@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -0,0 +1,127 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { USER_STATUS, userTable } from "../../user/index.js";
+import { signDeletionToken } from "../deletion-token.js";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+
+// TTL des Verify-Links. 60 min — lang genug für einen Mail-Roundtrip,
+// kurz genug dass ein abgefangener Link nicht ewig gültig ist.
+const DELETION_VERIFY_TTL_MINUTES = 60;
+
+// Apex-Magic-Link-Versand für den anonymen Deletion-Request. Der Handler
+// gibt den Link NICHT zurück (content-Enumeration-Safety) — er ruft den
+// Callback direkt, analog sendDeletionRequestedEmail.
+//
+// WICHTIG (Timing-Oracle): Der Callback MUSS non-blocking sein (enqueue, z.B.
+// delivery.notify / Job), NICHT synchron senden. Er läuft nur im
+// existierenden-aktiven-User-Pfad; ein synchroner Send macht die
+// Response-Latenz für reale Accounts messbar länger als für nicht-existente
+// → Enumeration über Timing. Ein schnelles enqueue gleicht das praktisch aus.
+// Vollständige Timing-Angleichung (immer äquivalente Arbeit) ist v1-Follow-up.
+export type SendDeletionVerificationEmailFn = (args: {
+  readonly email: string;
+  readonly verifyUrl: string;
+  readonly expiresAt: string;
+}) => Promise<void>;
+
+export type RequestDeletionByEmailOptions = {
+  /** HMAC-Secret zum Signieren des Verify-Tokens. Ohne Secret ist der Flow
+   *  deaktiviert (Handler antwortet still mit success, kein Link). */
+  readonly deletionTokenSecret?: string;
+  /** Basis-URL des Apex-Confirm-Screens, z.B.
+   *  "https://app.example.com/delete-account/confirm". Der Handler hängt das
+   *  Token als URL-Fragment an (`#token=<token>`, fw#1554). Ohne URL kein Link. */
+  readonly deletionVerifyUrl?: string;
+  readonly sendDeletionVerificationEmail?: SendDeletionVerificationEmailFn;
+};
+
+// Token goes in the URL fragment, not a query param — fragments never leave
+// the browser (not sent to the server, so they never land in proxy/access
+// logs, unlike `?token=`). Same convention as the export-download link
+// (feature.ts, issue #1271). Preserves any existing query params on `base`
+// (`?lang=de` stays a query param; only the token is a fragment).
+const APPEND_LIFECYCLE_EVENT_REASON =
+  "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";
+
+export function buildDeletionVerifyUrl(base: string, token: string): string {
+  const url = new URL(base);
+  url.hash = `token=${encodeURIComponent(token)}`;
+  return url.toString();
+}
+
+// Anonymer Apex-Flow Schritt 1: "Account-Löschung beantragen" per Email.
+// DSGVO-relevant gerade wenn der User sich NICHT mehr einloggen kann
+// (Lockout). Email → Magic-Link → confirm-deletion-by-token.
+//
+// Enumeration-safe (content): antwortet IMMER mit derselben success-Shape,
+// egal ob die Email existiert, der User aktiv ist oder der Flow konfiguriert
+// ist. Ein Link wird nur für einen existierenden, aktiven User generiert.
+// Timing-Safety hängt am non-blocking Callback (siehe Type-Doc oben).
+export function createRequestDeletionByEmailHandler(opts: RequestDeletionByEmailOptions = {}) {
+  return defineWriteHandler({
+    name: "request-deletion-by-email",
+    schema: z.object({ email: z.email() }),
+    access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+    description:
+      "Mails an account-deletion verification link to the given address, for a user who wants to be erased but can no longer log in; it answers identically whether or not the address belongs to an active account and never returns the link.",
+    // Mails a deletion link to any address the caller names.
+    agent: { risk: "high" },
+    // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
+    rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+    escapeHatch: {
+      grants: ["unsafeRaw", "globalWrites"],
+      reason: APPEND_LIFECYCLE_EVENT_REASON,
+    },
+    handler: async (event, ctx) => {
+      const success = { isSuccess: true as const, data: { kind: "requested" as const } };
+
+      // not-configured-safe: ohne Secret/URL kein Link, aber gleiche Antwort.
