required: true }),
+      name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
       customFields: customFieldsField(),
     },
   });

package/src/user-data-rights/__tests__/forget-cleanup-search-purge-ordering.integration.test.ts

@@ -43,7 +43,7 @@ const NOTE_ID = "bbbbbbbb-bbbb-4bbb-8bbb-0000000000f1";
 const noteEntity = createEntity({
   table: "read_forget_purge_notes",
   fields: {
-    authorId: createTextField({ required: true }),
+    authorId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
     body: createTextField({
       required: true,
       personal: { of: "authorId" },

package/src/user-data-rights/__tests__/forget-hook-registry.integration.test.ts

@@ -46,7 +46,9 @@ const captureHook: UserDataDeleteHook = async (ctx) => {
 
 const probeEntity = createEntity({
   table: `read_${PROBE.replace(/-/g, "_")}`,
-  fields: { name: createTextField({ required: true }) },
+  fields: {
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+  },
 });
 
 const probeFeature = defineFeature(PROBE, (r) => {

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -72,7 +72,9 @@ const tenantScopedDeleteHook: UserDataDeleteHook = async (ctx) => {
 
 const scopedEntity = createEntity({
   table: TABLE,
-  fields: { name: createTextField({ required: true }) },
+  fields: {
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+  },
 });
 
 const contributorFeature = defineFeature("dsgvo-tenant-scoped", (r) => {

package/src/user-data-rights/schema/download-attempt.ts

@@ -16,17 +16,35 @@ export const downloadAttemptEntity = createEntity({
     "One rejected attempt to fetch a GDPR data-export download, recording the failure result, the path used (magic-link token or logged-in job id), the source IP, user agent and time, so brute-force probing of download links is visible.",
   fields: {
     // notFound | expired | failed | signedUrlNotSupported
-    result: createTextField({ required: true, maxLength: 32 }),
+    result: createTextField({
+      required: true,
+      maxLength: 32,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Welcher Pfad: "token" | "job"
-    via: createTextField({ required: true, maxLength: 16 }),
+    via: createTextField({
+      required: true,
+      maxLength: 16,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Token-Hash (token-Pfad) oder NULL (job-Pfad / unbekannter Token).
-    tokenHash: createTextField({ maxLength: 64 }),
+    tokenHash: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
     // Job-ID wenn der attempt einen kannte. NULL bei unbekanntem Token.
-    jobId: createTextField({}),
+    jobId: createTextField({ personal: false, reason: "technical_reference" }),
     // User-ID wenn auth-Pfad (job). NULL bei anonymous (token-Pfad).
-    attemptedByUserId: createTextField({}),
-    ip: createTextField({ maxLength: 64 }),
-    userAgent: createTextField({ maxLength: 256 }),
+    attemptedByUserId: createTextField({ personal: false, reason: "pseudonymous_fk" }),
+    // Same reasoning as download-token.ts's lastUsedFromIp/lastUsedUserAgent
+    // (sibling entity, same feature): DPO brute-force-audit data belongs to
+    // the tenant operator, not the (often anonymous) requester. Also avoids
+    // a real hazard on this buildEntityTable-managed entity: attemptedByUserId
+    // is null-by-design for the anonymous token path, so a subject annotation
+    // (`personal: { of: "attemptedByUserId" }`) would throw
+    // SubjectResolutionError on every such row once a KMS is configured
+    // (crypto/subject-resolver.ts resolveUserOwnedSubject).
+    ip: createTextField({ maxLength: 64, personal: false, reason: "is_business_data" }),
+    userAgent: createTextField({ maxLength: 256, personal: false, reason: "is_business_data" }),
     attemptedAt: createTimestampField({ required: true }),
   },
   // 90d hardDelete: unbounded growth = disk-bomb genau gegen das System

package/src/user-data-rights/schema/download-token.ts

@@ -45,6 +45,8 @@ export const exportDownloadTokenEntity = createEntity({
     // Job gehoeren.
     jobId: createTextField({
       required: true,
+      personal: false,
+      reason: "technical_reference",
     }),
 
     // **Hash NICHT plain.** SHA256-hex (64 chars). Atom 4b verifiziert
@@ -52,6 +54,8 @@ export const exportDownloadTokenEntity = createEntity({
     tokenHash: createTextField({
       required: true,
       maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
     }),
 
     // Wann wurde das Token ausgegeben (= Job-Done-Flip-Zeit).

package/src/user-data-rights/schema/export-job.ts

@@ -76,6 +76,8 @@ export const exportJobEntity = createEntity({
     userId: createTextField({
       required: true,
       searchable: true,
+      personal: false,
+      reason: "pseudonymous_fk",
     }),
 
     // **requestedFromTenantId** — der Tenant aus dem der User den Antrag
@@ -93,6 +95,8 @@ export const exportJobEntity = createEntity({
     // Tenant-Context ein falsches Profile.
     requestedFromTenantId: createTextField({
       required: true,
+      personal: false,
+      reason: "technical_reference",
     }),
 
     status: createSelectField({
@@ -123,6 +127,8 @@ export const exportJobEntity = createEntity({
     // signed-URL on demand vom Storage-Provider (Atom 4).
     downloadStorageKey: createTextField({
       maxLength: 500,
+      personal: false,
+      reason: "technical_reference",
     }),
 
     // Ab wann ist der Download nicht mehr abrufbar. Worker setzt