@cosmicdrift/kumiko-bundled-features 0.290.0 → 0.292.0

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,21 +19,40 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
+import { resolveLoggedInHref } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
 export type InviteAcceptScreenProps = {
   readonly title?: string;
   readonly token?: string;
-  /** Where to redirect on success. Default "/" — Apps mit Multi-Tenant-
-   *  Routing können `(data) => "/${data.tenantId}/"` setzen. */
-  readonly loggedInHref?: string | ((args: { tenantId: string }) => string);
+  /** Where to redirect on success. Default "/" — multi-tenant apps can pass
+   *  `(data) => "/${data.tenantId}/"`. Function-form receives the roles this
+   *  flow grants in the target tenant; branch 1 reports the invitation's
+   *  role, which for an existing member is not their full role set there. */
+  readonly loggedInHref?:
+    | string
+    | ((args: { tenantId: string; roles: readonly string[] }) => string);
   /** Login-Href für "Mit anderem Account anmelden". Default "/login". */
   readonly loginHref?: string;
 };
 
 type Mode = "loggedin" | "anon-existing" | "anon-new";
 
+// All three accept routes answer 200 with tenantId + the invitation role;
+// the two session-minting branches additionally carry the stripped session
+// roles. An MFA challenge is also a 200 and carries none of them.
+type InviteAcceptResponse = {
+  readonly tenantId: string;
+  readonly role?: string;
+  readonly user?: { readonly roles?: readonly string[] };
+};
+
+function grantedRoles(data: InviteAcceptResponse): readonly string[] {
+  if (data.user?.roles !== undefined) return data.user.roles;
+  return data.role === undefined ? [] : [data.role];
+}
+
 export function InviteAcceptScreen({
   title,
   token: tokenProp,
@@ -70,12 +89,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));
@@ -93,12 +114,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));
@@ -116,12 +139,14 @@ export function InviteAcceptScreen({
     });
     setSubmitting(false);
     if (res.ok) {
-      const data = (await res.json()) as { tenantId: string };
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantId: data.tenantId })
-          : loggedInHref;
-      window.location.assign(target);
+      // @cast-boundary engine-payload — auth route JSON
+      const data = (await res.json()) as InviteAcceptResponse;
+      window.location.assign(
+        resolveLoggedInHref(loggedInHref, {
+          tenantId: data.tenantId,
+          roles: grantedRoles(data),
+        }),
+      );
       return;
     }
     setError(t("auth.errors.invalidInviteToken"));

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -25,8 +25,11 @@ export type SignupCompleteScreenProps = {
   readonly title?: string;
   /** Override for the URL token — server-rendered apps can pass it. Default: `?token=...`. */
   readonly token?: string;
-  /** Where to send the user after activation. Function-form receives the tenantKey. Default "/". */
-  readonly loggedInHref?: string | ((args: { tenantKey: string }) => string);
+  /** Where to send the user after activation. Function-form receives the tenantKey and the
+   *  roles granted by this flow in that tenant — for role-dependent landing targets. Default "/". */
+  readonly loggedInHref?:
+    | string
+    | ((args: { tenantKey: string; roles: readonly string[] }) => string);
   /** Href for the "already have an account?" link when the token is missing. Default "/login". */
   readonly loginHref?: string;
 };
@@ -64,7 +67,12 @@ export function SignupCompleteScreen({
       // Cookies are already set (auto-login). Show a confirmation with an
       // explicit continue button instead of navigating away silently —
       // the user otherwise gets no signal that activation worked.
-      setContinueHref(resolveLoggedInHref(loggedInHref, res.data.tenantKey));
+      setContinueHref(
+        resolveLoggedInHref(loggedInHref, {
+          tenantKey: res.data.tenantKey,
+          roles: res.data.user.roles,
+        }),
+      );
       return;
     }
     if (res.error.reason === "invalid_signup_token") {

package/src/custom-fields/__tests__/audit-integration.integration.test.ts

@@ -33,6 +33,7 @@ import { AuditQueries } from "../../audit/constants";
 import { createAuditFeature } from "../../audit/feature";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user";
 import { fieldDefinitionEntity } from "../entity";
 import { createCustomFieldsFeature } from "../feature";
 import { customFieldsField, wireCustomFieldsFor } from "../wire-for-entity";
@@ -86,6 +87,7 @@ beforeAll(async () => {
       propertyFeature,
       createConfigFeature(),
       createTenantFeature(),
+      createUserFeature(),
       createAuditFeature(),
     ],
   });

