@cosmicdrift/kumiko-bundled-features 0.154.1 → 0.154.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.154.1",
+  "version": "0.154.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -115,11 +115,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.154.1",
-    "@cosmicdrift/kumiko-framework": "0.154.1",
-    "@cosmicdrift/kumiko-headless": "0.154.1",
-    "@cosmicdrift/kumiko-renderer": "0.154.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.154.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.154.2",
+    "@cosmicdrift/kumiko-framework": "0.154.2",
+    "@cosmicdrift/kumiko-headless": "0.154.2",
+    "@cosmicdrift/kumiko-renderer": "0.154.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.154.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/web/__tests__/auth-form-logic.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from "bun:test";
+import { passwordPairIssue, resolveLoggedInHref, retryAfterMinutes } from "../auth-form-logic";
+
+describe("passwordPairIssue", () => {
+  test("too_short when under min length", () => {
+    expect(passwordPairIssue("short", "short")).toBe("too_short");
+  });
+
+  test("mismatch when confirm differs", () => {
+    expect(passwordPairIssue("validpass1", "otherpass1")).toBe("mismatch");
+  });
+
+  test("null when both valid and matching", () => {
+    expect(passwordPairIssue("validpass1", "validpass1")).toBeNull();
+  });
+
+  test("custom minLength", () => {
+    expect(passwordPairIssue("123456", "123456", 6)).toBeNull();
+    expect(passwordPairIssue("12345", "12345", 6)).toBe("too_short");
+  });
+});
+
+describe("retryAfterMinutes", () => {
+  test("undefined in → undefined out", () => {
+    expect(retryAfterMinutes(undefined)).toBeUndefined();
+  });
+
+  test("ceils fractional minutes", () => {
+    expect(retryAfterMinutes(1)).toBe(1);
+    expect(retryAfterMinutes(60)).toBe(1);
+    expect(retryAfterMinutes(61)).toBe(2);
+    expect(retryAfterMinutes(540)).toBe(9);
+  });
+});
+
+describe("resolveLoggedInHref", () => {
+  test("string href returned as-is", () => {
+    expect(resolveLoggedInHref("/", "acme")).toBe("/");
+  });
+
+  test("function href receives tenantKey", () => {
+    expect(resolveLoggedInHref(({ tenantKey }) => `/${tenantKey}/`, "acme")).toBe("/acme/");
+  });
+});

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -0,0 +1,130 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { SignupCompleteScreen } from "../signup-complete-screen";
+import { renderWithProviders } from "./test-utils";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () =>
+      new Response(
+        JSON.stringify({
+          user: { id: "u1", tenantId: "t1", roles: ["User"] },
+          tenantKey: "acme",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+function fillPasswords(password: string, confirm: string): void {
+  fireEvent.change(document.getElementById("signup-password") as HTMLInputElement, {
+    target: { value: password },
+  });
+  fireEvent.change(document.getElementById("signup-confirm-password") as HTMLInputElement, {
+    target: { value: confirm },
+  });
+}
+
+describe("SignupCompleteScreen", () => {
+  test("ohne Token in URL UND ohne token-Prop → missing-token-Page", () => {
+    renderWithProviders(<SignupCompleteScreen />);
+    expect(screen.getByText(/enthält keinen Token/i)).toBeTruthy();
+  });
+
+  test("mit token-Prop → Form rendert", () => {
+    renderWithProviders(<SignupCompleteScreen token="abc-token" />);
+    expect(document.getElementById("signup-password")).toBeTruthy();
+    expect(document.getElementById("signup-confirm-password")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Account aktivieren" })).toBeTruthy();
+  });
+
+  test("Passwort < 8 Zeichen → client-side error, kein fetch-Call", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="abc" />);
+    fillPasswords("short", "short");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("8 Zeichen");
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("happy path: gültiges Passwort → signup-confirm fetch + location.assign", async () => {
+    const assigned: string[] = [];
+    const assignOrig = window.location.assign.bind(window.location);
+    window.location.assign = ((url: string | URL) => {
+      assigned.push(String(url));
+    }) as typeof window.location.assign;
+
+    const fetchMock = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["User"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    try {
+      renderWithProviders(
+        <SignupCompleteScreen
+          token="abc-token"
+          loggedInHref={({ tenantKey }) => `/${tenantKey}/`}
+        />,
+      );
+      fillPasswords("validpass1", "validpass1");
+      fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+      await waitFor(() => {
+        expect(fetchMock).toHaveBeenCalledWith(
+          "/api/auth/signup-confirm",
+          expect.objectContaining({
+            method: "POST",
+            body: JSON.stringify({ token: "abc-token", password: "validpass1" }),
+          }),
+        );
+        expect(assigned).toEqual(["/acme/"]);
+      });
+    } finally {
+      window.location.assign = assignOrig;
+    }
+  });
+
+  test("mismatch → client-side error, kein fetch-Call", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="abc" />);
+    fillPasswords("validpass1", "differentpass");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("nicht überein");
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("server invalid_signup_token → mapped i18n-error im UI", async () => {
+    const errBody = JSON.stringify({
+      error: { code: "invalid_signup_token", details: { reason: "invalid_signup_token" } },
+    });
+    globalThis.fetch = mock(
+      async () => new Response(errBody, { status: 422 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="bad" />);
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/ungültig|abgelaufen/i);
+    });
+  });
+});

