@cosmicdrift/kumiko-bundled-features 0.174.0 → 0.176.0

package/src/text-content/handlers/by-slug.query.ts

@@ -1,55 +0,0 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  crossTenantOverrideDenied,
-  defineQueryHandler,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
-import { type TextBlockRow, textBlocksTable } from "../table";
-
-// Public-Read by (tenantId, slug, lang). Anonymous: muss `anonymous`
-// in roles enthalten — openToAll alleine ist auth-only (Regression-
-// Guard). Tenant-Scope kommt default aus query.user.tenantId (anonymous-
-// context setzt SYSTEM_TENANT_ID oder Host-resolved-tenant je nach App-
-// Setup). Optional `tenantIdOverride` (SystemAdmin-only) erlaubt cross-
-// tenant Read — symmetrisch zum set-handler. Use-case: Edit-UI lädt den
-// SYSTEM_TENANT-Block für SystemAdmin der nicht direkt drauf member ist.
-export const bySlugQuery = defineQueryHandler({
-  name: "by-slug",
-  schema: z.object({
-    slug: z.string().min(1).max(64),
-    lang: z.string().min(2).max(8),
-    /** Optional cross-tenant read — nur für SystemAdmin. Siehe
-     *  set.write.ts für die symmetrische write-side. */
-    tenantIdOverride: z.string().min(1).optional(),
-  }),
-  // Public-Read: muss explizit `anonymous` enthalten damit no-JWT-
-  // Visitors auf Marketing-/Legal-Pages den Text sehen. openToAll
-  // alleine ist auth-only (Regression-Guard) — siehe
-  // docs/plans/datenschutz/legal-artifacts.md.
-  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-  handler: async (query, ctx) => {
-    const override = query.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      query.user,
-      override,
-      "textContent.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) throw overrideDenied;
-    const tenantId = override ?? query.user.tenantId;
-    const row = await fetchOne<TextBlockRow>(ctx.db, textBlocksTable, {
-      tenantId,
-      slug: query.payload.slug,
-      lang: query.payload.lang,
-    });
-
-    if (!row) return null;
-    return {
-      slug: row.slug,
-      lang: row.lang,
-      title: row.title,
-      body: row.body,
-      folder: row.folder,
-      updatedAt: row.updatedAt,
-    };
-  },
-});

package/src/text-content/handlers/by-tenant.query.ts

@@ -1,60 +0,0 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
-import {
-  crossTenantOverrideDenied,
-  defineQueryHandler,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
-import { type TextBlockRow, textBlocksTable } from "../table";
-
-// Public-Read aller Text-Blocks für einen Tenant. Use-Case: Visual-Tree-
-// Provider lädt die Slug-Liste zur Sidebar-Render. Anonymous: explizit
-// in roles damit no-JWT-Visitors auch lesen können (Marketing-Sidebar
-// auf Public-Pages). Tenant-Scope kommt aus query.user.tenantId; optional
-// `tenantIdOverride` (SystemAdmin-only) — symmetrisch zu by-slug.query.
-//
-// **Listing statt single-row**: anders als by-slug returnt das hier
-// `{ blocks: [...] }` mit allen Slugs des Tenants. Pro Slug nur die
-// Summary-Felder (kein full body — den lädt der Editor on-demand via
-// by-slug). Hält die Sidebar-Payload klein bei vielen Slugs.
-export type TextBlockSummary = {
-  readonly slug: string;
-  readonly lang: string;
-  readonly title: string;
-  readonly body: string | null;
-  readonly folder: string | null;
-  readonly updatedAt: Date;
-};
-
-export const byTenantQuery = defineQueryHandler({
-  name: "by-tenant",
-  schema: z.object({
-    /** Optional cross-tenant read — nur für SystemAdmin. Symmetrisch
-     *  zur by-slug.query und set.write Override-Logik. */
-    tenantIdOverride: z.string().min(1).optional(),
-  }),
-  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-  handler: async (query, ctx) => {
-    const override = query.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      query.user,
-      override,
-      "textContent.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) throw overrideDenied;
-    const tenantId = override ?? query.user.tenantId;
-    const rows = castTenantRows<TextBlockRow>(
-      await selectMany(ctx.db, textBlocksTable, { tenantId: tenantId }),
-    );
-    return {
-      blocks: rows.map((row) => ({
-        slug: row.slug,
-        lang: row.lang,
-        title: row.title,
-        body: row.body,
-        folder: row.folder,
-        updatedAt: row.updatedAt,
-      })),
-    };
-  },
-});

