@cosmicdrift/kumiko-bundled-features 0.192.0 → 0.193.0

package/src/template-resolver/web/client-plugin.tsx

@@ -256,10 +256,30 @@ type TextBlock = {
   readonly locale: string;
   readonly title: string | null;
   readonly content: string | null;
+  readonly contentFormat: string;
   readonly folder: string | null;
   readonly updatedAt: string;
 };
 
+// The collection's declared contentFormat ("plain" | "rich" | "markdown",
+// see ContentCollectionDefinition.contentFormat) uses a different vocabulary
+// than the stored entry's contentFormat ("plain" | "html" | "markdown" |
+// "mjml", see CONTENT_FORMATS) — "rich" always stores HTML. Without this,
+// handleSave omitting contentFormat let the write schema's
+// contentFormatSchema.default("markdown") silently stamp every save as
+// markdown, clobbering e.g. a "plain" entry. Undefined (no collection, or
+// the collection didn't declare a format) keeps whatever was already saved
+// instead of guessing.
+function resolveWriteContentFormat(
+  collectionContentFormat: string | undefined,
+  loadedContentFormat: string | undefined,
+): string | undefined {
+  if (collectionContentFormat === "plain") return "plain";
+  if (collectionContentFormat === "rich") return "html";
+  if (collectionContentFormat === "markdown") return "markdown";
+  return loadedContentFormat;
+}
+
 type SetResponse = { readonly slug: string; readonly locale: string; readonly isNew: boolean };
 
 function TextBlockEditor({
@@ -337,12 +357,14 @@ function TextBlockEditor({
     setSaveError(null);
     setSavedMsg(null);
     try {
+      const resolvedContentFormat = resolveWriteContentFormat(contentFormat, loaded?.contentFormat);
       const result = await dispatcher.write<SetResponse>(writeHandler, {
         slug,
         locale,
         title,
         content: content.length > 0 ? content : null,
         folder: loaded?.folder ?? null,
+        ...(resolvedContentFormat !== undefined && { contentFormat: resolvedContentFormat }),
         ...(tenantIdOverride !== undefined && { tenantIdOverride }),
       });
       if (result.isSuccess) {

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -98,13 +98,28 @@ export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strate
     }
   }
 
-  const inviterRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
-    tenantId: ctx.tenantId,
-    invitedBy: ctx.userId,
-  });
-  for (const row of inviterRows) {
+  // `invitedBy` has no `lookupable`/blind-index column — it's ciphertext
+  // under an active KMS, so `{ invitedBy: ctx.userId }` would compare a
+  // plaintext userId against an encrypted column and always match zero
+  // rows. Load every invitation in the tenant instead (small per-tenant
+  // row count) and decrypt `invitedBy` per row to find this user's own
+  // invites-sent. See tenant/handlers/invitations.query.ts for the same
+  // decrypt-on-read pattern.
+  const tenantInvitations = await selectMany<Record<string, unknown>>(
+    ctx.db,
+    tenantInvitationsTable,
+    { tenantId: ctx.tenantId },
+  );
+  for (const row of tenantInvitations) {
     const id = row["id"]; // @cast-boundary db-row
-    if (typeof id !== "string") continue;
+    const invitedByRaw = row["invitedBy"];
+    if (typeof id !== "string" || typeof invitedByRaw !== "string") continue;
+    const invitedBy = await decryptStoredPii(
+      invitedByRaw,
+      "invitedBy",
+      "user-data-rights:invitation-hook",
+    );
+    if (invitedBy !== ctx.userId) continue;
     await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, tdb, {
       skipOptimisticLock: true,
     });