@cosmicdrift/kumiko-framework 0.306.0 → 0.307.0

package/src/event-store/__tests__/event-attribution.integration.test.ts

@@ -14,12 +14,13 @@
 //      and stay readable without the new fields.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { UNATTRIBUTED_ORIGIN } from "@cosmicdrift/kumiko-types/event-store-types";
+import { UNATTRIBUTED_ORIGIN, type WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
 import { z } from "zod";
 import { createEventStoreExecutor } from "../../db/event-store-executor";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { createEntity, createTextField, defineFeature } from "../../engine";
+import type { TenantId } from "../../engine/types";
 import {
   resetEventStore,
   setupTestStack,
@@ -43,8 +44,11 @@ const orderTable = buildEntityTable("attr-order", orderEntity);
 
 const PLACED = "attribution:event:placed";
 const CONFIRMED = "attribution:event:confirmed";
+const PROBED = "attribution:event:probed";
 const PLACE_HANDLER = "attribution:write:order:place";
+const PROBE_HANDLER = "attribution:write:order:probe";
 const CONFIRMER_MSP = "attribution:projection:confirmer";
+const TENANT_ID = "00000000-0000-4000-8000-000000000002" as TenantId;
 
 const attributionFeature = defineFeature("attribution", (r) => {
   r.entity("attr-order", orderEntity);
@@ -75,6 +79,26 @@ const attributionFeature = defineFeature("attribution", (r) => {
     { access: { roles: ["Admin"] } },
   );
 
+  const probed = r.defineEvent("probed", z.object({ orderId: z.uuid() }), { piiFields: "none" });
+
+  // Anonymous, no public-intake declared, no PII field written (nothing to gate).
+  r.writeHandler(
+    "order:probe",
+    z.object({ item: z.string() }),
+    async (event, ctx) => {
+      const created = await orderExecutor.create({ item: event.payload.item }, event.user, ctx.db);
+      if (!created.isSuccess) return created;
+      await ctx.unsafeAppendEvent({
+        aggregateId: String(created.data.id),
+        aggregateType: "attr-order",
+        type: probed.name,
+        payload: { orderId: String(created.data.id) },
+      });
+      return created;
+    },
+    { access: { roles: ["anonymous"] } },
+  );
+
   r.multiStreamProjection({
     name: "confirmer",
     apply: {
@@ -95,7 +119,11 @@ let stack: TestStack;
 const admin = TestUsers.admin;
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [attributionFeature], systemHooks: [] });
+  stack = await setupTestStack({
+    features: [attributionFeature],
+    systemHooks: [],
+    anonymousAccess: { defaultTenantId: TENANT_ID },
+  });
   await unsafeCreateEntityTable(stack.db, orderEntity, "attr-order");
 });
 
@@ -107,7 +135,7 @@ afterEach(async () => {
   await resetEventStore(stack, ["read_attribution_orders"]);
 });
 
-type Origin = { feature?: string; handler?: string };
+type Origin = { feature?: string; handler?: string; writeOrigin?: WriteOrigin };
 
 async function originOf(type: string): Promise<Origin> {
   const rows = await selectMany(stack.db, eventsTable);
@@ -165,6 +193,28 @@ describe("#3043 — event attribution from the execution scope", () => {
     });
   });
 
+  test("authenticated write: the event carries no writeOrigin at all", async () => {
+    await stack.http.writeOk(PLACE_HANDLER, { item: "cog" }, admin);
+
+    const origin = await originOf(PLACED);
+    expect(origin.writeOrigin).toBeUndefined();
+  });
+
+  test("anonymous non-intake write: the event is stamped with the gated origin", async () => {
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: PROBE_HANDLER,
+      payload: { item: "washer" },
+    });
+    expect(res.status).toBe(200);
+
+    const origin = await originOf(PROBED);
+    expect(origin.writeOrigin).toMatchObject({
+      rootHandler: PROBE_HANDLER,
+      anonymousRoot: true,
+      publicIntake: false,
+    });
+  });
+
   test("appendRaw keeps historical metadata verbatim and stays readable", async () => {
     const aggregateId = uuid();
     await appendRaw(stack.db, {