+      if (!opts.deletionTokenSecret || !opts.deletionVerifyUrl) return success;
+
+      const userRow = await ctx.db
+        .global(userTable)
+        .fetchOne<{ id: string; status: string; email: string }>({
+          email: event.payload.email,
+          isDeleted: false,
+        });
+      if (!userRow || userRow["status"] !== USER_STATUS.Active || !userRow["email"]) {
+        return success;
+      }
+
+      // Replay-Schutz (#354/1): pro Antrag eine frische requestId, die auf der
+      // user-Row landet und in die Token-HMAC-Purpose gefaltet wird. cancel
+      // nullt sie → ein nach Cancel nachgespieltes Token verifiziert nicht mehr.
+      const requestId = crypto.randomUUID();
+      await updateUserLifecycle(ctx.db.unsafeRaw(APPEND_LIFECYCLE_EVENT_REASON), userRow["id"], {
+        pendingDeletionRequestId: requestId,
+      });
+
+      const { token, expiresAt } = signDeletionToken(
+        userRow["id"],
+        requestId,
+        DELETION_VERIFY_TTL_MINUTES,
+        opts.deletionTokenSecret,
+      );
+      const verifyUrl = buildDeletionVerifyUrl(opts.deletionVerifyUrl, token);
+
+      if (opts.sendDeletionVerificationEmail) {
+        try {
+          await opts.sendDeletionVerificationEmail({
+            // Row value is ciphertext with an active KMS; the lookup above
+            // only matches byte-exact, so the payload IS the stored plaintext.
+            email: event.payload.email,
+            verifyUrl,
+            expiresAt: expiresAt.toString(),
+          });
+        } catch (err) {
+          // biome-ignore lint/suspicious/noConsole: operator-visibility for email-send-failure
+          console.warn(
+            `[user-data-rights:request-deletion-by-email] send failed err=${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+      }
+
+      return success;
+    },
+  });
+}

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -0,0 +1,117 @@
+import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { USER_STATUS } from "../../user/index.js";
+import {
+  type GdprMailDefaults,
+  isMailTransportAvailable,
+  makeDefaultDeletionRequestedEmail,
+} from "../lib/default-mailers.js";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
+
+// Atom 5b — Email-Notification beim deletion-requested-flip. Pattern:
+// password-reset-Callback aus auth-routes.ts. Best-effort — Throw beim
+// Send wird gefangen + per console.warn geloggt, der Status-Flip selbst
+// bleibt erfolgreich. Reasoning: user-Aktion ist abgeschlossen sobald
+// die DB-Row geflipt ist; Email-Versand ist Beleg, keine Vorbedingung.
+// Wenn Email broken ist soll der User nicht erneut "Account löschen"
+// klicken muessen.
+export type SendDeletionRequestedEmailFn = (args: {
+  readonly userId: string;
+  readonly userEmail: string;
+  /** Stored user.locale (free-form) — lets the default mailer render in the
+   *  recipient's language. */
+  readonly userLocale: string | null;
+  readonly tenantId: string;
+  readonly gracePeriodEnd: string;
+}) => Promise<void>;
+
+export type RequestDeletionOptions = {
+  readonly sendDeletionRequestedEmail?: SendDeletionRequestedEmailFn;
+  /** Branding fuer die Default-Mail wenn kein sendDeletionRequestedEmail
+   *  gesetzt ist + mail-foundation gemountet ist. */
+  readonly mailDefaults?: GdprMailDefaults;
+};
+
+// POST /api/user/request-deletion (S2.U5a) — DSGVO Art. 17 Forget-Antrag.
+// Flippt status=Active → deletionRequested, setzt gracePeriodEnd aus dem
+// Compliance-Profile (geteilte Logik: startDeletionGracePeriod). Account-
+// weite Semantik (1 User-Row global), siehe docs/plans/architecture/
+// user-data-rights.md "Cross-Tenant-Semantik".
