@cosmicdrift/kumiko-bundled-features 0.269.2 → 0.273.0

package/src/user-data-rights/handlers/export-job-detail.query.ts

@@ -4,7 +4,10 @@ import { exportJobEntity } from "../schema/export-job";
 // Detail fetch backing the read-only export-job inspector screen.
 export const exportJobDetailQuery = defineEntityDetailHandler("export-job", exportJobEntity, {
   access: { roles: access.systemAdmin },
-  crossTenant: true,
+  escapeHatch: {
+    reason:
+      "SystemAdmin GDPR Art. 20 export inspector opens one data-export job owned by any tenant for platform-operator support",
+  },
   description:
     "Read-only cross-tenant detail view of one GDPR data-export job for the system-admin inspector, showing its lifecycle timestamps, storage key, byte count and error message.",
 });

package/src/user-data-rights/handlers/export-job-list.query.ts

@@ -5,7 +5,10 @@ import { exportJobEntity } from "../schema/export-job";
 // rows are created by the user's request-export flow, never through this handler.
 export const exportJobListQuery = defineEntityListHandler("export-job", exportJobEntity, {
   access: { roles: access.systemAdmin },
-  crossTenant: true,
+  escapeHatch: {
+    reason:
+      "SystemAdmin GDPR Art. 20 export inspector lists data-export jobs of every tenant for platform-operator support",
+  },
   description:
     "Read-only cross-tenant list of GDPR Art. 20 data-export jobs for the system-admin inspector; use export-status instead when a user asks about their own export.",
 });

package/src/user-data-rights/handlers/export-status.query.ts

@@ -35,7 +35,13 @@ type ExportJobRow = {
 export const exportStatusQuery = defineQueryHandler({
   name: "export-status",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user reads only their own most recent export job; the query " +
+        "filters exportJobsTable by the caller's own userId",
+    },
+  },
   description:
     "Returns the calling user's own most recent data-export job with its status, expiry and error, or hasJob false, for polling after a request-export while the job is still running.",
   escapeHatch: {

package/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -28,7 +28,14 @@ export const myAuditLogQuery = defineQueryHandler({
       message: "`from` must be less than or equal to `to`",
       path: ["from"],
     }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user reads only their own event-store history for the GDPR " +
+        "Art. 15 self-disclosure; the query hard-codes createdBy = caller and can never " +
+        "read another user's history",
+    },
+  },
   description:
     "Returns the calling user's own event-store entries across all their tenant memberships, paged and filterable by aggregate type, event type and time range, for the GDPR Art. 15 self-disclosure; it can never read another user's history.",
   escapeHatch: {

package/src/user-data-rights/handlers/request-deletion.write.ts

@@ -43,7 +43,13 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
   return defineWriteHandler({
     name: "request-deletion",
     schema: z.object({}),
-    access: { openToAll: true },
+    access: {
+      openToAll: {
+        reason:
+          "each signed-in user starts deletion of only their own account; the grace " +
+          "period is armed for the caller's own userId",
+      },
+    },
     escapeHatch: {
       reason:
         "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +

package/src/user-data-rights/handlers/request-export.write.ts

@@ -60,7 +60,13 @@ function isActiveJobConflict(failure: WriteFailure): boolean {
 export const requestExportWrite = defineWriteHandler({
   name: "request-export",
   schema: z.object({}),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user queues only their own data export; the active-job " +
+        "check and the created job are both keyed by the caller's own userId",
+    },
+  },
   description:
     "Queues a GDPR Art. 15 and 20 data export for the calling user and returns its job id, handing back the running job with isExisting true instead of a second one when an export is already pending.",
   escapeHatch: {

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -40,7 +40,14 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
   schema: z.object({ userId: z.string().uuid().optional() }),
-  access: { openToAll: true },
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user may restrict only their own account by default; targeting " +
+        "another userId additionally requires isAdminActor(event.user) and a membership " +
+        "row for the target in the admin's own tenant, both checked in the handler body",
+    },
+  },
   escapeHatch: {
     reason:
       "Revokes all live sessions of the (possibly self-)restricted user via ctx.writeAs(SYSTEM, " +

package/src/user-data-rights/lib/is-admin-actor.ts

@@ -4,7 +4,7 @@ import { access } from "@cosmicdrift/kumiko-framework/engine";
 const ADMIN_ROLES: ReadonlySet<string> = new Set(access.admin);
 const SYSTEM_ADMIN_ROLES: ReadonlySet<string> = new Set(access.systemAdmin);
 
-// Reused by handlers that are `openToAll: true` but still need a manual
+// Reused by handlers that declare `openToAll` but still need a manual
 // self-or-admin gate (e.g. restrict-account.write.ts) — Set-lookup instead
 // of the O(n·m) `roles.some(role => access.admin.includes(role))` re-scan.
 export function isAdminActor(user: Pick<SessionUser, "roles">): boolean {

package/src/user-data-rights/screens.ts

@@ -71,4 +71,7 @@ export const downloadAttemptListScreen: EntityListScreenDefinition = {
   columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
   searchable: false,
   access: { roles: access.systemAdmin },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
 };

package/src/user-profile/__tests__/profile-screen.boot.test.ts

@@ -46,7 +46,12 @@ describe("user-profile screen (fw#2312 projectionDetail conversion)", () => {
     expect(screen?.type).toBe("projectionDetail");
     if (screen?.type === "projectionDetail") {
       expect(screen.query).toBe("user:query:user:me");
-      expect(screen.access).toEqual({ openToAll: true });
+      expect(screen.access).toEqual({
+        openToAll: {
+          reason:
+            "each signed-in user manages only their own profile: change-email/password re-authenticate the caller, and deletion request/cancel act on the caller's own userId; no app role name is portable enough to gate this",
+        },
+      });
     }
   });
 

package/src/user-profile/feature.ts

@@ -77,7 +77,17 @@ export function createUserProfileFeature(): FeatureDefinition {
       type: "projectionDetail",
       query: UserProfileQueries.me,
       singleton: true,
-      access: { openToAll: true },
+      access: {
+        openToAll: {
+          reason:
+            "each signed-in user manages only their own profile: change-email/password " +
+            "re-authenticate the caller, and deletion request/cancel act on the caller's " +
+            "own userId; no app role name is portable enough to gate this",
+        },
+      },
+      // Self-service settings-area screen, placed by the consuming app's own
+      // r.nav() (see samples/apps/use-all-bundled's screens-feature.ts).
+      dormant: true,
       description:
         "Self-service account page: change password, change email (with re-auth and " +
         "a verification-mail follow-up), and request or cancel account deletion " +

package/src/workflow-runner/__tests__/pending-projection.integration.test.ts

@@ -52,7 +52,7 @@ const testEventsFeature = defineFeature("wr-pending-test", (r) => {
       });
       return { isSuccess: true, data: {} };
     },
-    { access: { openToAll: true } },
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
   );
 });