@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/user-data-rights/constants.ts

@@ -0,0 +1,63 @@
+// @runtime client
+// Reine String-Konstanten — client-markiert, damit web/ (z.B. ExportSection)
+// sie importieren darf, ohne das runtime-Barrel des Features (und damit
+// dessen Server-/DOM-freien Code) zu ziehen. Runtime-Code (feature.ts) darf
+// client-Dateien ohnehin importieren.
+
+export const USER_DATA_RIGHTS_FEATURE = "user-data-rights" as const;
+
+// Registered without r.nav — apps place it via their own r.nav. Qualified:
+// `user-data-rights:screen:privacy-center`.
+export const PRIVACY_CENTER_SCREEN_ID = "privacy-center" as const;
+
+// Extension-section component name for the Export (Art. 20) section of the
+// privacy-center screen — shared between feature.ts (screen def's
+// `component: { react: { __component } }`) and web/client-plugin.tsx
+// (extensionSectionComponents registration), same pattern as
+// compliance-profiles' COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME.
+export const EXPORT_SECTION_EXTENSION_NAME = "UserDataRightsExportSection" as const;
+
+// enumOption keyPrefix for the privacy-center screen's `status` field
+// (fw#2315 pattern) — resolves the raw user-lifecycle enum value
+// (active/restricted/deletionRequested/deleted) to a translated label
+// instead of showing the raw string.
+export const STATUS_OPTION_KEY_PREFIX =
+  "userDataRights.privacyCenter.field.status.option." as const;
+
+export const UserDataRightsQueries = {
+  exportStatus: "user-data-rights:query:export-status",
+  myAuditLog: "user-data-rights:query:my-audit-log",
+  downloadByJob: "user-data-rights:query:download-by-job",
+} as const;
+
+// App-level config: tenant-occupancy model. "single-user" tells the forget
+// pipeline that each tenant has exactly one user, so tenant-scoped contributors
+// (e.g. credit) may erase the tenant's data as that user's personal data.
+// Default "multi-user" (declared in feature.ts). Apps set it via appOverrides:
+// `overrides.set(TENANT_MODEL_CONFIG_KEY, "single-user")`.
+export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model" as const;
+
+export const UserDataRightsHandlers = {
+  requestExport: "user-data-rights:write:request-export",
+  requestDeletion: "user-data-rights:write:request-deletion",
+  cancelDeletion: "user-data-rights:write:cancel-deletion",
+  restrictAccount: "user-data-rights:write:restrict-account",
+} as const;
+
+// Fremde QN: der Lifecycle-Status (active / deletionRequested / restricted)
+// kommt aus dem user-Feature. Lokal gepinnt statt das user-runtime-Barrel zu
+// importieren (Runtime-Isolation, wie user-profile). Drift-Schutz: der
+// Screen-Test vergleicht gegen UserQueries.me.
+export const USER_ME_QUERY = "user:query:user:me" as const;
+
+// Client-safe Mirror von EXPORT_JOB_STATUS (schema/export-job.ts ist
+// server-only via Drizzle-Import). Drift-Schutz: der Screen-Test vergleicht
+// gegen die Schema-Originale.
+export const EXPORT_JOB_STATUS = {
+  Pending: "pending",
+  Running: "running",
+  Done: "done",
+  Failed: "failed",
+} as const;
+
+export type ExportJobStatus = (typeof EXPORT_JOB_STATUS)[keyof typeof EXPORT_JOB_STATUS];

package/packages/bundled-features/src/user-data-rights/db/queries/export-jobs.ts

@@ -0,0 +1,28 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
+import { exportJobsTable } from "../../schema/export-job.js";
+
+export type ExportJobCleanupCandidate = {
+  readonly id: string;
+  readonly version: number;
+  readonly status: string;
+  readonly requestedFromTenantId: TenantId;
+  readonly downloadStorageKey: string | null;
+  readonly expiresAt: Temporal.Instant | null;
+  readonly completedAt: Temporal.Instant | null;
+  readonly startedAt: Temporal.Instant | null;
+};
+
+// @wrapper-known semantic-alias
+export async function selectExportJobsForStorageCleanup(
+  db: DbConnection,
+  doneStatus: string,
+  failedStatus: string,
+): Promise<readonly ExportJobCleanupCandidate[]> {
+  return selectMany<ExportJobCleanupCandidate>(db, exportJobsTable, {
+    status: { in: [doneStatus, failedStatus] },
+    downloadStorageKey: { ne: null },
+  });
+}

