@cosmicdrift/kumiko-framework 0.215.1 → 0.215.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.215.1",
+  "version": "0.215.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -194,7 +194,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.215.1",
+    "@cosmicdrift/kumiko-types": "0.215.2",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -210,7 +210,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/blind-index-cleanup.ts

@@ -44,3 +44,41 @@ export async function nullBlindIndexesForSubject(
     }
   }
 }
+
+// Tenant-scope oracle for crypto-shredding's forget-subject (mh#349): a
+// "user"-kind subject id is often not a real user (share-token recipient,
+// email subscriber, ...) — those entities self-own their PII (`personal:
+// "self"`, i.e. their own row id IS the subject) and carry a real tenant_id,
+// unlike read_users (systemStream, tenant_id always SYSTEM_TENANT_ID). This
+// checks whether the subject row lives in the given tenant, so a tenant-
+// scoped DPO can still forget subjects it truly owns without needing a
+// tenant-membership row (which only exists for real users).
+export async function subjectRowExistsInTenant(
+  db: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  subjectId: string,
+  tenantId: string,
+): Promise<boolean> {
+  for (const feature of features.values()) {
+    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+      const hasSelfPiiField = Object.values(entity.fields).some(
+        (field) => "pii" in field && field.pii === true,
+      );
+      if (!hasSelfPiiField) continue;
+      const tableName = resolveTableName(entityName, entity, undefined);
+      try {
+        const rows = await executeRawQuery(
+          db,
+          `SELECT 1 FROM ${quoteIdent(tableName)} WHERE id = $1 AND tenant_id = $2 LIMIT 1`,
+          [subjectId, tenantId],
+        );
+        if (rows.length > 0) return true;
+      } catch {
+        // Table missing, id-type mismatch, ... — not evidence the subject is
+        // owned here. Fail-closed must come from an honest "not found" across
+        // every entity, never from a query blowing up on one of them.
+      }
+    }
+  }
+  return false;
+}

package/src/db/index.ts

@@ -1,5 +1,5 @@
 export { assertExistsIn } from "./assert-exists-in";
-export { nullBlindIndexesForSubject } from "./blind-index-cleanup";
+export { nullBlindIndexesForSubject, subjectRowExistsInTenant } from "./blind-index-cleanup";
 export { collectTableMetas } from "./collect-table-metas";
 export { flattenCompoundTypes, rehydrateCompoundTypes } from "./compound-types";
 export { seedConfigValues } from "./config-seed";