@cosmicdrift/kumiko-bundled-features 0.220.1 → 0.222.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.220.1",
+  "version": "0.222.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -71,6 +71,7 @@
     "./file-derivatives": "./src/file-derivatives/index.ts",
     "./derivatives-sharp": "./src/derivatives-sharp/index.ts",
     "./files": "./src/files/index.ts",
+    "./files-tenant-data": "./src/files-tenant-data/index.ts",
     "./user-data-rights": "./src/user-data-rights/index.ts",
     "./user-data-rights/web": "./src/user-data-rights/web/index.ts",
     "./user-data-rights-defaults": "./src/user-data-rights-defaults/index.ts",
@@ -126,12 +127,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.220.1",
-    "@cosmicdrift/kumiko-framework": "0.220.1",
-    "@cosmicdrift/kumiko-headless": "0.220.1",
-    "@cosmicdrift/kumiko-renderer": "0.220.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.220.1",
-    "@cosmicdrift/kumiko-types": "0.220.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.222.0",
+    "@cosmicdrift/kumiko-framework": "0.222.0",
+    "@cosmicdrift/kumiko-headless": "0.222.0",
+    "@cosmicdrift/kumiko-renderer": "0.222.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.222.0",
+    "@cosmicdrift/kumiko-types": "0.222.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,7 +161,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.220.1",
-    "@cosmicdrift/kumiko-locale-es": "0.220.1"
+    "@cosmicdrift/kumiko-locale-de": "0.222.0",
+    "@cosmicdrift/kumiko-locale-es": "0.222.0"
   }
 }

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -294,7 +294,7 @@ describe("access-invalidation event consumer", () => {
       {
         id: userId,
         version: detail["version"],
-        changes: { roles: JSON.stringify(["SystemAdmin"]) },
+        changes: { roles: ["SystemAdmin"] },
       },
       admin,
     );
@@ -307,6 +307,7 @@ describe("access-invalidation event consumer", () => {
     const sessionRow = await fetchOne<{ revokedAt: unknown }>(stack.db, userSessionTable, {
       id: sid,
     });
+    expect(sessionRow).toBeTruthy();
     expect(sessionRow?.revokedAt).not.toBeNull();
   });
 });

package/src/audit/__tests__/audit-log-screen.test.tsx

@@ -21,7 +21,8 @@ import { defaultPrimitives, defaultTokens } from "@cosmicdrift/kumiko-renderer-w
 import { render, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { TenantQueries } from "../../tenant/constants";
-import { AuditQueries } from "../constants";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AuditQueries } from "../constants";
+import { AuditLogDetailScreen } from "../web/audit-log-detail-screen";
 import { AuditLogScreen } from "../web/audit-log-screen";
 import { defaultTranslations } from "../web/i18n";
 
@@ -124,14 +125,32 @@ const MEMBERS: readonly MemberRowFixture[] = [
   { userId: "user-2", email: "bob@example.com", displayName: null },
 ];
 
-function makeDispatcher(): Dispatcher {
+type AuditDetailFixture = AuditRowFixture & { readonly metadata: Record<string, unknown> };
+
+function detailFixtureFor(row: AuditRowFixture): AuditDetailFixture {
+  return { ...row, metadata: {} };
+}
+
+type MembersResult =
+  | { readonly isSuccess: true; readonly data: readonly MemberRowFixture[] }
+  | { readonly isSuccess: false; readonly error: { readonly message: string } };
+
+function makeDispatcher(
+  options: {
+    readonly detail?: AuditDetailFixture | null;
+    readonly membersResult?: MembersResult;
+  } = {},
+): Dispatcher {
   const statusStore = createStore<DispatcherStatus>("online");
   const query = (async (type: string) => {
     if (type === AuditQueries.list) {
       return { isSuccess: true, data: { rows: AUDIT_ROWS, nextBefore: null } };
     }
+    if (type === AuditQueries.details) {
+      return { isSuccess: true, data: options.detail ?? null };
+    }
     if (type === TenantQueries.members) {
-      return { isSuccess: true, data: MEMBERS };
+      return options.membersResult ?? { isSuccess: true, data: MEMBERS };
     }
     return { isSuccess: true, data: null };
   }) as unknown as Dispatcher["query"];
@@ -146,7 +165,12 @@ function makeDispatcher(): Dispatcher {
   } as unknown as Dispatcher; // @cast-boundary test-stub
 }
 
