@cosmicdrift/kumiko-framework 0.156.0 → 0.156.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.156.0",
+  "version": "0.156.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -193,7 +193,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.156.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.156.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/crypto/__tests__/pii-field-encryption.test.ts

@@ -1,13 +1,20 @@
 import { describe, expect, test } from "bun:test";
 import { createEntity, createTextField } from "../../engine/factories";
 import { InMemoryKmsAdapter } from "../in-memory-kms-adapter";
-import { KeyNotFoundError, type KmsContext, subjectIdFromKey } from "../kms-adapter";
+import {
+  KeyErasedError,
+  KeyNotFoundError,
+  type KmsContext,
+  subjectIdFromKey,
+  subjectIdToKey,
+} from "../kms-adapter";
 import {
   decryptPiiFieldValues,
   decryptPiiValueForSubject,
   encryptPiiFieldValues,
   encryptPiiValueForSubject,
   isPiiCiphertext,
+  PII_CIPHERTEXT_PREFIX,
   PII_ERASED_SENTINEL,
 } from "../pii-field-encryption";
 import { collectPiiSubjectFields } from "../subject-resolver";
@@ -291,3 +298,23 @@ describe("encryptPiiValueForSubject / decryptPiiValueForSubject (kumiko-platform
     expect(read).toBe("plain-value");
   });
 });
+
+describe("cross-subject decrypt leak (kumiko-framework#1190)", () => {
+  test("ciphertext forged to a different-but-valid subject's DEK fails GCM auth, not just KeyNotFound", async () => {
+    const kms = new InMemoryKmsAdapter();
+    const subjectA = { kind: "tenant" as const, tenantId: UUID_A };
+    const subjectB = { kind: "tenant" as const, tenantId: UUID_B };
+    // Both subjects must have a real key — otherwise this only re-proves the
+    // existing "ciphertext without a key row fails loud" (KeyNotFoundError) case.
+    await kms.createKey(subjectA);
+
+    const storedForB = await encryptPiiValueForSubject(kms, subjectB, "tenant-b-secret", KMS_CTX);
+    const blob = storedForB.slice(storedForB.lastIndexOf(":") + 1);
+    const forgedForA = `${PII_CIPHERTEXT_PREFIX}${subjectIdToKey(subjectA)}:${blob}`;
+
+    const attempt = decryptPiiValueForSubject(kms, forgedForA, KMS_CTX);
+    await expect(attempt).rejects.not.toBeInstanceOf(KeyNotFoundError);
+    await expect(attempt).rejects.not.toBeInstanceOf(KeyErasedError);
+    await expect(attempt).rejects.toThrow();
+  });
+});

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -419,6 +419,81 @@ describe("event-store-executor — encrypted fields", () => {
     expect(updated.data.data["secretNote"]).toBe("new-note");
   });
 
+  test("update WITHOUT skipUnchanged still re-encrypts a resubmitted-but-unchanged encrypted field (KEK-rotation/backfill contract)", async () => {
+    // Regression guard: direct executor.update() callers that don't opt into
+    // skipUnchanged rely on today's always-re-encrypt behavior to force a
+    // fresh ciphertext for an unchanged plaintext — e.g. auth-mfa's
+    // KEK-rotation job (reencrypt.job.ts) and the user-data-rights #494
+    // backfill both resubmit the CURRENT value on purpose to land a real
+    // event. A blanket value-diff here would silently break both.
+    const created = await crud.create(
+      { email: "force-enc@test.de", secretNote: "same-note" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const before = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'force-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    const updated = await crud.update(
+      { id: created.data.id, version: 1, changes: { secretNote: "same-note" } },
+      adminUser,
+      tdb,
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    const after = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'force-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    // Fresh AEAD nonce per encrypt call → different ciphertext even though
+    // the plaintext is identical. Byte-identical would mean the write was
+    // skipped, which is exactly what would break KEK rotation.
+    expect(after[0]?.secret_note).toBeDefined();
+    expect(after[0]?.secret_note).not.toBe(before[0]?.secret_note);
+  });
+
+  test("update with skipUnchanged: true omits a resubmitted-but-unchanged encrypted field — no phantom re-encrypt (#464)", async () => {
+    const created = await crud.create(
+      { email: "noop-enc@test.de", secretNote: "same-note" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const before = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'noop-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    const updated = await crud.update(
+      {
+        id: created.data.id,
+        version: 1,
+        changes: { secretNote: "same-note", email: "noop-enc-2@test.de" },
+      },
+      adminUser,
+      tdb,
+      { skipUnchanged: true },
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    const after = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'noop-enc-2@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    // Re-encrypting the same plaintext produces a fresh AEAD nonce → a
+    // different ciphertext even for an unchanged value. Byte-identical
+    // ciphertext proves the column was never touched by this update.
+    expect(after[0]?.secret_note).toBe(before[0]?.secret_note);
+
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE type = 'esExecEncrypted.updated' ORDER BY id DESC LIMIT 1`,
+    )) as Array<{ payload: { changes?: Record<string, unknown> } }>;
+    expect(rows[0]?.payload.changes).not.toHaveProperty("secretNote");
+  });
+
   test("update's persisted event carries ciphertext (not plaintext) for an encrypted field in `previous`", async () => {
     // Regression: `previous` in the STORED event came from loadById(), which
     // decrypts — appending it unchanged would put the plaintext of an

package/src/db/event-store-executor-write.ts

@@ -32,6 +32,20 @@ import { selectMany } from "./query";
 // unchanged from the original, just relocated behind an explicit
 // ExecutorContext instead of capturing the factory's local scope directly.
 
