@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/run-forget-cleanup.ts

@@ -33,7 +33,12 @@
 // retried automatisch).
 
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  configuredPiiSubjectKms,
+  type KmsAdapter,
+  subjectIdToKey,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { type DbRunner, nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
@@ -46,6 +51,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
+import { decryptStoredPii } from "../shared";
 import { tenantMembershipsTable } from "../tenant";
 import { USER_STATUS, userTable } from "../user";
 import { selectUsersDueForForgetCleanup } from "./db/queries/forget-cleanup";
@@ -101,6 +107,15 @@ export interface RunForgetCleanupArgs {
     tenantId: TenantId,
   ) => Promise<UserDataStorageProvider | undefined>;
 
+  /**
+   * KMS for crypto-shredding: erases the per-user subject key after the
+   * delete-hooks, inside the per-user sub-tx, right before the status flip.
+   * Defaults to the boot-configured adapter (configurePiiSubjectKms);
+   * explicit arg is the test seam. Omitted + none configured → plaintext
+   * deployment, nothing to shred.
+   */
+  readonly kms?: KmsAdapter;
+
   /**
    * App-level tenant-occupancy model (resolved from the `tenantModel` config by
    * the cron/handler). The pipeline refines it PER TENANT with a sole-member
@@ -118,6 +133,24 @@ export interface ForgetCleanupError {
   readonly message: string;
 }
 
+/** A hook reporting `{status:"incomplete", reason}` — no throw, no
+ *  rollback, the user still gets flipped to Deleted (see Header
+ *  "incomplete is not a hard failure"). Collected for operator
+ *  visibility, NOT in `errors` (those stand for hook throws + rollback). */
+export interface ForgetCleanupIncomplete {
+  readonly userId: string;
+  readonly tenantId: TenantId;
+  readonly entityName: string;
+  readonly reason: string;
+  /** True when a LATER hook in the same user's sub-tx threw, rolling back
+   *  the DB rows (including the status flip) — but this hook's own
+   *  non-transactional side effect (e.g. an already-issued S3 delete,
+   *  a provider API call) already ran and does NOT get undone by that
+   *  rollback. The user is still DeletionRequested and will retry, but
+   *  this partial external effect needs its own operator follow-up. */
+  readonly rolledBack: boolean;
+}
+
 export interface RunForgetCleanupResult {
   /** User die in diesem Lauf von DeletionRequested → Deleted geflippt wurden. */
   readonly processedUserIds: readonly string[];
@@ -125,6 +158,8 @@ export interface RunForgetCleanupResult {
   readonly hookCallsAttempted: number;
   /** Hook-Errors fuer Operator-Visibility. Lauf bricht nicht ab — siehe Header. */
   readonly errors: readonly ForgetCleanupError[];
+  /** Hooks that reported `{status:"incomplete"}` — partial success, user still Deleted. */
+  readonly incomplete: readonly ForgetCleanupIncomplete[];
 }
 
 interface HookEntry {
@@ -140,21 +175,31 @@ interface HookEntry {
 // hook that nulls that column. See custom-fields wire-user-data-rights.ts.
 const HOOK_ORDER_DEFAULT = EXT_USER_DATA_ORDER.DEFAULT;
 
+// Hook-reported reasons are external input (provider error messages can embed
+// user-controlled filenames/emails) — strip newlines before a single-line
+// console.warn so a crafted reason can't forge extra log lines, and cap the
+// length against a log-flood. The unsanitized reason still lands in the
+// returned `incomplete` entry untouched.
+export function sanitizeReasonForLog(reason: string): string {
+  return reason.replace(/[\r\n]+/g, " ").slice(0, 500);
+}
+
 export async function runForgetCleanup(
   args: RunForgetCleanupArgs,
 ): Promise<RunForgetCleanupResult> {
   const { db, registry, now, sendDeletionExecutedEmail, buildStorageProvider } = args;
+  const kms = args.kms ?? configuredPiiSubjectKms();
   const appTenantModel: TenantUserModel = args.tenantModel ?? "multi-user";
 
   // Step 1: Find users with expired grace period.
   const dueUsers = await selectUsersDueForForgetCleanup(
-    db,
+    db as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,
     USER_STATUS.DeletionRequested,
     now.toString(),
   );
 
   if (dueUsers.length === 0) {
-    return { processedUserIds: [], hookCallsAttempted: 0, errors: [] };
+    return { processedUserIds: [], hookCallsAttempted: 0, errors: [], incomplete: [] };
   }
 
