@cosmicdrift/kumiko-bundled-features 0.285.1 → 0.286.0

package/src/shared/single-use-token-store.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+import { createSingleUseTokenStore } from "./single-use-token-store";
+
+// Production Redis has active signup/invite tokens under these exact keys —
+// asserting the generated Redis key strings (not just behavior through a
+// mocked client) catches a prefix typo that would silently make existing
+// tokens unreachable. Only integration tests exercised this logic before
+// (which never assert on the raw key string), so this is new coverage.
+function fakeRedis() {
+  const calls: { method: string; args: unknown[] }[] = [];
+  const redis = {
+    set: async (...args: unknown[]) => {
+      calls.push({ method: "set", args });
+      return "OK";
+    },
+    get: async (...args: unknown[]) => {
+      calls.push({ method: "get", args });
+      return null;
+    },
+    del: async (...args: unknown[]) => {
+      calls.push({ method: "del", args });
+      return 1;
+    },
+    // biome-ignore lint/suspicious/noExplicitAny: minimal ioredis stand-in for key-string assertions
+  } as any;
+  return { redis, calls };
+}
+
+const TOKEN = "tok-1";
+
+describe("signup Redis key strings", () => {
+  const store = createSingleUseTokenStore({
+    tokenPrefix: "signup:by-token:",
+    subjectPrefix: "signup:by-email:",
+    burnPrefix: "signup:burn:",
+  });
+
+  test("store writes forward key under signup:by-token: and reverse key under signup:by-email:", async () => {
+    const { redis, calls } = fakeRedis();
+    await store.store(redis, { subjectId: "user@example.com", token: TOKEN, ttlSeconds: 60 });
+    const forwardKey = calls[0]?.args[0];
+    const subjectKey = calls[1]?.args[0];
+    expect(String(forwardKey)).toStartWith("signup:by-token:");
+    expect(subjectKey).toBe("signup:by-email:user@example.com");
+  });
+
+  test("burn writes under signup:burn:", async () => {
+    const { redis, calls } = fakeRedis();
+    await store.burn(redis, TOKEN);
+    expect(String(calls[0]?.args[0])).toStartWith("signup:burn:");
+  });
+});
+
+describe("invite Redis key strings", () => {
+  const store = createSingleUseTokenStore({
+    tokenPrefix: "invite:by-token:",
+    subjectPrefix: "invite:by-id:",
+    burnPrefix: "invite:burn:",
+  });
+
+  test("store writes forward key under invite:by-token: and reverse key under invite:by-id:", async () => {
+    const { redis, calls } = fakeRedis();
+    await store.store(redis, { subjectId: "inv-1", token: TOKEN, ttlSeconds: 60 });
+    const forwardKey = calls[0]?.args[0];
+    const subjectKey = calls[1]?.args[0];
+    expect(String(forwardKey)).toStartWith("invite:by-token:");
+    expect(subjectKey).toBe("invite:by-id:inv-1");
+  });
+
+  test("burn writes under invite:burn:", async () => {
+    const { redis, calls } = fakeRedis();
+    await store.burn(redis, TOKEN);
+    expect(String(calls[0]?.args[0])).toStartWith("invite:burn:");
+  });
+});

