@cosmicdrift/kumiko-bundled-features 0.130.0 → 0.130.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.130.0",
+  "version": "0.130.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -107,11 +107,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.130.0",
-    "@cosmicdrift/kumiko-framework": "0.130.0",
-    "@cosmicdrift/kumiko-headless": "0.130.0",
-    "@cosmicdrift/kumiko-renderer": "0.130.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.130.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.130.2",
+    "@cosmicdrift/kumiko-framework": "0.130.2",
+    "@cosmicdrift/kumiko-headless": "0.130.2",
+    "@cosmicdrift/kumiko-renderer": "0.130.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.130.2",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/admin-shell/__tests__/admin-shell.boot.test.ts

@@ -5,6 +5,7 @@ import { createConfigFeature } from "../../config/feature";
 import { createJobsFeature } from "../../jobs/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { tierEngineFeature } from "../../tier-engine/feature";
+import { createUserFeature } from "../../user/feature";
 import {
   ADMIN_SHELL_FEATURE,
   DEFAULT_PLATFORM_WORKSPACE_ID,
@@ -14,6 +15,7 @@ import { createAdminShellFeature } from "../feature";
 
 const features = [
   createConfigFeature(),
+  createUserFeature(),
   createTenantFeature(),
   createAuditFeature(),
   createJobsFeature(),
@@ -22,10 +24,22 @@ const features = [
 ];
 
 describe("admin-shell boot + workspace composition", () => {
-  test("validateBoot with tenant, audit, jobs, tier-engine", () => {
+  test("validateBoot with user, tenant, audit, jobs, tier-engine", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("validateBoot fails without user (platform-overview user-count requires it)", () => {
+    const withoutUser = [
+      createConfigFeature(),
+      createTenantFeature(),
+      createAuditFeature(),
+      createJobsFeature(),
+      tierEngineFeature,
+      createAdminShellFeature(),
+    ];
+    expect(() => validateBoot(withoutUser)).toThrow();
+  });
+
   test("registers tenant + platform workspaces with qualified ids", () => {
     const registry = createRegistry(features);
     expect(
@@ -82,6 +96,7 @@ describe("admin-shell boot + workspace composition", () => {
     });
     const registry = createRegistry([
       createConfigFeature(),
+      createUserFeature(),
       createTenantFeature(),
       createAuditFeature(),
       createJobsFeature(),
@@ -103,6 +118,7 @@ describe("admin-shell boot + workspace composition", () => {
     });
     const registry = createRegistry([
       createConfigFeature(),
+      createUserFeature(),
       createTenantFeature(),
       createAuditFeature(),
       createJobsFeature(),

package/src/admin-shell/__tests__/overview-allowlist.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import { JobQueries } from "../../jobs/constants";
 import { TenantQueries } from "../../tenant/constants";
+import { UserQueries } from "../../user/constants";
 import {
   isOverviewQueryAllowed,
   PLATFORM_OVERVIEW_ALLOWED_QUERIES,
@@ -22,8 +23,16 @@ describe("overview query allowlist", () => {
     expect(TENANT_OVERVIEW_ALLOWED_QUERIES).toContain("config:query:readiness");
   });
 
-  test("platform allowlist is tenant:list + jobs:list only", () => {
-    expect(PLATFORM_OVERVIEW_ALLOWED_QUERIES).toEqual([TenantQueries.list, JobQueries.list]);
+  test("platform allowlist is tenant:list + jobs:list + user:list", () => {
+    expect(PLATFORM_OVERVIEW_ALLOWED_QUERIES).toEqual([
+      TenantQueries.list,
+      JobQueries.list,
+      UserQueries.list,
+    ]);
+  });
+
+  test("platform overview allows the user-count query (fw#891 regression)", () => {
+    expect(isOverviewQueryAllowed("platform", UserQueries.list)).toBe(true);
   });
 
   test("platform queries are not tenant-allowlisted", () => {

package/src/admin-shell/__tests__/overview-screens.boot.test.ts

@@ -5,11 +5,13 @@ import { createConfigFeature } from "../../config/feature";
 import { createJobsFeature } from "../../jobs/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { tierEngineFeature } from "../../tier-engine/feature";
+import { createUserFeature } from "../../user/feature";
 import { PLATFORM_OVERVIEW_SCREEN_ID, TENANT_OVERVIEW_SCREEN_ID } from "../constants";
 import { createAdminShellFeature } from "../feature";
 
