@cosmicdrift/kumiko-bundled-features 0.65.0 → 0.66.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -84,11 +84,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.65.0",
-    "@cosmicdrift/kumiko-framework": "0.65.0",
-    "@cosmicdrift/kumiko-headless": "0.65.0",
-    "@cosmicdrift/kumiko-renderer": "0.65.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.65.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.66.0",
+    "@cosmicdrift/kumiko-framework": "0.66.0",
+    "@cosmicdrift/kumiko-headless": "0.66.0",
+    "@cosmicdrift/kumiko-renderer": "0.66.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.66.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -98,6 +98,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
       // client can observe it through the HTTP surface.
       if (!user || user.isDeleted || !user.email || spec.extraSilentSkip(user)) {
         const data: TokenRequestData<TSuccessKind> = { kind: "no-op" };
+        // skip: silent no-op — uniform response prevents user-enumeration probing
         return { isSuccess: true, data };
       }
 

package/src/config/handlers/readiness.query.ts

@@ -87,6 +87,7 @@ export async function collectMissingRequiredConfig(
     if (keyDef.required !== true) continue;
     if (!effectiveGate(qualifiedKey)) continue;
     if (options?.skipAccessFilter !== true && !hasConfigAccess(keyDef.access.read, user.roles)) {
+      // skip: key not visible to this user's roles (access-filtered listing)
       continue;
     }
     candidates.set(qualifiedKey, keyDef);

package/src/custom-fields/web/__tests__/custom-fields-form-section.test.tsx

@@ -334,11 +334,13 @@ describe("CustomFieldsFormSection — boolean/date-Pfade", () => {
       </Wrapper>,
     );
 
-    // boolean rendert als Checkbox — Bestand steckt in checked, nicht value.
-    const input = document.getElementById("custom-field-active") as HTMLInputElement;
-    expect(input.checked).toBe(true);
+    // boolean = vendored Radix-Checkbox → button[role=checkbox], Bestand steckt
+    // in aria-checked (kein natives .checked).
+    const checkbox = document.getElementById("custom-field-active");
+    if (checkbox === null) throw new Error("boolean checkbox not rendered");
+    expect(checkbox.getAttribute("aria-checked")).toBe("true");
 
-    fireEvent.click(input);
+    fireEvent.click(checkbox);
     fireEvent.click(screen.getByTestId("custom-fields-form-save"));
     await Promise.resolve();
     await Promise.resolve();

package/src/legal-pages/web/__tests__/client-plugin.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from "bun:test";
+import type { TreeNode } from "@cosmicdrift/kumiko-framework/engine";
+import { legalPagesClient } from "../client-plugin";
+
+// Deckt die drei neuen Migrations-Pfade (advisor-Gap): navId-Attach,
+// no-leak ohne navId, und der Unwrap (Provider emittiert die slug-Folder
+// direkt, NICHT mehr unter einem "Legal"-Wrapper — der App-r.nav-Knoten
+// IST der Container). legal-pages ist fetch-frei → Provider direkt aufrufbar.
+
+function collect(
+  provider: () => (emit: (n: readonly TreeNode[]) => void) => () => void,
+): readonly TreeNode[] {
+  let emitted: readonly TreeNode[] | undefined;
+  const unsub = provider()((nodes) => {
+    emitted = nodes;
+  });
+  unsub();
+  if (emitted === undefined) throw new Error("provider emitted nothing");
+  return emitted;
+}
+
+describe("legalPagesClient", () => {
+  test("ohne navId: kein navProvider (server-only-Consumer leaken keinen Node)", () => {
+    const def = legalPagesClient();
+    expect(def.name).toBe("legal-pages");
+    expect(def.navProviders).toBeUndefined();
+  });
+
+  test("mit navId: Provider hängt unter exakt dieser (pass-through) QN", () => {
+    const navId = "publicstatus:nav:legal";
+    const def = legalPagesClient({ navId });
+    expect(Object.keys(def.navProviders ?? {})).toEqual([navId]);
+  });
+
+  test("Provider unwrappt den Legal-Container: Top-Level sind die slug-Folder", () => {
+    const navId = "publicstatus:nav:legal";
+    const provider = legalPagesClient({ navId }).navProviders?.[navId];
+    if (provider === undefined) throw new Error("provider missing");
+    const emitted = collect(provider);
+
+    // Kein "Legal"-Wrapper mehr — der App-Knoten ist der Container.
+    expect(emitted.some((n) => n.label === "Legal")).toBe(false);
+    expect(emitted.length).toBeGreaterThan(0);
+
+    // Jeder Top-Level-Knoten ist ein slug-Folder mit lang-Leaves, die per
+    // Cross-Link auf text-content:edit zeigen.
+    const folder = emitted[0];
+    expect(Array.isArray(folder?.children)).toBe(true);
+    const langLeaf = Array.isArray(folder?.children) ? folder?.children[0] : undefined;
+    expect(langLeaf?.target?.featureId).toBe("text-content");
+    expect(langLeaf?.target?.action).toBe("edit");
+  });
+});

package/src/legal-pages/web/client-plugin.ts

@@ -63,20 +63,19 @@ const treeProvider: TreeChildrenSubscribe = () => (emit) => {
     });
   }
 
-  emit([
-    {
-      label: "Legal",
-      icon: "folder",
-      state: "filled",
-      children: slugFolders,
-    },
-  ]);
+  // Der App-seitige r.nav-Knoten IST der "Legal"-Container → der Provider
+  // emittiert die slug-Folder direkt darunter.
+  emit(slugFolders);
   return () => {};
 };
 
