@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/src/search/purge-subject.ts

@@ -1,253 +0,0 @@
-// Purge derived search documents for an erased PII subject (#1610).
-//
-// After kms.eraseKey the projection/event ciphertext is unreadable, but Meili
-// still holds the plaintext that createSearchEventConsumer decrypted into the
-// index. Discovery is dual-path:
-//   1. Ownership: pii self-id / userOwned.ownerField / tenantOwned.tenantId
-//      (survives anonymize hooks that overwrite ciphertext with plaintext).
-//   2. Ciphertext LIKE prefix (same as nullBlindIndexesForSubject) for rows
-//      that still carry the subject key in encrypted columns.
-
-import { quoteIdent, subjectCiphertextLikePattern } from "../crypto/ciphertext-pattern";
-import { isSelfPiiField } from "../crypto/is-self-pii-field";
-import type { SubjectId } from "../crypto/kms-adapter";
-import { collectSearchableSubjectFields } from "../crypto/subject-resolver";
-import type { DbRunner } from "../db/connection";
-import { resolveTableName } from "../db/entity-table-meta";
-import { executeRawQueryRead } from "../db/queries/raw-sql";
-import { tableExists } from "../db/schema-inspection";
-import type { FeatureDefinition } from "../engine/types";
-import type { EntityDefinition } from "../engine/types/fields";
-import type { EntityId, TenantId } from "../engine/types/identifiers";
-import { toSnakeCase } from "../utils/case";
-import type { SearchAdapter } from "./types";
-
-function finalizePredicateParts(
-  parts: readonly string[],
-  params: readonly unknown[],
-): { sql: string; params: unknown[] } | null {
-  if (parts.length === 0) return null;
-  return { sql: parts.join(" OR "), params: [...params] };
-}
-
-function userOwnershipPredicates(
-  entity: EntityDefinition,
-  searchableFields: readonly string[],
-  userId: string,
-  nextParam: () => number,
-): { sql: string; params: unknown[] } | null {
-  const parts: string[] = [];
-  const params: unknown[] = [];
-  let selfIdN: number | undefined;
-  const ownerFieldN = new Map<string, number>();
-
-  for (const fieldName of searchableFields) {
-    const field = entity.fields[fieldName];
-    if (!field) continue;
-    if ("userOwned" in field && field.userOwned !== undefined) {
-      const col = toSnakeCase(field.userOwned.ownerField);
-      let n = ownerFieldN.get(col);
-      if (n === undefined) {
-        n = nextParam();
-        ownerFieldN.set(col, n);
-        params.push(userId);
-        parts.push(`${quoteIdent(col)} = $${n}`);
-      }
-    } else if (isSelfPiiField(field) && selfIdN === undefined) {
-      selfIdN = nextParam();
-      params.push(userId);
-      parts.push(`${quoteIdent("id")} = $${selfIdN}`);
-    }
-  }
-  return finalizePredicateParts(parts, params);
-}
-
-function tenantOwnershipPredicates(
-  entity: EntityDefinition,
-  searchableFields: readonly string[],
-  tenantId: string,
-  nextParam: () => number,
-): { sql: string; params: unknown[] } | null {
-  const parts: string[] = [];
-  const params: unknown[] = [];
-  let tenantIdN: number | undefined;
-
-  for (const fieldName of searchableFields) {
-    const field = entity.fields[fieldName];
-    if (!field) continue;
-    if ("tenantOwned" in field && field.tenantOwned === true && tenantIdN === undefined) {
-      tenantIdN = nextParam();
-      params.push(tenantId);
-      parts.push(`${quoteIdent("tenant_id")} = $${tenantIdN}`);
-    }
-  }
-  return finalizePredicateParts(parts, params);
-}
-
-function recordOwnershipPredicates(
-  entity: EntityDefinition,
-  searchableFields: readonly string[],
-  entityName: string,
-  subjectEntity: string,
-  subjectId: string,
-  nextParam: () => number,
-): { sql: string; params: unknown[] } | null {
-  const parts: string[] = [];
-  const params: unknown[] = [];
-  let recordIdN: number | undefined;
-
-  for (const fieldName of searchableFields) {
-    const field = entity.fields[fieldName];
-    if (!field) continue;
-    const isMatchingRecordField =
-      entityName === subjectEntity && "recordOwned" in field && field.recordOwned === true;
-    if (isMatchingRecordField && recordIdN === undefined) {
-      recordIdN = nextParam();
-      params.push(subjectId);
-      parts.push(`${quoteIdent("id")} = $${recordIdN}`);
-    }
-  }
-  return finalizePredicateParts(parts, params);
-}
-
-/** Build OR predicates for rows owned by `subject` (id / ownerField / tenant_id). */
-function ownershipPredicates(
-  entity: EntityDefinition,
-  searchableFields: readonly string[],
-  entityName: string,
-  subject: SubjectId,
-  nextParam: () => number,
-): { sql: string; params: unknown[] } | null {
-  switch (subject.kind) {
-    case "user":
-      return userOwnershipPredicates(entity, searchableFields, subject.userId, nextParam);
-    case "tenant":
-      return tenantOwnershipPredicates(entity, searchableFields, subject.tenantId, nextParam);
-    case "record":
-      return recordOwnershipPredicates(
-        entity,
-        searchableFields,
-        entityName,
-        subject.entity,
-        subject.id,
-        nextParam,
-      );
-    default: {
-      const exhaustiveCheck: never = subject;
-      throw new Error(`Unhandled subject kind: ${JSON.stringify(exhaustiveCheck)}`);
-    }
-  }
-}
-
-type MatchedRow = { id: string; tenant_id: string };
-
-// ponytail: LIMIT/OFFSET, not a keyset cursor — mirrors reindexEntity's same
-// tradeoff (id type varies uuid/serial across entities). A tenant-destroy
-// purge is a one-time sweep, not a hot path.