+// updateOptions.skipUnchanged (#464) — opt-in: a resubmitted-but-identical
+// key is dropped before encryption so pii/encrypted fields don't get a fresh
+// AEAD ciphertext (new nonce) for no real change, and the event's `changes`
+// don't carry a phantom diff. Opt-in, not the executor's default, because
+// direct executor.update() callers rely on the current behavior to FORCE a
+// re-encrypt of an unchanged plaintext — KEK-rotation (auth-mfa reencrypt.job)
+// and the user-data-rights #494 backfill both resubmit the current value on
+// purpose to land a fresh event/ciphertext. Only the generic entity update
+// handler (entity-handlers.ts) sets this flag; those two call their own
+// executor directly and never see it.
+function isUnchangedValue(a: unknown, b: unknown): boolean {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
 export function createWriteVerbs(
   ctx: ExecutorContext,
 ): Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore"> {
@@ -282,9 +296,16 @@ export function createWriteVerbs(
         // Compound-Types Auto-Convert (alle in einem Pass).
         // subjectSource: partial changes may carry a pii field without its
         // ownerField — the merged row still names the subject.
-        const flatChangesPlain = flattenCompoundTypes(payload.changes, entity);
+        const submittedChanges = updateOptions?.skipUnchanged
+          ? Object.fromEntries(
+              Object.entries(payload.changes).filter(
+                ([key, value]) => !isUnchangedValue(value, previous[key]),
+              ),
+            )
+          : payload.changes;
+        const flatChangesPlain = flattenCompoundTypes(submittedChanges, entity);
         const flatChanges = await encryptForStorage(flatChangesPlain, user, {
-          onlyKeys: Object.keys(payload.changes),
+          onlyKeys: Object.keys(submittedChanges),
           subjectSource: mergedNew,
         });
 

package/src/db/event-store-executor.ts

@@ -53,7 +53,7 @@ export type EventStoreExecutor = {
     payload: { id: EntityId; version?: number | undefined; changes: Record<string, unknown> },
     user: SessionUser,
     db: import("./tenant-db").TenantDb,
-    options?: { skipOptimisticLock?: boolean },
+    options?: { skipOptimisticLock?: boolean; skipUnchanged?: boolean },
   ) => Promise<WriteResult<SaveContext>>;
 
   delete: (

package/src/engine/entity-handlers.ts

@@ -176,7 +176,15 @@ export function defineEntityWriteHandler(
         changes: buildUpdateSchema(entity),
       });
       handler = async (event, ctx) =>
-        executor.update(event.payload as UpdatePayload, event.user, ctx.db); // @cast-boundary engine-payload
+        // skipUnchanged (#464): API-driven updates diff against the stored
+        // row so a resubmitted-but-identical field doesn't force a fresh
+        // pii/encrypted ciphertext. Direct executor.update() callers (e.g.
+        // KEK-rotation, the user-data-rights #494 backfill) don't go through
+        // this handler and keep today's always-re-encrypt behavior, which
+        // they rely on to intentionally force a fresh event/ciphertext.
+        executor.update(event.payload as UpdatePayload, event.user, ctx.db, {
+          skipUnchanged: true,
+        }); // @cast-boundary engine-payload
       break;
     case "delete":
       schema = idSchema;

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -100,6 +100,35 @@ describe("dispatcher.write", () => {
     expect(result.isSuccess).toBe(true);
   });
 
+  test("user-bucketed handler without RateLimitResolver → internal_error", async () => {
+    // Misconfig: a handler opts into L3 rate-limit but the app never loaded the
+    // rate-limiting feature. User buckets cannot skip (unlike ip+no-IP), so we
+    // fail loud at first write instead of silently running uncapped.
+    const rlFeature = defineFeature("rl-user", (r) => {
+      r.entity("item", createEntity({ table: "Items", fields: { name: createTextField() } }));
+      r.writeHandler(
+        "item:create",
+        z.object({ name: z.string() }),
+        async (event) => ({ isSuccess: true, data: { name: event.payload.name } }),
+        {
+          access: { openToAll: true },
+          rateLimit: { per: "user", limit: 3, windowSeconds: 60 },
+        },
+      );
+    });
+    const dispatcher = createDispatcher(createRegistry([rlFeature]), {});
+    const result = await dispatcher.write(
+      "rl-user:write:item:create",
+      { name: "should-not-run" },
+      createTestUser(),
+    );
+    expect(result.isSuccess).toBe(false);
+    if (!result.isSuccess) {
+      expect(result.error.code).toBe("internal_error");
+      expect(result.error.message).toMatch(/RateLimitResolver is configured/);
+    }
+  });
+
   test("ctx.user ist Convenience-Alias auf event.user (gleicher Wert)", async () => {
     // Pinst dass der Handler auf ctx.user zugreifen kann ohne den
     // typo-resistenten event.user-Pfad zu nutzen. Identitätsprüfung