@cosmicdrift/kumiko-framework 0.249.0 → 0.251.0

package/src/pipeline/__tests__/search-consumer-named-events.integration.test.ts

@@ -0,0 +1,260 @@
+// #2765 — named domain events (r.defineEvent, not created/updated/restored/
+// deleted/forgotten) on an entity with searchable fields must still reach
+// the search index. The event payload only carries the named event's own
+// field slice, so the consumer reads the live projection row instead.
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { asRawClient, buildEntityTable, createEventStoreExecutor, createTenantDb } from "../../db";
+import { createEntity, createTextField, defineFeature } from "../../engine";
+import {
+  resetEventStore,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "../../stack";
+import { SEARCH_CONSUMER_NAME } from "../system-hooks";
+
+const noteEntity = createEntity({
+  table: "read_named_search_notes",
+  fields: {
+    label: createTextField({ required: true, maxLength: 100, searchable: true }),
+  },
+  softDelete: true,
+});
+const noteTable = buildEntityTable("note", noteEntity);
+
+// No DDL table for this one — proves the searchable-fields gate runs
+// before any query, not after a failed one.
+const ghostEntity = createEntity({
+  table: "read_named_search_ghosts",
+  fields: {
+    note: createTextField({ required: true, maxLength: 50 }),
+  },
+});
+
+const ROW_LABEL = "row-projection-value";
+
+const namedSearchFeature = defineFeature("named-search", (r) => {
+  r.entity("note", noteEntity);
+  r.entity("ghost", ghostEntity);
+
+  const relabeled = r.defineEvent("relabeled", z.object({ label: z.string() }), {
+    piiFields: "none",
+  });
+  const poked = r.defineEvent("poked", z.object({}), { piiFields: "none" });
+
+  r.writeHandler(
+    "note:relabel",
+    z.object({ id: z.uuid(), label: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: event.payload.id,
+        aggregateType: "note",
+        type: relabeled.name,
+        payload: { label: event.payload.label },
+      });
+      // Bypasses the executor on purpose (raw SQL, not updateMany — the
+      // executor-built table is write-locked to the executor) so the row
+      // ends up with a value distinct from the event payload above. Proves
+      // the search consumer reads the row, not the payload.
+      await asRawClient(ctx.db).unsafe(
+        `UPDATE read_named_search_notes SET label = $1 WHERE id = $2`,
+        [ROW_LABEL, event.payload.id],
+      );
+      return { isSuccess: true as const, data: { id: event.payload.id } };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.writeHandler(
+    "ghost:poke",
+    z.object({ id: z.uuid() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: event.payload.id,
+        aggregateType: "ghost",
+        type: poked.name,
+        payload: {},
+      });
+      return { isSuccess: true as const, data: { id: event.payload.id } };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+});
+
+let stack: TestStack;
+const admin = TestUsers.admin;
+
+function noteExecutor() {
+  return createEventStoreExecutor(noteTable, noteEntity, {
+    entityName: "note",
+    searchAdapter: stack.search,
+  });
+}
+
+function tenantDb() {
+  return createTenantDb(stack.db, admin.tenantId, "system");
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [namedSearchFeature] });
+  await unsafeCreateEntityTable(stack.db, noteEntity, "note");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(async () => {
+  await resetEventStore(stack, ["read_named_search_notes"]);
+});
+
+describe("search consumer: named domain events (#2765)", () => {
+  test("named event on a searchable entity indexes from the projection row, not the payload", async () => {
+    const created = await noteExecutor().create({ label: "original-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+    await stack.eventDispatcher?.runOnce();
+
+    const beforeHits = await stack.search.search(admin.tenantId, "original-label", {
+      filterType: "note",
+    });
+    expect(beforeHits.some((h) => String(h.entityId) === id)).toBe(true);
+
+    await stack.http.writeOk(
+      "named-search:write:note:relabel",
+      { id, label: "payload-label-should-not-be-indexed" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    const payloadHits = await stack.search.search(
