@cosmicdrift/kumiko-bundled-features 0.215.6 → 0.215.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.215.6",
+  "version": "0.215.7",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.215.6",
-    "@cosmicdrift/kumiko-framework": "0.215.6",
-    "@cosmicdrift/kumiko-headless": "0.215.6",
-    "@cosmicdrift/kumiko-renderer": "0.215.6",
-    "@cosmicdrift/kumiko-renderer-web": "0.215.6",
-    "@cosmicdrift/kumiko-types": "0.215.6",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.215.7",
+    "@cosmicdrift/kumiko-framework": "0.215.7",
+    "@cosmicdrift/kumiko-headless": "0.215.7",
+    "@cosmicdrift/kumiko-renderer": "0.215.7",
+    "@cosmicdrift/kumiko-renderer-web": "0.215.7",
+    "@cosmicdrift/kumiko-types": "0.215.7",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.215.6"
+    "@cosmicdrift/kumiko-locale-de": "0.215.7",
+    "@cosmicdrift/kumiko-locale-es": "0.215.7"
   }
 }

package/src/cap-counter/__tests__/cap-list.boot.test.ts

@@ -11,6 +11,10 @@ describe("cap-counter list screen + handler access alignment", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("cap-list nav declares icon gauge", () => {
+    expect(capCounterFeature.navs["cap-list"]?.icon).toBe("gauge");
+  });
+
   test("cap-list screen is entityList, SystemAdmin-gated", () => {
     const screen = capCounterFeature.screens[CAP_COUNTER_LIST_SCREEN_ID];
     expect(screen?.type).toBe("entityList");

package/src/cap-counter/feature.ts

@@ -110,6 +110,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: "cap-list",
     label: "cap-counter:nav.cap-list",
     screen: "cap-counter:screen:cap-list",
+    icon: "gauge",
     order: 60,
   });
   r.translations({

package/src/delivery/__tests__/delivery-security.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { insertMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
   setupTestStack,
@@ -105,6 +105,144 @@ describe("delivery log tenant isolation", () => {
   });
 });
 
+describe("delivery log SystemAdmin cross-tenant scope", () => {
+  // Platform waitlist confirmations are dispatched under SYSTEM_TENANT_ID
+  // (anonymous submit). SystemAdmin must see those rows even when their
+  // session tenant is a demo tenant; TenantAdmin must not.
+  const WAITLIST_CONFIRMATION = "waitlist:notify:confirmation";
+
+  test("SystemAdmin sees waitlist confirmation under SYSTEM_TENANT_ID and other tenants, with tenantId on each row", async () => {
+    const demoTenant = testTenantId(51);
+    const otherTenant = testTenantId(52);
+    const systemConfirmationId = crypto.randomUUID();
+    const demoActivationId = crypto.randomUUID();
+    const otherTenantId = crypto.randomUUID();
+    const failedConfirmationId = crypto.randomUUID();
+
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: systemConfirmationId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: failedConfirmationId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "failed",
+        error: "smtp down",
+      },
+      {
+        id: demoActivationId,
+        tenantId: demoTenant,
+        notificationType: "auth-email-password:signup-activation",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: otherTenantId,
+        tenantId: otherTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    // Session on demo tenant — mirrors SystemAdmin browsing a tenant panel.
+    const systemAdmin = createTestUser({
+      id: 51,
+      roles: ["SystemAdmin"],
+      tenantId: demoTenant,
+    });
+    const res = await stack.http.queryOk<{
+      rows: readonly {
+        id: string;
+        tenantId: string;
+        type: string;
+        status: string;
+        error: string | null;
+      }[];
+    }>(DeliveryQueries.log, {}, systemAdmin);
+
+    const byId = new Map(res.rows.map((r) => [r.id, r]));
+    expect(byId.get(systemConfirmationId)?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(byId.get(systemConfirmationId)?.type).toBe(WAITLIST_CONFIRMATION);
+    expect(byId.get(demoActivationId)?.tenantId).toBe(demoTenant);
+    expect(byId.get(otherTenantId)?.tenantId).toBe(otherTenant);
+
+    const failed = byId.get(failedConfirmationId);
+    expect(failed?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(failed?.type).toBe(WAITLIST_CONFIRMATION);
+    // Failure path: confirmation delivery errors must surface in the log so
+    // SystemAdmin can diagnose SMTP/channel outages (status=failed).
+    expect(failed?.status).toBe("failed");
+
+    expect(res.rows.every((r) => typeof r.tenantId === "string" && r.tenantId.length > 0)).toBe(
+      true,
+    );
+  });
+
+  test("TenantAdmin cannot read SYSTEM_TENANT_ID or foreign-tenant delivery attempts", async () => {
+    const demoTenant = testTenantId(61);
+    const otherTenant = testTenantId(62);
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: crypto.randomUUID(),
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: WAITLIST_CONFIRMATION,
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: crypto.randomUUID(),
+        tenantId: otherTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: crypto.randomUUID(),
+        tenantId: demoTenant,
+        notificationType: "welcome",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    const tenantAdmin = createTestUser({
+      id: 61,
+      roles: ["TenantAdmin"],
+      tenantId: demoTenant,
+    });
+    const res = await stack.http.queryOk<{ rows: readonly { tenantId: string }[] }>(
+      DeliveryQueries.log,
+      {},
+      tenantAdmin,
+    );
+
+    expect(res.rows.length).toBeGreaterThan(0);
+    expect(res.rows.every((r) => r.tenantId === demoTenant)).toBe(true);
+    expect(res.rows.some((r) => r.tenantId === SYSTEM_TENANT_ID)).toBe(false);
+    expect(res.rows.some((r) => r.tenantId === otherTenant)).toBe(false);
+  });
+
+  test("tenant User cannot query delivery log (negative authz)", async () => {
+    const demoTenant = testTenantId(71);
+    const user = createTestUser({ id: 71, roles: ["User"], tenantId: demoTenant });
+    expect((await stack.http.query(DeliveryQueries.log, {}, user)).status).toBe(403);
+  });
+});
+
 describe("delivery preferences tenant isolation", () => {
   // A userId is not tenant-unique — the same person can be a member of
   // several tenants (tenant:write:add-member takes {userId, tenantId}).

