@cosmicdrift/kumiko-bundled-features 0.86.0 → 0.87.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,16 +80,17 @@
     "./renderer-foundation": "./src/renderer-foundation/index.ts",
     "./legal-pages": "./src/legal-pages/index.ts",
     "./legal-pages/web": "./src/legal-pages/web/index.ts",
+    "./page-render": "./src/page-render/index.ts",
     "./managed-pages": "./src/managed-pages/index.ts",
     "./managed-pages/seeding": "./src/managed-pages/seeding.ts",
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.86.0",
-    "@cosmicdrift/kumiko-framework": "0.86.0",
-    "@cosmicdrift/kumiko-headless": "0.86.0",
-    "@cosmicdrift/kumiko-renderer": "0.86.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.86.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.87.0",
+    "@cosmicdrift/kumiko-framework": "0.87.0",
+    "@cosmicdrift/kumiko-headless": "0.87.0",
+    "@cosmicdrift/kumiko-renderer": "0.87.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.87.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -161,9 +161,20 @@ describe("legal-pages :: edge-cases", () => {
 });
 
 describe("legal-pages :: cache-control", () => {
-  test("sets public cache header for 5min", async () => {
+  test("sets revalidate cache header + etag", async () => {
     const res = await stack.app.request("/legal/impressum");
-    expect(res.headers.get("cache-control")).toBe("public, max-age=300");
+    expect(res.headers.get("cache-control")).toBe("public, max-age=0, must-revalidate");
+    expect(res.headers.get("etag")).toBeTruthy();
+  });
+
+  test("If-None-Match → 304 when content unchanged", async () => {
+    const first = await stack.app.request("/legal/impressum");
+    const etag = first.headers.get("etag");
+    expect(etag).toBeTruthy();
+    const second = await stack.app.request("/legal/impressum", {
+      headers: { "if-none-match": etag ?? "" },
+    });
+    expect(second.status).toBe(304);
   });
 });
 

package/src/legal-pages/feature.ts

@@ -2,14 +2,15 @@ import {
   requireTextContent,
   type TextContentApi,
 } from "@cosmicdrift/kumiko-bundled-features/text-content";
+import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineFeature,
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { cachedSecurePageResponse } from "../page-render";
 import { LEGAL_REQUIRED_BLOCKS, LEGAL_ROUTES } from "./constants";
 import { renderMarkdownToHtml, wrapInLayout } from "./markdown";
-import { securePageHeaders } from "./security-headers";
 
 // QN-Konstante als dokumentierter Public-Contract des text-content-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
@@ -22,7 +23,7 @@ const TEXT_CONTENT_BY_SLUG_QN = "text-content:query:by-slug";
 
 // Wire-Body-Shape von /api/query — das, was bySlugQuery returnt.
 type ByslugQueryBody = {
-  data: { title: string; body: string | null } | null;
+  data: { title: string; body: string | null; updatedAt: string } | null;
 };
 
 // legal-pages — Opt-in-Wrapper um text-content für DACH-Compliance.
@@ -113,20 +114,32 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
             );
           }
 
+          const etag = computeRevisionEtag([
+            SYSTEM_TENANT_ID,
+            route.slug,
+            route.lang,
+            data.updatedAt,
+          ]);
+          const notModified = cachedSecurePageResponse(c.req.raw, {
+            body: null,
+            etag,
+            cache: { kind: "revalidate" },
+            extra: { "content-type": "text/html; charset=utf-8" },
+          });
+          if (notModified.status === 304) return notModified;
+
           const html = wrapLayout({
             title: data.title || route.titleFallback,
             bodyHtml: renderMarkdownToHtml(data.body),
             lang: route.lang,
           });
 
-          return c.body(
-            html,
-            200,
-            securePageHeaders({
-              "content-type": "text/html; charset=utf-8",
-              "cache-control": "public, max-age=300",
-            }),
-          );
+          return cachedSecurePageResponse(c.req.raw, {
+            body: html,
+            etag,
+            cache: { kind: "revalidate" },
+            extra: { "content-type": "text/html; charset=utf-8" },
+          });
         },
       });
     }

package/src/managed-pages/__tests__/managed-pages.integration.test.ts

@@ -142,13 +142,24 @@ describe("managed-pages :: Cross-Tenant-Isolation", () => {
 });
 
 describe("managed-pages :: Cache + Security-Header", () => {
-  test("Vary: Host + CSP/Hardening-Header", async () => {
+  test("Vary: Host + CSP/Hardening-Header + revalidate cache", async () => {
     const res = await stack.app.request("http://a.example.com/p/about");
     expect(res.headers.get("vary")).toBe("Host");
-    expect(res.headers.get("cache-control")).toBe("public, max-age=300");
+    expect(res.headers.get("cache-control")).toBe("public, max-age=0, must-revalidate");
+    expect(res.headers.get("etag")).toBeTruthy();
     expect(res.headers.get("content-security-policy")).toContain("script-src 'none'");
     expect(res.headers.get("x-content-type-options")).toBe("nosniff");
   });
+
+  test("If-None-Match → 304 when page unchanged", async () => {
+    const first = await stack.app.request("http://a.example.com/p/about");
+    const etag = first.headers.get("etag");
+    expect(etag).toBeTruthy();
+    const second = await stack.app.request("http://a.example.com/p/about", {
+      headers: { "if-none-match": etag ?? "" },
+    });
+    expect(second.status).toBe(304);
+  });
 });
 
