@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -12,11 +12,12 @@
 //      downloadStorageKey wird genullt + storage-key geloescht
 //   6. Idempotency: 2× run → kein Re-Processing von done/failed-Jobs
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -38,7 +39,7 @@ import {
   tenantComplianceProfileTable,
 } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
@@ -59,6 +60,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -68,6 +70,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, exportDownloadTokenEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await createEventsTable(stack.db);
   // tenant-membership-table fuer runUserExport's Cross-Tenant-Iteration.
   // Pattern matched user-data-rights-defaults integration-test.
@@ -144,6 +147,21 @@ async function seedPendingJob(opts: { user?: typeof aliceUser } = {}): Promise<s
   return result.jobId;
 }
 
+// Force a UNIQUE-violation on read_export_download_tokens.job_id (test-fixture,
+// direct-INSERT is a test-only exemption) — the worker's tokenCrud.create then
+// fails with constraintName "read_export_download_tokens_one_per_job",
+// deterministically flipping the job to failed for the tests below.
+async function seedConflictingDownloadToken(jobId: string): Promise<void> {
+  await asRawClient(stack.db).unsafe(
+    `
+      INSERT INTO read_export_download_tokens
+        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
+      VALUES (gen_random_uuid(), $1, $2, $3, now(), now() + interval '7 days', 1, now(), now())
+    `,
+    [tenantA, jobId, "existing-hash"],
+  );
+}
+
 describe("runExportJobs :: happy path", () => {
   test("pending Job → Worker pickt → done mit downloadStorageKey + bytesWritten", async () => {
     const jobId = await seedPendingJob();
@@ -384,6 +402,47 @@ describe("runExportJobs :: storage-cleanup", () => {
     expect(result.cleanedJobIds).not.toContain(jobId);
     expect(await provider.exists(storageKey)).toBe(true);
   });
+
+  test("storage-delete Throw → Job bleibt uncleaned (retry naechster Pass)", async () => {
+    const jobId = await seedPendingJob();
+    const T = getTemporal();
+    const longAgo = T.Instant.fromEpochMilliseconds(Date.now() - 365 * 24 * 60 * 60 * 1000);
+    const storageKey = `${tenantA}/exports/${jobId}.zip`;
+    const provider = await buildProvider(tenantA);
+    await provider.write(storageKey, new Uint8Array([7, 8, 9]));
+
+    await updateRows(
+      stack.db,
+      exportJobsTable,
+      {
+        status: EXPORT_JOB_STATUS.Done,
+        startedAt: longAgo,
+        completedAt: longAgo,
+        downloadStorageKey: storageKey,
+        expiresAt: longAgo,
+      },
+      { id: jobId },
+    );
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: async () => ({
+        ...provider,
+        delete: async () => {
+          throw new Error("synthetic storage delete failure");
+        },
+      }),
+      now: NOW(),
+    });
+
+    expect(result.cleanedJobIds).not.toContain(jobId);
+    expect(await provider.exists(storageKey)).toBe(true);
+    const [row] = (await selectMany(stack.db, exportJobsTable, { id: jobId })) as Array<{
+      downloadStorageKey: string | null;
+    }>;
+    expect(row?.downloadStorageKey).toBe(storageKey);
+  });
 });
 
 describe("runExportJobs :: idempotency", () => {
@@ -573,6 +632,67 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     expect(tokenRows).toHaveLength(1);
   });
 
