@cosmicdrift/kumiko-bundled-features 0.176.1 → 0.176.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.176.1",
+  "version": "0.176.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -120,12 +120,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.176.1",
-    "@cosmicdrift/kumiko-framework": "0.176.1",
-    "@cosmicdrift/kumiko-headless": "0.176.1",
-    "@cosmicdrift/kumiko-renderer": "0.176.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.176.1",
-    "@cosmicdrift/kumiko-types": "0.176.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.176.2",
+    "@cosmicdrift/kumiko-framework": "0.176.2",
+    "@cosmicdrift/kumiko-headless": "0.176.2",
+    "@cosmicdrift/kumiko-renderer": "0.176.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.176.2",
+    "@cosmicdrift/kumiko-types": "0.176.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/handlers/login.write.ts

@@ -86,19 +86,21 @@ function ok<T>(value: T): GateOk<T> {
   return { ok: true, value };
 }
 
+type AuthenticatableUserRow = AuthUserRow & { readonly passwordHash: string };
+
 /** Uniform response on any credential miss — burns argon2 cost (#774). */
 export async function gateResolveAuthUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
   email: string,
   password: string,
-): Promise<GateOutcome<AuthUserRow>> {
+): Promise<GateOutcome<AuthenticatableUserRow>> {
   const found = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email }));
   if (!found?.passwordHash || found.isDeleted) {
     await verifyDummyPassword(password);
     return reject(invalidCredentials());
   }
-  return ok(found);
+  return ok({ ...found, passwordHash: found.passwordHash });
 }
 
 /**
@@ -124,14 +126,12 @@ export async function gateEnforceLockout(
 /** Verify password; record miss / clear lockout on hit. */
 export async function gateVerifyPassword(
   ctx: HandlerContext,
-  found: AuthUserRow,
+  found: AuthenticatableUserRow,
   password: string,
   maxFailedAttempts: number,
   lockoutDurationMinutes: number,
 ): Promise<GateOutcome<undefined>> {
-  const passwordHash = found.passwordHash;
-  if (!passwordHash) return reject(invalidCredentials());
-  const passwordOk = await verifyPassword(passwordHash, password);
+  const passwordOk = await verifyPassword(found.passwordHash, password);
   if (!passwordOk) {
     if (ctx.redis) {
       await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);

package/src/config/__tests__/tz-resolution.integration.test.ts

@@ -88,8 +88,13 @@ describe("buildHandlerContext ctx.tz resolution", () => {
   });
 
   test("ctx.tz.user reads SessionUser.timezone independently of tenant", async () => {
-    // Same tenant as the previous test (Europe/Berlin already set) — proves
-    // user overrides without needing to touch tenant config.
+    const admin = createTestUser({ id: 13, roles: ["Admin"] });
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Europe/Berlin" },
+      admin,
+    );
+
     const user = createTestUser({ id: 12, timezone: "Asia/Tokyo" });
     const res = await stack.http.writeOk<{ tenant: string; user: string }>(
       "probe:write:read-tz",

package/src/jobs/__tests__/jobs-catalog.integration.test.ts

@@ -1,39 +1,22 @@
 // Catalog + trigger hardening for #1602 — manual-only surface.
+// Real HTTP via setupTestStack — no mocks, mirrors jobs-security.integration.test.ts.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { buildServer, type JwtHelper } from "@cosmicdrift/kumiko-framework/api";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  createRegistry,
-  defineFeature,
-  type SessionUser,
-} from "@cosmicdrift/kumiko-framework/engine";
-import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { createJobRunner, type JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
-import {
-  createTestDb,
-  createTestRedis,
-  type TestDb,
-  type TestRedis,
+  setupTestStack,
+  type TestStack,
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import type { Hono } from "hono";
 import { z } from "zod";
 import { JobErrors, JobHandlers, JobQueries } from "../constants";
 import { createJobsFeature } from "../feature";
-import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
-let testDb: TestDb;
-let testRedis: TestRedis;
-let db: DbConnection;
-let app: Hono;
-let jwt: JwtHelper;
-let jobRunner: JobRunner;
+let stack: TestStack;
 