package/src/delivery/feature.ts

@@ -64,8 +64,13 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // apply-key is a registered domain-event (DELIVERY_ATTEMPT_EVENT).
     // recipientAddress is the real PII (email address); recipientId stays
     // plaintext — pseudonymous fk, same line as config.userId (#821).
+    // recipientId is nullable (system-triggered sends to non-users), so the
+    // address falls back to the tenant key instead of the plaintext it used
+    // to be — still shreddable, one tenant wide (fw#2776).
     r.defineEvent("attempt", deliveryAttemptSchema, {
-      piiFields: { recipientAddress: { personal: { of: "recipientId" } } },
+      piiFields: {
+        recipientAddress: { personal: { of: "recipientId", whenAbsent: "tenant" } },
+      },
     });
 
     // Inline projection that materialises every delivery attempt into

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -5,7 +5,15 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createTenantConfig,
+  defineFeature,
+  defineWriteHandler,
+  FILE_PROVIDER_CONFIG_KEY,
+  FILE_STORAGE_PROVIDER_BOOT_SENTINEL,
+  FILE_STORAGE_PROVIDER_ENV,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { createEnvMasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import {
@@ -25,7 +33,11 @@ import { z } from "zod";
 import { createConfigFeature } from "../../config";
 import { ConfigHandlers } from "../../config/constants";
 import { createConfigAccessorFactory } from "../../config/feature";
-import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
+import {
+  buildEnvConfigOverrides,
+  type ConfigResolver,
+  createConfigResolver,
+} from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "../../file-provider-s3";
 import { fileProviderS3EnvFeature } from "../../file-provider-s3-env";
@@ -37,15 +49,30 @@ import { createFileProviderForTenant, fileFoundationFeature } from "../feature";
 // --- Test-Handler that exercises the factory end-to-end ---
 
 const TEST_HANDLER_QN = "file-test:write:build-provider";
+const PROBE_SECRET_KEY = "file-test:config:probe-secret";
 const testProbeFeature = defineFeature("file-test", (r) => {
   r.requires("config");
   r.requires("secrets");
+  // Envelope-cipher round-trip partner: proves the resolver still decrypts
+  // once it also carries ENV-bridged app-overrides.
+  r.config({
+    keys: {
+      probeSecret: createTenantConfig("text", {
+        encrypted: true,
+        default: "",
+        read: access.roles("TenantAdmin", "SystemAdmin"),
+        write: access.roles("TenantAdmin", "SystemAdmin"),
+      }),
+    },
+  });
   r.writeHandler(
     defineWriteHandler({
       name: "build-provider",
       schema: z.object({}),
       access: { roles: ["TenantAdmin", "SystemAdmin"] },
       handler: async (event, ctx) => {
+        const readConfig = ctx.config;
+        if (!readConfig) throw new Error(`${TEST_HANDLER_QN}: ctx.config is missing`);
         const provider = await createFileProviderForTenant(
           ctx,
           event.user.tenantId,
@@ -54,6 +81,8 @@ const testProbeFeature = defineFeature("file-test", (r) => {
         return {
           isSuccess: true,
           data: {
+            selectedProvider: await readConfig(FILE_PROVIDER_CONFIG_KEY),
+            probeSecret: await readConfig(PROBE_SECRET_KEY),
             hasWrite: typeof provider.write === "function",
             hasRead: typeof provider.read === "function",
             hasDelete: typeof provider.delete === "function",
@@ -72,10 +101,10 @@ let resolver: ConfigResolver;
 let providerRef: MutableMasterKeyProvider;
 
 const testEncryptionKey = randomBytes(32).toString("base64");
+const ENV_SELECTED_PROVIDER = "s3-env";
 
 beforeAll(async () => {
   const encryption = createTestEnvelopeCipher(testEncryptionKey);
-  resolver = createConfigResolver({ cipher: encryption });
 
