@cosmicdrift/kumiko-bundled-features 0.160.0 → 0.162.0

package/src/feature-toggles/__tests__/compose-tier-resolver.test.ts

@@ -0,0 +1,96 @@
+// Unit test (no DB) — the composition logic is pure given a tier resolver
+// function + a GlobalFeatureToggleRuntime whose in-memory snapshot is set
+// directly via .apply(). Pins the semantics documented in
+// compose-tier-resolver.ts: the global layer only NARROWS what the tier
+// grants (explicit `false` removes it), it never falls back to a
+// toggleable feature's own default and never widens beyond the tier.
+
+import { describe, expect, test } from "bun:test";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  EffectiveFeaturesResolver,
+  Registry,
+  TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { composeTierResolverWithGlobalToggles } from "../compose-tier-resolver";
+import { GlobalFeatureToggleRuntime } from "../toggle-runtime";
+
+// Never touched by .apply()/.readOverride() — the runtime only does I/O in
+// .initialize()/.refresh(), which this test never calls.
+const fakeDb = {} as unknown as DbConnection;
+const fakeRegistry = {} as unknown as Registry;
+
+function tierResolverGranting(...features: readonly string[]): EffectiveFeaturesResolver {
+  return ((_tenantId: TenantId) => new Set(features)) as EffectiveFeaturesResolver;
+}
+
+describe("composeTierResolverWithGlobalToggles", () => {
+  test("no override → tier's grant stands", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("auth-self-registration", "personal-access-tokens"),
+      runtime,
+    );
+    expect([...composed("t1" as TenantId)].sort()).toEqual([
+      "auth-self-registration",
+      "personal-access-tokens",
+    ]);
+  });
+
+  test("explicit override=false removes a tier-granted feature", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    runtime.apply("auth-self-registration", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("auth-self-registration", "personal-access-tokens"),
+      runtime,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["personal-access-tokens"]);
+  });
+
+  test("explicit override=true is a no-op — cannot widen beyond the tier's grant", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    runtime.apply("some-other-feature", true);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("auth-self-registration"),
+      runtime,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("a tier-gated toggleable feature with NO override row stays on — no fallback to its own default", () => {
+    // Regression pin for the exact bug this composer exists to avoid:
+    // a Team-tier feature declared `toggleable({default:false})` must stay
+    // granted when the tier includes it and no operator has touched it —
+    // computeEffectiveFeatures' cascade would otherwise fall back to
+    // `false` the moment feature-toggles is composed in.
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("personal-access-tokens"),
+      runtime,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["personal-access-tokens"]);
+  });
+
+  test("flip back on restores the tier's grant", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    runtime.apply("auth-self-registration", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("auth-self-registration"),
+      runtime,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual([]);
+
+    runtime.apply("auth-self-registration", true);
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("preserves the tier resolver's trialGate", async () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, fakeRegistry);
+    const tierResolver = tierResolverGranting();
+    const trialGate = async (_tenantId: TenantId, _featureName: string) => true;
+    Object.assign(tierResolver, { trialGate });
+
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime);
+    expect(composed.trialGate).toBe(trialGate);
+  });
+});

