@cosmicdrift/kumiko-bundled-features 0.174.1 → 0.176.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.174.1",
+  "version": "0.176.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -104,12 +104,10 @@
     "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
-    "./text-content": "./src/text-content/index.ts",
-    "./text-content/seeding": "./src/text-content/seeding.ts",
-    "./text-content/web": "./src/text-content/web/index.ts",
     "./template-resolver": "./src/template-resolver/index.ts",
     "./template-resolver/seeding": "./src/template-resolver/seeding.ts",
     "./template-resolver/testing": "./src/template-resolver/testing.ts",
+    "./template-resolver/web": "./src/template-resolver/web/index.ts",
     "./renderer-foundation": "./src/renderer-foundation/index.ts",
     "./legal-pages": "./src/legal-pages/index.ts",
     "./legal-pages/web": "./src/legal-pages/web/index.ts",
@@ -122,12 +120,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.174.1",
-    "@cosmicdrift/kumiko-framework": "0.174.1",
-    "@cosmicdrift/kumiko-headless": "0.174.1",
-    "@cosmicdrift/kumiko-renderer": "0.174.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.174.1",
-    "@cosmicdrift/kumiko-types": "0.174.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.176.1",
+    "@cosmicdrift/kumiko-framework": "0.176.1",
+    "@cosmicdrift/kumiko-headless": "0.176.1",
+    "@cosmicdrift/kumiko-renderer": "0.176.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.176.1",
+    "@cosmicdrift/kumiko-types": "0.176.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/__tests__/boot-seed-contract.integration.test.ts

@@ -17,17 +17,21 @@ import {
   tenantComplianceProfileTable,
 } from "../compliance-profiles/schema/profile-selection";
 import { seedComplianceProfile } from "../compliance-profiles/seeding";
-import { createTextContentFeature } from "../text-content/feature";
-import { seedTextBlock } from "../text-content/seeding";
-import { type TextBlockRow, textBlockEntity, textBlocksTable } from "../text-content/table";
+import { createTemplateResolverFeature } from "../template-resolver/feature";
+import { seedTextBlock } from "../template-resolver/seeding";
+import {
+  type TemplateResourceRow,
+  templateResourceEntity,
+  templateResourcesTable,
+} from "../template-resolver/table";
 
 let stack: TestStack;
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [createTextContentFeature(), createComplianceProfilesFeature()],
+    features: [createTemplateResolverFeature(), createComplianceProfilesFeature()],
   });
-  await unsafeCreateEntityTable(stack.db, textBlockEntity);
+  await unsafeCreateEntityTable(stack.db, templateResourceEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await createEventsTable(stack.db);
 });
@@ -43,32 +47,32 @@ describe("boot-seed contract", () => {
     await seedTextBlock(stack.db, {
       tenantId,
       slug: "imprint",
-      lang: "de",
+      locale: "de",
       title: "Impressum",
-      body: "seed body",
+      content: "seed body",
     });
     await seedTextBlock(stack.db, {
       tenantId,
       slug: "imprint",
-      lang: "de",
+      locale: "de",
       title: "Impressum (edited)",
-      body: "admin body",
+      content: "admin body",
       ifExists: "update",
     });
     await seedTextBlock(stack.db, {
       tenantId,
       slug: "imprint",
-      lang: "de",
+      locale: "de",
       title: "Impressum",
-      body: "seed body",
+      content: "seed body",
     });
 
-    const row = await fetchOne<TextBlockRow>(stack.db, textBlocksTable, {
+    const row = await fetchOne<TemplateResourceRow>(stack.db, templateResourcesTable, {
       tenantId,
       slug: "imprint",
-      lang: "de",
+      locale: "de",
     });
-    expect(row).toMatchObject({ title: "Impressum (edited)", body: "admin body", version: 2 });
+    expect(row).toMatchObject({ title: "Impressum (edited)", content: "admin body", version: 2 });
 
     const events = await selectMany(stack.db, eventsTable, { aggregateId: String(row!.id) });
     expect(events).toHaveLength(2);

