@cosmicdrift/kumiko-framework 0.186.0 → 0.186.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.186.0",
+  "version": "0.186.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.186.0",
+    "@cosmicdrift/kumiko-types": "0.186.2",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.186.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.186.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/event-store-executor-money-rehydrate.integration.test.ts

@@ -0,0 +1,140 @@
+// fw#1855 — money columns in list()/detail() surfaced the raw minor-units
+// integer instead of { amount, currency }: rehydrateCompoundTypes ran BEFORE
+// coerceRow on raw-SQL rows, so rehydrateMoney looked up the still-snake_case
+// key and silently no-op'd. money.test.ts/compound-types.test.ts only feed
+// rehydrateMoney pre-camelCased rows directly — neither covers the real
+// list()/detail() path through raw SQL, which is why this went unnoticed.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient } from "../../db/query";
+import { createEntity, createMoneyField, createTextField, from } from "../../engine";
+import { createEventsTable } from "../../event-store";
+import { TestUsers, unsafeCreateEntityTable } from "../../stack";
+import { createTestEnvelopeCipher } from "../../testing";
+import { ensureTemporalPolyfill } from "../../time/polyfill";
+import {
+  configureEntityFieldEncryption,
+  resetEntityFieldEncryptionCacheForTests,
+} from "../entity-field-encryption";
+import { createEventStoreExecutor } from "../event-store-executor";
+import { buildEntityTable } from "../table-builder";
+import { createTenantDb, type TenantDb } from "../tenant-db";
+
+const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
+const cipher = createTestEnvelopeCipher(TEST_KEY);
+
+// Multi-word field name on purpose: "price" maps to column "price" (snake ==
+// camel), which would pass even with the key-mismatch bug still present.
+// "grossTotal" maps to "gross_total" / "gross_total_currency" and exposes it.
+// billingIban ("billing_iban") is multi-word + encrypted: true for the same
+// reason, targeting the encrypted-field variant of the bug on detail()'s
+// ownership.kind==="sql" branch (decryptForRead used to run against a still
+// snake_case row and silently skip the field, leaking ciphertext).
+const entity = createEntity({
+  table: "read_money_orders",
+  fields: {
+    ownerId: createTextField({ required: true }),
+    grossTotal: createMoneyField(),
+    billingIban: createTextField({ required: true, encrypted: true }),
+  },
+  // A non-"all" read rule forces buildOwnershipClause into the
+  // ownership.kind==="sql" raw-SQL branch that list()/detail() read through.
+  // The "pass" branch (db.fetchOne → selectMany → coerceRows) is already
+  // camelCase and would pass this test even with the bug present.
+  access: { read: { Admin: from("user:id", "ownerId") } },
+});
+const table = buildEntityTable("moneyOrder", entity);
+
+let testDb: BunTestDb;
+let tdb: TenantDb;
+const admin = TestUsers.admin;
+
+beforeAll(async () => {
+  await ensureTemporalPolyfill();
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, entity, "moneyOrder");
+  await createEventsTable(testDb.db);
+  tdb = createTenantDb(testDb.db, admin.tenantId);
+  configureEntityFieldEncryption(cipher);
+});
+
+afterAll(async () => {
+  resetEntityFieldEncryptionCacheForTests();
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, read_money_orders RESTART IDENTITY CASCADE`,
+  );
+});
+
+describe("event-store-executor — money column rehydration through raw SQL (fw#1855)", () => {
+  const exec = createEventStoreExecutor(table, entity, { entityName: "moneyOrder" });
+
+  test("list(): money column arrives as { amount, currency }, not the raw minor-units integer", async () => {
+    const created = await exec.create(
+      {
+        ownerId: admin.id,
+        grossTotal: { amount: 136.85, currency: "EUR" },
+        billingIban: "DE1234567890",
+      },
+      admin,
+      tdb,
+    );
+    expect(created.isSuccess).toBe(true);
+
+    const res = await exec.list({ limit: 50 }, admin, tdb);
+    expect(res.rows).toHaveLength(1);
+    const row = res.rows[0] as Record<string, unknown>;
+    expect(row["grossTotal"]).toEqual({ amount: 136.85, currency: "EUR", amountMinor: 13685 });
+    expect("grossTotalCurrency" in row).toBe(false);
+  });
+
+  test('detail() via ownership.kind==="sql": money column arrives as { amount, currency }', async () => {
+    const created = await exec.create(
+      {
+        ownerId: admin.id,
+        grossTotal: { amount: 42.5, currency: "USD" },
+        billingIban: "DE9876543210",
+      },
+      admin,
+      tdb,
+    );
+    expect(created.isSuccess).toBe(true);
+    if (!created.isSuccess) return;
+
+    const row = (await exec.detail({ id: created.data.id }, admin, tdb)) as Record<
+      string,
+      unknown
+    > | null;
+    expect(row).not.toBeNull();
+    if (!row) return;
+    expect(row["grossTotal"]).toEqual({ amount: 42.5, currency: "USD", amountMinor: 4250 });
+    expect("grossTotalCurrency" in row).toBe(false);
+  });
+
+  test('detail() via ownership.kind==="sql": encrypted field decrypts to plaintext, not ciphertext', async () => {
+    const plainIban = "DE44500105175407324931";
+    const created = await exec.create(
+      {
+        ownerId: admin.id,
+        grossTotal: { amount: 10, currency: "EUR" },
+        billingIban: plainIban,
+      },
+      admin,
+      tdb,
+    );
+    expect(created.isSuccess).toBe(true);
+    if (!created.isSuccess) return;
+
+    const row = (await exec.detail({ id: created.data.id }, admin, tdb)) as Record<
+      string,
+      unknown
+    > | null;
+    expect(row).not.toBeNull();
+    if (!row) return;
+    expect(row["billingIban"]).toBe(plainIban);
+  });
+});