+export function createRequestDeletionHandler(opts: RequestDeletionOptions = {}) {
+  return defineWriteHandler({
+    name: "request-deletion",
+    schema: z.object({}),
+    access: {
+      openToAll: {
+        reason:
+          "each signed-in user starts deletion of only their own account; the grace " +
+          "period is armed for the caller's own userId",
+      },
+    },
+    escapeHatch: {
+      reason:
+        "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+        "...) to compute the grace period end — the calling user's own identity has no read " +
+        "access to that tenant-config projection. startDeletionGracePeriod also appends the " +
+        "user lifecycle event on the SYSTEM_TENANT_ID user stream.",
+    },
+    description:
+      "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
+    agent: { risk: "high" },
+    handler: async (event, ctx) => {
+      const res = await startDeletionGracePeriod(
+        ctx,
+        event.user.id,
+        () => resolveGracePeriod(ctx, event.user.tenantId),
+        ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"),
+      );
+      if (!res.ok) return writeFailure(res.error);
+      const { gracePeriodEnd, userEmail, userLocale } = res;
+
+      // App-Callback hat Vorrang; sonst greift die mail-foundation-Default-Mail
+      // (Request-Lane → ctx.config vorhanden, createTransportForTenant direkt).
+      // Ohne gemounteten mail-transport bleibt send undefined → keine Mail.
+      const send =
+        opts.sendDeletionRequestedEmail ??
+        (isMailTransportAvailable(ctx.registry)
+          ? makeDefaultDeletionRequestedEmail(
+              (tenantId) =>
+                createTransportForTenant(ctx, tenantId, "user-data-rights:request-deletion"),
+              opts.mailDefaults,
+            )
+          : undefined);
+
+      // Best-effort Email-Notification. Send-Failure darf das Write nicht
+      // killen — siehe Type-Doc oben.
+      if (send && userEmail.length > 0) {
+        try {
+          await send({
+            userId: event.user.id,
+            userEmail,
+            userLocale,
+            tenantId: event.user.tenantId,
+            gracePeriodEnd: gracePeriodEnd.toString(),
+          });
+        } catch (err) {
+          // biome-ignore lint/suspicious/noConsole: operator-visibility for email-send-failure
+          console.warn(
+            `[user-data-rights:request-deletion] sendDeletionRequestedEmail failed userId=${event.user.id} tenantId=${event.user.tenantId} err=${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+      }
+
+      // Response liefert den absoluten gracePeriodEnd-Timestamp damit
+      // Frontend/Audit/Cleanup-Runner alle denselben Wert lesen.
+      return {
+        isSuccess: true as const,
+        data: {
+          userId: event.user.id,
+          status: USER_STATUS.DeletionRequested,
+          gracePeriodEnd: gracePeriodEnd.toString(),
+        },
+      };
+    },
+  });
+}

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -0,0 +1,165 @@
+// POST /api/user/request-export (S2.U3 Atom 2) — DSGVO Art. 15 + 20 Trigger.
+//
+// User triggert Export-Job. Persistenz via createEventStoreExecutor
+// (ES-Pattern, Memory: ES kein CRUD). Idempotency-Strategie zweistufig:
+//
+//   1) **App-side-Pre-Check (primaerer Pfad):** fetchOne aktive Jobs
+//      (status pending|running) fuer den userId. Wenn existing,
+//      return `{jobId, isExisting: true}` — KEIN neues Event,
+//      sauberer Audit-Trail (1 Klick-Storm = 1 Event, nicht N).
+//
+//   2) **DB-Constraint als Race-Schutz (Sekundaerpfad):** Bei parallelem
+//      Klick zwischen fetchOne + crud.create wirft die Tx 23505 mit
+//      constraint_name === "read_export_jobs_one_active_per_user".
+//      Catch + re-fetch + return existing als isExisting=true. Race-
+//      Window <1ms, in Production extrem selten.
+//
+// **Cross-Tenant-Semantik:** ExportJob is tenant-agnostic (1 job per userId
+// across all memberships) — the pre-check uses ctx.db.unsafeRaw (no TenantDb filter) so a click from tenant B still finds the job from tenant A.