   const initialKp = createEnvMasterKeyProvider({
     env: {
@@ -96,12 +125,22 @@ beforeAll(async () => {
       testProbeFeature,
     ],
     masterKeyProvider: providerRef,
-    extraContext: ({ db, registry }) => ({
-      configResolver: resolver,
-      configEncryption: encryption,
-      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
-      secrets: createSecretsContext({ db, masterKeyProvider: providerRef }),
-    }),
+    extraContext: ({ db, registry }) => {
+      // No app-side resolver rebuild: the provider key declares
+      // env: FILE_STORAGE_PROVIDER, so the generic ENV bridge selects it.
+      resolver = createConfigResolver({
+        cipher: encryption,
+        appOverrides: buildEnvConfigOverrides(registry, {
+          [FILE_STORAGE_PROVIDER_ENV]: ENV_SELECTED_PROVIDER,
+        }),
+      });
+      return {
+        configResolver: resolver,
+        configEncryption: encryption,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+        secrets: createSecretsContext({ db, masterKeyProvider: providerRef }),
+      };
+    },
   });
   db = stack.db;
 
@@ -283,3 +322,87 @@ describe("scenario 4: s3-env provider (app-wide env, no secrets)", () => {
     }
   });
 });
+
+// --- Scenario 5: FILE_STORAGE_PROVIDER selects the provider, no app resolver ---
+//
+// The stack's resolver is the plain framework one — its only app-override
+// comes from buildEnvConfigOverrides reading the key's `env` declaration.
+// Before #3112 every app rebuilt createConfigResolver just to pin this key.
+
+describe("scenario 5: ENV-bridged provider selection", () => {
+  function withS3Env<T>(run: () => Promise<T>): Promise<T> {
+    const saved = S3_ENV_KEYS.map((k) => [k, process.env[k]] as const);
+    Object.assign(process.env, {
+      S3_BUCKET: "env-bridge-bucket",
+      S3_REGION: "fsn1",
+      S3_ACCESS_KEY: "AKIABRIDGE",
+      S3_SECRET_KEY: "env-secret-not-real",
+    });
+    return run().finally(() => {
+      for (const [k, v] of saved) {
+        if (v === undefined) delete process.env[k];
+        else process.env[k] = v;
+      }
+    });
+  }
+
+  test("no tenant row → FILE_STORAGE_PROVIDER wins and the factory builds that provider", async () => {
+    const admin = adminFor(506);
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["selectedProvider"]).toBe(ENV_SELECTED_PROVIDER);
+    expect(result["hasWrite"]).toBe(true);
+  });
+
+  test("tenant row still overrides the ENV value (cascade unchanged)", async () => {
+    const admin = adminFor(507);
+
+    await selectS3Provider(admin);
+    await setConfig(admin, "file-provider-s3:config:bucket", "row-bucket");
+    await setConfig(admin, "file-provider-s3:config:region", "fsn1");
+    await setConfig(admin, "file-provider-s3:config:access-key-id", "AKIAROW");
+    await stack.http.writeOk(
+      "secrets:write:set",
+      { key: S3_SECRET_ACCESS_KEY.name, value: "row-secret" },
+      admin,
+    );
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["selectedProvider"]).toBe("s3");
+  });
+
+  test("boot-gate sentinel selects no provider", async () => {
+    // What runDevApp writes into FILE_STORAGE_PROVIDER when options.files
+    // already wires a provider — it names no plugin, so the bridge must not
+    // turn it into a selection.
+    expect(
+      buildEnvConfigOverrides(stack.registry, {
+        [FILE_STORAGE_PROVIDER_ENV]: FILE_STORAGE_PROVIDER_BOOT_SENTINEL,
+      }).get(FILE_PROVIDER_CONFIG_KEY),
+    ).toBe(FILE_STORAGE_PROVIDER_BOOT_SENTINEL);
+
+    const admin = adminFor(508);
+    await setConfig(admin, FILE_PROVIDER_CONFIG_KEY, FILE_STORAGE_PROVIDER_BOOT_SENTINEL);
+
+    const error = await stack.http.writeErr(TEST_HANDLER_QN, {}, admin);
+    // The factory throw surfaces as internal_error; the original message sits
+    // in details.causeMessage.
+    expect(JSON.stringify(error)).toMatch(
+      /no provider selected — set the 'file-foundation:config:provider' config-key/,
+    );
+  });
+
+  test("encrypted config keys still round-trip through the same resolver", async () => {
+    const admin = adminFor(509);
+    await setConfig(admin, PROBE_SECRET_KEY, "cipher-round-trip");
+
+    const result = await withS3Env(
+      async () => (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<string, unknown>,
+    );
+    expect(result["probeSecret"]).toBe("cipher-round-trip");
+  });
+});

