@cosmicdrift/kumiko-bundled-features 0.124.0 → 0.125.0

package/src/admin-shell/overview-allowlist.ts

@@ -0,0 +1,32 @@
+// @runtime client
+// Hard-coded query allowlists for overview-home screens — security boundary
+// against privilege escalation via accidental cross-workspace fetches.
+
+export type OverviewWorkspaceKind = "tenant" | "platform";
+
+/** Tenant workspace overview may only call these queries. */
+export const TENANT_OVERVIEW_ALLOWED_QUERIES = [
+  "tenant:query:invitations",
+  "tenant:query:members",
+  "config:query:readiness",
+  "cap-counter:query:get-counter",
+] as const;
+
+/** Platform workspace overview may only call these queries. */
+export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = ["tenant:query:list", "jobs:query:list"] as const;
+
+/** Regression guard — TenantAdmin overview must never touch these (HTTP 403). */
+export const TENANT_OVERVIEW_FORBIDDEN_QUERIES = [
+  "tenant:query:list",
+  "jobs:query:list",
+  "feature-toggles:query:list",
+  "feature-toggles:query:registered",
+] as const;
+
+export function overviewAllowedQueries(kind: OverviewWorkspaceKind): readonly string[] {
+  return kind === "tenant" ? TENANT_OVERVIEW_ALLOWED_QUERIES : PLATFORM_OVERVIEW_ALLOWED_QUERIES;
+}
+
+export function isOverviewQueryAllowed(kind: OverviewWorkspaceKind, queryName: string): boolean {
+  return overviewAllowedQueries(kind).includes(queryName);
+}

package/src/admin-shell/web/client-plugin.tsx

@@ -0,0 +1,26 @@
+// @runtime client
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import {
+  ADMIN_SHELL_FEATURE,
+  PLATFORM_OVERVIEW_SCREEN_ID,
+  TENANT_OVERVIEW_SCREEN_ID,
+} from "../constants";
+import { defaultTranslations } from "./i18n";
+import { PlatformOverviewScreen } from "./platform-overview-screen";
+import { TenantOverviewScreen } from "./tenant-overview-screen";
+
+export type AdminShellClientOptions = {
+  readonly translations?: TranslationsByLocale;
+};
+
+export function adminShellClient(options?: AdminShellClientOptions): ClientFeatureDefinition {
+  return {
+    name: ADMIN_SHELL_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [TENANT_OVERVIEW_SCREEN_ID]: TenantOverviewScreen,
+      [PLATFORM_OVERVIEW_SCREEN_ID]: PlatformOverviewScreen,
+    },
+  };
+}

package/src/admin-shell/web/i18n.ts

@@ -0,0 +1,16 @@
+// @runtime client
+// Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import { ADMIN_SHELL_I18N } from "../i18n";
+
+const LOCALES = ["de", "en"] as const;
+
+export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
+  LOCALES.map((locale) => [
+    locale,
+    Object.fromEntries(
+      Object.entries(ADMIN_SHELL_I18N).map(([key, value]) => [key, value[locale]]),
+    ),
+  ]),
+);

package/src/admin-shell/web/index.ts

@@ -0,0 +1,2 @@
+// @runtime client
+export { type AdminShellClientOptions, adminShellClient } from "./client-plugin";