package/src/text-content/handlers/set.write.ts

@@ -1,141 +0,0 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import {
-  crossTenantOverrideDenied,
-  defineWriteHandler,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
-import { type TextBlockRow, textBlockEntity, textBlocksTable } from "../table";
-
-const slugSchema = z
-  .string()
-  .min(1)
-  .max(64)
-  .regex(/^[a-z0-9][a-z0-9-]*$/, "slug must be kebab-case (lowercase, digits, dashes)");
-
-// Folder-Convention V.1.4: gleiches kebab-Pattern wie slug, optional
-// `/`-Separator für nested folders ("legal/imprint", "page/marketing").
-// Multi-level wird vom Visual-Tree-Grouping flat-rendered bis V.1.5
-// rekursive Hierarchie braucht — dann erweitert sich nur der UI-Render,
-// nicht das Schema.
-const folderSchema = z
-  .string()
-  .min(1)
-  .max(128)
-  .regex(/^[a-z0-9][a-z0-9-]*(\/[a-z0-9][a-z0-9-]*)*$/, "folder must be kebab-case path");
-
-const langSchema = z
-  .string()
-  .min(2)
-  .max(8)
-  .regex(/^[a-z]{2}(-[a-z]{2})?$/i, "lang must be ISO 639-1 (e.g. de, en, en-us)");
-
-const executor = createEventStoreExecutor(textBlocksTable, textBlockEntity, {
-  entityName: "text-block",
-});
-
-// Upsert handler — eine Operation pro (tenantId, slug, lang). Bei
-// existierender Row → update, sonst → create. Tenant-Scope kommt
-// default aus event.user. Tenant-Admins setzen Texte für ihren
-// eigenen Tenant; Plattform-Sysadmins können via optional
-// `tenantIdOverride` für einen anderen Tenant schreiben (typisch:
-// SYSTEM_TENANT_ID für legal-pages-content den die ganze Plattform
-// teilt). Override ist SystemAdmin-only — TenantAdmin's Override-
-// Versuch → 403.
-export const setWrite = defineWriteHandler({
-  name: "set",
-  schema: z.object({
-    slug: slugSchema,
-    lang: langSchema,
-    title: z.string().min(1).max(200),
-    body: z.string().max(100_000).nullable(),
-    /** V.1.4: Folder-Pfad für Visual-Tree-Gruppierung. Optional + null
-     *  → root-node (kein Folder). Tree groupt nach diesem Field, slug
-     *  bleibt flach + kebab-validiert. Beispiele: "page", "legal",
-     *  "page/marketing". */
-    folder: folderSchema.nullable().optional(),
-    /** Optional cross-tenant write — nur für SystemAdmin. Typischer
-     *  use-case: legal-pages-Edit-UI lässt SystemAdmin auf
-     *  SYSTEM_TENANT_ID schreiben (sonst landet der text auf seinem
-     *  eigenen platform-tenant und legal-pages-routes lesen ihn
-     *  nicht). TenantAdmin's Versuch → ForbiddenError. */
-    tenantIdOverride: z.string().min(1).optional(),
-  }),
-  // SystemAdmin ist eine GLOBALE Rolle (users.roles), TenantAdmin pro
-  // tenant-membership. SystemAdmin braucht beide Pfade explizit weil
-  // er nicht implicit TenantAdmin auf jedem Tenant ist (siehe
-  // project_global_roles_sysadmin memory). Ohne SystemAdmin könnte
-  // niemand SYSTEM_TENANT-Texte setzen — nur via Test-Helper.
-  access: { roles: ["TenantAdmin", "SystemAdmin"] },
-  handler: async (event, ctx) => {
-    const db = ctx.db;
-    const override = event.payload.tenantIdOverride;
-    const overrideDenied = crossTenantOverrideDenied(
-      event.user,
-      override,
-      "textContent.errors.tenantOverrideRequiresSystemAdmin",
-    );
-    if (overrideDenied) return writeFailure(overrideDenied);
-    const tenantId = override ?? event.user.tenantId;
-    // Bei tenantIdOverride muss auch der user-context auf den ziel-tenant
-    // umgestellt werden, sonst läuft der event-store-Lookup
-    // (getStreamVersion) gegen user.tenantId statt tenantId — und findet
-    // den stream nicht → version_conflict obwohl die projection-row da ist.
-    // Symmetric with seedTextBlock, which defaults by to
-    // createSystemUser(tenantId) so stream lookup and projection tenant match.
-    const executorUser =
-      override !== undefined ? { ...event.user, tenantId: override as TenantId } : event.user; // @cast-boundary engine-bridge
-
-    const existing = await fetchOne<TextBlockRow>(db, textBlocksTable, {
-      tenantId,
-      slug: event.payload.slug,
-      lang: event.payload.lang,
-    });
-
-    // V.1.4 folder: optional + null erlaubt (root-node). Optional-Chain
-    // mapped undefined → null damit drizzle nullable-column konsistent
-    // schreibt (sonst SQL-default kicked-in vs. explicit-null Unterschied).
-    const folder = event.payload.folder ?? null;
-
-    if (existing) {
-      const result = await executor.update(
-        {
-          id: existing.id,
-          version: existing.version,
-          changes: {
-            title: event.payload.title,
-            body: event.payload.body,
-            folder,
-          },
-        },
-        executorUser,
-        db,
-      );
-      if (!result.isSuccess) return result;
-      return {
-        isSuccess: true as const,
-        data: { slug: event.payload.slug, lang: event.payload.lang, isNew: false },
-      };
-    }
-
-    const result = await executor.create(
-      {
-        slug: event.payload.slug,
-        lang: event.payload.lang,
-        title: event.payload.title,
-        body: event.payload.body,
-        folder,
-        tenantId,
-      },
-      executorUser,
-      db,
-    );
-    if (!result.isSuccess) return result;
-    return {
-      isSuccess: true as const,
-      data: { slug: event.payload.slug, lang: event.payload.lang, isNew: true },
-    };
-  },
-});