-const PURGE_BATCH_SIZE = 500;
-
-async function collectMatchingRowsForEntity(
-  db: DbRunner,
-  tableName: string,
-  whereSql: string,
-  params: readonly unknown[],
-): Promise<readonly MatchedRow[]> {
-  const rows: MatchedRow[] = [];
-  let offset = 0;
-  for (;;) {
-    const offsetN = params.length + 1;
-    const page = await executeRawQueryRead<MatchedRow>(
-      db,
-      `SELECT id, tenant_id FROM ${quoteIdent(tableName)} WHERE ${whereSql}
-        ORDER BY ${quoteIdent("id")} ASC
-        LIMIT ${PURGE_BATCH_SIZE} OFFSET $${offsetN}`,
-      [...params, offset],
-    );
-    if (page.length === 0) break;
-    rows.push(...page);
-    offset += page.length;
-    if (page.length < PURGE_BATCH_SIZE) break;
-  }
-  return rows;
-}
-
-function buildSubjectPredicate(
-  entity: EntityDefinition,
-  fields: readonly string[],
-  likePattern: string,
-  entityName: string,
-  subject: SubjectId | undefined,
-): { sql: string; params: unknown[] } {
-  let paramIdx = 0;
-  const nextParam = () => ++paramIdx;
-  const params: unknown[] = [];
-  const orParts: string[] = [];
-
-  const likeN = nextParam();
-  params.push(likePattern);
-  orParts.push(
-    `(${fields.map((f) => `${quoteIdent(toSnakeCase(f))} LIKE $${likeN}`).join(" OR ")})`,
-  );
-
-  if (subject) {
-    const owned = ownershipPredicates(entity, fields, entityName, subject, nextParam);
-    if (owned) {
-      params.push(...owned.params);
-      orParts.push(`(${owned.sql})`);
-    }
-  }
-
-  return { sql: orParts.join(" OR "), params };
-}
-
-export async function purgeSearchDocumentsForSubject(
-  db: DbRunner,
-  features: ReadonlyMap<string, FeatureDefinition>,
-  search: SearchAdapter,
-  subjectKey: string,
-  /** When set, also match rows by ownership — needed after anonymize rewrites ciphertext. */
-  subject?: SubjectId,
-): Promise<void> {
-  const likePattern = subjectCiphertextLikePattern(subjectKey);
-  const byTenant = new Map<string, { entityType: string; entityId: EntityId }[]>();
-  const seen = new Set<string>();
-
-  for (const feature of features.values()) {
-    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
-      const fields = collectSearchableSubjectFields(entity);
-      if (fields.length === 0) continue;
-      const tableName = resolveTableName(entityName, entity, undefined);
-      // Same post-eraseKey hazard as nullBlindIndexesForSubject (fw#2550):
-      // a mounted feature without its migration must not abort the purge
-      // (and the audit event after it).
