@cosmicdrift/kumiko-bundled-features 0.108.0 → 0.109.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.108.0",
+  "version": "0.109.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.108.0",
-    "@cosmicdrift/kumiko-framework": "0.108.0",
-    "@cosmicdrift/kumiko-headless": "0.108.0",
-    "@cosmicdrift/kumiko-renderer": "0.108.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.108.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.109.0",
+    "@cosmicdrift/kumiko-framework": "0.109.0",
+    "@cosmicdrift/kumiko-headless": "0.109.0",
+    "@cosmicdrift/kumiko-renderer": "0.109.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.109.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -49,10 +49,11 @@ let patResolver: PatResolver | undefined;
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
 
-// One scope "tokens" grants exactly the two PAT queries — deliberately NOT
-// sessions:query:user-session:mine, so that QN is the out-of-scope probe.
+// One domain "tokens" whose read set is exactly the two PAT queries —
+// deliberately NOT sessions:query:user-session:mine, so that QN is the
+// out-of-scope probe. Granted as "tokens:read".
 const SCOPES: PatScopeConfig = {
-  tokens: { label: "Tokens", qns: [PatQueries.mine, PatQueries.availableScopes] },
+  tokens: { label: "Tokens", read: [PatQueries.mine, PatQueries.availableScopes] },
 };
 
 async function mintToken(
@@ -63,7 +64,7 @@ async function mintToken(
     PatHandlers.create,
     {
       name: "test",
-      scopes: opts?.scopes ?? ["tokens"],
+      scopes: opts?.scopes ?? ["tokens:read"],
       ...(opts?.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}),
     },
     actor,

package/src/personal-access-tokens/__tests__/scopes.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "bun:test";
+import { expandScopes, type PatScopeConfig, parseGrant } from "../scopes";
+
+const CONFIG: PatScopeConfig = {
+  credit: { label: "Kredite", read: ["credit:query:*"], write: ["credit:write:*"] },
+  miete: { label: "Mieten", read: ["ledger:query:*"] }, // read-only domain
+};
+
+describe("parseGrant", () => {
+  it("splits domain:level on the last colon", () => {
+    expect(parseGrant("credit:write")).toEqual({ domain: "credit", level: "write" });
+  });
+  it("rejects a bare token", () => {
+    expect(parseGrant("credit")).toBeNull();
+  });
+});
+
+describe("expandScopes", () => {
+  it("read grants only the read QNs", () => {
+    expect(expandScopes(CONFIG, ["credit:read"])).toEqual(["credit:query:*"]);
+  });
+
+  it("write grants read + write QNs", () => {
+    expect(expandScopes(CONFIG, ["credit:write"]).sort()).toEqual(
+      ["credit:query:*", "credit:write:*"].sort(),
+    );
+  });
+
+  it("read-only domain ignores a write grant's missing write set", () => {
+    expect(expandScopes(CONFIG, ["miete:write"])).toEqual(["ledger:query:*"]);
+  });
+
+  it("unknown domain contributes nothing (fail-closed)", () => {
+    expect(expandScopes(CONFIG, ["ghost:write"])).toEqual([]);
+  });
+
+  it("unions across multiple grants without duplicates", () => {
+    expect(expandScopes(CONFIG, ["credit:read", "miete:read"]).sort()).toEqual(
+      ["credit:query:*", "ledger:query:*"].sort(),
+    );
+  });
+});

package/src/personal-access-tokens/handlers/available-scopes.query.ts

@@ -2,14 +2,20 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import type { PatScopeConfig } from "../scopes";
 
-// Returns the app-declared scopes ({name, label}) so the mint UI can render a
-// checkbox per scope. Built from the config the feature was mounted with — the
-// list is static per deployment, not per user.
+// Returns the app-declared scope domains ({name, label, canWrite}) so the mint
+// UI can render a per-domain level picker (no access / read / read & write).
+// canWrite is false for read-only domains → the UI hides the write option.
+// Static per deployment, not per user.
 export function buildAvailableScopesQuery(scopes: PatScopeConfig) {
   return defineQueryHandler({
     name: "available-scopes",
     schema: z.object({}),
     access: { openToAll: true },
-    handler: async () => Object.entries(scopes).map(([name, def]) => ({ name, label: def.label })),
+    handler: async () =>
+      Object.entries(scopes).map(([name, def]) => ({
+        name,
+        label: def.label,
+        canWrite: (def.write?.length ?? 0) > 0,
+      })),
   });
 }

