@cosmicdrift/kumiko-bundled-features 0.286.0 → 0.288.0

package/src/shared/row-bound-grant.test.ts

@@ -0,0 +1,294 @@
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { redeemRowBoundGrant, signRowBoundGrant } from "./row-bound-grant";
+
+const SECRET = "test-secret-value";
+const PURPOSE = "waitlist-enrich";
+const SUBJECT = "row-42";
+const NOW = Temporal.Instant.fromEpochMilliseconds(1_700_000_000_000);
+
+function grantFor(anchor: string, ttlMinutes = 30): string {
+  return signRowBoundGrant({
+    subject: SUBJECT,
+    purpose: PURPOSE,
+    anchor,
+    ttlMinutes,
+    secret: SECRET,
+    now: NOW,
+  }).token;
+}
+
+function anchorIs(anchor: string | null): (subject: string) => Promise<string | null> {
+  return async () => anchor;
+}
+
+const SKIP_COMMIT = { unsafeSkip: { reason: "test covers verification only" } } as const;
+
+// Stands in for a conditional UPDATE ... WHERE anchor = expected: the first
+// caller to spend the live anchor wins, everyone after it gets false.
+function spendableAnchor(initial: string) {
+  let current: string | null = initial;
+  return {
+    load: async () => current,
+    commit: async (_subject: string, expected: string) => {
+      if (current !== expected) return false;
+      current = null;
+      return true;
+    },
+  };
+}
+
+describe("redeemRowBoundGrant", () => {
+  test("accepts a grant whose row still carries the anchor it was minted for", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.ok && result.subject).toBe(SUBJECT);
+  });
+
+  test("passes the token's subject to loadAnchor so the row is looked up by it", async () => {
+    const seen: string[] = [];
+
+    await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: async (subject) => {
+        seen.push(subject);
+        return "pending";
+      },
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(seen).toEqual([SUBJECT]);
+  });
+
+  test("rejects a replayed grant once the row moved on to another anchor", async () => {
+    const token = grantFor("pending");
+
+    const first = await redeemRowBoundGrant({
+      token,
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+    const replayed = await redeemRowBoundGrant({
+      token,
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("enriched"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(first.ok).toBe(true);
+    expect(replayed.ok).toBe(false);
+  });
+
+  test("rejects when the row has no anchor at all", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs(null),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects instead of surfacing a throwing row lookup", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: async () => {
+        throw new Error("invalid input syntax for type uuid");
+      },
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects an expired grant", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending", 30),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW.add({ minutes: 31 }),
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects a grant redeemed against a different purpose", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: "waitlist-delete",
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects a tampered signature", async () => {
+    const [subject, expiresAt] = grantFor("pending").split(".");
+
+    const result = await redeemRowBoundGrant({
+      token: `${subject}.${expiresAt}.YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY`,
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects a grant minted with a different secret", async () => {
+    const foreign = signRowBoundGrant({
+      subject: SUBJECT,
+      purpose: PURPOSE,
+      anchor: "pending",
+      ttlMinutes: 30,
+      secret: "someone-elses-secret",
+      now: NOW,
+    }).token;
+
+    const result = await redeemRowBoundGrant({
+      token: foreign,
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+
+  test("rejects without touching the row when no secret is configured", async () => {
+    let looked = false;
+
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: undefined,
+      loadAnchor: async () => {
+        looked = true;
+        return "pending";
+      },
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+    expect(looked).toBe(false);
+  });
+
+  test("rejects a malformed token without touching the row", async () => {
+    let looked = false;
+
+    const result = await redeemRowBoundGrant({
+      token: "not-a-token",
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: async () => {
+        looked = true;
+        return "pending";
+      },
+      commitAnchor: SKIP_COMMIT,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+    expect(looked).toBe(false);
+  });
+
+  test("only one of two simultaneous redemptions of the same grant wins", async () => {
+    const row = spendableAnchor("pending");
+    const token = grantFor("pending");
+    const redeem = () =>
+      redeemRowBoundGrant({
+        token,
+        purpose: PURPOSE,
+        secret: SECRET,
+        loadAnchor: row.load,
+        commitAnchor: row.commit,
+        now: NOW,
+      });
+
+    const [first, second] = await Promise.all([redeem(), redeem()]);
+
+    expect([first.ok, second.ok].filter(Boolean)).toHaveLength(1);
+  });
+
+  test("does not spend the anchor for a token that fails verification", async () => {
+    const row = spendableAnchor("pending");
+
+    const rejected = await redeemRowBoundGrant({
+      token: grantFor("some-other-anchor"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: row.load,
+      commitAnchor: row.commit,
+      now: NOW,
+    });
+    const legitimate = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: row.load,
+      commitAnchor: row.commit,
+      now: NOW,
+    });
+
+    expect(rejected.ok).toBe(false);
+    expect(legitimate.ok).toBe(true);
+  });
+
+  test("refuses an unsafeSkip without a reason", async () => {
+    const redeem = redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: { unsafeSkip: { reason: "  " } },
+      now: NOW,
+    });
+
+    expect(redeem).rejects.toThrow(/non-empty reason/);
+  });
+
+  test("rejects when the anchor can no longer be spent", async () => {
+    const result = await redeemRowBoundGrant({
+      token: grantFor("pending"),
+      purpose: PURPOSE,
+      secret: SECRET,
+      loadAnchor: anchorIs("pending"),
+      commitAnchor: async () => false,
+      now: NOW,
+    });
+
+    expect(result.ok).toBe(false);
+  });
+});