 const systemAdmin = TestUsers.systemAdmin;
-const JWT_SECRET = "test-jwt-secret-for-jobs-catalog-32chars!!";
 
 const appFeature = defineFeature("catalog-app", (r) => {
   r.job(
@@ -45,115 +28,70 @@ const appFeature = defineFeature("catalog-app", (r) => {
 });
 
 beforeAll(async () => {
-  testDb = await createTestDb();
-  testRedis = await createTestRedis();
-  db = testDb.db;
-
-  const registry = createRegistry([appFeature, createJobsFeature()]);
-  await unsafePushTables(db, { jobRunsTable, jobRunLogsTable });
-  await createEventsTable(db);
-
-  const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
-  const logger = createJobRunLogger({ db, registry });
-  jobRunner = createJobRunner({
-    registry,
-    context: { db },
-    redisUrl,
-    consumerLane: "worker",
-    queueNamePrefix: `kumiko-jobs-catalog-test-${Date.now()}`,
-    ...logger,
+  stack = await setupTestStack({
+    features: [appFeature, createJobsFeature()],
+    jobs: { consumerLane: "worker", queueNamePrefix: `kumiko-jobs-catalog-test-${Date.now()}` },
   });
-  const context = { db, registry, jobRunner };
-  const server = buildServer({ registry, context, jwtSecret: JWT_SECRET });
-  app = server.app;
-  jwt = server.jwt;
-
-  await jobRunner.start();
+  await unsafePushTables(stack.db, { jobRunsTable, jobRunLogsTable });
 });
 
 afterAll(async () => {
-  await jobRunner.stop();
-  await testDb.cleanup();
-  await testRedis.cleanup();
+  await stack.cleanup();
 });
 
-async function req(
-  method: string,
-  path: string,
-  user: SessionUser,
-  body?: unknown,
-): Promise<Response> {
-  const token = await jwt.sign(user);
-  const init: RequestInit = {
-    method,
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-  };
-  if (body) init.body = JSON.stringify(body);
-  return app.request(path, init);
-}
-
-async function write(user: SessionUser, type: string, payload: unknown) {
-  const res = await req("POST", "/api/write", user, { type, payload });
-  return res.json();
-}
-
-async function query(user: SessionUser, type: string, payload: unknown) {
-  const res = await req("POST", "/api/query", user, { type, payload });
-  const body = await res.json();
-  if (res.status !== 200) {
-    throw new Error(`query ${type} → ${res.status}: ${JSON.stringify(body)}`);
-  }
-  return body;
-}
-
 describe("jobs:query:catalog", () => {
   test("lists only manual jobs including framework builtins", async () => {
-    const result = await query(systemAdmin, JobQueries.catalog, {});
     type CatalogRow = {
       readonly jobName: string;
       readonly perTenant: boolean;
       readonly payloadSchema: Record<string, unknown> | null;
     };
-    const rows = (result.data as { rows: readonly CatalogRow[] }).rows;
-    const names = rows.map((r) => r.jobName);
+    const result = await stack.http.queryOk<{ rows: readonly CatalogRow[] }>(
+      JobQueries.catalog,
+      {},
+      systemAdmin,
+    );
+    const names = result.rows.map((r) => r.jobName);
     expect(names).toContain("catalog-app:job:manual-echo");
     expect(names).toContain("jobs:job:reindex-entity");
     expect(names).toContain("jobs:job:projection-rebuild");
     expect(names).not.toContain("catalog-app:job:cron-only");
 
-    const echo = rows.find((r) => r.jobName === "catalog-app:job:manual-echo");
+    const echo = result.rows.find((r) => r.jobName === "catalog-app:job:manual-echo");
     expect(echo).toBeDefined();
     expect(echo?.payloadSchema).not.toBeNull();
 
