@cosmicdrift/kumiko-bundled-features 0.165.1 → 0.165.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.165.1",
+  "version": "0.165.3",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -119,11 +119,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.165.1",
-    "@cosmicdrift/kumiko-framework": "0.165.1",
-    "@cosmicdrift/kumiko-headless": "0.165.1",
-    "@cosmicdrift/kumiko-renderer": "0.165.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.165.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.165.3",
+    "@cosmicdrift/kumiko-framework": "0.165.3",
+    "@cosmicdrift/kumiko-headless": "0.165.3",
+    "@cosmicdrift/kumiko-renderer": "0.165.3",
+    "@cosmicdrift/kumiko-renderer-web": "0.165.3",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",
@@ -148,7 +148,7 @@
     "LICENSE"
   ],
   "peerDependencies": {
-    "@cosmicdrift/kumiko-types": "^0.165.1"
+    "@cosmicdrift/kumiko-types": "^0.165.3"
   },
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -72,7 +72,7 @@ let invalidated: string[];
 let unsubscribe: (() => void) | undefined;
 
 function trackInvalidation(userId: string): void {
-  unsubscribe = stack.sseBroker.subscribeAccessInvalidation(userId, () => {
+  unsubscribe = stack.sseBroker.subscribeAccessInvalidation?.(userId, () => {
     invalidated.push(userId);
   });
 }

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -53,25 +53,28 @@ const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT = testTenantId(1);
 
-// Gate between chunk 0 and chunk 1 so the test can revoke + drain the event
-// consumer before the stream's next pull — otherwise an eager pump would
-// race past the invalidation window.
-let releaseNextChunk: (() => void) | undefined;
-let nextChunkGate: Promise<void>;
-
-function resetGate(): void {
-  nextChunkGate = new Promise<void>((resolve) => {
-    releaseNextChunk = resolve;
+// Per-stream gate (gateId in payload) so parallel/second streams don't share
+// one module-level Promise — Map keyed by the id the test picks.
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
   });
+  chunkGates.set(gateId, { promise, release });
+  return release;
 }
 
 const streamProbeFeature = defineFeature("stream-probe", (r) => {
   r.streamHandler(
     "probe:tail",
-    z.object({}).optional(),
-    async function* () {
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
       yield { phase: "open" as const };
-      await nextChunkGate;
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
       // Reached only if mid-stream access check failed to cut the generator.
       yield { phase: "should-not-reach-client" as const };
     },
@@ -144,74 +147,73 @@ beforeEach(async () => {
     userSessionTable,
     eventsTable,
   ]);
-  resetGate();
+  chunkGates.clear();
 });
 
-describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
-  test("session revoke mid-stream terminates the open HTTP SSE stream", async () => {
-    await h.seedUser("stream-revoke@example.com", "pw-long-enough");
-    const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
-
-    const { fetch, csrfToken } = buildLiveFetch(token);
-    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
-
-    const iter = dispatcher
-      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
-      [Symbol.asyncIterator]();
-
-    const first = await iter.next();
-    expect(first.done).toBe(false);
-    expect(first.value).toEqual({ phase: "open" });
+async function openProbeStream(token: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(token);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
 
-    const revokeRes = await h.authedPost("/api/write", token, {
-      type: SessionHandlers.revoke,
-      payload: { id: sid },
+describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
+  const cases = [
+    {
+      name: "session revoke mid-stream terminates the open HTTP SSE stream",
+      setup: async () => {
+        await h.seedUser("stream-revoke@example.com", "pw-long-enough");
+        const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
+        return {
+          token,
+          revoke: async () => {
+            const revokeRes = await h.authedPost("/api/write", token, {
+              type: SessionHandlers.revoke,
+              payload: { id: sid },
+            });
+            expect(revokeRes.status).toBe(200);
+          },
+        };
+      },
+    },
+    {
+      name: "tenant role strip mid-stream terminates the open HTTP SSE stream",
+      setup: async () => {
+        const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
+        const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
+        return {
+          token,
+          revoke: async () => {
+            const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+            await stack.http.writeOk(
+              TenantHandlers.updateMemberRoles,
+              { userId, tenantId: TENANT, roles: ["Admin"] },
+              admin,
+            );
+          },
+        };
+      },
+    },
+  ] as const;
+
+  for (const c of cases) {
+    test(c.name, async () => {
+      const { token, revoke } = await c.setup();
+      const { iter, release } = await openProbeStream(token);
+      await revoke();
+      await stack.eventDispatcher?.runOnce();
+      release();
+      await expect(iter.next()).rejects.toMatchObject({ code: "access_denied" });
     });
-    expect(revokeRes.status).toBe(200);
-    await stack.eventDispatcher?.runOnce();
-
-    releaseNextChunk?.();
-
-    let thrown: unknown;
-    try {
-      await iter.next();
-    } catch (e) {
-      thrown = e;
-    }
-    expect(thrown).toMatchObject({ code: "access_denied" });
-  });
-
-  test("tenant role strip mid-stream terminates the open HTTP SSE stream", async () => {
-    const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
-    const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
-
-    const { fetch, csrfToken } = buildLiveFetch(token);
-    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
-
-    const iter = dispatcher
-      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
-      [Symbol.asyncIterator]();
-
-    const first = await iter.next();
-    expect(first.done).toBe(false);
-    expect(first.value).toEqual({ phase: "open" });
-
-    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
-    await stack.http.writeOk(
-      TenantHandlers.updateMemberRoles,
-      { userId, tenantId: TENANT, roles: ["Admin"] },
-      admin,
-    );
-    await stack.eventDispatcher?.runOnce();
-
-    releaseNextChunk?.();
-
-    let thrown: unknown;
-    try {
-      await iter.next();
-    } catch (e) {
-      thrown = e;
-    }
-    expect(thrown).toMatchObject({ code: "access_denied" });
-  });
+  }
 });