   // Step 2: Sammle alle EXT_USER_DATA-Usages einmalig — Liste der
@@ -176,6 +221,7 @@ export async function runForgetCleanup(
     .sort((a, b) => a.order - b.order);
 
   const errors: ForgetCleanupError[] = [];
+  const incomplete: ForgetCleanupIncomplete[] = [];
   const processedUserIds: string[] = [];
   let hookCallsAttempted = 0;
 
@@ -188,9 +234,11 @@ export async function runForgetCleanup(
       hookEntries,
       buildStorageProvider,
       appTenantModel,
+      kms,
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
+    incomplete.push(...userResult.incomplete);
     if (userResult.success) {
       processedUserIds.push(user.id);
 
@@ -224,13 +272,14 @@ export async function runForgetCleanup(
     }
   }
 
-  return { processedUserIds, hookCallsAttempted, errors };
+  return { processedUserIds, hookCallsAttempted, errors, incomplete };
 }
 
 interface ProcessUserResult {
   readonly success: boolean;
   readonly hookCallsAttempted: number;
   readonly errors: readonly ForgetCleanupError[];
+  readonly incomplete: readonly ForgetCleanupIncomplete[];
   /** Atom 5b: userEmail VOR Tx gecacht (user-Hook anonymisiert in Tx).
    *  null wenn user-Row beim Pre-Tx-Lookup nicht (mehr) existiert oder
    *  email leer ist. */
@@ -248,9 +297,11 @@ async function processUser(args: {
   hookEntries: readonly HookEntry[];
   buildStorageProvider?: (tenantId: TenantId) => Promise<UserDataStorageProvider | undefined>;
   appTenantModel: TenantUserModel;
+  kms?: KmsAdapter;
 }): Promise<ProcessUserResult> {
-  const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel } = args;
+  const { db, registry, userId, hookEntries, buildStorageProvider, appTenantModel, kms } = args;
   const errors: ForgetCleanupError[] = [];
+  const incomplete: Omit<ForgetCleanupIncomplete, "rolledBack">[] = [];
   let hookCallsAttempted = 0;
 
   // Atom 5b — userEmail VOR der Tx cachen. user-Hook (user-data-rights-
@@ -262,7 +313,9 @@ async function processUser(args: {
     id: userId,
   });
   const userEmailBeforeDelete =
-    userPreTx?.email && userPreTx.email.length > 0 ? userPreTx.email : null;
+    userPreTx?.email && userPreTx.email.length > 0
+      ? await decryptStoredPii(userPreTx.email, "email", "user-data-rights:forget-cleanup")
+      : null;
   const userLocaleBeforeDelete = userPreTx?.locale ?? null;
 
   // Memberships fuer diesen User holen — alle Tenants in denen er Mitglied ist.
@@ -313,9 +366,10 @@ async function processUser(args: {
           const strategy = policyToStrategy(policy.policy?.strategy ?? null);
 
           hookCallsAttempted++;
-          await entry.deleteHook(
+          const hookResult = await entry.deleteHook(
             {
               db: tx,
+              registry,
               tenantId,
               userId,
               buildStorageProvider,
@@ -324,9 +378,52 @@ async function processUser(args: {
             },
             strategy,
           );
+          // "incomplete" is not a hard failure (see Header): no throw,
+          // no rollback, eraseKey + status flip proceed unchanged.
+          // Only collected + logged for operator visibility.
+          if (hookResult?.status === "incomplete") {
+            incomplete.push({
+              userId,
+              tenantId,
+              entityName: entry.entityName,
+              reason: hookResult.reason,
+            });
+            // biome-ignore lint/suspicious/noConsole: operator-visibility for partial hook completion
+            console.warn(
+              `[user-data-rights:run-forget-cleanup] hook incomplete userId=${userId} tenantId=${tenantId} entityName=${entry.entityName} reason=${sanitizeReasonForLog(hookResult.reason)}`,
+            );
+          }
         }
       }
 