 const features = [
   createConfigFeature(),
+  createUserFeature(),
   createTenantFeature(),
   createAuditFeature(),
   createJobsFeature(),

package/src/admin-shell/feature.ts

@@ -36,13 +36,14 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
 
   return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
     r.describe(
-      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`). Mount after tenant, audit, and jobs; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
+      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`). Mount after user, tenant, audit, and jobs; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
     );
     r.uiHints({
       displayLabel: "Admin Shell",
       category: "operations",
       recommended: false,
     });
+    r.requires("user");
     r.requires("tenant");
     r.requires("audit");
     r.requires("jobs");

package/src/admin-shell/i18n.ts

@@ -30,6 +30,7 @@ export const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>> = {
     en: "Check required settings",
   },
   "admin-shell:overview.tenants": { de: "Mandanten", en: "Tenants" },
+  "admin-shell:overview.users": { de: "Benutzer", en: "Users" },
   "admin-shell:overview.failedJobs": { de: "Fehlgeschlagene Jobs", en: "Failed jobs" },
   "admin-shell:overview.failedJobsHint": { de: "Job-Runs prüfen", en: "Review job runs" },
 };

package/src/admin-shell/overview-allowlist.ts

@@ -13,7 +13,11 @@ export const TENANT_OVERVIEW_ALLOWED_QUERIES = [
 ] as const;
 
 /** Platform workspace overview may only call these queries. */
-export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = ["tenant:query:list", "jobs:query:list"] as const;
+export const PLATFORM_OVERVIEW_ALLOWED_QUERIES = [
+  "tenant:query:list",
+  "jobs:query:list",
+  "user:query:user:list",
+] as const;
 
 /** Regression guard — TenantAdmin overview must never touch these (HTTP 403). */
 export const TENANT_OVERVIEW_FORBIDDEN_QUERIES = [

package/src/admin-shell/web/platform-overview-screen.tsx

@@ -4,6 +4,7 @@ import { useDispatcher, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useEffect, useState } from "react";
 import { JobQueries } from "../../jobs/constants";
 import { TenantQueries } from "../../tenant/constants";
+import { UserQueries } from "../../user/constants";
 import { OverviewLayout, type OverviewState } from "./overview-layout";
 import { overviewQuery } from "./overview-query";
 
@@ -27,6 +28,18 @@ export function PlatformOverviewScreen(): ReactNode {
         return;
       }
 
+      const usersRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
+        "platform",
+        dispatcher,
+        UserQueries.list,
+        {},
+      );
+      if (cancelled) return;
+      if (!usersRes.isSuccess) {
+        setState({ kind: "error", message: usersRes.error.message });
+        return;
+      }
+
       const failedJobsRes = await overviewQuery<{ readonly rows: readonly unknown[] }>(
         "platform",
         dispatcher,
@@ -46,6 +59,10 @@ export function PlatformOverviewScreen(): ReactNode {
             label: t("admin-shell:overview.tenants"),
             value: String(tenantsRes.data.rows.length),
           },
+          {
+            label: t("admin-shell:overview.users"),
+            value: String(usersRes.data.rows.length),
+          },
           {
             label: t("admin-shell:overview.failedJobs"),
             value: String(failedJobsRes.data.rows.length),
@@ -69,7 +86,7 @@ export function PlatformOverviewScreen(): ReactNode {
       title={t("admin-shell:overview.platformTitle")}
       state={state}
       loadingLabel={t("admin-shell:overview.loading")}
-      columns={2}
+      columns={3}
     />
   );
 }

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config/feature";
-import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
 describe("audit log screen + handler access alignment", () => {
@@ -21,9 +21,22 @@ describe("audit log screen + handler access alignment", () => {
     }
   });
 
-  test("audit:query:list uses access.admin (screen ⊆ handler)", () => {
+  test("audit-log-detail screen is custom, admin-gated, breadcrumb-linked to list", () => {
+    const audit = createAuditFeature();
+    const screen = audit.screens[AUDIT_LOG_DETAIL_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "listScreenId" in screen) {
+      expect(screen.listScreenId).toBe(AUDIT_LOG_SCREEN_ID);
+    }
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(access.admin);
+    }
+  });
+
+  test("audit queries use access.admin (screen ⊆ handler)", () => {
     const audit = createAuditFeature();
     expect(rolesOf(audit.queryHandlers["list"]?.access)).toEqual([...access.admin]);
+    expect(rolesOf(audit.queryHandlers["details"]?.access)).toEqual([...access.admin]);
     void AuditQueries;
   });
 });

package/src/audit/constants.ts

@@ -4,7 +4,11 @@ export const AUDIT_FEATURE = "audit" as const;
 
 export const AuditQueries = {
   list: "audit:query:list",
+  details: "audit:query:details",
 } as const;
 