+      admin.tenantId,
+      "payload-label-should-not-be-indexed",
+      { filterType: "note" },
+    );
+    expect(payloadHits).toHaveLength(0);
+
+    const rowHits = await stack.search.search(admin.tenantId, ROW_LABEL, { filterType: "note" });
+    expect(rowHits.some((h) => String(h.entityId) === id)).toBe(true);
+  });
+
+  test("named event on an entity without searchable fields triggers no query and no index", async () => {
+    const id = crypto.randomUUID();
+    // Ghost has no DDL table — if the consumer queried it anyway, runOnce()
+    // would reject instead of completing (relation does not exist).
+    await stack.http.writeOk("named-search:write:ghost:poke", { id }, admin);
+    const result = await stack.eventDispatcher?.runOnce();
+    expect(result?.byConsumer[SEARCH_CONSUMER_NAME]?.failed).toBe(0);
+
+    const hits = await stack.search.search(admin.tenantId, "poked", { filterType: "ghost" });
+    expect(hits).toHaveLength(0);
+  });
+
+  test("named event with no live projection row removes the index entry", async () => {
+    const created = await noteExecutor().create({ label: "vanishing-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "vanishing-label", { filterType: "note" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    // Hard-delete the row directly, bypassing executor.forget — simulates a
+    // projection row that's simply gone, distinct from the deleted/forgotten
+    // verb path covered by the regression test below.
+    await asRawClient(stack.db).unsafe(`DELETE FROM read_named_search_notes WHERE id = $1`, [id]);
+
+    await stack.http.writeOk("named-search:write:note:relabel", { id, label: "irrelevant" }, admin);
+    await stack.eventDispatcher?.runOnce();
+
+    const after = await stack.search.search(admin.tenantId, "vanishing-label", {
+      filterType: "note",
+    });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+
+  test("named event on a soft-deleted entity does not resurrect the index entry", async () => {
+    const created = await noteExecutor().create({ label: "soft-deleted-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = created.data.id;
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (
+        await stack.search.search(admin.tenantId, "soft-deleted-label", { filterType: "note" })
+      ).some((h) => String(h.entityId) === String(id)),
+    ).toBe(true);
+
+    const deleted = await noteExecutor().delete({ id }, admin, tenantDb());
+    if (!deleted.isSuccess) throw new Error("delete failed");
+    await stack.eventDispatcher?.runOnce();
+
+    // The row still physically exists (isDeleted: true) — a plain fetchOne
+    // without the soft-delete filter would find it and re-index it.
+    await stack.http.writeOk(
+      "named-search:write:note:relabel",
+      { id: String(id), label: "irrelevant" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    const after = await stack.search.search(admin.tenantId, ROW_LABEL, { filterType: "note" });
+    expect(after.some((h) => String(h.entityId) === String(id))).toBe(false);
+  });
+
+  test("created/updated/restored/deleted/forgotten still index/remove as before (regression)", async () => {
+    const created = await noteExecutor().create({ label: "crud-created" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = created.data.id;
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-created", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const updated = await noteExecutor().update(
+      { id, changes: { label: "crud-updated" } },
+      admin,
+      tenantDb(),
+      { skipOptimisticLock: true },
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const deleted = await noteExecutor().delete({ id }, admin, tenantDb());
+    if (!deleted.isSuccess) throw new Error("delete failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(false);
+
+    const restored = await noteExecutor().restore({ id }, admin, tenantDb());
+    if (!restored.isSuccess) throw new Error("restore failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const forgotten = await noteExecutor().forget({ id }, admin, tenantDb());
+    if (!forgotten.isSuccess) throw new Error("forget failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(false);
+  });
+});