package/src/event-store/admin-api.ts

@@ -9,6 +9,7 @@
 
 import type { DbRunner } from "../db";
 import { constraintOf, isUniqueViolation } from "../db/pg-error";
+import { claimXactId } from "../db/queries/event-store";
 import {
   eventPredecessorExists,
   findExistingEventVersion,
@@ -54,6 +55,9 @@ export async function appendRaw(runner: DbRunner, event: RawEventToAppend): Prom
   const eventVersion = event.eventVersion ?? 1;
 
   try {
+    // See db/queries/event-store.ts's claimXactId — gap-finality needs a
+    // real xact id assigned before this holder's insert.
+    await claimXactId(runner);
     if (event.expectedVersion === 0) {
       await insertRawFirst(runner, event, newVersion, eventVersion);
     } else {
@@ -145,6 +149,7 @@ export async function appendRawBatch(
   });
 
   try {
+    await claimXactId(runner);
     await insertRawEventBatch(runner, valuesClauses.join(", "), params);
   } catch (e) {
     if (isUniqueViolation(e)) {

package/src/event-store/event-store.ts

@@ -1,5 +1,6 @@
 import {
   type EventMetadata,
+  isPersonalDataGated,
   type StoredEvent,
   UNATTRIBUTED_ORIGIN,
 } from "@cosmicdrift/kumiko-types/event-store-types";
@@ -15,6 +16,7 @@ import { encryptEventPayloadPii } from "../crypto/event-pii";
 import type { DbRunner } from "../db";
 import { constraintOf, isUniqueViolation } from "../db/pg-error";
 import {
+  claimXactId,
   insertSubsequentEventRow,
   notifyPgChannel,
   selectAggregateMaxVersion,
@@ -93,14 +95,16 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
   const eventVersion = toStore.eventVersion ?? 1;
 
   try {
+    await claimXactId(db);
+
     const row =
       toStore.expectedVersion === 0
         ? await insertFirstEvent(db, toStore, newVersion, eventVersion)
         : await insertSubsequentEvent(db, toStore, newVersion, eventVersion);
 
-    // NOTIFY fires on commit (PG buffers NOTIFY per TX), so subscribers never
-    // see a wake-up for an event that later rolled back. Harmless no-op when
-    // no LISTENer is attached.
+    // NOTIFY after the INSERT: outside a transaction each statement commits
+    // on its own, so a NOTIFY sent first would wake the dispatcher before
+    // the row exists.
     await notifyPgChannel(db, EVENTS_PUBSUB_CHANNEL);
 
     return buildStoredEvent(toStore, newVersion, eventVersion, row);
@@ -127,12 +131,15 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
 // bypass this deliberately — they replay historical rows verbatim.
 function stampOrigin(event: EventToAppend): EventToAppend {
   const origin = requestContext.get();
+  const { writeOrigin: _droppedCallerWriteOrigin, ...restMetadata } = event.metadata;
   return {
     ...event,
     metadata: {
-      ...event.metadata,
+      ...restMetadata,
       feature: origin?.feature ?? UNATTRIBUTED_ORIGIN,
       handler: origin?.handler ?? UNATTRIBUTED_ORIGIN,
+      ...(origin?.writeOrigin &&
+        isPersonalDataGated(origin.writeOrigin) && { writeOrigin: origin.writeOrigin }),
     },
   };
 }
@@ -380,9 +387,11 @@ export async function loadAllEventsByType(
 
 // Stream every event for an aggregate_type across all tenants, batchwise
 // instead of buffered. Memory-bounded: never more than `batchSize` rows
-// resident. Cursor walks `events.id` (bigserial monotonic — concurrent
-// inserts get distinct ids in commit order, so no duplicates and no skips
-// past the cursor).
+// resident. Cursor walks `events.id` (bigserial monotonic, but ids are
+// assigned at INSERT time, not commit time — a sweep can overtake a still-
+// open transaction and its lower id, same gap the event-dispatcher's
+// pending_gaps tracks). Fine for this generator's use case: history sweeps
+// (projection-rebuild, tests) that don't need live, just-committed rows.
 //
 // Use case: projection-rebuild on a large event log (>100k events per
 // aggregate-type). loadAllEventsByType would OOM; this iterator yields