@cosmicdrift/kumiko-bundled-features 0.322.0 → 0.324.0

package/src/delivery/unsubscribe.ts

@@ -10,7 +10,12 @@ import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out";
-import { DELIVERY_UNSUBSCRIBE_PATH, DeliveryHandlers } from "./constants";
+import {
+  DELIVERY_RESUBSCRIBE_PATH,
+  DELIVERY_UNSUBSCRIBE_PATH,
+  DeliveryErrors,
+  DeliveryHandlers,
+} from "./constants";
 
 // Shape des verified-JWT-payloads. tenantId kommt als string aus jose und
 // wird NACH erfolgreichem parse() zur Branded TenantId — kein blind-cast.
@@ -130,11 +135,10 @@ export async function signAddressUnsubscribeToken(
       .setSubject(addressHash)
       .setIssuer("kumiko:unsubscribe")
       .setIssuedAt()
-      // No expiry, unlike the user token above: a leaked address token can
-      // only opt that one address out of one notificationType/channel, and
-      // an unsubscribe link mailed out today must keep working indefinitely
-      // — there is no signed-in flow for a no-account address to re-subscribe
-      // or request a fresh link from.
+      // No expiry, unlike the user token above: this same token also signs
+      // the resubscribe (undo) direction, and an unsubscribe link mailed out
+      // today must keep working indefinitely — there's no signed-in flow for
+      // a no-account address to request a fresh link from.
       .sign(encodedSecret)
   );
 }
@@ -262,6 +266,50 @@ async function dispatchUnsubscribeWrite(
   return dispatched.isSuccess;
 }
 
+// "limit_reached" is a distinct outcome, not a generic failure: it's the
+// address-side generation cap (removeAddressOptOut) refusing to delete the
+// opt-out row so unsubscribe always still works — the route answers 409,
+// not the 500 a real write failure gets.
+type ResubscribeOutcome = "success" | "limit_reached" | "failed";
+
+function isResubscribeLimitReached(error: { readonly details?: unknown }): boolean {
+  const details = error.details;
+  return (
+    typeof details === "object" &&
+    details !== null &&
+    (details as { reason?: unknown }).reason === DeliveryErrors.resubscribeLimitReached
+  );
+}
+
+async function dispatchResubscribeWrite(
+  verified: VerifiedUnsubscribe,
+  deps: SignatureExtraRouteDeps,
+): Promise<ResubscribeOutcome> {
+  const payload =
+    verified.kind === "address"
+      ? {
+          addressHash: verified.addressHash,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
+        }
+      : {
+          userId: verified.userId,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
+        };
+
+  const dispatched = await deps.dispatchSystemWrite({
+    handlerQn:
+      verified.kind === "address"
+        ? DeliveryHandlers.resubscribeAddress
+        : DeliveryHandlers.resubscribeUser,
+    tenantId: verified.tenantId,
+    payload,
+  });
+  if (dispatched.isSuccess) return "success";
+  return isResubscribeLimitReached(dispatched.error) ? "limit_reached" : "failed";
+}
+
 function confirmationPage(token: string): string {
   return `<!doctype html>
 <html>
@@ -291,6 +339,30 @@ function tokenFromPostRequest(request: SignatureExtraRouteVerifyRequest): string
   return request.query["token"];
 }
 
+// Resubscribe is deliberately NOT reachable via the query string — a mail
+// client's link prefetcher (or a scanner) following an unsubscribe link
+// eagerly is the exact threat model unsubscribe's one-click POST body
+// convention is built to avoid; resubscribe carries the same risk in
+// reverse (a prefetch that undoes a real opt-out) and gets no query-param
+// fallback at all.
+function tokenFromResubscribeRequest(
+  request: SignatureExtraRouteVerifyRequest,
+): string | undefined {
+  const contentType = request.headers["content-type"];
+  if (contentType?.includes("application/x-www-form-urlencoded")) {
+    return new URLSearchParams(request.rawBody).get("token") ?? undefined;
+  }
+  if (contentType?.includes("application/json")) {
+    try {
+      const parsed = JSON.parse(request.rawBody) as { token?: unknown };
+      return typeof parsed.token === "string" ? parsed.token : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
 // GET renders a confirmation page without writing; POST performs the opt-out.
 export function createUnsubscribeRoutes(
   options: UnsubscribeRouteOptions,
@@ -335,5 +407,30 @@ export function createUnsubscribeRoutes(
     },
   });
 
-  return [confirmRoute, writeRoute];
+  // Undo direction: token only from the JSON/form body, never the query
+  // (see tokenFromResubscribeRequest) — no GET confirmation-page variant,
+  // this is a one-shot POST from the unsubscribe-page's "Undo" button.
+  const resubscribeRoute = signatureRoute<VerifiedUnsubscribe>({
+    method: "POST",
+    path: DELIVERY_RESUBSCRIBE_PATH,
+    entry: "signature",
+    verify: async (request) =>
+      verifyUnsubscribeToken(tokenFromResubscribeRequest(request), encodedSecret),
+    handler: async (c, verified, deps) => {
+      const outcome = await dispatchResubscribeWrite(verified, deps);
+      if (outcome === "limit_reached") {
+        return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
+          "Cache-Control": "no-store",
+        });
+      }
+      if (outcome === "failed") {
+        return c.json({ error: { code: "resubscribe_failed" } }, 500, {
+          "Cache-Control": "no-store",
+        });
+      }
+      return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+    },
+  });
+
+  return [confirmRoute, writeRoute, resubscribeRoute];
 }

package/src/document-ingest-foundation/__tests__/feature.integration.test.ts

@@ -6,6 +6,12 @@
 // hardcoded allowlist/cap — there is none anymore.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  buildAgentManifest,
+  buildToolCatalog,
+  dispatchToolCall,
+  toolNameForQn,
+} from "@cosmicdrift/kumiko-bundled-features/agent-tools";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -27,6 +33,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { waitFor } from "@cosmicdrift/kumiko-framework/testing";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import * as z from "zod";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
@@ -136,6 +143,22 @@ const documentExtractExecutorForSeed = createEventStoreExecutor(
   { entityName: "document-extract" },
 );
 
