@cosmicdrift/kumiko-bundled-features 0.147.1 → 0.147.3

package/src/seo/__tests__/seo.integration.test.ts

@@ -280,3 +280,71 @@ describe("seo :: runSeoBootCheck (direct unit-tests)", () => {
     }
   });
 });
+
+// resolverTrust: "authoritative" (kumiko-platform#278/1, show-pony#51) —
+// dieselbe Regression wie managed-pages' Suite, für sitemap.xml/llms.txt.
+// gatherEntries' interner Self-Fetch für die by-tenant-published-Query trug
+// keinen Host-Header; ein fallback-freier Resolver (wie hier, wie
+// publicstatus' echter Resolver) löste dafür null auf → tenant_required
+// statt der Managed-Pages-Einträge. systemQuery behebt das (siehe
+// managed-pages' Suite für die volle Mechanismus-Erklärung + Rot/Grün-Beweis).
+describe("seo :: resolverTrust authoritative (host-based, wie publicstatus/show-pony)", () => {
+  let authStack: TestStack;
+  const authManaged = createManagedPagesFeature({
+    resolveApexTenant: (host) => (host.startsWith("a.") ? TENANT_A : null),
+  });
+  const authSeo = createSeoFeature({
+    sitemapEntries: (host) => [{ loc: `https://${host}/`, changefreq: "daily" }],
+    managedPages: {
+      resolveApexTenant: (host) => (host.startsWith("a.") ? TENANT_A : null),
+    },
+  });
+  const authConfigFeature = createConfigFeature();
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    authStack = await setupTestStack({
+      features: [authConfigFeature, authManaged, authSeo],
+      anonymousAccess: {
+        // KEIN URL-Fallback — spiegelt publicstatus' echten Resolver. Ein
+        // interner Self-Fetch trägt keinen Host-Header; mit Fallback würde
+        // dieser Test den Bug maskieren (siehe managed-pages' Suite).
+        tenantResolver: (c) => ((c.req.header("host") ?? "").startsWith("a.") ? TENANT_A : null),
+        resolverTrust: "authoritative",
+        tenantExists: async (id) => id === TENANT_A,
+      },
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafeCreateEntityTable(authStack.db, pageEntity);
+    await unsafePushTables(authStack.db, { configValuesTable });
+    await createEventsTable(authStack.db);
+    await seedPage(authStack.db, {
+      tenantId: TENANT_A,
+      slug: "about",
+      lang: "en",
+      title: "About",
+      body: "# About",
+      published: true,
+    });
+  });
+
+  afterAll(async () => {
+    await authStack.cleanup();
+  });
+
+  test("sitemap.xml → 200, merges managed-pages' published slugs via systemQuery", async () => {
+    const res = await authStack.app.request("http://a.example.com/sitemap.xml");
+    expect(res.status).toBe(200);
+    const xml = await res.text();
+    expect(xml).toContain("<loc>https://a.example.com/</loc>");
+    expect(xml).toContain("<loc>http://a.example.com/p/about</loc>");
+  });
+
+  test("llms.txt → 200", async () => {
+    const res = await authStack.app.request("http://a.example.com/llms.txt");
+    expect(res.status).toBe(200);
+  });
+});

package/src/seo/feature.ts

@@ -19,11 +19,11 @@ const SEO_CACHE = { kind: "revalidate", maxAgeSeconds: 300 } as const;
 const MANAGED_PAGES_BY_TENANT_PUBLISHED_QN = "managed-pages:query:by-tenant-published";
 const SEO_CONFIG_QUERY_QN = "seo:query:config";
 
