@cosmicdrift/kumiko-bundled-features 0.146.1 → 0.146.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.146.1",
+  "version": "0.146.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -111,11 +111,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.146.1",
-    "@cosmicdrift/kumiko-framework": "0.146.1",
-    "@cosmicdrift/kumiko-headless": "0.146.1",
-    "@cosmicdrift/kumiko-renderer": "0.146.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.146.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.146.2",
+    "@cosmicdrift/kumiko-framework": "0.146.2",
+    "@cosmicdrift/kumiko-headless": "0.146.2",
+    "@cosmicdrift/kumiko-renderer": "0.146.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.146.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/handlers/login.write.ts

@@ -1,8 +1,8 @@
 import {
+  buildSessionRoles,
   createSystemUser,
   defineWriteHandler,
   type SessionUser,
-  stripForbiddenMembershipRoles,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -169,11 +169,10 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       // membership. Dedupe via Set damit eine Rolle die in beiden Quellen
       // steht nicht doppelt im Session-Roles landet.
       const globalRoles = parseRoles(found.roles ?? null);
-      // Strip reserved roles from the membership portion only (globalRoles keeps
-      // SystemAdmin) — read-time backstop against a rebuild-resurrected role.
-      const mergedRoles = Array.from(
-        new Set([...globalRoles, ...stripForbiddenMembershipRoles(chosen.roles)]),
-      );
+      // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
+      // only (globalRoles keeps SystemAdmin) — read-time backstop against a
+      // rebuild-resurrected role.
+      const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
       const baseSession: SessionUser = {
         id: found.id,
         tenantId: chosen.tenantId,

package/src/auth-email-password/handlers/logout.write.ts

@@ -1,4 +1,4 @@
-import { access, defineWriteHandler, pipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 
 // Logout — JWT is stateless, so server-side we only return OK. A future
@@ -8,5 +8,7 @@ export const logoutWrite = defineWriteHandler({
   name: "logout",
   schema: z.object({}),
   access: { roles: access.authenticated },
-  perform: pipeline(({ r }) => [r.step.return({ isSuccess: true, data: { kind: "logged-out" } })]),
+  perform: stepsPipeline(({ r }) => [
+    r.step.return({ isSuccess: true, data: { kind: "logged-out" } }),
+  ]),
 });

package/src/personal-access-tokens/roles.ts

@@ -1,13 +1,14 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { stripForbiddenMembershipRoles } from "@cosmicdrift/kumiko-framework/engine";
+import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { tenantMembershipsTable } from "../tenant";
 import { userTable } from "../user";
 
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
-// stripped). Resolved fresh on every PAT request — a snapshot baked at mint
+// stripped via stripForbiddenMembershipRoles, see engine/membership-roles).
+// Resolved fresh on every PAT request — a snapshot baked at mint
 // time would keep a since-revoked admin role for the token's whole (months-long)
 // life. Returns null when the user has no membership in that tenant: removed
 // from the tenant → the PAT stops authenticating there.
@@ -24,6 +25,5 @@ export async function resolvePatRoles(
   if (!membership) return null;
   const userRow = await fetchOne<{ roles: string | null }>(db, userTable, { id: userId });
   const globalRoles = parseRoles(userRow?.roles ?? null);
-  const membershipRoles = stripForbiddenMembershipRoles(parseRoles(membership.roles));
-  return [...new Set([...globalRoles, ...membershipRoles])];
+  return buildSessionRoles(globalRoles, parseRoles(membership.roles));
 }

package/src/seo/__tests__/seo.integration.test.ts

@@ -129,6 +129,18 @@ describe("seo :: GET /sitemap.xml", () => {
     expect(res.headers.get("etag")).toBeTruthy();
   });
 
+  test("x-forwarded-proto: https → every merged URL uses https, not the raw http hop", async () => {
+    const res = await stack.app.request("http://a.example.com/sitemap.xml", {
+      headers: { "x-forwarded-proto": "https" },
+    });
+    expect(res.status).toBe(200);
+    const xml = await res.text();
+    expect(xml).toContain("<loc>https://a.example.com/</loc>");
+    expect(xml).toContain("<loc>https://a.example.com/legal/impressum</loc>");
+    expect(xml).toContain("<loc>https://a.example.com/p/about</loc>");
+    expect(xml).not.toContain("http://a.example.com");
+  });
+
   test("host without a managed-pages tenant → callback + legal-pages entries only", async () => {
     const res = await stack.app.request("http://unknown.example.com/sitemap.xml");
     expect(res.status).toBe(200);

package/src/seo/feature.ts

@@ -147,12 +147,21 @@ async function gatherEntries(
   return entries;
 }
 
+// TLS-terminating reverse proxies (ingress-nginx et al.) forward the
+// original request over plain HTTP internally, so `c.req.url`'s scheme
+// reflects the proxy hop, not what the client actually used — trusting it
+// downgraded every legal-pages/managed-pages URL in sitemap.xml/llms.txt to
+// http:// in production. `x-forwarded-proto` carries the real scheme;
+// fall back to the raw URL only when the header is absent (plain local dev).
 function requestHost(c: { req: { header: (name: string) => string | undefined; url: string } }): {
   origin: string;
   host: string;
 } {
   const url = new URL(c.req.url);
-  return { origin: url.origin, host: c.req.header("host") ?? url.host };
+  const host = c.req.header("host") ?? url.host;
+  const forwardedProto = c.req.header("x-forwarded-proto")?.split(",")[0]?.trim();
+  const protocol = forwardedProto || url.protocol.replace(":", "");
+  return { origin: `${protocol}://${host}`, host };
 }
 
 // seo — site-discovery routes (sitemap.xml/llms.txt/robots.txt) plus the