-export function legalPagesClient(): ClientFeatureDefinition {
+// `navId` = QN des r.nav({ provider: true })-Knotens den die App registriert.
+// Statisch (kein Fetch, keine Entities) → kein SSE-Refresh nötig. Ohne navId:
+// kein Sidebar-Knoten (server-only-Consumer leaken nichts).
+export function legalPagesClient(opts?: { readonly navId?: string }): ClientFeatureDefinition {
+  const navId = opts?.navId;
   return {
     name: "legal-pages",
-    treeProvider,
+    ...(navId !== undefined && { navProviders: { [navId]: treeProvider } }),
   };
 }

package/src/text-content/web/__tests__/client-plugin.test.tsx

@@ -0,0 +1,65 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+import type { TreeNode } from "@cosmicdrift/kumiko-framework/engine";
+import { textContentClient } from "../client-plugin";
+
+// Deckt die drei neuen Migrations-Pfade (advisor-Gap): navId-Attach + SSE-
+// Entities, no-leak ohne navId (conditional-spread), und der Unwrap (Provider
+// emittiert die Folder/Leaves direkt, NICHT unter dem "Content"-Wrapper).
+// Der Provider fetcht → fetch wird gemockt.
+
+describe("textContentClient — shape", () => {
+  test("ohne navId: kein navProvider/navEntities (no-leak), aber Resolver bleibt", () => {
+    const def = textContentClient();
+    expect(def.name).toBe("text-content");
+    expect(def.navProviders).toBeUndefined();
+    expect(def.navEntities).toBeUndefined();
+    expect(def.resolvers?.["text-content:edit"]).toBeDefined();
+  });
+
+  test("mit navId: Provider + SSE-Entities unter exakt dieser QN", () => {
+    const navId = "publicstatus:nav:content";
+    const def = textContentClient({ navId });
+    expect(Object.keys(def.navProviders ?? {})).toEqual([navId]);
+    expect(def.navEntities?.[navId]).toEqual(["text-block"]);
+  });
+});
+
+describe("textContentClient — Provider unwrappt den Content-Container", () => {
+  const origFetch = globalThis.fetch;
+  afterEach(() => {
+    globalThis.fetch = origFetch;
+  });
+
+  test("emittiert Folder/Leaves direkt, kein 'Content'-Wrapper-Knoten", async () => {
+    const blocks = [
+      { slug: "imprint", lang: "de", title: "Imprint", body: "x", folder: null, updatedAt: "" },
+      { slug: "hero", lang: "de", title: "Hero", body: null, folder: "page", updatedAt: "" },
+    ];
+    // Test-Mock-Grenze: bun-Mock deckt nicht die volle fetch-Signatur
+    // (preconnect etc.) — Double-Cast bewusst, nur dieser Test ruft fetch.
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ data: { blocks } }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+    ) as unknown as typeof fetch;
+
+    const navId = "x:nav:content";
+    const provider = textContentClient({ navId }).navProviders?.[navId];
+    if (provider === undefined) throw new Error("provider missing");
+
+    let emitted: readonly TreeNode[] | undefined;
+    provider()((nodes) => {
+      emitted = nodes;
+    });
+    // fetch().then(...) ist async → eine Makrotask abwarten bis emit lief.
+    await new Promise((r) => setTimeout(r, 0));
+
+    expect(emitted).toBeDefined();
+    const labels = (emitted ?? []).map((n) => n.label).sort();
+    // Kein "Content"-Wrapper — root-leaf "Imprint" + folder "page" direkt.
+    expect(labels).not.toContain("Content");
+    expect(labels).toEqual(["Imprint", "page"]);
+  });
+});

package/src/text-content/web/client-plugin.tsx

@@ -157,8 +157,10 @@ const treeProvider: TreeChildrenSubscribe = () => (emit, emitError) => {
       return r.json();
     })
     .then((data: ByTenantResponse) => {
-      const nodes = groupBlocksByFolder(data.data.blocks);
-      emit(nodes);
+      // Der App-seitige r.nav-Knoten IST der "Content"-Container → die
+      // Provider-Kinder sind die Folder/Leaves darunter, nicht der Wrapper.
+      const content = groupBlocksByFolder(data.data.blocks)[0];
+      emit(content !== undefined && Array.isArray(content.children) ? content.children : []);
     })
     .catch((e) => {
       // V.1.4: explicit error-Signal via emitError. ProviderBranch zeigt
@@ -346,19 +348,20 @@ function TextContentEditor({
   );
 }
 
-export function textContentClient(): ClientFeatureDefinition {
+// `navId` = die QN des r.nav({ provider: true })-Knotens, den die App für den
+// Content-Tree registriert (z.B. "publicstatus:nav:content"). Die App besitzt
+// Label/Icon/Access des Knotens (managed-pages-Konvention) — das Feature
+// liefert nur die Kinder + den Editor. Ohne navId: nur der Resolver, kein
+// Sidebar-Knoten (server-only-Consumer wie money-horse leaken nichts).
+export function textContentClient(opts?: { readonly navId?: string }): ClientFeatureDefinition {
+  const navId = opts?.navId;
   return {
     name: "text-content",
-    treeProvider,
-    // V.1.5b: SSE-driven Tree-Refresh. Bei jedem text-block-Event
-    // (created/updated/deleted) ruft ProviderBranch den treeProvider
-    // neu auf → Tree-State spiegelt save sofort wider (Stale-Tree-Fix).
-    treeEntities: ["text-block"],
-    treeActions: {
-      edit: { args: { slug: "" as string, lang: "" as string } },
-      list: {},
-      create: { args: { folder: "" as string } },
-    },
+    ...(navId !== undefined && {
+      navProviders: { [navId]: treeProvider },
+      // SSE-Refresh: jedes text-block-Event re-fired den Provider → Tree live.
+      navEntities: { [navId]: ["text-block"] },
+    }),
     resolvers: {
       "text-content:edit": TextContentEditor,
     },