package/src/file-foundation/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.292.0",
+    "type": "improvement",
+    "title": "FILE_STORAGE_PROVIDER selects the file provider, not just the boot gate",
+    "detail": "The `provider` config key declares `env: \"FILE_STORAGE_PROVIDER\"`, so the ENV→app-override bridge selects the provider at boot without an app-side `createConfigResolver` rebuild. Tenant rows still override the ENV value (cascade unchanged). The boot-gate placeholder `\"configured\"` that `runDevApp` writes names no plugin, so `createFileProviderForTenant` treats it as unset and raises \"no provider selected\"; both strings are exported as `FILE_STORAGE_PROVIDER_ENV` / `FILE_STORAGE_PROVIDER_BOOT_SENTINEL`.",
+    "migration": "Apps on the framework's default config resolver: make sure `FILE_STORAGE_PROVIDER` holds a registered provider name (`inmemory`, `s3`, `s3-env`) — it is now the provider selection, not only a presence check. Apps that pass their own `configResolver` are unaffected and can drop their hand-rolled `file-foundation:config:provider` app-override."
+  }
+]

package/src/file-foundation/feature.ts

@@ -21,6 +21,7 @@ import {
   createTenantConfig,
   defineFeature,
   EXT_FILE_PROVIDER,
+  FILE_STORAGE_PROVIDER_ENV,
 } from "@cosmicdrift/kumiko-framework/engine";
 
 export type {
@@ -58,6 +59,7 @@ export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
     "provider",
     createTenantConfig("text", {
       default: "",
+      env: FILE_STORAGE_PROVIDER_ENV,
       write: access.roles("TenantAdmin", "SystemAdmin"),
       read: access.roles("TenantAdmin", "SystemAdmin", "User"),
     }),

