@cosmicdrift/kumiko-bundled-features 0.305.0 → 0.307.0

package/src/auth-mfa/__tests__/session-scoped-sse-revoke.integration.test.ts

@@ -0,0 +1,270 @@
+// Session-scoped SSE revocation (kumiko-framework "session-scoped-revoke").
+//
+// enable-confirm (and disable/regenerate-recovery) call
+// sessionRevokeAllOthers, which appends sessions:event:session-revoked with
+// an optional `keptSessionId` set to the caller's own sid — the ONE sid this
+// write deliberately does NOT revoke. Before this fix,
+// createAccessInvalidationEventConsumer ignored that and called
+// sseBroker.publishAccessInvalidation USERWIDE, which closed the caller's
+// own just-opened SSE stream along with every other session's — the exact
+// bug this test proves fixed: studio's live MFA-status panel never saw the
+// state flip because its own stream died with everyone else's.
+//
+// This is a KEEP-list (spare exactly keptSessionId), not a kill-list
+// (scope to the revoked sessionIds) — the first test below proves why: a
+// third session (C) that was already logged out through the real
+// /api/auth/logout endpoint BEFORE enable-confirm runs never appears in any
+// session-revoked event's sessionIds (logout revokes via the raw
+// sessionRevoker callback with no event at all). A kill-list keyed on
+// sessionIds would silently leave C's still-open stream running; the
+// keep-list closes it like every other non-kept stream, exactly as the
+// pre-scoping userwide invalidation always did.
+//
+// Real stack throughout: setupTestStack + real HTTP (createLiveDispatcher for
+// the SSE streams, stack.http for the writes), never createTestDispatcher.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { z } from "zod";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { makeSessionHelpers } from "../../sessions/__tests__/test-helpers";
+import { createSessionsFeature } from "../../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
+import { createTenantFeature } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { bindMfaRevokeAllOtherSessionsFromFeature, createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const SETUP_TOKEN_SECRET = "test-mfa-setup-token-secret-at-least-32-bytes!!";
+const TENANT = testTenantId(1);
+
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  chunkGates.set(gateId, { promise, release });
+  return release;
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
+      yield { phase: "open" as const };
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
+      yield { phase: "survived" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(authJwt: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const cookieHeader = `kumiko_auth=${authJwt}; kumiko_csrf=${csrfToken}`;
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Cookie: cookieHeader,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+async function openProbeStream(token: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(token);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      mfaFeature,
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(callbacks.get().sessionRevokeAllOthers);
+
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  chunkGates.clear();
+});
+
+describe("session-scoped SSE revoke (enable-confirm keeps the caller's own stream open)", () => {
+  test("enable-confirm from session A keeps A's stream alive, closes B's, and also closes C's even though C was already logged out through the eventless /api/auth/logout path", async () => {
+    await h.seedUser("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionC = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+    const streamC = await openProbeStream(sessionC.token);
+
+    // C logs out through the REAL endpoint — sessionRevoker (session-
+    // callbacks.ts) revokes the row directly, no session-revoked event at
+    // all. C's sid therefore never appears in any later event's sessionIds.
+    const logoutRes = await h.authedPost("/api/auth/logout", sessionC.token);
+    expect(logoutRes.status).toBe(200);
+
+    const start = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableStart,
+      payload: { accountLabel: "mfa-scope-a@example.com" },
+    });
+    expect(start.status).toBe(200);
+    const startBody = (await start.json()) as {
+      data: { setupToken: string; otpauthUri: string };
+    };
+    const secretParam =
+      new URLSearchParams(startBody.data.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+
+    const confirm = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableConfirm,
+      payload: { setupToken: startBody.data.setupToken, code: currentTotpCode(secret) },
+    });
+    expect(confirm.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    // Assert B and C first, without releasing A's gate: their rejections are
+    // proof the publish already reached every listener (they fire from the
+    // same publish loop), so a still-pending A cannot pass "by being slow".
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamC.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    streamA.release();
+    const survivedChunk = await streamA.iter.next();
+    expect(survivedChunk.done).toBe(false);
+    expect(survivedChunk.value).toEqual({ phase: "survived" });
+  });
+
+  test("an invalidation reason with no keptSessionId (role change) still closes every session's stream, unscoped", async () => {
+    const { userId } = await h.seedUser("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    await expect(streamA.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+  });
+});