+// `requestedFromTenantId` persistiert den Initial-Tenant aus dem
+// 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
+// fuer Job-TTL/Stale/Cleanup.
+
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import * as z from "zod";
+import {
+  ACTIVE_JOB_CONSTRAINT,
+  EXPORT_JOB_STATUS,
+  exportJobEntity,
+  exportJobsTable,
+} from "../schema/export-job.js";
+
+const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
+  entityName: "export-job",
+});
+
+const REQUEST_EXPORT_REASON =
+  "export jobs are keyed by userId across all of the user's tenant memberships, not the caller's current tenant";
+
+/**
+ * Race-Loss-Detection: createEventStoreExecutor.create catched 23505
+ * intern + returnt `WriteFailure(UniqueViolationError)`, **kein throw**.
+ * Wir checken den Failure-Code + constraintName um den App-side-vs-Race-
+ * Pfad zu unterscheiden. Andere Failures (validation, version-conflict,
+ * ...) propagieren unveraendert.
+ */
+function isActiveJobConflict(failure: WriteFailure): boolean {
+  const error = failure.error as {
+    code?: string;
+    details?: { constraintName?: string };
+  }; // @cast-boundary error-details
+  return (
+    error.code === "unique_violation" && error.details?.constraintName === ACTIVE_JOB_CONSTRAINT
+  );
+}
+
+export const requestExportWrite = defineWriteHandler({
+  name: "request-export",
+  schema: z.object({}),
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user queues only their own data export; the active-job " +
+        "check and the created job are both keyed by the caller's own userId",
+    },
+  },
+  description:
+    "Queues a GDPR Art. 15 and 20 data export for the calling user and returns its job id, handing back the running job with isExisting true instead of a second one when an export is already pending.",
+  escapeHatch: {
+    grants: ["unsafeRaw"],
+    reason: REQUEST_EXPORT_REASON,
+  },
+  handler: async (event, ctx) => {
+    const userId = event.user.id;
+    const T = getTemporal();
+    const now = T.Now.instant();
+    const exportJobRunner = ctx.db.unsafeRaw(REQUEST_EXPORT_REASON);
+
+    // Pre-Check: exportJobRunner bypasses the TenantDb-Filter — the
+    // TenantDb-Wrapper would hide cross-tenant jobs.
+    const existing = await findActiveJob(exportJobRunner, userId);
+    if (existing) {
+      // Snapshot-Status (kann zwischen fetchOne + Response stale werden
+      // wenn Worker parallel den State flippt; window minimal). User
+      // pollt fuer Live-Wahrheit ueber export-status.query.
+      return {
+        isSuccess: true as const,
+        data: {
+          jobId: existing.id,
+          status: existing.status,
+          isExisting: true,
+        },
+      };
+    }
+
+    // Kein active Job — neuen anlegen via crud.create. requestedFromTenantId
+    // = aktueller Tenant des Users; Worker liest sein Compliance-Profile
+    // aus diesem Tenant.
+    const result = await crud.create(
+      {
+        userId,
+        requestedFromTenantId: event.user.tenantId,
+        requestedAt: now,
+        tenantId: event.user.tenantId,
+      },
+      event.user,
+      ctx.db,
+    );
+
+    if (!result.isSuccess) {
+      // Race-Pfad: paralleler Klick hat zwischen findActiveJob + crud.create
+      // einen aktiven Job angelegt → UniqueViolationError mit unserem
+      // Constraint. Re-fetch + return existing als isExisting=true.
+      // Andere Failures (validation, version-conflict, ...) propagieren.
+      if (isActiveJobConflict(result)) {
+        const winner = await findActiveJob(exportJobRunner, userId);
+        if (!winner) {
+          // Sollte nie passieren — Constraint-Violation ohne existing
+          // active Job hiesse der Constraint matcht etwas anderes.
+          // Original-Failure zurueckgeben damit das auffaellt.
+          return result;
+        }
+        return {
+          isSuccess: true as const,
+          data: {
+            jobId: winner.id,
+            status: winner.status,
+            isExisting: true,
+          },
+        };
+      }
+      return result;
+    }
+
+    // Happy path: neuer Job. SaveContext.id ist EntityId (number | string);
+    // exportJobEntity hat idType:"uuid" → garantiert string, String()
+    // schuetzt vor Drift falls jemand die Entity auf serial migriert.
