@cosmicdrift/kumiko-dev-server 0.109.0 → 0.111.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.109.0",
+  "version": "0.111.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.109.0",
-    "@cosmicdrift/kumiko-framework": "0.109.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.111.0",
+    "@cosmicdrift/kumiko-framework": "0.111.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/boot/apply-boot-seeds.ts

@@ -1,6 +1,7 @@
 import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
-import type { DbConnection, EncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 
 // Single boot-seed entry-point. runDevApp + runProdApp both call this
 // from their post-stack hook, so the wiring lives in exactly one place
@@ -12,7 +13,7 @@ import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 export async function applyBootSeeds(deps: {
   registry: Registry;
   db: DbConnection;
-  encryption?: EncryptionProvider;
+  cipher?: EnvelopeCipher;
 }): Promise<void> {
-  await seedAllConfigValues(deps.registry, deps.db, deps.encryption);
+  await seedAllConfigValues(deps.registry, deps.db, deps.cipher);
 }

package/src/boot/boot-crypto.ts

@@ -0,0 +1,82 @@
+// One place that turns env/options into the app-wide crypto objects:
+// the MasterKeyProvider (KUMIKO_SECRETS_MASTER_KEY_V<n> keyring) and the
+// EnvelopeCipher for `encrypted: true` config keys. runProdApp and
+// runDevApp both resolve this once and thread it into
+// buildBootExtraContext + applyBootSeeds so resolver, set-handler and
+// seeds share the same cipher instance (and DEK cache).
+
+import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createDekCache,
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+  type DekCache,
+  type EnvelopeCipher,
+  type MasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+
+// Keyring detection without throwing: only build the env provider when at
+// least one versioned KEK is actually set. Covers (a) apps without any
+// encryption — no KEK requirement, and (b) dev with an app-supplied
+// provider in options.masterKey — env stays irrelevant.
+const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
+export function envHasMasterKek(env: Record<string, string | undefined>): boolean {
+  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
+}
+
+export type BootCrypto = {
+  readonly masterKeyProvider?: MasterKeyProvider;
+  // Cipher for encrypted config keys. Present exactly when a master key is
+  // available. Decrypts legacy CONFIG_ENCRYPTION_KEY values as fallback
+  // until the config re-encrypt job migrated them.
+  readonly configCipher?: EnvelopeCipher;
+  // Cipher for `encrypted: true` entity fields — same master key, but the
+  // legacy fallback reads the pre-envelope ENCRYPTION_KEY format. Identical
+  // to configCipher when no ENCRYPTION_KEY is set.
+  readonly entityFieldCipher?: EnvelopeCipher;
+  readonly dekCache: DekCache;
+};
+
+export function resolveBootCrypto(
+  envSource: Record<string, string | undefined>,
+  masterKeyOverride?: MasterKeyProvider,
+): BootCrypto {
+  const masterKeyProvider =
+    masterKeyOverride ??
+    (envHasMasterKek(envSource)
+      ? createEnvMasterKeyProvider({
+          // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
+          // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
+          env: {
+            ...envSource,
+            KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
+              envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
+          },
+        })
+      : undefined);
+
+  const dekCache = createDekCache();
+  const legacyConfigKey = envSource["CONFIG_ENCRYPTION_KEY"];
+  const configCipher = masterKeyProvider
+    ? createEnvelopeCipher(masterKeyProvider, {
+        dekCache,
+        ...(legacyConfigKey ? { legacy: createEncryptionProvider(legacyConfigKey) } : {}),
+      })
+    : undefined;
+
+  const legacyEntityKey = envSource["ENCRYPTION_KEY"];
+  const entityFieldCipher =
+    masterKeyProvider && legacyEntityKey
+      ? createEnvelopeCipher(masterKeyProvider, {
+          dekCache,
+          legacy: createEncryptionProvider(legacyEntityKey),
+        })
+      : configCipher;
+
+  return {
+    ...(masterKeyProvider && { masterKeyProvider }),
+    ...(configCipher && { configCipher }),
+    ...(entityFieldCipher && { entityFieldCipher }),
+    dekCache,
+  };
+}