-function renderScreen(): ReturnType<typeof render> {
+function renderWithProviders(
+  ui: ReactNode,
+  options: { readonly nav?: NavApi; readonly dispatcher?: Dispatcher } = {},
+): ReturnType<typeof render> {
+  const nav = options.nav ?? stubNav;
+  const dispatcher = options.dispatcher ?? makeDispatcher();
   const wrapper = ({ children }: { readonly children: ReactNode }): ReactNode => (
     <TokensProvider value={stubTokens}>
       <LocaleProvider
@@ -154,16 +178,25 @@ function renderScreen(): ReturnType<typeof render> {
         fallbackBundles={[defaultTranslations, kumikoDefaultTranslations]}
       >
         <PrimitivesProvider value={defaultPrimitives}>
-          <NavProvider value={stubNav}>
+          <NavProvider value={nav}>
             <LiveEventsProvider value={stubLiveEvents}>
-              <DispatcherProvider dispatcher={makeDispatcher()}>{children}</DispatcherProvider>
+              <DispatcherProvider dispatcher={dispatcher}>{children}</DispatcherProvider>
             </LiveEventsProvider>
           </NavProvider>
         </PrimitivesProvider>
       </LocaleProvider>
     </TokensProvider>
   );
-  return render(<AuditLogScreen />, { wrapper });
+  return render(ui, { wrapper });
+}
+
+function renderScreen(dispatcher?: Dispatcher): ReturnType<typeof render> {
+  return renderWithProviders(<AuditLogScreen />, { dispatcher });
+}
+
+function renderDetailScreen(entityId: string, dispatcher: Dispatcher): ReturnType<typeof render> {
+  const nav: NavApi = { ...stubNav, route: { screenId: AUDIT_LOG_DETAIL_SCREEN_ID, entityId } };
+  return renderWithProviders(<AuditLogDetailScreen />, { nav, dispatcher });
 }
 
 describe("AuditLogScreen — actor name resolution", () => {
@@ -185,14 +218,14 @@ describe("AuditLogScreen — actor name resolution", () => {
     expect(view.getByTestId("cell-2-actor").textContent).toBe("bob@example.com");
   });
 
-  test("createdBy not in members list → cell is empty, never the raw id", async () => {
+  test("createdBy not in members list → cell shows Unknown actor, never the raw id", async () => {
     const view = renderScreen();
     await waitFor(() => {
       const cell = view.queryByTestId("cell-3-actor");
       if (cell === null) throw new Error("actor cell not rendered yet");
     });
     const cell = view.getByTestId("cell-3-actor");
-    expect(cell.textContent).toBe("");
+    expect(cell.textContent).toBe("Unknown actor");
     expect(cell.textContent).not.toBe("user-missing");
   });
 
@@ -215,14 +248,55 @@ describe("AuditLogScreen — actor name resolution", () => {
     expect(view.getByTestId("cell-4-actor").textContent).toBe("System");
   });
 
-  test("createdBy is an unresolvable UUID → cell stays empty, raw UUID never rendered", async () => {
+  test("createdBy is an unresolvable UUID → Unknown actor label, raw UUID never rendered", async () => {
     const view = renderScreen();
     await waitFor(() => {
       const cell = view.queryByTestId("cell-5-actor");
       if (cell === null) throw new Error("actor cell not rendered yet");
     });
     const cell = view.getByTestId("cell-5-actor");
-    expect(cell.textContent).toBe("");
+    expect(cell.textContent).toBe("Unknown actor");
     expect(view.container.textContent).not.toContain("3f2504e0-4f89-11d3-9a0c-0305e82c3301");
   });
 });
+
+describe("AuditLogScreen — members query failure", () => {
+  test("members query returns isSuccess:false → list still renders, no crash", async () => {
+    const dispatcher = makeDispatcher({
+      membersResult: { isSuccess: false, error: { message: "members unavailable" } },
+    });
+    const view = renderScreen(dispatcher);
+    await waitFor(() => {
+      const cell = view.queryByTestId("cell-1-type");
+      if (cell === null) throw new Error("table not rendered yet");
+    });
+    expect(view.getByTestId("cell-1-type").textContent).toBe("widget.created");
+    expect(view.getByTestId("cell-1-actor").textContent).toBe("Unknown actor");
+  });
+});
+
+describe("AuditLogDetailScreen — actor name resolution", () => {
+  test("known member with displayName → detail actor field shows the display name", async () => {
+    const row = AUDIT_ROWS[0];
+    if (row === undefined) throw new Error("fixture missing");
+    const dispatcher = makeDispatcher({ detail: detailFixtureFor(row) });
+    const view = renderDetailScreen(row.id, dispatcher);
+    await waitFor(() => {
+      const cell = view.queryByTestId("audit-detail-actor");
+      if (cell === null) throw new Error("actor field not rendered yet");
+    });
+    expect(view.getByTestId("audit-detail-actor").textContent).toBe("Alice Example");
+  });
+
+  test("known member without displayName → detail actor field falls back to email", async () => {
+    const row = AUDIT_ROWS[1];
+    if (row === undefined) throw new Error("fixture missing");
+    const dispatcher = makeDispatcher({ detail: detailFixtureFor(row) });
+    const view = renderDetailScreen(row.id, dispatcher);
+    await waitFor(() => {
+      const cell = view.queryByTestId("audit-detail-actor");
+      if (cell === null) throw new Error("actor field not rendered yet");
+    });
+    expect(view.getByTestId("audit-detail-actor").textContent).toBe("bob@example.com");
+  });
+});