package/src/jobs/__tests__/tenant-job-failures.integration.test.ts

@@ -0,0 +1,275 @@
+// Tenant-visible job failures (fw#3079) end to end: a write triggers a job,
+// the job fails, and the triggering tenant reads the failure back through
+// `jobs:query:failures` — over real HTTP, a real BullMQ worker and a real
+// Postgres, with the real createJobRunLogger callbacks wired in.
+//
+// Not setupTestStack: that helper builds a JobRunner but wires none of the
+// bundled run-logger callbacks (test-stack.ts), which are the write path
+// under test here. Same buildServer + createJobRunner + createJobRunLogger
+// harness the neighbouring jobs integration tests use.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { buildServer, type JwtHelper } from "@cosmicdrift/kumiko-framework/api";
+import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createRegistry,
+  defineFeature,
+  defineWriteHandler,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { createJobRunner, type JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
+import {
+  createTestDb,
+  createTestRedis,
+  createTestUser,
+  type TestDb,
+  type TestRedis,
+  testTenantId,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { sleep } from "@cosmicdrift/kumiko-framework/testing";
+import type { Hono } from "hono";
+import { z } from "zod";
+import { JobQueries } from "../constants";
+import { createJobsFeature } from "../feature";
+import { createJobRunLogger } from "../job-run-logger";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+import { tenantJobFailuresTable } from "../tenant-job-failure-table";
+
+const JWT_SECRET = "tenant-job-failures-integration-secret-key-0123456789";
+const DECLARED_KEY = "app:errors.generationFailed";
+const BUDGET_KEY = "app:errors.budgetExceeded";
+// A provider message that must never reach the tenant.
+const PROVIDER_MESSAGE = "openai 429: prompt 'Herr Schmidt, Kennzeichen B-XY-123' rejected";
+
+const tenantA = testTenantId(1);
+const tenantB = testTenantId(2);
+const userA = createTestUser({ id: 1, tenantId: tenantA, roles: ["Admin"] });
+const userB = createTestUser({ id: 2, tenantId: tenantB, roles: ["Admin"] });
+const systemAdmin = createTestUser({ id: 3, tenantId: tenantA, roles: ["SystemAdmin"] });
+
+const generateWrite = defineWriteHandler({
+  name: "generate",
+  description: "Test-only: starts the text generation for one campaign.",
+  schema: z.object({ campaignId: z.string(), mode: z.enum(["fail", "budget", "succeed"]) }),
+  access: { roles: ["Admin"] },
+  handler: async (event) => ({ isSuccess: true as const, data: { ...event.payload } }),
+});
+
+const retryWrite = defineWriteHandler({
+  name: "startFlaky",
+  description: "Test-only: starts a job that fails on every attempt.",
+  schema: z.object({}),
+  access: { roles: ["Admin"] },
+  handler: async () => ({ isSuccess: true as const, data: {} }),
+});
+
+const appFeature = defineFeature("app", (r) => {
+  r.writeHandler(generateWrite);
+  r.writeHandler(retryWrite);
+
+  r.job(
+    "generateTexts",
+    {
+      trigger: { on: "app:write:generate" },
+      tenantVisibleFailure: { messageKey: DECLARED_KEY, subjectFields: ["campaignId"] },
+    },
+    async (payload) => {
+      if (payload["mode"] === "budget") {
+        throw new UnprocessableError("budget_exceeded", { i18nKey: BUDGET_KEY });
+      }
+      if (payload["mode"] === "fail") throw new Error(PROVIDER_MESSAGE);
+    },
+  );
+
+  // retries: 1 — two attempts, both failing. Only the last one may record.
+  r.job(
+    "flaky",
+    {
+      trigger: { on: "app:write:start-flaky" },
+      retries: 1,
+      tenantVisibleFailure: { messageKey: DECLARED_KEY },
+    },
+    async () => {
+      throw new Error(PROVIDER_MESSAGE);
+    },
+  );
+});
+
+let testDb: TestDb;
+let testRedis: TestRedis;
+let db: DbConnection;
+let app: Hono;
+let jwt: JwtHelper;
+let jobRunner: JobRunner;
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  testRedis = await createTestRedis();
+  db = testDb.db;
+
+  const registry = createRegistry([appFeature, createJobsFeature()]);
+  await unsafePushTables(db, { jobRunsTable, jobRunLogsTable, tenantJobFailuresTable });
+  await createEventsTable(db);
+
+  const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+  jobRunner = createJobRunner({
+    registry,
+    context: { db },
+    redisUrl,
+    consumerLane: "worker",
+    queueNamePrefix: `kumiko-tenant-job-failures-${Date.now()}`,
+    ...createJobRunLogger({ db, registry }),
+  });
+
+  const server = buildServer({
+    registry,
+    context: { db, registry, jobRunner },
+    jwtSecret: JWT_SECRET,
+    // Event-triggered jobs enqueue from dispatch-write's afterCommit hooks,
+    // which read the runner off the dispatcher — not off the AppContext.
+    dispatcherOptions: { jobRunner },
+  });
+  app = server.app;
+  jwt = server.jwt;
+
+  await jobRunner.start();
+});
+
+afterAll(async () => {
+  await jobRunner.stop();
+  await testDb.cleanup();
+  await testRedis.cleanup();
+});
