@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -1,7 +1,8 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { InMemoryKmsAdapter, PII_CIPHERTEXT_PREFIX, PII_ERASED_SENTINEL } from "../../crypto";
 import { asRawClient } from "../../db/query";
 import { createBooleanField, createEntity, createTextField } from "../../engine";
-import { append, createEventsTable } from "../../event-store";
+import { append, createEventsTable, loadEventsAfterVersion } from "../../event-store";
 import type { EntityCache } from "../../pipeline/entity-cache";
 import {
   createTestDb,
@@ -10,7 +11,8 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "../../stack";
-import { createEncryptionProvider } from "../encryption";
+import { createTestEnvelopeCipher } from "../../testing";
+import { applyEntityEvent } from "../apply-entity-event";
 import { resetEntityFieldEncryptionCacheForTests } from "../entity-field-encryption";
 import { createEventStoreExecutor } from "../event-store-executor";
 import { buildEntityTable } from "../table-builder";
@@ -122,17 +124,18 @@ describe("event-store-executor", () => {
   });
 });
 
-// Sensitive-field stripping: passwords/tokens/IBANs stay in the entity row
-// but MUST NOT land in the immutable event log (GDPR right-to-be-forgotten,
-// secrets-rotation, audit discoverability). Fields marked `sensitive: true`
-// are excluded from every event payload: create data, update changes,
-// update previous, delete previous, restore previous.
+// Sensitive fields (#967): passwords/tokens/IBANs must be ciphertext-at-rest
+// (boot validates sensitive ⇒ pii | encrypted). The event log carries the
+// table ciphertext — replay reproduces the row byte-identically. Plaintext
+// never lands in permanent history; the caller-facing event echo strips the
+// field entirely (#820).
+const SENSITIVE_TEST_KEY = Buffer.from("s3nS!t1vE.kP9xQ2@wN!vL$hR5yT8eU0").toString("base64");
 const sensitiveEntity = createEntity({
   table: "read_es_exec_sensitive",
   fields: {
     email: createTextField({ required: true }),
-    passwordHash: createTextField({ sensitive: true }),
-    apiToken: createTextField({ sensitive: true }),
+    passwordHash: createTextField({ sensitive: true, encrypted: true }),
+    apiToken: createTextField({ sensitive: true, encrypted: true }),
   },
   softDelete: true,
 });
@@ -141,6 +144,7 @@ const sensitiveTable = buildEntityTable("esExecSensitive", sensitiveEntity);
 describe("event-store-executor — sensitive fields", () => {
   const crud = createEventStoreExecutor(sensitiveTable, sensitiveEntity, {
     entityName: "esExecSensitive",
+    encryption: createTestEnvelopeCipher(SENSITIVE_TEST_KEY),
   });
 
   beforeAll(async () => {
@@ -170,26 +174,35 @@ describe("event-store-executor — sensitive fields", () => {
     };
   }
 
-  test("create event payload excludes sensitive fields but entity row keeps them", async () => {
+  test("create event payload carries sensitive fields as table ciphertext; echo strips them", async () => {
     const result = await crud.create(
       { email: "s@test.de", passwordHash: "pw-hash-123", apiToken: "tok-abc" },
       adminUser,
       tdb,
     );
     if (!result.isSuccess) throw new Error("create failed");
-    // Entity row: full data preserved.
+    // Caller-facing row: plaintext preserved.
     expect(result.data.data["passwordHash"]).toBe("pw-hash-123");
     expect(result.data.data["apiToken"]).toBe("tok-abc");
 
-    // Event payload: sensitive stripped, public retained.
+    // Event payload: ciphertext, byte-identical to the table column (#967).
     const event = await lastEvent();
     expect(event.type).toBe("esExecSensitive.created");
     expect(event.payload["email"]).toBe("s@test.de");
-    expect(event.payload["passwordHash"]).toBeUndefined();
-    expect(event.payload["apiToken"]).toBeUndefined();
+    expect(event.payload["passwordHash"]).toBeDefined();
+    expect(event.payload["passwordHash"]).not.toBe("pw-hash-123");
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT password_hash FROM read_es_exec_sensitive WHERE email = 's@test.de' LIMIT 1`,
+    )) as Array<{ password_hash: string }>;
+    expect(event.payload["passwordHash"]).toBe(rawRows[0]!.password_hash);
+
+    // Caller-facing event echo stays stripped (#820).
+    if (!result.data.event) throw new Error("no event echo");
+    expect(result.data.event.payload["passwordHash"]).toBeUndefined();
+    expect(result.data.event.payload["apiToken"]).toBeUndefined();
   });
 