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -2,11 +2,12 @@ import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config/feature";
+import { createTenantFeature } from "../../tenant/feature";
 import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
 describe("audit log screen + handler access alignment", () => {
-  const features = [createConfigFeature(), createAuditFeature()];
+  const features = [createConfigFeature(), createTenantFeature(), createAuditFeature()];
 
   test("boot-validates with audit-log screen registered", () => {
     expect(() => validateBoot(features)).not.toThrow();

package/src/audit/__tests__/audit.integration.test.ts

@@ -21,6 +21,8 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant";
 import { AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
@@ -59,7 +61,7 @@ const otherTenantAdmin: SessionUser = createTestUser({
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [widgetFeature, createAuditFeature()],
+    features: [widgetFeature, createConfigFeature(), createTenantFeature(), createAuditFeature()],
   });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
 });

package/src/audit/__tests__/constants.test.ts

@@ -0,0 +1,13 @@
+import { describe, expect, test } from "bun:test";
+import { SYSTEM_ACTOR_ID, SYSTEM_ACTOR_IDS } from "../constants";
+
+describe("audit constants", () => {
+  test("SYSTEM_ACTOR_ID matches the event-store system user id", () => {
+    expect(SYSTEM_ACTOR_ID).toBe("system");
+  });
+
+  test("SYSTEM_ACTOR_IDS includes createSystemUser nil UUID", () => {
+    expect(SYSTEM_ACTOR_IDS.has(SYSTEM_ACTOR_ID)).toBe(true);
+    expect(SYSTEM_ACTOR_IDS.has("00000000-0000-0000-0000-000000000000")).toBe(true);
+  });
+});

package/src/audit/constants.ts

@@ -2,9 +2,18 @@
 // Qualified handler names + screen ids — shared by server feature and web client.
 export const AUDIT_FEATURE = "audit" as const;
 
-/** Literal `createdBy` written by system-authored events (e.g. delivery attempts). */
+/** Literal `createdBy` written by hand-built system actors (secrets/jobs/…). */
 export const SYSTEM_ACTOR_ID = "system" as const;
 
+/** Literal `createdBy` for anonymous / unauthenticated actors. */
+export const ANONYMOUS_USER_ID = "anonymous" as const;
+
+/** All `createdBy` values that mean "system" in the audit UI (nil-UUID from createSystemUser + literal). */
+export const SYSTEM_ACTOR_IDS: ReadonlySet<string> = new Set([
+  SYSTEM_ACTOR_ID,
+  "00000000-0000-0000-0000-000000000000",
+]);
+
 export const AuditQueries = {
   list: "audit:query:list",
   details: "audit:query:details",

package/src/audit/feature.ts

@@ -31,6 +31,8 @@ export function createAuditFeature(): FeatureDefinition {
       recommended: false,
     });
     r.translations({ keys: AUDIT_I18N });
+    // Screens resolve actor names via tenant:query:members.
+    r.requires("tenant");
 
