@cosmicdrift/kumiko-bundled-features 0.392.1 → 0.392.2

package/dist/inbound-mail-foundation/types.d.ts

@@ -11,7 +11,7 @@ import type { OutboundMailMessage, OutboundMailSent } from "./outbound-mail.ts";
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
  *   auditUserId  — audit identity for secret reads. Handler path: unset,
  *              requireSecretsContext falls back to ctx.user.id; worker/provider
- *              path: system identity set by the resolver.
+ *              path: the supervisor sets the system identity.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
  *              no-op instead of a throw.

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -44,7 +44,8 @@
 // racing a new holder.
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
-import { systemScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { systemScopedRunner, tenantScopedSecrets, } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
@@ -80,13 +81,21 @@ export function createInboundMailSupervisor(deps) {
     // configured TTL — real deployments (default 90s) never hit it.
     const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
     const log = deps.log ?? (() => { });
+    // The supervisor runs outside any request: secret reads need an audit
+    // identity, and under enforced row-level security they need the account's
+    // tenant scope, or the credential row is invisible and reads as missing.
+    const providerCtx = {
+        ...deps.providerCtx,
+        auditUserId: deps.providerCtx.auditUserId ?? SYSTEM_USER_ID,
+        ...(deps.providerCtx.secrets && { secrets: tenantScopedSecrets(deps.providerCtx.secrets) }),
+    };
     const systemDb = systemScopedRunner(deps.db, "mail sync supervisor polls accounts and cursors of all tenants outside a request");
     const oauthTokens = deps.oauthTokens ??
-        (deps.providerCtx.secrets
+        (providerCtx.secrets
             ? createOAuthAccessTokenManager({
                 db: systemDb,
-                secrets: deps.providerCtx.secrets,
-                providerCtx: deps.providerCtx,
+                secrets: providerCtx.secrets,
+                providerCtx,
             })
             : undefined);
     // Undefined for non-OAuth accounts. A refresh failure propagates into the
@@ -294,7 +303,7 @@ export function createInboundMailSupervisor(deps) {
             // exhausted.
             for (;;) {
                 const accessToken = await resolveAccessToken(account, plugin);
-                const result = await plugin.fetch(deps.providerCtx, account, cursor, {
+                const result = await plugin.fetch(providerCtx, account, cursor, {
                     backfillWindowDays,
                     maxMessages: budget,
                     filterUnknownMessageIds: unknownMessageIdsFilterFor(account),
@@ -317,7 +326,7 @@ export function createInboundMailSupervisor(deps) {
         for (const account of accounts) {
             let plugin;
             try {
-                plugin = resolveInboundProviderForAccount(deps.providerCtx, account);
+                plugin = resolveInboundProviderForAccount(providerCtx, account);
             }
             catch (err) {
                 log(`inbound-mail: ${describeError(err)}`);
@@ -461,7 +470,7 @@ export function createInboundMailSupervisor(deps) {
         state.starting = true;
         try {
             const accessToken = await resolveAccessToken(account, plugin);
-            const stop = await plugin.watch(deps.providerCtx, account, {
+            const stop = await plugin.watch(providerCtx, account, {
                 onMessages: async (msgs) => {
                     try {
                         await ingestBatch(account, msgs, "watch");

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -1,4 +1,4 @@
-import type { InboundMailProviderPlugin, RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { type InboundMailProviderPlugin, type RawInboundMessage } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 export declare const INMEMORY_PROVIDER_KEY = "inmemory";
 /** Test helper: adds a message to the mailbox. If a watch is active, it is
  *  pushed immediately (IDLE simulation); the next fetch also returns it by
@@ -9,6 +9,9 @@ export declare function seedInboundMessage(accountId: string, msg: RawInboundMes
 export declare function failNextFetchWith(accountId: string, err: unknown): void;
 /** Test helper: injects a one-shot error into the next verify. */
 export declare function failNextVerifyWith(accountId: string, err: unknown): void;
+/** Test helper: every fetch reads this tenant secret first, like a real
+ *  provider reads its stored credentials; a missing secret is an auth error. */
+export declare function requireCredentialSecretOnFetch(accountId: string, key: string): void;
 /** Test helper: simulates the live connection terminating (the supervisor
  *  must restart with backoff). */
 export declare function emitWatchError(accountId: string, err: unknown): void;