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -63,7 +63,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       setupToken: z.string().min(1),
       code: z.string().length(6),
     }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/auth-mfa/handlers/verify.write.ts

@@ -45,7 +45,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
   return defineWriteHandler({
     name: "verify",
     schema: z.object({ challengeToken: z.string().min(1), code: z.string().min(6).max(9) }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -23,7 +23,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { isStreamArchived, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import { loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
   setupTestStack,
@@ -33,7 +33,6 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
 import {
-  ComplianceProfileHandlers,
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
 } from "../../compliance-profiles";
@@ -50,7 +49,6 @@ import {
 } from "../constants";
 import { billingFoundationFeature } from "../feature";
 import { paymentsProjectionTable, subscriptionsProjectionTable } from "../projection";
-import { subscriptionTenantDestroyHook } from "../tenant-destroy-hook";
 import type { PaymentEvent, SubscriptionProviderPlugin } from "../types";
 import { createSubscriptionWebhookRoute } from "../webhook-handler";
 
@@ -669,66 +667,9 @@ describe("scenario 8: cancel-event setzt status auf canceled, behält subscripti
   });
 });
 
-describe("scenario 9: subscriptionTenantDestroyHook (#800 tenant-destroy PII erasure)", () => {
-  test("default profile → row hard-deleted, stream archived", async () => {
-    const admin = adminFor(3009);
-    await stack.http.writeOk(
-      SubscriptionFoundationHandlers.processEvent,
-      buildEvent({
-        providerEventId: "evt_3009_create",
-        providerCustomerId: "cus_3009",
-        providerSubscriptionId: "sub_3009",
-      }),
-      admin,
-    );
-
-    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
-
-    const rows = await selectMany(db, subscriptionsProjectionTable, {
-      id: subscriptionAggregateId(admin.tenantId),
-    });
-    expect(rows).toHaveLength(0);
-    expect(
-      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
-    ).toBe(true);
-  });
-
-  test("HGB profile → PII redacted, accounting fields + row survive, stream archived", async () => {
-    const admin = adminFor(3010);
-    await stack.http.writeOk(
-      ComplianceProfileHandlers.setProfile,
-      { profileKey: "de-hr-dsgvo-hgb" },
-      admin,
-    );
-    await stack.http.writeOk(
-      SubscriptionFoundationHandlers.processEvent,
-      buildEvent({
-        providerEventId: "evt_3010_create",
-        providerCustomerId: "cus_3010",
-        providerSubscriptionId: "sub_3010",
-        tier: "pro",
-      }),
-      admin,
-    );
-
-    await subscriptionTenantDestroyHook({ db, tenantId: admin.tenantId });
-
-    const rows = await selectMany<{
-      providerCustomerId: string;
-      providerSubscriptionId: string;
-      tier: string;
-      status: string;
-    }>(db, subscriptionsProjectionTable, { id: subscriptionAggregateId(admin.tenantId) });
-    expect(rows).toHaveLength(1);
-    expect(rows[0]?.providerCustomerId).toBe("[erased]");
-    expect(rows[0]?.providerSubscriptionId).toBe("[erased]");
-    // accounting facts survive — that's the point of the HGB retention branch
-    expect(rows[0]?.tier).toBe("pro");
-    expect(
-      await isStreamArchived(db, admin.tenantId, subscriptionAggregateId(admin.tenantId)),
-    ).toBe(true);
-  });
-});
+// scenario 9 (subscriptionTenantDestroyHook direct-call, default+HGB branches) removed:
+// covered end-to-end by billing-foundation/__tests__/tenant-destroy.integration.test.ts,
+// which drives the real tenant-lifecycle sweep instead of hand-feeding the hook.
 