package/src/personal-access-tokens/scopes.ts

@@ -1,22 +1,43 @@
-// App-declared scopes. Each scope is a named bundle of QN globs the app author
-// wires when mounting the feature — a scope may span features (e.g. a "miete"
-// scope granting ledger + folders QNs). The token stores granted scope NAMES;
-// the resolver expands them to globs at request time.
+// @runtime client
+// Pure scope helpers + types — client-marked so the web screen (web/) may import
+// parseGrant without pulling the feature's server runtime barrel.
+//
+// App-declared scopes — two axes, like GitHub fine-grained PATs: WHICH API
+// (the domain, keyed here) × the permission LEVEL (read vs read+write). Each
+// domain declares its read-QN globs and (optionally) its write-QN globs. A
+// domain may span features (e.g. a "miete" domain granting ledger + folders).
 export type PatScopeDef = {
   readonly label: string;
-  readonly qns: readonly string[];
+  readonly read: readonly string[];
+  // Omit for a read-only domain — the UI then offers only "no access" / "read".
+  readonly write?: readonly string[];
 };
 
 export type PatScopeConfig = Readonly<Record<string, PatScopeDef>>;
 
-// Expand granted scope names into the union of their QN globs. Unknown names
-// (scope dropped from config after a token was minted) contribute nothing —
-// fail-closed: the token silently loses that capability rather than erroring.
+export type PatLevel = "read" | "write";
+
+// A granted scope is the string "<domain>:<level>" (e.g. "credit:write"). The
+// domain key never contains a colon, so split on the LAST one.
+export function parseGrant(grant: string): { domain: string; level: string } | null {
+  const idx = grant.lastIndexOf(":");
+  if (idx <= 0) return null;
+  return { domain: grant.slice(0, idx), level: grant.slice(idx + 1) };
+}
+
+// Expand granted "<domain>:<level>" entries into the union of QN globs: read
+// always grants the read QNs; write additionally grants the write QNs. Unknown
+// domains contribute nothing (fail-closed — a scope dropped from config after a
+// token was minted silently loses that capability).
 export function expandScopes(config: PatScopeConfig, granted: readonly string[]): string[] {
   const out = new Set<string>();
-  for (const name of granted) {
-    const def = config[name];
-    if (def) for (const qn of def.qns) out.add(qn);
+  for (const grant of granted) {
+    const parsed = parseGrant(grant);
+    if (!parsed) continue;
+    const def = config[parsed.domain];
+    if (!def) continue;
+    for (const q of def.read) out.add(q);
+    if (parsed.level === "write") for (const q of def.write ?? []) out.add(q);
   }
   return [...out];
 }

