@actuate-media/cms-admin 0.36.0 → 0.37.0

package/dist/views/settings/useUpdates.d.ts

@@ -0,0 +1,67 @@
+export type UpdateChangeType = 'feature' | 'fix' | 'improvement' | 'breaking' | 'security' | 'deprecation';
+export interface UpdateChangelogItem {
+    version: string;
+    date: string;
+    summary: string;
+    type?: UpdateChangeType;
+}
+export interface UpdatePluginCompatibility {
+    name: string;
+    compatible: boolean;
+    minVersion?: string;
+}
+export interface UpdateInfo {
+    current: string;
+    latest: string;
+    updateAvailable: boolean;
+    severity?: 'patch' | 'minor' | 'major' | 'security';
+    releaseDate?: string;
+    changelog?: UpdateChangelogItem[];
+    updateCommand?: string;
+    breakingChanges?: string[];
+    hasMigrations?: boolean;
+    pluginCompatibility?: UpdatePluginCompatibility[];
+    source?: 'update-server' | 'npm';
+    /** Whether the current session may manage updates (admin/owner). */
+    canManage?: boolean;
+    hasGithubToken?: boolean;
+    githubRepo?: string;
+}
+interface GithubForm {
+    githubRepo: string;
+    githubToken: string;
+}
+/** Admin/Owner may manage updates (matches the server's `requireAdminScope`). */
+export declare function canManageUpdates(role: string | null | undefined): boolean;
+/**
+ * State + actions for the Settings → Updates tab. Owns the update-status check,
+ * the GitHub-integration config form (with dirty tracking for the shared save
+ * bar), and the "Create Update PR" action. All writes are gated on `canManage`,
+ * which the server confirms in the check response.
+ */
+export declare function useUpdates({ role }: {
+    role?: string;
+}): {
+    info: UpdateInfo | null;
+    checking: boolean;
+    hasChecked: boolean;
+    error: string;
+    applying: boolean;
+    prResult: {
+        prUrl: string;
+        prNumber: number;
+    } | null;
+    canManage: boolean;
+    form: GithubForm;
+    setField: (key: keyof GithubForm, value: string) => void;
+    dirty: boolean;
+    repoError: string;
+    hasErrors: boolean;
+    saveState: "error" | "success" | "idle" | "saving";
+    save: () => Promise<void>;
+    reset: () => void;
+    check: () => Promise<void>;
+    apply: () => Promise<void>;
+};
+export {};
+//# sourceMappingURL=useUpdates.d.ts.map

package/dist/views/settings/useUpdates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUpdates.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,KAAK,GACL,aAAa,GACb,UAAU,GACV,UAAU,GACV,aAAa,CAAA;AAEjB,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,OAAO,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,eAAe,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,mBAAmB,EAAE,CAAA;IACjC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,CAAA;IACjD,MAAM,CAAC,EAAE,eAAe,GAAG,KAAK,CAAA;IAChC,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,UAAU,UAAU;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGzE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;eAMF,MAAM;kBAAY,MAAM;;;;oBAqCvC,MAAM,UAAU,SAAS,MAAM;;;;;;;;;EA0EnE"}

