@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/__tests__/boot-validator-pii-retention.test.ts

@@ -117,6 +117,55 @@ describe("validateBoot — PII annotations", () => {
     expect(() => validateBoot([feature])).toThrow(/multiple subject-key annotations/);
   });
 
+  test("naked sensitive (no pii/encrypted) throws — event log needs ciphertext-at-rest (#967)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "vault",
+        createEntity({
+          fields: {
+            apiToken: createTextField({ sensitive: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/sensitive: true.*without ciphertext-at-rest/);
+  });
+
+  test("sensitive with pii subject annotation passes", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "vault",
+        createEntity({
+          fields: {
+            apiToken: createTextField({ sensitive: true, pii: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("sensitive with encrypted passes", () => {
+    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from(
+      "0123456789abcdef0123456789abcdef",
+    ).toString("base64");
+    try {
+      const feature = defineFeature("test", (r) => {
+        r.entity(
+          "vault",
+          createEntity({
+            fields: {
+              apiToken: createTextField({ sensitive: true, encrypted: true }),
+            },
+          }),
+        );
+      });
+      expect(() => validateBoot([feature])).not.toThrow();
+    } finally {
+      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+    }
+  });
+
   test("userOwned.ownerField pointing to non-existent field throws", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
@@ -133,19 +182,36 @@ describe("validateBoot — PII annotations", () => {
     );
   });
 
-  test("userOwned.ownerField pointing to non-reference field throws", () => {
+  test("userOwned.ownerField on a text field passes (ES userId-by-convention)", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
         "comment",
         createEntity({
           fields: {
-            body: createLongTextField({ userOwned: { ownerField: "authorName" } }),
-            authorName: createTextField(),
+            body: createLongTextField({ userOwned: { ownerField: "authorId" } }),
+            authorId: createTextField(),
           },
         }),
       );
     });
-    expect(() => validateBoot([feature])).toThrow(/must be a reference field, got type "text"/);
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("userOwned.ownerField pointing to a non-id-capable field throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "comment",
+        createEntity({
+          fields: {
+            body: createLongTextField({ userOwned: { ownerField: "isPublic" } }),
+            isPublic: { type: "boolean" },
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(
+      /must be a reference or text \(userId\) field, got type "boolean"/,
+    );
   });
 
   test("userOwned.ownerField referencing non-user entity warns", () => {
@@ -568,3 +634,179 @@ describe("validateBoot — retention", () => {
     expect(matchingWarn).toBeUndefined();
   });
 });
+
+describe("validateBoot — lookupable / blind-index (#818)", () => {
+  test("lookupable on subject-annotated text field passes", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "user",
+        createEntity({
+          fields: {
+            email: createTextField({ pii: true, lookupable: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("lookupable without subject annotation throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "doc",
+        createEntity({
+          fields: {
+            slug: createTextField({ lookupable: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/lookupable.*without a subject annotation/);
+  });
+
+  test("lookupable on non-text field throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "person",
+        createEntity({
+          fields: {
+            // longText carries PiiAnnotations too — lookupable must still be rejected.
+            bio: createLongTextField({ userOwned: { ownerField: "ownerId" }, lookupable: true }),
+            ownerId: createTextField({ required: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/only apply to text fields/);
+  });
+
+  test("searchable combined with a subject annotation throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "user",
+        createEntity({
+          fields: {
+            displayName: createTextField({ pii: true, searchable: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/searchable.*cannot work/);
+  });
+
+  test("sortable combined with a subject annotation throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "user",
+        createEntity({
+          fields: {
+            email: createTextField({ pii: true, sortable: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/sortable.*cannot work/);
+  });
+});
+
+describe("validateBoot — piiEncrypted (kumiko-platform#231/#456)", () => {
+  test("piiEncrypted on a plain text field passes", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            iban: createTextField({
+              piiEncrypted: true,
+              tenantOwned: true,
+              access: { read: ["TenantAdmin"] },
+            }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("piiEncrypted on a non-text field throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            amount: { ...createNumberField(), piiEncrypted: true } as unknown as ReturnType<
+              typeof createNumberField
+            >,
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*only applies to text fields/);
+  });
+
+  test("piiEncrypted without a subject annotation throws (kumiko-platform#457)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            iban: createTextField({ piiEncrypted: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*without a subject annotation/);
+  });
+
+  test("piiEncrypted combined with searchable throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            iban: createTextField({
+              piiEncrypted: true,
+              tenantOwned: true,
+              access: { read: ["TenantAdmin"] },
+              searchable: true,
+            }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*searchable.*cannot work/);
+  });
+
+  test("piiEncrypted combined with sortable throws", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            iban: createTextField({
+              piiEncrypted: true,
+              tenantOwned: true,
+              access: { read: ["TenantAdmin"] },
+              sortable: true,
+            }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*sortable.*cannot work/);
+  });
+
+  test("piiEncrypted without access.read throws (kumiko-platform#460)", () => {
+    const feature = defineFeature("test", (r) => {
+      r.entity(
+        "tenant",
+        createEntity({
+          fields: {
+            iban: createTextField({ piiEncrypted: true, tenantOwned: true }),
+          },
+        }),
+      );
+    });
+    expect(() => validateBoot([feature])).toThrow(/piiEncrypted.*without.*access.*read/);
+  });
+});

