@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/tenant/handlers/members.query.ts

@@ -1,21 +1,56 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
+import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";
 
+type UserRow = { readonly id: unknown; readonly email?: unknown; readonly displayName?: unknown };
+
+// Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
+// own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
+// one call per user unbounded and exhausts the pool once membership counts
+// exceed a handful, surfacing as "the connection was closed"; a strict
+// sequential loop caps concurrency at 1 and leaves 3 pool slots idle.
+const KMS_POOL_CONCURRENCY = 4;
+
 export const membersQuery = defineQueryHandler({
   name: "members",
   schema: z.object({}),
-  access: { roles: ["Admin", "SystemAdmin"] },
+  access: { roles: access.admin },
   handler: async (query, ctx) => {
     const rows = await selectMany(ctx.db, tenantMembershipsTable, {
       tenantId: query.user.tenantId,
     });
 
-    return rows.map((row) => ({
-      ...row,
-      roles: parseRoles(row["roles"]),
-    }));
+    const userIds = [...new Set(rows.map((row) => row["userId"]))];
+    const users =
+      userIds.length > 0 ? await selectMany<UserRow>(ctx.db, userTable, { id: userIds }) : [];
+    const userById = new Map(users.map((u) => [String(u.id), u]));
+
+    const decrypted = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
+      const email =
+        typeof user.email === "string"
+          ? await decryptStoredPii(user.email, "email", "tenant:members")
+          : null;
+      const displayName =
+        typeof user.displayName === "string"
+          ? await decryptStoredPii(user.displayName, "displayName", "tenant:members")
+          : null;
+      return { userId: String(user.id), email, displayName };
+    });
+    const decryptedByUserId = new Map(decrypted.map((d) => [d.userId, d]));
+
+    return rows.map((row) => {
+      const user = userById.get(String(row["userId"]));
+      const decrypted = user ? decryptedByUserId.get(String(user.id)) : undefined;
+      return {
+        ...row,
+        email: decrypted?.email ?? null,
+        displayName: decrypted?.displayName ?? null,
+        roles: parseRoles(row["roles"]),
+      };
+    });
   },
 });

package/src/tenant/i18n.ts

@@ -0,0 +1,28 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TENANT_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tenant-list.title": { de: "Mandanten", en: "Tenants" },
+  "screen:tenant-edit.title": { de: "Mandant bearbeiten", en: "Edit tenant" },
+  "screen:members.title": { de: "Team", en: "Team" },
+  "tenant.nav.members": { de: "Team", en: "Team" },
+  "tenant:entity:tenant:field:key": { de: "Schlüssel", en: "Key" },
+  "tenant:entity:tenant:field:name": { de: "Name", en: "Name" },
+  "tenant:entity:tenant:field:isEnabled": { de: "Aktiv", en: "Enabled" },
+  "tenant:entity:tenant:field:status": { de: "Status", en: "Status" },
+  "tenant:entity:tenant:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "tenant:entity:tenant:field:status:option:destroyRequested": {
+    de: "Löschung angefordert",
+    en: "Destroy requested",
+  },
+  "tenant:entity:tenant:field:status:option:destroying": {
+    de: "Wird gelöscht",
+    en: "Destroying",
+  },
+  "tenant:entity:tenant:field:status:option:destroyFailed": {
+    de: "Löschung fehlgeschlagen",
+    en: "Destroy failed",
+  },
+  "tenant:entity:tenant:field:status:option:destroyed": { de: "Gelöscht", en: "Destroyed" },
+  "tenant:entity:tenant:field:isEnabled:option:true": { de: "Ja", en: "Yes" },
+  "tenant:entity:tenant:field:isEnabled:option:false": { de: "Nein", en: "No" },
+};

package/src/tenant/index.ts

@@ -8,5 +8,10 @@ export {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "./invitation-table";
-export { tenantMembershipsTable } from "./membership-table";
-export { tenantEntity, tenantTable } from "./schema/tenant";
+export { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
+export {
+  TENANT_LIFECYCLE_STATUSES,
+  type TenantLifecycleStatus,
+  tenantEntity,
+  tenantTable,
+} from "./schema/tenant";

