@cosmicdrift/kumiko-bundled-features 0.242.0 → 0.243.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +9 -9
- package/src/auth-email-password/changes.json +13 -13
- package/src/auth-foundation/changes.json +6 -6
- package/src/cap-overview/changes.json +6 -6
- package/src/crypto-shredding/changes.json +8 -8
- package/src/personal-access-tokens/changes.json +6 -6
- package/src/user-data-rights/changes.json +6 -6
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cosmicdrift/kumiko-bundled-features",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.243.0",
|
|
4
4
|
"description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
|
|
5
5
|
"license": "BUSL-1.1",
|
|
6
6
|
"author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
|
|
@@ -130,12 +130,12 @@
|
|
|
130
130
|
"./workflow-runner": "./src/workflow-runner/index.ts"
|
|
131
131
|
},
|
|
132
132
|
"dependencies": {
|
|
133
|
-
"@cosmicdrift/kumiko-dispatcher-live": "0.
|
|
134
|
-
"@cosmicdrift/kumiko-framework": "0.
|
|
135
|
-
"@cosmicdrift/kumiko-headless": "0.
|
|
136
|
-
"@cosmicdrift/kumiko-renderer": "0.
|
|
137
|
-
"@cosmicdrift/kumiko-renderer-web": "0.
|
|
138
|
-
"@cosmicdrift/kumiko-types": "0.
|
|
133
|
+
"@cosmicdrift/kumiko-dispatcher-live": "0.243.0",
|
|
134
|
+
"@cosmicdrift/kumiko-framework": "0.243.0",
|
|
135
|
+
"@cosmicdrift/kumiko-headless": "0.243.0",
|
|
136
|
+
"@cosmicdrift/kumiko-renderer": "0.243.0",
|
|
137
|
+
"@cosmicdrift/kumiko-renderer-web": "0.243.0",
|
|
138
|
+
"@cosmicdrift/kumiko-types": "0.243.0",
|
|
139
139
|
"@mollie/api-client": "^4.5.0",
|
|
140
140
|
"@node-rs/argon2": "^2.0.2",
|
|
141
141
|
"@types/mailparser": "^3.4.6",
|
|
@@ -164,7 +164,7 @@
|
|
|
164
164
|
"devDependencies": {
|
|
165
165
|
"@testing-library/user-event": "^14.6.1",
|
|
166
166
|
"@types/qrcode": "^1.5.5",
|
|
167
|
-
"@cosmicdrift/kumiko-locale-de": "0.
|
|
168
|
-
"@cosmicdrift/kumiko-locale-es": "0.
|
|
167
|
+
"@cosmicdrift/kumiko-locale-de": "0.243.0",
|
|
168
|
+
"@cosmicdrift/kumiko-locale-es": "0.243.0"
|
|
169
169
|
}
|
|
170
170
|
}
|
|
@@ -5,6 +5,13 @@
|
|
|
5
5
|
"title": "Self-signup provisions TenantAdmin on the new tenant",
|
|
6
6
|
"detail": "INITIAL_SIGNUP_ROLES is TenantAdmin (was Admin) so the first user on a new tenant can invite peers and manage memberships without elevation dead-ends."
|
|
7
7
|
},
|
|
8
|
+
{
|
|
9
|
+
"version": "0.167.1",
|
|
10
|
+
"type": "improvement",
|
|
11
|
+
"title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
|
|
12
|
+
"detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock — an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
|
|
13
|
+
"migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts — no error, no warning, no protection — so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
|
|
14
|
+
},
|
|
8
15
|
{
|
|
9
16
|
"version": "0.165.1",
|
|
10
17
|
"type": "breaking",
|
|
@@ -12,13 +19,6 @@
|
|
|
12
19
|
"detail": "The four positional args (LoginComponent, loginProps, MfaVerifyComponent, MfaSetupComponent) did not scale past two optional MFA params. Shipped in the stranded 2.0.0 major and carried into the 0.165.1 line.",
|
|
13
20
|
"migration": "Rewrite call sites as makeAuthGate({ loginScreen, loginScreenProps, mfaVerifyScreen, mfaSetupScreen }). Type-check catches every occurrence."
