@cosmicdrift/kumiko-bundled-features 0.285.1 → 0.285.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.285.1",
+  "version": "0.285.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.285.1",
-    "@cosmicdrift/kumiko-framework": "0.285.1",
-    "@cosmicdrift/kumiko-headless": "0.285.1",
-    "@cosmicdrift/kumiko-renderer": "0.285.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.285.1",
-    "@cosmicdrift/kumiko-types": "0.285.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.285.2",
+    "@cosmicdrift/kumiko-framework": "0.285.2",
+    "@cosmicdrift/kumiko-headless": "0.285.2",
+    "@cosmicdrift/kumiko-renderer": "0.285.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.285.2",
+    "@cosmicdrift/kumiko-types": "0.285.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.285.1",
-    "@cosmicdrift/kumiko-locale-es": "0.285.1"
+    "@cosmicdrift/kumiko-locale-de": "0.285.2",
+    "@cosmicdrift/kumiko-locale-es": "0.285.2"
   }
 }

package/src/file-provider-s3-env/feature.ts

@@ -10,8 +10,8 @@
 // buckets, admin-seeded). This `"s3-env"` provider reads one credential set
 // from env and serves every tenant from one bucket — the
 // Hetzner-Object-Storage / single-bucket deploy case. Tenant isolation
-// still holds: file keys are tenant-prefixed (export ZIPs:
-// `<tenantId>/exports/<jobId>.zip`) or globally-unique UUIDs (fileRefs).
+// still holds: file keys carry the tenant (export ZIPs:
+// `exports/<tenantId>/<jobId>.zip`) or are globally-unique UUIDs (fileRefs).
 //
 // **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
 // only the file-foundation plugin-point required).

package/src/files-tenant-data/__tests__/hooks.integration.test.ts

@@ -24,6 +24,7 @@ import {
   fileRefEntity,
   fileRefsTable,
   type InMemoryFileProvider,
+  tenantExportPrefix,
 } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -203,10 +204,15 @@ describe("files-tenant-data :: tenant destroy", () => {
     );
     const derivativeKeyA = `${originalKeyA.replace(/\.jpg$/, "")}.thumb-0123456789abcdef.jpg`;
     const unrelatedKeyA = `${tenantA.tenantId}/some-other-file.bin`;
+    // Export ZIPs live under exports/{tenantId}/, not {tenantId}/ — a
+    // regression here would leave a tenant's decrypted GDPR export bundle
+    // behind after destroy (#3003 review finding).
+    const exportKeyA = `${tenantExportPrefix(tenantA.tenantId)}job-1.zip`;
     const { id: fileRefIdA } = await seedFileRef(tenantA.tenantId, originalKeyA);
     await provider.write(originalKeyA, new Uint8Array([1]));
     await provider.write(derivativeKeyA, new Uint8Array([2]));
     await provider.write(unrelatedKeyA, new Uint8Array([3]));
+    await provider.write(exportKeyA, new Uint8Array([5]));
 
     const originalKeyB = buildStorageKey(
       tenantB.tenantId,
@@ -233,6 +239,9 @@ describe("files-tenant-data :: tenant destroy", () => {
     // Storage wipe (EXT_STORAGE_PROVIDER "files" stage) — every key under the
     // tenant's prefix is gone, including the unrelated non-fileRef-tracked key.
     expect(await provider.list(`${tenantA.tenantId}/`)).toHaveLength(0);
+    // The export prefix is a separate top-level sweep, not covered by
+    // `${tenantId}/` — proves fileRefStorageDestroyHook sweeps it too.
+    expect(await provider.exists(exportKeyA)).toBe(false);
 
     // Tenant B's fileRef row and storage key are completely untouched.
     const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });

package/src/files-tenant-data/hooks.ts

@@ -11,12 +11,12 @@
 //     tenant has no "restore from trash" future.
 //   - fileRefStorageDestroyHook ("files" stage, EXT_STORAGE_PROVIDER): wipes
 //     every BINARY (original + derivatives + anything else) under the
-//     tenant's storage prefix. A full `${tenantId}/` prefix sweep, not a
-//     per-row derivative lookup — buildStorageKey always puts tenantId first,
-//     so this needs only the tenantId, stays correct even though the "files"
-//     stage runs after "app-data" already forgot the rows, and can never
-//     cross into another tenant's keys (the provider's own list() prefix
-//     already scopes it).
+//     tenant's storage prefixes. A full prefix sweep per tenantStoragePrefixes()
+//     entry, not a per-row derivative lookup — not every layout puts tenantId
+//     first (see tenantExportPrefix), so this must sweep every known prefix,
+//     stays correct even though the "files" stage runs after "app-data"
+//     already forgot the rows, and can never cross into another tenant's keys
+//     (the provider's own list() prefix already scopes it).
 