 describe("managed-pages :: XSS-Härtung", () => {

package/src/managed-pages/feature.ts

@@ -1,3 +1,4 @@
+import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineEntityCreateHandler,
   defineEntityDeleteHandler,
@@ -9,9 +10,9 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   type BrandingTokens,
+  cachedSecurePageResponse,
   EMPTY_BRANDING,
   renderSafeMarkdown,
-  securePageHeaders,
   wrapInLayout,
 } from "../page-render";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding";
@@ -40,9 +41,23 @@ type ByslugQueryBody = {
     lang: string;
     description: string | null;
     ogImage: string | null;
+    version: number;
+    updatedAt: string;
   } | null;
 };
 
+function brandingRevisionSeed(branding: BrandingTokens): string {
+  return JSON.stringify([
+    branding.title,
+    branding.description,
+    branding.siteUrl,
+    branding.accentColor,
+    branding.logoUrl,
+    branding.layoutPreset,
+    branding.customCss,
+  ]);
+}
+
 // Parse the branding query's `{ data }` envelope into BrandingTokens, never
 // throwing: a non-ok status or malformed body degrades to the unbranded
 // default (branding is decoration, not a hard dependency of the page render).
@@ -221,6 +236,26 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
         const branding = await readBrandingResponse(brandingRes);
 
+        const etag = computeRevisionEtag([
+          tenantId,
+          slug,
+          lang,
+          String(data.version),
+          data.updatedAt,
+          brandingRevisionSeed(branding),
+        ]);
+        const pageHeaders = {
+          "content-type": "text/html; charset=utf-8",
+          vary: "Host",
+        } as const;
+        const notModified = cachedSecurePageResponse(c.req.raw, {
+          body: null,
+          etag,
+          cache: { kind: "revalidate" },
+          extra: pageHeaders,
+        });
+        if (notModified.status === 304) return notModified;
+
         const html = wrapLayout({
           title: data.title,
           bodyHtml: renderSafeMarkdown(data.body),
@@ -231,18 +266,12 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
           branding,
         });
 
-        // Vary: Host — per-Tenant-Content darf nicht von einem shared CDN
-        // nur unter dem Pfad gecached werden (sonst Tenant A's Page auf
-        // Tenant B's Domain). Cache keyed mit auf den Host.
-        return c.body(
-          html,
-          200,
-          securePageHeaders({
-            "content-type": "text/html; charset=utf-8",
-            "cache-control": "public, max-age=300",
-            vary: "Host",
-          }),
-        );
+        return cachedSecurePageResponse(c.req.raw, {
+          body: html,
+          etag,
+          cache: { kind: "revalidate" },
+          extra: pageHeaders,
+        });
       },
     });
 

package/src/managed-pages/handlers/by-slug.query.ts

@@ -30,6 +30,8 @@ export const bySlugQuery = defineQueryHandler({
       body: row.body,
       description: row.description,
       ogImage: row.ogImage,
+      version: row.version,
+      updatedAt: row.updatedAt,
     };
   },
 });

package/src/page-render/cached-page-response.ts

@@ -0,0 +1,25 @@
+import { type CachePolicy, cachedResponse } from "@cosmicdrift/kumiko-framework/api";
+import { securePageHeaders } from "./security-headers";
+
+export type CachedSecurePageResponseInit = {
+  readonly body: BodyInit | null;
+  readonly status?: number;
+  readonly etag: string;
+  readonly cache: CachePolicy;
+  readonly extra?: Record<string, string>;
+  readonly lastModified?: Date;
+};
+
+export function cachedSecurePageResponse(
+  req: Request,
+  init: CachedSecurePageResponseInit,
+): Response {
+  return cachedResponse(req, {
+    body: init.body,
+    status: init.status,
+    etag: init.etag,
+    cache: init.cache,
+    lastModified: init.lastModified,
+    headers: securePageHeaders(init.extra ?? {}),
+  });
+}

package/src/page-render/index.ts

@@ -7,6 +7,10 @@ export {
   isSafeHttpsUrl,
   layoutMaxWidth,
 } from "./branding";
+export {
+  type CachedSecurePageResponseInit,
+  cachedSecurePageResponse,
+} from "./cached-page-response";
 export { sanitizeTenantCss } from "./css-sanitize";
 export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout";
 export { renderSafeMarkdown } from "./markdown";