-      if (!(await tableExists(db, tableName))) continue;
-      const predicate = buildSubjectPredicate(entity, fields, likePattern, entityName, subject);
-      const rows = await collectMatchingRowsForEntity(
-        db,
-        tableName,
-        predicate.sql,
-        predicate.params,
-      );
-      for (const row of rows) {
-        const key = `${row.tenant_id}:${entityName}:${row.id}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        const list = byTenant.get(row.tenant_id) ?? [];
-        list.push({ entityType: entityName, entityId: row.id as EntityId });
-        byTenant.set(row.tenant_id, list);
-      }
-    }
-  }
-
-  for (const [tenantId, items] of byTenant) {
-    if (items.length === 0) continue;
-    const tid = tenantId as TenantId;
-    if (search.removeBatch) {
-      await search.removeBatch(tid, items);
-    } else {
-      for (const item of items) {
-        await search.remove(tid, item.entityType, item.entityId);
-      }
-    }
-  }
-}

package/src/search/reindex-entity.ts

@@ -1,190 +0,0 @@
-// One-time backfill for entities that only got `searchable: true` after rows
-// already existed (#1206). buildSearchDocument() only runs on the write path
-// (createSearchEventConsumer, system-hooks.ts) — pre-existing rows never
-// pass through it, so they stay unfindable until their next write. This
-// re-derives a SearchDocument straight from the read-table row for every
-// existing row and indexes it, same as a live write would.
-
-import type { DbRunner } from "../db/connection";
-import { resolveTableName } from "../db/entity-table-meta";
-import { executeRawQueryRead } from "../db/queries/raw-sql";
-import type { Registry, TenantId } from "../engine/types";
-import {
-  buildSearchDocument,
-  decryptSearchableSubjectFields,
-  hasErasedSearchableSubjectField,
-} from "../pipeline/system-hooks";
-import { toSnakeCase } from "../utils/case";
-import type { SearchAdapter, SearchDocument } from "./types";
-
-export type ReindexEntityFailure = {
-  readonly entityId: string;
-  readonly reason: string;
-};
-
-export type ReindexEntityResult = {
-  readonly scannedRows: number;
-  readonly indexedRows: number;
-  // Only nonzero in a dry run — docs that would have been indexed. In a
-  // real run indexedRows already counts these; wouldIndexRows stays 0.
-  readonly wouldIndexRows: number;
-  readonly failures: readonly ReindexEntityFailure[];
-};
-
-export type ReindexEntityOptions = {
-  readonly batchSize?: number;
-  // Scan + build docs, write nothing.
-  readonly dryRun?: boolean;
-};
-
-function quoteIdent(name: string): string {
-  return `"${name.replace(/"/g, '""')}"`;
-}
-
-// Read-table state, forward-mapped from entity.fields (fieldName →
-// toSnakeCase(fieldName)). SELECT * + forward-map instead of building an
-// explicit column list: some field types (files/images) emit no column at
-// all, others (locatedTimestamp, money) emit companion columns under a
-// different name — an explicit alias list breaks on those. Missing columns
-// are just skipped, matching what a `.created` event payload would carry.
-function rowToState(
-  row: Record<string, unknown>,
-  fieldNames: readonly string[],
-): Record<string, unknown> {
-  const state: Record<string, unknown> = {};
-  for (const fieldName of fieldNames) {
-    const column = toSnakeCase(fieldName);
-    if (Object.hasOwn(row, column)) state[fieldName] = row[column];
-  }
-  return state;
-}
-
-export async function reindexEntity(
-  db: DbRunner,
-  registry: Registry,
-  searchAdapter: SearchAdapter,
-  entityName: string,
-  tenantId: TenantId,
-  options: ReindexEntityOptions = {},
-): Promise<ReindexEntityResult> {
-  const entity = registry.getEntity(entityName);
-  if (!entity) {
-    throw new Error(`reindexEntity: unknown entity "${entityName}"`);
-  }
-  const searchableFields = registry.getSearchableFields(entityName);
-  const extensions = registry.getSearchPayloadExtensions(entityName);
-  if (searchableFields.length === 0 && extensions.length === 0) {
-    throw new Error(
-      `reindexEntity: entity "${entityName}" has no searchable fields and no search-payload ` +
-        `extensions — nothing to index.`,
-    );
-  }
-
-  const batchSize = options.batchSize ?? 500;
-  const tableName = resolveTableName(entityName, entity, undefined);
-  const fieldNames = Object.keys(entity.fields);
-  // Soft-deleted rows already left the live index (the .deleted consumer
-  // calls searchAdapter.remove()) — resurrecting them here would make
-  // erased entities findable again.
-  const deletedFilter =
-    entity.softDelete === true ? `AND ${quoteIdent("is_deleted")} IS NOT TRUE` : "";
-
-  const result = {
-    scannedRows: 0,
-    indexedRows: 0,
-    wouldIndexRows: 0,
-    failures: [] as ReindexEntityFailure[],
-  };
-
-  let offset = 0;
-  // Whether a searchable field lacks a matching read-table column depends
-  // only on the table's column set (rowToState/Object.hasOwn), not on any
-  // particular row's data — every row from the same SELECT * has the same
-  // columns. Check once against the first row instead of every row, so a
-  // dropped/never-migrated column fails fast with one clear error instead
-  // of one identical failures[] entry per scanned row (1M rows → 1M
-  // entries, and the real schema problem is buried in "x failed").