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -28,6 +28,7 @@ import {
   assertSafeStorageKey,
   fileRefEntity,
   fileRefsTable,
+  tenantStoragePrefixes,
 } from "@cosmicdrift/kumiko-framework/files";
 
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
@@ -83,9 +84,11 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
   // the "files" stage throws, tenant-lifecycle's retry/abandon handling sees
   // it, and the next sweep tick retries (list+delete are idempotent, so this
   // converges rather than double-deleting or erroring on a missing key).
-  const keys = await provider.list(`${tenantId}/`);
-  for (const key of keys) {
-    assertSafeStorageKey(key);
-    await provider.delete(key);
+  for (const prefix of tenantStoragePrefixes(tenantId)) {
+    const keys = await provider.list(prefix);
+    for (const key of keys) {
+      assertSafeStorageKey(key);
+      await provider.delete(key);
+    }
   }
 };

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -141,7 +141,7 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     );
     const jobId = requestRes.jobId;
     const provider = await buildProvider(jobTenant);
-    await provider.write(`${jobTenant}/exports/${jobId}.zip`, new Uint8Array([1, 2, 3]));
+    await provider.write(`exports/${jobTenant}/${jobId}.zip`, new Uint8Array([1, 2, 3]));
 
     const result = await runExportJobs({
       db: stack.db,
@@ -164,6 +164,6 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     expect(res.status).toBe(200);
     const body = (await res.json()) as { data?: { url?: string } };
     expect(body.data?.url).toMatch(/^memory:\/\//);
-    expect(body.data?.url).toContain(`${jobTenant}/exports/${jobId}.zip`);
+    expect(body.data?.url).toContain(`exports/${jobTenant}/${jobId}.zip`);
   });
 });

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -211,7 +211,7 @@ async function seedDoneJobWithToken(): Promise<{ jobId: string; plainToken: stri
 
   // 2. seed in-memory ZIP file at path that worker would write
   const provider = await buildProvider(tenantA);
-  const storageKey = `${tenantA}/exports/${jobId}.zip`;
+  const storageKey = `exports/${tenantA}/${jobId}.zip`;
   await provider.write(storageKey, new Uint8Array([1, 2, 3]));
 
   // 3. Run worker → done-flip + Token-Create
@@ -250,7 +250,7 @@ describe("download-by-token :: happy path", () => {
     const result = body.data;
 
     expect(result.url).toMatch(/^memory:\/\//);
-    expect(result.url).toContain(`${tenantA}/exports/${jobId}.zip`);
+    expect(result.url).toContain(`exports/${tenantA}/${jobId}.zip`);
     expect(result.expiresAt).toMatch(/^\d{4}-\d{2}-\d{2}T/);
 
     // Audit-Update: useCount=1, lastUsedAt set, IP+UA persistiert

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -183,13 +183,13 @@ describe("runExportJobs :: happy path", () => {
       bytesWritten: number | null;
     }>;
     expect(row?.status).toBe(EXPORT_JOB_STATUS.Done);
-    expect(row?.downloadStorageKey).toBe(`${tenantA}/exports/${jobId}.zip`);
+    expect(row?.downloadStorageKey).toBe(`exports/${tenantA}/${jobId}.zip`);
     expect(row?.expiresAt).not.toBeNull();
     expect(row?.bytesWritten).toBeGreaterThan(0);
 
     // ZIP wirklich im Storage
     const provider = await buildProvider(tenantA);
-    expect(await provider.exists(`${tenantA}/exports/${jobId}.zip`)).toBe(true);
+    expect(await provider.exists(`exports/${tenantA}/${jobId}.zip`)).toBe(true);
   });
 
   test("ZIP ist real entpackbar via Info-ZIP + enthaelt bundle.json", async () => {
@@ -203,7 +203,7 @@ describe("runExportJobs :: happy path", () => {
     });
 