+
+async function post(path: string, user: SessionUser, body: unknown): Promise<Response> {
+  const token = await jwt.sign(user);
+  return app.request(path, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  });
+}
+
+type FailureRow = {
+  readonly jobName: string;
+  readonly subject: Record<string, unknown> | null;
+  readonly messageKey: string;
+};
+
+async function generate(
+  user: SessionUser,
+  campaignId: string,
+  mode: "fail" | "budget" | "succeed",
+): Promise<void> {
+  const res = await post("/api/write", user, {
+    type: "app:write:generate",
+    payload: { campaignId, mode },
+  });
+  expect((await res.json()).isSuccess).toBe(true);
+  await sleep(1500);
+}
+
+async function failures(user: SessionUser, payload: unknown = {}): Promise<FailureRow[]> {
+  const res = await post("/api/query", user, { type: JobQueries.failures, payload });
+  const body = await res.json();
+  expect(res.status, JSON.stringify(body)).toBe(200);
+  return body.data.rows;
+}
+
+describe("jobs:query:failures (fw#3079)", () => {
+  test("the triggering tenant reads its own failed job, scoped by subject", async () => {
+    await generate(userA, "campaign-1", "fail");
+    await generate(userA, "campaign-2", "budget");
+
+    const rows = await failures(userA);
+    expect(rows).toHaveLength(2);
+    const byCampaign = new Map(rows.map((row) => [row.subject?.["campaignId"], row]));
+    expect(byCampaign.get("campaign-1")?.jobName).toBe("app:job:generate-texts");
+    // Plain Error → the key declared at the job.
+    expect(byCampaign.get("campaign-1")?.messageKey).toBe(DECLARED_KEY);
+    // KumikoError → its own i18nKey wins over the declared fallback.
+    expect(byCampaign.get("campaign-2")?.messageKey).toBe(BUDGET_KEY);
+  });
+
+  test("another tenant sees none of them, and only its own", async () => {
+    expect(await failures(userB)).toHaveLength(0);
+
+    await generate(userB, "campaign-1", "fail");
+
+    const rowsB = await failures(userB);
+    expect(rowsB).toHaveLength(1);
+    expect(rowsB[0]?.subject?.["campaignId"]).toBe("campaign-1");
+    // Tenant A's two records are untouched by B's own run of the same job
+    // and the same campaign id.
+    expect(await failures(userA)).toHaveLength(2);
+  });
+
+  test("no provider message reaches the tenant", async () => {
+    const res = await post("/api/query", userA, { type: JobQueries.failures, payload: {} });
+    const raw = await res.text();
+    expect(raw).toContain(DECLARED_KEY);
+    expect(raw).not.toContain(PROVIDER_MESSAGE);
+    expect(raw).not.toContain("openai");
+  });
+
+  test("a later successful run of the same subject clears the record", async () => {
+    await generate(userA, "campaign-1", "succeed");
+
+    const rows = await failures(userA);
+    expect(rows.map((row) => row.subject?.["campaignId"])).toEqual(["campaign-2"]);
+  });
+
+  test("only the final attempt records — a retried job leaves one record", async () => {
+    const res = await post("/api/write", userB, { type: "app:write:start-flaky", payload: {} });
+    expect((await res.json()).isSuccess).toBe(true);
+    await sleep(2500);
+
+    const rows = await failures(userB, { jobName: "app:job:flaky" });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.subject).toBeNull();
+
+    // Both attempts did land as their own failed run — the single record
+    // above is the final-attempt gate, not a missing second attempt.
+    const runs = await selectMany(db, jobRunsTable, { jobName: "app:job:flaky" });
+    expect(runs).toHaveLength(2);
+  });
+
+  test("the subject filter selects one record", async () => {
+    const rows = await failures(userA, { subject: { campaignId: "campaign-2" } });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.messageKey).toBe(BUDGET_KEY);
+
+    expect(await failures(userA, { subject: { campaignId: "campaign-unknown" } })).toHaveLength(0);
+  });
+
+  test("SystemAdmin still sees every tenant's run with its provider message", async () => {
+    const res = await post("/api/query", systemAdmin, {
+      type: JobQueries.list,
+      payload: { jobName: "app:job:generate-texts", status: "failed" },
+    });
+    const raw = await res.text();
+    expect(res.status, raw).toBe(200);
+
+    // Both of tenant A's failures plus tenant B's — the tenant-visible record
+    // is an addition, it takes nothing away from the SystemAdmin view.
+    expect(JSON.parse(raw).data.rows).toHaveLength(3);
+    expect(raw).toContain(PROVIDER_MESSAGE);
+  });
+  test("a corrupt stored subject degrades to null instead of failing the list", async () => {
+    await insertOne(db, tenantJobFailuresTable, {
+      tenantId: tenantB,
+      jobName: "app:job:corrupt",
+      subject: '{"campaignId":"not-an-entry-array"}',
+      messageKey: DECLARED_KEY,
+      failedAt: Temporal.Now.instant(),
+    });
+
+    const rows = await failures(userB, { jobName: "app:job:corrupt" });
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.subject).toBeNull();
+  });
+});