@cosmicdrift/kumiko-samples 0.404.1 → 0.405.0

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -1,4 +1,4 @@
-import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // Forget-cleanup runner — pure-function pipeline.
 //
 // After the grace period, this runner processes users in DeletionRequested
@@ -34,7 +34,6 @@ import {
   subjectIdToKey,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
-  createTenantDb,
   type DbRunner,
   entityEventName,
   executeRawQuery,
@@ -57,10 +56,6 @@ import {
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
-import {
-  createEscapeHatchReporter,
-  UNATTRIBUTED_ACTOR,
-} from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   purgeSearchDocumentsForSubject,
   type SearchAdapter,
@@ -78,6 +73,7 @@ import {
 } from "../shared/index.ts";
 import { tenantMembershipsTable } from "../tenant/index.ts";
 import { USER_STATUS, userTable } from "../user/index.ts";
+import { buildHookDb } from "./build-hook-db.ts";
 import { selectUsersDueForForgetCleanup } from "./db/queries/forget-cleanup.ts";
 import { updateUserLifecycle } from "./lib/update-user-lifecycle.ts";
 
@@ -205,35 +201,6 @@ interface HookEntry {
   readonly escapeHatchReason: string | undefined;
 }
 
-function buildHookDb(
-  db: DbRunner,
-  tenantId: TenantId,
-  entry: HookEntry,
-  args: {
-    readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
-    readonly escapeHatchAuditLog?: Logger;
-    readonly actor?: string;
-  },
-) {
-  const report = createEscapeHatchReporter({
-    handler: `${EXT_USER_DATA}:${entry.entityName}`,
-    tenantId,
-    actor: args.actor ?? UNATTRIBUTED_ACTOR,
-    sink: args.escapeHatchAuditSink,
-    log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
-  });
-  return createTenantDb({
-    db,
-    tenantId,
-    mode: "tenant",
-    grants: {
-      unsafeRaw:
-        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-      report,
-    },
-  });
-}
-
 // EXT_USER_DATA delete-hooks default here; a hook that redacts data keyed on an
 // owner column it doesn't own must register a lower order so it runs BEFORE any
 // hook that nulls that column. See custom-fields wire-user-data-rights.ts.

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -1,4 +1,4 @@
-import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // User data export pipeline — GDPR Art. 15 (access) +
 // Art. 20 (data portability).
 //
@@ -29,7 +29,6 @@ import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   collectEncryptedFieldNames,
   configuredEntityFieldEncryption,
-  createTenantDb,
   decryptEntityFieldValues,
   selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
@@ -44,12 +43,9 @@ import {
   type UserDataExportSnippet,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
-import {
-  createEscapeHatchReporter,
-  UNATTRIBUTED_ACTOR,
-} from "@cosmicdrift/kumiko-framework/pipeline";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantMembershipsTable } from "../tenant/index.ts";
+import { buildHookDb } from "./build-hook-db.ts";
 import { buildFileRefZipPath } from "./zip-path.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
@@ -108,31 +104,6 @@ interface HookEntry {
   readonly escapeHatchReason: string | undefined;
 }
 
-function buildHookDb(
-  db: DbRunner,
-  tenantId: TenantId,
-  entry: HookEntry,
-  args: Pick<RunUserExportArgs, "escapeHatchAuditSink" | "escapeHatchAuditLog" | "actor">,
-) {
-  const report = createEscapeHatchReporter({
-    handler: `${EXT_USER_DATA}:${entry.entityName}`,
-    tenantId,
-    actor: args.actor ?? UNATTRIBUTED_ACTOR,
-    sink: args.escapeHatchAuditSink,
-    log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
-  });
-  return createTenantDb({
-    db,
-    tenantId,
-    mode: "tenant",
-    grants: {
-      unsafeRaw:
-        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-      report,
-    },
-  });
-}
-
 /**
  * Pure function: invokes all EXT_USER_DATA hooks for each tenant
  * membership and collects snippets into a UserExportBundle.

package/packages/bundled-features/src/user-data-rights/token-helpers.ts

@@ -13,10 +13,8 @@
 // **Multi-use within TTL:** The token is NOT "consumed" on download, so the user
 // can download repeatedly until expiresAt. This matches Google-Takeout (7d) and
 // Facebook-Data-Download (4d).
-//
-// **Universal Web-Crypto API:** crypto.getRandomValues + crypto.subtle.digest
-// runs identically in Bun, Node 19+, and browsers, avoiding platform-specific
-// imports.
+
+import { hashOpaqueToken } from "@cosmicdrift/kumiko-framework/crypto";
 