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
 
     // Real-Decoder-Roundtrip via Info-ZIP unzip
     const dir = await mkdtemp(join(tmpdir(), "kumiko-worker-test-"));
@@ -291,7 +291,7 @@ describe("runExportJobs :: stale-detection", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const twoHoursAgo = T.Instant.fromEpochMilliseconds(Date.now() - 2 * 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
 
     // Simuliert real-Pfad: claim-update hatte status=running + storageKey
     // gesetzt + ZIP geschrieben. Worker dann gecrashed (kein done-flip).
@@ -335,7 +335,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const longAgo = T.Instant.fromEpochMilliseconds(
       Date.now() - 365 * 24 * 60 * 60 * 1000, // 1 Jahr ago
     );
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([1, 2, 3]));
 
@@ -374,7 +374,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const oneHourAgo = T.Instant.fromEpochMilliseconds(Date.now() - 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([4, 5, 6]));
 
@@ -406,7 +406,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([7, 8, 9]));
 
@@ -505,11 +505,11 @@ describe("runExportJobs :: concurrency", () => {
     }>;
     expect(rows).toHaveLength(1);
     expect(rows[0]?.status).toBe(EXPORT_JOB_STATUS.Done);
-    expect(rows[0]?.downloadStorageKey).toBe(`${tenantA}/exports/${jobId}.zip`);
+    expect(rows[0]?.downloadStorageKey).toBe(`exports/${tenantA}/${jobId}.zip`);
 
     // Storage hat genau ein ZIP — kein Race-induziertes Doppel-Schreiben
     const provider = await buildProvider(tenantA);
-    expect(await provider.exists(`${tenantA}/exports/${jobId}.zip`)).toBe(true);
+    expect(await provider.exists(`exports/${tenantA}/${jobId}.zip`)).toBe(true);
   });
 });
 
@@ -875,7 +875,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     // Storage-Cleanup-Pass fuer failed-Jobs: sofort ZIP loeschen (kein
     // Grace), DB-Spalte nullen.
     const jobId = await seedPendingJob();
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
 
     // ZIP in storage seeden + Job manuell auf failed mit storageKey
     // (simuliert orphan-state nach Worker-crash).
@@ -1050,7 +1050,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
 
     // ZIP entpacken + file-bytes verifizieren
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
     const dir = await mkdtemp(join(tmpdir(), "kumiko-3c-test-"));
     try {
       const zipPath = join(dir, "out.zip");
@@ -1155,7 +1155,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
     expect(result.completedJobIds).toContain(jobId);
 
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
     const dir = await mkdtemp(join(tmpdir(), "kumiko-3c-malicious-"));
     try {
       const zipPath = join(dir, "out.zip");

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.285.2",
+    "type": "fix",
+    "title": "export ZIPs write to exports/{tenantId}/{jobId}.zip, enabling one bucket-wide S3 lifecycle rule",
+    "detail": "buildExportStorageKey previously put the tenant first ({tenantId}/exports/{jobId}.zip), so no S3 prefix rule could target \"all tenants, then /exports/\" without also matching normal user uploads in the same bucket. The key now starts with the fixed exports/ segment via the new @cosmicdrift/kumiko-framework/files tenantExportPrefix() helper, tenant stays as the second segment. downloadStorageKey is stored per job and never recomputed, so existing rows keep resolving through their old key — no migration needed. tenantStoragePrefixes() (also new in framework/files) lists every prefix a tenant's binaries can live under; files-tenant-data's fileRefStorageDestroyHook now sweeps all of them on tenant-destroy instead of only {tenantId}/, closing a gap where a destroyed tenant's decrypted GDPR export bundles would have survived under the new exports/ prefix."
+  },
   {
     "version": "0.241.0",
     "type": "breaking",

package/src/user-data-rights/run-export-jobs.ts

@@ -58,6 +58,7 @@ import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createZipStream,
   type FileStorageProvider,
+  tenantExportPrefix,
   type ZipEntry,
 } from "@cosmicdrift/kumiko-framework/files";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -709,9 +710,7 @@ function systemTenantDb(db: DbConnection, tenantId: TenantId) {
 }
 
 function buildExportStorageKey(job: JobRow): string {
-  // Tenant-prefix damit der Storage-Layout pro-Tenant separat liegt.
-  // job.id ist UUID → URL-safe.
-  return `${job.requestedFromTenantId}/exports/${job.id}.zip`;
+  return `${tenantExportPrefix(job.requestedFromTenantId)}${job.id}.zip`;
 }
 
 /**