     const queries = {
       list: r.queryHandler(listQuery),

package/src/audit/i18n.ts

@@ -17,6 +17,8 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.col.aggregate": { en: "Aggregate" },
   "audit.log.col.actor": { en: "Actor" },
   "audit.log.actor.system": { en: "System" },
+  "audit.log.actor.anonymous": { en: "Anonymous" },
+  "audit.log.actor.unknown": { en: "Unknown actor" },
   "audit.log.filter.eventType": { en: "Event type" },
   "audit.log.filter.aggregateType": { en: "Aggregate type" },
   "audit.log.filter.from": { en: "From" },

package/src/audit/web/audit-log-detail-screen.tsx

@@ -11,7 +11,7 @@ import {
 import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
 import { type ReactNode, useCallback, useEffect, useState } from "react";
 import { TenantQueries } from "../../tenant/constants";
-import { AuditQueries, SYSTEM_ACTOR_ID } from "../constants";
+import { ANONYMOUS_USER_ID, AuditQueries, SYSTEM_ACTOR_IDS } from "../constants";
 
 type AuditDetail = {
   readonly id: string;
@@ -34,7 +34,15 @@ type State =
   | { readonly kind: "loading" }
   | { readonly kind: "missing" }
   | { readonly kind: "error"; readonly message: string }
-  | { readonly kind: "ready"; readonly event: AuditDetail; readonly actorName: string };
+  | {
+      readonly kind: "ready";
+      readonly event: AuditDetail;
+      /** Resolved member display string, or "" if unknown. System actor is
+       *  flagged separately so the translated label is formed in render
+       *  (avoids refetch on locale change — fw#2297). */
+      readonly memberLabel: string;
+      readonly isSystemActor: boolean;
+    };
 
 export function AuditLogDetailScreen(): ReactNode {
   const t = useTranslation();
@@ -60,21 +68,24 @@ export function AuditLogDetailScreen(): ReactNode {
       return;
     }
     const event = res.data;
-    const membersRes = await dispatcher.query<readonly MemberRow[]>(TenantQueries.members, {});
+    if (SYSTEM_ACTOR_IDS.has(event.createdBy)) {
+      setState({ kind: "ready", event, memberLabel: "", isSystemActor: true });
+      return;
+    }
+    // Single-user filter — do not decrypt the whole tenant roster for one name.
+    const membersRes = await dispatcher.query<readonly MemberRow[]>(TenantQueries.members, {
+      userId: event.createdBy,
+    });
     const member = membersRes.isSuccess
       ? membersRes.data.find((m) => m.userId === event.createdBy)
       : undefined;
     setState({
       kind: "ready",
       event,
-      actorName:
-        event.createdBy === SYSTEM_ACTOR_ID
-          ? t("audit.log.actor.system")
-          : member
-            ? (member.displayName ?? member.email ?? "")
-            : "",
+      memberLabel: member ? (member.displayName ?? member.email ?? "") : "",
+      isSystemActor: false,
     });
-  }, [dispatcher, eventId, t]);
+  }, [dispatcher, eventId]);
 
   // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
   useEffect(() => {
@@ -83,7 +94,7 @@ export function AuditLogDetailScreen(): ReactNode {
 
   if (state.kind === "loading") {
     return (
-      <FormScreenShell testId="audit-log-detail-screen">
+      <FormScreenShell testId="audit-log-detail-screen" maxWidth="3xl">
         <Text variant="small">{t("audit.log.detail.loading")}</Text>
       </FormScreenShell>
     );
@@ -91,7 +102,7 @@ export function AuditLogDetailScreen(): ReactNode {
 
   if (state.kind === "missing") {
     return (
-      <FormScreenShell testId="audit-log-detail-screen">
+      <FormScreenShell testId="audit-log-detail-screen" maxWidth="3xl">
         <Banner variant="error">{t("audit.log.detail.missing")}</Banner>
       </FormScreenShell>
     );
@@ -99,16 +110,25 @@ export function AuditLogDetailScreen(): ReactNode {
 
   if (state.kind === "error") {
     return (
-      <FormScreenShell testId="audit-log-detail-screen">
+      <FormScreenShell testId="audit-log-detail-screen" maxWidth="3xl">
         <Banner variant="error">{state.message}</Banner>
       </FormScreenShell>
     );
   }
 