 /**
  * Generates a new download token. The plain token is sent to the user by email;
@@ -41,9 +39,7 @@ export async function generateDownloadToken(): Promise<{
  * database (no constant-time comparison, see the header comment).
  */
 export async function hashDownloadToken(plain: string): Promise<string> {
-  const encoded = new TextEncoder().encode(plain);
-  const digest = await crypto.subtle.digest("SHA-256", encoded);
-  return uint8ArrayToHex(new Uint8Array(digest));
+  return hashOpaqueToken(plain);
 }
 
 function uint8ArrayToBase64Url(bytes: Uint8Array): string {
@@ -54,11 +50,3 @@ function uint8ArrayToBase64Url(bytes: Uint8Array): string {
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-
-function uint8ArrayToHex(bytes: Uint8Array): string {
-  let out = "";
-  for (let i = 0; i < bytes.length; i++) {
-    out += (bytes[i] as number).toString(16).padStart(2, "0"); // @cast-boundary dynamic-key
-  }
-  return out;
-}

package/packages/bundled-features/src/user-data-rights/web/privacy-center-screen.tsx

@@ -19,6 +19,7 @@ import {
 import { postWithDownload } from "@cosmicdrift/kumiko-renderer/web";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ReactNode, useEffect, useState } from "react";
+import { type SectionStatus, StatusBanner } from "../../shared/web/status-banner.tsx";
 import {
   EXPORT_JOB_STATUS,
   type ExportJobStatus,
@@ -41,12 +42,6 @@ type ExportStatusResult =
   | { readonly hasJob: false }
   | { readonly hasJob: true; readonly job: ExportJob };
 
-type SectionStatus =
-  | { kind: "idle" }
-  | { kind: "submitting" }
-  | { kind: "success"; messageKey: string }
-  | { kind: "error"; messageKey: string };
-
 // Dispatcher failures include i18nKey only when the handler sets one; read it
 // at the boundary with a generic fallback.
 function failureKey(error: unknown): string {
@@ -63,18 +58,6 @@ export function formatDate(iso: string | null | undefined): string {
   return tIndex > 0 ? iso.slice(0, tIndex) : iso;
 }
 
-function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
-  const t = useTranslation();
-  const { Banner } = usePrimitives();
-  if (status.kind === "success") {
-    return <Banner variant="info">{t(status.messageKey)}</Banner>;
-  }
-  if (status.kind === "error") {
-    return <Banner variant="error">{t(status.messageKey)}</Banner>;
-  }
-  return null;
-}
-
 // Mounted by the renderer's ExtensionSectionMount (already wrapped in
 // <Section title={...} testId="section-extension-...">) — takes no props of
 // its own, ExtensionSectionProps (entityName/entityId/...) are unused since

package/packages/bundled-features/src/user-profile/web/profile-screen.tsx

@@ -16,14 +16,9 @@ import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ReactNode, useState } from "react";
 import { AuthHandlers } from "../../auth-email-password/web/constants.ts";
 import { requestEmailVerification } from "../../auth-email-password/web/index.ts";
+import { type SectionStatus, StatusBanner } from "../../shared/web/status-banner.tsx";
 import { UserProfileHandlers } from "./constants.ts";
 
-type SectionStatus =
-  | { kind: "idle" }
-  | { kind: "submitting" }
-  | { kind: "success"; messageKey: string }
-  | { kind: "error"; messageKey: string };
-
 // Dispatcher failures carry an i18nKey only when the handler sets one —
 // boundary read with a generic fallback.
 function failureKey(error: unknown): string {
@@ -31,18 +26,6 @@ function failureKey(error: unknown): string {
   return typeof key === "string" ? key : "profile.errors.generic";
 }
 
-function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
-  const t = useTranslation();
-  const { Banner } = usePrimitives();
-  if (status.kind === "success") {
-    return <Banner variant="info">{t(status.messageKey)}</Banner>;
-  }
-  if (status.kind === "error") {
-    return <Banner variant="error">{t(status.messageKey)}</Banner>;
-  }
-  return null;
-}
-
 // Mounted by the renderer's ExtensionSectionMount (already wrapped in
 // <Section title={...} testId="section-extension-...">) — takes no props of
 // its own. Deliberately NOT a <Form>: RenderEdit already renders a host