-    const reindex = rows.find((r) => r.jobName === "jobs:job:reindex-entity");
+    const reindex = result.rows.find((r) => r.jobName === "jobs:job:reindex-entity");
     expect(reindex?.perTenant).toBe(true);
   });
 });
 
 describe("jobs:write:trigger hardening", () => {
   test("rejects cron-only jobs", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:cron-only",
-    });
-    expect(result.isSuccess).toBe(false);
-    expect(result.error?.code).toBe("unprocessable");
-    expect(result.error?.details).toMatchObject({ reason: JobErrors.notManual });
+    const err = await stack.http.writeErr(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:cron-only" },
+      systemAdmin,
+    );
+    expect(err.code).toBe("unprocessable");
+    expect(err.details).toMatchObject({ reason: JobErrors.notManual });
   });
 
   test("rejects invalid payload against job schema", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:manual-echo",
-      payload: {},
-    });
-    expect(result.isSuccess).toBe(false);
-    expect(result.error?.code).toBe("validation_error");
+    const err = await stack.http.writeErr(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:manual-echo", payload: {} },
+      systemAdmin,
+    );
+    expect(err.code).toBe("validation_error");
   });
 
   test("accepts valid schema payload", async () => {
-    const result = await write(systemAdmin, JobHandlers.trigger, {
-      jobName: "catalog-app:job:manual-echo",
-      payload: { entity: "credit" },
-    });
-    expect(result.isSuccess).toBe(true);
+    const result = await stack.http.writeOk<{ jobName: string; bullJobId: string }>(
+      JobHandlers.trigger,
+      { jobName: "catalog-app:job:manual-echo", payload: { entity: "credit" } },
+      systemAdmin,
+    );
+    expect(result.jobName).toBe("catalog-app:job:manual-echo");
   });
 });

package/src/jobs/web/job-runs-screen.tsx

@@ -86,6 +86,16 @@ export function JobRunsScreen(): ReactNode {
       ? JSON.stringify(selected.payloadSchema, null, 2)
       : null;
 
+  // Switching jobs invalidates any typed payload/messages against the new
+  // job's schema — reset so a submit can't validate stale payload text
+  // against the wrong job.
+  const handleJobNameChange = (name: string): void => {
+    setJobName(name);
+    setPayloadText("{}");
+    setClientError(null);
+    setSuccessMessage(null);
+  };
+
   const onTrigger = async (): Promise<void> => {
     setClientError(null);
     setSuccessMessage(null);
@@ -168,7 +178,7 @@ export function JobRunsScreen(): ReactNode {
                 id="job-trigger-name"
                 name="job-trigger-name"
                 value={jobName}
-                onChange={setJobName}
+                onChange={handleJobNameChange}
                 options={jobOptions}
               />
             </Field>

package/src/template-resolver/web/__tests__/editor-read-only.test.tsx

@@ -12,6 +12,7 @@ import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
 import { act, fireEvent, render, screen } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { textBlocksClient } from "../client-plugin";
+import { defaultTranslations } from "../i18n";
 
 mock.module("@cosmicdrift/kumiko-bundled-features/auth-email-password/web", () => ({
   useShellUser: mock(),
@@ -50,11 +51,22 @@ function getEditor() {
   return Editor;
 }
 
-const localeResolver = createStaticLocaleResolver();
+const localeResolver = createStaticLocaleResolver({ locale: "de" });
 
 function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
   return (
-    <LocaleProvider resolver={localeResolver}>
+    <LocaleProvider resolver={localeResolver} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+function EnglishWrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider
+      resolver={createStaticLocaleResolver({ locale: "en" })}
+      fallbackBundles={[defaultTranslations]}
+    >
       <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
     </LocaleProvider>
   );
@@ -115,6 +127,19 @@ describe("TextContentEditor — role-based write-access", () => {
   });
 });
 