 describe("scenario 10: PII is encrypted at rest, not just erasable on destroy", () => {
   test("raw event-log payload and raw projection row both hold ciphertext, not the plaintext provider id", async () => {

package/src/billing-foundation/__tests__/tenant-destroy.integration.test.ts

@@ -0,0 +1,199 @@
+// Drives the real tenant-lifecycle destruction sweep: a direct hook call with a hand-built
+// TenantDb hides the escapeHatch grant the "app-data" stage actually resolves.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { append, isStreamArchived, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { tenantMembershipEntity } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import {
+  TENANT_AGGREGATE_TYPE,
+  TENANT_DESTRUCTION_STARTED_EVENT_QN,
+} from "../../tenant-lifecycle/constants";
+import { runTenantDestructionSweep } from "../../tenant-lifecycle/run-tenant-destroy";
+import { subscriptionAggregateId } from "../aggregate-id";
+import { SubscriptionEventTypes, SubscriptionFoundationHandlers } from "../constants";
+import { billingFoundationFeature } from "../feature";
+import { subscriptionsProjectionTable } from "../projection";
+
+const SET_PROFILE = "compliance-profiles:write:set-profile";
+
+let stack: TestStack;
+let db: DbConnection;
+
+function adminFor(tenantNumber: number) {
+  return createTestUser({
+    id: tenantNumber,
+    tenantId: testTenantId(tenantNumber),
+    roles: ["TenantAdmin", "SystemAdmin"],
+  });
+}
+
+const tenantA = adminFor(9001);
+const tenantB = adminFor(9002);
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+    ],
+  });
+  db = stack.db;
+  await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, tenantMembershipEntity);
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+beforeEach(async () => {
+  stack.events.reset();
+  await resetTestTables(db, [tenantTable, tenantComplianceProfileTable]);
+  await stack.db.unsafe?.(`TRUNCATE kumiko_events, read_subscriptions RESTART IDENTITY CASCADE`);
+});
+
+async function seedTenant(user: typeof tenantA, profileKey = "eu-dsgvo"): Promise<void> {
+  await stack.http.writeOk(
+    TenantHandlers.create,
+    { id: user.tenantId, key: `t-${user.tenantId}`, name: "Tenant" },
+    TestUsers.systemAdmin,
+  );
+  await stack.http.writeOk(SET_PROFILE, { profileKey }, user);
+}
+
+async function seedSubscription(user: typeof tenantA, eventIdSuffix: string): Promise<void> {
+  await stack.http.writeOk(
+    SubscriptionFoundationHandlers.processEvent,
+    {
+      providerEventId: `evt_${eventIdSuffix}`,
+      providerName: "stripe",
+      type: SubscriptionEventTypes.created,
+      status: "active",
+      tier: "pro",
+      providerCustomerId: `cus_${eventIdSuffix}`,
+      providerSubscriptionId: `sub_${eventIdSuffix}`,
+      currentPeriodEndIso: "2030-01-01T00:00:00Z",
+      rawPayload: "{}",
+    },
+    user,
+  );
+}
+
+async function seedDestroyingTenant(tenantId: TenantId): Promise<void> {
+  const now = getTemporal().Now.instant();
+  await updateRows(
+    db,
+    tenantTable,
+    { status: "destroying", destroyStartedAt: now },
+    { id: tenantId },
+  );
+  await append(db, {
+    aggregateId: tenantId,
+    aggregateType: TENANT_AGGREGATE_TYPE,
+    tenantId,
+    expectedVersion: (await loadAggregate(db, tenantId, tenantId)).at(-1)?.version ?? 0,
+    type: TENANT_DESTRUCTION_STARTED_EVENT_QN,
+    payload: { startedAt: now.toString() },
+    metadata: { userId: "system", requestId: "test:destruction-started" },
+  });
+}
+
+async function driveDestructionToCompletion(tenantId: TenantId): Promise<string> {
+  const farFuture = getTemporal()
+    .Now.instant()
+    .add({ hours: 24 * 3650 });
+  let status = "";
+  for (let i = 0; i < 20; i++) {
+    await runTenantDestructionSweep({ db: stack.db, registry: stack.registry, now: farFuture });
+    const rows = await selectMany(db, tenantTable, { id: tenantId });
+    status = String(rows[0]?.["status"]);
+    if (status === "destroyed" || status === "destroyFailed") break;
+  }
+  return status;
+}
+
+describe("billing-foundation :: tenant destroy (#3196)", () => {
+  test("deletes the subscription row for the destroyed tenant, archives its stream, leaves another tenant's row untouched", async () => {
+    await seedTenant(tenantA);
+    await seedTenant(tenantB);
+
+    await seedSubscription(tenantA, "a");
+    await seedSubscription(tenantB, "b");
+
+    await seedDestroyingTenant(tenantA.tenantId);
+
+    const finalStatus = await driveDestructionToCompletion(tenantA.tenantId);
+    expect(finalStatus).toBe("destroyed");
+
+    const rowsA = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(tenantA.tenantId),
+    });
+    expect(rowsA).toHaveLength(0);
+
+    const rowsB = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(tenantB.tenantId),
+    });
+    expect(rowsB).toHaveLength(1);
+
+    expect(
+      await isStreamArchived(db, tenantA.tenantId, subscriptionAggregateId(tenantA.tenantId)),
+    ).toBe(true);
+  });
+
+  test("HGB profile: redacts PII fields but keeps the row and archives its stream", async () => {
+    const tenantHgb = adminFor(9003);
+    await seedTenant(tenantHgb, "de-hr-dsgvo-hgb");
+
+    await seedSubscription(tenantHgb, "c");
+
+    await seedDestroyingTenant(tenantHgb.tenantId);
+
+    const finalStatus = await driveDestructionToCompletion(tenantHgb.tenantId);
+    expect(finalStatus).toBe("destroyed");
+
+    const rowsA = await selectMany(db, subscriptionsProjectionTable, {
+      id: subscriptionAggregateId(tenantHgb.tenantId),
+    });
+    expect(rowsA).toHaveLength(1);
+    expect(rowsA[0]?.["providerCustomerId"]).toBe("[erased]");
+    expect(rowsA[0]?.["providerSubscriptionId"]).toBe("[erased]");
+
+    expect(
+      await isStreamArchived(db, tenantHgb.tenantId, subscriptionAggregateId(tenantHgb.tenantId)),
+    ).toBe(true);
+  });
+});