package/dist/views/settings/useUpdates.js

@@ -0,0 +1,127 @@
+'use client';
+import { useCallback, useEffect, useState } from 'react';
+import { toast } from 'sonner';
+import { cmsApi } from '../../lib/api.js';
+const REPO_PATTERN = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
+/** Admin/Owner may manage updates (matches the server's `requireAdminScope`). */
+export function canManageUpdates(role) {
+    const r = (role ?? '').toUpperCase();
+    return r === 'ADMIN' || r === 'OWNER';
+}
+/**
+ * State + actions for the Settings → Updates tab. Owns the update-status check,
+ * the GitHub-integration config form (with dirty tracking for the shared save
+ * bar), and the "Create Update PR" action. All writes are gated on `canManage`,
+ * which the server confirms in the check response.
+ */
+export function useUpdates({ role }) {
+    const [info, setInfo] = useState(null);
+    const [checking, setChecking] = useState(false);
+    const [hasChecked, setHasChecked] = useState(false);
+    const [error, setError] = useState('');
+    const [applying, setApplying] = useState(false);
+    const [prResult, setPrResult] = useState(null);
+    const [form, setForm] = useState({ githubRepo: '', githubToken: '' });
+    const [baseline, setBaseline] = useState({ githubRepo: '', githubToken: '' });
+    const [saveState, setSaveState] = useState('idle');
+    // Optimistic until the check response confirms the server-side permission.
+    const canManage = info?.canManage ?? canManageUpdates(role);
+    const check = useCallback(async () => {
+        setChecking(true);
+        setError('');
+        setPrResult(null);
+        const res = await cmsApi('/updates/check');
+        if (res.error) {
+            setError(res.error);
+        }
+        else if (res.data) {
+            setInfo(res.data);
+            const repo = res.data.githubRepo ?? '';
+            setForm({ githubRepo: repo, githubToken: '' });
+            setBaseline({ githubRepo: repo, githubToken: '' });
+        }
+        setChecking(false);
+        setHasChecked(true);
+    }, []);
+    useEffect(() => {
+        check();
+    }, [check]);
+    const repoError = form.githubRepo.trim() && !REPO_PATTERN.test(form.githubRepo.trim())
+        ? 'Use the owner/repo format (e.g. actuate-media/my-site).'
+        : '';
+    const hasErrors = Boolean(repoError);
+    const dirty = form.githubRepo !== baseline.githubRepo || form.githubToken.trim() !== '';
+    const setField = useCallback((key, value) => {
+        setForm((f) => ({ ...f, [key]: value }));
+        setSaveState('idle');
+    }, []);
+    const save = useCallback(async () => {
+        if (hasErrors || !dirty)
+            return;
+        setSaveState('saving');
+        const body = {};
+        if (form.githubToken.trim())
+            body.githubToken = form.githubToken.trim();
+        if (form.githubRepo.trim())
+            body.githubRepo = form.githubRepo.trim();
+        const res = await cmsApi('/updates/config', { method: 'PUT', body: JSON.stringify(body) });
+        if (res.error) {
+            setSaveState('error');
+            toast.error(res.error);
+            return;
+        }
+        setSaveState('success');
+        toast.success('GitHub configuration saved and encrypted.');
+        const savedRepo = form.githubRepo.trim();
+        setBaseline({ githubRepo: savedRepo, githubToken: '' });
+        setForm({ githubRepo: savedRepo, githubToken: '' });
+        setInfo((prev) => prev
+            ? {
+                ...prev,
+                githubRepo: savedRepo,
+                hasGithubToken: prev.hasGithubToken || Boolean(body.githubToken),
+            }
+            : prev);
+    }, [dirty, form.githubRepo, form.githubToken, hasErrors]);
+    const reset = useCallback(() => {
+        setForm({ ...baseline });
+        setSaveState('idle');
+    }, [baseline]);
+    const apply = useCallback(async () => {
+        if (!info?.latest || !canManage)
+            return;
+        setApplying(true);
+        const res = await cmsApi('/updates/apply', {
+            method: 'POST',
+            body: JSON.stringify({ targetVersion: info.latest }),
+        });
+        if (res.error) {
+            toast.error(res.error);
+        }
+        else if (res.data) {
+            setPrResult(res.data);
+            toast.success('Update PR created.');
+        }
+        setApplying(false);
+    }, [info, canManage]);
+    return {
+        info,
+        checking,
+        hasChecked,
+        error,
+        applying,
+        prResult,
+        canManage,
+        form,
+        setField,
+        dirty,
+        repoError,
+        hasErrors,
+        saveState,
+        save,
+        reset,
+        check,
+        apply,
+    };
+}
+//# sourceMappingURL=useUpdates.js.map

