@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,15 +1,22 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+// Value-only import, aliased to avoid shadowing the ambient global
+// `Temporal` TYPE that gracePeriodEndCutoff's parameter type resolves
+// against (same #1438 dual-package-hazard pattern as event-store.ts).
+import { Temporal as TemporalPolyfill } from "temporal-polyfill";
 import { userTable } from "../../../user";
 
 export async function selectUsersDueForForgetCleanup(
   db: DbConnection,
   status: string,
-  gracePeriodEndCutoff: Temporal.Instant | string,
+  gracePeriodEndCutoff: InstanceType<typeof TemporalPolyfill.Instant> | string,
 ): Promise<readonly { id: string }[]> {
+  // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
+  // at runtime, distinct nominal types across the two .d.ts sources (see
+  // event-store.ts). Only ever consumed via the `lte` comparison below.
   const cutoff =
     typeof gracePeriodEndCutoff === "string"
-      ? Temporal.Instant.from(gracePeriodEndCutoff)
+      ? TemporalPolyfill.Instant.from(gracePeriodEndCutoff)
       : gracePeriodEndCutoff;
   return selectMany<{ id: string }>(db, userTable, {
     status,

package/src/user-data-rights/email-templates.ts

@@ -117,7 +117,7 @@ export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): Render
     <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t.exportReadyButton })}</p>
     <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t.exportReadyExpiry(formatTimestamp(args.expiresAt)))}</p>
     ${renderFallbackUrl({ url: args.downloadUrl, label: t.fallbackUrl })}`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
@@ -128,7 +128,7 @@ export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): Rend
   const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.exportFailedIntro(app))}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderDeletionRequestedEmail(
@@ -142,7 +142,7 @@ export function renderDeletionRequestedEmail(
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionRequestedIntro(app, formatTimestamp(args.gracePeriodEnd)))}</p>
     <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t.deletionRequestedCancel)}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
@@ -153,7 +153,7 @@ export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArg
   const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionExecutedIntro(app, formatTimestamp(args.executedAt)))}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 function wrapCell(bodyHtml: string): string {
@@ -162,9 +162,9 @@ function wrapCell(bodyHtml: string): string {
 
 // Plain inline-styled HTML — gespiegelt von auth-email-password.
 // guard:dup-ok — Email-HTML (table-layout, inline CSS) ≠ Web-HTML (legal-pages/markdown.ts)
-function renderShell(args: { title: string; bodyHtml: string }): string {
+function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
   return `<!DOCTYPE html>
-<html lang="en">
+<html lang="${args.locale}">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />

package/src/user-data-rights/feature.ts

@@ -5,6 +5,7 @@ import {
   type FeatureDefinition,
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks";
 import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
@@ -28,6 +29,7 @@ import {
 import { requestExportWrite } from "./handlers/request-export.write";
 import { restrictAccountWrite } from "./handlers/restrict-account.write";
 import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write";
+import { USER_DATA_RIGHTS_I18N } from "./i18n";
 import {
   type GdprMailDefaults,
   isMailTransportAvailable,
@@ -43,7 +45,11 @@ import {
   type SendExportFailedEmailFn,
   type SendExportReadyEmailFn,
 } from "./run-export-jobs";
-import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "./run-forget-cleanup";
+import {
+  runForgetCleanup,
+  type SendDeletionExecutedEmailFn,
+  sanitizeReasonForLog,
+} from "./run-forget-cleanup";
 import { downloadAttemptEntity } from "./schema/download-attempt";
 import { exportDownloadTokenEntity } from "./schema/download-token";
 import { exportJobEntity } from "./schema/export-job";
@@ -86,7 +92,7 @@ export type UserDataRightsOptions = {
   readonly sendExportFailedEmail?: SendExportFailedEmailFn;
   /** Base-URL fuer den Magic-Link, z.B.
    *  "https://app.example.com/user-export/by-token". Worker bauen
-   *  `${appExportDownloadUrl}?token=<plain>`. Required wenn
+   *  a URL fragment (`#token=<plain>`, issue #1271). Required wenn
    *  sendExportReadyEmail gesetzt. Per-Tenant via reverse-proxy host
    *  routing — nicht via per-Tenant-config-key (App-Author-Decision). */
   readonly appExportDownloadUrl?: string;
@@ -154,20 +160,26 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     r.extendsRegistrar(EXT_USER_DATA, {});
 