package/src/shared/single-use-token-store.ts

@@ -0,0 +1,136 @@
+// Generic Redis-backed pre-activation token store: bidirectional
+// token↔subject mapping plus single-use burn/unburn semantics. Extracted
+// from auth-email-password/signup-token-store.ts and
+// auth-email-password/invite-token-store.ts (infra#446) — both were the
+// same Redis layout, differing only in their key prefixes and which field
+// (email vs. invitationId) plays the "subject" role.
+//
+// Public subpath export (./shared/single-use-token-store in package.json):
+// offlot-app (a separate repo, external consumer) carries its own copy of
+// this exact logic under `src/features/waitlist/signup-token-store.ts`,
+// with a comment noting it "must stay byte-compatible with
+// auth-email-password/signup-token-store" because signup-confirm resolves
+// tokens via the same Redis key layout. offlot-app#418 (separate issue,
+// after this ships) will replace that copy with
+// `createSingleUseTokenStore({ tokenPrefix: "signup:by-token:", subjectPrefix:
+// "signup:by-email:", burnPrefix: "signup:burn:" })` — i.e. the exact same
+// prefix strings the framework's own signup store below uses, so both stay
+// byte-compatible by construction instead of by hand-copied logic.
+//
+// Token material: opaque random 256-bit (e.g. crypto.randomBytes,
+// base64url-encoded). Not designed for human typing — the subject clicks a
+// mail link, nobody types the token.
+//
+// Why a server-side lookup at all (not a stateless HMAC-signed token, like
+// password-reset/email-verification)? Some subjects (e.g. a not-yet-created
+// signup) have no stable identity claim yet for an HMAC to bind to. We map
+// token ↔ subject bidirectionally in Redis and delete the pair on confirm.
+// Bidirectional because:
+//   - forward (by-token): confirm/accept needs token → subject
+//   - reverse (by-subject): the create/request flow needs to know whether a
+//     token is still live for this subject, so a resend can invalidate it
+//     instead of leaving two valid tokens around
+//
+// Every key is derived from sha256(token), never the raw token — Redis key
+// names, MONITOR output, replica traffic, and memory/backup dumps never
+// carry the bearer secret in the clear (#2174). The by-subject entry stores
+// the *hash* of the live token, not the token itself, so it can only be
+// used to invalidate (delete the matching forward entry) — never to
+// recover or resend the original token. A resend therefore always mints a
+// fresh token and invalidates the previous one, rather than reusing the
+// same link.
+//
+// Single-use burn: `SET burn:<hash> "1" EX 3600 NX` — first caller to
+// confirm/accept wins ("OK"), a concurrent second tab racing the same link
+// gets "already-used". TTL is 1h (short enough that the burn-key doesn't
+// permanently tax Redis, long enough to catch replays inside any realistic
+// race window).
+
+import { createHash } from "node:crypto";
+import type Redis from "ioredis";
+
+function hashToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function createSingleUseTokenStore(prefixes: {
+  readonly tokenPrefix: string;
+  readonly subjectPrefix: string;
+  readonly burnPrefix: string;
+}) {
+  function tokenKey(token: string): string {
+    return `${prefixes.tokenPrefix}${hashToken(token)}`;
+  }
+  // Builds the forward key from an already-hashed value (e.g. read back
+  // from the by-subject entry) — does NOT hash again. Kept separate from
+  // tokenKey() (which hashes a raw token) so a double-hash mistake is
+  // visible at the call site instead of silently no-op'ing a delete.
+  function forwardKeyForHash(tokenHash: string): string {
+    return `${prefixes.tokenPrefix}${tokenHash}`;
+  }
+  function subjectKey(subjectId: string): string {
+    return `${prefixes.subjectPrefix}${subjectId}`;
+  }
+  function burnKey(token: string): string {
+    return `${prefixes.burnPrefix}${hashToken(token)}`;
+  }
+
+  // Stores the pair bidirectionally and sets TTL on both keys. Idempotent —
+  // re-writing the same token/subject pair is fine. The by-subject value is
+  // the token's hash, not the token — see file header.
+  async function store(
+    redis: Redis,
+    args: { subjectId: string; token: string; ttlSeconds: number },
+  ): Promise<void> {
+    await Promise.all([
+      redis.set(tokenKey(args.token), args.subjectId, "EX", args.ttlSeconds),
+      redis.set(subjectKey(args.subjectId), hashToken(args.token), "EX", args.ttlSeconds),
+    ]);
+  }
+
+  // Lookup: subject for a token. Null when the token doesn't (or no longer)
+  // exist (expired, already consumed, or invalid).
+  async function getSubjectForToken(redis: Redis, token: string): Promise<string | null> {
+    return redis.get(tokenKey(token));
+  }
+
+  // Deletes a still-live token for this subject, if one exists — both the
+  // forward entry (built from the hash already stored in the by-subject
+  // entry, never recovers the raw token) and the by-subject entry itself.
+  // Returns whether a live token existed. Deleting the by-subject entry
+  // here too (not just the forward key) avoids leaving a dangling hash
+  // pointing at nothing if the caller crashes before the following store().
+  async function invalidateExistingBySubject(redis: Redis, subjectId: string): Promise<boolean> {
+    const existingHash = await redis.get(subjectKey(subjectId));
+    if (existingHash === null) return false;
+    await Promise.all([
+      redis.del(forwardKeyForHash(existingHash)),
+      redis.del(subjectKey(subjectId)),
+    ]);
+    return true;
+  }
+
+  // SET NX EX — atomic check-and-set. Returns "OK" when the key is new,
+  // null when it's already there.
+  async function burn(redis: Redis, token: string): Promise<"burned" | "already-used"> {
+    const result = await redis.set(burnKey(token), "1", "EX", 3600, "NX");
+    return result === "OK" ? "burned" : "already-used";
+  }
+
+  // Cleanup after a successful confirm/accept — both lookup keys. The
+  // burn-key stays (prevents a replay for the rest of the burn TTL).
+  async function deleteBoth(
+    redis: Redis,
+    args: { subjectId: string; token: string },
+  ): Promise<void> {
+    await Promise.all([redis.del(tokenKey(args.token)), redis.del(subjectKey(args.subjectId))]);
+  }
+
+  // Burn-release for a failed confirm/accept path (e.g. a DB error) so a
+  // legitimate retry isn't blocked by a stale burn marker.
+  async function unburn(redis: Redis, token: string): Promise<void> {
+    await redis.del(burnKey(token));
+  }
+
+  return { store, getSubjectForToken, invalidateExistingBySubject, burn, deleteBoth, unburn };
+}