package/src/pipeline/__tests__/try-append-event.integration.test.ts

@@ -50,7 +50,9 @@ const admin = TestUsers.admin;
 
 const tryAppendFeature = defineFeature("tae", (r) => {
   r.entity("taeMarker", markerEntity);
-  const appended = r.defineEvent("appended", z.object({ note: z.string() }));
+  const appended = r.defineEvent("appended", z.object({ note: z.string() }), {
+    piiFields: "none",
+  });
 
   r.writeHandler(
     "doc:try-append",

package/src/pipeline/system-hooks.ts

@@ -6,9 +6,18 @@ import {
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
 } from "../crypto";
-import type { DbRow } from "../db/connection";
+import { createTenantDb, entityTableFromRegistry, rehydrateCompoundTypes } from "../db";
+import type { DbConnection, DbRow } from "../db/connection";
 import { tenantChannel } from "../engine/constants";
-import type { EntityId, JobRunnerRef, Registry, SessionUser } from "../engine/types";
+import type {
+  AppContext,
+  EntityDefinition,
+  EntityId,
+  JobRunnerRef,
+  Registry,
+  SessionUser,
+  TenantId,
+} from "../engine/types";
 import type { SearchAdapter, SearchDocument } from "../search/types";
 import type { EventConsumer } from "./event-dispatcher";
 
@@ -21,25 +30,29 @@ import type { EventConsumer } from "./event-dispatcher";
 //
 // Event → Search-Op Mapping:
 //
-//   <entity>.created     → index(tenantId, doc)
-//   <entity>.updated     → index(tenantId, doc)   // re-index mit neuem state
-//   <entity>.restored    → index(tenantId, doc)   // wiederbeleben
+//   <entity>.created     → index(tenantId, doc)   // state = event.payload
+//   <entity>.updated     → index(tenantId, doc)   // state = { ...previous, ...changes }
+//   <entity>.restored    → index(tenantId, doc)   // state = event.payload.previous
 //   <entity>.deleted     → remove(tenantId, type, id)
+//   <entity>.forgotten   → remove(tenantId, type, id)
+//   <entity>.<named>     → index or remove, state read from the live
+//                          projection row (#2765) — a named domain event
+//                          carries only a payload slice, not the full
+//                          entity, so there's no fixed shape to reconstruct
+//                          state from the way created/updated/restored do.
+//                          Only queried when the entity declares searchable
+//                          fields/extensions; no row (hard/soft-deleted) →
+//                          remove, same as the deleted branch.
 //
-// Der Document-State wird aus dem Event rekonstruiert (kein SaveContext
-// mehr available). Regel:
+// Sensitive fields never reach this consumer for created/updated/restored —
+// event-store-executor.ts strips them before they land in the event log.
+// The projection-row path (named events) reads them from the live table
+// instead, so the same sensitive+searchable boot-guard (entity-handler.ts)
+// keeps them out there too.
 //
-//   created:  state = event.payload            // ganze entity ist im payload
-//   updated:  state = { ...previous, ...changes }  // rekonstruiert neuen state
-//   restored: state = event.payload.previous   // restored field-set
-//
-// Sensitive fields sind aus dem event log bereits gestrippt (event-store-
-// executor.ts), also kriegt der Search-Index sie ebenfalls nicht — das ist
-// die gleiche Garantie wie vorher beim postSave-hook.
-//
-// Batch-Variante gibt's aktuell nicht mehr — jeder Event triggert einen
-// eigenen index()-call. Wenn Performance nach Scale-Messung das erfordert,
-// kann der event-dispatcher später eine Batch-Handler-Variante bekommen.
+// No batch variant right now — every event triggers its own index() call.
+// If a scale measurement later calls for it, the event-dispatcher could
+// grow a batch-handler variant.
 export const SEARCH_CONSUMER_NAME = "system:consumer:search";
 
 export function createSearchEventConsumer(
@@ -55,7 +68,7 @@ export function createSearchEventConsumer(
     // killing the consumer near-instantly). Upgrade path: time-based
     // dead-lettering in event-dispatcher-delivery.ts if 2min isn't enough.
     errorPolicy: { maxAttempts: 1200 },
-    handler: async (event) => {
+    handler: async (event, ctx) => {
       const entityName = event.aggregateType;
       const verb = event.type.split(".").pop();
       const tenantId = event.tenantId;
@@ -67,14 +80,41 @@ export function createSearchEventConsumer(
         return;
       }
 