+    // GDPR-storage guards V2+V3 (#1314) — moved off the framework-internal
+    // boot-validator onto this feature's own r.bootCheck(), since it's the
+    // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
+    // usage already requires user-data-rights to be mounted.
+    r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
+    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
     // (would harm co-members). An app with one user per tenant sets this to
     // "single-user" via appOverrides (TENANT_MODEL_CONFIG_KEY) so the forget
     // pipeline may erase the tenant's data as that user's personal data — still
     // gated by a runtime sole-member check in run-forget-cleanup.
-    r.config({
-      keys: {
-        tenantModel: createSystemConfig("select", {
-          default: "multi-user",
-          options: ["single-user", "multi-user"],
-        }),
-      },
-    });
+    r.config(
+      "tenantModel",
+      createSystemConfig("select", {
+        default: "multi-user",
+        options: ["single-user", "multi-user"],
+      }),
+    );
 
     // S2.U3 Atom 1b — ExportJob-Lifecycle-Entity.
     r.entity("export-job", exportJobEntity);
@@ -249,9 +261,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.queryHandler(myAuditLogQuery);
     r.queryHandler(listDownloadAttemptsQuery);
 
-    // Read-only operator inspector over the GDPR read-models (SystemAdmin).
-    // Convention list/detail handlers so entityList/entityEdit resolve by QN;
-    // the screens stay inert until an app navs them (opt-in at wire time).
+    // Read-only GDPR operator inspector (SystemAdmin) — screens stay inert until an app navs them.
     r.queryHandler(exportJobListQuery);
     r.queryHandler(exportJobDetailQuery);
     r.queryHandler(downloadAttemptListQuery);
@@ -259,6 +269,17 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.screen(exportJobDetailScreen);
     r.screen(downloadAttemptListScreen);
 
+    r.nav({
+      id: "export-job-list",
+      label: "user-data-rights:nav.exportJobs",
+      icon: "download",
+      screen: "user-data-rights:screen:export-job-list",
+      order: 25,
+      access: { roles: ["SystemAdmin"] },
+    });
+
+    r.translations({ keys: USER_DATA_RIGHTS_I18N });
+
     // Dormant Self-Service-Screen (Art. 15/17/18/20): Export, Aktivitäts-
     // protokoll, Einschränkung, Löschung in einem Screen. Kein r.nav — die
     // App platziert ihn im eingeloggten Bereich. Die React-Component kommt
@@ -273,10 +294,20 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       access: { openToAll: true },
     });
 
-    // Magic-Link-Pfad (anonymous): GET /user-export/by-token?token=<plain>.
-    // Ruft via app.fetch /api/query → success: 302-Redirect zur signed-URL →
-    // Browser folgt → Download startet beim Object-Store. Bei error:
-    // passthrough (404/410/501) als JSON.
+    // Magic-link path (anonymous): the email link carries the token as a
+    // URL fragment (`#token=<plain>`) instead of a query param — fragments
+    // never leave the browser, so they never hit proxy/access logs
+    // (issue #1271). This route only serves the interstitial page; the
+    // external script reads the fragment client-side and exchanges the
+    // token via POST for the signed URL.
+    //
+    // No `?token=` query fallback: framework is zero-legacy (#1512) — no
+    // live customer data / no pre-#1271 emails in flight that would need
+    // bridging, so there's nothing a fallback would need to cover. A query
+    // param reaches the server as part of the request URL and gets written
+    // to proxy/access logs regardless of what the handler does with it
+    // afterward (a redirect doesn't undo an already-logged request) — the
+    // only leak-proof fix is to never accept the token that way.
     //
     // Path liegt AUSSERHALB /api/* weil r.httpRoute den /api-namespace nicht
     // claimen darf (reserved fuer write/query/batch/auth/sse-dispatcher).
@@ -289,23 +320,76 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       method: "GET",
       path: "/user-export/by-token",
       anonymous: true,
+      handler: async (c) => {
+        return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
+          "content-type": "text/html; charset=utf-8",
+        });
+      },
+    });
+
+    // External script for the interstitial page above — same-origin file
+    // instead of inline <script>, so the page also works under a strict
+    // `script-src 'self'` CSP (apps set CSP via the security-headers
+    // option, without assuming `unsafe-inline`).
+    r.httpRoute({
+      method: "GET",
+      path: "/user-export/by-token.js",
+      anonymous: true,
+      handler: async (c) => {
+        return c.body(TOKEN_EXCHANGE_PAGE_JS, 200, {
+          "content-type": "application/javascript; charset=utf-8",
+        });
+      },
+    });
+
+    // Exchange endpoint for the interstitial page: the token arrives here
+    // as a POST body instead of a query string (issue #1271). A dedicated
+    // route rather than letting the browser JS call /api/query directly,
+    // for two reasons:
+    //   1. IP/UA audit — extractAuditMeta needs the raw request headers,
+    //      which only the server has, not the browser (see the GET path
+    //      above). Without this route every fragment-path download would
+    //      land in download-attempt with lastUsedFromIp/UA = null.
+    //   2. /api/query is the reserved dispatcher namespace for
+    //      authenticated writes/queries — an anonymous cross-origin POST
+    //      there isn't guaranteed to be reachable (origin guard).
+    r.httpRoute({
+      method: "POST",
+      path: "/user-export/by-token",
+      anonymous: true,
       handler: async (c, { app }) => {
         const url = new URL(c.req.url);
-        const token = url.searchParams.get("token");
-        if (!token) {
+        const parsedBody = await c.req.json().catch(() => null);
+        const token =
+          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
+            ? (parsedBody as { token?: unknown }).token
+            : undefined;
+        if (typeof token !== "string" || token.length === 0) {
           return c.json({ error: "missing_token" }, 400);
         }
-        const queryRes = await app.fetch(
+        const auditMeta = extractAuditMeta(c.req.raw.headers);
+        return app.fetch(
           new Request(`${url.origin}/api/query`, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+              "content-type": "application/json",
+              // download-by-token.query.ts's `rateLimit: { per: "ip", limit: 30 }`
+              // keys off request-id-middleware's own x-forwarded-for read on
+              // THIS internal request — without forwarding it, every fragment-
+              // POST download shares the request's own (empty/localhost) IP,
+              // turning the per-user 30/min backstop into one global bucket
+              // (#1307). Forwarding the same value extractAuditMeta already
+              // computed from the original request's headers doesn't widen the
+              // trust boundary: it's the identical XFF-trusts-first-hop model
+              // request-id-middleware.ts already applies framework-wide.
+              ...(auditMeta.ip ? { "x-forwarded-for": auditMeta.ip } : {}),
+            },
             body: JSON.stringify({
               type: "user-data-rights:query:download-by-token",
-              payload: { token, auditMeta: extractAuditMeta(c.req.raw.headers) },
+              payload: { token, auditMeta },
             }),
           }),
         );
-        return mapQueryResponseToRedirect(c, queryRes);
       },
     });
 
