@cosmicdrift/kumiko-bundled-features 0.314.0 → 0.315.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.314.0",
+  "version": "0.315.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.314.0",
-    "@cosmicdrift/kumiko-framework": "0.314.0",
-    "@cosmicdrift/kumiko-headless": "0.314.0",
-    "@cosmicdrift/kumiko-renderer": "0.314.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.314.0",
-    "@cosmicdrift/kumiko-types": "0.314.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.315.0",
+    "@cosmicdrift/kumiko-framework": "0.315.0",
+    "@cosmicdrift/kumiko-headless": "0.315.0",
+    "@cosmicdrift/kumiko-renderer": "0.315.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.315.0",
+    "@cosmicdrift/kumiko-types": "0.315.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.314.0",
-    "@cosmicdrift/kumiko-locale-es": "0.314.0",
+    "@cosmicdrift/kumiko-locale-de": "0.315.0",
+    "@cosmicdrift/kumiko-locale-es": "0.315.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/compliance-profiles/resolve-for-tenant.ts

@@ -14,22 +14,32 @@ import {
   type EffectiveComplianceProfile,
   resolveComplianceProfile,
 } from "@cosmicdrift/kumiko-framework/compliance";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { isTenantDb } from "../shared";
 import { parseComplianceProfileOverride } from "./_internal/parse-override";
 import { tenantComplianceProfileTable } from "./schema/profile-selection";
 
 export interface ResolveProfileForTenantArgs {
-  readonly db: DbRunner;
+  // data-retention's resolveTenantRetentionPreset forwards this via
+  // resolveRetentionPolicyForTenant, whose own `db` is DbRunner | TenantDb
+  // (bulk cron vs. per-hook TenantDb). This lookup is a plain tenant-scoped
+  // read either way.
+  readonly db: DbRunner | TenantDb;
   readonly tenantId: TenantId;
 }
 
 export async function resolveProfileForTenant(
   args: ResolveProfileForTenantArgs,
 ): Promise<EffectiveComplianceProfile> {
-  const row = (await fetchOne(args.db, tenantComplianceProfileTable, {
-    tenantId: args.tenantId,
-  })) as { profileKey: string; override: string | null } | null; // @cast-boundary db-runner
+  const row = isTenantDb(args.db)
+    ? ((await args.db.fetchOne<{ profileKey: string; override: string | null }>(
+        tenantComplianceProfileTable,
+        { tenantId: args.tenantId },
+      )) ?? null)
+    : ((await fetchOne(args.db, tenantComplianceProfileTable, {
+        tenantId: args.tenantId,
+      })) as { profileKey: string; override: string | null } | null); // @cast-boundary db-runner
 
   if (!row) {
     return resolveComplianceProfile({});

package/src/data-retention/__tests__/retention-cleanup-files.integration.test.ts

@@ -249,7 +249,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
       files: filesCtx(),
     });
@@ -289,7 +289,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
       files: filesCtx(),
     });
@@ -324,7 +324,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
       files: filesCtx(failingProvider),
     });
@@ -339,7 +339,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
       files: filesCtx(),
     });
@@ -365,7 +365,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -405,7 +405,7 @@ describe("runRetentionCleanup :: hardDelete purges file bytes + derivatives + fi
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
       files: filesCtx(),
     });

package/src/data-retention/__tests__/retention-cleanup-kms.integration.test.ts

@@ -133,7 +133,7 @@ describe("runRetentionCleanup :: hardDelete crypto-shredding (Refs #2057)", () =
       db: stack.db,
       registry: stack.registry,
       tenantId,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -206,7 +206,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -223,7 +223,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -240,7 +240,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -254,7 +254,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -301,7 +301,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -326,7 +326,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 
@@ -351,7 +351,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
     expect(first.anonymized).toBe(1);
@@ -364,7 +364,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
     expect(second.anonymized).toBe(0);
@@ -388,7 +388,7 @@ describe("runRetentionCleanup :: real postgres", () => {
         db: stack.db,
         registry: stack.registry,
         tenantId: T1,
-        tenantPreset: null,
+        preloadedTenantPreset: null,
         now,
         batchLimit: 1,
       });
@@ -412,7 +412,7 @@ describe("runRetentionCleanup :: real postgres", () => {
       db: stack.db,
       registry: stack.registry,
       tenantId: T1,
-      tenantPreset: null,
+      preloadedTenantPreset: null,
       now,
     });
 