-  test("update event strips sensitive from BOTH changes and previous", async () => {
+  test("update event carries ciphertext in BOTH changes and previous", async () => {
     const created = await crud.create(
       { email: "u@test.de", passwordHash: "old-hash", apiToken: "old-tok" },
       adminUser,
@@ -213,16 +226,29 @@ describe("event-store-executor — sensitive fields", () => {
       previous: { email?: string; passwordHash?: string; apiToken?: string };
     }>();
     expect(event.type).toBe("esExecSensitive.updated");
-    // Changes: email retained (public), passwordHash stripped.
+    // Changes: email plaintext (public), passwordHash ciphertext.
     expect(event.payload.changes.email).toBe("u2@test.de");
-    expect(event.payload.changes.passwordHash).toBeUndefined();
-    // Previous: email retained, passwordHash + apiToken stripped.
+    expect(event.payload.changes.passwordHash).toBeDefined();
+    expect(event.payload.changes.passwordHash).not.toBe("new-hash");
+    // Previous: email plaintext, passwordHash + apiToken ciphertext.
     expect(event.payload.previous.email).toBe("u@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("old-hash");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("old-tok");
+
+    // Caller-facing event echo stays stripped (#820).
+    if (!result.data.event) throw new Error("no event echo");
+    const echoPayload = result.data.event.payload as {
+      changes: Record<string, unknown>;
+      previous: Record<string, unknown>;
+    };
+    expect(echoPayload.changes["passwordHash"]).toBeUndefined();
+    expect(echoPayload.previous["passwordHash"]).toBeUndefined();
+    expect(echoPayload.previous["apiToken"]).toBeUndefined();
   });
 
-  test("delete event strips sensitive from previous", async () => {
+  test("delete event carries ciphertext in previous", async () => {
     const created = await crud.create(
       { email: "d@test.de", passwordHash: "pw", apiToken: "tk" },
       adminUser,
@@ -238,11 +264,13 @@ describe("event-store-executor — sensitive fields", () => {
     const event = await lastEvent<SensitivePrevious>();
     expect(event.type).toBe("esExecSensitive.deleted");
     expect(event.payload.previous.email).toBe("d@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("pw");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("tk");
   });
 
-  test("restore event strips sensitive from previous", async () => {
+  test("restore event carries ciphertext in previous", async () => {
     const created = await crud.create(
       { email: "r@test.de", passwordHash: "pw", apiToken: "tk" },
       adminUser,
@@ -259,8 +287,10 @@ describe("event-store-executor — sensitive fields", () => {
     const event = await lastEvent<SensitivePrevious>();
     expect(event.type).toBe("esExecSensitive.restored");
     expect(event.payload.previous.email).toBe("r@test.de");
-    expect(event.payload.previous.passwordHash).toBeUndefined();
-    expect(event.payload.previous.apiToken).toBeUndefined();
+    expect(event.payload.previous.passwordHash).toBeDefined();
+    expect(event.payload.previous.passwordHash).not.toBe("pw");
+    expect(event.payload.previous.apiToken).toBeDefined();
+    expect(event.payload.previous.apiToken).not.toBe("tk");
   });
 });
 
@@ -324,7 +354,7 @@ const encryptedSoftDeleteEntity = createEntity({
 const encryptedSoftDeleteTable = buildEntityTable("esExecEncSoft", encryptedSoftDeleteEntity);
 
 describe("event-store-executor — encrypted fields", () => {
-  const encryption = createEncryptionProvider(ENCRYPTION_TEST_KEY);
+  const encryption = createTestEnvelopeCipher(ENCRYPTION_TEST_KEY);
   const crud = createEventStoreExecutor(encryptedTable, encryptedEntity, {
     entityName: "esExecEncrypted",
     encryption,
@@ -337,7 +367,6 @@ describe("event-store-executor — encrypted fields", () => {
   );
 
   beforeAll(async () => {
-    process.env["ENCRYPTION_KEY"] = ENCRYPTION_TEST_KEY;
     resetEntityFieldEncryptionCacheForTests();
     await unsafeCreateEntityTable(testDb.db, encryptedEntity, "esExecEncrypted");
     await unsafeCreateEntityTable(testDb.db, encryptedSoftDeleteEntity, "esExecEncSoft");
@@ -390,6 +419,81 @@ describe("event-store-executor — encrypted fields", () => {
     expect(updated.data.data["secretNote"]).toBe("new-note");
   });
 