package/src/tenant/invitation-table.ts

@@ -58,7 +58,7 @@ export const tenantInvitationEntity = createEntity({
   fields: {
     // Eingeladene Email — case-insensitive normalisiert beim Insert.
     // PII bis zur Annahme (danach hat der User selbst seine email in users).
-    email: createTextField({ required: true, maxLength: 320, pii: true }),
+    email: createTextField({ required: true, maxLength: 320, pii: true, lookupable: true }),
     // Membership-Rolle die dem User nach Accept gegeben wird. Default
     // im handler ist "Admin" (Co-Admin-Pattern für kleine Teams).
     role: createTextField({ required: true, maxLength: 50 }),
@@ -70,7 +70,8 @@ export const tenantInvitationEntity = createEntity({
       default: "pending",
     }),
     // userId des einladenden Admins (für Audit-Trail "wer hat eingeladen").
-    invitedBy: createTextField({ required: true }),
+    // Self-referencing ownerField: the field's own value IS the owner userId.
+    invitedBy: createTextField({ required: true, userOwned: { ownerField: "invitedBy" } }),
     // UI-Anzeige — Wahrheit liegt in Redis-TTL.
     expiresAt: createTimestampField({ required: true }),
   },

package/src/tenant/schema/tenant.ts

@@ -2,9 +2,21 @@ import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createBooleanField,
   createEntity,
+  createSelectField,
   createTextField,
+  createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
 
+export const TENANT_LIFECYCLE_STATUSES = [
+  "active",
+  "destroyRequested",
+  "destroying",
+  "destroyFailed",
+  "destroyed",
+] as const;
+
+export type TenantLifecycleStatus = (typeof TENANT_LIFECYCLE_STATUSES)[number];
+
 export const tenantEntity = createEntity({
   table: "read_tenants",
   // tenant.id IS the tenantId-value that every other table references as FK.
@@ -12,8 +24,21 @@ export const tenantEntity = createEntity({
   // UUID sein, sonst findet der tenants-Lookup nie. Default gen_random_uuid().
   fields: {
     key: createTextField({ required: true, maxLength: 50 }),
-    name: createTextField({ required: true, maxLength: 200, searchable: true }),
-    isEnabled: createBooleanField({ default: true }),
+    name: createTextField({ required: true, maxLength: 200, searchable: true, sortable: true }),
+    isEnabled: createBooleanField({ default: true, filterable: true }),
+    // Tenant-destroy lifecycle (tenant-lifecycle feature). Defaults keep
+    // existing tenants valid when the feature is not mounted.
+    status: createSelectField({
+      options: TENANT_LIFECYCLE_STATUSES,
+      default: "active",
+      required: true,
+      filterable: true,
+    }),
+    destroyRequestedAt: createTimestampField({}),
+    destroyRequestedBy: createTextField({ maxLength: 36 }),
+    gracePeriodEnd: createTimestampField({}),
+    destroyStartedAt: createTimestampField({}),
+    destroyedAt: createTimestampField({}),
   },
   // tenant.key wird in Admin-URLs verwendet (`admin.<host>/<key>/...`) und
   // muss eindeutig sein. Ohne unique-constraint hätte ein konkurrenter

package/src/tenant/screens.ts

@@ -16,7 +16,7 @@ export const tenantListScreen: EntityListScreenDefinition = {
   id: "tenant-list",
   type: "entityList",
   entity: "tenant",
-  columns: ["key", "name", "isEnabled"],
+  columns: ["key", "name", "status", "isEnabled"],
   rowActions: [
     {
       kind: "navigate",
@@ -26,7 +26,8 @@ export const tenantListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  searchable: false,
+  defaultSort: { field: "name", dir: "asc" },
+  searchable: true,
   access: { roles: ["SystemAdmin"] },
 };
 

package/src/tenant/seeding.ts

@@ -34,8 +34,16 @@ import {
   createTenantDb,
   type DbRunner,
 } from "@cosmicdrift/kumiko-framework/db";
-import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  type AppContext,
+  HookPhases,
+  type Registry,
+  type SaveContext,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createLifecycleHooks } from "@cosmicdrift/kumiko-framework/pipeline";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { assertAssignableMembershipRoles } from "./membership-roles";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table";
@@ -74,6 +82,117 @@ export type SeedTenantOptions = {
   readonly by?: SessionUser;
 };
 
+// seedTenant runs through the raw event-store executor, which fires no
+// postSave hooks (#1463) — feature-registered entity hooks on "tenant"
+// (e.g. tier-engine's auto-default-tier, an app's auto-default-compliance)
+// silently never run for tenants created this way. Pass `hooks` to fire
+// them explicitly, same lookup as the dispatcher (registry.getEntityPostSaveHooks
+// by result.entityName), just without the full dispatch roundtrip. Omit it
+// to keep today's hook-less behavior (existing fixture call-sites that don't
+// care about hooks need no changes).
+export type SeedTenantHooks = {
+  readonly registry: Registry;
+  readonly context: AppContext;
+};
+
+// Shared by seedTenant/seedTenantMembership/auth-email-password's
+// seedUserWithPassword: fires the same entity-scoped postSave hooks the
+// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
+// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
+// lifecycle-hooks instance per call, no systemHooks — only feature-
+// registered entity/handler hooks fire (search-index/SSE system hooks are
+// wired at server-boot and out of reach here).
+//
+// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
+// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
+// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
+// closures over the caller's tenant (self-signup is anonymous/system).
+// `query`/`write` bridges still share the caller's identity; hooks that
+// need a full identity switch use `writeAs`/`queryAs`.
+//
+// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
+// (HandlerContext from a live write), afterCommit hooks are queued onto the
+// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
+// Connection) they still fire immediately — there is no outer TX to wait for.
+function resolveRawDb(db: AppContext["db"]): DbRunner | undefined {
+  if (!db) return undefined;
+  if (typeof db === "object" && "raw" in db) {
+    return (db as { raw: DbRunner }).raw;
+  }
+  return db as DbRunner;
+}
+
+function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): AppContext {
+  const raw = resolveRawDb(context.db);
+  const db = raw
+    ? createTenantDb(raw, targetTenantId, "system", context.tracer, context.meter, context.signal)
+    : context.db;
+
+  // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
+  // live handler user when present so notify/hasFeature keep a real SessionUser.
+  const handlerUser = (context as { user?: SessionUser }).user;
+  const baseUser: SessionUser | undefined = handlerUser ?? context.systemUser;
+  const scopedUser: SessionUser | undefined = baseUser
+    ? { ...baseUser, tenantId: targetTenantId }
+    : undefined;
+
+  const notify =
+    context._notifyFactory && scopedUser
+      ? context._notifyFactory(scopedUser, targetTenantId)
+      : context.notify;
+
+  const features = context.effectiveFeatures as
+    | (((tenantId: TenantId) => ReadonlySet<string>) & {
+        trialGate?: (tenantId: TenantId, featureName: string) => Promise<boolean>;
+      })
+    | undefined;
+  const hasFeature = features
+    ? async (featureName: string): Promise<boolean> => {
+        if (features(targetTenantId).has(featureName)) return true;
+        if (!features.trialGate) return false;
+        return features.trialGate(targetTenantId, featureName);
+      }
+    : "hasFeature" in context
+      ? // Keep caller's hasFeature when no effectiveFeatures (always-on apps).
+        (context as { hasFeature?: (n: string) => Promise<boolean> }).hasFeature
+      : undefined;
+
+  return {
+    ...context,
+    _tenantId: targetTenantId,
+    ...(db !== undefined ? { db } : {}),
+    ...(notify !== undefined ? { notify } : {}),
+    ...(scopedUser && "user" in context ? { user: scopedUser } : {}),
+    ...(hasFeature ? { hasFeature } : {}),
+  };
+}
+
+export async function fireEntityPostSave(
+  hooks: SeedTenantHooks | undefined,
+  pseudoType: string,
+  entityData: SaveContext,
+  // Undefined for tenant-agnostic entities (user has no tenant_id column at
+  // seed time) — keeps hooks.context._tenantId as the caller passed it.
+  targetTenantId?: TenantId,
+): Promise<void> {
+  // skip: caller opted out of hooks (existing fixture/test call-sites that
+  // don't pass them keep today's hook-less behavior, see seedTenant's doc).
+  if (!hooks) return;
+  const lifecycle = createLifecycleHooks(hooks.registry);
+  const scopedContext =
+    targetTenantId === undefined
+      ? hooks.context
+      : scopeSeedHookContext(hooks.context, targetTenantId);
+  await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
+  const runAfterCommit = () =>
+    lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.afterCommit);
+  if (scopedContext.scheduleAfterCommit) {
+    scopedContext.scheduleAfterCommit(runAfterCommit);
+  } else {
+    await runAfterCommit();
+  }
+}
+
 /**
  * Seed a tenant through the event-store executor. Idempotent add-only:
  * a second call for the same `id` is a no-op (no update path). Same
@@ -83,6 +202,7 @@ export type SeedTenantOptions = {
 export async function seedTenant(
   db: DbRunner,
   options: SeedTenantOptions,
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: TenantId }> {
   const by = options.by ?? TestUsers.systemAdmin;
   // executor.create erwartet eine TenantDb (mit .insert()-API), nicht
@@ -99,7 +219,7 @@ export async function seedTenant(
   // (Projection-Drift nach rebuild, manuellem DELETE, oder async-lag). Wenn
   // Stream-Version > 0 → kein create() — wäre version_conflict. Caller
   // bekommt die ID, Projection wird beim nächsten Dispatcher-Cycle aufgebaut.
-  const streamVersion = await getAggregateStreamMaxVersion(db, options.id);
+  const streamVersion = await getUnscopedAggregateStreamMaxVersion(db, options.id);
   if (streamVersion > 0) return { id: options.id };
 
   const result = await tenantExecutor.create(
@@ -112,6 +232,12 @@ export async function seedTenant(
       `seedTenant failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+
+  // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
+  // (keyed by result.entityName === "tenant") — that's exactly what
+  // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
+  await fireEntityPostSave(hooks, "tenant:seed", result.data, options.id);
+
   return { id: options.id };
 }
 
@@ -127,6 +253,12 @@ export async function seedTenant(
 export async function seedTenantMembership(
   db: DbRunner,
   options: SeedTenantMembershipOptions,
+  // Optional, append-only — same rationale as seedTenant's hooks param
+  // (#1478): fires tenantMembership's postSave hooks (e.g. a Welcome-
+  // notification or default-notification-preferences hook keyed off
+  // `allOf: "tenantMembership"`) for fixtures/self-signup that opt in.
+  // Omit to keep today's hook-less behavior.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   // Chokepoint: invite-accept (×3) + seedAdmin/provisionSignup all flow
   // through here — reject reserved/global roles before they ever persist.
@@ -164,6 +296,7 @@ export async function seedTenantMembership(
       `seedTenantMembership failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, options.tenantId);
   return { id: extractMembershipId(result.data) };
 }
 

package/src/tenant/web/client-plugin.tsx

@@ -0,0 +1,20 @@
+// @runtime client
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { MEMBERS_SCREEN_ID, TENANT_FEATURE } from "../constants";
+import { defaultTranslations } from "./i18n";
+import { MembersScreen } from "./members-screen";
+
+export type TenantClientOptions = {
+  readonly translations?: TranslationsByLocale;
+};
+
+export function tenantClient(options?: TenantClientOptions): ClientFeatureDefinition {
+  return {
+    name: TENANT_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [MEMBERS_SCREEN_ID]: MembersScreen,
+    },
+  };
+}

package/src/tenant/web/i18n.ts

@@ -0,0 +1,43 @@
+// @runtime client
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "tenant.members.title": "Mitglieder",
+    "tenant.members.loading": "Lade Mitglieder…",
+    "tenant.members.active": "Aktive Mitglieder",
+    "tenant.members.invite.title": "Neue Einladung",
+    "tenant.members.invite.email": "E-Mail",
+    "tenant.members.invite.role": "Rolle",
+    "tenant.members.invite.submit": "Einladung senden",
+    "tenant.members.invite.submitting": "Einladung wird gesendet…",
+    "tenant.members.invite.success": "Einladung an {email} gesendet",
+    "tenant.members.pending": "Ausstehende Einladungen",
+    "tenant.members.pending.empty": "Keine ausstehenden Einladungen.",
+    "tenant.members.cancel": "Zurückziehen",
+    "tenant.members.col.userId": "User-ID",
+    "tenant.members.col.roles": "Rollen",
+    "tenant.members.col.email": "E-Mail",
+    "tenant.members.col.expires": "Gültig bis",
+    "tenant.nav.members": "Team",
+  },
+  en: {
+    "tenant.members.title": "Members",
+    "tenant.members.loading": "Loading members…",
+    "tenant.members.active": "Active members",
+    "tenant.members.invite.title": "New invitation",
+    "tenant.members.invite.email": "Email",
+    "tenant.members.invite.role": "Role",
+    "tenant.members.invite.submit": "Send invitation",
+    "tenant.members.invite.submitting": "Sending invitation…",
+    "tenant.members.invite.success": "Invitation sent to {email}",
+    "tenant.members.pending": "Pending invitations",
+    "tenant.members.pending.empty": "No pending invitations.",
+    "tenant.members.cancel": "Cancel",
+    "tenant.members.col.userId": "User ID",
+    "tenant.members.col.roles": "Roles",
+    "tenant.members.col.email": "Email",
+    "tenant.members.col.expires": "Valid until",
+    "tenant.nav.members": "Team",
+  },
+};

package/src/tenant/web/index.ts

@@ -0,0 +1,4 @@
+// @runtime client
+export { type TenantClientOptions, tenantClient } from "./client-plugin";
+export { defaultTranslations } from "./i18n";
+export { MembersScreen, type MembersScreenProps } from "./members-screen";