@cosmicdrift/kumiko-bundled-features 0.126.0 → 0.128.0

package/src/tier-engine/web/tier-admin-screen.tsx

@@ -37,7 +37,7 @@ type Status =
 
 export function TierAdminScreen(): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button, Banner, Heading, Text } = usePrimitives();
+  const { Field, Input, Button, Banner, Form, Text } = usePrimitives();
   const dispatcher = useDispatcher();
 
   // ponytail: nur die erste Seite (default-limit, nextCursor ignoriert) —
@@ -92,8 +92,7 @@ export function TierAdminScreen(): ReactNode {
   const canSubmit = tenantId !== "" && tier !== "" && !submitting;
 
   return (
-    <FormScreenShell testId="tier-admin-screen" className="flex max-w-xl flex-col gap-6">
-      <Heading variant="page">{t("tier-admin.title")}</Heading>
+    <FormScreenShell testId="tier-admin-screen" className="flex flex-col gap-6">
       <Text variant="small">{t("tier-admin.explainer")}</Text>
 
       {tenantsQuery.error !== null && (
@@ -107,7 +106,23 @@ export function TierAdminScreen(): ReactNode {
         </Banner>
       )}
 
-      <Section>
+      <Form
+        testId="tier-admin-form"
+        onSubmit={(e) => {
+          e?.preventDefault();
+          void onSave();
+        }}
+        actions={
+          <Button
+            type="submit"
+            disabled={!canSubmit}
+            loading={submitting}
+            testId="tier-admin-submit"
+          >
+            {t("tier-admin.submit")}
+          </Button>
+        }
+      >
         <Field id="tier-admin-tenant" label={t("tier-admin.tenant.label")} required>
           <Input
             kind="select"
@@ -147,16 +162,7 @@ export function TierAdminScreen(): ReactNode {
             {t(status.messageKey)}
           </Banner>
         )}
-
-        <Button
-          onClick={() => void onSave()}
-          disabled={!canSubmit}
-          loading={submitting}
-          testId="tier-admin-submit"
-        >
-          {t("tier-admin.submit")}
-        </Button>
-      </Section>
+      </Form>
     </FormScreenShell>
   );
 }

package/src/user/feature.ts

@@ -5,6 +5,7 @@ import { findForAuthQuery } from "./handlers/find-for-auth.query";
 import { listQuery } from "./handlers/list.query";
 import { meQuery } from "./handlers/me.query";
 import { updateWrite } from "./handlers/update.write";
+import { USER_I18N } from "./i18n";
 import { userEntity } from "./schema/user";
 import { userEditScreen, userListScreen } from "./screens";
 
@@ -43,6 +44,8 @@ export function createUserFeature(): FeatureDefinition {
     r.screen(userListScreen);
     r.screen(userEditScreen);
 
+    r.translations({ keys: USER_I18N });
+
     return { handlers, queries };
   });
 }

package/src/user/i18n.ts

@@ -0,0 +1,20 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:user-list.title": { de: "Benutzer", en: "Users" },
+  "screen:user-edit.title": { de: "Benutzer bearbeiten", en: "Edit user" },
+  "user:entity:user:field:email": { de: "E-Mail", en: "Email" },
+  "user:entity:user:field:displayName": { de: "Anzeigename", en: "Display name" },
+  "user:entity:user:field:status": { de: "Status", en: "Status" },
+  "user:entity:user:field:emailVerified": { de: "E-Mail bestätigt", en: "Email verified" },
+  "user:entity:user:field:locale": { de: "Sprache", en: "Locale" },
+  "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "user:entity:user:field:status:option:restricted": { de: "Eingeschränkt", en: "Restricted" },
+  "user:entity:user:field:status:option:deletionRequested": {
+    de: "Löschung angefordert",
+    en: "Deletion requested",
+  },
+  "user:entity:user:field:status:option:deleted": { de: "Gelöscht", en: "Deleted" },
+  "user:entity:user:field:emailVerified:option:true": { de: "Ja", en: "Yes" },
+  "user:entity:user:field:emailVerified:option:false": { de: "Nein", en: "No" },
+};

package/src/user/schema/user.ts

@@ -136,6 +136,7 @@ export const userEntity = createEntity({
       required: true,
       default: USER_STATUS.Active,
       options: USER_STATUS_OPTIONS,
+      sortable: true,
       access: { write: access.privileged },
     }),
 

package/src/user/screens.ts

@@ -7,10 +7,6 @@ import type {
 // feature runs with `r.systemScope()`, the entityList query returns every
 // user across all tenants — the SystemAdmin platform roster. Both screens are
 // SystemAdmin-gated and stay inert until an app navs them (no auto-nav).
-//
-// Field labels come from the renderer's humanizeSlug fallback (no i18n keys
-// registered) — "Display Name", "Email Verified" etc. Apps can override via
-// their own translations under the `user:entity:user:field:*` convention.
 