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -141,7 +141,7 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     );
     const jobId = requestRes.jobId;
     const provider = await buildProvider(jobTenant);
-    await provider.write(`${jobTenant}/exports/${jobId}.zip`, new Uint8Array([1, 2, 3]));
+    await provider.write(`exports/${jobTenant}/${jobId}.zip`, new Uint8Array([1, 2, 3]));
 
     const result = await runExportJobs({
       db: stack.db,
@@ -164,6 +164,6 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     expect(res.status).toBe(200);
     const body = (await res.json()) as { data?: { url?: string } };
     expect(body.data?.url).toMatch(/^memory:\/\//);
-    expect(body.data?.url).toContain(`${jobTenant}/exports/${jobId}.zip`);
+    expect(body.data?.url).toContain(`exports/${jobTenant}/${jobId}.zip`);
   });
 });

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -211,7 +211,7 @@ async function seedDoneJobWithToken(): Promise<{ jobId: string; plainToken: stri
 
   // 2. seed in-memory ZIP file at path that worker would write
   const provider = await buildProvider(tenantA);
-  const storageKey = `${tenantA}/exports/${jobId}.zip`;
+  const storageKey = `exports/${tenantA}/${jobId}.zip`;
   await provider.write(storageKey, new Uint8Array([1, 2, 3]));
 
   // 3. Run worker → done-flip + Token-Create
@@ -250,7 +250,7 @@ describe("download-by-token :: happy path", () => {
     const result = body.data;
 
     expect(result.url).toMatch(/^memory:\/\//);
-    expect(result.url).toContain(`${tenantA}/exports/${jobId}.zip`);
+    expect(result.url).toContain(`exports/${tenantA}/${jobId}.zip`);
     expect(result.expiresAt).toMatch(/^\d{4}-\d{2}-\d{2}T/);
 
     // Audit-Update: useCount=1, lastUsedAt set, IP+UA persistiert

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -183,13 +183,13 @@ describe("runExportJobs :: happy path", () => {
       bytesWritten: number | null;
     }>;
     expect(row?.status).toBe(EXPORT_JOB_STATUS.Done);
-    expect(row?.downloadStorageKey).toBe(`${tenantA}/exports/${jobId}.zip`);
+    expect(row?.downloadStorageKey).toBe(`exports/${tenantA}/${jobId}.zip`);
     expect(row?.expiresAt).not.toBeNull();
     expect(row?.bytesWritten).toBeGreaterThan(0);
 
     // ZIP wirklich im Storage
     const provider = await buildProvider(tenantA);
-    expect(await provider.exists(`${tenantA}/exports/${jobId}.zip`)).toBe(true);
+    expect(await provider.exists(`exports/${tenantA}/${jobId}.zip`)).toBe(true);
   });
 
   test("ZIP ist real entpackbar via Info-ZIP + enthaelt bundle.json", async () => {
@@ -203,7 +203,7 @@ describe("runExportJobs :: happy path", () => {
     });
 
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
 
     // Real-Decoder-Roundtrip via Info-ZIP unzip
     const dir = await mkdtemp(join(tmpdir(), "kumiko-worker-test-"));
@@ -291,7 +291,7 @@ describe("runExportJobs :: stale-detection", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const twoHoursAgo = T.Instant.fromEpochMilliseconds(Date.now() - 2 * 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
 