+  test("Re-Run (fw#832): Job zurueck auf pending → Token in place rotiert, kein 2. created-Event", async () => {
+    const jobId = await seedPendingJob();
+    const first = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+    });
+    const firstPlain = first.tokenByJobId.get(jobId);
+    expect(firstPlain).toBeDefined();
+
+    const [tokenBefore] = (await selectMany(stack.db, exportDownloadTokensTable, {
+      jobId,
+    })) as Array<{ id: string }>;
+
+    // Operator-Recovery (Email-Fail, plain verloren): NUR den Job auf
+    // pending flippen — die Token-Row bleibt liegen. Vor fw#832 created
+    // der Worker dann ein ZWEITES Aggregat fuers gleiche jobId und der
+    // Projection-Rebuild kollidierte dauerhaft am one_per_job-Index.
+    await updateRows(
+      stack.db,
+      exportJobsTable,
+      { status: EXPORT_JOB_STATUS.Pending },
+      { id: jobId },
+    );
+
+    const second = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+    });
+    expect(second.completedJobIds).toContain(jobId);
+    const secondPlain = second.tokenByJobId.get(jobId);
+    expect(secondPlain).toBeDefined();
+    expect(secondPlain).not.toBe(firstPlain);
+
+    // Genau EINE Row, GLEICHES Aggregat, frischer Hash, Audit-Reset.
+    const tokenRows = (await selectMany(stack.db, exportDownloadTokensTable, {
+      jobId,
+    })) as Array<{
+      id: string;
+      tokenHash: string;
+      useCount: number | null;
+      lastUsedAt: unknown;
+    }>;
+    expect(tokenRows).toHaveLength(1);
+    expect(tokenRows[0]?.id).toBe(tokenBefore?.id as string);
+    expect(tokenRows[0]?.tokenHash).toBe(await hashDownloadToken(secondPlain as string));
+    expect(tokenRows[0]?.useCount).toBe(0);
+    expect(tokenRows[0]?.lastUsedAt).toBeNull();
+
+    // Rebuild-Invariante: genau EIN created-Event — der one_per_job-
+    // Index kann beim Replay nie kollidieren.
+    const events = (await asRawClient(stack.db).unsafe(
+      `SELECT type FROM kumiko_events WHERE aggregate_type = 'export-download-token'`,
+    )) as unknown as Array<{ type: string }>;
+    expect(events.filter((e) => e.type === "export-download-token.created")).toHaveLength(1);
+    expect(events.some((e) => e.type === "export-download-token.updated")).toBe(true);
+  });
+
   test("failed-Job: kein Token wird generiert", async () => {
     // Bewusst keinen Job — leerer Pending-Pass. Aber wir koennen den
     // failure-Pfad pinnen via runUserExport-Fehler. Einfacher: nur
@@ -602,28 +722,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     // schreibt ZIP, versucht Token-create → UNIQUE hits → throw.
     const jobId = await seedPendingJob();
 
-    // Force UNIQUE-violation: pre-seed eine Token-Row mit jobId via
-    // direct-INSERT (Test-Exemption). Worker's tokenCrud.create wird
-    // dann mit constraintName "read_export_download_tokens_one_per_job"
-    // failen.
-    await asRawClient(stack.db).unsafe(
-      `
-      INSERT INTO read_export_download_tokens
-        (id, tenant_id, job_id, token_hash, issued_at, expires_at, version, inserted_at, modified_at)
-      VALUES (
-        gen_random_uuid(),
-        $1,
-        $2,
-        $3,
-        now(),
-        now() + interval '7 days',
-        1,
-        now(),
-        now()
-      )
-    `,
-      [tenantA, jobId, "existing-hash"],
-    );
+    await seedConflictingDownloadToken(jobId);
 
     const result = await runExportJobs({
       db: stack.db,
@@ -644,6 +743,133 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     expect(row?.errorMessage).toMatch(/Token-Creation failed/);
   });
 