-  const { event, actorName } = state;
+  const { event, memberLabel, isSystemActor } = state;
+  const actorName = isSystemActor
+    ? t("audit.log.actor.system")
+    : event.createdBy === ANONYMOUS_USER_ID
+      ? t("audit.log.actor.anonymous")
+      : memberLabel || t("audit.log.actor.unknown");
 
   return (
-    <FormScreenShell testId="audit-log-detail-screen" className="flex flex-col gap-6">
+    <FormScreenShell
+      testId="audit-log-detail-screen"
+      maxWidth="3xl"
+      className="flex flex-col gap-6"
+    >
       <Card slots={{ title: event.type }}>
         <dl className="grid gap-3 text-sm">
           <div>

package/src/audit/web/audit-log-screen.tsx

@@ -14,7 +14,12 @@ import {
 import { Filter, RotateCcw } from "lucide-react";
 import { type ReactNode, useCallback, useEffect, useRef, useState } from "react";
 import { TenantQueries } from "../../tenant/constants";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AuditQueries, SYSTEM_ACTOR_ID } from "../constants";
+import {
+  ANONYMOUS_USER_ID,
+  AUDIT_LOG_DETAIL_SCREEN_ID,
+  AuditQueries,
+  SYSTEM_ACTOR_IDS,
+} from "../constants";
 
 type AuditRow = {
   readonly id: string;
@@ -36,7 +41,6 @@ type MemberRow = {
 
 type Filters = {
   readonly eventType: string;
-  readonly aggregateType: string;
   readonly from: string;
   readonly to: string;
 };
@@ -51,7 +55,17 @@ type State =
       readonly names: ReadonlyMap<string, string>;
     };
 
-const EMPTY_FILTERS: Filters = { eventType: "", aggregateType: "", from: "", to: "" };
+const EMPTY_FILTERS: Filters = { eventType: "", from: "", to: "" };
+
+function actorLabel(
+  createdBy: string,
+  names: ReadonlyMap<string, string>,
+  t: (key: string) => string,
+): string {
+  if (SYSTEM_ACTOR_IDS.has(createdBy)) return t("audit.log.actor.system");
+  if (createdBy === ANONYMOUS_USER_ID) return t("audit.log.actor.anonymous");
+  return names.get(createdBy) ?? t("audit.log.actor.unknown");
+}
 
 export function AuditLogScreen(): ReactNode {
   const t = useTranslation();
@@ -70,25 +84,37 @@ export function AuditLogScreen(): ReactNode {
   // mid-session and refetching on every "older" click is wasted work.
   const membersRef = useRef<Promise<ReadonlyMap<string, string>> | null>(null);
 