+    const created = result.data as SaveContext; // @cast-boundary engine-payload
+    return {
+      isSuccess: true as const,
+      data: {
+        jobId: String(created.id),
+        // Snapshot: just-created → pending. Live-Wahrheit kommt ueber
+        // export-status.query, status hier ist nice-to-have fuer das
+        // initial UI-Render ("Anfrage angenommen, currently pending").
+        status: EXPORT_JOB_STATUS.Pending,
+        isExisting: false,
+      },
+    };
+  },
+});
+
+async function findActiveJob(
+  db: import("@cosmicdrift/kumiko-framework/db").DbRunner,
+  userId: string,
+): Promise<{ id: string; status: string } | null> {
+  const row = await fetchOne<{ id: string; status: string }>(db, exportJobsTable, {
+    userId,
+    status: [EXPORT_JOB_STATUS.Pending, EXPORT_JOB_STATUS.Running],
+  });
+  return row ?? null;
+}

package/packages/bundled-features/src/user-data-rights/handlers/restrict-account.write.ts

@@ -0,0 +1,133 @@
+import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { USER_STATUS, userTable } from "../../user/index.js";
+import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
+import { isAdminActor } from "../lib/is-admin-actor.js";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+
+// POST /api/user/restrict (S2.U6) — DSGVO Art. 18 Account-Freeze.
+// Flippt status=Active → Restricted und revoked alle live sessions
+// des Users via cross-feature ctx.writeAs(sessions.revokeAllForUser).
+//
+// Plan-Doc-Verhalten ("Schreib-API geblockt"):
+//   - Login geblockt: login.write.ts checked status=Restricted (Atom 3).
+//   - Active sessions: revoked durch cross-feature-call (sessions-feature
+//     muss gemountet sein). App-Author ohne sessions-feature kriegt einen
+//     Boot-Resolver-Error via r.usesApi("sessions.revokeAllForUser").
+//
+// Self-service by default (userId omitted → event.user.id). An admin can
+// also target someone else's account — needed once a user is already
+// Restricted, since their own session is then unconditionally rejected by
+// sessionChecker and they can no longer call this (or any) endpoint
+// themselves; only an operator path reaches it at that point.
+//
+// Tenant scope: `isAdminActor` accepts access.admin, which includes TenantAdmin
+// (tenant-scoped) even though the User-entity is global — see user-data-rights.md "Cross-Tenant-Semantik". Without a membership check, a TenantAdmin from tenant A could restrict/unrestrict a user who
+// has never been a member of tenant A. Only SystemAdmin (platform-wide)
+// skips the check; the target must have a membership row in the acting
+// admin's `event.user.tenantId` (row existence only — no active-status field).
+//
+// State-Transitions:
+//   Active → Restricted        ✓ (dieser Handler)
+//   Restricted → Restricted    ✗ 422 already_restricted (Idempotenz-Guard)
+//   DeletionRequested → ...    ✗ 422 user_not_in_active_state
+//   Deleted → ...              ✗ 422 user_not_in_active_state
+export const restrictAccountWrite = defineWriteHandler({
+  name: "restrict-account",
+  schema: z.object({ userId: z.string().uuid().optional() }),
+  access: {
+    openToAll: {
+      reason:
+        "each signed-in user may restrict only their own account by default; targeting " +
+        "another userId additionally requires isAdminActor(event.user) and a membership " +
+        "row for the target in the admin's own tenant, both checked in the handler body",
+    },
+  },
+  escapeHatch: {
+    reason:
+      "Revokes all live sessions of the (possibly self-)restricted user via ctx.writeAs(SYSTEM, " +
+      "sessions:write:user-session:revoke-all-for-user) — that handler's own access gate needs " +
+      "privileged roles the acting caller doesn't necessarily have. It also checks the target " +
+      "user's membership in the admin's tenant and appends the user lifecycle status change on " +
+      "the SYSTEM_TENANT_ID user stream, both via DbRunner helpers.",
+  },
+  description:
+    "Freezes an account under GDPR Art. 18 by flipping it to restricted and revoking all of its live sessions, locking the user out until an admin calls lift-restriction; targets the caller by default, an admin may name another userId.",
+  agent: { risk: "high" },
+  handler: async (event, ctx) => {