 /** Tenant-admin audit log screen. Nav: `audit:screen:audit-log`. */
 export const AUDIT_LOG_SCREEN_ID = "audit-log" as const;
+
+/** Single-event detail screen, breadcrumb-linked to the audit-log list. */
+export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail" as const;

package/src/audit/feature.ts

@@ -3,7 +3,8 @@ import {
   defineFeature,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { AUDIT_LOG_SCREEN_ID } from "./constants";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID } from "./constants";
+import { detailsQuery } from "./handlers/details.query";
 import { listQuery } from "./handlers/list.query";
 import { AUDIT_I18N } from "./i18n";
 
@@ -33,6 +34,7 @@ export function createAuditFeature(): FeatureDefinition {
 
     const queries = {
       list: r.queryHandler(listQuery),
+      details: r.queryHandler(detailsQuery),
     };
 
     r.screen({
@@ -41,6 +43,13 @@ export function createAuditFeature(): FeatureDefinition {
       renderer: { react: { __component: "AuditLogScreen" } },
       access: { roles: access.admin },
     });
+    r.screen({
+      id: AUDIT_LOG_DETAIL_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "AuditLogDetailScreen" } },
+      listScreenId: AUDIT_LOG_SCREEN_ID,
+      access: { roles: access.admin },
+    });
     r.nav({
       id: "audit-log",
       label: "audit:nav.auditLog",

package/src/audit/handlers/details.query.ts

@@ -0,0 +1,47 @@
+// Single audit event by its event-store id — backs the audit-log-detail
+// screen. Tenant-isolated at the WHERE level like list.query, so a caller
+// can only read events in their own tenant.
+
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { z } from "zod";
+
+export const detailsQuery = defineQueryHandler({
+  name: "details",
+  schema: z.object({
+    id: z.string().regex(/^\d+$/, "id must be a positive integer"),
+  }),
+  access: { roles: access.admin },
+  handler: async (query, ctx) => {
+    const rows = await selectMany<{
+      id: bigint;
+      aggregateId: string;
+      aggregateType: string;
+      version: number;
+      type: string;
+      payload: Record<string, unknown>;
+      metadata: Record<string, unknown>;
+      createdAt: unknown;
+      createdBy: string;
+    }>(
+      ctx.db,
+      eventsTable,
+      { tenantId: query.user.tenantId, id: BigInt(query.payload.id) },
+      { limit: 1 },
+    );
+    const row = rows[0];
+    if (row === undefined) return null;
+    return {
+      id: String(row.id),
+      aggregateId: row.aggregateId,
+      aggregateType: row.aggregateType,
+      version: row.version,
+      type: row.type,
+      payload: row.payload,
+      metadata: row.metadata,
+      createdAt: row.createdAt,
+      createdBy: row.createdBy,
+    };
+  },
+});

package/src/audit/i18n.ts

@@ -5,6 +5,7 @@ type LocalizedString = { readonly de: string; readonly en: string };
 
 export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:audit-log.title": { de: "Audit-Log", en: "Audit log" },
+  "screen:audit-log-detail.title": { de: "Ereignis", en: "Event" },
   "audit:nav.auditLog": { de: "Audit", en: "Audit" },
   "audit.log.title": { de: "Audit-Log", en: "Audit log" },
   "audit.log.loading": { de: "Lade Ereignisse…", en: "Loading events…" },
@@ -22,6 +23,9 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.filter.apply": { de: "Filtern", en: "Filter" },
   "audit.log.filter.reset": { de: "Zurücksetzen", en: "Reset" },
   "audit.log.details": { de: "Details", en: "Details" },
-  "audit.log.detail.title": { de: "Ereignis-Payload", en: "Event payload" },
-  "audit.log.detail.close": { de: "Schließen", en: "Close" },
+  "audit.log.detail.loading": { de: "Lade Ereignis…", en: "Loading event…" },
+  "audit.log.detail.missing": { de: "Ereignis nicht gefunden.", en: "Event not found." },
+  "audit.log.detail.payload": { de: "Ereignis-Payload", en: "Event payload" },
+  "audit.log.detail.metadata": { de: "Metadaten", en: "Metadata" },
+  "audit.log.detail.field.id": { de: "Ereignis-ID", en: "Event ID" },
 };