+  test("update WITHOUT skipUnchanged still re-encrypts a resubmitted-but-unchanged encrypted field (KEK-rotation/backfill contract)", async () => {
+    // Regression guard: direct executor.update() callers that don't opt into
+    // skipUnchanged rely on today's always-re-encrypt behavior to force a
+    // fresh ciphertext for an unchanged plaintext — e.g. auth-mfa's
+    // KEK-rotation job (reencrypt.job.ts) and the user-data-rights #494
+    // backfill both resubmit the CURRENT value on purpose to land a real
+    // event. A blanket value-diff here would silently break both.
+    const created = await crud.create(
+      { email: "force-enc@test.de", secretNote: "same-note" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const before = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'force-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    const updated = await crud.update(
+      { id: created.data.id, version: 1, changes: { secretNote: "same-note" } },
+      adminUser,
+      tdb,
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    const after = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'force-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    // Fresh AEAD nonce per encrypt call → different ciphertext even though
+    // the plaintext is identical. Byte-identical would mean the write was
+    // skipped, which is exactly what would break KEK rotation.
+    expect(after[0]?.secret_note).toBeDefined();
+    expect(after[0]?.secret_note).not.toBe(before[0]?.secret_note);
+  });
+
+  test("update with skipUnchanged: true omits a resubmitted-but-unchanged encrypted field — no phantom re-encrypt (#464)", async () => {
+    const created = await crud.create(
+      { email: "noop-enc@test.de", secretNote: "same-note" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const before = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'noop-enc@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    const updated = await crud.update(
+      {
+        id: created.data.id,
+        version: 1,
+        changes: { secretNote: "same-note", email: "noop-enc-2@test.de" },
+      },
+      adminUser,
+      tdb,
+      { skipUnchanged: true },
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+
+    const after = (await asRawClient(testDb.db).unsafe(
+      `SELECT secret_note FROM read_es_exec_encrypted WHERE email = 'noop-enc-2@test.de' LIMIT 1`,
+    )) as Array<{ secret_note: string }>;
+
+    // Re-encrypting the same plaintext produces a fresh AEAD nonce → a
+    // different ciphertext even for an unchanged value. Byte-identical
+    // ciphertext proves the column was never touched by this update.
+    expect(after[0]?.secret_note).toBe(before[0]?.secret_note);
+
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE type = 'esExecEncrypted.updated' ORDER BY id DESC LIMIT 1`,
+    )) as Array<{ payload: { changes?: Record<string, unknown> } }>;
+    expect(rows[0]?.payload.changes).not.toHaveProperty("secretNote");
+  });
+
   test("update's persisted event carries ciphertext (not plaintext) for an encrypted field in `previous`", async () => {
     // Regression: `previous` in the STORED event came from loadById(), which
     // decrypts — appending it unchanged would put the plaintext of an
@@ -524,7 +628,7 @@ describe("event-store-executor — entity cache + encrypted fields", () => {
       store.delete(`${tenantId}:${name}:${id}`);
     },
   };
-  const encryption = createEncryptionProvider(ENCRYPTION_TEST_KEY);
+  const encryption = createTestEnvelopeCipher(ENCRYPTION_TEST_KEY);
   const cachedEncryptedCrud = createEventStoreExecutor(encryptedTable, encryptedEntity, {
     entityName: "esExecEncrypted",
     entityCache,
@@ -554,4 +658,170 @@ describe("event-store-executor — entity cache + encrypted fields", () => {
     const second = await cachedEncryptedCrud.detail({ id }, adminUser, tdb);
     expect(second?.["secretNote"]).toBe("cache-plaintext-note");
   });
+
+  // Regression twin pack for the list() path:
+  //   1. list decrypted BEFORE the snake→camel coercion, so any multi-word
+  //      encrypted/pii field (secret_note vs secretNote) came back as raw
+  //      ciphertext to the caller.
+  //   2. list's mset cached the decrypted rows — plaintext in Redis, the
+  //      exact leak the detail() path re-encrypts to avoid.
+  test("list() returns plaintext for camelCase encrypted fields and caches ciphertext", async () => {
+    const created = await cachedEncryptedCrud.create(
+      { email: "cache-list@test.de", secretNote: "list-plaintext-note" },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+    const storeKey = `${adminUser.tenantId}:esExecEncrypted:${created.data.id}`;
+    store.clear();
+
+    const list = await cachedEncryptedCrud.list({}, adminUser, tdb);
+    const listed = list.rows.find((r) => r["id"] === created.data.id);
+    expect(listed?.["secretNote"]).toBe("list-plaintext-note");
+
+    const cachedRaw = store.get(storeKey);
+    expect(cachedRaw?.["secretNote"]).toBeDefined();
+    expect(cachedRaw?.["secretNote"]).not.toBe("list-plaintext-note");
+  });
+});
+
+// PII subject encryption (crypto-shredding, #724 phase C): pii/userOwned/
+// tenantOwned fields are encrypted with the erase subject's DEK. Event
+// payload AND projection row carry ciphertext (live == rebuild); erasing the
+// subject key renders every value as the [[erased]] sentinel without
+// touching the immutable log.
+const piiEntity = createEntity({
+  table: "read_es_exec_pii",
+  fields: {
+    email: createTextField({ required: true, pii: true }),