 export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
@@ -26,9 +22,9 @@ export const userListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  // No SearchAdapter assumption: search is opt-in per app infra, not a
-  // universal default for a bundled screen.
-  searchable: false,
+  defaultSort: { field: "status", dir: "asc" },
+  // ponytail: screen searchable but email is encrypted PII — list search uses non-encrypted columns only.
+  searchable: true,
   access: { roles: ["SystemAdmin"] },
 };
 
@@ -44,14 +40,6 @@ export const userEditScreen: EntityEditScreenDefinition = {
       },
     ],
   },
-  // `roles` is deliberately NOT editable here: it is a raw JSON text column
-  // (`["SystemAdmin"]`) — a free-text input would let a typo corrupt the
-  // privilege column on a live platform. Role management needs a dedicated
-  // surface; the list still shows status for triage.
-  //
-  // Create dispatches user:write:user:create (email + displayName required —
-  // both in the form). Delete is suppressed: there is no user:write:user:delete
-  // — user removal is the GDPR status/forget flow, not a hard delete.
   allowDelete: false,
   access: { roles: ["SystemAdmin"] },
 };

package/src/user-data-rights/feature.ts

@@ -28,6 +28,7 @@ import {
 import { requestExportWrite } from "./handlers/request-export.write";
 import { restrictAccountWrite } from "./handlers/restrict-account.write";
 import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write";
+import { USER_DATA_RIGHTS_I18N } from "./i18n";
 import {
   type GdprMailDefaults,
   isMailTransportAvailable,
@@ -257,6 +258,22 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     r.screen(exportJobDetailScreen);
     r.screen(downloadAttemptListScreen);
 
+    r.nav({
+      id: "export-job-list",
+      label: "user-data-rights:nav.exportJobs",
+      icon: "download",
+      screen: "user-data-rights:screen:export-job-list",
+      order: 25,
+      access: { roles: ["SystemAdmin"] },
+    });
+
+    r.translations({
+      keys: {
+        ...USER_DATA_RIGHTS_I18N,
+        "user-data-rights:nav.exportJobs": { de: "DSGVO-Exporte", en: "GDPR exports" },
+      },
+    });
+
     // Dormant Self-Service-Screen (Art. 15/17/18/20): Export, Aktivitäts-
     // protokoll, Einschränkung, Löschung in einem Screen. Kein r.nav — die
     // App platziert ihn im eingeloggten Bereich. Die React-Component kommt

package/src/user-data-rights/i18n.ts

@@ -1,37 +1,36 @@
-// @runtime client
-//
-// Default-Translations fuer user-data-rights Error-Wire-Keys (S2.U3 Atom 4b.fix3).
-//
-// Wire-Errors aus den download-handlers tragen i18nKeys statt fixe
-// Strings — UI rendert die Keys ueber den Renderer-LocaleProvider. Apps
-// koennen einzelne Keys via `userDataRightsClient({ translations: { de:
-// {...} } })` ueberschreiben (Pattern matched auth-email-password).
-//
-// **Scope 4b.fix3:** nur die download-error-keys. Andere Keys (UI-
-// Texte fuer Forget-Pfad, Status-Labels, Banner) kommen mit Atom 6+
-// (UI-Integration).
+type LocalizedString = { readonly de: string; readonly en: string };
 