package/src/delivery/feature.ts

@@ -143,6 +143,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
       type: "projectionList",
       query: DeliveryQueries.log,
       columns: [
+        { field: "tenantId", label: "delivery.log.col.tenantId" },
         { field: "type", label: "delivery.log.col.type" },
         { field: "channel", label: "delivery.log.col.channel" },
         { field: "recipient", label: "delivery.log.col.recipient" },

package/src/delivery/handlers/log.query.ts

@@ -81,8 +81,15 @@ export const logQuery = definePagedQueryHandler({
     // delivery is r.systemScope()'d, so the TenantDb is system-mode (reads
     // unfiltered). assertTenantMatch is a self-check on the caller's own
     // tenantId, not a query filter — it returns that same unfiltered db, so
-    // the explicit `where` below still does the actual tenant scoping.
-    const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+    // the explicit `where` below still does the actual tenant scoping for
+    // non-SystemAdmin callers. SystemAdmin acknowledges cross-tenant read
+    // (PII-bearing delivery logs across all tenants incl. SYSTEM_TENANT_ID).
+    const isSystemAdmin = query.user.roles.includes("SystemAdmin");
+    const db = isSystemAdmin
+      ? ctx.systemDb.acknowledgeCrossTenant(
+          "SystemAdmin reads delivery attempts across all tenants including SYSTEM_TENANT_ID",
+        )
+      : ctx.systemDb.assertTenantMatch(query.user.tenantId);
 
     const requestedSort = query.payload.sort;
     const sortField: DeliveryLogSortField =
@@ -92,7 +99,9 @@ export const logQuery = definePagedQueryHandler({
     const sortDirection = query.payload.sortDirection ?? "desc";
     const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
 
-    const where: WhereObject = { tenantId: query.user.tenantId };
+    // TenantAdmin/Admin stay strictly tenant-scoped; SystemAdmin sees every
+    // tenant's attempts (platform waitlist confirmations live on SYSTEM_TENANT_ID).
+    const where: WhereObject = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
     if (query.payload.cursor) {
       where[sortColumn] = {
         [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),

package/src/delivery/i18n.ts

@@ -3,6 +3,7 @@ type LocalizedString = { readonly en: string };
 export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:delivery-log.title": { en: "Delivery log" },
   "delivery:nav.deliveryLog": { en: "Delivery" },
+  "delivery.log.col.tenantId": { en: "Tenant" },
   "delivery.log.col.type": { en: "Type" },
   "delivery.log.col.channel": { en: "Channel" },
   "delivery.log.col.recipient": { en: "Recipient" },

package/src/jobs/is-manual-trigger.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, test } from "bun:test";
+import { isManualTrigger } from "./is-manual-trigger";
+
+describe("isManualTrigger", () => {
+  test("manual trigger → true", () => {
+    expect(isManualTrigger({ manual: true })).toBe(true);
+  });
+
+  test("cron trigger → false", () => {
+    expect(isManualTrigger({ cron: "*/5 * * * *" })).toBe(false);
+  });
+
+  test("event trigger → false", () => {
+    expect(isManualTrigger({ on: "entity.created" })).toBe(false);
+    expect(isManualTrigger({ on: ["entity.created", "entity.updated"] })).toBe(false);
+  });
+});