-  let uncheckedSchema = true;
-
-  for (;;) {
-    // ponytail: LIMIT/OFFSET, not a keyset cursor — id can be uuid or
-    // serial depending on the entity, and a uniform cursor comparison
-    // across both types needs a text cast that breaks integer ordering.
-    // This is a one-time backfill over existing rows, not a live hot path;
-    // switch to keyset if it ever needs to run against a churning table.
-    const rows = await executeRawQueryRead<Record<string, unknown>>(
-      db,
-      `SELECT * FROM ${quoteIdent(tableName)}
-        WHERE ${quoteIdent("tenant_id")} = $1 ${deletedFilter}
-        ORDER BY ${quoteIdent("id")} ASC
-        LIMIT $2 OFFSET $3`,
-      [tenantId, batchSize, offset],
-    );
-    if (rows.length === 0) break;
-
-    if (uncheckedSchema) {
-      uncheckedSchema = false;
-      const sampleState = rowToState(rows[0] as Record<string, unknown>, fieldNames);
-      const unmappedField = searchableFields.find((fieldName) => !(fieldName in sampleState));
-      if (unmappedField !== undefined) {
-        throw new Error(
-          `reindexEntity: searchable field "${unmappedField}" is not mappable from read-table ` +
-            `column ${quoteIdent(tableName)} — likely a dropped/never-migrated column.`,
-        );
-      }
-    }
-
-    const docs: Array<{ entityId: string; doc: SearchDocument }> = [];
-    for (const row of rows) {
-      result.scannedRows++;
-      const entityId = String(row["id"]);
-      try {
-        const rawState = rowToState(row, fieldNames);
-        // `pii + searchable` fields hold ciphertext on the read-table row —
-        // decrypt the same way the live write-path consumer does. An
-        // erased subject key doesn't throw, it swaps the value for
-        // PII_ERASED_SENTINEL (see decryptSearchableSubjectFields) — check
-        // for that AFTER decrypting, mirroring the softDelete filter above:
-        // resurrecting a crypto-shredded row here would undo
-        // purgeSearchDocumentsForSubject and make it findable again.
-        const state = await decryptSearchableSubjectFields(entityName, rawState, registry);
-        if (hasErasedSearchableSubjectField(entityName, state, registry)) continue;
-        const doc = await buildSearchDocument(entityName, entityId, state, registry);
-        if (doc) docs.push({ entityId, doc });
-      } catch (e) {
-        result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
-      }
-    }
-
-    if (!options.dryRun && docs.length > 0) {
-      if (searchAdapter.indexBatch) {
-        try {
-          await searchAdapter.indexBatch(
-            tenantId,
-            docs.map((d) => d.doc),
-          );
-          result.indexedRows += docs.length;
-        } catch (e) {
-          const reason = e instanceof Error ? e.message : String(e);
-          for (const { entityId } of docs) result.failures.push({ entityId, reason });
-        }
-      } else {
-        for (const { entityId, doc } of docs) {
-          try {
-            await searchAdapter.index(tenantId, doc);
-            result.indexedRows++;
-          } catch (e) {
-            result.failures.push({ entityId, reason: e instanceof Error ? e.message : String(e) });
-          }
-        }
-      }
-    } else if (options.dryRun) {
-      result.wouldIndexRows += docs.length;
-    }
-
-    offset += rows.length;
-    if (rows.length < batchSize) break;
-  }
-
-  return result;
-}

package/src/secrets/__tests__/contains-secret.test.ts

@@ -1,108 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import * as z from "zod";
-import type { TenantId } from "../../engine";
-import { defineQueryHandler } from "../../engine/define-handler";
-import { type ContainsSecret, createSecret, type Secret } from "../index";
-
-// R6 is a COMPILE-TIME guard. The type-level assertions below are the real
-// coverage — they are checked by tsc (the bun runtime strips types without
-// checking). The runtime test only proves the guarded registration functions
-// still build a clean handler.
-
-type Expect<T extends true> = T;
-type Equal<A, B> =
-  (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
-
-// One exported tuple so each case is checked by tsc without tripping
-// noUnusedLocals on a named alias. Any wrong predicate fails to compile here.
-export type _R6TypeAssertions = [
-  // Clean responses → false, incl. branded primitives (TenantId, via Primitive)
-  // and opaque leaves (Temporal.Instant, Date, via SafeLeaf). These double as
-  // the false-positive guard: a mangled leaf would flip the case to `true`.