package/src/data-retention/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.315.0",
+    "type": "breaking",
+    "title": "forget/policy-for now honor the tenant retention preset",
+    "migration": "ResolveForTenantArgs.tenantPreset was renamed to preloadedTenantPreset (mirrors preloadedOverride): omitting it now makes the resolver load the tenant's retention preset itself instead of skipping it. Behavior change: forget (Art. 17) and the policy-for query now honor the tenant's compliance-profile-derived retention preset, not just entity defaults and per-tenant overrides. For tenants with a mapped compliance profile (e.g. de-hr-dsgvo-hgb), forget now keeps invoice/booking/contract rows via blockDelete and anonymizes order rows instead of hard-deleting them; notes-history mentions on such hosts are no longer shredded when the mentioned note's host entity is preset-protected. policy-for (data-retention:query:policy-for) now returns source: \"preset\" where it previously returned \"none\" for these entities."
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/data-retention/feature.ts

@@ -107,7 +107,7 @@ export function createDataRetentionFeature(): FeatureDefinition {
           db: cleanupDb,
           registry: ctx.registry,
           tenantId,
-          tenantPreset,
+          preloadedTenantPreset: tenantPreset,
           now: T.Now.instant(),
           files: ctx.files,
         });

package/src/data-retention/handlers/policy-for.query.ts

@@ -1,9 +1,7 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
-import { type EffectiveRetentionPolicy, resolveRetentionPolicy } from "../resolver";
-import { tenantRetentionOverrideTable } from "../schema/tenant-retention-override";
+import { resolveRetentionPolicyForTenant } from "../resolve-for-tenant";
+import type { EffectiveRetentionPolicy } from "../resolver";
 
 // retention:query:policy-for — Cross-Feature-API fuer den Forget-Flow.
 //
@@ -11,9 +9,9 @@ import { tenantRetentionOverrideTable } from "../schema/tenant-retention-overrid
 // Forget mit "delete" oder "anonymize" oder "blockDelete-bis-Frist"
 // laufen soll. Plus Cleanup-Job-Sprint-2.D2b fuer das gleiche.
 //
-// Tenant-Preset-Storage existiert noch nicht (kommt mit S2.D2b ueber
-// einen tenant-config-key). Bis dahin tenantPreset=null — der Resolver
-// liefert dann nur die Entity-Default-Layer + Override.
+// Delegates to resolveRetentionPolicyForTenant so forget, the cleanup cron and
+// this query can never disagree about the tenant preset. Letting the resolver
+// load the preset itself costs one read per call, fine for a single lookup.
 //
 // access: openToAll — andere Features im selben Tenant duerfen das
 // abrufen. Keine PII im Result, nur Policy-Metadata.
@@ -33,31 +31,16 @@ export const policyForQuery = defineQueryHandler({
   description:
     "Resolves the effective retention policy for one entity name in the caller's tenant (keep-for duration plus delete or anonymize strategy) by layering the entity default, tenant preset and tenant override, so a forget flow or cleanup job knows how that data may be removed.",
   handler: async (query, ctx): Promise<EffectiveRetentionPolicy> => {
-    const entityName = query.payload.entityName;
-
-    // Layer 3: Tenant-Override aus DB laden (UNIQUE(tenantId, entityName))
-    const overrideRow = (await fetchOne(ctx.db, tenantRetentionOverrideTable, {
+    if (!ctx.registry) {
+      throw new Error(
+        "data-retention:policy-for: ctx.registry required (HandlerContext incomplete)",
+      );
+    }
+    return resolveRetentionPolicyForTenant({
+      db: ctx.db,
+      registry: ctx.registry,
       tenantId: query.user.tenantId,
-      entityName,
-    })) as { config: string | null } | null; // @cast-boundary db-runner
-
-    const tenantOverride = parseRetentionOverrideOrNull(
-      overrideRow?.config ?? null,
-      query.user.tenantId,
-      "data-retention:policy-for",
-    );
-
-    // Layer 1: Entity-Default aus Registry
-    const entityDef = ctx.registry?.getEntity(entityName) ?? null;
-
-    // Layer 2: Tenant-Preset — Storage kommt mit S2.D2b. Bis dahin null.
-    const tenantPreset = null;
-
-    return resolveRetentionPolicy({
-      entityName,
-      entityDef,
-      tenantPreset,
-      tenantOverride,
+      entityName: query.payload.entityName,
     });
   },
 });