package/src/run-dev-app.ts

@@ -29,12 +29,15 @@ import {
   patScopesFromFeature,
 } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
+  bindAutoRevokeFromFeature,
   createSessionCallbacks,
+  SESSIONS_FEATURE,
   type SessionCallbacks,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import type { PatResolver, SessionMetadata } from "@cosmicdrift/kumiko-framework/api";
 import { createInMemoryLoginRateLimiter } from "@cosmicdrift/kumiko-framework/api";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectWriteHandlerQns,
   createRegistry,
@@ -48,10 +51,11 @@ import {
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
+import type { EnvelopeCipher, MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
+import { resolveBootCrypto } from "./boot/boot-crypto";
 
 import { watchAndRegenerate } from "./codegen";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
@@ -309,8 +313,17 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // throwaway-Registry hier extrahiert nur die config-Keys, weil der
   // configResolver vor dem Server-Boot konstruiert wird (stack.registry
   // gibt's erst onAfterSetup) — createKumikoServer baut intern seine eigene.
+  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+  // App-wide cipher for `encrypted: true` entity fields (symmetrisch zu
+  // runProdApp) — executors resolve it lazily.
+  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const cfgExtra = effectiveAuth
-    ? mergeConfigResolverDefault(options.extraContext, createRegistry(features), envSource)
+    ? mergeConfigResolverDefault(
+        options.extraContext,
+        createRegistry(features),
+        envSource,
+        bootCrypto.configCipher,
+      )
     : options.extraContext;
   // Auto-wire textContent (immer) + secrets (feature-gated), symmetrisch zu
   // runProdApp. Anders als prod existiert die db hier erst im Factory-deps
@@ -325,7 +338,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       registry: deps.registry,
       hasAuth: false,
       sseBroker: deps.sseBroker,
-      ...(options.masterKey && { masterKey: options.masterKey }),
+      crypto: bootCrypto,
     });
     const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
     return { ...boot, ...base };
@@ -463,6 +476,12 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           db: stack.db,
           ...(expiresInMs !== undefined && { expiresInMs }),
         });
+        // Secure-by-default (symmetrisch zu runProdApp): Password-Change/
+        // -Reset mass-revoked die Sessions des Users ohne App-Opt-in.
+        const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
+        if (sessionsFeature) {
+          bindAutoRevokeFromFeature(sessionsFeature)?.(sessionCallbacks.sessionMassRevoker);
+        }
       }
       if (patFeature) {
         patResolver = createPatResolver({ db: stack.db, scopes: patScopesFromFeature(patFeature) });
@@ -474,7 +493,11 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       // Runs before user-supplied seed callbacks so those can read /
       // override the deploy-defaults. The helper indirection is what
       // config-seed-boot.integration.ts pins — keep it as a single call.
-      await applyBootSeeds({ registry: stack.registry, db: stack.db });
+      await applyBootSeeds({
+        registry: stack.registry,
+        db: stack.db,
+        ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
+      });
       for (const seed of options.seeds ?? []) {
         await seed(stack);
       }
@@ -510,10 +533,12 @@ export function mergeConfigResolverDefault(
   ctx: CreateKumikoServerOptions["extraContext"],
   registry: Registry,
   envSource: Record<string, string | undefined>,
+  cipher?: EnvelopeCipher,
 ): CreateKumikoServerOptions["extraContext"] {
   const defaults = {
     configResolver: createConfigResolver({
       appOverrides: buildEnvConfigOverrides(registry, envSource),
+      ...(cipher && { cipher }),
     }),
   };
   // ctx.config wird per-Request aus _configAccessorFactory geminted (siehe