+      // Crypto-shredding: erase the user's subject key AFTER the hooks and
+      // BEFORE the status flip. The KMS is not a tx participant, so ordering
+      // is what makes this crash-safe: eraseKey-throw → tx rollback → user
+      // stays DeletionRequested → next run retries; flip-throw after a
+      // successful erase → retry re-runs the idempotent hooks and eraseKey
+      // (contractually a no-op on an erased/unknown subject). Erasing after
+      // the flip instead would risk a permanent silent miss: user already
+      // Deleted, no run ever picks him up again, key stays live.
+      if (kms) {
+        await kms.eraseKey(
+          { kind: "user", userId },
+          {
+            requestId: "user-data-rights:run-forget-cleanup",
+            userId,
+            eraseReason: "user-data-rights:forget",
+          },
+        );
+        // Blind-Index-Sweep (#818): bidx-Spalten des erased Subjects sofort
+        // nullen — sonst bliebe der deterministische HMAC bis zum nächsten
+        // Rebuild equality-matchbar (Linkage-Fenster). In der Sub-Tx, damit
+        // ein Rollback auch den Sweep zurücknimmt.
+        await nullBlindIndexesForSubject(
+          tx,
+          registry.features,
+          subjectIdToKey({ kind: "user", userId }),
+        );
+      }
+
       // Status-Flip in derselben Sub-Tx. Falls einer der Hooks oben
       // geworfen hat, kommen wir hier nicht an — die Tx rollback'd
       // alles, der User bleibt im DeletionRequested-Status, naechster
@@ -350,6 +447,14 @@ async function processUser(args: {
     success: txSucceeded,
     hookCallsAttempted,
     errors,
+    // Reported either way — a rolled-back sub-tx doesn't undo an
+    // "incomplete" hook's own non-transactional side effect (S3 delete,
+    // provider call), so dropping the report entirely would hide exactly
+    // the case its own reason string describes ("would report a
+    // not-yet-deleted user as partially cleaned up" — true of the DB rows,
+    // not of that external effect). `rolledBack` lets the operator tell
+    // the two situations apart instead of losing the signal outright.
+    incomplete: incomplete.map((i) => ({ ...i, rolledBack: !txSucceeded })),
     userEmailBeforeDelete,
     userLocaleBeforeDelete,
     tenantIdsBeforeDelete,

package/src/user-data-rights/run-user-export.ts

@@ -21,7 +21,17 @@
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
 
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  collectEncryptedFieldNames,
+  configuredEntityFieldEncryption,
+  decryptEntityFieldValues,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   EXT_USER_DATA,
   type Registry,
@@ -137,8 +147,9 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   for (const tenantId of tenantList) {
     const entities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({ db, tenantId, userId });
-      if (snippet === null) continue;
+      const rawSnippet = await entry.exportHook({ db, registry, tenantId, userId });
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       entities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -169,12 +180,14 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   if (tenantList.length === 0 && hookEntries.length > 0) {
     const orphanEntities: UserDataExportSnippet[] = [];
     for (const entry of hookEntries) {
-      const snippet = await entry.exportHook({
+      const rawSnippet = await entry.exportHook({
         db,
+        registry,
         tenantId: SYSTEM_TENANT_ID_FOR_ORPHANS,
         userId,
       });
-      if (snippet === null) continue;
+      if (rawSnippet === null) continue;
+      const snippet = await decryptSnippetFields(registry, entry.entityName, rawSnippet);
       orphanEntities.push(snippet);
       if (snippet.fileRefs) {
         for (const ref of snippet.fileRefs) {
@@ -203,6 +216,59 @@ export async function runUserExport(args: RunUserExportArgs): Promise<UserExport
   };
 }
 
+// Art. 20 verlangt die DATEN, nicht deren Ciphertext: Export-Hooks lesen
+// raw rows an der Executor-Decrypt-Schicht vorbei, darum entschluesselt
+// dieser zentrale Pass encrypted entity fields nach jedem Hook. Ohne
+// konfigurierten Cipher wird ein expliziter Marker exportiert statt den
+// base64-Blob als "Wert" auszuliefern (leak-by-confusion).
+const ENCRYPTED_UNAVAILABLE = "[encrypted:unavailable]";
+
+async function decryptSnippetFields(
+  registry: Registry,
+  hookEntityName: string,
+  snippet: UserDataExportSnippet,
+): Promise<UserDataExportSnippet> {
+  let rows = snippet.rows;
+
+  const entity = registry.getEntity(snippet.entity) ?? registry.getEntity(hookEntityName);
+  if (entity) {
+    const encryptedFields = collectEncryptedFieldNames(entity);
+    if (encryptedFields.size > 0) {
+      const cipher = configuredEntityFieldEncryption();
+      rows = await Promise.all(
+        rows.map(async (row) => {
+          if (cipher) return decryptEntityFieldValues(row, encryptedFields, cipher);
+          const out = { ...row };
+          for (const name of encryptedFields) {
+            if (typeof out[name] === "string") out[name] = ENCRYPTED_UNAVAILABLE;
+          }
+          return out;
+        }),
+      );
+    }
+  }
+
+  // PII-Subject-Ciphertexte (kumiko-pii:) sind self-describing — kein
+  // Entity-Kontext noetig, deckt jeden heutigen und kuenftigen Hook ab.
+  // Erased Subject → Sentinel (ehrlich: der Wert ist geshreddet).
+  const kms = configuredPiiSubjectKms();
+  rows = await Promise.all(
+    rows.map(async (row) => {
+      const piiKeys = Object.keys(row).filter((k) => isPiiCiphertext(row[k]));
+      if (piiKeys.length === 0) return row;
+      if (!kms) {
+        const out = { ...row };
+        for (const k of piiKeys) out[k] = ENCRYPTED_UNAVAILABLE;
+        return out;
+      }
+      return decryptPiiFieldValues(row, piiKeys, kms, {
+        requestId: "user-data-rights:export",
+      });
+    }),
+  );
+  return { ...snippet, rows };
+}
+
 // Pseudo-Tenant fuer User ohne aktive Memberships. Identisch zum
 // Pattern in run-forget-cleanup.ts — RFC4122-Null-UUID. Tenant-scoped
 // Hooks finden hier nichts (no-op).