+    const targetUserId = event.payload.userId ?? event.user.id;
+    if (targetUserId !== event.user.id) {
+      if (!isAdminActor(event.user)) {
+        return writeFailure(
+          new AccessDeniedError({
+            details: { reason: "admin_required_for_other_user" },
+          }),
+        );
+      }
+      const outside = await denyIfTargetOutsideAdminTenant(
+        ctx.db.unsafeRaw(
+          "checks the target user's membership in the admin's tenant via the DbRunner helper",
+        ),
+        event.user,
+        targetUserId,
+      );
+      if (outside) return outside;
+    }
+
+    const userRow = await ctx.db.global(userTable).fetchOne<{ status: string }>({
+      id: targetUserId,
+    });
+
+    if (!userRow) {
+      return writeFailure(
+        new UnprocessableError("user_not_found", {
+          details: { userId: targetUserId },
+        }),
+      );
+    }
+
+    const currentStatus = userRow.status;
+    if (currentStatus === USER_STATUS.Restricted) {
+      return writeFailure(
+        new UnprocessableError("already_restricted", {
+          details: { currentStatus },
+        }),
+      );
+    }
+    if (currentStatus !== USER_STATUS.Active) {
+      return writeFailure(
+        new UnprocessableError("user_not_in_active_state", {
+          details: { currentStatus },
+        }),
+      );
+    }
+
+    await updateUserLifecycle(
+      ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"),
+      targetUserId,
+      { status: USER_STATUS.Restricted },
+    );
+
+    // Cross-Feature: alle live sessions revoken — sonst koennte der User
+    // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
+    // ctx.writeAs(systemUser, ...) damit der privileged-Handler die
+    // System-User-Roles im access-gate hat.
+    const systemUser = createSystemUser(event.user.tenantId);
+    await ctx.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
+      userId: targetUserId,
+    });
+
+    return {
+      isSuccess: true as const,
+      data: {
+        userId: targetUserId,
+        status: USER_STATUS.Restricted,
+      },
+    };
+  },
+});

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -0,0 +1,95 @@
+// POST /userDataRights/run-forget-cleanup (S2.U5b).
+//
+// Cron-Trigger fuer den Forget-Cleanup-Pipeline. Der Handler wrapt nur
+// `runForgetCleanup` damit er via dispatcher (System-User) aufrufbar
+// wird — die Pipeline-Logik selbst lebt im pure-function Modul
+// `run-forget-cleanup.ts` (testbar ohne dispatcher).
+//
+// Access: privileged — nur System-Caller (cron, ops-script). Im Cron-
+// Setup laeuft der Job mit `createSystemUser(...)` als executor.
+//
+// Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
+
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import * as z from "zod";
+import { resolveAppTenantModel } from "../lib/resolve-tenant-model.js";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.js";
+import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.js";
+
+export type RunForgetCleanupOptions = {
+  readonly sendDeletionExecutedEmail?: SendDeletionExecutedEmailFn;
+};
+
+const RUN_FORGET_CLEANUP_REASON =
+  "operator forget cleanup iterates users across tenants in per-user sub-transactions";
+
+export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}) {
+  return defineWriteHandler({
+    name: "run-forget-cleanup",
+    schema: z.object({}),
+    access: { roles: access.privileged },
+    // Cascades into per-user forget hooks that hard-purge (executor.forget)
+    // records without softDelete — an agent must never be able to trigger it.
+    agent: { expose: false, risk: "high" },
+    escapeHatch: {
+      grants: ["unsafeRaw"],
+      reason: RUN_FORGET_CLEANUP_REASON,
+    },
+    handler: async (_event, ctx) => {
+      if (!ctx.registry) {
+        return writeFailure(
+          new InternalError({
+            message: "run-forget-cleanup: ctx.registry missing",
+          }),
+        );
+      }
+
+      const T = getTemporal();
+      const runner = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON);
+      // Operator-triggered forget must also erase binaries, not just rows —
+      // it flips users to Deleted, after which the cron never re-processes
+      // them, so a row-only delete here would permanently leak the binaries.