package/src/data-retention/index.ts

@@ -2,6 +2,7 @@ export type {
   EffectiveRetentionPolicy,
   ResolveForTenantArgs,
   ResolveRetentionPolicyArgs,
+  ResolveTenantPresetArgs,
   RetentionOverride,
   RetentionPreset,
   RetentionPresetKey,
@@ -11,6 +12,7 @@ export {
   RETENTION_PRESETS,
   resolveRetentionPolicy,
   resolveRetentionPolicyForTenant,
+  resolveTenantRetentionPreset,
   retentionOverrideSchema,
   SELECTABLE_RETENTION_PRESETS,
   tenantRetentionOverrideEntity,

package/src/data-retention/resolve-for-tenant.ts

@@ -1,23 +1,17 @@
-// Direkter Resolver-Helper fuer Bulk-Iteration (S2.U5b Cleanup-Runner).
-//
-// `policy-for` Query (handlers/policy-for.query.ts) ist die Cross-Feature-
-// API fuer einzelne Lookups. Der Cleanup-Runner iteriert N Entities × M
-// Tenants — Handler-Roundtrip pro Lookup waere zu teuer + braucht einen
-// HandlerContext. Beide Pfade nutzen denselben `parseRetentionOverrideOrNull`
-// + `resolveRetentionPolicy`, also kein Drift-Risiko.
+// Single implementation of the three-layer policy resolution: the cleanup cron,
+// the forget runner and the `policy-for` query all go through here, so a caller
+// cannot skip a layer (e.g. the tenant preset) by accident.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { isTenantDb } from "../shared";
 import { parseRetentionOverrideOrNull } from "./_internal/parse-override";
 import type { RetentionPresetKey } from "./presets";
+import { resolveTenantRetentionPreset } from "./resolve-tenant-preset";
 import { type EffectiveRetentionPolicy, resolveRetentionPolicy } from "./resolver";
 import { tenantRetentionOverrideTable } from "./schema/tenant-retention-override";
 
-function isTenantDb(db: DbRunner | TenantDb): db is TenantDb {
-  return typeof (db as Partial<TenantDb>).unsafeRaw === "function";
-}
-
 export interface ResolveForTenantArgs {
   // fw#2914 — a EXT_USER_DATA hook's ctx.db is a TenantDb (method-form);
   // the cleanup cron's own db is still a raw DbRunner. Both are valid here —
@@ -27,12 +21,17 @@ export interface ResolveForTenantArgs {
   readonly tenantId: TenantId;
   readonly entityName: string;
   /**
-   * Layer 2 — Tenant-Preset, vom Caller aufgeloest (retention-cleanup-Cron
-   * leitet ihn aus dem Compliance-Profile ab, siehe resolve-tenant-preset.ts).
-   * null = kein Preset, Resolver faellt auf Entity-Default (Layer 1) +
-   * Tenant-Override (Layer 3) zurueck.
+   * Layer 2 — Tenant-Preset. `undefined` (the default) means this resolver
+   * derives it itself via resolveTenantRetentionPreset — one compliance-
+   * profile read per call, fine for single-lookup callers (`policy-for`, a
+   * per-hook TenantDb caller like notes-history-user-data). A bulk caller
+   * iterating N entities × M tenants (the forget-cleanup runner, the
+   * retention-cleanup cron) MUST resolve it ONCE per tenant and pass it in
+   * here instead, or it re-derives per entity. `null` means "resolved
+   * already, no preset applies" — the resolver falls back to Entity-Default
+   * (Layer 1) + Tenant-Override (Layer 3).
    */
-  readonly tenantPreset?: RetentionPresetKey | null;
+  readonly preloadedTenantPreset?: RetentionPresetKey | null;
   /**
    * Pre-fetched override row for this (tenantId, entityName) pair — lets a
    * bulk caller (the cleanup cron, N entities × M tenants) read every
@@ -68,10 +67,19 @@ export async function resolveRetentionPolicyForTenant(
 