package/src/user-data-rights/schema/download-token.ts

@@ -93,9 +93,11 @@ export const exportDownloadTokenEntity = createEntity({
     }),
   },
 
-  // 1 Token pro Job. UNIQUE auf jobId — garantiert dass Worker-
-  // Idempotency (Atom 3b's "2× run done-Job → no-op") auch fuer
-  // Token-Generierung gilt: zweiter Versuch faellt auf Constraint.
+  // 1 Token pro Job. UNIQUE auf jobId — Backstop fuer Worker-Idempotency
+  // (Atom 3b's "2× run done-Job → no-op"). Der Worker created NIE ein
+  // zweites Aggregat fuers gleiche jobId: Re-Runs rotieren das Token
+  // in place via update (fw#832) — sonst kollidiert der Projection-
+  // Rebuild an genau diesem Index.
   indexes: [
     {
       unique: true,

package/src/user-data-rights/schema/export-job.ts

@@ -73,6 +73,7 @@ export const exportJobEntity = createEntity({
     // nur Storage.
     userId: createTextField({
       required: true,
+      searchable: true,
     }),
 
     // **requestedFromTenantId** — der Tenant aus dem der User den Antrag
@@ -102,6 +103,7 @@ export const exportJobEntity = createEntity({
     // entsteht ohne Klick.
     requestedAt: createTimestampField({
       required: true,
+      sortable: true,
     }),
 
     // Wann hat der Worker mit dem Pickup angefangen. NULL solange

package/src/user-data-rights/screens.ts

@@ -28,7 +28,8 @@ export const exportJobListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  searchable: false,
+  defaultSort: { field: "requestedAt", dir: "desc" },
+  searchable: true,
   access: { roles: access.systemAdmin },
 };
 

package/src/user-data-rights/web/__tests__/privacy-center-screen.test.tsx

@@ -71,6 +71,7 @@ function makeDispatcher(
     query,
     batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
     statusStore,
+    async *stream() {},
     pendingWrites: () => [],
     pendingFiles: () => [],
   } as unknown as Dispatcher; // @cast-boundary test-stub

package/src/user-data-rights/web/__tests__/public-deletion-gate.test.tsx

@@ -5,7 +5,7 @@
 // Provider-Wrapper lokal (Dependency-Richtung renderer-web → bundled-features
 // verbietet test-utils-Import).
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import type { Dispatcher } from "@cosmicdrift/kumiko-headless";
 import {
   createStaticLocaleResolver,
@@ -27,6 +27,12 @@ const stubDispatcher = {
 
 const ROUTES = { requestPath: "/account/delete", confirmPath: "/account/delete/confirm" };
 
+// renderGate mutates the shared happy-dom document's history (570/1) — reset
+// so a later, unrelated test file doesn't inherit this suite's last path.
+afterEach(() => {
+  window.history.replaceState({}, "", "/");
+});
+
 function renderGate(path: string, gate: ReactNode): ReturnType<typeof within> {
   window.history.replaceState({}, "", path);
   const { container } = render(

package/src/user-data-rights/web/client-plugin.tsx

@@ -45,5 +45,10 @@ export function userDataRightsClient(
     },
   };
   if (options?.publicDeletion === undefined) return base;
-  return { ...base, gates: [makePublicDeletionGate(options.publicDeletion)] };
+  // Extend, not overwrite (570/2) — base.gates is empty today, but a spread
+  // that clobbers it instead of appending would silently drop future gates.
+  return {
+    ...base,
+    gates: [...(base.gates ?? []), makePublicDeletionGate(options.publicDeletion)],
+  };
 }

package/src/user-data-rights/web/i18n.ts

@@ -5,8 +5,24 @@
 // deletion.<step>.<slug>`.
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import { USER_DATA_RIGHTS_I18N } from "../i18n";
 