package/src/feature-toggles/compose-tier-resolver.ts

@@ -0,0 +1,41 @@
+import type { EffectiveFeaturesResolver } from "@cosmicdrift/kumiko-framework/engine";
+import type { GlobalFeatureToggleRuntime } from "./toggle-runtime";
+
+// Composes a tenantTierResolver (tier-engine) with a GlobalFeatureToggleRuntime
+// (feature-toggles) into a single resolver an app can pass as
+// runProdApp/runDevApp's `effectiveFeatures`.
+//
+// The framework only auto-wires ONE tenantTierResolver plugin (single-plugin
+// assumption, see tier-resolver-extension.ts) — an app running BOTH
+// tier-engine (per-tenant feature cuts) and feature-toggles (global runtime
+// switches, e.g. an operator kill-switch not tied to any tier) needs to
+// combine them itself. This is that combination, factored out here instead
+// of duplicated per app.
+//
+// Semantics: the global toggle layer can only NARROW what the tier grants,
+// never widen it — an explicit `enabled: false` row removes a feature the
+// tier would otherwise include; no row, or an explicit `true` row, leaves
+// the tier's grant untouched. Deliberately NOT computeEffectiveFeatures'
+// cascade (which falls back to a toggleable feature's declared default):
+// under tier-engine, a toggleable feature with no override row is governed
+// by the TIER, not by its own default — falling back to the default would
+// silently kill every tier-gated toggleable feature (e.g. a Team-tier
+// feature defaulting `false`) the moment feature-toggles gets composed in.
+export function composeTierResolverWithGlobalToggles(
+  tierResolver: EffectiveFeaturesResolver,
+  toggleRuntime: GlobalFeatureToggleRuntime,
+): EffectiveFeaturesResolver {
+  const composed = ((tenantId) => {
+    const tierSet = tierResolver(tenantId);
+    const result = new Set<string>();
+    for (const name of tierSet) {
+      if (toggleRuntime.readOverride(name) !== false) result.add(name);
+    }
+    return result;
+  }) as EffectiveFeaturesResolver;
+
+  if (tierResolver.trialGate) {
+    return Object.assign(composed, { trialGate: tierResolver.trialGate });
+  }
+  return composed;
+}

package/src/feature-toggles/index.ts

@@ -1,3 +1,4 @@
+export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver";
 export {
   FEATURE_TOGGLES_FEATURE,
   FeatureToggleHandlers,

package/src/feature-toggles/toggle-runtime.ts

@@ -47,6 +47,20 @@ export class GlobalFeatureToggleRuntime {
     this.snapshot.set(featureName, enabled);
   }
 
+  // Raw per-feature override, bypassing the requires() cascade —
+  // `undefined` means "no explicit row, inherits toggleableDefault"
+  // (distinct from an explicit `false`). Used by composeTierResolver to
+  // layer a global kill-switch UNDER a tenantTierResolver: the composed
+  // resolver must only ever narrow what the tier already grants, never
+  // fall back to a toggleable feature's declared default the way
+  // effectiveFeatures()/computeEffectiveFeatures do — that default exists
+  // for apps with no tier resolver, and would otherwise turn tier-gated
+  // toggleable features (e.g. a Team-tier feature defaulting off) globally
+  // off the moment feature-toggles is composed in.
+  readOverride(featureName: string): boolean | undefined {
+    return this.snapshot.get(featureName);
+  }
+
   // The callback shape the dispatcher expects. Computes the effective
   // feature set from the current snapshot + the registry's requires()
   // cascade every call. Cheap: the cascade is a DFS over O(features);

package/src/sessions/feature.ts

@@ -42,6 +42,9 @@ export type SessionsFeatureOptions = {
   // only to supply a custom revoker — an explicit value wins over the
   // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
+  // Session JWT / store_user_sessions TTL. Was previously auth.sessions.expiresInMs
+  // (#1372) — lives on the sessions feature now that sessionStore is the wiring.
+  readonly expiresInMs?: number;
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
@@ -120,12 +123,16 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // via resolveSessionStore().
     r.useExtension(EXT_SESSION_STORE, "default", {
       build: (deps): SessionStore => {
-        const callbacks = createSessionCallbacks({ db: deps.db });
+        const callbacks = createSessionCallbacks({
+          db: deps.db,
+          ...(options?.expiresInMs !== undefined && { expiresInMs: options.expiresInMs }),
+        });
         return {
           creator: callbacks.sessionCreator,
           revoker: callbacks.sessionRevoker,
           checker: callbacks.sessionChecker,
           massRevoker: callbacks.sessionMassRevoker,
+          revokeAllOthers: callbacks.sessionRevokeAllOthers,
         };
       },
     } satisfies SessionStoreProvider);