package/src/admin-shell/web/overview-layout.tsx

@@ -0,0 +1,68 @@
+// @runtime client
+import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+
+export type OverviewCard = {
+  readonly label: string;
+  readonly value: string;
+  readonly hint?: string;
+  /** When true and hint is set, render an attention Banner inside the card. */
+  readonly attention?: boolean;
+};
+
+export type OverviewState =
+  | { readonly kind: "loading" }
+  | { readonly kind: "error"; readonly message: string }
+  | { readonly kind: "ready"; readonly cards: readonly OverviewCard[] };
+
+export function OverviewLayout({
+  testId,
+  title,
+  state,
+  loadingLabel,
+  columns = 3,
+}: {
+  readonly testId: string;
+  readonly title: string;
+  readonly state: OverviewState;
+  readonly loadingLabel: string;
+  readonly columns?: 2 | 3;
+}): ReactNode {
+  const { Banner, Card, Heading, Text } = usePrimitives();
+  const gridClass = columns === 2 ? "sm:grid-cols-2" : "sm:grid-cols-3";
+
+  return (
+    <div data-testid={testId} className="flex max-w-4xl flex-col gap-6 p-6">
+      <Heading variant="page">{title}</Heading>
+
+      {state.kind === "loading" && (
+        <Text variant="small" testId={`${testId}-loading`}>
+          {loadingLabel}
+        </Text>
+      )}
+
+      {state.kind === "error" && (
+        <Banner variant="error" testId={`${testId}-error`}>
+          {state.message}
+        </Banner>
+      )}
+
+      {state.kind === "ready" && (
+        <div className={`grid grid-cols-1 gap-4 ${gridClass}`}>
+          {state.cards.map((card) => (
+            <Card key={card.label} testId={`${testId}-card`} slots={{ title: card.label }}>
+              <div className="flex flex-col gap-2" data-overview-card={card.label}>
+                <span className="text-3xl font-semibold tabular-nums">{card.value}</span>
+                {card.attention === true && card.hint !== undefined ? (
+                  <Banner variant="error">{card.hint}</Banner>
+                ) : (
+                  card.hint !== undefined && <Text variant="small">{card.hint}</Text>
+                )}
+              </div>
+            </Card>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}

package/src/admin-shell/web/overview-query.ts

@@ -0,0 +1,15 @@
+// @runtime client
+import type { Dispatcher, QueryResult } from "@cosmicdrift/kumiko-headless";
+import { isOverviewQueryAllowed, type OverviewWorkspaceKind } from "../overview-allowlist";
+
+export async function overviewQuery<T>(
+  kind: OverviewWorkspaceKind,
+  dispatcher: Dispatcher,
+  queryName: string,
+  payload: Record<string, unknown>,
+): Promise<QueryResult<T>> {
+  if (!isOverviewQueryAllowed(kind, queryName)) {
+    throw new Error(`admin-shell:overview query not allowlisted: ${queryName}`);
+  }
+  return dispatcher.query<T>(queryName, payload);
+}

package/src/admin-shell/web/platform-overview-screen.tsx

@@ -0,0 +1,75 @@
+// @runtime client
+
+import { useDispatcher, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useEffect, useState } from "react";
+import { JobQueries } from "../../jobs/constants";
+import { TenantQueries } from "../../tenant/constants";
+import { OverviewLayout, type OverviewState } from "./overview-layout";
+import { overviewQuery } from "./overview-query";
+
+export function PlatformOverviewScreen(): ReactNode {
+  const t = useTranslation();
+  const dispatcher = useDispatcher();
+  const [state, setState] = useState<OverviewState>({ kind: "loading" });
+
+  useEffect(() => {
+    let cancelled = false;
+    void (async (): Promise<void> => {
+      const tenantsRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
+        "platform",
+        dispatcher,
+        TenantQueries.list,
+        {},
+      );
+      if (cancelled) return;
+      if (!tenantsRes.isSuccess) {
+        setState({ kind: "error", message: tenantsRes.error.message });
+        return;
+      }
+
+      const failedJobsRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
+        "platform",
+        dispatcher,
+        JobQueries.list,
+        { status: "failed", limit: 50 },
+      );
+      if (cancelled) return;
+      if (!failedJobsRes.isSuccess) {
+        setState({ kind: "error", message: failedJobsRes.error.message });
+        return;
+      }
+
+      setState({
+        kind: "ready",
+        cards: [
+          {
+            label: t("admin-shell:overview.tenants"),
+            value: String(tenantsRes.data.rows.length),
+          },
+          {
+            label: t("admin-shell:overview.failedJobs"),
+            value: String(failedJobsRes.data.rows.length),
+            hint:
+              failedJobsRes.data.rows.length > 0
+                ? t("admin-shell:overview.failedJobsHint")
+                : undefined,
+            attention: failedJobsRes.data.rows.length > 0,
+          },
+        ],
+      });
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [dispatcher, t]);
+
+  return (
+    <OverviewLayout
+      testId="platform-overview-screen"
+      title={t("admin-shell:overview.platformTitle")}
+      state={state}
+      loadingLabel={t("admin-shell:overview.loading")}
+      columns={2}
+    />
+  );
+}