package/src/run-prod-app.ts

@@ -61,6 +61,7 @@ import {
   SECRETS_FEATURE_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import {
+  bindAutoRevokeFromFeature,
   createSessionCallbacks,
   SESSIONS_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
@@ -77,6 +78,7 @@ import {
   type SseBroker,
 } from "@cosmicdrift/kumiko-framework/api";
 import {
+  configureEntityFieldEncryption,
   createDbConnection,
   type DbConnection,
   type DbRunner,
@@ -122,13 +124,11 @@ import {
   createEventDedup,
   createIdempotencyGuard,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import {
-  createEnvMasterKeyProvider,
-  type MasterKeyProvider,
-} from "@cosmicdrift/kumiko-framework/secrets";
+import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import { warnIfNonUtcServerTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import Redis from "ioredis";
 import { applyBootSeeds } from "./boot/apply-boot-seeds";
+import { type BootCrypto, resolveBootCrypto } from "./boot/boot-crypto";
 import { ASSETS_DIR } from "./build-prod-bundle";
 import { buildComposeAuthOptions, composeFeatures } from "./compose-features";
 import { type ExtraRoutesSystemDeps, makeDispatchSystemWrite } from "./extra-routes-deps";
@@ -596,18 +596,13 @@ export function addConfigAccessorFactory<T extends { readonly configResolver?: C
 // nur einen db-gebundenen Accessor). secrets wird nur auto-verdrahtet wenn
 // das secrets-Feature gemountet ist UND ein KEK tatsächlich verfügbar ist
 // (masterKey-Override ODER env-KEK present) — sonst skip, damit der eager
-// createEnvMasterKeyProvider nicht wirft. Das deckt zwei Fälle: (a) App ohne
-// secrets → kein KEK-Zwang; (b) dev mit App-eigenem DEV-KEK in extraContext
-// (kein env-KEK) → kein Boot-Crash, die App-explizite secrets-Wiring gewinnt.
+// KEK-Detection + Provider/Cipher-Aufbau leben in boot/boot-crypto.ts
+// (envHasMasterKek, resolveBootCrypto) — gemeinsam mit runDevApp.
 // Prod-Misconfig (secrets gemountet, kein KEK) fängt schon secretsEnvSchema
 // beim Boot; fehlt der env-Schema-Pfad, wirft requireSecretsContext beim
 // ersten ctx.secrets-Zugriff mit Wiring-Hinweis. configResolver nur im
 // Auth-Mode. Exportiert + pure für Unit-Tests; der merge mit App-Werten
 // passiert beim Caller (App gewinnt).
-const MASTER_KEK_VAR = /^KUMIKO_SECRETS_MASTER_KEY_V\d+$/;
-function envHasMasterKek(env: Record<string, string | undefined>): boolean {
-  return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
-}
 
 // Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
 // in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
@@ -634,12 +629,16 @@ export function buildBootExtraContext(opts: {
   readonly envSource: Record<string, string | undefined>;
   readonly registry: Registry;
   readonly hasAuth: boolean;
+  // Resolved once per boot via resolveBootCrypto — shared by secrets,
+  // config-resolver, config-set-handler and boot-seeds. Absent (tests
+  // that don't care about encryption) ⇒ resolved from envSource here.
+  readonly crypto?: BootCrypto;
   readonly masterKey?: MasterKeyProvider;
   readonly sseBroker?: SseBroker;
 }): Record<string, unknown> {
+  const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
-  const wireSecrets =
-    hasSecretsFeature && (opts.masterKey !== undefined || envHasMasterKek(opts.envSource));
+  const wireSecrets = hasSecretsFeature && crypto.masterKeyProvider !== undefined;
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
   return {
     textContent: createTextContentApi(opts.db),
@@ -650,25 +649,25 @@ export function buildBootExtraContext(opts: {
         ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
       }),
     }),
-    ...(wireSecrets && {
-      secrets: createSecretsContext({
-        db: opts.db,
-        masterKeyProvider:
-          opts.masterKey ??
-          createEnvMasterKeyProvider({
-            // CURRENT_VERSION default "1" spiegelt secretsEnvSchema — ohne
-            // ihn wirft der raw-env-Provider, obwohl V1 gesetzt ist.
-            env: {
-              ...opts.envSource,
-              KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION:
-                opts.envSource["KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION"] ?? "1",
-            },
-          }),
+    // Top-level provider so feature jobs (secrets rotate, config reencrypt)
+    // reach it via ctx — previously only test-stack wired it.
+    ...(crypto.masterKeyProvider && { masterKeyProvider: crypto.masterKeyProvider }),
+    // Encrypt/decrypt partner for `encrypted: true` config keys. Wired
+    // whenever a master key exists — NOT gated on the secrets feature,
+    // config encryption must work without mounting ctx.secrets.
+    ...(crypto.configCipher && { configEncryption: crypto.configCipher }),
+    ...(wireSecrets &&
+      crypto.masterKeyProvider && {
+        secrets: createSecretsContext({
+          db: opts.db,
+          masterKeyProvider: crypto.masterKeyProvider,
+          dekCache: crypto.dekCache,
+        }),
       }),
-    }),
     ...(opts.hasAuth && {
       configResolver: createConfigResolver({
         appOverrides: buildEnvConfigOverrides(opts.registry, opts.envSource),
+        ...(crypto.configCipher && { cipher: crypto.configCipher }),
       }),
     }),
   };
@@ -919,6 +918,10 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
 