|
|
14
21
|
},
|
|
15
|
-
{
|
|
16
|
-
"version": "0.167.1",
|
|
17
|
-
"type": "improvement",
|
|
18
|
-
"title": "accountLockout is reachable through runProdApp/runDevApp (fw#1627).",
|
|
19
|
-
"detail": "accountLockout was an option on createAuthEmailPasswordFeature, but both wrappers mount auth-email-password themselves and their auth options only knew accountUnlock \u2014 an app on either entrypoint had no way to turn brute-force protection on. RunProdAppAuthOptions and RunDevAppAuthOptions now carry accountLockout and composeFeatures passes it through.",
|
|
20
|
-
"migration": "Opt-in, nothing breaks without it. Two things to know before relying on it: without ctx.redis the lockout is silently skipped in login.write.ts \u2014 no error, no warning, no protection \u2014 so treat Redis as a deploy invariant, and prove the lockout with a behavioural test instead of assuming the mount is enough."
|
|
21
|
-
},
|
|
22
22
|
{
|
|
23
23
|
"version": "0.162.0",
|
|
24
24
|
"type": "improvement",
|
|
@@ -28,19 +28,19 @@
|
|
|
28
28
|
{
|
|
29
29
|
"version": "0.154.1",
|
|
30
30
|
"type": "fix",
|
|
31
|
-
"title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled
|
|
32
|
-
"detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen,
|
|
31
|
+
"title": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled…",
|
|
32
|
+
"detail": "Export `LoginScreen`/`LoginScreenProps`/`AuthLegalLink` from `@cosmicdrift/kumiko-bundled-features/auth-email-password/web`. Every other auth screen (ForgotPasswordScreen, SignupScreen, ResetPasswordScreen, …) was already exported from the barrel with its props type; `LoginScreen` was missed. `makeAuthGate`'s second parameter is typed `LoginScreenProps`, so consumers passing a typed `loginScreenProps` override (e.g. `@cosmicdriftgamestudio/kumiko-designer`) couldn't import the type at all. - @cosmicdrift/kumiko-framework@0.154.1 - @cosmicdrift/kumiko-dispatcher-live@0.154.1 - @cosmicdrift/kumiko-headless@0.154.1 - @cosmicdrift/kumiko-renderer@0.154.1 - @cosmicdrift/kumiko-renderer-web@0.154.1"
|
|
33
33
|
},
|
|
34
34
|
{
|
|
35
35
|
"version": "0.151.0",
|
|
36
36
|
"type": "improvement",
|
|
37
|
-
"title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly
|
|
38
|
-
"detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly
|
|
37
|
+
"title": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — u…",
|
|
38
|
+
"detail": "`auth-email-password/web` no longer exports `LoginScreen`/`LoginScreenProps` directly — use the new `createLoginRoute({ loginScreenProps, mfaVerifyScreen, unaffected (they already build on the same logic internally now). Why: a raw `<LoginScreen />` render has no MFA-challenge handling unless the caller remembers to hand-wire `onMfaChallenge` + swap in a verify screen itself — exactly how kumiko-framework#266's login-time MFA step went missing in a real app's standalone apex/marketing login route (it renders outside `emailPasswordClient`'s own gate, which already handled this correctly). `createLoginRoute` is the one place this logic lives now, for both the gated and standalone cases — there's no lower-level piece left to misuse. The `apex-surface-auth` recipe is updated to match."
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
41
|
"version": "0.131.0",
|
|
42
42
|
"type": "improvement",
|
|
43
|
-
"title": "App-Mounting 2.0
|
|
44
|
-
"detail": "App-Mounting 2.0
|
|
43
|
+
"title": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, Secti…",
|
|
44
|
+
"detail": "App-Mounting 2.0 Säule A: Mid-Level-Widget-Kit in renderer-web (StatCard, MiniStat, SectionCard, StatusBadge, ProgressBar, CollapsibleSection, DetailList, ModeSwitch, StatusBarChart, TimeseriesChart, EmptyState/LoadingState/ErrorState, QueryTable) + Status-Farb-Tokens (--color-status-\\*). Neue Hooks useMutation + useDisclosure. Neues Core-Primitive Link (default/button/muted), Button-Variant \"link\", Text-Variant \"muted\"; auth-email-password nutzt sie (authButtonClass/authMutedLinkClass entfernt)."