package/src/admin-shell/web/tenant-overview-screen.tsx

@@ -0,0 +1,90 @@
+// @runtime client
+
+import { useDispatcher, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useEffect, useState } from "react";
+import { ConfigQueries } from "../../config/constants";
+import { TenantQueries } from "../../tenant/constants";
+import { OverviewLayout, type OverviewState } from "./overview-layout";
+import { overviewQuery } from "./overview-query";
+
+export function TenantOverviewScreen(): ReactNode {
+  const t = useTranslation();
+  const dispatcher = useDispatcher();
+  const [state, setState] = useState<OverviewState>({ kind: "loading" });
+
+  useEffect(() => {
+    let cancelled = false;
+    void (async (): Promise<void> => {
+      const invitationsRes = await overviewQuery<readonly unknown[]>(
+        "tenant",
+        dispatcher,
+        TenantQueries.invitations,
+        {},
+      );
+      if (cancelled) return;
+      if (!invitationsRes.isSuccess) {
+        setState({ kind: "error", message: invitationsRes.error.message });
+        return;
+      }
+
+      const membersRes = await overviewQuery<readonly unknown[]>(
+        "tenant",
+        dispatcher,
+        TenantQueries.members,
+        {},
+      );
+      if (cancelled) return;
+      if (!membersRes.isSuccess) {
+        setState({ kind: "error", message: membersRes.error.message });
+        return;
+      }
+
+      const readinessRes = await overviewQuery<{ readonly missing: readonly unknown[] }>(
+        "tenant",
+        dispatcher,
+        ConfigQueries.readiness,
+        {},
+      );
+      if (cancelled) return;
+      if (!readinessRes.isSuccess) {
+        setState({ kind: "error", message: readinessRes.error.message });
+        return;
+      }
+
+      setState({
+        kind: "ready",
+        cards: [
+          {
+            label: t("admin-shell:overview.pendingInvitations"),
+            value: String(invitationsRes.data.length),
+          },
+          {
+            label: t("admin-shell:overview.members"),
+            value: String(membersRes.data.length),
+          },
+          {
+            label: t("admin-shell:overview.missingConfig"),
+            value: String(readinessRes.data.missing.length),
+            hint:
+              readinessRes.data.missing.length > 0
+                ? t("admin-shell:overview.missingConfigHint")
+                : undefined,
+            attention: readinessRes.data.missing.length > 0,
+          },
+        ],
+      });
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [dispatcher, t]);
+
+  return (
+    <OverviewLayout
+      testId="tenant-overview-screen"
+      title={t("admin-shell:overview.tenantTitle")}
+      state={state}
+      loadingLabel={t("admin-shell:overview.loading")}
+    />
+  );
+}

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config/feature";
+import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
+import { createAuditFeature } from "../feature";
+
+describe("audit log screen + handler access alignment", () => {
+  const features = [createConfigFeature(), createAuditFeature()];
+
+  test("boot-validates with audit-log screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("audit-log screen is custom, access.admin-gated", () => {
+    const audit = createAuditFeature();
+    const screen = audit.screens[AUDIT_LOG_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+
+  test("audit:query:list uses access.admin (screen ⊆ handler)", () => {
+    const audit = createAuditFeature();
+    expect(rolesOf(audit.queryHandlers["list"]?.access)).toEqual([...access.admin]);
+    void AuditQueries;
+  });
+});

