@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/__tests__/request-export.integration.test.ts

@@ -18,6 +18,7 @@
 //     hasJob=false wenn nichts da
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -53,6 +54,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -12,8 +12,8 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -26,12 +26,12 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
   createLateBoundHolder,
+  createTestEnvelopeCipher,
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -45,7 +45,12 @@ import { createSessionsFeature } from "../../sessions";
 import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import {
+  SESSION_REVOKED_EVENT_QN,
+  type SessionRevokedPayload,
+} from "../../sessions/session-revoked-event";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
+import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
 import { seedTenantMembership } from "../../tenant/seeding";
@@ -65,8 +70,8 @@ const ALICE_EMAIL = "alice.restrict@example.com";
 const ALICE_PW = "alice-pw-long-enough";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
   const bound = sessionCallbacksFromLateBound(callbacks);
 
   stack = await setupTestStack({
@@ -77,6 +82,7 @@ beforeAll(async () => {
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
     ],
@@ -115,10 +121,14 @@ async function seedAliceWithMembership(
   status: string = USER_STATUS.Active,
 ): Promise<{ userId: string }> {
   const hash = await hashPassword(ALICE_PW);
+  const actor = await withMintedSession(
+    (user, meta) => callbacks.get().sessionCreator(user, meta),
+    TestUsers.systemAdmin,
+  );
   const created = await stack.http.writeOk<{ id: string }>(
     UserHandlers.create,
     { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-    TestUsers.systemAdmin,
+    actor,
   );
   if (status !== USER_STATUS.Active) {
     await updateRows(stack.db, userTable, { status }, { id: created.id });
@@ -136,6 +146,12 @@ async function login(email: string, password: string): Promise<{ status: number;
   return { status: res.status, body: await res.json() };
 }
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired (same gate as seedAliceWithMembership's bootstrap actor above).
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 function reasonOf(err: { details?: unknown }): string | undefined {
   return (err.details as { reason?: string } | undefined)?.reason;
 }
@@ -156,11 +172,11 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsBefore.every((s) => s.revokedAt === null)).toBe(true);
 
     // Restrict-Account.
-    const aliceUser = {
+    const aliceUser = await mintActor({
       id: userId,
       tenantId: TENANT,
       roles: ["Member"],
-    };
+    });
     const result = await stack.http.writeOk<{ userId: string; status: string }>(
       RESTRICT,
       {},
@@ -182,28 +198,124 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
   });
 
+  test("non-admin targets another user's account: 403 admin_required_for_other_user", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const attacker = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, attacker);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("admin_required_for_other_user");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  // kumiko-framework#1545: mirrors the lift-restriction cross-tenant guard
+  // below — an isAdminActor check alone lets an Admin/TenantAdmin from a
+  // DIFFERENT tenant restrict (and force-revoke the sessions of) a user
+  // who was never a member of the admin's tenant.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(RESTRICT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Restricted);
+  });
+
   test("Restricted → Restricted (Idempotenz-Guard): 422 already_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
+    // Alice's own session is blocked while Restricted — an admin targets
+    // her account instead, same as production would have to.
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(RESTRICT, { userId }, admin);
     expect(err.httpStatus).toBe(422);
     expect(reasonOf(err)).toBe("already_restricted");
   });
 
   test("DeletionRequested → restrict-account: 422 user_not_in_active_state", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    const aliceUser = await mintActor({ id: userId, tenantId: TENANT, roles: ["Member"] });
     const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
     expect(reasonOf(err)).toBe("user_not_in_active_state");
   });
+
+  // kumiko-framework#1540: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the isAdminActor gate and flip the target's
+  // status. Mirrors the sibling lift-restriction fix (kumiko-framework#1342).
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator) + revoked Sessions", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const loginRes = await login(ALICE_EMAIL, ALICE_PW);
+    expect(loginRes.status).toBe(200);
+
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ userId: string; status: string }>(
+      RESTRICT,
+      { userId: targetId },
+      systemAdmin,
+    );
+    expect(result.status).toBe(USER_STATUS.Restricted);
+
+    const sessionsAfter = (await selectMany(stack.db, userSessionTable, {
+      userId: targetId,
+    })) as Array<{ revokedAt: unknown }>;
+    expect(sessionsAfter.length).toBeGreaterThanOrEqual(1);
+    expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
+  });
 });
 
 describe("S2.U6 :: lift-restriction state-transitions", () => {
   test("Restricted → Active: status flippt zurueck", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    // lift-restriction is operator-only (access.admin) — Alice's own
+    // session is blocked while Restricted anyway.
+    const admin = await mintActor(TestUsers.admin);
 
-    const result = await stack.http.writeOk<{ status: string }>(LIFT, {}, aliceUser);
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, admin);
     expect(result.status).toBe(USER_STATUS.Active);
 
     const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
@@ -214,17 +326,48 @@ describe("S2.U6 :: lift-restriction state-transitions", () => {
 
   test("Active → lift-restriction: 422 not_restricted (Idempotenz-Guard)", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Active);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
 
   test("DeletionRequested → lift-restriction: 422 not_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
+
+  // kumiko-framework#1342: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the access-gate and flip the target's status.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Restricted", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(LIFT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Restricted);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend liften (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Active);
+  });
 });
 
 describe("S2.U6 :: Login-Block fuer Restricted/DeletionRequested/Deleted", () => {
@@ -286,11 +429,11 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
     expect(liveBefore.length).toBe(2);
 
     // System-Caller.
-    const systemUser = {
+    const systemUser = await mintActor({
       id: "00000000-0000-4000-8000-000000000000",
       tenantId: TENANT,
       roles: ["SystemAdmin"],
-    };
+    });
     const result = await stack.http.writeOk<{ count: number; userId: string }>(
       SessionHandlers.revokeAllForUser,
       { userId },
@@ -304,5 +447,15 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
       revokedAt: unknown;
     }>;
     expect(revoked.every((s) => s.revokedAt !== null)).toBe(true);
+
+    // #1559 — cross-tenant privileged revoke uses the low-level append(),
+    // not ctx.unsafeAppendEvent (see revoke-all-for-user.write.ts for why:
+    // the SystemAdmin caller's own tenantId has no relationship to the
+    // target user's session tenant). One event, both sids listed.
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1);
+    const payload = events[0]?.["payload"] as SessionRevokedPayload;
+    expect(payload.userId).toBe(userId);
+    expect(new Set(payload.sessionIds)).toEqual(new Set(liveBefore.map((s) => s.id)));
   });
 });

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -10,6 +10,7 @@
 // jeden Export auf "failed" setzte).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -65,6 +66,7 @@ beforeAll(async () => {
       fileProviderInMemoryFeature,
       mailFoundationFeature,
       mailTransportInMemoryFeature,
+      authFoundationFeature,
       createSessionsFeature(),
       // appExportDownloadUrl set → the default export-ready mail is enabled, so
       // this also proves the export cron's mail bridge end-to-end (C6).