package/src/engine/__tests__/boot-validator.test.ts

@@ -2,7 +2,8 @@ import { describe, expect, test } from "bun:test";
 import { z } from "zod";
 import type { SchemaTable } from "../../db/dialect";
 import { table, text } from "../../db/dialect";
-import { validateBoot } from "../boot-validator";
+import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
+import { validateBoot as validateBootRaw } from "../boot-validator";
 import { createSystemConfig, createTenantConfig } from "../config-helpers";
 import {
   createDerivedField,
@@ -11,8 +12,13 @@ import {
   createTextField,
   defineFeature,
   from,
+  registerEntityCrud,
 } from "../index";
 
+function validateBoot(features: Parameters<typeof validateBootRaw>[0]): void {
+  validateBootRaw(withBootValidatorFixture(features));
+}
+
 describe("boot-validator", () => {
   test("passes for valid features with no issues", () => {
     const features = [
@@ -106,8 +112,10 @@ describe("boot-validator", () => {
     expect(() => validateBoot(features)).toThrow(/token.*cannot be both encrypted and sortable/i);
   });
 
-  test("allows encrypted field when ENCRYPTION_KEY is set", () => {
-    process.env["ENCRYPTION_KEY"] = "test-key";
+  test("allows encrypted field when a master key keyring is available", () => {
+    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from(
+      "0123456789abcdef0123456789abcdef",
+    ).toString("base64");
     try {
       const features = [
         defineFeature("a", (r) => {
@@ -124,12 +132,34 @@ describe("boot-validator", () => {
       ];
       expect(() => validateBoot(features)).not.toThrow();
     } finally {
-      delete process.env["ENCRYPTION_KEY"];
+      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
+    }
+  });
+
+  test("throws at boot when the master key is malformed (not 32 bytes)", () => {
+    process.env["KUMIKO_SECRETS_MASTER_KEY_V1"] = Buffer.from("too-short").toString("base64");
+    try {
+      const features = [
+        defineFeature("a", (r) => {
+          r.entity(
+            "secret",
+            createEntity({
+              table: "Secrets",
+              fields: {
+                apiKey: { type: "text", encrypted: true },
+              },
+            }),
+          );
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(/master key/i);
+    } finally {
+      delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
     }
   });
 
-  test("throws when encrypted fields exist but ENCRYPTION_KEY not set", () => {
-    delete process.env["ENCRYPTION_KEY"];
+  test("throws when encrypted fields exist but no master key is available", () => {
+    delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
     const features = [
       defineFeature("a", (r) => {
         r.entity(
@@ -143,16 +173,16 @@ describe("boot-validator", () => {
         );
       }),
     ];
-    expect(() => validateBoot(features)).toThrow(/ENCRYPTION_KEY.*required/i);
+    expect(() => validateBoot(features)).toThrow(/master key/i);
   });
 