-export const defaultTranslations: TranslationsByLocale = {
+const LOCALES = ["de", "en"] as const;
+
+// Operator keys (export-job list/detail titles + entity field labels + nav)
+// live in the server i18n; the SystemAdmin entityList screens render them
+// client-side, so the web bundle must carry them too — otherwise raw keys
+// show. Derive from the single server source instead of duplicating.
+const operatorTranslations: TranslationsByLocale = Object.fromEntries(
+  LOCALES.map((locale) => [
+    locale,
+    Object.fromEntries(
+      Object.entries(USER_DATA_RIGHTS_I18N).map(([key, value]) => [key, value[locale]]),
+    ),
+  ]),
+);
+
+const apexTranslations: TranslationsByLocale = {
   de: {
     "userDataRights.deletion.request.title": "Account-Löschung beantragen",
     "userDataRights.deletion.request.intro":
@@ -74,11 +90,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Konto wirklich löschen?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Mit dem Bestätigen startet die Lösch-Frist. Du kannst die Löschung bis zu ihrem Ablauf wieder abbrechen.",
-
-    "userDataRights.privacyCenter.audit.title": "Aktivitätsprotokoll (Art. 15)",
-    "userDataRights.privacyCenter.audit.intro":
-      "Die letzten Ereignisse zu deinem Konto über alle Tenants hinweg.",
-    "userDataRights.privacyCenter.audit.empty": "Noch keine Ereignisse.",
   },
   en: {
     "userDataRights.deletion.request.title": "Request account deletion",
@@ -147,9 +158,18 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
 
-    "userDataRights.privacyCenter.audit.title": "Activity log (Art. 15)",
-    "userDataRights.privacyCenter.audit.intro":
-      "The most recent events on your account across all tenants.",
-    "userDataRights.privacyCenter.audit.empty": "No events yet.",
+    "userDataRights.errors.download.notFound":
+      "The download link is invalid or belongs to a different account.",
+    "userDataRights.errors.download.expired":
+      "Your download has expired. Please request a new export.",
+    "userDataRights.errors.download.unavailable":
+      "The export is not yet ready or has failed. Please check the status endpoint.",
+    "userDataRights.errors.download.signedUrlNotSupported":
+      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
   },
 };
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: { ...apexTranslations["de"], ...operatorTranslations["de"] },
+  en: { ...apexTranslations["en"], ...operatorTranslations["en"] },
+};

package/src/user-data-rights/web/privacy-center-screen.tsx

@@ -19,7 +19,7 @@ import {
   useQuery,
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
-import { postWithDownload } from "@cosmicdrift/kumiko-renderer-web";
+import { FormScreenShell, postWithDownload } from "@cosmicdrift/kumiko-renderer-web";
 import { type ReactNode, useEffect, useState } from "react";
 import {
   EXPORT_JOB_STATUS,
@@ -224,6 +224,7 @@ function RestrictionSection({
     <Section
       title={t("userDataRights.privacyCenter.restriction.title")}
       testId="privacy-restriction"
+      variant="destructive"
       actions={
         restricted ? undefined : (
           <Button
@@ -303,6 +304,7 @@ function DeletionSection({
     <Section
       title={t("userDataRights.privacyCenter.deletion.title")}
       testId="privacy-deletion"
+      variant="destructive"
       actions={
         deletionRequested ? (
           <Button
@@ -384,12 +386,12 @@ export function PrivacyCenterScreen({
   };
 
   return (
-    <div className="p-6 flex flex-col gap-6 max-w-2xl" data-testid="privacy-center-screen">
+    <FormScreenShell className="flex flex-col gap-6" testId="privacy-center-screen">
       <Heading variant="page">{t("userDataRights.privacyCenter.title")}</Heading>
       <p className="text-sm text-muted-foreground">{t("userDataRights.privacyCenter.intro")}</p>
       <ExportSection />
       <RestrictionSection me={me} onChanged={refetch} />
       {showDeletion && <DeletionSection me={me} onChanged={refetch} />}
-    </div>
+    </FormScreenShell>
   );
 }