@@ -435,7 +519,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
             ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
             : undefined);
 
-        await runForgetCleanup({
+        const forgetResult = await runForgetCleanup({
           db: forgetDb,
           registry: forgetRegistry,
           now: T.Now.instant(),
@@ -452,30 +536,24 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           }),
           ...(sendDeletionExecutedEmail && { sendDeletionExecutedEmail }),
         });
+
+        // Persist each incomplete report on the job-run log (#1572). The write
+        // handler returns incomplete[] in its response; the cron path used to
+        // discard the array (only a console.warn for rolledBack cases).
+        // ctx.log feeds createJobRunLogger → store_job_run_logs.
+        for (const entry of forgetResult.incomplete) {
+          ctx.log?.warn?.(
+            `[user-data-rights:run-forget-cleanup] incomplete hook ` +
+              `userId=${entry.userId} tenantId=${entry.tenantId} ` +
+              `entityName=${entry.entityName} rolledBack=${entry.rolledBack} ` +
+              `reason=${sanitizeReasonForLog(entry.reason)}`,
+          );
+        }
       },
     );
   });
 }
 
-// Map /api/query-Response auf 302-Redirect oder Error-Passthrough.
-async function mapQueryResponseToRedirect(
-  c: import("hono").Context,
-  queryRes: Response,
-): Promise<Response> {
-  if (!queryRes.ok) {
-    const errorBody = await queryRes.text();
-    const statusCode = queryRes.status as 400 | 401 | 404 | 410 | 500; // @cast-boundary engine-payload
-    return c.body(errorBody, statusCode, {
-      "content-type": queryRes.headers.get("content-type") ?? "application/json",
-    });
-  }
-  const body = (await queryRes.json()) as { data?: { url?: string } }; // @cast-boundary engine-payload
-  if (!body.data?.url) {
-    return c.json({ error: "download_resolution_failed" }, 500);
-  }
-  return c.redirect(body.data.url, 302);
-}
-
 // Extract Audit-Meta (IP + UA) aus den HTTP-Headers + steck es in die
 // query-payload. Der httpRoute-Wrapper ist trusted-source — er hat den
 // raw-request gesehen, nicht der direkter /api/query-Caller. User der
@@ -495,3 +573,44 @@ function extractAuditMeta(headers: Headers): { ip: string | null; userAgent: str
   }
   return { ip, userAgent: headers.get("user-agent") };
 }
+
+// Interstitial page for the magic-link fragment exchange (see the
+// httpRoute above). Plain static markup — no build step, no i18n lookup
+// (the server doesn't know a user locale here; anonymous path).
+const TOKEN_EXCHANGE_PAGE_HTML = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>Export Download</title></head>
+<body>
+<p id="status">Preparing your download…</p>
+<script src="/user-export/by-token.js"></script>
+</body>
+</html>`;
+
+// Reads the token client-side from the URL fragment (never sent to the
+// server) and exchanges it via POST for the signed URL. Same-origin
+// external file instead of inline <script>, so the page also works under
+// a strict `script-src 'self'` CSP.
+const TOKEN_EXCHANGE_PAGE_JS = `(async () => {
+  const status = document.getElementById("status");
+  const params = new URLSearchParams(location.hash.slice(1));
+  const token = params.get("token");
+  if (!token) {
+    status.textContent = "Invalid download link.";
+    return;
+  }
+  try {
+    const res = await fetch("/user-export/by-token", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ token }),
+    });
+    const body = await res.json();
+    if (!res.ok || !body || !body.data || !body.data.url) {
+      status.textContent = "This download link is invalid or has expired.";
+      return;
+    }
+    location.href = body.data.url;
+  } catch {
+    status.textContent = "Could not start the download.";
+  }
+})();`;