+describe("TextContentEditor — en locale", () => {
+  test("TenantAdmin sieht englische Labels statt hartcodiertem Deutsch (#1754)", () => {
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useShellUser as any).mockReturnValue({ id: "u1", roles: ["TenantAdmin"] });
+    const Editor = getEditor();
+    render(<Editor target={TARGET} onClose={() => {}} />, { wrapper: EnglishWrapper });
+
+    expect(screen.getByRole("button", { name: /^save$/i })).toBeTruthy();
+    expect(screen.getByLabelText(/title/i)).toBeTruthy();
+    expect(screen.getByLabelText(/content/i)).toBeTruthy();
+  });
+});
+
 describe("TextContentEditor — handleSave", () => {
   test("reicht das geladene folder unverändert an den Write-Payload durch (#898)", async () => {
     // biome-ignore lint/suspicious/noExplicitAny: Bun mock function

package/src/template-resolver/web/client-plugin.tsx

@@ -17,10 +17,16 @@ import type {
   TreeChildrenSubscribe,
   TreeNode,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { useDispatcher, usePrimitives, useQuery } from "@cosmicdrift/kumiko-renderer";
+import {
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
 import { type FormEvent, type ReactNode, useEffect, useState } from "react";
 import { TemplateResolverHandlers, TemplateResolverQueries } from "../qualified-names";
+import { defaultTranslations } from "./i18n";
 
 // Exported for the unit test — groupBlocksByFolder is a pure function.
 export type BlockSummary = {
@@ -211,6 +217,7 @@ function TextBlockEditor({
   const { Form, Field, Input, Button, Banner } = usePrimitives();
   const dispatcher = useDispatcher();
   const user = useShellUser();
+  const t = useTranslation();
   const canWrite =
     user?.roles.includes("TenantAdmin") === true || user?.roles.includes("SystemAdmin") === true;
 
@@ -254,14 +261,20 @@ function TextBlockEditor({
         ...(tenantIdOverride !== undefined && { tenantIdOverride }),
       });
       if (result.isSuccess) {
-        setSavedMsg(result.data.isNew ? "Neu angelegt." : "Gespeichert.");
+        setSavedMsg(
+          result.data.isNew
+            ? t("template-resolver.editor.created")
+            : t("template-resolver.editor.saved"),
+        );
         return;
       }
-      setSaveError(result.error.message ?? result.error.code ?? "Speichern fehlgeschlagen.");
+      setSaveError(
+        result.error.message ?? result.error.code ?? t("template-resolver.editor.saveFailed"),
+      );
     } catch (e) {
       // Network blip / dispatcher throw — otherwise submitting stays true and
       // the save button is locked forever with no feedback.
-      setSaveError(e instanceof Error ? e.message : "Netzwerkfehler beim Speichern.");
+      setSaveError(e instanceof Error ? e.message : t("template-resolver.editor.networkError"));
     } finally {
       setSubmitting(false);
     }
@@ -283,21 +296,21 @@ function TextBlockEditor({
       actions={
         canWrite ? (
           <Button type="submit" loading={submitting} disabled={disabled}>
-            {submitting ? "Speichern…" : "Speichern"}
+            {submitting ? t("template-resolver.editor.saving") : t("template-resolver.editor.save")}
           </Button>
         ) : undefined
       }
     >
-      {loading && <Banner variant="loading">Lädt aktuellen Stand…</Banner>}
+      {loading && <Banner variant="loading">{t("template-resolver.editor.loading")}</Banner>}
       {loadError !== null && (
-        <Banner variant="error">Konnte Block nicht laden: {loadError.code}</Banner>
+        <Banner variant="error">
+          {t("template-resolver.editor.loadFailed")}: {loadError.code}
+        </Banner>
       )}
       {!canWrite && !loading && (
-        <Banner variant="info">
-          Read-only — TenantAdmin- oder SystemAdmin-Rolle f&uuml;r &Auml;nderungen erforderlich.
-        </Banner>
+        <Banner variant="info">{t("template-resolver.editor.readOnly")}</Banner>
       )}
-      <Field id="text-block-title" label="Titel" required>
+      <Field id="text-block-title" label={t("template-resolver.editor.titleLabel")} required>
         <Input
           kind="text"
           id="text-block-title"
@@ -308,7 +321,7 @@ function TextBlockEditor({
           required
         />
       </Field>
-      <Field id="text-block-content" label="Inhalt">
+      <Field id="text-block-content" label={t("template-resolver.editor.contentLabel")}>
         <Input
           kind="textarea"
           id="text-block-content"
@@ -348,5 +361,6 @@ export function textBlocksClient(opts?: {
     resolvers: {
       "template-resolver:edit": TextBlockEditor,
     },
+    translations: defaultTranslations,
   };
 }