   const entityDef = args.registry.getEntity(args.entityName) ?? null;
 
+  const tenantPreset =
+    args.preloadedTenantPreset !== undefined
+      ? args.preloadedTenantPreset
+      : await resolveTenantRetentionPreset({
+          db: args.db,
+          registry: args.registry,
+          tenantId: args.tenantId,
+        });
+
   return resolveRetentionPolicy({
     entityName: args.entityName,
     entityDef,
-    tenantPreset: args.tenantPreset ?? null,
+    tenantPreset,
     tenantOverride,
   });
 }

package/src/data-retention/resolve-tenant-preset.ts

@@ -12,7 +12,7 @@
 // sogar namensgleich. minimal-no-region → "default" (No-Op-Preset).
 
 import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/compliance";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveProfileForTenant } from "../compliance-profiles";
 import type { RetentionPresetKey } from "./presets";
@@ -29,7 +29,10 @@ const PROFILE_TO_PRESET: Readonly<Record<ComplianceProfileKey, RetentionPresetKe
 } satisfies Readonly<Record<ComplianceProfileKey, RetentionPresetKey>>;
 
 export interface ResolveTenantPresetArgs {
-  readonly db: DbRunner;
+  // resolveRetentionPolicyForTenant calls this itself when its own
+  // caller omits preloadedTenantPreset. Its `db` is DbRunner | TenantDb (bulk
+  // cron vs. per-hook TenantDb), so this must accept both too.
+  readonly db: DbRunner | TenantDb;
   readonly registry: Registry;
   readonly tenantId: TenantId;
 }

package/src/data-retention/run-retention-cleanup.ts

@@ -95,8 +95,9 @@ export interface RunRetentionCleanupArgs {
   readonly db: DbRunner;
   readonly registry: Registry;
   readonly tenantId: TenantId;
-  /** Layer-2 Preset (aus resolveTenantRetentionPreset). null = nur Layer 1/3. */
-  readonly tenantPreset: RetentionPresetKey | null;
+  /** Layer-2 preset from resolveTenantRetentionPreset, resolved once per tenant
+   *  by the caller rather than per entity here. null = layers 1 and 3 only. */
+  readonly preloadedTenantPreset: RetentionPresetKey | null;
   /** Now-Injection — Tests pinnen den Wert ohne Date-Mock (Pattern keep-for.ts). */
   readonly now: Instant;
   readonly batchLimit?: number;
@@ -587,7 +588,7 @@ async function anonymizeMatchingRows(
 export async function runRetentionCleanup(
   args: RunRetentionCleanupArgs,
 ): Promise<RunRetentionCleanupResult> {
-  const { db, registry, tenantId, tenantPreset, now } = args;
+  const { db, registry, tenantId, preloadedTenantPreset, now } = args;
   const batchLimit = args.batchLimit ?? DEFAULT_BATCH_LIMIT;
   const kms = args.kms ?? configuredPiiSubjectKms();
 
@@ -628,7 +629,7 @@ export async function runRetentionCleanup(
       registry,
       tenantId,
       entityName,
-      tenantPreset,
+      preloadedTenantPreset,
       preloadedOverride: overrideByEntity.get(entityName) ?? null,
     });
     const policy = resolved.policy;