|
|
45
45
|
}
|
|
46
46
|
]
|
|
@@ -5,16 +5,16 @@
|
|
|
5
5
|
"title": "validateSessionStoreMultiplicity accepts zero sessionStore providers (fw#1547).",
|
|
6
6
|
"detail": "A machine-API-only deployment (PAT-bearer auth, no browser sessions) can mount auth-foundation without also mounting sessions."
|
|
7
7
|
},
|
|
8
|
-
{
|
|
9
|
-
"version": "0.161.0",
|
|
10
|
-
"type": "improvement",
|
|
11
|
-
"title": "tenantResolver/tenantExistence extension points, sessionStore without auth.sessions (fw#1372-1375).",
|
|
12
|
-
"detail": "Auth-foundation migration: tenant resolution and tenant-existence become extension points, sessionStore is wired without going through auth.sessions, AnonymousAccessConfig is slimmed down. See the auth-foundation-providers recipe."
|
|
13
|
-
},
|
|
14
8
|
{
|
|
15
9
|
"version": "0.165.0",
|
|
16
10
|
"type": "fix",
|
|
17
11
|
"title": "Allow zero tokenVerifier when sessionStore present",
|
|
18
12
|
"detail": "Auth foundation now accepts zero tokenVerifier when a sessionStore is configured — prevents crash in session-store-only setups."
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"version": "0.161.0",
|
|
16
|
+
"type": "improvement",
|
|
17
|
+
"title": "tenantResolver/tenantExistence extension points, sessionStore without auth.sessions (fw#1372-1375).",
|
|
18
|
+
"detail": "Auth-foundation migration: tenant resolution and tenant-existence become extension points, sessionStore is wired without going through auth.sessions, AnonymousAccessConfig is slimmed down. See the auth-foundation-providers recipe."
|
|
19
19
|
}
|
|
20
20
|
]
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
[
|
|
2
|
-
{
|
|
3
|
-
"version": "0.224.0",
|
|
4
|
-
"type": "improvement",
|
|
5
|
-
"title": "Add cap-overview feature: tier + cap usage visibility per tenant.",
|
|
6
|
-
"detail": "New read-only bundled feature. SystemAdmin gets a paged, searchable tenant list with tier/billing columns and per-cap usage bars, plus a per-tenant dashboard reachable from the list. TenantAdmin gets a 'My usage' dashboard showing their own tenant's cap usage as cards. Reads tier-engine, billing-foundation and tenant projections plus caller-supplied CapSpec usage callbacks; every handler enforces explicit tenant scoping (no ambient tenant filter, cross-tenant reads require SystemAdmin + acknowledgeCrossTenant)."
|
|
7
|
-
},
|
|
8
2
|
{
|
|
9
3
|
"version": "0.233.0",
|
|
10
4
|
"type": "improvement",
|
|
11
5
|
"title": "CapSpec.limit can now return null for an unlimited usage meter.",
|
|
12
6
|
"detail": "A CapSpec's `limit(tier)` may now return `null` to mean unlimited: the cap is still counted (used shows the raw count) but never capped, has no percent, and renders no progress bar or badge. This is a distinct meaning from `limit <= 0`, which unchanged still means 'not part of this tier' and renders as 0/0%."
|
|
7
|
+
},
|
|
8
|
+
{
|
|
9
|
+
"version": "0.224.0",
|
|
10
|
+
"type": "improvement",
|
|
11
|
+
"title": "Add cap-overview feature: tier + cap usage visibility per tenant.",
|
|
12
|
+
"detail": "New read-only bundled feature. SystemAdmin gets a paged, searchable tenant list with tier/billing columns and per-cap usage bars, plus a per-tenant dashboard reachable from the list. TenantAdmin gets a 'My usage' dashboard showing their own tenant's cap usage as cards. Reads tier-engine, billing-foundation and tenant projections plus caller-supplied CapSpec usage callbacks; every handler enforces explicit tenant scoping (no ambient tenant filter, cross-tenant reads require SystemAdmin + acknowledgeCrossTenant)."