package/src/shared/session-locale-field.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, test } from "bun:test";
+import { sessionLocaleField } from "./session-locale-field";
+
+describe("sessionLocaleField", () => {
+  test("set locale → { locale }", () => {
+    expect(sessionLocaleField("de-DE")).toEqual({ locale: "de-DE" });
+  });
+
+  test("null locale → empty object", () => {
+    expect(sessionLocaleField(null)).toEqual({});
+  });
+
+  test("undefined locale → empty object", () => {
+    expect(sessionLocaleField(undefined)).toEqual({});
+  });
+});

package/src/shared/session-timezone-field.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, test } from "bun:test";
+import { sessionTimezoneField } from "./session-timezone-field";
+
+describe("sessionTimezoneField", () => {
+  test("set timezone → { timezone }", () => {
+    expect(sessionTimezoneField("Europe/Berlin")).toEqual({ timezone: "Europe/Berlin" });
+  });
+
+  test("null timezone → empty object", () => {
+    expect(sessionTimezoneField(null)).toEqual({});
+  });
+
+  test("undefined timezone → empty object", () => {
+    expect(sessionTimezoneField(undefined)).toEqual({});
+  });
+});

package/src/tenant/__tests__/members-facet-i18n.test.ts

@@ -0,0 +1,72 @@
+// fw#2376: the Members facet labels are i18n keys that the renderer resolves
+// through translate() (fw#2373). A key missing from a locale pack resolves to
+// nothing and the raw key ("tenant.members.filter.status") ends up in the UI —
+// which is exactly what shipping translate() without the es/de entries did.
+// The keys are read off the live screen definition instead of being hardcoded,
+// so adding a facet option without translating it fails here rather than in
+// production.
+import { describe, expect, test } from "bun:test";
+import { localeDeBundle } from "@cosmicdrift/kumiko-locale-de";
+import { localeEsBundle } from "@cosmicdrift/kumiko-locale-es";
+import { MEMBERS_SCREEN_ID } from "../constants";
+import { createTenantFeature } from "../feature";
+
+function membersFacetLabelKeys(): readonly string[] {
+  const screen = createTenantFeature().screens[MEMBERS_SCREEN_ID];
+  if (screen?.type !== "projectionList") {
+    throw new Error("expected members screen to be projectionList");
+  }
+  return (screen.facets ?? []).flatMap((facet) =>
+    facet.type === "select"
+      ? [facet.label, ...facet.options.map((option) => option.label)]
+      : [facet.label, facet.trueLabel, facet.falseLabel],
+  );
+}
+
+const facetKeys = membersFacetLabelKeys();
+
+const localePacks: ReadonlyArray<readonly [string, Readonly<Record<string, string>>]> = [
+  ["es", localeEsBundle],
+  ["de", localeDeBundle],
+];
+
+describe("members status filter labels are localized in every shipped locale (fw#2376)", () => {
+  test("the status facet ships the keys the locale packs have to cover", () => {
+    expect(facetKeys).toEqual([
+      "tenant.members.filter.status",
+      "tenant.members.filter.status.option.active",
+      "tenant.members.filter.status.option.pending",
+    ]);
+  });
+
+  test("every facet label has English copy in the tenant feature itself", () => {
+    const translations = createTenantFeature().translations ?? {};
+    for (const key of facetKeys) {
+      const label = translations[key]?.["en"];
+      expect(label).toBeString();
+      expect(label).not.toBe(key);
+      expect((label ?? "").trim()).not.toBe("");
+    }
+  });
+
+  for (const [locale, bundle] of localePacks) {
+    test(`every facet label resolves to a localized string in ${locale}`, () => {
+      for (const key of facetKeys) {
+        const label = bundle[key];
+        expect(label).toBeString();
+        expect(label).not.toBe(key);
+        expect((label ?? "").trim()).not.toBe("");
+      }
+    });
+  }
+
+  // Presence alone would still pass if a pack copied the English string in,
+  // which is the failure mode a "did you actually translate it" check has to
+  // catch for the two option labels users read in the dropdown.
+  test("the option labels are real translations, not the English copy", () => {
+    expect(localeEsBundle["tenant.members.filter.status.option.active"]).toBe("Activo");
+    expect(localeEsBundle["tenant.members.filter.status.option.pending"]).toBe("Pendiente");
+    expect(localeDeBundle["tenant.members.filter.status.option.active"]).toBe("Aktiv");
+    expect(localeDeBundle["tenant.members.filter.status.option.pending"]).toBe("Ausstehend");
+  });
+});