package/src/auth-email-password/web/__tests__/signup-screen.test.tsx

@@ -0,0 +1,89 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { SignupScreen } from "../signup-screen";
+import { renderWithProviders } from "./test-utils";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+function fillEmail(value: string): void {
+  fireEvent.change(document.getElementById("signup-email") as HTMLInputElement, {
+    target: { value },
+  });
+}
+
+describe("SignupScreen", () => {
+  test("rendert title + email-input + submit-button (de)", () => {
+    renderWithProviders(<SignupScreen />);
+    expect(screen.getByText("Account erstellen")).toBeTruthy();
+    expect(document.getElementById("signup-email")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Aktivierungs-Link senden" })).toBeTruthy();
+  });
+
+  test("submit ruft /api/auth/signup-request mit der Email", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/signup-request",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ email: "new@example.com" }),
+        }),
+      );
+    });
+  });
+
+  test("nach erfolgreichem Submit: success-Banner + Resend", async () => {
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Mail gesendet")).toBeTruthy();
+    });
+    expect(screen.getByRole("button", { name: /Mail erneut senden/i })).toBeTruthy();
+  });
+
+  test("rate_limited mit retryAfterSeconds → interpolated minutes", async () => {
+    const errBody = JSON.stringify({
+      error: { code: "rate_limited", details: { retryAfterSeconds: 120 } },
+    });
+    globalThis.fetch = mock(
+      async () => new Response(errBody, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/2/);
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+
+  test("server 5xx → error-banner statt Success-State", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 500 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+});

package/src/auth-email-password/web/auth-form-logic.ts

@@ -0,0 +1,30 @@
+// @runtime client
+// Pure form helpers shared by auth screens. Extracted so unit tests can
+// pin password / rate-limit / redirect rules without mounting React.
+
+export type PasswordPairIssue = "too_short" | "mismatch";
+
+/** Client-side password + confirm check before calling signup/reset APIs. */
+export function passwordPairIssue(
+  password: string,
+  confirmPassword: string,
+  minLength = 8,
+): PasswordPairIssue | null {
+  if (password.length < minLength) return "too_short";
+  if (password !== confirmPassword) return "mismatch";
+  return null;
+}
+
+/** Maps server `retryAfterSeconds` to whole minutes for i18n interpolation. */
+export function retryAfterMinutes(retryAfterSeconds?: number): number | undefined {
+  if (retryAfterSeconds === undefined) return undefined;
+  return Math.ceil(retryAfterSeconds / 60);
+}
+
+/** Resolves post-login redirect: string template or function of tenantKey. */
+export function resolveLoggedInHref(
+  href: string | ((args: { readonly tenantKey: string }) => string),
+  tenantKey: string,
+): string {
+  return typeof href === "function" ? href({ tenantKey }) : href;
+}

package/src/auth-email-password/web/reset-password-screen.tsx

@@ -13,6 +13,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { resetPassword } from "./auth-client";
+import { passwordPairIssue } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type ResetPasswordScreenProps = {
@@ -41,11 +42,12 @@ export function ResetPasswordScreen({
 
   const doSubmit = async (): Promise<void> => {
     setError(null);
-    if (newPassword.length < 8) {
+    const issue = passwordPairIssue(newPassword, confirmPassword);
+    if (issue === "too_short") {
       setError(t("auth.resetPassword.tooShort"));
       return;
     }
-    if (newPassword !== confirmPassword) {
+    if (issue === "mismatch") {
       setError(t("auth.resetPassword.mismatch"));
       return;
     }