   // Framework-Default-Provider zuerst, App-Werte (resolvedExtraContext)
   // gewinnen immer (z.B. money-horse's eigener configResolver).
+  const bootCrypto = resolveBootCrypto(envSource, options.masterKey);
+  // App-wide cipher for `encrypted: true` entity fields — executors resolve
+  // it lazily, entities without encrypted fields never touch it.
+  configureEntityFieldEncryption(bootCrypto.entityFieldCipher);
   const autoExtraContext = buildBootExtraContext({
     db,
     features,
@@ -926,7 +929,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     registry,
     hasAuth: !!effectiveAuth,
     sseBroker,
-    ...(options.masterKey && { masterKey: options.masterKey }),
+    crypto: bootCrypto,
   });
   const extraContext = addConfigAccessorFactory(
     { ...autoExtraContext, ...resolvedExtraContext },
@@ -942,19 +945,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // sessionStrictMode=true: Prod-Sessions sollen nicht stillschweigend
   // von einem JWT-ohne-sid umgangen werden können. sessionMassRevoker
   // (4. callback aus createSessionCallbacks) ist nicht Teil der
-  // AuthRoutesConfig-Surface — der wird vom sessions-Feature selbst über
-  // die `autoRevokeOnPasswordChange`-Option konsumiert, nicht über die
-  // auth-routes.
+  // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
+  // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
+  // über die auth-routes.
   // Secure-by-default: if the sessions feature is mounted, server-side revocation +
-  // sessionStrictMode are wired automatically; `auth.sessions` only overrides the config,
-  // and `auth.sessions: false` is the explicit opt-out (back to stateless JWTs).
-  const sessionsFeatureMounted = features.some((f) => f.name === SESSIONS_FEATURE);
+  // sessionStrictMode + auto-revoke-on-password-change are wired automatically;
+  // `auth.sessions` only overrides the config, and `auth.sessions: false` is the
+  // explicit opt-out (back to stateless JWTs).
+  const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
-    sessionsFeatureMounted,
+    sessionsFeature !== undefined,
     effectiveAuth?.sessions,
   )
-    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions))
+    ? buildProdSessionAuth(db, resolveProdSessionsConfig(effectiveAuth?.sessions), sessionsFeature)
     : undefined;
 
   // PAT opt-in: if the personal-access-tokens feature is mounted, wire its
@@ -1104,7 +1108,11 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   if (effectiveAuth) {
     await seedAdmin(db, effectiveAuth.admin);
   }
-  await applyBootSeeds({ registry, db });
+  await applyBootSeeds({
+    registry,
+    db,
+    ...(bootCrypto.configCipher && { cipher: bootCrypto.configCipher }),
+  });
   for (const seed of options.seeds ?? []) {
     await seed({ db });
   }
@@ -1492,6 +1500,7 @@ export function staticCachePolicy(pathname: string): CachePolicy {
 function buildProdSessionAuth(
   db: import("@cosmicdrift/kumiko-framework/db").DbConnection,
   opts: ProdSessionsConfig,
+  sessionsFeature: import("@cosmicdrift/kumiko-framework/engine").FeatureDefinition | undefined,
 ): {
   readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
   readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
@@ -1502,6 +1511,11 @@ function buildProdSessionAuth(
     db,
     ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
   });
+  // Secure-by-default: password-change/-reset mass-revokes the user's live
+  // sessions without the app opting in via autoRevokeOnPasswordChange.
+  if (sessionsFeature) {
+    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
+  }
   return {
     sessionCreator: cbs.sessionCreator,
     sessionRevoker: cbs.sessionRevoker,