package/src/shared/row-bound-grant.ts

@@ -0,0 +1,115 @@
+// A short-lived grant that lets a caller without a session perform exactly
+// one named operation on exactly one row — the shape behind
+// user-data-rights' confirm-deletion-by-token and any "you just created this
+// row, now enrich it" flow.
+//
+// The row's own anchor (a value that moves on when the row is consumed: a
+// request id, a status, a version) is mixed INTO the HMAC purpose rather
+// than carried in the token. Verification recomputes it from the row's
+// CURRENT anchor, so a replayed token dies the moment the row moves on —
+// single-use semantics without a burn key or Redis. Minting and redeeming
+// share one purpose-building function so the two can't drift apart; that
+// coupling is the whole point of this module, since an unanchored purpose
+// silently degrades to a bearer token valid for the full TTL.
+//
+// Anchoring alone closes the replay window only AFTER the row has moved on.
+// Two requests redeeming the same grant simultaneously both read the live
+// anchor and both verify, so spending it is a separate, mandatory step:
+// `commitAnchor` must move the row on atomically (a conditional update on
+// the anchor) and report whether this caller was the one who did. Skipping
+// it is possible but has to be declared with a reason, the way the framework
+// handles escapeHatch — an undeclared skip is how a single-use grant quietly
+// becomes a bearer token for the length of its TTL. Put the actual write into
+// the same statement that spends the anchor: a write issued after `ok: true`
+// can lose its work to a crash while the grant is already burned.
+//
+// The subject is NOT secret: signToken puts it in the token body in the
+// clear. A grant on a row therefore exposes that row's id to whoever holds
+// the link. Where the id itself must stay hidden, use an opaque handle
+// (single-use-token-store) instead.
+
+import type { Temporal } from "temporal-polyfill";
+import { peekTokenSubject, signToken, verifyToken } from "./signed-token";
+
+export type RowBoundGrantResult =
+  | { readonly ok: true; readonly subject: string; readonly expiresAtMs: number }
+  | { readonly ok: false };
+
+// Atomically spends the anchor: must return true only for the single caller
+// that moved the row on from `expectedAnchor`, false for everyone else. A
+// plain "read, check, then write" is not enough — two requests redeeming the
+// same grant at once both read the live anchor and both pass.
+export type AnchorCommit =
+  | ((subject: string, expectedAnchor: string) => Promise<boolean>)
+  | { readonly unsafeSkip: { readonly reason: string } };
+
+const FAILED: RowBoundGrantResult = { ok: false };
+
+function anchoredPurpose(purpose: string, anchor: string): string {
+  return `${purpose}:${anchor}`;
+}
+
+export function signRowBoundGrant(args: {
+  readonly subject: string;
+  readonly purpose: string;
+  readonly anchor: string;
+  readonly ttlMinutes: number;
+  readonly secret: string;
+  readonly now?: Temporal.Instant;
+}): { readonly token: string; readonly expiresAt: Temporal.Instant } {
+  return signToken(
+    args.subject,
+    anchoredPurpose(args.purpose, args.anchor),
+    args.ttlMinutes,
+    args.secret,
+    args.now,
+  );
+}
+
+// Every rejection returns the same bare `{ ok: false }` — no reason, by
+// design. A caller that could tell "bad signature" from "no such row" would
+// hand an attacker a row-existence oracle on an endpoint that is open to
+// anonymous callers.
+export async function redeemRowBoundGrant(args: {
+  readonly token: string;
+  readonly purpose: string;
+  readonly secret: string | undefined;
+  readonly loadAnchor: (subject: string) => Promise<string | null>;
+  readonly commitAnchor: AnchorCommit;
+  readonly now?: Temporal.Instant;
+}): Promise<RowBoundGrantResult> {
+  if (!args.secret) return FAILED;
+
+  const subject = peekTokenSubject(args.token);
+  if (!subject) return FAILED;
+
+  // The subject is unverified attacker input at this point, so a lookup that
+  // throws on it (e.g. a non-uuid value against a uuid column) must not
+  // surface as a 500.
+  let anchor: string | null;
+  try {
+    anchor = await args.loadAnchor(subject);
+  } catch {
+    return FAILED;
+  }
+  if (!anchor) return FAILED;
+
+  const verified = verifyToken(
+    args.token,
+    anchoredPurpose(args.purpose, anchor),
+    args.secret,
+    args.now,
+  );
+  if (!verified.ok) return FAILED;
+
+  // Spending happens after verification, never before: a caller that burned
+  // the anchor on an unverified token could invalidate any row it can name.
+  if (typeof args.commitAnchor === "function") {
+    const spent = await args.commitAnchor(subject, anchor);
+    if (!spent) return FAILED;
+  } else if (!args.commitAnchor.unsafeSkip.reason.trim()) {
+    throw new Error("row-bound grant: unsafeSkip needs a non-empty reason");
+  }
+
+  return { ok: true, subject, expiresAtMs: verified.expiresAtMs };
+}