+  test("failed-Job: sendExportFailedEmail wird mit errorMessage + userEmail gerufen", async () => {
+    const jobId = await seedPendingJob();
+
+    await seedConflictingDownloadToken(jobId);
+
+    type SentArgs = {
+      userId: string;
+      userEmail: string;
+      jobId: string;
+      errorMessage: string;
+      tenantId: string;
+    };
+    const sentEmails: SentArgs[] = [];
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async (args) => {
+        sentEmails.push(args);
+      },
+    });
+
+    expect(result.failedJobIds).toContain(jobId);
+    expect(sentEmails).toHaveLength(1);
+    const sent = sentEmails[0];
+    if (!sent) throw new Error("expected 1 sent email");
+    expect(sent.userId).toBe(String(aliceUser.id));
+    expect(sent.userEmail).toBe("alice@example.com");
+    expect(sent.jobId).toBe(jobId);
+    expect(sent.errorMessage).toMatch(/Token-Creation failed/);
+  });
+
+  test("failed-Job ohne Callback: kein Email, Worker-Run succeeded", async () => {
+    const jobId = await seedPendingJob();
+    await seedConflictingDownloadToken(jobId);
+
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      // Kein sendExportFailedEmail
+    });
+    expect(result.failedJobIds).toContain(jobId);
+    // Kein Email, kein Throw — Worker laeuft normal durch
+  });
+
+  test("failed-Job, sendExportFailedEmail-Throw wird abgefangen (best-effort, kein Batch-Abbruch)", async () => {
+    // Two jobs, both forced to fail via the same token-collision mechanism
+    // as the tests above — the callback throws for job A only, proving the
+    // throw doesn't kill the batch loop before job B's callback fires.
+    const bobUser = createTestUser({ id: 8, tenantId: tenantA, roles: ["Member"] });
+    await seedRow(stack.db, userTable, {
+      id: String(bobUser.id),
+      tenantId: tenantA,
+      email: "bob-failed@example.com",
+      passwordHash: "h",
+      displayName: "Bob",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.Active,
+    });
+
+    const jobAId = await seedPendingJob();
+    const jobBId = await seedPendingJob({ user: bobUser });
+    for (const jobId of [jobAId, jobBId]) {
+      await seedConflictingDownloadToken(jobId);
+    }
+
+    const calls: string[] = [];
+    // Should not throw despite job A's callback throwing — the try/catch
+    // around fireExportFailedCallback swallows it (operator-visibility
+    // via console.warn only) and the loop continues to job B. A regress to
+    // a fully silent swallow (no log call at all) would still pass every
+    // assertion below unless the warn itself is pinned.
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async (args) => {
+        calls.push(args.jobId);
+        if (args.jobId === jobAId) {
+          throw new Error("synthetic email transport failure for job A");
+        }
+      },
+    });
+    expect(result.failedJobIds).toEqual(expect.arrayContaining([jobAId, jobBId]));
+    expect(calls.sort()).toEqual([jobAId, jobBId].sort());
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+
+  test("failed-Job, user ohne email → sendExportFailedEmail skipped (kein Throw)", async () => {
+    await resetTestTables(stack.db, [userTable]);
+    await seedRow(stack.db, userTable, {
+      id: String(aliceUser.id),
+      tenantId: tenantA,
+      email: "", // empty string — lookupUserEmail returns null
+      passwordHash: "hashed",
+      displayName: "Alice",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.Active,
+    });
+    const jobId = await seedPendingJob();
+    await seedConflictingDownloadToken(jobId);
+
+    let callbackInvoked = false;
+    const result = await runExportJobs({
+      db: stack.db,
+      registry: stack.registry,
+      buildStorageProvider: buildProvider,
+      now: NOW(),
+      sendExportFailedEmail: async () => {
+        callbackInvoked = true;
+      },
+    });
+    expect(result.failedJobIds).toContain(jobId);
+    expect(callbackInvoked).toBe(false);
+  });
+
   test("failed-Job mit downloadStorageKey → ZIP wird im Cleanup-Pass entfernt (orphan-fix)", async () => {
     // Atom 4a.fix orphan-cleanup: failed-Jobs haben downloadStorageKey
     // gesetzt (path-pre-claim) — der ZIP-Pfad ist persistiert ab claim.
@@ -729,6 +955,10 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
             },
           ],
         }),
+        // no-op: this fixture exercises only the export/file path; the erase
+        // side is covered by forget-*.integration.test.ts. Required so the
+        // V2 boot gate (export-without-erase) does not reject the stack.
+        delete: async () => {},
       });
     });
 
@@ -737,6 +967,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        authFoundationFeature,
         createSessionsFeature(),
 
         createUserDataRightsFeature(),
@@ -997,7 +1228,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     expect(sent.userEmail).toBe("alice@example.com");
     expect(sent.jobId).toBe(jobId);
     expect(sent.downloadUrl).toMatch(
-      /^https:\/\/app\.example\.com\/user-export\/by-token\?token=[A-Za-z0-9_%-]+$/,
+      /^https:\/\/app\.example\.com\/user-export\/by-token#token=[A-Za-z0-9_%-]+$/,
     );
     // plain-token aus dem callback-arg entspricht dem result.tokenByJobId
     const plainFromResult = result.tokenByJobId.get(jobId);
@@ -1044,7 +1275,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
-      email: "" as string, // empty string — lookupUserEmail returnt null
+      email: "" as string, // empty string — lookupUserEmail returns null
       passwordHash: "h",
       displayName: "Alice",
       locale: "de",