package/src/personal-access-tokens/web/i18n.ts

@@ -5,41 +5,65 @@ export const defaultTranslations: TranslationsByLocale = {
   de: {
     "pat.title": "Personal Access Tokens",
     "pat.create.title": "Neuen Token erstellen",
+    "pat.create.subtitle":
+      "Wähle Berechtigungen und eine Gültigkeit. Der Token wird nur einmal angezeigt.",
     "pat.create.name": "Name",
     "pat.create.namePlaceholder": "z. B. CLI-Automatisierung",
-    "pat.create.scopes": "Berechtigungen",
+    "pat.create.scopes": "Zugriff pro Bereich",
+    "pat.level.none": "Kein Zugriff",
+    "pat.level.read": "Lesen",
+    "pat.level.write": "Lesen & Schreiben",
+    "pat.create.expiry": "Gültig bis",
     "pat.create.submit": "Token erstellen",
     "pat.create.needName": "Bitte einen Namen vergeben.",
     "pat.create.needScope": "Bitte mindestens eine Berechtigung wählen.",
-    "pat.created.title": "Token erstellt — jetzt kopieren",
-    "pat.created.hint": "Dieser Token wird nur einmal angezeigt. Kopiere ihn jetzt.",
-    "pat.created.dismiss": "Verstanden",
+    "pat.expiry.30d": "30 Tage",
+    "pat.expiry.90d": "90 Tage",
+    "pat.expiry.1y": "1 Jahr",
+    "pat.expiry.never": "Unbegrenzt",
+    "pat.created.hint":
+      "Kopiere diesen Token jetzt — er wird aus Sicherheitsgründen nur dieses eine Mal angezeigt.",
+    "pat.created.copy": "Kopieren",
+    "pat.created.copied": "Kopiert ✓",
+    "pat.created.dismiss": "Fertig",
     "pat.list.title": "Deine Tokens",
     "pat.list.empty": "Noch keine Tokens.",
-    "pat.list.created": "Erstellt",
-    "pat.list.revoked": "Widerrufen",
-    "pat.list.expired": "Abgelaufen",
     "pat.list.revoke": "Widerrufen",
+    "pat.list.revoked": "Widerrufen",
+    "pat.list.validUntil": "Gültig bis {date}",
+    "pat.list.neverExpires": "Unbegrenzt gültig",
+    "pat.list.created": "Erstellt {date}",
     "pat.error.generic": "Aktion fehlgeschlagen.",
   },
   en: {
     "pat.title": "Personal Access Tokens",
     "pat.create.title": "Create a new token",
+    "pat.create.subtitle": "Pick permissions and an expiration. The token is shown only once.",
     "pat.create.name": "Name",
     "pat.create.namePlaceholder": "e.g. CLI automation",
-    "pat.create.scopes": "Permissions",
+    "pat.create.scopes": "Per-API access",
+    "pat.level.none": "No access",
+    "pat.level.read": "Read",
+    "pat.level.write": "Read & write",
+    "pat.create.expiry": "Expiration",
     "pat.create.submit": "Create token",
     "pat.create.needName": "Please enter a name.",
     "pat.create.needScope": "Please select at least one permission.",
-    "pat.created.title": "Token created — copy it now",
-    "pat.created.hint": "This token is shown only once. Copy it now.",
-    "pat.created.dismiss": "Got it",
+    "pat.expiry.30d": "30 days",
+    "pat.expiry.90d": "90 days",
+    "pat.expiry.1y": "1 year",
+    "pat.expiry.never": "No expiration",
+    "pat.created.hint": "Copy this token now — for security it is shown only this once.",
+    "pat.created.copy": "Copy",
+    "pat.created.copied": "Copied ✓",
+    "pat.created.dismiss": "Done",
     "pat.list.title": "Your tokens",
     "pat.list.empty": "No tokens yet.",
-    "pat.list.created": "Created",
-    "pat.list.revoked": "Revoked",
-    "pat.list.expired": "Expired",
     "pat.list.revoke": "Revoke",
+    "pat.list.revoked": "Revoked",
+    "pat.list.validUntil": "Valid until {date}",
+    "pat.list.neverExpires": "Never expires",
+    "pat.list.created": "Created {date}",
     "pat.error.generic": "Action failed.",
   },
 };

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -1,8 +1,10 @@
 // @runtime client
-// PatTokensScreen — logged-in self-service for Personal Access Tokens: mint a
-// token (name + scope toggles, plaintext shown once), list your tokens and
-// revoke them. The feature registers it dormant (r.screen); the app places it
-// via r.nav. Imports only from ../constants (pure) — no server pull-in.
+// PatTokensScreen — logged-in self-service for Personal Access Tokens. Two-axis
+// scopes (like GitHub fine-grained PATs): per API domain pick a permission LEVEL
+// (no access / read / read & write). Mint → copy the plaintext ONCE → it's never
+// re-displayed. Layout follows the framework's polished-screen convention (Form
+// primitive + Tailwind), cards match the mh style. The feature registers this
+// dormant (r.screen); the app places it via r.nav.
 
 import {
   useDispatcher,
@@ -12,95 +14,160 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { PatHandlers, PatQueries } from "../constants";
+import { parseGrant } from "../scopes";
 
-type ScopeOption = { readonly name: string; readonly label: string };
+type ScopeDomain = { readonly name: string; readonly label: string; readonly canWrite: boolean };
 type TokenRow = {
   readonly id: string;
   readonly name: string;
-  readonly prefix: string;
   readonly scopes: readonly string[];
   readonly createdAt: string | null;
   readonly expiresAt: string | null;
   readonly revokedAt: string | null;
 };
 
-function isExpired(expiresAt: string | null): boolean {
-  return expiresAt !== null && new Date(expiresAt).getTime() <= Date.now();
+type Level = "none" | "read" | "write";
+type ExpiryKey = "30d" | "90d" | "1y" | "never";
+const EXPIRY_DAYS: Record<ExpiryKey, number | undefined> = {
+  "30d": 30,
+  "90d": 90,
+  "1y": 365,
+  never: undefined,
+};
+
+// Timestamps arrive as ISO strings over the JSON API — slice the date part
+// without touching the banned Date API.
+function isoDate(value: string | null): string | null {
+  return typeof value === "string" && value.length >= 10 ? value.slice(0, 10) : null;
 }
 
 export function PatTokensScreen(): ReactNode {
   const t = useTranslation();
-  const { Section, Heading, Field, Input, Button, Banner, Card, Text } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Card, Heading } = usePrimitives();
   const dispatcher = useDispatcher();
 