-  Expect<Equal<ContainsSecret<{ ok: true; id: string }>, false>>,
-  Expect<Equal<ContainsSecret<{ id: TenantId; when: Temporal.Instant; at: Date }>, false>>,
-  Expect<Equal<ContainsSecret<{ items: { label: string }[]; total: number }>, false>>,
-  Expect<Equal<ContainsSecret<{ apiKey: string }>, false>>, // revealed → plain string
-  // A Secret<> anywhere → true.
-  Expect<Equal<ContainsSecret<{ apiKey: Secret<string> }>, true>>,
-  Expect<Equal<ContainsSecret<{ creds: { token: Secret<string> } }>, true>>,
-  Expect<Equal<ContainsSecret<{ keys: Secret<string>[] }>, true>>,
-  Expect<Equal<ContainsSecret<{ when: Temporal.Instant; secret: Secret<string> }>, true>>,
-  // Uninspectable types are biased to `false` (allowed) — the runtime guard is
-  // the backstop. This is what keeps generic-over-response handlers compiling.
-  Expect<Equal<ContainsSecret<unknown>, false>>,
-  Expect<Equal<ContainsSecret<never>, false>>,
-  // 556/3: ContainsSecret<A | B> distributes over the union (naked type
-  // param) to `ContainsSecret<A> | ContainsSecret<B>` = `boolean`, not the
-  // literal `true` — pinned here so a future change to this predicate can't
-  // silently regress it. The actual leak-guard in define-handler.ts compares
-  // via `true extends ContainsSecret<TData>` (556/1) instead of `ContainsSecret<
-  // TData> extends true`, which is fail-closed for `boolean` either way.
-  Expect<Equal<ContainsSecret<{ ok: true } | { s: Secret<string> }>, boolean>>,
-  // 556/2: Map/Set are explicit SafeLeaf members now — pins that the runtime
-  // guard's "walk Map/Set entries separately" intent is mirrored, not an
-  // accidental compile-time blind spot.
-  Expect<Equal<ContainsSecret<Map<string, Secret<string>>>, false>>,
-  Expect<Equal<ContainsSecret<Set<Secret<string>>>, false>>,
-];
-
-const schema = z.object({ q: z.string() });
-declare const aSecret: Secret<string>;
-
-// End-to-end: a Secret<> in the query response is a compile error at the call.
-// @ts-expect-error — R6: Secret<> must not appear in a handler response
-defineQueryHandler({
-  name: "t:query:leak",
-  schema,
-  access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
-  handler: async () => ({ apiKey: aSecret }),
-});
-
-// Regression: a handler generic over its response (the createTokenRequestHandler
-// pattern) must NOT false-flag — the guard allows what it cannot prove. This
-// call compiling at all is the assertion.
-function genericResponseHandler<K extends string>(kind: K) {
-  return defineQueryHandler({
-    name: "t:query:generic",
-    schema,
-    access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
-    handler: async () => ({ kind, ok: true }) as { kind: K; ok: boolean },
-  });
-}
-void genericResponseHandler;
-
-// 556/1: ContainsSecret<A | B> distributes over the union (naked type param
-// in the condition) to `ContainsSecret<A> | ContainsSecret<B>` = `boolean`,
-// not the literal `true` — a check written as `ContainsSecret<TData> extends
-// true` silently passes a union with a leak hidden in ONE branch. Both
-// assertions below must hold: the guard rejects the leaking union AND still
-// accepts the clean one, proving the fix (membership form on the phantom
-// param) is fail-closed for unions, not just for a bare Secret<>.
-declare const leakingUnion: { ok: true } | { apiKey: Secret<string> };
-// @ts-expect-error — R6: a Secret<> hidden in one union branch must still leak-guard
-defineQueryHandler({
-  name: "t:query:union-leak",
-  schema,
-  access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
-  handler: async () => leakingUnion,
-});
-
-declare const cleanUnion: { ok: true } | { id: string };
-defineQueryHandler({
-  name: "t:query:union-clean",
-  schema,
-  access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
-  handler: async () => cleanUnion,
-});
-
-describe("R6 ContainsSecret", () => {
-  test("a clean query handler still builds — the guard param is invisible", () => {
-    const def = defineQueryHandler({
-      name: "t:query:clean",
-      schema,
-      access: { openToAll: { reason: "test handler callable by any signed-in test user" } },
-      handler: async () => ({ ok: true, value: createSecret("x").reveal() }),
-    });
-    expect(def.name).toBe("t:query:clean");
-  });
-});