-  test("throws when longText encrypted field exists but ENCRYPTION_KEY not set", () => {
+  test("throws when longText encrypted field exists but no master key is available", () => {
     // Drift-pin Sprint-5b-vorab-Audit Issue 1: validateEncryptedFields
     // hatte `if (field.type !== "text") continue;` und ignorierte
     // longText-encrypted-fields silently — ENCRYPTION_KEY-check wurde
     // nie getriggert, encryption silent broken. Jetzt: beide string-
     // typed fields werden gechecked.
-    delete process.env["ENCRYPTION_KEY"];
+    delete process.env["KUMIKO_SECRETS_MASTER_KEY_V1"];
     const features = [
       defineFeature("a", (r) => {
         r.entity(
@@ -166,7 +196,7 @@ describe("boot-validator", () => {
         );
       }),
     ];
-    expect(() => validateBoot(features)).toThrow(/ENCRYPTION_KEY.*required/i);
+    expect(() => validateBoot(features)).toThrow(/master key/i);
   });
 
   test("rejects encrypted text field that is also filterable", () => {
@@ -523,6 +553,21 @@ describe("boot-validator", () => {
     expect(() => validateBoot(features)).toThrow(/a:query:list.*missing an access rule/i);
   });
 
+  test("registerEntityCrud without access options fails boot (no implicit openToAll)", () => {
+    const widgetEntity = createEntity({
+      table: "phase0_widgets",
+      fields: { name: createTextField({ required: true }) },
+    });
+    const features = [
+      defineFeature("phase0", (r) => {
+        registerEntityCrud(r, "widget", widgetEntity);
+      }),
+    ];
+    expect(() => validateBoot(features)).toThrow(
+      /phase0:write:widget:create.*missing an access rule/i,
+    );
+  });
+
   test("accepts role-based access rule", () => {
     const features = [
       defineFeature("a", (r) => {
@@ -545,6 +590,66 @@ describe("boot-validator", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("throws when a stream handler has no access rule", () => {
+    const features = [
+      defineFeature("a", (r) => {
+        r.streamHandler("chat:complete", z.object({}), async function* () {});
+      }),
+    ];
+    expect(() => validateBoot(features)).toThrow(/a:stream:chat:complete.*missing an access rule/i);
+  });
+
+  test("object-form streamHandler with access rule passes boot", () => {
+    const features = [
+      defineFeature("a", (r) => {
+        r.streamHandler({
+          name: "chat:complete",
+          schema: z.object({}),
+          handler: async function* () {},
+          access: { roles: ["User"] },
+        });
+      }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("accepts openToAll access rule on a stream handler", () => {
+    const features = [
+      defineFeature("a", (r) => {
+        r.streamHandler("chat:complete", z.object({}), async function* () {}, {
+          access: { openToAll: true },
+        });
+      }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("throws when an anonymous stream handler uses a user-bucketed rate limit", () => {
+    const features = [
+      defineFeature("a", (r) => {
+        r.streamHandler("chat:complete", z.object({}), async function* () {}, {
+          access: { roles: ["anonymous"] },
+          rateLimit: { per: "user", limit: 10, windowSeconds: 60 },
+        });
+      }),
+    ];
+    expect(() => validateBoot(features)).toThrow(
+      /stream handler "a:stream:chat:complete" allows anonymous callers/i,
+    );
+  });
+
+  test("accepts an anonymous stream handler with an ip-bucketed rate limit", () => {
+    const features = [
+      defineFeature("a", (r) => {
+        r.streamHandler("chat:complete", z.object({}), async function* () {}, {
+          access: { roles: ["anonymous"] },
+          rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        });
+      }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
   describe("config key bounds consistency", () => {
     test("accepts number key with consistent bounds + default", () => {
       const features = [
@@ -1186,8 +1291,9 @@ describe("boot-validator", () => {
   // --- entityList column-renderer form-check ---
   // Validator akzeptiert die `{ react: { __component: "Name" } }`-Form
   // (PlatformComponent → client-side Registry-Lookup) und prüft sie
-  // strukturell. String-Funktionen, null/undefined, native-only und
-  // andere Formen bleiben opak.
+  // strukturell. null/undefined, native-only und andere Formen bleiben
+  // opak. Function-Renderer werfen (action-wiring.ts validateFieldWiring) —
+  // von JSON.stringify verworfen, sonst stiller No-op auf dem Client.
   describe("entityList column renderer form", () => {
     function shopFeature(renderer: unknown) {
       return defineFeature("shop", (r) => {
@@ -1205,8 +1311,10 @@ describe("boot-validator", () => {
       });
     }
 