+  // Tenant/dispatcher identity can change without remounting — drop the cache.
+  const dispatcherIdentityRef = useRef(dispatcher);
+  if (dispatcherIdentityRef.current !== dispatcher) {
+    dispatcherIdentityRef.current = dispatcher;
+    membersRef.current = null;
+  }
+
   const load = useCallback(
     async (cursor?: string, overrideFilters?: Filters): Promise<void> => {
       setState({ kind: "loading" });
       const f = overrideFilters ?? filtersRef.current;
-      membersRef.current ??= dispatcher
-        .query<readonly MemberRow[]>(TenantQueries.members, {})
-        .then((res) =>
-          res.isSuccess
-            ? new Map(res.data.map((m) => [m.userId, m.displayName ?? m.email ?? ""] as const))
-            : new Map<string, string>(),
-        );
+      if (!membersRef.current) {
+        const p = dispatcher.query<readonly MemberRow[]>(TenantQueries.members, {}).then((res) => {
+          if (!res.isSuccess) {
+            // Soft failure: clear so a later filter/page retry can refetch
+            // instead of freezing an empty actor column for the session.
+            if (membersRef.current === p) membersRef.current = null;
+            return new Map<string, string>();
+          }
+          return new Map(res.data.map((m) => [m.userId, m.displayName ?? m.email ?? ""] as const));
+        });
+        membersRef.current = p;
+        void p.catch(() => {
+          if (membersRef.current === p) membersRef.current = null;
+        });
+      }
       const [res, names] = await Promise.all([
         dispatcher.query<AuditResponse>(AuditQueries.list, {
           limit: 50,
           ...(cursor !== undefined && { before: cursor }),
           ...(f.eventType.trim() !== "" && { eventType: f.eventType.trim() }),
-          ...(f.aggregateType.trim() !== "" && {
-            aggregateType: f.aggregateType.trim(),
-          }),
           ...(f.from !== "" && { from: toIsoStart(f.from) }),
           ...(f.to !== "" && { to: toIsoEnd(f.to) }),
         }),
@@ -130,7 +156,7 @@ export function AuditLogScreen(): ReactNode {
   return (
     <div className="w-full" data-testid="audit-log-screen">
       <div className="flex flex-wrap items-end gap-4 px-6 pt-6">
-        <div className="min-w-40 flex-1">
+        <div className="min-w-40 max-w-64 flex-1">
           <Field id="audit-filter-event" label={t("audit.log.filter.eventType")}>
             <Input
               kind="text"
@@ -141,18 +167,7 @@ export function AuditLogScreen(): ReactNode {
             />
           </Field>
         </div>
-        <div className="min-w-40 flex-1">
-          <Field id="audit-filter-aggregate" label={t("audit.log.filter.aggregateType")}>
-            <Input
-              kind="text"
-              id="audit-filter-aggregate"
-              name="audit-filter-aggregate"
-              value={filters.aggregateType}
-              onChange={(v) => setFilters((f) => ({ ...f, aggregateType: v }))}
-            />
-          </Field>
-        </div>
-        <div className="min-w-40 flex-1">
+        <div className="min-w-40 max-w-64 flex-1">
           <Field id="audit-filter-from" label={t("audit.log.filter.from")}>
             <Input
               kind="date"
@@ -163,7 +178,7 @@ export function AuditLogScreen(): ReactNode {
             />
           </Field>
         </div>
-        <div className="min-w-40 flex-1">
+        <div className="min-w-40 max-w-64 flex-1">
           <Field id="audit-filter-to" label={t("audit.log.filter.to")}>
             <Input
               kind="date"
@@ -184,7 +199,7 @@ export function AuditLogScreen(): ReactNode {
             }}
             testId="audit-log-apply-filters"
           >
-            <Filter className="h-4 w-4" />
+            <Filter className="h-4 w-4" aria-hidden="true" />
             <span>{t("audit.log.filter.apply")}</span>
           </Button>
           <Button
@@ -197,7 +212,7 @@ export function AuditLogScreen(): ReactNode {
             }}
             testId="audit-log-reset-filters"
           >
-            <RotateCcw className="h-4 w-4" />
+            <RotateCcw className="h-4 w-4" aria-hidden="true" />
             <span>{t("audit.log.filter.reset")}</span>
           </Button>
         </div>
@@ -217,10 +232,7 @@ export function AuditLogScreen(): ReactNode {
           values: {
             when: formatWhen(row.createdAt),
             type: row.type,
-            actor:
-              row.createdBy === SYSTEM_ACTOR_ID
-                ? t("audit.log.actor.system")
-                : (state.names.get(row.createdBy) ?? ""),
+            actor: actorLabel(row.createdBy, state.names, t),
           },
         }))}
         onRowClick={(row) => openDetail(row.id)}

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -78,6 +78,7 @@ async function seedLoginUser(opts: {
   password: string;
   tenantId?: TenantId;
   roles?: string[];
+  locale?: string;
 }): Promise<{ id: string; tenantId: TenantId }> {
   const hash = await hashPassword(opts.password);
   const created = await stack.http.writeOk<{ id: string }>(
@@ -86,6 +87,7 @@ async function seedLoginUser(opts: {
       email: opts.email,
       passwordHash: hash,
       displayName: opts.email.split("@")[0] ?? "user",
+      locale: opts.locale,
     },
     systemAdmin,
   );
@@ -134,6 +136,33 @@ describe("scenario 1: login success", () => {
       },
     );
     expect(meRes.status).toBe(200);
+
+    // fw#2333 — a user without a stored locale must not carry a locale
+    // claim at all (not null, not "").
+    const payload = await stack.jwt.verify(body.token as string);
+    expect(payload.locale).toBeUndefined();
+  });
+
+  test("correct credentials with a stored locale → JWT carries the locale claim", async () => {
+    const seed = await seedLoginUser({
+      email: "good-locale@example.com",
+      password: "correct-horse-battery",
+      roles: ["User"],
+      locale: "de-DE",
+    });
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "good-locale@example.com",
+      password: "correct-horse-battery",
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.token).toBeTypeOf("string");
+
+    const payload = await stack.jwt.verify(body.token as string);
+    expect(payload.locale).toBe("de-DE");
+    expect(payload.sub).toBe(seed.id);
   });
 });