package/src/admin-shell/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.125.0",
+    "type": "improvement",
+    "title": "admin-shell: neues bundled-feature für rollen-gated Tenant- und Platform-Workspaces mit O…",
+    "detail": "admin-shell: neues bundled-feature für rollen-gated Tenant- und Platform-Workspaces mit Overview-Home-Screens, Nav-Icons und Server-i18n. Komponiert Screens aus `tenant`, `audit`, `jobs` und optional `tier-engine` — mount nach diesen Features. Overview-Queries laufen über eine fest kodierte Allowlist pro Workspace, um versehentliche Cross-Workspace-Datenzugriffe zu verhindern."
+  }
+]

package/src/agent-tools/changes.json

@@ -0,0 +1 @@
+[]

package/src/audit/__tests__/audit.integration.test.ts

@@ -212,7 +212,7 @@ describe("audit: list query", () => {
     ];
     for (const [name, createdAt] of stamps) {
       const id = byName.get(name);
-      expect(id).toBeDefined();
+      if (!id) throw new Error(`missing event for ${name}`);
       await asRawClient(stack.db).unsafe(
         `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
         [createdAt, id],
@@ -244,7 +244,10 @@ describe("audit: list query", () => {
       admin,
     );
     expect(untilBefore.rows).toHaveLength(1);
-    expect((untilBefore.rows[0]?.payload as { name?: string }).name).toBe("before-window");
+    const untilRow = untilBefore.rows[0];
+    expect(untilRow).toBeDefined();
+    if (!untilRow) throw new Error("expected untilBefore row");
+    expect((untilRow.payload as { name?: string }).name).toBe("before-window");
   });
 
   test("rejects inverted from/to range with validation_error", async () => {

package/src/audit/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.127.0",
+    "type": "improvement",
+    "title": "Harden admin operator UI: stricter boot i18n/entityList validation, job run logger wiring…",
+    "detail": "Harden admin operator UI: stricter boot i18n/entityList validation, job run logger wiring, audit/job filters, shell breadcrumbs, and bundled entityList/i18n standards."
+  }
+]

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { USER_STATUS } from "../../user";
+import type { AuthUserRow } from "../auth-user-row";
+import { gateEnforceAccountStatus, gateEnforceEmailVerified } from "../handlers/login.write";
+
+function row(over: Partial<AuthUserRow> = {}): AuthUserRow {
+  return { id: "00000000-0000-4000-8000-000000000001", passwordHash: "x", ...over };
+}
+
+describe("login.write gates (fw#1284)", () => {
+  test("gateEnforceEmailVerified rejects when strict and unverified", () => {
+    const g = gateEnforceEmailVerified(row({ emailVerified: false }), true);
+    expect(g.ok).toBe(false);
+    if (!g.ok) expect(g.result.isSuccess).toBe(false);
+  });
+
+  test("gateEnforceEmailVerified passes when not strict", () => {
+    expect(gateEnforceEmailVerified(row({ emailVerified: false }), false).ok).toBe(true);
+  });
+
+  test("gateEnforceAccountStatus rejects restricted", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.Restricted }));
+    expect(g.ok).toBe(false);
+  });
+
+  test("gateEnforceAccountStatus rejects deletion_requested as invalid_creds shape", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.DeletionRequested }));
+    expect(g.ok).toBe(false);
+    if (!g.ok) {
+      expect(g.result.isSuccess).toBe(false);
+      // anti-enumeration — same family as invalid credentials
+      expect(g.result).toMatchObject({ isSuccess: false });
+    }
+  });
+
+  test("gateEnforceAccountStatus passes active", () => {
+    expect(gateEnforceAccountStatus(row({ status: USER_STATUS.Active })).ok).toBe(true);
+  });
+});

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -133,6 +133,9 @@ beforeAll(async () => {
     password: "warmup-password-not-asserted-on",
     tenants: [],
   });
+  // Pins the authHeader sid-cache key: one create for the seed actor, then
+  // we reset. If the cache key drifts, this fails instead of leaking into tests.
+  expect(store.created).toHaveLength(1);
   store.live.clear();
   store.created.length = 0;
   store.revoked.length = 0;

package/src/auth-email-password/changes.json

@@ -0,0 +1,26 @@
+[
+  {
+    "version": "0.162.0",
+    "type": "improvement",
+    "title": "auth-email-password: runtime toggle for self-registration.",
+    "detail": "auth-email-password: runtime toggle for self-registration. A new handler-less companion feature (`auth-self-registration`, toggleable, default on) lets an operator flip self-signup off at runtime via feature-toggles without redeploying. `signup-request` silently no-ops when off (matching its always-200 anti-enumeration contract), and a new anonymous-readable query (`auth-email-password:query:signup-registration-status`) lets the public signup page hide its own link/form."
+  },
+  {
+    "version": "0.154.1",
+    "type": "fix",
+    "title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled…",
+    "detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, …) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
+  },
+  {
+    "version": "0.151.0",
+    "type": "improvement",
+    "title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — u…",
+    "detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself — exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases — there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
+  },
+  {
+    "version": "0.131.0",
+    "type": "improvement",
+    "title": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti…",
+    "detail": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
+  }
+]