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -0,0 +1,25 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+// Value-only import, aliased to avoid shadowing the ambient global
+// `Temporal` TYPE that gracePeriodEndCutoff's parameter type resolves
+// against (same #1438 dual-package-hazard pattern as event-store.ts).
+import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { userTable } from "../../../user/index.js";
+
+export async function selectUsersDueForForgetCleanup(
+  db: DbConnection,
+  status: string,
+  gracePeriodEndCutoff: InstanceType<typeof TemporalPolyfill.Instant> | string,
+): Promise<readonly { id: string }[]> {
+  // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
+  // at runtime, distinct nominal types across the two .d.ts sources (see
+  // event-store.ts). Only ever consumed via the `lte` comparison below.
+  const cutoff =
+    typeof gracePeriodEndCutoff === "string"
+      ? TemporalPolyfill.Instant.from(gracePeriodEndCutoff)
+      : gracePeriodEndCutoff;
+  return selectMany<{ id: string }>(db, userTable, {
+    status,
+    gracePeriodEnd: { lte: cutoff },
+  });
+}

package/packages/bundled-features/src/user-data-rights/deletion-token.ts

@@ -0,0 +1,58 @@
+// Email-verified account deletion, expressed as a row-bound grant: the
+// subject is the user, the anchor is the pending request id stored on the
+// user row. Minting and verification both run through
+// shared/row-bound-grant, so a token from a cancelled cycle (id nulled) or a
+// superseded one (row holds a newer id) fails verification — see #354/1.
+//
+// The purpose string and the anchoring are unchanged from the hand-rolled
+// version this replaced, so tokens stay byte-compatible.
+
+import type { Temporal } from "temporal-polyfill";
+import {
+  type RowBoundGrantResult,
+  redeemRowBoundGrant,
+  signRowBoundGrant,
+} from "../shared/index.js";
+
+const DELETION_REQUEST_PURPOSE = "deletion-request";
+
+export function signDeletionToken(
+  userId: string,
+  requestId: string,
+  ttlMinutes: number,
+  secret: string,
+  now?: Temporal.Instant,
+): { readonly token: string; readonly expiresAt: Temporal.Instant } {
+  return signRowBoundGrant({
+    subject: userId,
+    purpose: DELETION_REQUEST_PURPOSE,
+    anchor: requestId,
+    ttlMinutes,
+    secret,
+    now,
+  });
+}
+
+export function redeemDeletionToken(args: {
+  readonly token: string;
+  readonly secret: string | undefined;
+  readonly loadPendingRequestId: (userId: string) => Promise<string | null>;
+  // Spends the anchor AND performs the actual lifecycle transition in one
+  // atomic step (#3024) — the caller (confirm-deletion-by-token) folds the
+  // Active→DeletionRequested write itself in here via `updateUserLifecycle`'s
+  // `expect: { status: Active, pendingDeletionRequestId }`, so a write issued
+  // after `ok: true` can't lose its work to a crash while the grant is
+  // already burned (see shared/row-bound-grant.ts). Returns whether this
+  // caller was the one who moved the row on.
+  readonly commitDeletion: (userId: string, requestId: string) => Promise<boolean>;
+  readonly now?: Temporal.Instant;
+}): Promise<RowBoundGrantResult> {
+  return redeemRowBoundGrant({
+    token: args.token,
+    purpose: DELETION_REQUEST_PURPOSE,
+    secret: args.secret,
+    loadAnchor: args.loadPendingRequestId,
+    commitAnchor: args.commitDeletion,
+    now: args.now,
+  });
+}