package/src/{auth-email-password/__tests__ → shared}/signed-token.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { Temporal } from "temporal-polyfill";
-import { signToken, TokenPurpose, verifyToken } from "../signed-token";
+import { signToken, TokenPurpose, verifyToken } from "./signed-token";
 
 const SECRET = "test-hmac-secret-32-bytes-minimum!!";
 const USER_ID = "11111111-1111-4111-8111-111111111111";

package/src/shared/signed-token.ts

@@ -0,0 +1,101 @@
+// HMAC-signed single-purpose tokens for out-of-band auth flows
+// (password-reset, email-verification, future: magic-link).
+//
+// Format: <userId>.<expiresAtMs>.<hmac-base64url>
+//
+// The `purpose` is mixed INTO the HMAC input so a token minted for one
+// purpose (e.g. password-reset) can't be replayed against an endpoint that
+// expects another (e.g. verify-email), even if the caller knows the
+// userId and a valid expiry. Purpose is NOT carried in the token body —
+// verify() takes the purpose as argument and recomputes.
+//
+// Timing-safe comparison on verify so a valid-length forgery can't leak
+// signal through a short-circuit.
+
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { Temporal } from "temporal-polyfill";
+
+export type VerifyResult =
+  | { readonly ok: true; readonly userId: string; readonly expiresAtMs: number }
+  | { readonly ok: false; readonly reason: "malformed" | "bad_signature" | "expired" };
+
+function sign(input: string, secret: string): string {
+  return createHmac("sha256", secret).update(input).digest("base64url");
+}
+
+function payload(purpose: string, userId: string, expiresAtMs: number): string {
+  return `${purpose}:${userId}.${expiresAtMs}`;
+}
+
+export function signToken(
+  userId: string,
+  purpose: string,
+  ttlMinutes: number,
+  secret: string,
+  now: Temporal.Instant = Temporal.Now.instant(),
+): { token: string; expiresAt: Temporal.Instant } {
+  const expiresAt = now.add({ minutes: ttlMinutes });
+  const expiresAtMs = expiresAt.epochMilliseconds;
+  const signature = sign(payload(purpose, userId, expiresAtMs), secret);
+  return {
+    token: `${userId}.${expiresAtMs}.${signature}`,
+    expiresAt,
+  };
+}
+
+// Reads the subject out of the token body WITHOUT checking the HMAC. Only
+// safe as a lookup key for something that is itself an input to the
+// verification below — the signature stays the gate. Mirrors verifyToken's
+// structural checks, which is why it lives next to it: a token this rejects
+// must never reach a DB lookup.
+export function peekTokenSubject(token: string): string | null {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [subject, expiresAtRaw, sig] = parts;
+  if (!subject || !expiresAtRaw || !sig) return null;
+  const expiresAtMs = Number(expiresAtRaw);
+  if (!Number.isFinite(expiresAtMs) || String(expiresAtMs) !== expiresAtRaw) return null;
+  return subject;
+}
+
+export function verifyToken(
+  token: string,
+  purpose: string,
+  secret: string,
+  now: Temporal.Instant = Temporal.Now.instant(),
+): VerifyResult {
+  const parts = token.split(".");
+  if (parts.length !== 3) return { ok: false, reason: "malformed" };
+  const [userId, expiresAtRaw, providedSig] = parts;
+  if (!userId || !expiresAtRaw || !providedSig) return { ok: false, reason: "malformed" };
+
+  const expiresAtMs = Number(expiresAtRaw);