|
|
13
13
|
}
|
|
14
14
|
]
|
|
@@ -1,4 +1,12 @@
|
|
|
1
1
|
[
|
|
2
|
+
{
|
|
3
|
+
"version": "0.167.0",
|
|
4
|
+
"type": "breaking",
|
|
5
|
+
"title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
|
|
6
|
+
"detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
|
|
7
|
+
"migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
|
|
8
|
+
"codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
|
|
9
|
+
},
|
|
2
10
|
{
|
|
3
11
|
"version": "0.166.0",
|
|
4
12
|
"type": "improvement",
|
|
@@ -11,14 +19,6 @@
|
|
|
11
19
|
"title": "KmsWiringEnv accepts process.env directly (fw#1618).",
|
|
12
20
|
"detail": "All members being optional made TypeScript's weak-type detection reject ProcessEnv for having no properties in common, which forced every consumer into a cast or a six-key mapping — the boilerplate fw#1617 set out to remove."
|
|
13
21
|
},
|
|
14
|
-
{
|
|
15
|
-
"version": "0.167.0",
|
|
16
|
-
"type": "breaking",
|
|
17
|
-
"title": "Test-only reset helpers moved from /crypto to /testing (fw#1631).",
|
|
18
|
-
"detail": "resetPiiSubjectKmsForTests and resetBlindIndexKeyForTests are no longer exported by the production barrels. The functions did not change — only the export path. Why it matters beyond tidiness: resetPiiSubjectKmsForTests clears the injected KMS, after which encryptForStorage sees no adapter and writes subject-annotated fields in plaintext, with no error and no log. Reachable from a production barrel, that is one stray import away from silent plaintext PII.",
|
|
19
|
-
"migration": "Change the import in your test files: `import { resetPiiSubjectKmsForTests } from \"@cosmicdrift/kumiko-framework/testing\"` instead of `.../crypto`. Type-check catches every occurrence; nothing else changes. Apps mounting crypto-shredding typically hit this in every test that configures an InMemoryKmsAdapter.",
|
|
20
|
-
"codemod": "scripts/codemod/crypto-shredding-testing-move.ts"
|
|
21
|
-
},
|
|
22
22
|
{
|
|
23
23
|
"version": "0.165.3",
|
|
24
24
|
"type": "improvement",
|
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
[
|
|
2
|
-
{
|
|
3
|
-
"version": "0.117.0",
|
|
4
|
-
"type": "improvement",
|
|
5
|
-
"title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
|
|
6
|
-
"detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
|
|
7
|
-
},
|
|
8
2
|
{
|
|
9
3
|
"version": "0.202.0",
|
|
10
4
|
"type": "breaking",
|
|
11
5
|
"title": "personal-access-tokens: `write:create` now requires `currentPassword` (+ `mfaCode` if MFA enrolled) (e91d4cb).",
|
|
12
6
|
"detail": "`personal-access-tokens:write:create` now requires `currentPassword` (verified against the caller's password hash) before minting a token, and rejects when the caller has MFA enrolled and `mfaCode` is missing or wrong — a session cookie alone is no longer enough to stand up a durable API credential. `expiresInDays` now defaults to 90 days instead of never-expiring when omitted (the existing 3650-day cap is unchanged, so a genuinely long-lived token is still possible if requested explicitly). Changing a user's password, or enabling/disabling MFA, now revokes all of that user's live PAT tokens — mirrors the existing session auto-revoke-on-password-change behavior. `run-prod-app`/`run-dev-app` wire the new MFA↔PAT revoke callback automatically when both `auth-mfa` and `personal-access-tokens` are mounted; no app-level change needed for that part.",
|
|
13
7
|
"migration": "Apps that already mint PATs (their own client code, scripts, or tests) need to add `currentPassword` to the `create` request payload — this is a breaking change to the `create` request shape despite the minor bump (bundled-features doesn't follow strict semver across its handler schemas yet). If the caller has MFA enrolled, also include a valid `mfaCode`."
|
|
8
|
+
},
|
|
9
|
+
{
|
|
10
|
+
"version": "0.117.0",
|
|
11
|
+
"type": "improvement",
|
|
12
|
+
"title": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated vi…",
|
|
13
|
+
"detail": "personal-access-tokens: add `toggleable` option so the whole feature can be tier-gated via the tier-engine (mirrors ledger/tags). Pass `{ toggleable: { default: false } }` for fail-closed gating — PAT is then off until a tier lists `\"personal-access-tokens\"` in its features. Omitting the option keeps PAT always-on (no behaviour change for existing consumers)."