     // Simuliert real-Pfad: claim-update hatte status=running + storageKey
     // gesetzt + ZIP geschrieben. Worker dann gecrashed (kein done-flip).
@@ -335,7 +335,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const longAgo = T.Instant.fromEpochMilliseconds(
       Date.now() - 365 * 24 * 60 * 60 * 1000, // 1 Jahr ago
     );
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([1, 2, 3]));
 
@@ -374,7 +374,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const oneHourAgo = T.Instant.fromEpochMilliseconds(Date.now() - 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([4, 5, 6]));
 
@@ -406,7 +406,7 @@ describe("runExportJobs :: storage-cleanup", () => {
     const jobId = await seedPendingJob();
     const T = getTemporal();
     const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
     const provider = await buildProvider(tenantA);
     await provider.write(storageKey, new Uint8Array([7, 8, 9]));
 
@@ -505,11 +505,11 @@ describe("runExportJobs :: concurrency", () => {
     }>;
     expect(rows).toHaveLength(1);
     expect(rows[0]?.status).toBe(EXPORT_JOB_STATUS.Done);
-    expect(rows[0]?.downloadStorageKey).toBe(`${tenantA}/exports/${jobId}.zip`);
+    expect(rows[0]?.downloadStorageKey).toBe(`exports/${tenantA}/${jobId}.zip`);
 
     // Storage hat genau ein ZIP — kein Race-induziertes Doppel-Schreiben
     const provider = await buildProvider(tenantA);
-    expect(await provider.exists(`${tenantA}/exports/${jobId}.zip`)).toBe(true);
+    expect(await provider.exists(`exports/${tenantA}/${jobId}.zip`)).toBe(true);
   });
 });
 
@@ -875,7 +875,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     // Storage-Cleanup-Pass fuer failed-Jobs: sofort ZIP loeschen (kein
     // Grace), DB-Spalte nullen.
     const jobId = await seedPendingJob();
-    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
 
     // ZIP in storage seeden + Job manuell auf failed mit storageKey
     // (simuliert orphan-state nach Worker-crash).
@@ -1050,7 +1050,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
 
     // ZIP entpacken + file-bytes verifizieren
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
     const dir = await mkdtemp(join(tmpdir(), "kumiko-3c-test-"));
     try {
       const zipPath = join(dir, "out.zip");
@@ -1155,7 +1155,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
     expect(result.completedJobIds).toContain(jobId);
 
     const provider = await buildProvider(tenantA);
-    const zipBytes = await provider.read(`${tenantA}/exports/${jobId}.zip`);
+    const zipBytes = await provider.read(`exports/${tenantA}/${jobId}.zip`);
     const dir = await mkdtemp(join(tmpdir(), "kumiko-3c-malicious-"));
     try {
       const zipPath = join(dir, "out.zip");

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.285.2",
+    "type": "fix",
+    "title": "export ZIPs write to exports/{tenantId}/{jobId}.zip, enabling one bucket-wide S3 lifecycle rule",
+    "detail": "buildExportStorageKey previously put the tenant first ({tenantId}/exports/{jobId}.zip), so no S3 prefix rule could target \"all tenants, then /exports/\" without also matching normal user uploads in the same bucket. The key now starts with the fixed exports/ segment via the new @cosmicdrift/kumiko-framework/files tenantExportPrefix() helper, tenant stays as the second segment. downloadStorageKey is stored per job and never recomputed, so existing rows keep resolving through their old key — no migration needed. tenantStoragePrefixes() (also new in framework/files) lists every prefix a tenant's binaries can live under; files-tenant-data's fileRefStorageDestroyHook now sweeps all of them on tenant-destroy instead of only {tenantId}/, closing a gap where a destroyed tenant's decrypted GDPR export bundles would have survived under the new exports/ prefix."
+  },
   {
     "version": "0.241.0",
     "type": "breaking",

package/src/user-data-rights/run-export-jobs.ts

@@ -58,6 +58,7 @@ import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createZipStream,
   type FileStorageProvider,
+  tenantExportPrefix,
   type ZipEntry,
 } from "@cosmicdrift/kumiko-framework/files";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
@@ -709,9 +710,7 @@ function systemTenantDb(db: DbConnection, tenantId: TenantId) {
 }
 
 function buildExportStorageKey(job: JobRow): string {
-  // Tenant-prefix damit der Storage-Layout pro-Tenant separat liegt.
-  // job.id ist UUID → URL-safe.
-  return `${job.requestedFromTenantId}/exports/${job.id}.zip`;
+  return `${tenantExportPrefix(job.requestedFromTenantId)}${job.id}.zip`;
 }
 
 /**