package/dist/views/settings/useUpdates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useUpdates.js","sourceRoot":"","sources":["../../../src/views/settings/useUpdates.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AA8CzC,MAAM,YAAY,GAAG,oCAAoC,CAAA;AAEzD,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAA+B;IAC9D,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,IAAI,EAAqB;IACpD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAoB,IAAI,CAAC,CAAA;IACzD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA6C,IAAI,CAAC,CAAA;IAE1F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACjF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAa,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IACzF,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAA0C,MAAM,CAAC,CAAA;IAE3F,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,QAAQ,CAAC,EAAE,CAAC,CAAA;QACZ,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAa,gBAAgB,CAAC,CAAA;QACtD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAA;YACtC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;YAC9C,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACpD,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,aAAa,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,EAAE,CAAA;IACT,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAEX,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAClE,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IAEvF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,GAAqB,EAAE,KAAa,EAAE,EAAE;QACpE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACxC,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC/B,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,MAAM,IAAI,GAA2B,EAAE,CAAA;QACvC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACvE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QAEpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,YAAY,CAAC,SAAS,CAAC,CAAA;QACvB,KAAK,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAA;QACxC,WAAW,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QACnD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI;YACF,CAAC,CAAC;gBACE,GAAG,IAAI;gBACP,UAAU,EAAE,SAAS;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aACjE;YACH,CAAC,CAAC,IAAI,CACT,CAAA;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IAEzD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;QACxB,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS;YAAE,OAAM;QACvC,WAAW,CAAC,IAAI,CAAC,CAAA;QACjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsC,gBAAgB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SACrD,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACrB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QACrC,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAA;IAErB,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -88,7 +88,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.46.0",
+    "@actuate-media/cms-core": "0.47.0",
     "@actuate-media/component-blocks": "0.2.0"
   },
   "scripts": {

package/src/__tests__/views/appearance-settings.render.test.tsx

@@ -51,9 +51,9 @@ describe('AppearanceTab', () => {
     render(<AppearanceTab role="ADMIN" />)
 
     await screen.findByText('Branding')
-    expect(screen.getByText('Admin Theme')).toBeTruthy()
-    expect(screen.getByText('Typography & Motion')).toBeTruthy()
-    expect(screen.getByText('Brand Preview')).toBeTruthy()
+    expect(screen.getByText('Admin theme')).toBeTruthy()
+    expect(screen.getByText('Typography & motion')).toBeTruthy()
+    expect(screen.getByText('Brand preview')).toBeTruthy()
     expect(
       (screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement).disabled,
     ).toBe(true)
@@ -99,7 +99,7 @@ describe('AppearanceTab', () => {
     render(<AppearanceTab role="ADMIN" />)
     await screen.findByText('Branding')
 
-    const input = screen.getByLabelText('Primary Logo') as HTMLInputElement
+    const input = screen.getByLabelText('Primary logo') as HTMLInputElement
     const file = new File(
       ['<svg viewBox="0 0 400 100" xmlns="http://www.w3.org/2000/svg"></svg>'],
       'logo.svg',