+  if (!Number.isFinite(expiresAtMs) || String(expiresAtMs) !== expiresAtRaw) {
+    return { ok: false, reason: "malformed" };
+  }
+
+  const expected = sign(payload(purpose, userId, expiresAtMs), secret);
+  const expectedBuf = Buffer.from(expected, "base64url");
+  const providedBuf = Buffer.from(providedSig, "base64url");
+  // Length mismatch fails BEFORE timingSafeEqual, which throws on different
+  // lengths — but that throw itself leaks via timing. Explicit length check
+  // keeps the path uniform.
+  if (expectedBuf.length !== providedBuf.length) return { ok: false, reason: "bad_signature" };
+  if (!timingSafeEqual(expectedBuf, providedBuf)) return { ok: false, reason: "bad_signature" };
+
+  if (Temporal.Instant.compare(now, Temporal.Instant.fromEpochMilliseconds(expiresAtMs)) > 0) {
+    return { ok: false, reason: "expired" };
+  }
+
+  // expiresAtMs surfaces so callers (burn-store TTL, telemetry, …) don't
+  // have to re-parse the token themselves.
+  return { ok: true, userId, expiresAtMs };
+}
+
+// Canonical purposes baked into the framework. Features that introduce new
+// flows extend this set (or just pass an inline string).
+export const TokenPurpose = {
+  passwordReset: "reset",
+  emailVerification: "verify",
+  accountUnlock: "unlock",
+} as const;

package/src/tenant/seeding.ts

@@ -234,6 +234,10 @@ export async function seedTenant(
     tdb,
   );
   if (!result.isSuccess) {
+    // Same idempotency case as the stream-version check above, only detected
+    // one instruction later: a dispatcher cycle appended to the stream between
+    // that read and this create. Both paths return without firing postSave.
+    if (result.error.code === "version_conflict") return { id: options.id };
     throw new Error(
       `seedTenant failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );

package/src/user-data-rights/__tests__/deletion-token-compat.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
+import { signToken } from "../../shared";
+import { redeemDeletionToken, signDeletionToken } from "../deletion-token";
+
+const SECRET = "deletion-token-compat-secret";
+const USER_ID = "user-7";
+const REQUEST_ID = "req-99";
+const NOW = Temporal.Instant.fromEpochMilliseconds(1_700_000_000_000);
+
+// Deletion tokens sit in mails that are already out. Moving the minting onto
+// shared/row-bound-grant must not change a single byte of them, so this pins
+// the wire format against the formula the hand-rolled version used:
+// signToken(userId, `deletion-request:${requestId}`, ...).
+describe("deletion token wire format", () => {
+  test("a token minted with the pre-refactor formula still redeems", async () => {
+    const legacy = signToken(USER_ID, `deletion-request:${REQUEST_ID}`, 30, SECRET).token;
+
+    const result = await redeemDeletionToken({
+      token: legacy,
+      secret: SECRET,
+      loadPendingRequestId: async () => REQUEST_ID,
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.ok && result.subject).toBe(USER_ID);
+  });
+
+  test("minting produces exactly the pre-refactor bytes", () => {
+    const minted = signDeletionToken(USER_ID, REQUEST_ID, 30, SECRET, NOW);
+    const legacy = signToken(USER_ID, `deletion-request:${REQUEST_ID}`, 30, SECRET, NOW);
+
+    expect(minted.token).toBe(legacy.token);
+  });
+});

