@cosmicdrift/kumiko-dev-server 0.116.1 → 0.118.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.116.1",
+  "version": "0.118.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.116.1",
-    "@cosmicdrift/kumiko-framework": "0.116.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.118.0",
+    "@cosmicdrift/kumiko-framework": "0.118.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/run-prod-app.integration.test.ts

@@ -14,6 +14,7 @@ import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { InMemoryKmsAdapter, type KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import { createDbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   createBooleanField,
@@ -69,6 +70,12 @@ const widgetFeature = defineFeature("prod-probe", (r) => {
     access: { roles: ["anonymous"] },
     handler: async () => ({ pong: true }),
   });
+  r.queryHandler({
+    name: "kms-probe",
+    schema: z.object({}),
+    access: { roles: ["anonymous"] },
+    handler: async (_event, ctx) => ({ hasKms: ctx.kms !== undefined }),
+  });
   // SystemAdmin-gated write — Ziel des extraRoutes.dispatchSystemWrite-
   // Tests: Echo von user.tenantId + roles beweist, dass der Dispatch
   // durch den echten Dispatcher (Zod + Access-Check) läuft und der
@@ -837,4 +844,43 @@ describe("runProdApp job-lane wiring (runSingleInstance)", () => {
       false,
     );
   });
+
+  test("kms option: adapter reaches handler ctx; without the option ctx.kms is absent", async () => {
+    const probe = async (handle: ProdAppHandle): Promise<boolean | undefined> => {
+      const res = await handle.entrypoint.app.fetch(
+        new Request("http://test/api/query", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ type: "prod-probe:query:kms-probe", payload: {} }),
+        }),
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { data?: { hasKms?: boolean } };
+      return body.data?.hasKms;
+    };
+
+    const withKms = await boot(undefined, {
+      kms: new InMemoryKmsAdapter(),
+      anonymousAccess: { defaultTenantId: TENANT_ID },
+    });
+    expect(await probe(withKms)).toBe(true);
+
+    const withoutKms = await boot(undefined, {
+      anonymousAccess: { defaultTenantId: TENANT_ID },
+    });
+    expect(await probe(withoutKms)).toBe(false);
+  });
+
+  test("unhealthy kms aborts boot before any connection is opened", async () => {
+    const unhealthyKms: KmsAdapter = {
+      capabilities: { mode: "local-key" },
+      createKey: async () => {},
+      getKey: async () => {
+        throw new Error("unreachable");
+      },
+      eraseKey: async () => {},
+      health: async () => ({ ok: false, latencyMs: 3 }),
+    };
+    await expect(boot(undefined, { kms: unhealthyKms })).rejects.toThrow(/KMS health check failed/);
+  });
 });

package/src/run-prod-app.ts

@@ -77,6 +77,7 @@ import {
   createSseBroker,
   type SseBroker,
 } from "@cosmicdrift/kumiko-framework/api";
+import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   configureEntityFieldEncryption,
   createDbConnection,
@@ -477,6 +478,12 @@ export type RunProdAppOptions = {
    *  Override für KMS-Backends (AWS/GCP/Azure) statt env-KEK. Nur relevant
    *  wenn das `secrets`-Feature gemountet ist. */
   readonly masterKey?: MasterKeyProvider;
+  /** Subject-Key-Adapter für Crypto-Shredding (DSGVO Art. 17). Wenn gesetzt,
+   *  steht er Feature-Code als `ctx.kms` zur Verfügung und der Boot prüft
+   *  seine health() — die App startet nicht gegen ein unerreichbares KMS
+   *  (Silent-Start würde jeden PII-Read mit 503 beantworten). Kein Default:
+   *  ohne Adapter bleibt Crypto-Shredding aus. */
+  readonly kms?: KmsAdapter;
   /** Deploy-Topologie. Default `true` (Single-Container): dieser Prozess
    *  fährt HTTP + BEIDE Job-Lanes (api + worker) + den Event-Dispatcher
    *  (MSP-Anwendung) inline — via `createAllInOneEntrypoint`. Damit laufen
@@ -635,6 +642,7 @@ export function buildBootExtraContext(opts: {
   readonly crypto?: BootCrypto;
   readonly masterKey?: MasterKeyProvider;
   readonly sseBroker?: SseBroker;
+  readonly kms?: KmsAdapter;
 }): Record<string, unknown> {
   const crypto = opts.crypto ?? resolveBootCrypto(opts.envSource, opts.masterKey);
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
@@ -642,6 +650,7 @@ export function buildBootExtraContext(opts: {
   const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
   return {
     textContent: createTextContentApi(opts.db),
+    ...(opts.kms && { kms: opts.kms }),
     ...(hasDeliveryFeature && {
       _notifyFactory: buildDeliveryNotifyFactory({
         db: opts.db,
@@ -848,6 +857,18 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   //    idempotency, event-dedup, entity-cache, rate-limit; failing to
   //    construct here surfaces the misconfig immediately. `new Redis(...)`
   //    connects eagerly, so it must stay AFTER the boot-mode exit above.
+  // KMS health gate: an app configured for crypto-shredding must not boot
+  // against an unreachable key store — a silent start would answer every
+  // PII read with 503. Runs BEFORE connections so an abort leaks nothing.
+  if (options.kms) {
+    const kmsHealth = await options.kms.health();
+    if (!kmsHealth.ok) {
+      throw new Error(
+        `[runProdApp] BOOT ABORTED — KMS health check failed (latency ${kmsHealth.latencyMs}ms)`,
+      );
+    }
+  }
+
   const { db, close: closeDb } = createDbConnection(databaseUrl);
   const redis = new Redis(redisUrl, { maxRetriesPerRequest: null });
 
@@ -930,6 +951,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     hasAuth: !!effectiveAuth,
     sseBroker,
     crypto: bootCrypto,
+    ...(options.kms && { kms: options.kms }),
   });
   const extraContext = addConfigAccessorFactory(
     { ...autoExtraContext, ...resolvedExtraContext },