package/src/audit/__tests__/audit-security.integration.test.ts

@@ -0,0 +1,151 @@
+// Security integration tests for audit-log HTTP surface.
+// Real HTTP via setupTestStack — no mocks.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  access,
+  createEntity,
+  createTextField,
+  defineEntityWriteHandler,
+  defineFeature,
+  type SessionUser,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  resetEventStore,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { hashPassword } from "../../auth-email-password/password-hashing";
+import { createConfigFeature } from "../../config/feature";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { seedUser } from "../../user/seeding";
+import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
+import { createAuditFeature } from "../feature";
+
+const widgetEntity = createEntity({
+  table: "audit_sec_widgets",
+  fields: {
+    name: createTextField({ required: true }),
+  },
+});
+
+const widgetFeature = defineFeature("audit-sec-widgets", (r) => {
+  r.entity("widget", widgetEntity);
+  r.writeHandler(
+    defineEntityWriteHandler("widget:create", widgetEntity, {
+      access: { roles: ["Admin", "User", "SystemAdmin", "TenantAdmin"] },
+    }),
+  );
+});
+
+let stack: TestStack;
+let TENANT_ID: TenantId;
+let tenantAdminId: string;
+
+const systemAdmin = TestUsers.systemAdmin;
+
+function tenantAdmin(): SessionUser {
+  return { id: tenantAdminId, tenantId: TENANT_ID, roles: ["TenantAdmin"] };
+}
+
+function regularUser(): SessionUser {
+  return createTestUser({ id: 42, tenantId: TENANT_ID, roles: ["User"] });
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      widgetFeature,
+      createAuditFeature(),
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, widgetEntity);
+  await unsafePushTables(stack.db, { tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetEventStore(stack);
+  await asRawClient(stack.db).unsafe(`TRUNCATE audit_sec_widgets`);
+  TENANT_ID = testTenantId(1);
+  await seedTenant(stack.db, { id: TENANT_ID, key: "audit-sec", name: "Audit Sec" });
+  ({ id: tenantAdminId } = await seedUser(stack.db, {
+    email: "taudit@example.com",
+    displayName: "TAudit",
+    passwordHash: await hashPassword("pw-audit-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: tenantAdminId,
+    tenantId: TENANT_ID,
+    roles: ["TenantAdmin"],
+  });
+});
+
+describe("access matrix: audit list uses access.admin", () => {
+  test("handler and screen share access.admin", () => {
+    const adminRoles = [...access.admin];
+    expect(rolesOf(stack.registry.getQueryHandler(AuditQueries.list)?.access)).toEqual(adminRoles);
+    const audit = createAuditFeature();
+    const screen = audit.screens[AUDIT_LOG_SCREEN_ID];
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(adminRoles);
+    }
+  });
+});
+
+describe("TenantAdmin can query audit log for own tenant", () => {
+  test("TenantAdmin lists events after write in tenant", async () => {
+    await stack.http.writeOk(
+      "audit-sec-widgets:write:widget:create",
+      { name: "audited" },
+      tenantAdmin(),
+    );
+    const res = await stack.http.queryOk<{ rows: readonly { type: string }[] }>(
+      AuditQueries.list,
+      {},
+      tenantAdmin(),
+    );
+    expect(res.rows.some((r) => r.type === "widget.created")).toBe(true);
+  });
+});
+
+describe("regular User denied audit log", () => {
+  test("403 on audit:query:list", async () => {
+    const res = await stack.http.query(AuditQueries.list, {}, regularUser());
+    expect(res.status).toBe(403);
+  });
+});
+
+describe("systemAdmin retains audit access", () => {
+  test("SystemAdmin can list", async () => {
+    await stack.http.writeOk("audit-sec-widgets:write:widget:create", { name: "sys" }, systemAdmin);
+    const res = await stack.http.queryOk<{ rows: readonly unknown[] }>(
+      AuditQueries.list,
+      {},
+      systemAdmin,
+    );
+    expect(res.rows.length).toBeGreaterThanOrEqual(1);
+  });
+});