+// A mid-risk agent tool (not the raw HTTP DELETE route) appends fileRef.deleted under a real
+// entryHandler, proving the forget-extract-with-file-ref consumer stays ungated regardless.
+const AGENT_DELETE_FILEREF_QN = "agent-tools-test-delete-fileref:write:delete-fileref-mid";
+
+const agentDeleteFileRefFeature = defineFeature("agent-tools-test-delete-fileref", (r) => {
+  r.writeHandler(
+    "delete-fileref-mid",
+    z.object({ id: z.uuid() }),
+    async (event, ctx) => fileRefExecutor.delete({ id: event.payload.id }, event.user, ctx.db),
+    {
+      access: { roles: ["Admin"] },
+      description: "Soft-delete a fileRef (mid risk, default agent exposure).",
+    },
+  );
+});
+
 beforeAll(async () => {
   provider = createInMemoryFileProvider();
   stack = await setupTestStack({
@@ -147,6 +170,7 @@ beforeAll(async () => {
       documentIngestFoundationFeature,
       testProviderAFeature,
       testProviderBFeature,
+      agentDeleteFileRefFeature,
     ],
     files: { storageProvider: provider },
     // Distinct prefix: avoids sharing a BullMQ queue namespace with any other
@@ -579,6 +603,54 @@ describe("fileRef.restored → re-ingest", () => {
   });
 });
 
+// Regression proof for the deferred-context exception on assertIrreversibleOperationAllowed:
+// the consumer (separate dispatcher pass, no entryHandler) still forgets the extract cleanly.
+describe("fileRef soft-delete via a mid-risk agent tool", () => {
+  test("dispatchToolCall delete succeeds, the consumer forgets the extract without a gate error, restore re-ingests", async () => {
+    const { id: fileRefId } = await uploadFile("invoice.pdf", pdfBytes, "application/pdf");
+
+    await waitFor(async () => {
+      await stack.eventDispatcher?.runOnce();
+      expect(await selectMany(stack.db, documentExtractsTable, { fileRefId })).toHaveLength(1);
+    });
+
+    const manifest = buildAgentManifest(stack.registry, { locale: "en", roles: admin.roles });
+    const catalog = buildToolCatalog(stack.registry, manifest, { mode: "edit" });
+    const deleteResult = await dispatchToolCall({
+      dispatcher: stack.dispatcher,
+      user: admin,
+      toolName: toolNameForQn(AGENT_DELETE_FILEREF_QN),
+      input: { id: fileRefId },
+      dispatchTable: catalog.dispatchTable,
+      runId: "run-delete-fileref",
+      toolCallId: `call-delete-fileref-${fileRefId}`,
+    });
+    expect(deleteResult.ok).toBe(true);
+
+    await stack.eventDispatcher?.runOnce();
+
+    const consumerRows = await asRawClient(stack.db).unsafe(
+      `SELECT status, last_error FROM kumiko_event_consumers WHERE name = $1`,
+      ["document-ingest-foundation:projection:forget-extract-with-file-ref"],
+    );
+    const consumer = (consumerRows as { status: string; last_error: string | null }[])[0];
+    expect(consumer?.last_error).toBeNull();
+    expect(await selectMany(stack.db, documentExtractsTable, { fileRefId })).toHaveLength(0);
+
+    const user = createSystemUser(admin.tenantId);
+    const tdb = createTenantDb(stack.db, admin.tenantId);
+    const restoreResult = await fileRefExecutor.restore({ id: fileRefId }, user, tdb);
+    if (!restoreResult.isSuccess) {
+      throw new Error(`restore failed: ${restoreResult.error.message}`);
+    }
+
+    await waitFor(async () => {
+      await stack.eventDispatcher?.runOnce();
+      expect(await selectMany(stack.db, documentExtractsTable, { fileRefId })).toHaveLength(1);
+    });
+  });
+});
+
 describe("orphan extract guard", () => {
   const testMeta = {
     provider: PROVIDER_A_NAME,

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -15,10 +15,10 @@
 // Unit-Test pinned (policy-to-strategy.test.ts), nicht hier. Hier nur
 // der end-to-end-Default-Pfad (delete).
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
@@ -29,10 +29,15 @@ import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
   type TestStack,
+  TestUsers,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  seedRow,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
@@ -1092,3 +1097,35 @@ describe("runForgetCleanup :: crypto-shredding (subject key erase)", () => {
     expect(alice?.email).toBe("alice.erase-fail@example.com");
   });
 });
+
+// The manual operator trigger (agent.risk "high") must erase a real subject key
+// through configuredPiiSubjectKms(), not a directly-injected args.kms that bypasses the wrapper.
+describe("run-forget-cleanup write handler (manual, risk high) via configuredPiiSubjectKms", () => {
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("erases the subject key through the gated KMS wrapper", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const kms = new InMemoryKmsAdapter();
+    await kms.createKey({ kind: "user", userId: ALICE_ID });
+    configurePiiSubjectKms(kms);
+
+    await stack.http.writeOk(
+      "user-data-rights:write:run-forget-cleanup",
+      {},
+      TestUsers.systemAdmin,
+    );
+
+    const aliceRow = await fetchUser(ALICE_ID);
+    expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+    await expect(kms.getKey({ kind: "user", userId: ALICE_ID })).rejects.toThrow(
+      "Subject key erased",
+    );
+  });
+});