-// Minimal shape of the httpRoute handler's `{ app }` dep — just enough to
-// make an internal /api/query call. Not importing HttpRouteHandlerDeps
-// itself: it isn't part of the engine's public surface (only the
-// httpRoute-registration types are).
-type FetchApp = { readonly fetch: (req: Request) => Promise<Response> | Response };
+// Minimal shape of the httpRoute handler's `{ systemQuery }` dep — just
+// enough to force a specific tenant in-process. Not importing
+// HttpRouteHandlerDeps itself: it isn't part of the engine's public surface
+// (only the httpRoute-registration types are).
+type SystemQueryFn = (type: string, payload: unknown, tenantId: string) => Promise<unknown>;
 
 export type ManagedPagesDiscoveryOptions = {
   /** Same per-host tenant resolver the app already passes to
@@ -76,26 +76,18 @@ const EMPTY_SEO_CONFIG: SeoConfigValues = {
   defaultOgImage: "",
 };
 
-function queryRequest(origin: string, tenantId: string, type: string, payload: unknown): Request {
-  return new Request(`${origin}/api/query`, {
-    method: "POST",
-    headers: { "content-type": "application/json", "X-Tenant": tenantId },
-    body: JSON.stringify({ type, payload }),
-  });
-}
-
 // Config is decoration, not a hard dependency — a failed/unreachable read
 // degrades to empty strings (same posture as managed-pages' readBrandingResponse).
+// systemQuery forces tenantId in-process — no internal X-Tenant self-fetch,
+// which a host-based anonymousAccess resolver in "authoritative" mode would
+// reject as a forged client override.
 async function readSeoConfig(
-  app: FetchApp,
-  origin: string,
+  systemQuery: SystemQueryFn,
   tenantId: string,
 ): Promise<SeoConfigValues> {
   try {
-    const res = await app.fetch(queryRequest(origin, tenantId, SEO_CONFIG_QUERY_QN, {}));
-    if (!res.ok) return EMPTY_SEO_CONFIG;
-    const body: { data?: Partial<SeoConfigValues> } = await res.json();
-    return { ...EMPTY_SEO_CONFIG, ...body.data };
+    const data = (await systemQuery(SEO_CONFIG_QUERY_QN, {}, tenantId)) as Partial<SeoConfigValues>;
+    return { ...EMPTY_SEO_CONFIG, ...data };
   } catch {
     return EMPTY_SEO_CONFIG;
   }
@@ -104,13 +96,13 @@ async function readSeoConfig(
 // Merges the app callback with the optional legal-pages/managed-pages
 // sources. legal-pages routes are static (no per-tenant data) — merged
 // directly from the public LEGAL_ROUTES constant. managed-pages entries need
-// a live query (per-tenant published slugs) — merged via app.fetch, same
+// a live query (per-tenant published slugs) — merged via systemQuery, same
 // cross-feature decoupling as legal-pages' own text-content calls; a
 // failed/unreachable read degrades to "no managed-pages entries" rather than
 // failing the whole route.
 async function gatherEntries(
   opts: SeoOptions,
-  app: FetchApp,
+  systemQuery: SystemQueryFn,
   origin: string,
   host: string,
 ): Promise<SitemapEntry[]> {
@@ -126,21 +118,16 @@ async function gatherEntries(
     const tenantId = await opts.managedPages.resolveApexTenant(host);
     if (tenantId) {
       try {
-        const res = await app.fetch(
-          queryRequest(origin, tenantId, MANAGED_PAGES_BY_TENANT_PUBLISHED_QN, {}),
-        );
-        if (res.ok) {
-          const body: {
-            data?: { pages?: readonly { slug: string; title: string; updatedAt: string }[] };
-          } = await res.json();
-          const basePath = opts.managedPages.basePath ?? "/p";
-          for (const page of body.data?.pages ?? []) {
-            entries.push({
-              loc: `${origin}${basePath}/${page.slug}`,
-              title: page.title,
-              lastmod: page.updatedAt,
-            });
-          }
+        const data = (await systemQuery(MANAGED_PAGES_BY_TENANT_PUBLISHED_QN, {}, tenantId)) as {
+          pages?: readonly { slug: string; title: string; updatedAt: string }[];
+        };
+        const basePath = opts.managedPages.basePath ?? "/p";
+        for (const page of data.pages ?? []) {
+          entries.push({
+            loc: `${origin}${basePath}/${page.slug}`,
+            title: page.title,
+            lastmod: page.updatedAt,
+          });
         }
       } catch {
         // managed-pages unreachable/not mounted — degrade to callback-only entries.
@@ -203,9 +190,9 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       method: "GET",
       path: paths.sitemap,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
-        const entries = await gatherEntries(opts, app, origin, host);
+        const entries = await gatherEntries(opts, systemQuery, origin, host);
         const xml = buildSitemapXml(entries);
         const etag = computeRevisionEtag([host, xml]);
         return cachedSecurePageResponse(c.req.raw, {
@@ -221,14 +208,14 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
       method: "GET",
       path: paths.llmsTxt,
       anonymous: true,
-      handler: async (c, { app }) => {
+      handler: async (c, { systemQuery }) => {
         const { origin, host } = requestHost(c);
         const tenantId = opts.managedPages
           ? ((await opts.managedPages.resolveApexTenant(host)) ?? SYSTEM_TENANT_ID)
           : SYSTEM_TENANT_ID;
         const [entries, seoConfig] = await Promise.all([
-          gatherEntries(opts, app, origin, host),
-          readSeoConfig(app, origin, tenantId),
+          gatherEntries(opts, systemQuery, origin, host),
+          readSeoConfig(systemQuery, tenantId),
         ]);
         const sections =
           entries.length > 0