package/dist/inbound-provider-inmemory/feature.js

@@ -10,6 +10,8 @@
 //
 // **Pattern basis:** mail-transport-inmemory (module-level state +
 // test-helper exports). Not for production.
+import { InboundAuthError, } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 const FEATURE_NAME = "inbound-provider-inmemory";
 export const INMEMORY_PROVIDER_KEY = "inmemory";
@@ -17,7 +19,13 @@ const accounts = new Map();
 function stateFor(accountId) {
     let state = accounts.get(accountId);
     if (!state) {
-        state = { log: [], watch: null, nextFetchError: null, nextVerifyError: null };
+        state = {
+            log: [],
+            watch: null,
+            nextFetchError: null,
+            nextVerifyError: null,
+            credentialSecretKey: null,
+        };
         accounts.set(accountId, state);
     }
     return state;
@@ -40,6 +48,17 @@ export function failNextFetchWith(accountId, err) {
 export function failNextVerifyWith(accountId, err) {
     stateFor(accountId).nextVerifyError = err;
 }
+/** Test helper: every fetch reads this tenant secret first, like a real
+ *  provider reads its stored credentials; a missing secret is an auth error. */
+export function requireCredentialSecretOnFetch(accountId, key) {
+    stateFor(accountId).credentialSecretKey = key;
+}
+async function readCredentialSecret(ctx, account, key) {
+    const secrets = requireSecretsContext({ secrets: ctx.secrets, auditUserId: ctx.auditUserId }, FEATURE_NAME);
+    const secret = await secrets.get(account.tenantId, key);
+    if (!secret)
+        throw new InboundAuthError(`${FEATURE_NAME}: no credential secret ${key}`);
+}
 /** Test helper: simulates the live connection terminating (the supervisor
  *  must restart with backoff). */
 export function emitWatchError(accountId, err) {
@@ -75,13 +94,16 @@ export const inMemoryInboundMailPlugin = {
             throw err;
         }
     },
-    fetch: async (_ctx, account, cursor, opts) => {
+    fetch: async (ctx, account, cursor, opts) => {
         const state = stateFor(account.id);
         if (state.nextFetchError) {
             const err = state.nextFetchError;
             state.nextFetchError = null;
             throw err;
         }
+        if (state.credentialSecretKey) {
+            await readCredentialSecret(ctx, account, state.credentialSecretKey);
+        }
         const offset = offsetOf(cursor);
         const slice = state.log.slice(offset, offset + opts.maxMessages);
         const nextOffset = offset + slice.length;

package/dist/inbound-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.ts";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, requireCredentialSecretOnFetch, resetInboundInMemory, seedInboundMessage, } from "./feature.ts";

package/dist/inbound-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
-export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, isWatching, requireCredentialSecretOnFetch, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.392.1",
+  "version": "0.392.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -558,9 +558,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.392.1",
-    "@cosmicdrift/kumiko-renderer": "0.392.1",
-    "@cosmicdrift/kumiko-types": "0.392.1",
+    "@cosmicdrift/kumiko-framework": "0.392.2",
+    "@cosmicdrift/kumiko-renderer": "0.392.2",
+    "@cosmicdrift/kumiko-types": "0.392.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "^3.31.3",
@@ -1142,17 +1142,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.392.1",
-    "@cosmicdrift/kumiko-locale-es": "0.392.1",
-    "@cosmicdrift/kumiko-locale-fr": "0.392.1",
-    "@cosmicdrift/kumiko-locale-it": "0.392.1",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.392.1",
+    "@cosmicdrift/kumiko-locale-de": "0.392.2",
+    "@cosmicdrift/kumiko-locale-es": "0.392.2",
+    "@cosmicdrift/kumiko-locale-fr": "0.392.2",
+    "@cosmicdrift/kumiko-locale-it": "0.392.2",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.392.2",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.392.1"
+    "@cosmicdrift/kumiko-testing": "0.392.2"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.392.1"
+    "@cosmicdrift/kumiko-testing": "0.392.2"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.392.2",
+    "type": "fix",
+    "title": "Mail sync no longer fails when reading IMAP credentials",
+    "detail": "createInboundMailSupervisor builds its provider context with auditUserId defaulting to the system user. Apps that did not set auditUserId in providerCtx got an internal error on every fetch and watch because the secrets context needs an audit identity. An explicitly set auditUserId is kept."
+  },
+  {
+    "version": "0.392.2",
+    "type": "fix",
+    "title": "Mail sync finds the stored IMAP credentials under row-level security",
+    "detail": "createInboundMailSupervisor runs outside any request, so secret reads ran without a tenant scope and the application role saw no row in read_tenant_secrets. The supervisor now wraps providerCtx.secrets with tenantScopedSecrets, which the framework exports from internal/row-level-security. inbound-provider-inmemory gains requireCredentialSecretOnFetch so tests can exercise credential reads; a new integration test runs the secrets against an application-role database."
+  },
   {
     "version": "0.392.0",
     "type": "fix",