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -18,6 +18,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup } from "./auth-client";
+import { passwordPairIssue, resolveLoggedInHref } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
@@ -52,11 +53,12 @@ export function SignupCompleteScreen({
 
   const doSubmit = async (): Promise<void> => {
     setError(null);
-    if (password.length < 8) {
+    const issue = passwordPairIssue(password, confirmPassword);
+    if (issue === "too_short") {
       setError(t("auth.signupComplete.tooShort"));
       return;
     }
-    if (password !== confirmPassword) {
+    if (issue === "mismatch") {
       setError(t("auth.signupComplete.mismatch"));
       return;
     }
@@ -66,11 +68,7 @@ export function SignupCompleteScreen({
     if (res.ok) {
       // Auto-Login: Cookies sind via Set-Cookie schon im Browser. Wir
       // schicken den User direkt zur eingeloggten Page.
-      const target =
-        typeof loggedInHref === "function"
-          ? loggedInHref({ tenantKey: res.data.tenantKey })
-          : loggedInHref;
-      window.location.assign(target);
+      window.location.assign(resolveLoggedInHref(loggedInHref, res.data.tenantKey));
       return;
     }
     if (res.error.reason === "invalid_signup_token") {

package/src/auth-email-password/web/signup-screen.tsx

@@ -15,6 +15,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { requestSignup } from "./auth-client";
+import { retryAfterMinutes } from "./auth-form-logic";
 import { AuthCard } from "./auth-form-primitives";
 
 export type SignupScreenProps = {
@@ -45,10 +46,7 @@ export function SignupScreen({
       if (res.ok) {
         setDone(true);
       } else if (res.error.reason === "rate_limited") {
-        const minutes =
-          res.error.retryAfterSeconds !== undefined
-            ? Math.ceil(res.error.retryAfterSeconds / 60)
-            : undefined;
+        const minutes = retryAfterMinutes(res.error.retryAfterSeconds);
         setError(
           minutes !== undefined
             ? t("auth.errors.accountLockedRetry", { minutes })

package/src/auth-mfa/web/mfa-enable-screen.tsx

@@ -43,6 +43,30 @@ function extractSecret(otpauthUri: string): string {
   return new URLSearchParams(query).get("secret") ?? "";
 }
 
