@cosmicdrift/kumiko-bundled-features 0.269.2 → 0.270.0

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -94,7 +94,12 @@ describe("privacy-center screen (fw#2312 projectionDetail conversion)", () => {
     expect(screen?.type).toBe("projectionDetail");
     if (screen?.type === "projectionDetail") {
       expect(screen.query).toBe("user:query:user:me");
-      expect(screen.access).toEqual({ openToAll: true });
+      expect(screen.access).toEqual({
+        openToAll: {
+          reason:
+            "each signed-in user manages GDPR self-service actions (export, restriction, deletion) for only their own account; the bound query and every action handler operate on the caller's own userId, and no app role name is portable enough to gate this",
+        },
+      });
     }
   });
 

package/src/user-data-rights/feature.ts

@@ -344,7 +344,14 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       type: "projectionDetail",
       query: USER_ME_QUERY,
       singleton: true,
-      access: { openToAll: true },
+      access: {
+        openToAll: {
+          reason:
+            "each signed-in user manages GDPR self-service actions (export, restriction, " +
+            "deletion) for only their own account; the bound query and every action handler " +
+            "operate on the caller's own userId, and no app role name is portable enough to gate this",
+        },
+      },
       description:
         "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
       fieldLabels: {

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -22,7 +22,13 @@ const APPEND_LIFECYCLE_EVENT_REASON =
 export const cancelDeletionWrite = defineWriteHandler({
   name: "cancel-deletion",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user cancels only their own pending deletion request; the " +
+        "lookup and update are scoped to the caller's own id",
+    },
+  },
   description:
     "Withdraws the calling user's own pending account-deletion request and puts the account back to active, accepted only while the grace period is still running.",
   escapeHatch: {

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -63,7 +63,13 @@ export const downloadByJobQuery = defineQueryHandler({
   schema: z.object({
     jobId: z.string().min(1, "jobId required"),
   }),
-  access: { openToAll: true }, // openToAll = auth-required, kein anonymous
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user downloads only their own finished export job; the job " +
+        "lookup checks jobRow.userId against the caller's own id and 404s otherwise",
+    },
+  }, // openToAll = auth-required, kein anonymous
   description:
     "Returns a short-lived signed download URL for the calling user's own finished data-export job named by job id, backing the download button in the privacy center once export-status reports the job done.",
   escapeHatch: {

package/src/user-data-rights/handlers/export-status.query.ts

@@ -35,7 +35,13 @@ type ExportJobRow = {
 export const exportStatusQuery = defineQueryHandler({
   name: "export-status",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user reads only their own most recent export job; the query " +
+        "filters exportJobsTable by the caller's own userId",
+    },
+  },
   description:
     "Returns the calling user's own most recent data-export job with its status, expiry and error, or hasJob false, for polling after a request-export while the job is still running.",
   escapeHatch: {

package/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -28,7 +28,14 @@ export const myAuditLogQuery = defineQueryHandler({
       message: "`from` must be less than or equal to `to`",
       path: ["from"],
     }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user reads only their own event-store history for the GDPR " +
+        "Art. 15 self-disclosure; the query hard-codes createdBy = caller and can never " +
+        "read another user's history",
+    },
+  },
   description:
     "Returns the calling user's own event-store entries across all their tenant memberships, paged and filterable by aggregate type, event type and time range, for the GDPR Art. 15 self-disclosure; it can never read another user's history.",
   escapeHatch: {

package/src/user-data-rights/handlers/request-deletion.write.ts

@@ -43,7 +43,13 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
   return defineWriteHandler({
     name: "request-deletion",
     schema: z.object({}),
-    access: { openToAll: true },
+    access: {
+      openToAll: {
+        reason:
+          "each signed-in user starts deletion of only their own account; the grace " +
+          "period is armed for the caller's own userId",
+      },
+    },
     escapeHatch: {
       reason:
         "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +

package/src/user-data-rights/handlers/request-export.write.ts

@@ -60,7 +60,13 @@ function isActiveJobConflict(failure: WriteFailure): boolean {
 export const requestExportWrite = defineWriteHandler({
   name: "request-export",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user queues only their own data export; the active-job " +
+        "check and the created job are both keyed by the caller's own userId",
+    },
+  },
   description:
     "Queues a GDPR Art. 15 and 20 data export for the calling user and returns its job id, handing back the running job with isExisting true instead of a second one when an export is already pending.",
   escapeHatch: {

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -40,7 +40,14 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
   schema: z.object({ userId: z.string().uuid().optional() }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user may restrict only their own account by default; targeting " +
+        "another userId additionally requires isAdminActor(event.user) and a membership " +
+        "row for the target in the admin's own tenant, both checked in the handler body",
+    },
+  },
   escapeHatch: {
     reason:
       "Revokes all live sessions of the (possibly self-)restricted user via ctx.writeAs(SYSTEM, " +

package/src/user-data-rights/lib/is-admin-actor.ts

@@ -4,7 +4,7 @@ import { access } from "@cosmicdrift/kumiko-framework/engine";
 const ADMIN_ROLES: ReadonlySet<string> = new Set(access.admin);
 const SYSTEM_ADMIN_ROLES: ReadonlySet<string> = new Set(access.systemAdmin);
 
-// Reused by handlers that are `openToAll: true` but still need a manual
+// Reused by handlers that declare `openToAll` but still need a manual
 // self-or-admin gate (e.g. restrict-account.write.ts) — Set-lookup instead
 // of the O(n·m) `roles.some(role => access.admin.includes(role))` re-scan.
 export function isAdminActor(user: Pick<SessionUser, "roles">): boolean {

package/src/user-profile/__tests__/profile-screen.boot.test.ts

@@ -46,7 +46,12 @@ describe("user-profile screen (fw#2312 projectionDetail conversion)", () => {
     expect(screen?.type).toBe("projectionDetail");
     if (screen?.type === "projectionDetail") {
       expect(screen.query).toBe("user:query:user:me");
-      expect(screen.access).toEqual({ openToAll: true });
+      expect(screen.access).toEqual({
+        openToAll: {
+          reason:
+            "each signed-in user manages only their own profile: change-email/password re-authenticate the caller, and deletion request/cancel act on the caller's own userId; no app role name is portable enough to gate this",
+        },
+      });
     }
   });
 

package/src/user-profile/feature.ts

@@ -77,7 +77,14 @@ export function createUserProfileFeature(): FeatureDefinition {
       type: "projectionDetail",
       query: UserProfileQueries.me,
       singleton: true,
-      access: { openToAll: true },
+      access: {
+        openToAll: {
+          reason:
+            "each signed-in user manages only their own profile: change-email/password " +
+            "re-authenticate the caller, and deletion request/cancel act on the caller's " +
+            "own userId; no app role name is portable enough to gate this",
+        },
+      },
       description:
         "Self-service account page: change password, change email (with re-auth and " +
         "a verification-mail follow-up), and request or cancel account deletion " +

package/src/workflow-runner/__tests__/pending-projection.integration.test.ts

@@ -52,7 +52,7 @@ const testEventsFeature = defineFeature("wr-pending-test", (r) => {
       });
       return { isSuccess: true, data: {} };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });