@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/__tests__/file-retention.integration.test.ts

@@ -16,6 +16,7 @@
 //      die Policy entscheidet pro Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
@@ -36,7 +37,7 @@ import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { tenantRetentionOverrideTable } from "../../data-retention/schema/tenant-retention-override";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -68,6 +69,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
@@ -76,6 +78,7 @@ beforeAll(async () => {
   db = stack.db;
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable });
   await asRawClient(db).unsafe(`

package/src/user-data-rights/__tests__/file-storage-unification.integration.test.ts

@@ -11,6 +11,7 @@
 // assertion below go red.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type SessionUser, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -40,7 +41,7 @@ import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -94,6 +95,7 @@ beforeAll(async () => {
       createTestFileProviderFeature(provider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
@@ -117,6 +119,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(db, userEntity);
+  await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
   await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await createEventsTable(db);

package/src/user-data-rights/__tests__/forget-cleanup-hook-ordering.integration.test.ts

@@ -1,32 +1,31 @@
-// DSGVO forget hook-ordering — the custom-fields anonymize strip must run
-// before any host hook that nulls the owner column it filters on, regardless
-// of feature registration order.
+// DSGVO forget hook-ordering — a redaction hook with order
+// EXT_USER_DATA_ORDER.REDACT_BEFORE_OWNER must run before any host hook that
+// nulls the owner column it filters on, regardless of feature registration
+// order. (Originally proven via the custom-fields sensitive strip; that strip
+// was removed in #972, so this test pins the generic runner guarantee with a
+// synthetic redact hook.)
 //
 // Two host entities are wired with the OPPOSITE EXT_USER_DATA registration
-// order: one registers the custom-fields strip first (the order that happened
-// to be safe), the other registers the owner-nulling host hook first (the
-// order that exposed the bug). Both run through the real `runForgetCleanup`
-// with strategy=anonymize. With the order-sentinel fix both strip the
-// sensitive jsonb key; without it the host-first entity would leave it behind
-// (the strip matches 0 rows after the owner column is nulled).
-//
-// This drives the full runner on purpose: the existing custom-fields
-// user-data-rights test invokes the strip hook in isolation
-// (getExtensionUsages + direct call) and is structurally blind to ordering.
+// order: one registers the redact hook first (the order that happened to be
+// safe), the other registers the owner-nulling host hook first (the order
+// that exposed the bug). Both run through the real `runForgetCleanup` with
+// strategy=anonymize. With the order-sentinel both strip the jsonb key;
+// without it the host-first entity would leave it behind (the redact matches
+// 0 rows after the owner column is nulled).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createTextField,
   defineFeature,
   EXT_USER_DATA,
+  EXT_USER_DATA_ORDER,
   type UserDataDeleteHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
-  createTestUser,
   resetEventStore,
   setupTestStack,
   type TestStack,
@@ -34,10 +33,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { seedRow as seedProjectionRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
-import { fieldDefinitionEntity } from "../../custom-fields/entity";
-import { createCustomFieldsFeature } from "../../custom-fields/feature";
 import { customFieldsField } from "../../custom-fields/wire-for-entity";
-import { wireCustomFieldsUserDataRightsFor } from "../../custom-fields/wire-user-data-rights";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { tenantRetentionOverrideTable } from "../../data-retention/schema/tenant-retention-override";
 import { createSessionsFeature } from "../../sessions";
@@ -70,6 +66,20 @@ function makeHostDeleteHook(tableName: string): UserDataDeleteHook {
   };
 }
 
+// Owner-keyed jsonb redaction with the REDACT_BEFORE_OWNER order sentinel —
+// the shape the removed custom-fields strip had, kept synthetic here.
+function makeRedactHook(tableName: string): UserDataDeleteHook {
+  return async (ctx, strategy) => {
+    // skip: delete strategy removes rows wholesale — redaction N/A.
+    if (strategy === "delete") return;
+    await asRawClient(ctx.db).unsafe(
+      `UPDATE ${tableName} SET custom_fields = custom_fields - 'ssn'
+       WHERE inserted_by_id = $1 AND tenant_id = $2`,
+      [ctx.userId, ctx.tenantId],
+    );
+  };
+}
+
 interface HostSpec {
   readonly entityName: string;
   readonly tableName: string;
@@ -99,19 +109,16 @@ function makeEntity(tableName: string) {
 
 const cfFirstEntity = makeEntity(CF_FIRST.tableName);
 const hostFirstEntity = makeEntity(HOST_FIRST.tableName);
-const cfFirstTable = buildEntityTable(CF_FIRST.entityName, cfFirstEntity);
-const hostFirstTable = buildEntityTable(HOST_FIRST.entityName, hostFirstEntity);
 
-// Registration order is the whole point: cfFirst registers the strip BEFORE the
-// owner-nulling host hook; hostFirst registers the host hook FIRST (the order
-// that exposed the bug). The order-sentinel must make both correct.
+// Registration order is the whole point: cfFirst registers the redact hook
+// BEFORE the owner-nulling host hook; hostFirst registers the host hook FIRST
+// (the order that exposed the bug). The order-sentinel must make both correct.
 const cfFirstFeature = defineFeature(CF_FIRST.featureName, (r) => {
   r.entity(CF_FIRST.entityName, cfFirstEntity);
-  r.requires("custom-fields");
-  wireCustomFieldsUserDataRightsFor(r, {
-    entityName: CF_FIRST.entityName,
-    entityTable: cfFirstTable,
-    userIdColumn: "inserted_by_id",
+  r.useExtension(EXT_USER_DATA, CF_FIRST.entityName, {
+    export: async () => null,
+    delete: makeRedactHook(CF_FIRST.tableName),
+    order: EXT_USER_DATA_ORDER.REDACT_BEFORE_OWNER,
   });
   r.useExtension(EXT_USER_DATA, CF_FIRST.entityName, {
     export: async () => null,
@@ -121,19 +128,17 @@ const cfFirstFeature = defineFeature(CF_FIRST.featureName, (r) => {
 
 const hostFirstFeature = defineFeature(HOST_FIRST.featureName, (r) => {
   r.entity(HOST_FIRST.entityName, hostFirstEntity);
-  r.requires("custom-fields");
   r.useExtension(EXT_USER_DATA, HOST_FIRST.entityName, {
     export: async () => null,
     delete: makeHostDeleteHook(HOST_FIRST.tableName),
   });
-  wireCustomFieldsUserDataRightsFor(r, {
-    entityName: HOST_FIRST.entityName,
-    entityTable: hostFirstTable,
-    userIdColumn: "inserted_by_id",
+  r.useExtension(EXT_USER_DATA, HOST_FIRST.entityName, {
+    export: async () => null,
+    delete: makeRedactHook(HOST_FIRST.tableName),
+    order: EXT_USER_DATA_ORDER.REDACT_BEFORE_OWNER,
   });
 });
 
-const admin = createTestUser({ id: 1, roles: ["TenantAdmin"], tenantId: TENANT });
 const FORGET_USER = "cccccccc-cccc-4ccc-8ccc-0000000000a1";
 
 let stack: TestStack;
@@ -144,17 +149,16 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
-      createCustomFieldsFeature(),
       createUserDataRightsFeature(),
       cfFirstFeature,
       hostFirstFeature,
     ],
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
-  await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await unsafeCreateEntityTable(stack.db, cfFirstEntity);
   await unsafeCreateEntityTable(stack.db, hostFirstEntity);
@@ -166,21 +170,6 @@ afterAll(async () => {
   await stack.cleanup();
 });
 
-async function defineSensitiveField(entityName: string, fieldKey: string, sensitive: boolean) {
-  await stack.http.writeOk(
-    "custom-fields:write:define-tenant-field",
-    {
-      entityName,
-      fieldKey,
-      serializedField: { type: "text", sensitive },
-      required: false,
-      searchable: false,
-      displayOrder: 0,
-    },
-    admin,
-  );
-}
-
 async function seedAnonymizeOverride(entityName: string) {
   await seedProjectionRow(stack.db, tenantRetentionOverrideTable, {
     entityName,
@@ -217,25 +206,15 @@ beforeEach(async () => {
   await resetEventStore(stack);
   await asRawClient(stack.db).unsafe(`DELETE FROM ${CF_FIRST.tableName}`);
   await asRawClient(stack.db).unsafe(`DELETE FROM ${HOST_FIRST.tableName}`);
-  await asRawClient(stack.db).unsafe(`DELETE FROM read_custom_field_definitions`);
   await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_retention_overrides`);
   await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
 });
 
 describe("forget hook-ordering :: redaction runs before owner-nulling regardless of registration order", () => {
-  test("both registration orders strip the sensitive jsonb key and null the owner column", async () => {
-    // Field defs (sensitive ssn, non-sensitive safe) for both entities.
+  test("both registration orders strip the redacted jsonb key and null the owner column", async () => {
     for (const spec of [CF_FIRST, HOST_FIRST]) {
-      await defineSensitiveField(spec.entityName, "ssn", true);
-      await defineSensitiveField(spec.entityName, "safe", false);
       await seedAnonymizeOverride(spec.entityName);
     }
-    // Project the field definitions. Assert the pass had no failures: a silent
-    // projection failure would leave read_custom_field_definitions empty, make
-    // loadSensitiveFieldKeys return [], and turn the strip into a no-op —
-    // verifying the test exercises the strip for the right reason.
-    const pass = await stack.eventDispatcher?.runOnce();
-    expect(pass?.failed ?? 0).toBe(0);
 
     const cfRowId = "dddddddd-dddd-4ddd-8ddd-000000000001";
     const hostRowId = "dddddddd-dddd-4ddd-8ddd-000000000002";

package/src/user-data-rights/__tests__/forget-hook-registry.integration.test.ts

@@ -0,0 +1,110 @@
+// A forget delete-hook receives the app registry so it can cascade custom child
+// projections for the executor's `<entity>.forgotten` event (runProjectionsForEvent).
+// executor.forget purges only the entity's OWN projection, and the forget pipeline
+// is a job — not a dispatched command — so the dispatcher's post-command projection
+// pass never fires. Without registry in the hook ctx the cascade is unreachable and
+// child read-model rows (m:n joins, per-parent detail projections) are orphaned on
+// live forget (a DSGVO gap). This pins that the plumbing delivers the real,
+// functional registry instance; the end-to-end cascade is covered consumer-side.
+
+import { afterAll, beforeAll, beforeEach, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type Registry,
+  type UserDataDeleteHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature, userEntity } from "../../user";
+import { createUserDataRightsFeature } from "../feature";
+import { runForgetCleanup } from "../run-forget-cleanup";
+import {
+  createForgetSeeders,
+  nowInstant,
+  READ_TENANT_MEMBERSHIPS_DDL,
+  TENANT_SYSTEM,
+} from "./forget-test-helpers";
+
+const PROBE = "forget-registry-probe";
+let capturedRegistry: Registry | undefined;
+
+const captureHook: UserDataDeleteHook = async (ctx) => {
+  capturedRegistry = ctx.registry;
+};
+
+const probeEntity = createEntity({
+  table: `read_${PROBE.replace(/-/g, "_")}`,
+  fields: { name: createTextField({ required: true }) },
+});
+
+const probeFeature = defineFeature(PROBE, (r) => {
+  r.entity(PROBE, probeEntity);
+  r.useExtension(EXT_USER_DATA, PROBE, {
+    export: async () => null,
+    delete: captureHook,
+  });
+});
+
+const FORGET_USER = "cccccccc-cccc-4ccc-8ccc-0000000000b1";
+let stack: TestStack;
+const seed = (db: unknown) =>
+  // biome-ignore lint/suspicious/noExplicitAny: dummy writer; this seeder never writes binaries.
+  createForgetSeeders(db as any, { write: async () => {} });
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createUserDataRightsFeature(),
+      probeFeature,
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
+  await unsafeCreateEntityTable(stack.db, probeEntity);
+  await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(() => {
+  capturedRegistry = undefined;
+});
+
+test("forget delete-hook receives the app registry instance", async () => {
+  await seed(stack.db).seedForgetUser(FORGET_USER);
+  await seed(stack.db).seedMembership(FORGET_USER, TENANT_SYSTEM);
+
+  const result = await runForgetCleanup({
+    db: stack.db,
+    registry: stack.registry,
+    now: nowInstant(),
+  });
+
+  expect(result.errors, JSON.stringify(result.errors)).toHaveLength(0);
+  expect(result.processedUserIds).toContain(FORGET_USER);
+  // The hook ran and got the exact registry passed to runForgetCleanup — not
+  // undefined, not a stand-in — so runProjectionsForEvent(event, ctx.registry, db)
+  // reaches the real projections.
+  expect(capturedRegistry).toBe(stack.registry);
+  expect(capturedRegistry?.getProjectionsForSource(PROBE)).toBeDefined();
+});

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,10 +1,15 @@
 import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createSessionsFeature } from "../../sessions/feature";
+import { createTenantFeature } from "../../tenant/feature";
 import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
 
 // Read-only GDPR inspector screens live IN user-data-rights (the boot-validator
@@ -16,13 +21,22 @@ import { createUserDataRightsFeature } from "../feature";
 // so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
 
 describe("user-data-rights read-only inspector screens", () => {
+  // A realistic assembly: mounting user-data-rights without its default hooks
+  // now fails the V3 boot gate (the framework `user` entity holds PII with no
+  // erase path). Real apps mount the defaults (which hard-require `files`)
+  // alongside — so this set mirrors that.
   const features = [
     createConfigFeature(),
     createUserFeature(),
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
+    createFilesFeature(),
     createUserDataRightsFeature(),
+    createUserDataRightsDefaultsFeature(),
   ];
 
   test("the assembled feature set boot-validates", () => {

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -10,6 +10,7 @@
 // #624: "App mountet mail-foundation+transport → GDPR-Mails ohne Callback-Code".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -26,7 +27,7 @@ import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../..
 import { createFilesFeature } from "../../files";
 import { mailFoundationFeature } from "../../mail-foundation";
 import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../../mail-transport-inmemory";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -56,6 +57,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       mailFoundationFeature,
       mailTransportInMemoryFeature,
@@ -67,6 +69,7 @@ beforeAll(async () => {
 
   await unsafePushTables(stack.db, { configValuesTable });
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
@@ -120,7 +123,21 @@ describe("C6 default mail bridge :: forget cron sends deletion-executed without
     expect(job).toBeDefined();
 
     // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
-    const jobCtx = { db: stack.db, registry: stack.registry, configResolver };
+    // log required since #1572 persists incomplete[] via ctx.log.warn.
+    const jobCtx = {
+      db: stack.db,
+      registry: stack.registry,
+      configResolver,
+      log: {
+        info() {},
+        warn() {},
+        error() {},
+        debug() {},
+        child() {
+          return this;
+        },
+      },
+    };
     await job?.handler({}, jobCtx as never);
 
     // Loeschung lief autonom durch.

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -13,8 +13,8 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   createRegistry,
   type Registry,
@@ -40,13 +40,13 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -59,7 +59,8 @@ import { createDataRetentionFeature } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";
@@ -91,14 +92,15 @@ function buildFeatures() {
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
     createAuthEmailPasswordFeature(),
+    authFoundationFeature,
     createSessionsFeature(),
     createUserDataRightsFeature(),
   ];
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({
@@ -137,6 +139,12 @@ beforeEach(async () => {
   ]);
 });
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired.
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
   test("Restricted-Status ueberlebt einen Projection-Rebuild (T_create != T_active)", async () => {
     // Diskriminierende Praemisse: user.created landet auf systemAdmin.tenantId
@@ -149,7 +157,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     // Mitgliedschaft + Lifecycle auf einem ANDEREN, aktiven Tenant.
     await seedTenantMembership(stack.db, {
@@ -158,7 +166,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
       roles: ["Member"],
     });
 
-    const aliceActive = { id: created.id, tenantId: T_ACTIVE, roles: ["Member"] };
+    const aliceActive = await mintActor({ id: created.id, tenantId: T_ACTIVE, roles: ["Member"] });
     const restricted = await stack.http.writeOk<{ status: string }>(RESTRICT, {}, aliceActive);
     expect(restricted.status).toBe(USER_STATUS.Restricted);
 
@@ -187,7 +195,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "grace.rebuild@example.com", passwordHash: hash, displayName: "Grace" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     const T = getTemporal();
@@ -218,7 +226,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "legacy.rebuild@example.com", passwordHash: hash, displayName: "Legacy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     // Prae-Fix-Zustand simulieren: roher Write OHNE Event.
@@ -256,14 +264,14 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const goodRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
 
     const badRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
     // userEntity is systemStream:true (schema/user.ts) — its event stream
@@ -283,8 +291,11 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     expect(backfilled).toBeGreaterThanOrEqual(1);
 
     // Proof the loop didn't abort at the corrupt row: rebuild the projection —
-    // goodRow got its user.updated event (survives), badRow never did (wiped
-    // back to Active, exactly the data-loss this backfill exists to prevent).
+    // goodRow got its user.updated event (survives). badRow's Stream ist
+    // archiviert und replayt seit fw#832 gar nicht mehr: die Row ist nach dem
+    // Rebuild WEG (nicht bloss auf Active zurueckgewischt). Genau deshalb ist
+    // der failed-Report oben der Operator-Alarm — Heilung: restoreStream +
+    // Backfill-Re-Run, DANN rebuild.
     await rebuildProjection(USER_PROJECTION, { db: stack.db, registry });
     const rows = (await selectMany(stack.db, userTable, {})) as Array<{
       id: string;
@@ -293,6 +304,6 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const good = rows.find((r) => r.id === goodRow.id);
     const bad = rows.find((r) => r.id === badRow.id);
     expect(good?.status).toBe(USER_STATUS.Restricted);
-    expect(bad?.status).toBe(USER_STATUS.Active);
+    expect(bad).toBeUndefined();
   });
 });

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -10,6 +10,7 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -57,6 +58,7 @@ const features = [
   createUserFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  authFoundationFeature,
   createSessionsFeature(),
 
   createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -8,6 +8,7 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -24,7 +25,7 @@ import {
   tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -64,12 +65,14 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature({ sendDeletionRequestedEmail }),
     ],
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await createEventsTable(stack.db);
 });