package/src/template-resolver/web/i18n.ts

@@ -0,0 +1,39 @@
+// @runtime client
+// Default translation bundle for the text-block editor. textBlocksClient()
+// hangs it into the LocaleProvider as a fallback bundle — apps override
+// individual keys via mergeTranslations at the createKumikoApp level.
+//
+// Keys follow `template-resolver.editor.<slug>`.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+
+export const defaultTranslations: TranslationsByLocale = {
+  de: {
+    "template-resolver.editor.titleLabel": "Titel",
+    "template-resolver.editor.contentLabel": "Inhalt",
+    "template-resolver.editor.save": "Speichern",
+    "template-resolver.editor.saving": "Speichern…",
+    "template-resolver.editor.created": "Neu angelegt.",
+    "template-resolver.editor.saved": "Gespeichert.",
+    "template-resolver.editor.saveFailed": "Speichern fehlgeschlagen.",
+    "template-resolver.editor.networkError": "Netzwerkfehler beim Speichern.",
+    "template-resolver.editor.loading": "Lädt aktuellen Stand…",
+    "template-resolver.editor.loadFailed": "Konnte Block nicht laden",
+    "template-resolver.editor.readOnly":
+      "Read-only — TenantAdmin- oder SystemAdmin-Rolle für Änderungen erforderlich.",
+  },
+  en: {
+    "template-resolver.editor.titleLabel": "Title",
+    "template-resolver.editor.contentLabel": "Content",
+    "template-resolver.editor.save": "Save",
+    "template-resolver.editor.saving": "Saving…",
+    "template-resolver.editor.created": "Created.",
+    "template-resolver.editor.saved": "Saved.",
+    "template-resolver.editor.saveFailed": "Save failed.",
+    "template-resolver.editor.networkError": "Network error while saving.",
+    "template-resolver.editor.loading": "Loading current version…",
+    "template-resolver.editor.loadFailed": "Could not load block",
+    "template-resolver.editor.readOnly":
+      "Read-only — TenantAdmin or SystemAdmin role required to make changes.",
+  },
+};

package/src/tenant/__tests__/tenant-timezone-boot.integration.test.ts

@@ -0,0 +1,60 @@
+// Regression guard for fw#1648: dispatch-shared.ts hardcodes the literal
+// "tenant:config:timezone" (TENANT_TIMEZONE_CONFIG_KEY) since framework/pipeline
+// can't import the bundled `tenant` feature. tz-resolution.integration.test.ts
+// exercises that literal against a standalone probe feature, which can't see a
+// drift to the REAL tenant feature's key name — this test boots the actual
+// createTenantFeature() instead.
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { createConfigAccessorFactory, createConfigFeature } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../feature";
+
+const probeFeature = defineFeature("tz-probe", (r) => {
+  r.requires("tenant");
+  r.writeHandler(
+    "read-tz",
+    z.object({}),
+    async (_event, ctx) => ({ isSuccess: true, data: { tenant: ctx.tz.tenant } }),
+    { access: { openToAll: true } },
+  );
+});
+
+describe("ctx.tz.tenant against the real tenant feature (fw#1648)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    stack = await setupTestStack({
+      features: [createConfigFeature(), createTenantFeature(), probeFeature],
+      extraContext: ({ registry }) => ({
+        configResolver: resolver,
+        _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+      }),
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("ctx.tz.tenant reflects tenant:config:timezone set via the real tenant feature", async () => {
+    const admin = createTestUser({ id: 20, roles: ["Admin"] });
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Asia/Tokyo" },
+      admin,
+    );
+    const res = await stack.http.writeOk<{ tenant: string }>("tz-probe:write:read-tz", {}, admin);
+    expect(res.tenant).toBe("Asia/Tokyo");
+  });
+});