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -0,0 +1,175 @@
+// Default HTML renderers for GDPR notification mails. English ships here;
+// other languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
+// localeEs() call registerMailTranslations). Apps that want their own
+// branding pass send*Email callbacks and these defaults do not run.
+
+import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { Temporal } from "temporal-polyfill";
+
+export type GdprMailLocale = string;
+
+export function normalizeGdprMailLocale(
+  raw: string | null | undefined,
+): GdprMailLocale | undefined {
+  if (!raw) return undefined;
+  const root = raw.toLowerCase().split("-")[0];
+  return root && root.length > 0 ? root : undefined;
+}
+
+export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
+  "gdpr.mail.appNameDefault": "Account",
+  "gdpr.mail.greeting": "Hi,",
+  "gdpr.mail.exportReady.subject": "{app} — Your data export is ready",
+  "gdpr.mail.exportReady.intro":
+    "your requested data export for {app} is ready. Download it using the link below:",
+  "gdpr.mail.exportReady.button": "Download data export",
+  "gdpr.mail.exportReady.expiry": "The download link expires on {when}.",
+  "gdpr.mail.exportFailed.subject": "{app} — Your data export failed",
+  "gdpr.mail.exportFailed.intro":
+    "your requested data export for {app} could not be created. Please request the export again.",
+  "gdpr.mail.deletionRequested.subject": "{app} — Account deletion requested",
+  "gdpr.mail.deletionRequested.intro":
+    "we received your request to delete your {app} account. Your account and associated data will be permanently deleted on {when}.",
+  "gdpr.mail.deletionRequested.cancel":
+    "If you didn't request this, sign in and cancel the deletion in your account settings before the deadline.",
+  "gdpr.mail.deletionExecuted.subject": "{app} — Your account has been deleted",
+  "gdpr.mail.deletionExecuted.intro":
+    "your {app} account and the associated personal data were deleted on {when}. This action is permanent.",
+  "gdpr.mail.fallbackUrl": "If the button doesn't work, copy this link into your browser:",
+};
+
+registerMailTranslations("en", GDPR_MAIL_EN);
+
+export type RenderedEmail = {
+  readonly subject: string;
+  readonly html: string;
+};
+
+export type RenderExportReadyEmailArgs = {
+  readonly downloadUrl: string;
+  readonly expiresAt: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderExportFailedEmailArgs = {
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderDeletionRequestedEmailArgs = {
+  readonly gracePeriodEnd: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderDeletionExecutedEmailArgs = {
+  readonly executedAt: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
+  return mailT(locale, key, params);
+}
+
+function appNameFor(args: { locale?: GdprMailLocale; appName?: string }): string {
+  const locale = args.locale ?? "en";
+  return args.appName ?? t(locale, "gdpr.mail.appNameDefault");
+}
+
+export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const subject = t(locale, "gdpr.mail.exportReady.subject", { app });
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
+    <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportReady.intro", { app }))}</p>
+    <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t(locale, "gdpr.mail.exportReady.button") })}</p>
+    <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }))}</p>
+    ${renderFallbackUrl({ url: args.downloadUrl, label: t(locale, "gdpr.mail.fallbackUrl") })}`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+}
+
+export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const subject = t(locale, "gdpr.mail.exportFailed.subject", { app });
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
+    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportFailed.intro", { app }))}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+}
+
+export function renderDeletionRequestedEmail(
+  args: RenderDeletionRequestedEmailArgs,
+): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const when = formatTimestamp(args.gracePeriodEnd);
+  const subject = t(locale, "gdpr.mail.deletionRequested.subject", { app });
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
+    <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.intro", { app, when }))}</p>
+    <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.cancel"))}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+}
+
+export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const when = formatTimestamp(args.executedAt);
+  const subject = t(locale, "gdpr.mail.deletionExecuted.subject", { app });
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
+    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }))}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
+}
+
+function wrapCell(bodyHtml: string): string {
+  return `<tr><td>${bodyHtml}</td></tr>`;
+}
+
+function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
+  return `<!DOCTYPE html>
+<html lang="${escapeHtmlAttr(args.locale)}">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(args.title)}</title>
+  </head>
+  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
+    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
+      <tr>
+        <td align="center">
+          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
+            ${args.bodyHtml}
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+
+function renderButton(args: { url: string; label: string }): string {
+  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
+}
+
+function renderFallbackUrl(args: { url: string; label: string }): string {
+  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
+}
+
+function formatTimestamp(iso: string): string {
+  try {
+    const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
+    return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;
+  } catch {
+    return iso;
+  }
+}
+
+function pad2(n: number): string {
+  return String(n).padStart(2, "0");
+}