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -351,6 +351,37 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     expect(memberships).toHaveLength(2);
   });
 
+  test("Bob accepts with a timezone → JWT retains the timezone", async () => {
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", bobId],
+    );
+    try {
+      const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+      const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+        token,
+        email: BOB_EMAIL,
+        password: BOB_PASSWORD,
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { token?: string };
+      expect(body.token).toBeTypeOf("string");
+      if (!body.token) throw new Error("invite acceptance did not return a token");
+
+      const payload = await stack.jwt.verify(body.token);
+      expect(payload.timezone).toBe("Europe/Berlin");
+    } finally {
+      // Bob is shared across this describe block (other tests rely on his
+      // membership state persisting) — restore his timezone so later tests
+      // don't silently inherit it.
+      await asRawClient(stack.db).unsafe(
+        `UPDATE "${userTable.tableName}" SET timezone = NULL WHERE id = $1`,
+        [bobId],
+      );
+    }
+  });
+
   test("Wrong password → 422 invalid_invite_token (anti-enum)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Editor");
     const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,7 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii, verifyPassword } from "../../shared";
+import { decryptStoredPii, sessionTimezoneField, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -96,7 +96,11 @@ export function createInviteAcceptWithLoginHandler() {
         readonly role: string;
         readonly version: number;
       };
-      type UserAuthRow = { readonly id: string; readonly passwordHash: string | null };
+      type UserAuthRow = {
+        readonly id: string;
+        readonly passwordHash: string | null;
+        readonly timezone?: string | null;
+      };
 
       let committed = false;
       try {
@@ -173,6 +177,7 @@ export function createInviteAcceptWithLoginHandler() {
           // buildSessionRoles calls stripForbiddenMembershipRoles internally —
           // a reserved role on the invitation itself must never reach the session.
           roles: buildSessionRoles([], [invitationRole]),
+          ...sessionTimezoneField(userRow.timezone),
         };
 
         committed = true;

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -14,9 +14,12 @@ import {
   expectErrorIncludes,
   seedRow,
 } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers as AuthEmailPasswordHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -25,7 +28,7 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { base32Decode } from "../base32";
 import { AuthMfaHandlers } from "../constants";
-import { createAuthMfaFeature } from "../feature";
+import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
 import { signMfaChallengeToken } from "../mfa-challenge-token";
 import { userMfaEntity } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
@@ -49,18 +52,26 @@ beforeAll(async () => {
   const encryption = createTestEnvelopeCipher();
   configureEntityFieldEncryption(encryption);
   const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
   stack = await setupTestStack({
     features: [
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
-      createAuthMfaFeature({
-        setupTokenSecret: SETUP_TOKEN_SECRET,
-        issuer: "Kumiko Test",
-        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
       }),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthEmailPasswordHandlers.login,
+    },
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -76,8 +87,10 @@ async function enableMfaFor(idSeed: number): Promise<{
   user: ReturnType<typeof createTestUser>;
   secret: Buffer;
   recoveryCodes: string[];
+  password: string;
 }> {
   const user = createTestUser({ id: idSeed, roles: ["User"] });
+  const password = `password-${idSeed}-long-enough`;
   const start = await stack.http.writeOk<{
     setupToken: string;
     otpauthUri: string;
@@ -103,14 +116,14 @@ async function enableMfaFor(idSeed: number): Promise<{
     id: user.id,
     tenantId: user.tenantId,
     email: `user-${user.id}@example.com`,
-    passwordHash: "h",
+    passwordHash: await hashPassword(password),
     displayName: `Test User ${idSeed}`,
     locale: "de",
     emailVerified: true,
     roles: "[]",
     status: USER_STATUS.Active,
   });
-  return { user, secret, recoveryCodes: start.recoveryCodes };
+  return { user, secret, recoveryCodes: start.recoveryCodes, password };
 }
 
 function challengeFor(userId: string, tenantId: TenantId): string {
@@ -131,6 +144,50 @@ describe("mfa verify — completes a two-step login", () => {
     expect(res.session.tenantId).toBe(user.tenantId);
   });
 