-    test("function-renderer → kein Throw (Bestand)", () => {
-      expect(() => validateBoot([shopFeature((v: unknown) => String(v))])).not.toThrow();
+    test("function-renderer → Throw (Function wird von JSON.stringify verworfen)", () => {
+      expect(() => validateBoot([shopFeature((v: unknown) => String(v))])).toThrow(
+        /column "name" renderer is a function/,
+      );
     });
 
     test("undefined renderer → kein Throw (Spalte ohne Renderer)", () => {
@@ -1249,6 +1357,102 @@ describe("boot-validator", () => {
     });
   });
 
+  // --- function-renderer check on the non-entityEdit/entityList screen
+  // types that share the same EditLayout/ListColumnSpec shapes
+  // (action-wiring.ts's validateEditLayoutNoFunctions/validateColumnsNoFunctions) ---
+  describe("function-renderer check on other EditLayout/columns screens", () => {
+    test("actionForm field renderer as a function → Throw", () => {
+      const features = [
+        defineFeature("shop", (r) => {
+          r.screen({
+            id: "restock",
+            type: "actionForm",
+            handler: "shop:write:restock",
+            fields: { qty: { type: "number" } } as never,
+            layout: {
+              sections: [
+                { fields: [{ field: "qty", renderer: (v: unknown) => String(v) }] as never },
+              ],
+            },
+          });
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(
+        /\(actionForm\) field "qty" renderer is a function/,
+      );
+    });
+
+    test("configEdit field renderer as a function → Throw", () => {
+      const features = [
+        defineFeature("shop", (r) => {
+          r.config({
+            keys: { "site-name": createTenantConfig("text", { default: "" }) },
+          });
+          r.screen({
+            id: "settings",
+            type: "configEdit",
+            scope: "tenant",
+            configKeys: { siteName: "shop:config:site-name" },
+            fields: { siteName: { type: "text" } } as never,
+            layout: {
+              sections: [
+                {
+                  fields: [{ field: "siteName", renderer: (v: unknown) => String(v) }] as never,
+                },
+              ],
+            },
+          });
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(
+        /\(configEdit\) field "siteName" renderer is a function/,
+      );
+    });
+
+    test("projectionDetail field renderer as a function → Throw", () => {
+      const features = [
+        defineFeature("shop", (r) => {
+          r.screen({
+            id: "order-detail",
+            type: "projectionDetail",
+            query: "shop:query:order-detail",
+            layout: {
+              sections: [
+                { fields: [{ field: "total", renderer: (v: unknown) => String(v) }] as never },
+              ],
+            },
+          });
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(
+        /\(projectionDetail\) field "total" renderer is a function/,
+      );
+    });
+
+    test("dashboard list-panel column renderer as a function → Throw", () => {
+      const features = [
+        defineFeature("shop", (r) => {
+          r.screen({
+            id: "overview",
+            type: "dashboard",
+            panels: [
+              {
+                kind: "list",
+                id: "recent-orders",
+                label: "Recent Orders",
+                query: "shop:query:recent-orders",
+                columns: [{ field: "total", renderer: (v: unknown) => String(v) }] as never,
+              },
+            ],
+          });
+        }),
+      ];
+      expect(() => validateBoot(features)).toThrow(
+        /\(dashboard-list\) column "total" renderer is a function/,
+      );
+    });
+  });
+
   // --- entityList virtual (labeled) columns ---
   // A column whose `field` is not an entity field is allowed IF it carries a
   // `label` — a presentational column drawn by a columnRenderer component (e.g.
@@ -2558,7 +2762,7 @@ describe("boot-validator", () => {
     });
 
     test("number-Field OHNE sortable → Throw (sortable: true ist Pflicht)", () => {
-      expect(() => validateBoot([buildFeature("rank", { rank: { type: "number" } })])).toThrow(
+      expect(() => validateBootRaw([buildFeature("rank", { rank: { type: "number" } })])).toThrow(
         /is not sortable/,
       );
     });