|
|
14
14
|
}
|
|
15
15
|
]
|
|
@@ -6,18 +6,18 @@
|
|
|
6
6
|
"detail": "`privacy-center` is now a declarative `projectionDetail` screen instead of a custom React component: the Restriction and Deletion sections render through the generic renderer (`EditFieldsSection` + `actions: RowAction[]`), preserving the original confirmation dialogs (`RowActionWriteHandler.confirm`) and visibility rules (`visible: {field, eq/ne}`) 1:1. The Export section (Art. 20) stays a custom `EditExtensionSection` — it needs polling + a signed-URL download — registered via the new `ClientFeatureDefinition.extensionSectionComponents` under `EXPORT_SECTION_EXTENSION_NAME`. `PrivacyCenterScreen` is a dead export (the renderer selects the screen by `screen.type`, not the client component registry). The single `status` field now renders through the `enumOption` format instead of the raw enum string; `gracePeriodEnd` is hidden when no deletion is pending instead of showing an empty date. Known UI regression, accepted for this pass: the confirm-dialog title is now always the action's `label` (the renderer hardcodes this) — the original's distinct `dialogTitle` copy and its dynamic composed banner sentence (e.g. \"Your account will be deleted on {date}\") are gone, replaced by the translated `status` label plus a separately labeled `gracePeriodEnd` date.",
|
|
7
7
|
"migration": "A declarative screen is registered once and can no longer be toggled per-app on the client: `userDataRightsClient(options)`'s `privacyCenter: { showDeletion }` option is removed. Move the flag server-side instead — replace `createUserDataRightsFeature({})` with `createUserDataRightsFeature({ privacyCenterShowDeletion: false })` (default `true`) — it conditionally omits the Deletion section and its `request-deletion`/`cancel-deletion` actions from the screen definition. Then drop the now-unused `privacyCenter` option from the matching `userDataRightsClient({ privacyCenter: { showDeletion: false } })` call. Known affected consumer: `money-horse` (`src/app/client-features.tsx:74`)."
|
|
8
8
|
},
|
|
9
|
-
{
|
|
10
|
-
"version": "0.165.1",
|
|
11
|
-
"type": "fix",
|
|
12
|
-
"title": "restrict-account runs the same cross-tenant membership check as lift-restriction (fw#1543).",
|
|
13
|
-
"detail": "Any Admin/TenantAdmin — not just SystemAdmin — could restrict a user's account and force-revoke their sessions regardless of tenant, as long as they held an admin role in some tenant. Also: the GET /user-export/by-token fallback now forwards x-forwarded-for to the internal query call, so the per-IP 30/min limit stops collapsing into one global bucket."
|
|
14
|
-
},
|
|
15
9
|
{
|
|
16
10
|
"version": "0.165.3",
|
|
17
11
|
"type": "improvement",
|
|
18
12
|
"title": "Forget cleanup purges derived Meili docs for searchable subject-PII (fw#1610).",
|
|
19
13
|
"detail": "run-forget-cleanup (and the forget cron path) call purgeSearchDocumentsForSubject after crypto-shred so searchable userOwned fields do not linger in Meili as plaintext after Art. 17."
|
|
20
14
|
},
|
|
15
|
+
{
|
|
16
|
+
"version": "0.165.1",
|
|
17
|
+
"type": "fix",
|
|
18
|
+
"title": "restrict-account runs the same cross-tenant membership check as lift-restriction (fw#1543).",
|
|
19
|
+
"detail": "Any Admin/TenantAdmin — not just SystemAdmin — could restrict a user's account and force-revoke their sessions regardless of tenant, as long as they held an admin role in some tenant. Also: the GET /user-export/by-token fallback now forwards x-forwarded-for to the internal query call, so the per-IP 30/min limit stops collapsing into one global bucket."
|
|
20
|
+
},
|
|
21
21
|
{
|
|
22
22
|
"version": "0.165.0",
|
|
23
23
|
"type": "breaking",
|