+  test("a password login followed by MFA verify retains the user's timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(9);
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", user.id],
+    );
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBe("Europe/Berlin");
+  });
+
+  test("a password login followed by MFA verify omits an unset timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(10);
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBeUndefined();
+  });
+
   test("a wrong TOTP code is rejected", async () => {
     const { user } = await enableMfaFor(2);
     const challengeToken = challengeFor(user.id, user.tenantId);

package/src/auth-mfa/handlers/verify.write.ts

@@ -8,7 +8,7 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
-import { burnToken } from "../../shared";
+import { burnToken, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants";
 import { findUserMfaRow } from "../db/queries";
@@ -135,7 +135,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
       const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
-      })) as { roles?: string | null; status?: string } | null; // @cast-boundary engine-payload
+      })) as { roles?: string | null; status?: string; timezone?: string | null } | null; // @cast-boundary engine-payload
 
       // Re-check status + membership the way login.write.ts does after its
       // password check — the challenge token only proves "password was
@@ -168,7 +168,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // read-time backstop against a rebuild-resurrected role.
       const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
 
-      const baseSession: SessionUser = { id: userId, tenantId, roles: mergedRoles };
+      const baseSession: SessionUser = {
+        id: userId,
+        tenantId,
+        roles: mergedRoles,
+        ...sessionTimezoneField(userRow?.timezone),
+      };
       const claims = await ctx.resolveAuthClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;

package/src/legal-pages/README.md

@@ -1,6 +1,6 @@
 # legal-pages
 
-Opt-in wrapper around [`text-content`](../text-content/) for
+Opt-in wrapper around [`template-resolver`](../template-resolver/) text-blocks for
 DACH compliance. Ships four fixed public HTML routes
 (`/legal/impressum`, `/legal/datenschutz`, `/legal/imprint`,
 `/legal/privacy`) with Markdown→HTML rendering and a boot check that
@@ -17,25 +17,25 @@ feature.
 ```typescript
 import { createLegalPagesFeature } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
 import {
-  createTextContentApi,
-  createTextContentFeature,
-} from "@cosmicdrift/kumiko-bundled-features/text-content";
+  createTemplateResolverApi,
+  createTemplateResolverFeature,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 runProdApp({
   features: [
-    createTextContentFeature(),  // legal-pages requires text-content
+    createTemplateResolverFeature(),  // legal-pages requires template-resolver
     createLegalPagesFeature(),
     /* ... */
   ],
   // Two wirings are required:
   //   1. anonymousAccess for /legal/* routes (run without a JWT)
-  //   2. extraContext.textContent for the boot check (cross-feature
-  //      decoupling — legal-pages imports no code from text-content,
+  //   2. extraContext.templateResolver for the boot check (cross-feature
+  //      decoupling — legal-pages imports no code from template-resolver,
   //      only uses the API via ctx)
   anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
   extraContext: ({ db }) => ({
-    textContent: createTextContentApi(db),
+    templateResolver: createTemplateResolverApi(db),
   }),
 });
 ```
@@ -44,19 +44,20 @@ runProdApp({
 
 ### Production table setup
 
-legal-pages doesn't have its own table — it uses text-content's
-`read_text_blocks`. Table setup therefore goes through text-content:
+legal-pages doesn't have its own table — it stores its blocks as
+`kind: "text-block"` rows in template-resolver's `read_template_resources`.
+Table setup therefore goes through template-resolver:
 
 ```bash
-bun kumiko migrate generate    # text-block entity is detected
-bun kumiko migrate apply
+bun kumiko schema generate <name>   # template-resource entity is detected
+bun kumiko schema apply
 ```
 
-See [text-content/README.md](../text-content/README.md#production-table-setup).
+See [template-resolver/README.md](../template-resolver/README.md).
 