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-
-export const defaultTranslations: TranslationsByLocale = {
-  de: {
-    "userDataRights.errors.download.notFound":
-      "Der Download-Link ist ungültig oder gehört zu einem anderen Konto.",
-    "userDataRights.errors.download.expired":
-      "Dein Download ist abgelaufen. Bitte fordere einen neuen Export an.",
-    "userDataRights.errors.download.unavailable":
-      "Der Export ist noch nicht fertig oder fehlgeschlagen. Bitte schau im Status-Polling nach.",
-    "userDataRights.errors.download.signedUrlNotSupported":
-      "Der Download steht aufgrund einer Server-Konfiguration aktuell nicht zur Verfügung. Der Operator wurde benachrichtigt.",
+export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:export-job-list.title": { de: "DSGVO-Exporte", en: "GDPR exports" },
+  "screen:export-job-detail.title": { de: "Export-Job", en: "Export job" },
+  "screen:download-attempt-list.title": { de: "Download-Versuche", en: "Download attempts" },
+  "screen:privacy-center.title": { de: "Datenschutz", en: "Privacy" },
+  "user-data-rights:entity:export-job:field:userId": { de: "Benutzer", en: "User" },
+  "user-data-rights:entity:export-job:field:status": { de: "Status", en: "Status" },
+  "user-data-rights:entity:export-job:field:requestedAt": { de: "Angefordert", en: "Requested" },
+  "user-data-rights:entity:export-job:field:completedAt": { de: "Abgeschlossen", en: "Completed" },
+  "user-data-rights:entity:export-job:field:expiresAt": { de: "Läuft ab", en: "Expires" },
+  "user-data-rights:entity:export-job:field:requestedFromTenantId": {
+    de: "Mandant",
+    en: "Tenant",
+  },
+  "user-data-rights:entity:export-job:field:startedAt": { de: "Gestartet", en: "Started" },
+  "user-data-rights:entity:export-job:field:downloadStorageKey": {
+    de: "Speicher-Schlüssel",
+    en: "Storage key",
+  },
+  "user-data-rights:entity:export-job:field:bytesWritten": { de: "Bytes", en: "Bytes" },
+  "user-data-rights:entity:export-job:field:errorMessage": { de: "Fehler", en: "Error" },
+  "user-data-rights:entity:download-attempt:field:attemptedAt": {
+    de: "Zeitpunkt",
+    en: "Attempted at",
   },
-  en: {
-    "userDataRights.errors.download.notFound":
-      "The download link is invalid or belongs to a different account.",
-    "userDataRights.errors.download.expired":
-      "Your download has expired. Please request a new export.",
-    "userDataRights.errors.download.unavailable":
-      "The export is not yet ready or has failed. Please check the status endpoint.",
-    "userDataRights.errors.download.signedUrlNotSupported":
-      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
+  "user-data-rights:entity:download-attempt:field:result": { de: "Ergebnis", en: "Result" },
+  "user-data-rights:entity:download-attempt:field:via": { de: "Via", en: "Via" },
+  "user-data-rights:entity:download-attempt:field:ip": { de: "IP", en: "IP" },
+  "user-data-rights:entity:download-attempt:field:attemptedByUserId": {
+    de: "Benutzer",
+    en: "User",
   },
+  "user-data-rights:entity:download-attempt:field:jobId": { de: "Job", en: "Job" },
 };

package/src/user-data-rights/schema/export-job.ts

@@ -73,6 +73,7 @@ export const exportJobEntity = createEntity({
     // nur Storage.
     userId: createTextField({
       required: true,
+      searchable: true,
     }),
 
     // **requestedFromTenantId** — der Tenant aus dem der User den Antrag
@@ -102,6 +103,7 @@ export const exportJobEntity = createEntity({
     // entsteht ohne Klick.
     requestedAt: createTimestampField({
       required: true,
+      sortable: true,
     }),
 
     // Wann hat der Worker mit dem Pickup angefangen. NULL solange

package/src/user-data-rights/screens.ts

@@ -28,7 +28,8 @@ export const exportJobListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  searchable: false,
+  defaultSort: { field: "requestedAt", dir: "desc" },
+  searchable: true,
   access: { roles: access.systemAdmin },
 };
 

package/src/user-data-rights/web/i18n.ts

@@ -141,5 +141,14 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Delete your account?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
+
+    "userDataRights.errors.download.notFound":
+      "The download link is invalid or belongs to a different account.",
+    "userDataRights.errors.download.expired":
+      "Your download has expired. Please request a new export.",
+    "userDataRights.errors.download.unavailable":
+      "The export is not yet ready or has failed. Please check the status endpoint.",
+    "userDataRights.errors.download.signedUrlNotSupported":
+      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
   },
 };