package/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -2,9 +2,12 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { isWithinGracePeriod } from "../../shared";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
+export { isWithinGracePeriod };
+
 // POST /api/user/cancel-deletion (S2.U5).
 //
 // Innerhalb der Grace-Period kann User seinen Forget-Antrag zurueck-
@@ -24,11 +27,10 @@ export const cancelDeletionWrite = defineWriteHandler({
     // ctx.db.raw (kein TenantDb-Wrapper) weil User-Entity tenant-agnostisch
     // ist — siehe request-deletion.write.ts fuer die Begruendung. Cancel
     // muss aus jedem Tenant-Mode den User finden + zuruecksetzen koennen.
-    const row = await fetchOne<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
-      ctx.db.raw,
-      userTable,
-      { id: event.user.id },
-    );
+    const row = await fetchOne<{
+      status: string;
+      gracePeriodEnd: Temporal.Instant | null;
+    }>(ctx.db.raw, userTable, { id: event.user.id });
 
     if (!row) {
       return writeFailure(
@@ -49,12 +51,7 @@ export const cancelDeletionWrite = defineWriteHandler({
       );
     }
 
-    const gracePeriodEnd = row.gracePeriodEnd;
-    const inGrace =
-      gracePeriodEnd != null &&
-      Temporal.Instant.compare(gracePeriodEnd, Temporal.Now.instant()) > 0;
-
-    if (!inGrace) {
+    if (!isWithinGracePeriod(row.gracePeriodEnd)) {
       return writeFailure(
         new UnprocessableError("grace_period_expired", {
           details: { reason: "grace_period_expired" },

package/src/user-data-rights/handlers/deletion-grace-period.ts

@@ -3,6 +3,7 @@ import { addDurationSpec, type DurationSpec } from "@cosmicdrift/kumiko-framewor
 import { createSystemUser, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { decryptStoredPii } from "../../shared";
 import { USER_STATUS, userTable } from "../../user";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle";
 
@@ -73,7 +74,9 @@ export async function startDeletionGracePeriod(
   return {
     ok: true,
     gracePeriodEnd,
-    userEmail: userRow["email"] ?? "",
+    userEmail: userRow["email"]
+      ? await decryptStoredPii(userRow["email"], "email", "user-data-rights:grace-period")
+      : "",
     userLocale: userRow["locale"] ?? null,
   };
 }

package/src/user-data-rights/handlers/download-by-job.query.ts

@@ -25,12 +25,16 @@
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 
@@ -63,13 +67,11 @@ export const downloadByJobQuery = defineQueryHandler({
     const userId = query.user.id;
     const jobId = query.payload.jobId;
     const tenantId = query.user.tenantId;
-    // IP aus dem request-scoped Kontext (von requestIdMiddleware aus
-    // x-forwarded-for befuellt) — server-trusted, anders als ein vom Client
-    // mitgeschickter Wert. UA steht nicht im RequestContext; der Audit-Row
-    // laesst sie null (best-effort, via requestId in den Server-Logs
-    // cross-referenzierbar).
+    // IP + UA aus dem request-scoped Kontext (von requestIdMiddleware
+    // befuellt) — server-trusted, anders als ein vom Client mitgeschickter
+    // Wert (603/2).
     const auditIp = requestContext.get()?.ip ?? null;
-    const auditUa: string | null = null;
+    const auditUa = requestContext.get()?.userAgent ?? null;
 