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -24,6 +24,7 @@ import {
   createInMemoryFileProvider,
   type FileStorageProvider,
 } from "@cosmicdrift/kumiko-framework/files";
+import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import {
   createTestUser,
   setupTestStack,
@@ -43,7 +44,7 @@ import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
-import { runExportJobs } from "../run-export-jobs";
+import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, runExportJobs } from "../run-export-jobs";
 import { exportDownloadTokenEntity, exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -133,6 +134,20 @@ function buildProvider(tenantId: string): Promise<FileStorageProvider> {
   return Promise.resolve(p);
 }
 
+// Typed fake standing in for the ctx.meter-backed MetricsHandle feature.ts
+// builds for the real cron — records `set()` calls without a Meter/registry.
+function createRecordingMetricsHandle(): MetricsHandle & { readonly values: Map<string, number> } {
+  const values = new Map<string, number>();
+  return {
+    values,
+    inc: () => {},
+    observe: () => {},
+    set: (name, value) => {
+      values.set(name, value);
+    },
+  };
+}
+
 // Seedet einen pending Job via realen request-export-Handler — echter
 // ES-Pfad (crud.create emittiert event "export-job.created"), nicht
 // direct-INSERT. Direct-INSERT wuerde stream-version=0/row-version=1
@@ -444,6 +459,80 @@ describe("runExportJobs :: storage-cleanup", () => {
   });
 });
 
+describe("runExportJobs :: export-cleanup backlog metric", () => {
+  test("done-Job mit abgelaufener TTL + weiterhin gesetztem downloadStorageKey → Metrik > 0", async () => {
+    const jobId = await seedPendingJob();
+    const T = getTemporal();
+    const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
+    const provider = await buildProvider(tenantA);
+    await provider.write(storageKey, new Uint8Array([7, 8, 9]));
+
+    await updateRows(
+      stack.db,
+      exportJobsTable,
+      {
+        status: EXPORT_JOB_STATUS.Done,
+        startedAt: longAgo,
+        completedAt: longAgo,
+        downloadStorageKey: storageKey,
+        expiresAt: longAgo,
+      },
+      { id: jobId },
+    );
+
+    const metrics = createRecordingMetricsHandle();
+    await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: async () => ({
+        ...provider,
+        delete: async () => {
+          throw new Error("synthetic storage delete failure");
+        },
+      }),
+      now: NOW(),
+      metrics,
+    });
+
+    expect(metrics.values.get(EXPORT_CLEANUP_BACKLOG_AGE_METRIC)).toBeGreaterThan(0);
+  });
+
+  test("done-Job wird erfolgreich cleaned → Metrik ist 0", async () => {
+    const jobId = await seedPendingJob();
+    const T = getTemporal();
+    const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
+    const storageKey = `exports/${tenantA}/${jobId}.zip`;
+    const provider = await buildProvider(tenantA);
+    await provider.write(storageKey, new Uint8Array([1, 2, 3]));
+
+    await updateRows(
+      stack.db,
+      exportJobsTable,
+      {
+        status: EXPORT_JOB_STATUS.Done,
+        startedAt: longAgo,
+        completedAt: longAgo,
+        downloadStorageKey: storageKey,
+        expiresAt: longAgo,
+      },
+      { id: jobId },
+    );
+
+    const metrics = createRecordingMetricsHandle();
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      metrics,
+    });
+
+    expect(result.cleanedJobIds).toContain(jobId);
+    expect(metrics.values.get(EXPORT_CLEANUP_BACKLOG_AGE_METRIC)).toBe(0);
+  });
+});
+
 describe("runExportJobs :: idempotency", () => {
   test("zweiter Run nach done ist no-op fuer den selben Job", async () => {
     const jobId = await seedPendingJob();