+    note: createTextField({ userOwned: { ownerField: "authorId" } }),
+    authorId: createTextField(),
+    plain: createTextField(),
+  },
+});
+const piiTable = buildEntityTable("esExecPii", piiEntity);
+
+describe("event-store-executor — pii subject encryption", () => {
+  const kms = new InMemoryKmsAdapter();
+  const crud = createEventStoreExecutor(piiTable, piiEntity, {
+    entityName: "esExecPii",
+    kms,
+  });
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTable(testDb.db, piiEntity, "esExecPii");
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_exec_pii RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("create: projection row + event payload are ciphertext, API reads plaintext", async () => {
+    const result = await crud.create({ email: "pii@test.de", plain: "visible" }, adminUser, tdb);
+    if (!result.isSuccess) throw new Error("create failed");
+    expect(result.data.data["email"]).toBe("pii@test.de");
+
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT email, plain FROM read_es_exec_pii LIMIT 1`,
+    )) as Array<{ email: string; plain: string }>;
+    expect(rawRows[0]!.email).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${result.data.id}:`);
+    expect(rawRows[0]!.plain).toBe("visible");
+
+    const events = (await asRawClient(testDb.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE type = 'esExecPii.created' LIMIT 1`,
+    )) as Array<{ payload: { email?: string } }>;
+    expect(events[0]?.payload.email).toStartWith(PII_CIPHERTEXT_PREFIX);
+
+    const detail = await crud.detail({ id: result.data.id }, adminUser, tdb);
+    expect(detail?.["email"]).toBe("pii@test.de");
+    const list = await crud.list({}, adminUser, tdb);
+    expect(list.rows[0]?.["email"]).toBe("pii@test.de");
+  });
+
+  test("userOwned update without ownerField in changes resolves via the merged row", async () => {
+    const created = await crud.create(
+      { email: "owner@test.de", note: "v1", authorId: TestUsers.admin.id },
+      adminUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const updated = await crud.update(
+      { id: created.data.id, version: 1, changes: { note: "v2" } },
+      adminUser,
+      tdb,
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+    expect(updated.data.data["note"]).toBe("v2");
+
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT note FROM read_es_exec_pii LIMIT 1`,
+    )) as Array<{ note: string }>;
+    expect(rawRows[0]!.note).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${TestUsers.admin.id}:`);
+  });
+
+  test("eraseKey: detail renders the sentinel, stored events stay byte-identical", async () => {
+    const created = await crud.create({ email: "forget@test.de" }, adminUser, tdb);
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const eventsBefore = (await asRawClient(testDb.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE type = 'esExecPii.created' LIMIT 1`,
+    )) as Array<{ payload: { email?: string } }>;
+
+    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
+
+    const detail = await crud.detail({ id: created.data.id }, adminUser, tdb);
+    expect(detail?.["email"]).toBe(PII_ERASED_SENTINEL);
+
+    const eventsAfter = (await asRawClient(testDb.db).unsafe(
+      `SELECT payload FROM kumiko_events WHERE type = 'esExecPii.created' LIMIT 1`,
+    )) as Array<{ payload: { email?: string } }>;
+    expect(eventsAfter[0]?.payload.email).toBe(eventsBefore[0]!.payload.email!);
+  });
+
+  test("rebuild after erase resurrects no plaintext (replay writes ciphertext, reads render sentinel)", async () => {
+    const created = await crud.create({ email: "rebuild@test.de" }, adminUser, tdb);
+    if (!created.isSuccess) throw new Error("create failed");
+    await kms.eraseKey({ kind: "user", userId: String(created.data.id) });
+
+    // Same code path rebuildProjection replays: applyEntityEvent on the
+    // PERSISTED event (ciphertext payload). The response echo carries the
+    // plaintext payload since #820 and must not be used as a replay source.
+    const responseEvent = created.data.event as { payload: Record<string, unknown> } | undefined;
+    expect(responseEvent?.payload["email"]).toBe("rebuild@test.de");
+    await asRawClient(testDb.db).unsafe(`TRUNCATE read_es_exec_pii RESTART IDENTITY CASCADE`);
+    const [storedEvent] = await loadEventsAfterVersion(
+      testDb.db,
+      String(created.data.id),
+      adminUser.tenantId,
+      0,
+    );
+    if (!storedEvent) throw new Error("no persisted event for the aggregate");
+    const applied = await applyEntityEvent(storedEvent, piiTable, piiEntity, tdb.raw);
+    expect(applied.kind).toBe("applied");
+
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT email FROM read_es_exec_pii LIMIT 1`,
+    )) as Array<{ email: string }>;
+    expect(rawRows[0]!.email).toStartWith(PII_CIPHERTEXT_PREFIX);
+    expect(rawRows[0]!.email).not.toContain("rebuild@test.de");
+
+    const detail = await crud.detail({ id: created.data.id }, adminUser, tdb);
+    expect(detail?.["email"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("without a kms adapter the engine is off: plaintext row (pre-#724 behavior)", async () => {
+    const plainCrud = createEventStoreExecutor(piiTable, piiEntity, {
+      entityName: "esExecPii",
+    });
+    const created = await plainCrud.create({ email: "off@test.de" }, adminUser, tdb);
+    if (!created.isSuccess) throw new Error("create failed");
+
+    const rawRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT email FROM read_es_exec_pii LIMIT 1`,
+    )) as Array<{ email: string }>;
+    expect(rawRows[0]!.email).toBe("off@test.de");
+  });
 });