+      // Resolve through the same file-foundation path the cron uses.
+      const forgetDb = runner as DbConnection; // @cast-boundary db-runner — DbRunner narrows to DbConnection, config reads tolerate the outer tx
+      const tenantModel = await resolveAppTenantModel({
+        registry: ctx.registry,
+        configResolver: ctx.configResolver,
+        db: forgetDb,
+        userId: ctx._userId ?? SYSTEM_USER_ID,
+      });
+      const result = await runForgetCleanup({
+        db: runner,
+        registry: ctx.registry,
+        now: T.Now.instant(),
+        tenantModel,
+        ...(ctx.searchAdapter !== undefined && { searchAdapter: ctx.searchAdapter }),
+        buildStorageProvider: makeTenantStorageProviderResolver({
+          registry: ctx.registry,
+          configResolver: ctx.configResolver,
+          secrets: ctx.secrets,
+          db: forgetDb,
+          userId: ctx._userId ?? SYSTEM_USER_ID,
+          handlerName: "user-data-rights:run-forget-cleanup",
+        }),
+        ...(opts.sendDeletionExecutedEmail && {
+          sendDeletionExecutedEmail: opts.sendDeletionExecutedEmail,
+        }),
+      });
+
+      return {
+        isSuccess: true as const,
+        data: {
+          processedUserIds: result.processedUserIds,
+          hookCallsAttempted: result.hookCallsAttempted,
+          errorCount: result.errors.length,
+          errors: result.errors,
+          incompleteCount: result.incomplete.length,
+          incomplete: result.incomplete,
+        },
+      };
+    },
+  });
+}

package/packages/bundled-features/src/user-data-rights/i18n.ts

@@ -0,0 +1,39 @@
+// @runtime client
+// Server + client i18n for user-data-rights (operator screens + nav). Pure
+// data, importable from the web bundle (web/i18n.ts derives the client keys).
+type LocalizedString = { readonly en: string };
+
+export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "user-data-rights:nav.exportJobs": { en: "GDPR exports" },
+  "screen:export-job-list.title": { en: "GDPR exports" },
+  "screen:export-job-detail.title": { en: "Export job" },
+  "screen:download-attempt-list.title": { en: "Download attempts" },
+  "screen:privacy-center.title": { en: "Privacy" },
+  "userDataRights.privacyCenter.subtitle": {
+    en: "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
+  },
+  "user-data-rights:entity:export-job:field:userId": { en: "User" },
+  "user-data-rights:entity:export-job:field:status": { en: "Status" },
+  "user-data-rights:entity:export-job:field:requestedAt": { en: "Requested" },
+  "user-data-rights:entity:export-job:field:completedAt": { en: "Completed" },
+  "user-data-rights:entity:export-job:field:expiresAt": { en: "Expires" },
+  "user-data-rights:entity:export-job:field:requestedFromTenantId": {
+    en: "Tenant",
+  },
+  "user-data-rights:entity:export-job:field:startedAt": { en: "Started" },
+  "user-data-rights:entity:export-job:field:downloadStorageKey": {
+    en: "Storage key",
+  },
+  "user-data-rights:entity:export-job:field:bytesWritten": { en: "Bytes" },
+  "user-data-rights:entity:export-job:field:errorMessage": { en: "Error" },
+  "user-data-rights:entity:download-attempt:field:attemptedAt": {
+    en: "Attempted at",
+  },
+  "user-data-rights:entity:download-attempt:field:result": { en: "Result" },
+  "user-data-rights:entity:download-attempt:field:via": { en: "Via" },
+  "user-data-rights:entity:download-attempt:field:ip": { en: "IP" },
+  "user-data-rights:entity:download-attempt:field:attemptedByUserId": {
+    en: "User",
+  },
+  "user-data-rights:entity:download-attempt:field:jobId": { en: "Job" },
+};