@cosmicdrift/kumiko-bundled-features 0.87.3 → 0.88.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.87.3",
+  "version": "0.88.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -86,11 +86,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.87.3",
-    "@cosmicdrift/kumiko-framework": "0.87.3",
-    "@cosmicdrift/kumiko-headless": "0.87.3",
-    "@cosmicdrift/kumiko-renderer": "0.87.3",
-    "@cosmicdrift/kumiko-renderer-web": "0.87.3",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.88.0",
+    "@cosmicdrift/kumiko-framework": "0.88.0",
+    "@cosmicdrift/kumiko-headless": "0.88.0",
+    "@cosmicdrift/kumiko-renderer": "0.88.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.88.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
+import { createConfigFeature } from "../../config/feature";
+import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createSessionsFeature } from "../../sessions/feature";
+import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsFeature } from "../feature";
+
+// Read-only GDPR inspector screens live IN user-data-rights (the boot-validator
+// forbids cross-feature screen ownership). The validator checks screen structure
+// — entity-local binding, columns/fields exist on the entity, rowAction targets
+// resolve — so a clean boot proves the entityList/entityEdit defs bind to the
+// real event-sourced entities and the convention list/detail QNs exist. The
+// entities (export-job, download-attempt) are r.entity, not direct-write stores,
+// so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
+
+describe("user-data-rights read-only inspector screens", () => {
+  const features = [
+    createConfigFeature(),
+    createUserFeature(),
+    createSessionsFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createUserDataRightsFeature(),
+  ];
+
+  test("the assembled feature set boot-validates", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("ships SystemAdmin-gated list + detail screens", () => {
+    const f = createUserDataRightsFeature();
+    expect(Object.keys(f.screens)).toEqual(
+      expect.arrayContaining(["export-job-list", "export-job-detail", "download-attempt-list"]),
+    );
+    const list = f.screens["export-job-list"];
+    expect(list?.type).toBe("entityList");
+    expect(list?.access).toEqual({ roles: ["SystemAdmin"] });
+  });
+
+  test("export-job detail is strictly read-only (no create/delete, every field readOnly)", () => {
+    const f = createUserDataRightsFeature();
+    const edit = f.screens["export-job-detail"];
+    expect(edit?.type).toBe("entityEdit");
+    if (edit?.type === "entityEdit") {
+      expect(edit.allowCreate).toBe(false);
+      expect(edit.allowDelete).toBe(false);
+      const fields = edit.layout.sections.flatMap((s) => ("fields" in s ? s.fields : []));
+      expect(fields.length).toBeGreaterThan(0);
+      expect(fields.every((field) => typeof field === "object" && field.readOnly === true)).toBe(
+        true,
+      );
+    }
+  });
+
+  test("convention list/detail handlers resolve the screen QNs", () => {
+    const f = createUserDataRightsFeature();
+    // entityList → user-data-rights:query:export-job:list; entityEdit detail →
+    // :export-job:detail; download-attempt list → :download-attempt:list.
+    expect(Object.keys(f.queryHandlers)).toEqual(
+      expect.arrayContaining(["export-job:list", "export-job:detail", "download-attempt:list"]),
+    );
+  });
+});

package/src/user-data-rights/feature.ts

@@ -8,8 +8,11 @@ import {
 import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
+import { downloadAttemptListQuery } from "./handlers/download-attempt-list.query";
 import { downloadByJobQuery } from "./handlers/download-by-job.query";
 import { downloadByTokenQuery } from "./handlers/download-by-token.query";
+import { exportJobDetailQuery } from "./handlers/export-job-detail.query";
+import { exportJobListQuery } from "./handlers/export-job-list.query";
 import { exportStatusQuery } from "./handlers/export-status.query";
 import { liftRestrictionWrite } from "./handlers/lift-restriction.write";
 import { listDownloadAttemptsQuery } from "./handlers/list-download-attempts.query";
@@ -36,6 +39,7 @@ import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "./run-forget
 import { downloadAttemptEntity } from "./schema/download-attempt";
 import { exportDownloadTokenEntity } from "./schema/download-token";
 import { exportJobEntity } from "./schema/export-job";
+import { downloadAttemptListScreen, exportJobDetailScreen, exportJobListScreen } from "./screens";
 
 // user-data-rights — DSGVO Art. 15 (Auskunft) + Art. 17 (Löschung) +
 // Art. 18 (Restriction) + Art. 20 (Portabilität) als Core-Feature.
@@ -222,6 +226,16 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.queryHandler(myAuditLogQuery);
     r.queryHandler(listDownloadAttemptsQuery);
 