package/src/sessions/feature.ts

@@ -7,7 +7,7 @@ import { revokeWrite } from "./handlers/revoke.write";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
 import { userSessionEntity } from "./schema/user-session";
-import type { SessionMassRevoker } from "./session-callbacks";
+import type { SessionAllOthersRevoker, SessionMassRevoker } from "./session-callbacks";
 
 export type SessionsFeatureOptions = {
   // A successful update on the `user` entity that changes the `passwordHash`
@@ -29,6 +29,7 @@ export type SessionsFeatureOptions = {
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
 
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature

package/src/sessions/session-callbacks.ts

@@ -33,6 +33,16 @@ const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
 // caller can log "revoked N other sessions".
 export type SessionMassRevoker = (userId: string) => Promise<number>;
 
+// "Sign out everywhere else, keep this one" — used both by the user-facing
+// revoke-all-others handler and by other features (auth-mfa) that need the
+// same effect from a raw callback instead of a dispatcher round-trip.
+// currentSid undefined (stateless-JWT / no sid claim) revokes everything —
+// there is no "current" row to spare.
+export type SessionAllOthersRevoker = (
+  userId: string,
+  currentSid: string | undefined,
+) => Promise<number>;
+
 export type SessionCallbacksOptions = {
   readonly db: DbConnection;
   // Session lifetime. MVP uses a single flat window; per-app policies can
@@ -45,6 +55,7 @@ export type SessionCallbacks = {
   sessionRevoker: SessionRevoker;
   sessionChecker: SessionChecker;
   sessionMassRevoker: SessionMassRevoker;
+  sessionRevokeAllOthers: SessionAllOthersRevoker;
 };
 
 export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCallbacks {
@@ -135,5 +146,17 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       );
       return result.length;
     },
+
+    async sessionRevokeAllOthers(userId: string, currentSid: string | undefined): Promise<number> {
+      const result = await updateMany(
+        db,
+        userSessionTable,
+        { revokedAt: Temporal.Now.instant() },
+        currentSid
+          ? { userId, revokedAt: null, id: { ne: currentSid } }
+          : { userId, revokedAt: null },
+      );
+      return result.length;
+    },
   };
 }

package/src/shared/index.ts

@@ -9,3 +9,4 @@ export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/{auth-email-password → shared}/token-burn-store.ts

@@ -1,5 +1,5 @@
 // Single-use enforcement for HMAC-signed auth tokens (password-reset,
-// email-verification).
+// email-verification, MFA setup/challenge).
 //
 // Problem: the token itself carries only userId + expiry + signature.
 // Without server-side burn, the same token can be replayed within its