 ## Routes
 
-| Path | Slug + lang | Title fallback (when block empty) |
+| Path | Slug + locale | Title fallback (when block empty) |
 |---|---|---|
 | `GET /legal/impressum` | `imprint` / `de` | "Impressum" |
 | `GET /legal/datenschutz` | `privacy` / `de` | "Datenschutzerklärung" |
@@ -64,12 +65,12 @@ See [text-content/README.md](../text-content/README.md#production-table-setup).
 | `GET /legal/privacy` | `privacy` / `en` | "Privacy Policy" |
 
 Response:
-- `200 text/html` — block exists + has body. Cache header `public, max-age=300`.
+- `200 text/html` — block exists + has content. Cache header `public, max-age=300`.
 - `404 text/plain` — block missing. Hint: "Tenant admin must set this text block".
 - `503 text/plain` — `app.fetch` to `/api/query` failed (anonymousAccess missing?).
 
 Layout: a minimal HTML5 skeleton with inline CSS — apps that want to
-integrate into their own layout use `text-content:query:by-slug`
+integrate into their own layout use `template-resolver:query:by-slug`
 directly and render themselves.
 
 ---
@@ -79,7 +80,7 @@ directly and render themselves.
 `r.job` with `runOnBoot: true` checks at app start whether the DE
 required blocks exist in SYSTEM_TENANT:
 
-| Slug + lang | What happens when missing |
+| Slug + locale | What happens when missing |
 |---|---|
 | `imprint` / `de` | **Production:** `throw new Error(...)` blocks app start. **Dev:** `ctx.log.warn(...)` |
 | `privacy` / `de` | as above |
@@ -104,18 +105,18 @@ await fetch("/api/write", {
   method: "POST",
   headers: { "Content-Type": "application/json", Authorization: `Bearer ${jwt}` },
   body: JSON.stringify({
-    type: "text-content:write:set",
+    type: "template-resolver:write:set",
     payload: {
       slug: "imprint",
-      lang: "de",
+      locale: "de",
       title: "Impressum",
-      body: "## Angaben gemäß § 5 TMG\n\n...",
+      content: "## Angaben gemäß § 5 TMG\n\n...",
     },
   }),
 });
 ```
 
-→ Idempotent: a second call with the same `(slug, lang)` updates the block.
+→ Idempotent: a second call with the same `(slug, locale)` updates the block.
 ACL: `roles: ["TenantAdmin", "SystemAdmin"]` — SystemAdmin (a global
 role) may set SYSTEM_TENANT texts, TenantAdmin only tenant-owned ones.
 
@@ -128,15 +129,15 @@ instant visibility, you can help things along with a CDN purge.
 On first app boot or via migration:
 
 ```typescript
-import { seedTextBlock } from "@cosmicdrift/kumiko-bundled-features/text-content/seeding";
+import { seedTextBlock } from "@cosmicdrift/kumiko-bundled-features/template-resolver/seeding";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 await seedTextBlock(db, {
   tenantId: SYSTEM_TENANT_ID,
   slug: "imprint",
-  lang: "de",
+  locale: "de",
   title: "Impressum",
-  body: `## Angaben gemäß § 5 TMG
+  content: `## Angaben gemäß § 5 TMG
 
 **Marc Frost**
 
@@ -181,7 +182,7 @@ no DOMPurify dependency needed:
 Kumiko app share the SYSTEM_TENANT version of the legal pages. If you
 need per-tenant imprints (rare — typical case: the platform operator
 is the responsible party, not the tenant customer), call
-text-content's by-slug query directly with a tenant-specific TenantId
+the by-slug query directly with a tenant-specific TenantId
 and put your own routes in front.
 
 ---