@cosmicdrift/kumiko-bundled-features 0.274.0 → 0.276.0

package/src/user-data-rights/feature.ts

@@ -529,21 +529,24 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     });
 
     // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
-    r.job(
-      "run-export-jobs",
-      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
-      async (_payload, ctx) => {
-        if (!ctx.db || !ctx.registry) {
-          throw new Error(
-            "run-export-jobs: ctx.db + ctx.registry required (JobContext incomplete)",
-          );
+    const RUN_EXPORT_JOBS_REASON = "processes pending export jobs across every tenant";
+    r.job({
+      name: "run-export-jobs",
+      trigger: { cron: "0 3 * * *" },
+      concurrency: "skip",
+      escapeHatch: { reason: RUN_EXPORT_JOBS_REASON },
+      handler: async (_payload, ctx) => {
+        if (!ctx.registry) {
+          throw new Error("run-export-jobs: ctx.registry required (JobContext incomplete)");
         }
         const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
         // SYSTEM_USER_ID ist die framework-weite Konvention. Der job-
         // Discriminator wird via handlerName="user-data-rights:run-export-
         // jobs" im Secret-Read-Audit erfasst.
         const exportUserId = ctx._userId ?? SYSTEM_USER_ID;
-        const exportDb = ctx.db as import("@cosmicdrift/kumiko-framework/db").DbConnection; // @cast-boundary db-operator
+        const exportDb = ctx.db.unsafeRaw(
+          RUN_EXPORT_JOBS_REASON,
+        ) as import("@cosmicdrift/kumiko-framework/db").DbConnection; // @cast-boundary db-operator — jobs never run inside a DbTx
         const exportRegistry = ctx.registry;
 
         // C6 — ohne eigene send*Email-Opts aber mit gemountetem mail-transport
@@ -609,25 +612,28 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           }),
         });
       },
-    );
+    });
 
     // Autonomer Art.17-Forget-Cron. Spiegelt run-export-jobs: nach Ablauf der
     // Grace-Period laeuft runForgetCleanup unbeaufsichtigt (der manuelle
     // userDataRights.runForget-API bleibt fuer Operator-Runs). Ohne diesen
     // Cron bleibt jeder Loesch-Antrag fuer immer in DeletionRequested haengen
     // — Art.17 wuerde nie ausgefuehrt.
-    r.job(
-      "run-forget-cleanup",
-      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
-      async (_payload, ctx) => {
-        if (!ctx.db || !ctx.registry) {
-          throw new Error(
-            "run-forget-cleanup: ctx.db + ctx.registry required (JobContext incomplete)",
-          );
+    const RUN_FORGET_CLEANUP_REASON = "executes overdue Art.17 forget requests across every tenant";
+    r.job({
+      name: "run-forget-cleanup",
+      trigger: { cron: "0 3 * * *" },
+      concurrency: "skip",
+      escapeHatch: { reason: RUN_FORGET_CLEANUP_REASON },
+      handler: async (_payload, ctx) => {
+        if (!ctx.registry) {
+          throw new Error("run-forget-cleanup: ctx.registry required (JobContext incomplete)");
         }
         const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
         const forgetUserId = ctx._userId ?? SYSTEM_USER_ID;
-        const forgetDb = ctx.db as import("@cosmicdrift/kumiko-framework/db").DbConnection; // @cast-boundary db-operator
+        const forgetDb = ctx.db.unsafeRaw(
+          RUN_FORGET_CLEANUP_REASON,
+        ) as import("@cosmicdrift/kumiko-framework/db").DbConnection; // @cast-boundary db-operator — jobs never run inside a DbTx
         const forgetRegistry = ctx.registry;
         const tenantModel = await resolveAppTenantModel({
           registry: forgetRegistry,
@@ -686,7 +692,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           );
         }
       },
-    );
+    });
   });
 }
 

package/src/workflow-runner/__tests__/event-wakeup.integration.test.ts

@@ -24,7 +24,12 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTenantDb,
+  createUncheckedSystemDb,
+  insertOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   type AwaitedEventType,
   createSystemUser,
@@ -199,7 +204,8 @@ async function runResumeDueRunsJob(tenantId: string): Promise<void> {
 
   const systemUser = createSystemUser(tenantId);
   const ctx: JobContext = {
-    db: stack.db,
+    db: createTenantDb(stack.db, tenantId),
+    systemDb: createUncheckedSystemDb(createTenantDb(stack.db, tenantId, "system")),
     registry: stack.registry,
     systemUser,
     log: noopLogger,

package/src/workflow-runner/__tests__/resume-loop.integration.test.ts

@@ -23,7 +23,12 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTenantDb,
+  createUncheckedSystemDb,
+  insertOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineFeature,
@@ -177,7 +182,8 @@ async function runResumeDueRunsJob(): Promise<void> {
 
   const systemUser = createSystemUser(admin.tenantId);
   const ctx: JobContext = {
-    db: stack.db,
+    db: createTenantDb(stack.db, admin.tenantId),
+    systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
     registry: stack.registry,
     systemUser,
     log: noopLogger,

package/src/workflow-runner/feature.ts

@@ -24,6 +24,7 @@
 //
 // wait/retry/waitForEvent suspensions all resume automatically now.
 
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { selectDueWorkflowRunPending } from "./db/queries/due-runs";
 import { resumeRunHandler } from "./handlers/resume-run.write";
@@ -58,8 +59,8 @@ export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
     "resume-due-runs",
     { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" },
     async (_payload, ctx) => {
-      if (!ctx.db) {
-        throw new Error("resume-due-runs: ctx.db required (JobContext incomplete)");
+      if (!ctx.systemDb) {
+        throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
       }
       const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
       if (tenantId === undefined) {
@@ -67,7 +68,13 @@ export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
         return;
       }
 
-      const dueRows = await selectDueWorkflowRunPending(ctx.db, tenantId);
+      ctx.systemDb.assertTenantMatch(tenantId);
+      const dueRows = await selectDueWorkflowRunPending(
+        ctx.systemDb.unsafeRaw(
+          "due-row pickup needs FOR UPDATE SKIP LOCKED raw SQL; the query filters by this job's tenantId",
+        ) as DbConnection, // @cast-boundary db-operator — DbRunner narrows to DbConnection, jobs never run inside a DbTx
+        tenantId,
+      );
 
       for (const row of dueRows) {
         try {