package/src/text-content/index.ts

@@ -1,14 +0,0 @@
-export {
-  createTextContentApi,
-  requireTextContent,
-  type TextBlock,
-  type TextContentApi,
-} from "./api";
-export {
-  TEXT_CONTENT_FEATURE,
-  TextContentErrors,
-  TextContentHandlers,
-  TextContentQueries,
-} from "./constants";
-export { createTextContentFeature } from "./feature";
-export { type TextBlockRow, textBlockEntity, textBlocksTable } from "./table";

package/src/text-content/seeding.ts

@@ -1,139 +0,0 @@
-// Boot-/test-seed helpers for text-content. Creates a TextBlock via the
-// event-store executor — same path as the real set-handler, without the
-// access check. Default ifExists="skip": only missing blocks; opt-in
-// update for demo fixtures / legal template authority.
-
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  createEventStoreExecutor,
-  createTenantDb,
-  type DbConnection,
-} from "@cosmicdrift/kumiko-framework/db";
-import {
-  createSystemUser,
-  type SessionUser,
-  SYSTEM_TENANT_ID,
-  type TenantId,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
-import { type TextBlockRow, textBlockEntity, textBlocksTable } from "./table";
-
-const executor = createEventStoreExecutor(textBlocksTable, textBlockEntity, {
-  entityName: "text-block",
-});
-
-export type SeedTextBlockOptions = {
-  readonly tenantId: TenantId;
-  readonly slug: string;
-  readonly lang: string;
-  readonly title: string;
-  readonly body?: string | null;
-  /** V.1.4: Folder path for visual-tree grouping. Optional + null =
-   *  root node. Seed path bypasses slugSchema/folderSchema validation
-   *  (system-trusted), but app builders should keep kebab-only so
-   *  set.write can overwrite the seeded row later. */
-  readonly folder?: string | null;
-  readonly by?: SessionUser;
-  readonly ifExists?: SeedIfExists;
-};
-
-export async function seedTextBlock(
-  db: DbConnection,
-  opts: SeedTextBlockOptions,
-): Promise<{ id: string }> {
-  // Default actor is createSystemUser(tenantId) — same as config-seed —
-  // so prod boot seeds (legal pages) do not pull TestUsers / stack into
-  // the app bundle or stamp phantom test fixture IDs into the audit trail.
-  const by = opts.by ?? createSystemUser(opts.tenantId);
-  // executor.create expects TenantDb — wrap so runtime tenant-scope checks apply.
-  const tdb = createTenantDb(db, opts.tenantId, "system");
-
-  const existing = await fetchOne<TextBlockRow>(db, textBlocksTable, {
-    tenantId: opts.tenantId,
-    slug: opts.slug,
-    lang: opts.lang,
-  });
-
-  const folder = opts.folder ?? null;
-  const body = opts.body ?? null;
-
-  return runEventStoreSeed({
-    existing,
-    ifExists: opts.ifExists,
-    create: async () => {
-      const result = await executor.create(
-        {
-          slug: opts.slug,
-          lang: opts.lang,
-          title: opts.title,
-          body,
-          folder,
-          tenantId: opts.tenantId,
-        },
-        by,
-        tdb,
-      );
-      if (!result.isSuccess) {
-        throw new Error(`seedTextBlock create failed: ${JSON.stringify(result)}`);
-      }
-      // @cast-boundary db-row: executor.create result.data is the
-      // inserted Drizzle row (Record<string, unknown>), projected
-      // after INSERT/RETURNING onto TextBlockRow. Runtime check below.
-      const data = result.data as Partial<TextBlockRow>;
-      if (data.id === undefined) {
-        throw new Error("seedTextBlock: executor.create did not return an id");
-      }
-      return { id: data.id };
-    },
-    update: async (row) => {
-      // Skip no-op updates so legal re-seed on every pod boot does not
-      // bump version/updatedAt (ETag / "last changed" / event-store growth).
-      if (row.title === opts.title && row.body === body && row.folder === folder) {
-        return { id: row.id };
-      }
-      const result = await executor.update(
-        {
-          id: row.id,
-          version: row.version,
-          changes: { title: opts.title, body, folder },
-        },
-        by,
-        tdb,
-      );
-      if (!result.isSuccess) {
-        throw new Error(`seedTextBlock update failed: ${JSON.stringify(result)}`);
-      }
-      return { id: row.id };
-    },
-  });
-}
-
-export type LegalContentBlock = {
-  readonly slug: string;
-  readonly lang: string;
-  readonly title: string;
-  readonly body: string;
-};
-
-// Boot-seed for legal/marketing copy from a JSON template. `ifExists:
-// "update"` is load-bearing: the template is authoritative — otherwise
-// legally required additions never reach already-seeded prod rows.
-export async function seedLegalContentFromJson(
-  db: DbConnection,
-  blocks: readonly LegalContentBlock[],
-  opts: { readonly tenantId?: TenantId; readonly by?: SessionUser } = {},
-): Promise<void> {
-  const tenantId = opts.tenantId ?? SYSTEM_TENANT_ID;
-  const by = opts.by ?? createSystemUser(tenantId);
-  for (const block of blocks) {
-    await seedTextBlock(db, {
-      tenantId,
-      slug: block.slug,
-      lang: block.lang,
-      title: block.title,
-      body: block.body,
-      ifExists: "update",
-      by,
-    });
-  }
-}