-  const scopesQuery = useQuery<readonly ScopeOption[]>(PatQueries.availableScopes, {});
+  const scopesQuery = useQuery<readonly ScopeDomain[]>(PatQueries.availableScopes, {});
   const listQuery = useQuery<readonly TokenRow[]>(PatQueries.mine, {});
 
   const [name, setName] = useState("");
-  const [selected, setSelected] = useState<readonly string[]>([]);
-  const [minted, setMinted] = useState<{ token: string; prefix: string } | null>(null);
+  const [levels, setLevels] = useState<Readonly<Record<string, Level>>>({});
+  const [expiry, setExpiry] = useState<ExpiryKey>("90d");
+  const [minted, setMinted] = useState<{ token: string } | null>(null);
+  const [copied, setCopied] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
 
-  const scopes = scopesQuery.data ?? [];
+  const domains = scopesQuery.data ?? [];
   const tokens = listQuery.data ?? [];
+  const labelOf = (domain: string): string =>
+    domains.find((d) => d.name === domain)?.label ?? domain;
+
+  // Granted scopes = "<domain>:<level>" for every domain not set to "none".
+  const grants = (): string[] =>
+    Object.entries(levels)
+      .filter(([, l]) => l !== "none")
+      .map(([domain, l]) => `${domain}:${l}`);
 
-  const toggle = (scope: string): void =>
-    setSelected((cur) => (cur.includes(scope) ? cur.filter((s) => s !== scope) : [...cur, scope]));
+  const setLevel = (domain: string, level: Level): void =>
+    setLevels((cur) => ({ ...cur, [domain]: level }));
 
   const create = async (): Promise<void> => {
     if (name.trim() === "") return setError(t("pat.create.needName"));
-    if (selected.length === 0) return setError(t("pat.create.needScope"));
+    const scopes = grants();
+    if (scopes.length === 0) return setError(t("pat.create.needScope"));
     setBusy(true);
     setError(null);
+    const days = EXPIRY_DAYS[expiry];
     const res = await dispatcher.write(PatHandlers.create, {
       name: name.trim(),
-      scopes: selected,
+      scopes,
+      ...(days !== undefined ? { expiresInDays: days } : {}),
     });
     setBusy(false);
     if (!res.isSuccess) return setError(t("pat.error.generic"));
-    const data = res.data as { token: string; prefix: string };
-    setMinted({ token: data.token, prefix: data.prefix });
+    setMinted({ token: (res.data as { token: string }).token });
+    setCopied(false);
     setName("");
-    setSelected([]);
+    setLevels({});
+    setExpiry("90d");
     void listQuery.refetch?.();
   };
 
+  const copy = async (): Promise<void> => {
+    if (!minted) return;
+    try {
+      await navigator.clipboard.writeText(minted.token);
+      setCopied(true);
+    } catch {
+      // clipboard blocked (non-secure context) — the token stays selectable in place
+    }
+  };
+
   const revoke = async (id: string): Promise<void> => {
     const res = await dispatcher.write(PatHandlers.revoke, { id });
     if (!res.isSuccess) return setError(t("pat.error.generic"));
     void listQuery.refetch?.();
   };
 
-  const status = (row: TokenRow): string => {
-    if (row.revokedAt !== null) return t("pat.list.revoked");
-    if (isExpired(row.expiresAt)) return t("pat.list.expired");
-    return "";
+  // "Pages (read & write) · Tags (read) · Valid until … · Created …"
+  const meta = (row: TokenRow): string => {
+    const scopeText = row.scopes
+      .map((g) => {
+        const p = parseGrant(g);
+        if (!p) return g;
+        const lvl = p.level === "write" ? t("pat.level.write") : t("pat.level.read");
+        return `${labelOf(p.domain)} (${lvl})`;
+      })
+      .join(" · ");
+    const d = isoDate(row.expiresAt);
+    const parts = [
+      scopeText,
+      d ? t("pat.list.validUntil", { date: d }) : t("pat.list.neverExpires"),
+    ];
+    const created = isoDate(row.createdAt);
+    if (created) parts.push(t("pat.list.created", { date: created }));
+    return parts.join("  ·  ");
   };
 
   return (
-    <Section>
+    <div className="flex max-w-3xl flex-col gap-6 p-6">
       <Heading>{t("pat.title")}</Heading>
 