-      if (verb !== "created" && verb !== "updated" && verb !== "restored") {
-        // skip: other event types (custom domain events, future verbs) don't
-        // carry a search-indexable payload shape. If a future feature needs
-        // them indexed, it registers its own multiStreamProjection.
-        return;
+      let state: Record<string, unknown>;
+      if (verb === "created" || verb === "updated" || verb === "restored") {
+        state = reconstructStateForSearch(event.payload, verb);
+      } else {
+        // #2765 — named domain event: no fixed payload shape to reconstruct
+        // state from. Only worth a projection read when the entity actually
+        // declared searchable fields/extensions — same check
+        // buildSearchDocument makes below, done here first so a non-
+        // searchable entity's named events stay a no-op like before.
+        const entity = registry.getEntity(entityName);
+        const isSearchable =
+          entity !== undefined &&
+          (registry.getSearchableFields(entityName).length > 0 ||
+            registry.getSearchPayloadExtensions(entityName).length > 0);
+        // skip: entity declares no searchable fields/extensions — nothing to
+        // index, stays a no-op with no extra query, same as before #2765.
+        if (!entity || !isSearchable) return;
+
+        const row = await readProjectionRowForSearch(
+          ctx,
+          registry,
+          entityName,
+          entity,
+          tenantId,
+          event.aggregateId,
+        );
+        // skip: no live row (hard-deleted stream, or soft-deleted) — same
+        // outcome as the deleted/forgotten branch above.
+        if (!row) {
+          await searchAdapter.remove(tenantId, entityName, event.aggregateId);
+          return;
+        }
+        state = row;
       }
 
-      let state = reconstructStateForSearch(event.payload, verb);
       state = await decryptSearchableSubjectFields(entityName, state, registry);
       // skip: erased subject — drop the doc so a rebuild cannot resurrect plaintext.
       if (hasErasedSearchableSubjectField(entityName, state, registry)) {
@@ -91,6 +131,35 @@ export function createSearchEventConsumer(
   };
 }
 
+// #2765 — reads the live projection row for a named domain event, tenant-
+// scoped through createTenantDb the same way MultiStreamProjection appliers
+// scope their apply()-writes (see api/server.ts), on the table the registry
+// actually booted (entityTableFromRegistry) rather than one freshly derived
+// from the entity definition alone. undefined means "no live row" — a hard
+// delete or a soft-delete — which the caller treats as a remove.
+async function readProjectionRowForSearch(
+  ctx: AppContext,
+  registry: Registry,
+  entityName: string,
+  entity: EntityDefinition,
+  tenantId: TenantId,
+  entityId: EntityId,
+): Promise<Record<string, unknown> | undefined> {
+  // @cast-boundary engine-bridge — consumer ctx.db is always the outer
+  // DbConnection: event-dispatcher creation is gated on it being set
+  // (api/server.ts), never a HandlerContext's already-tenant-scoped TenantDb.
+  const baseDb = ctx.db as DbConnection | undefined;
+  if (!baseDb) return undefined;
+  const table = entityTableFromRegistry(registry, entityName, entity);
+  const where: Record<string, unknown> = { id: entityId };
+  if (entity.softDelete && table["isDeleted"]) {
+    where["isDeleted"] = false;
+  }
+  const row = await createTenantDb(baseDb, tenantId).fetchOne(table, where);
+  if (!row) return undefined;
+  return rehydrateCompoundTypes(row, entity);
+}
+
 // #1610 — subject-annotated searchable fields are ciphertext in the event
 // payload; decrypt into the derived index only. No KMS → omit ciphertext
 // values rather than indexing blobs.