package/src/text-content/table.ts

@@ -1,53 +0,0 @@
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
-
-// TextBlock — generischer Container für statische Texte (legal pages,
-// FAQ, About, ToS, Marketing-Snippets). Pro (tenantId, slug, lang) genau
-// eine Row. SYSTEM_TENANT_ID für app-weite Texte (Impressum etc.), sonst
-// Tenant-eigene Texte.
-//
-// Inhaltsformat ist Markdown (App-Renderer entscheidet Markdown→HTML).
-// Body bleibt nullable damit ein leerer Block existieren kann (z.B.
-// während Tenant-Onboarding bevor der Admin den finalen Text schreibt).
-export const textBlockEntity = createEntity({
-  table: "read_text_blocks",
-  fields: {
-    slug: createTextField({ required: true }),
-    lang: createTextField({ required: true }),
-    title: createTextField({ required: true }),
-    // Body is CMS-content authored by TenantAdmin/SystemAdmin (legal pages,
-    // FAQ, ToS, marketing) — business data, not user-generated content.
-    body: createTextField({ allowPlaintext: "is-business-data" }),
-    // V.1.4: explicit folder-Hierarchie statt `:`-Encoding im Slug.
-    // Visual-Tree gruppiert nach diesem Field; null/undefined → root.
-    // Pflicht-Constraint im set.write-Schema (kebab-only wie slug,
-    // damit App-Builder konsistente Naming-Conventions haben).
-    folder: createTextField({}),
-  },
-  indexes: [
-    { unique: true, columns: ["tenantId", "slug", "lang"], name: "read_text_blocks_unique" },
-  ],
-});
-
-export const textBlocksTable = buildEntityTable("text-block", textBlockEntity);
-
-// Concrete Row-Type — single-source dafür dass die unknown-Werte die
-// Drizzle aus `Record<string, unknown>` liefert genau einmal benannt
-// werden (statt 6× `row["x"] as Y` Casts in Handlern + Seeding).
-// Kommt aus `entity.fields` + Standard-Spalten (id, version, tenantId,
-// createdAt, updatedAt, createdBy, updatedBy) die buildBaseColumns
-// erzwingt.
-export type TextBlockRow = {
-  readonly id: string;
-  readonly version: number;
-  readonly tenantId: string;
-  readonly slug: string;
-  readonly lang: string;
-  readonly title: string;
-  readonly body: string | null;
-  readonly folder: string | null;
-  readonly createdAt: Date;
-  readonly updatedAt: Date;
-  readonly createdBy: string;
-  readonly updatedBy: string;
-};