     // Step 1-2: job-lookup + cross-user-isolation
     // ctx.db.raw weil tenant-agnostisch — Alice in Tenant B sucht den
@@ -78,7 +80,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (!jobRow || jobRow.userId !== userId) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "notFound",
@@ -96,7 +98,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (jobRow.status !== EXPORT_JOB_STATUS.Done) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "failed",
@@ -113,7 +115,7 @@ export const downloadByJobQuery = defineQueryHandler({
     }
     if (!jobRow.downloadStorageKey) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "expired",
@@ -129,14 +131,20 @@ export const downloadByJobQuery = defineQueryHandler({
       });
     }
 
-    const provider = await createFileProviderForTenant(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-job",
-    );
+    // Provider bound explicitly to the job's tenant — NOT the ambient
+    // session tenant (cross-tenant-same-user: job.requestedFromTenantId
+    // can differ from query.user.tenantId).
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-job",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId,
         now,
         result: "signedUrlNotSupported",
@@ -173,7 +181,7 @@ export const downloadByJobQuery = defineQueryHandler({
 
     if (tokenRow) {
       await recordDownloadUse({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tokenId: tokenRow.id,
         tokenVersion: tokenRow.version,
         tokenUseCount: tokenRow.useCount ?? 0,

package/src/user-data-rights/handlers/download-by-token.query.ts

@@ -1,7 +1,7 @@
 // GET /api/query → user-data-rights:query:download-by-token (S2.U3 Atom 4b).
 //
 // **Magic-Link-Pfad** (anonymous): User klickt Email-Link mit
-// `?token=<plain>`. Worker hat beim done-flip Token-Hash in DB
+// `#token=<plain>` (URL fragment, issue #1271). Worker hat beim done-flip Token-Hash in DB
 // persistiert (Atom 4a). Verify-Pipeline:
 //
 //   1. hashDownloadToken(plain) → fetchOne in download-tokens
@@ -27,12 +27,16 @@
 // startet. Dieser query-handler liefert nur das JSON.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineQueryHandler,
+  SYSTEM_USER_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
-import { createFileProviderForTenant } from "../../file-foundation";
 import { recordDownloadUse, recordInvalidAttempt } from "../audit-download";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { exportDownloadTokensTable } from "../schema/download-token";
 import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job";
 import { hashDownloadToken } from "../token-helpers";
@@ -119,7 +123,7 @@ export const downloadByTokenQuery = defineQueryHandler({
       );
       if (jobForAudit) {
         await recordInvalidAttempt({
-          db: ctx.db.raw,
+          db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
           tenantId: jobForAudit.requestedFromTenantId,
           now,
           result: "expired",
@@ -148,7 +152,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     }
     if (jobRow.status !== EXPORT_JOB_STATUS.Done) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "failed",
@@ -165,7 +169,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     }
     if (!jobRow.downloadStorageKey) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "expired",
@@ -181,16 +185,20 @@ export const downloadByTokenQuery = defineQueryHandler({
       });
     }
 
-    // Step 5: signed-URL via provider. createFileProviderForTenant nutzt
-    // requestedFromTenantId (gleicher Tenant wie beim Worker-Storage-Write).
-    const provider = await createFileProviderForTenant(
-      ctx,
-      jobRow.requestedFromTenantId,
-      "user-data-rights:query:download-by-token",
-    );
+    // Step 5: signed-URL via provider, explicitly bound to the job's
+    // tenant — NOT the ambient request tenant (anonymous magic-link path
+    // has none under resolverTrust: "authoritative").
+    const provider = await makeTenantStorageProviderResolver({
+      registry: ctx.registry,
+      configResolver: ctx.configResolver,
+      secrets: ctx.secrets,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
+      userId: SYSTEM_USER_ID,
+      handlerName: "user-data-rights:query:download-by-token",
+    })(jobRow.requestedFromTenantId as TenantId); // @cast-boundary engine-payload: TenantId brand
     if (!provider.getSignedUrl) {
       await recordInvalidAttempt({
-        db: ctx.db.raw,
+        db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
         tenantId: jobRow.requestedFromTenantId,
         now,
         result: "signedUrlNotSupported",
@@ -221,7 +229,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Wrapper (trusted-source). Direct-API-caller koennen luegen, aber
     // Audit ist nicht security-relevant.
     await recordDownloadUse({
-      db: ctx.db.raw,
+      db: ctx.db.raw as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
       tokenId: tokenRow.id,
       tokenVersion: tokenRow.version,
       tokenUseCount: tokenRow.useCount ?? 0,