package/src/db/event-store-executor-read.ts

@@ -167,13 +167,14 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
 
       const rawRows = await executeRawQuery<Record<string, unknown>>(db.raw, listSql, params);
       // Read-Side rehydrate pro Row + snake→camel coercion für driver-agnostic Feldnamen.
-      // Coerce BEFORE decrypt: the raw SELECT * rows carry snake_case column
-      // names, while the encrypted/pii field lists are camelCase — decrypting
-      // first silently skipped every multi-word field (ciphertext leaked to
-      // the caller).
+      // Coerce BEFORE rehydrate/decrypt: the raw SELECT * rows carry snake_case
+      // column names, while compound-type lookups (rehydrateMoney et al.) and the
+      // encrypted/pii field lists are all camelCase — running either first on a
+      // still-snake_case row silently no-ops (money) or skips every multi-word
+      // field (ciphertext leaked to the caller).
       const tableInfo = extractTableInfo(table);
       const encryptedRows = rawRows.map((r) =>
-        coerceRow(rehydrateCompoundTypes(r, entity), tableInfo),
+        rehydrateCompoundTypes(coerceRow(r, tableInfo), entity),
       );
       const rows = await Promise.all(encryptedRows.map((r) => decryptForRead(r)));
 
@@ -256,9 +257,11 @@ export function createReadVerbs(ctx: ExecutorContext): Pick<EventStoreExecutor,
       const rows = await loadWithOwnership(db, idWhere, ownership);
       const raw = rows[0];
       if (!raw) return null;
-      const row = await decryptForRead(rehydrateCompoundTypes(raw, entity));
+      // Same coerce-before-rehydrate/decrypt ordering as list() above — raw
+      // is snake_case only on the ownership.kind==="sql" branch (raw SQL);
+      // coerceRow is a no-op on the already-camelCase "pass" branch rows.
       const rowInfo = extractTableInfo(table);
-      const coerced = coerceRow(row, rowInfo);
+      const coerced = await decryptForRead(rehydrateCompoundTypes(coerceRow(raw, rowInfo), entity));
 
       if (entityCache && entityName) {
         await entityCache.set(