+// 24x24 viewBox icon paths (Material-style), solid fill. Real SVG paths
+// instead of emoji glyphs — emoji-as-<text> renders inconsistently across
+// font stacks and never centers cleanly (font-specific glyph padding).
+const QR_ICONS = [
+  `<path d="M12 21.35l-1.45-1.32C5.4 15.36 2 12.28 2 8.5 2 5.42 4.42 3 7.5 3c1.74 0 3.41.81 4.5 2.09C13.09 3.81 14.76 3 16.5 3 19.58 3 22 5.42 22 8.5c0 3.78-3.4 6.86-8.55 11.54L12 21.35z" fill="#ef4444"/>`,
+  `<path d="M12 17.27L18.18 21l-1.64-7.03L22 9.24l-7.19-.61L12 2 9.19 8.63 2 9.24l5.46 4.73L5.82 21z" fill="#facc15"/>`,
+  `<circle cx="12" cy="12" r="11" fill="#facc15"/><circle cx="8.5" cy="10" r="1.4" fill="#1f2937"/><circle cx="15.5" cy="10" r="1.4" fill="#1f2937"/><path d="M7 14c1 2.2 3 3.4 5 3.4s4-1.2 5-3.4" stroke="#1f2937" stroke-width="1.6" fill="none" stroke-linecap="round"/>`,
+];
+
+// Overlay a random icon in a circle badge over the QR center. cx/cy/r
+// percentages resolve against the SVG viewport regardless of viewBox size,
+// so this string-injection works without parsing qrcode's output dimensions.
+function withIconBadge(svg: string): string {
+  const icon = QR_ICONS[Math.floor(Math.random() * QR_ICONS.length)];
+  const size = Number(svg.match(/viewBox="0 0 (\d+(?:\.\d+)?) /)?.[1] ?? 100);
+  const r = size * 0.16;
+  const iconSize = r * 1.3;
+  const scale = iconSize / 24;
+  const offset = size / 2 - iconSize / 2;
+  // html-ok: icon is one of the fixed QR_ICONS literals above, not user input
+  const badge = `<circle cx="${size / 2}" cy="${size / 2}" r="${r}" fill="#fff" stroke="#e5e7eb" stroke-width="${size * 0.01}"/><g transform="translate(${offset} ${offset}) scale(${scale})">${icon}</g>`;
+  return svg.replace("</svg>", `${badge}</svg>`);
+}
+
 export type MfaEnableScreenProps = {
   readonly embedded?: boolean;
   // Fired once enable-confirm succeeds — MfaEnableScreen has no query of its
@@ -80,7 +104,11 @@ export function MfaEnableScreen({
         setError(res.error.code);
         return;
       }
-      const qrSvg = await QRCode.toString(res.data.otpauthUri, { type: "svg" });
+      // errorCorrectionLevel "H" (~30% redundancy) so the icon badge overlay
+      // doesn't break scanning.
+      const qrSvg = withIconBadge(
+        await QRCode.toString(res.data.otpauthUri, { type: "svg", errorCorrectionLevel: "H" }),
+      );
       setSetup({
         setupToken: res.data.setupToken,
         secretParam: extractSecret(res.data.otpauthUri),

package/src/custom-fields/wire-for-entity.ts

@@ -198,7 +198,7 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
 
   // postQuery-hook: flatten row.customFields jsonb auf root-level der
   // API-response. Spec-Promise Z.4 "indistinguishable von Stammfeldern".
-  r.entityHook("postQuery", entityName, async ({ rows }) => ({
+  r.hook("postQuery", { allOf: entityName }, async ({ rows }) => ({
     rows: rows.map((row) => {
       const customFields = row["customFields"];
       if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -88,7 +88,7 @@ function widgetAuditFeature(): FeatureDefinition {
     r.toggleable({ default: true });
     r.entity("widget-audit", widgetAuditEntity);
 
-    r.entityHook("postSave", "widget", async (result, ctx) => {
+    r.hook("postSave", { allOf: "widget" }, async (result, ctx) => {
       if (result.kind !== "save" || !result.isNew) return;
       if (!ctx.db) return;
       const name = result.changes!["name"] as string | undefined;

package/src/files-provider-s3/__tests__/s3-provider.integration.test.ts

@@ -28,13 +28,29 @@ function uniqueKey(suffix: string): string {
 
 let provider: FileStorageProvider;
 
-beforeAll(() => {
+beforeAll(async () => {
+  const endpoint = requireEnv("MINIO_ENDPOINT");
+  // Fail loud with an actionable message when Minio is down (otherwise
+  // S3 networking errors look like provider bugs).
+  try {
+    const health = await fetch(`${endpoint.replace(/\/$/, "")}/minio/health/live`);
+    if (!health.ok) {
+      throw new Error(`HTTP ${health.status}`);
+    }
+  } catch (err) {
+    throw new Error(
+      `MinIO not reachable at ${endpoint} — run: docker compose up -d minio minio-init ` +
+        `(kumiko-framework compose, default port 19000). ` +
+        `Cause: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+
   // forcePathStyle is deliberately NOT set — resolveForcePathStyle() must
   // auto-detect path-style from the `endpoint` presence. If auto-detection
   // regressed, Minio would reject virtual-host-style URLs (bucket.host/key)
   // and every round-trip below would fail. That's the proof.
   provider = createS3Provider({
-    endpoint: requireEnv("MINIO_ENDPOINT"),
+    endpoint,
     region: requireEnv("MINIO_REGION"),
     accessKeyId: requireEnv("MINIO_ACCESS_KEY"),
     secretAccessKey: requireEnv("MINIO_SECRET_KEY"),