package/src/audit/web/audit-log-detail-screen.tsx

@@ -0,0 +1,133 @@
+// @runtime client
+// Single audit event detail. Route entityId = event-store id (bigint string).
+
+import { useDispatcher, useNav, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
+import { type ReactNode, useCallback, useEffect, useState } from "react";
+import { AuditQueries } from "../constants";
+
+type AuditDetail = {
+  readonly id: string;
+  readonly aggregateId: string;
+  readonly aggregateType: string;
+  readonly type: string;
+  readonly createdBy: string;
+  readonly createdAt: string;
+  readonly payload: Record<string, unknown>;
+  readonly metadata: Record<string, unknown>;
+};
+
+type State =
+  | { readonly kind: "loading" }
+  | { readonly kind: "missing" }
+  | { readonly kind: "error"; readonly message: string }
+  | { readonly kind: "ready"; readonly event: AuditDetail };
+
+export function AuditLogDetailScreen(): ReactNode {
+  const t = useTranslation();
+  const { Banner, Card, Text } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const nav = useNav();
+  const eventId = nav.route?.entityId;
+  const [state, setState] = useState<State>({ kind: "loading" });
+
+  const load = useCallback(async (): Promise<void> => {
+    if (eventId === undefined || eventId === "") {
+      setState({ kind: "missing" });
+      return;
+    }
+    setState({ kind: "loading" });
+    const res = await dispatcher.query<AuditDetail | null>(AuditQueries.details, { id: eventId });
+    if (!res.isSuccess) {
+      setState({ kind: "error", message: res.error.message });
+      return;
+    }
+    if (res.data === null) {
+      setState({ kind: "missing" });
+      return;
+    }
+    setState({ kind: "ready", event: res.data });
+  }, [dispatcher, eventId]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  if (state.kind === "loading") {
+    return (
+      <FormScreenShell testId="audit-log-detail-screen">
+        <Text variant="small">{t("audit.log.detail.loading")}</Text>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "missing") {
+    return (
+      <FormScreenShell testId="audit-log-detail-screen">
+        <Banner variant="error">{t("audit.log.detail.missing")}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  if (state.kind === "error") {
+    return (
+      <FormScreenShell testId="audit-log-detail-screen">
+        <Banner variant="error">{state.message}</Banner>
+      </FormScreenShell>
+    );
+  }
+
+  const { event } = state;
+
+  return (
+    <FormScreenShell testId="audit-log-detail-screen" className="flex flex-col gap-6">
+      <Card slots={{ title: event.type }}>
+        <dl className="grid gap-3 text-sm">
+          <div>
+            <dt className="font-medium">{t("audit.log.col.when")}</dt>
+            <dd data-testid="audit-detail-when">{formatWhen(event.createdAt)}</dd>
+          </div>
+          <div>
+            <dt className="font-medium">{t("audit.log.col.aggregate")}</dt>
+            <dd data-testid="audit-detail-aggregate">
+              {event.aggregateType} / {event.aggregateId}
+            </dd>
+          </div>
+          <div>
+            <dt className="font-medium">{t("audit.log.col.actor")}</dt>
+            <dd data-testid="audit-detail-actor">{event.createdBy}</dd>
+          </div>
+          <div>
+            <dt className="font-medium">{t("audit.log.detail.field.id")}</dt>
+            <dd>
+              <Text variant="code">{event.id}</Text>
+            </dd>
+          </div>
+        </dl>
+      </Card>
+
+      <Card slots={{ title: t("audit.log.detail.payload") }}>
+        <pre
+          className="max-h-96 overflow-auto whitespace-pre-wrap break-all text-xs"
+          data-testid="audit-detail-payload"
+        >
+          {JSON.stringify(event.payload, null, 2)}
+        </pre>
+      </Card>
+
+      <Card slots={{ title: t("audit.log.detail.metadata") }}>
+        <pre className="max-h-96 overflow-auto whitespace-pre-wrap break-all text-xs">
+          {JSON.stringify(event.metadata, null, 2)}
+        </pre>
+      </Card>
+    </FormScreenShell>
+  );
+}
+
+function formatWhen(value: string): string {
+  try {
+    return new Date(value).toLocaleString();
+  } catch {
+    return value;
+  }
+}