+    // Read-only operator inspector over the GDPR read-models (SystemAdmin).
+    // Convention list/detail handlers so entityList/entityEdit resolve by QN;
+    // the screens stay inert until an app navs them (opt-in at wire time).
+    r.queryHandler(exportJobListQuery);
+    r.queryHandler(exportJobDetailQuery);
+    r.queryHandler(downloadAttemptListQuery);
+    r.screen(exportJobListScreen);
+    r.screen(exportJobDetailScreen);
+    r.screen(downloadAttemptListScreen);
+
     // Dormant Self-Service-Screen (Art. 15/17/18/20): Export, Aktivitäts-
     // protokoll, Einschränkung, Löschung in einem Screen. Kein r.nav — die
     // App platziert ihn im eingeloggten Bereich. Die React-Component kommt

package/src/user-data-rights/handlers/download-attempt-list.query.ts

@@ -0,0 +1,11 @@
+import { access, defineEntityListHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { downloadAttemptEntity } from "../schema/download-attempt";
+
+// SystemAdmin operator view of invalid download attempts (DPO brute-force
+// triage). A bespoke list-download-attempts query already exists but sits on a
+// non-convention QN; entityList needs the convention `download-attempt:list`.
+export const downloadAttemptListQuery = defineEntityListHandler(
+  "download-attempt",
+  downloadAttemptEntity,
+  { access: { roles: access.systemAdmin } },
+);

package/src/user-data-rights/handlers/export-job-detail.query.ts

@@ -0,0 +1,7 @@
+import { access, defineEntityDetailHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { exportJobEntity } from "../schema/export-job";
+
+// Detail fetch backing the read-only export-job inspector screen.
+export const exportJobDetailQuery = defineEntityDetailHandler("export-job", exportJobEntity, {
+  access: { roles: access.systemAdmin },
+});

package/src/user-data-rights/handlers/export-job-list.query.ts

@@ -0,0 +1,8 @@
+import { access, defineEntityListHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { exportJobEntity } from "../schema/export-job";
+
+// SystemAdmin operator view of GDPR Art. 20 export jobs. Read-only inspector —
+// rows are created by the user's request-export flow, never through this handler.
+export const exportJobListQuery = defineEntityListHandler("export-job", exportJobEntity, {
+  access: { roles: access.systemAdmin },
+});

package/src/user-data-rights/screens.ts

@@ -0,0 +1,71 @@
+import type {
+  EntityEditScreenDefinition,
+  EntityListScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// Read-only operator inspector for the GDPR data-rights read-models. All
+// screens are SystemAdmin-gated and inert until an app navs them — the feature
+// only registers them, the app opts in per screen via r.nav (see the
+// mount-inspector-screens guide). The entities are event-sourced r.entity rows,
+// so binding entityList/entityEdit to them is safe (no direct-write rebuild
+// hazard like jobs/sessions).
+
+// Read-only field shorthand for the detail screens — every field is display-only.
+const ro = (field: string) => ({ field, readOnly: true });
+
+export const exportJobListScreen: EntityListScreenDefinition = {
+  id: "export-job-list",
+  type: "entityList",
+  entity: "export-job",
+  columns: ["userId", "status", "requestedAt", "completedAt", "expiresAt"],
+  rowActions: [
+    {
+      kind: "navigate",
+      id: "view",
+      label: "kumiko.actions.view",
+      screen: "export-job-detail",
+      entityId: "id",
+    },
+  ],
+  searchable: false,
+  access: { roles: ["SystemAdmin"] },
+};
+
+export const exportJobDetailScreen: EntityEditScreenDefinition = {
+  id: "export-job-detail",
+  type: "entityEdit",
+  entity: "export-job",
+  layout: {
+    sections: [
+      {
+        columns: 2,
+        fields: [
+          ro("userId"),
+          ro("requestedFromTenantId"),
+          ro("status"),
+          ro("requestedAt"),
+          ro("startedAt"),
+          ro("completedAt"),
+          ro("expiresAt"),
+          ro("downloadStorageKey"),
+          ro("bytesWritten"),
+          ro("errorMessage"),
+        ],
+      },
+    ],
+  },
+  // Inspector is strictly read-only: no export-job:create/update/delete handler
+  // exists, and the export lifecycle is driven by the worker, not an operator.
+  allowCreate: false,
+  allowDelete: false,
+  access: { roles: ["SystemAdmin"] },
+};
+
+export const downloadAttemptListScreen: EntityListScreenDefinition = {
+  id: "download-attempt-list",
+  type: "entityList",
+  entity: "download-attempt",
+  columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
+  searchable: false,
+  access: { roles: ["SystemAdmin"] },
+};