package/src/audit/__tests__/audit.integration.test.ts

@@ -314,15 +314,11 @@ describe("audit: list query", () => {
 
   test("access denied for non-admin roles", async () => {
     await createWidget(admin, "A");
-    // regularUser has role "User" — the handler requires Admin/SystemAdmin.
     const res = await stack.http.query(AuditQueries.list, {}, regularUser);
     expect(res.status).toBe(403);
     const body = (await res.json()) as {
       error?: { code?: string; details?: { reason?: string } };
     };
-    // Pin the specific failure class. The framework raises AccessDeniedError
-    // with code=access_denied; asserting on `code` beats a status-only check
-    // (a 403 could also come from ownership-denied, for example).
     expect(body.error?.code).toBe("access_denied");
   });
 });

package/src/audit/constants.ts

@@ -1,7 +1,10 @@
-// Qualified handler names — kept in one place so tests/clients can reference
-// the audit query without hard-coding the full string.
+// @runtime client
+// Qualified handler names + screen ids — shared by server feature and web client.
 export const AUDIT_FEATURE = "audit" as const;
 
 export const AuditQueries = {
   list: "audit:query:list",
 } as const;
+
+/** Tenant-admin audit log screen. Nav: `audit:screen:audit-log`. */
+export const AUDIT_LOG_SCREEN_ID = "audit-log" as const;

package/src/audit/feature.ts

@@ -1,5 +1,11 @@
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  defineFeature,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { AUDIT_LOG_SCREEN_ID } from "./constants";
 import { listQuery } from "./handlers/list.query";
+import { AUDIT_I18N } from "./i18n";
 
 // Audit feature — exposes a filtered read over the framework's event log.
 //
@@ -23,9 +29,26 @@ export function createAuditFeature(): FeatureDefinition {
       category: "compliance",
       recommended: false,
     });
+    r.translations({ keys: AUDIT_I18N });
+
     const queries = {
       list: r.queryHandler(listQuery),
     };
+
+    r.screen({
+      id: AUDIT_LOG_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "AuditLogScreen" } },
+      access: { roles: access.admin },
+    });
+    r.nav({
+      id: "audit-log",
+      label: "audit:nav.auditLog",
+      icon: "file",
+      screen: "audit:screen:audit-log",
+      order: 30,
+    });
+
     return { queries };
   });
 }

package/src/audit/handlers/list.query.ts

@@ -12,7 +12,7 @@
 // can't surface PII that the entity definition marked as sensitive.
 
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { z } from "zod";
 
@@ -35,7 +35,7 @@ export const listQuery = defineQueryHandler({
       message: "`from` must be less than or equal to `to`",
       path: ["from"],
     }),
-  access: { roles: ["Admin", "SystemAdmin"] },
+  access: { roles: access.admin },
   handler: async (query, ctx) => {
     const p = query.payload;
     const where: WhereObject = { tenantId: query.user.tenantId };

package/src/audit/i18n.ts

@@ -0,0 +1,18 @@
+// @runtime client
+// Server + client i18n for audit (nav labels + AuditLogScreen).
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:audit-log.title": { de: "Audit-Log", en: "Audit log" },
+  "audit:nav.auditLog": { de: "Audit", en: "Audit" },
+  "audit.log.title": { de: "Audit-Log", en: "Audit log" },
+  "audit.log.loading": { de: "Lade Ereignisse…", en: "Loading events…" },
+  "audit.log.empty": { de: "Keine Ereignisse.", en: "No events." },
+  "audit.log.newest": { de: "Neueste", en: "Newest" },
+  "audit.log.older": { de: "Ältere laden", en: "Load older" },
+  "audit.log.col.when": { de: "Zeit", en: "When" },
+  "audit.log.col.type": { de: "Ereignis", en: "Event" },
+  "audit.log.col.aggregate": { de: "Aggregate", en: "Aggregate" },
+  "audit.log.col.actor": { de: "Akteur", en: "Actor" },
+};