package/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.306.0",
+    "type": "fix",
+    "title": "Tenant destroy no longer fails on subscription and payment rows",
+    "detail": "The subscription and payment tenant-destroy hooks passed the tenant-scoped TenantDb they receive into raw DbRunner helpers, so the app-data stage failed and the tenant ended in destroyFailed. They now use ctx.db methods and declare an escapeHatch for the compliance-profile lookup and the event-stream archive."
+  },
   {
     "version": "0.301.0",
     "type": "breaking",

package/src/billing-foundation/feature.ts

@@ -81,7 +81,12 @@ import {
   paymentsProjectionTable,
   subscriptionsProjectionTable,
 } from "./projection";
-import { paymentTenantDestroyHook, subscriptionTenantDestroyHook } from "./tenant-destroy-hook";
+import {
+  PAYMENT_TENANT_DESTROY_ARCHIVE_REASON,
+  paymentTenantDestroyHook,
+  SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON,
+  subscriptionTenantDestroyHook,
+} from "./tenant-destroy-hook";
 
 export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE, (r) => {
   r.describe(
@@ -169,8 +174,10 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
 
   r.useExtension(EXT_TENANT_DATA, "subscription", {
     destroy: subscriptionTenantDestroyHook,
+    escapeHatch: { reason: SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON },
   });
   r.useExtension(EXT_TENANT_DATA, "payment", {
     destroy: paymentTenantDestroyHook,
+    escapeHatch: { reason: PAYMENT_TENANT_DESTROY_ARCHIVE_REASON },
   });
 });