       {minted && (
         <Banner
           variant="info"
           actions={
-            <Button variant="secondary" onClick={() => setMinted(null)}>
-              {t("pat.created.dismiss")}
-            </Button>
+            <>
+              <Button variant="primary" onClick={copy}>
+                {copied ? t("pat.created.copied") : t("pat.created.copy")}
+              </Button>
+              <Button variant="secondary" onClick={() => setMinted(null)}>
+                {t("pat.created.dismiss")}
+              </Button>
+            </>
           }
         >
-          <Heading>{t("pat.created.title")}</Heading>
-          <Text>{minted.token}</Text>
-          <Text>{t("pat.created.hint")}</Text>
+          <div className="flex flex-col gap-2">
+            <span className="text-sm">{t("pat.created.hint")}</span>
+            <code className="block break-all rounded bg-muted px-3 py-2 font-mono text-sm">
+              {minted.token}
+            </code>
+          </div>
         </Banner>
       )}
 
       {error && <Banner variant="error">{error}</Banner>}
 
-      <Section>
-        <Heading>{t("pat.create.title")}</Heading>
+      <Form
+        title={t("pat.create.title")}
+        subtitle={t("pat.create.subtitle")}
+        onSubmit={create}
+        actions={
+          <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
+            {t("pat.create.submit")}
+          </Button>
+        }
+      >
         <Field id="pat-name" label={t("pat.create.name")} required>
           <Input
             kind="text"
@@ -112,39 +179,73 @@ export function PatTokensScreen(): ReactNode {
             disabled={busy}
           />
         </Field>
-        <Text>{t("pat.create.scopes")}</Text>
-        {scopes.map((s) => (
-          <Button
-            key={s.name}
-            variant={selected.includes(s.name) ? "primary" : "secondary"}
-            onClick={() => toggle(s.name)}
-            disabled={busy}
-          >
-            {s.label}
-          </Button>
+
+        {domains.map((d) => (
+          <Field key={d.name} id={`pat-scope-${d.name}`} label={d.label}>
+            <Input
+              kind="select"
+              id={`pat-scope-${d.name}`}
+              name={d.name}
+              value={levels[d.name] ?? "none"}
+              onChange={(v) => setLevel(d.name, v as Level)}
+              options={[
+                { value: "none", label: t("pat.level.none") },
+                { value: "read", label: t("pat.level.read") },
+                ...(d.canWrite ? [{ value: "write", label: t("pat.level.write") }] : []),
+              ]}
+              disabled={busy}
+            />
+          </Field>
         ))}
-        <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
-          {t("pat.create.submit")}
-        </Button>
-      </Section>
 
-      <Section>
+        <Field id="pat-expiry" label={t("pat.create.expiry")}>
+          <Input
+            kind="select"
+            id="pat-expiry"
+            name="expiry"
+            value={expiry}
+            onChange={(v) => setExpiry(v as ExpiryKey)}
+            options={[
+              { value: "30d", label: t("pat.expiry.30d") },
+              { value: "90d", label: t("pat.expiry.90d") },
+              { value: "1y", label: t("pat.expiry.1y") },
+              { value: "never", label: t("pat.expiry.never") },
+            ]}
+            disabled={busy}
+          />
+        </Field>
+      </Form>
+
+      <div className="flex flex-col gap-3">
         <Heading>{t("pat.list.title")}</Heading>
-        {tokens.length === 0 && <Text>{t("pat.list.empty")}</Text>}
-        {tokens.map((row) => (
-          <Card key={row.id}>
-            <Text>
-              {row.name} — {row.prefix}… {status(row)}
-            </Text>
-            <Text>{row.scopes.join(", ")}</Text>
-            {row.revokedAt === null && (
-              <Button variant="danger" onClick={() => revoke(row.id)}>
-                {t("pat.list.revoke")}
-              </Button>
-            )}
-          </Card>
-        ))}
-      </Section>
-    </Section>
+        {tokens.length === 0 && (
+          <span className="text-sm text-muted-foreground">{t("pat.list.empty")}</span>
+        )}
+        {tokens.map((row) => {
+          const revoked = row.revokedAt !== null;
+          return (
+            <Card
+              key={row.id}
+              options={{ padded: false }}
+              className={`p-4 ${revoked ? "opacity-60" : ""}`}
+            >
+              <div className="flex items-center justify-between gap-3">
+                <div className="flex min-w-0 flex-col gap-0.5">
+                  <span className="truncate text-sm font-semibold">{row.name}</span>
+                  <span className="truncate text-xs text-muted-foreground">
+                    {revoked ? t("pat.list.revoked") : meta(row)}
+                  </span>
+                </div>
+                {!revoked && (
+                  <Button variant="danger" onClick={() => revoke(row.id)}>
+                    {t("pat.list.revoke")}
+                  </Button>
+                )}
+              </div>
+            </Card>
+          );
+        })}
+      </div>
+    </div>
   );
 }