package/src/db/__tests__/feature-table-sources.test.ts

@@ -0,0 +1,34 @@
+// Regression test for #255-class drift: storeTables must appear in
+// enumerateFeatureTableSources so setupTestStack's auto-push and
+// collectTableMetas see the exact same table set. Before this fix,
+// unmanaged tables were only handled by collectTableMetas directly, so any
+// app relying on setupTestStack's ephemeral DB (Playwright/e2e) never got
+// its store tables created — e.g. the bundled "sessions" feature's
+// store_user_sessions, breaking every login in an ephemeral test stack.
+
+import { describe, expect, test } from "bun:test";
+import { defineFeature } from "../../engine/define-feature";
+import { defineUnmanagedTable } from "../entity-table-meta";
+import { enumerateFeatureTableSources } from "../feature-table-sources";
+
+const probeMeta = defineUnmanagedTable({
+  tableName: "ftst_probe",
+  columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+});
+
+describe("enumerateFeatureTableSources — storeTables", () => {
+  test("includes a feature's storeTable as a table source", () => {
+    const feature = defineFeature("probe", (r) => {
+      r.storeTable(probeMeta, { reason: "direct-write store" });
+    });
+    const sources = enumerateFeatureTableSources(feature);
+    const entry = sources.find((s) => s.origin.includes("ftst_probe"));
+    expect(entry).toBeDefined();
+    expect(entry?.table).toBe(probeMeta);
+  });
+
+  test("a feature with no storeTable contributes nothing extra", () => {
+    const feature = defineFeature("plain", () => {});
+    expect(enumerateFeatureTableSources(feature)).toEqual([]);
+  });
+});