package/src/__tests__/views/updates-tab.render.test.tsx

@@ -0,0 +1,161 @@
+// @vitest-environment happy-dom
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+
+// The Updates tab reads `/updates/check`, saves GitHub config via
+// PUT `/updates/config`, and opens an upgrade PR via POST `/updates/apply`.
+let checkData: any
+
+const cmsApi = vi.fn(async (endpoint: string, options?: { method?: string; body?: unknown }) => {
+  const method = options?.method ?? 'GET'
+  if (endpoint === '/updates/check' && method === 'GET') return { data: checkData, status: 200 }
+  if (endpoint === '/updates/config' && method === 'PUT')
+    return { data: { success: true }, status: 200 }
+  if (endpoint === '/updates/apply' && method === 'POST')
+    return { data: { prUrl: 'https://github.com/x/y/pull/1', prNumber: 1 }, status: 200 }
+  return { data: {}, status: 200 }
+})
+
+vi.mock('../../lib/api.js', () => ({ cmsApi: (e: string, o?: unknown) => cmsApi(e, o as any) }))
+vi.mock('sonner', () => ({ toast: { success: vi.fn(), error: vi.fn(), loading: vi.fn() } }))
+
+const { UpdatesTab } = await import('../../views/settings/UpdatesTab.js')
+
+function upToDate(overrides: Record<string, unknown> = {}) {
+  return {
+    current: '0.46.0',
+    latest: '0.46.0',
+    updateAvailable: false,
+    canManage: true,
+    hasGithubToken: false,
+    githubRepo: '',
+    source: 'update-server',
+    ...overrides,
+  }
+}
+
+function updateAvailable(overrides: Record<string, unknown> = {}) {
+  return {
+    current: '0.45.0',
+    latest: '0.46.0',
+    updateAvailable: true,
+    severity: 'minor',
+    releaseDate: '2026-01-02',
+    changelog: [
+      {
+        version: '0.46.0',
+        date: '2026-01-02',
+        summary: 'Add Brand Voice training',
+        type: 'feature',
+      },
+    ],
+    hasMigrations: true,
+    breakingChanges: ['Removed the legacy provider API'],
+    pluginCompatibility: [
+      { name: '@actuate-media/plugin-seo', compatible: true, minVersion: '0.46.0' },
+    ],
+    updateCommand: 'npm update @actuate-media/cms-core',
+    canManage: true,
+    hasGithubToken: false,
+    githubRepo: '',
+    source: 'update-server',
+    ...overrides,
+  }
+}
+
+beforeEach(() => {
+  cmsApi.mockClear()
+  checkData = upToDate()
+})
+
+describe('UpdatesTab', () => {
+  it('shows the current version and an up-to-date banner', async () => {
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText("You're up to date!")
+    expect(screen.getAllByText('0.46.0').length).toBeGreaterThan(0)
+    // Admins see the GitHub integration card.
+    expect(screen.getByText('GitHub Integration')).toBeTruthy()
+  })
+
+  it('surfaces severity, real changelog, migrations and breaking changes', async () => {
+    checkData = updateAvailable()
+    render(<UpdatesTab role="ADMIN" />)
+
+    await screen.findByText('Update available')
+    expect(screen.getByText('Minor')).toBeTruthy()
+    expect(screen.getByText('Add Brand Voice training')).toBeTruthy()
+    expect(screen.getByText('Database migrations required')).toBeTruthy()
+    expect(screen.getByText('Breaking changes in this release')).toBeTruthy()
+    expect(screen.getByText('Removed the legacy provider API')).toBeTruthy()
+    // Plugin compatibility surfaced.
+    expect(screen.getByText('plugin-seo')).toBeTruthy()
+    expect(screen.getByRole('button', { name: 'Create Update PR' })).toBeTruthy()
+  })
+
+  it('flags a security release prominently', async () => {
+    checkData = updateAvailable({ severity: 'security' })
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText('Security update available')
+    expect(screen.getByText('Security')).toBeTruthy()
+  })
+
+  it('is permission-aware: non-admins cannot manage updates', async () => {
+    checkData = updateAvailable({ canManage: false })
+    render(<UpdatesTab role="EDITOR" />)
+
+    await screen.findByText('Update available')
+    expect(screen.queryByText('GitHub Integration')).toBeNull()
+    expect(screen.queryByRole('button', { name: 'Create Update PR' })).toBeNull()
+    expect(screen.getByText(/Ask an administrator/i)).toBeTruthy()
+  })
+
+  it('enables Save when the repo changes and persists via PUT /updates/config', async () => {
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText('GitHub Integration')
+
+    const save = screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement
+    expect(save.disabled).toBe(true)
+
+    const repo = screen.getByLabelText('Repository') as HTMLInputElement
+    fireEvent.change(repo, { target: { value: 'actuate-media/site' } })
+    expect(save.disabled).toBe(false)
+
+    fireEvent.click(save)
+    await waitFor(() =>
+      expect(cmsApi).toHaveBeenCalledWith(
+        '/updates/config',
+        expect.objectContaining({
+          method: 'PUT',
+          body: expect.stringContaining('actuate-media/site'),
+        }),
+      ),
+    )
+  })
+
+  it('blocks Save on an invalid repository format', async () => {
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText('GitHub Integration')
+
+    const repo = screen.getByLabelText('Repository') as HTMLInputElement
+    fireEvent.change(repo, { target: { value: 'not a repo' } })
+
+    expect(screen.getByText(/owner\/repo format/i)).toBeTruthy()
+    const save = screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement
+    expect(save.disabled).toBe(true)
+  })
+
+  it('creates an update PR via POST /updates/apply', async () => {
+    checkData = updateAvailable()
+    render(<UpdatesTab role="ADMIN" />)
+    await screen.findByText('Update available')
+
+    fireEvent.click(screen.getByRole('button', { name: 'Create Update PR' }))
+    await waitFor(() =>
+      expect(cmsApi).toHaveBeenCalledWith(
+        '/updates/apply',
+        expect.objectContaining({ method: 'POST', body: expect.stringContaining('0.46.0') }),
+      ),
+    )
+    await screen.findByText('Pull Request Created')
+  })
+})