@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/document-ingest-foundation/feature.ts

@@ -0,0 +1,126 @@
+// kumiko-feature-version: 1
+//
+// document-ingest-foundation — Phase-1 (MVP) skeleton for the shared
+// PDF/Scan/Image → normalized-text ingest primitive. Owns the
+// `documentExtract` entity + tenant-config, and (Theme A, kumiko-framework
+// #1497) the fileRef.created trigger: a multiStreamProjection that validates
+// mime/size and — on OK — appends `documentIngest.requested`, the anchor
+// event the Phase-2 worker job (kumiko-enterprise LiteParse provider) reacts
+// to (event-trigger, not job-trigger — `files` exports no write-handler ref
+// for r.job's trigger.on to hang off, files-post-processing recipe pattern).
+// LiteParse itself lands in kumiko-enterprise#273-275. See
+// CosmicDriftGameStudio/kumiko-framework#1495 for the full phase breakdown.
+
+import { entityEventName } from "@cosmicdrift/kumiko-framework/db";
+import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { documentExtractEntity } from "./entity";
+import {
+  DOCUMENT_INGEST_AGGREGATE_TYPE,
+  DOCUMENT_INGEST_REQUESTED_EVENT_QN,
+  DOCUMENT_INGEST_REQUESTED_EVENT_SHORT,
+  documentIngestRequestedPayloadSchema,
+} from "./events";
+
+const FEATURE_NAME = "document-ingest-foundation";
+
+const FILE_REF_CREATED = entityEventName("fileRef", "created");
+
+// Phase-1 scope (plan doc): PDF + raster images only. xlsx/docx/vision are
+// Phase 2, routed through separate providers, not this MSP.
+const ALLOWED_MIME_TYPES = new Set(["application/pdf", "image/png", "image/jpeg", "image/tiff"]);
+
+// ponytail: fixed cap, not tenant-config — the plan only calls out
+// maxPagesPerFile as tenant-configurable. Runs BEFORE the mime check for
+// the same reason it must run before isComplex() downstream: rejecting on
+// size is O(1), the checks after it are not (Spike: 699-page PDF). Chosen
+// on domain grounds — scanned invoices and official letters routinely land
+// in the 10-20mb range, well above file-routes.ts' unconstrained-upload
+// default (10mb); tests raise maxUploadSize instead of shrinking this.
+const MAX_FILE_BYTES = 25 * 1024 * 1024;
+
+// Narrow fileRef.created's generic entity payload at the MSP boundary.
+// Missing/invalid fields → skip (return), never cast — a bad size would
+// otherwise pass `undefined > MAX_FILE_BYTES` and a later appendDomainEvent
+// schema failure would dead the request-ingest consumer for all tenants.
+const fileRefCreatedPayloadSchema = z.object({
+  storageKey: z.string().min(1),
+  fileName: z.string().min(1),
+  mimeType: z.string().min(1),
+  size: z.number().int().min(0),
+});
+
+export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
+  r.describe(
+    "Shared PDF/Scan/Image → normalized-text ingest primitive. Owns the `documentExtract` entity (fileRefId, storageKey, per-page text + metadata) as an implicit entity-projection, the per-tenant `ocrLanguage`/`maxPagesPerFile` config keys, and a fileRef.created trigger that validates mime/size and requests ingest via `documentIngest.requested`. LiteParse provider wiring lands in follow-up features.",
+  );
+  r.uiHints({
+    displayLabel: "Document Ingest Foundation",
+    category: "storage",
+    recommended: false,
+  });
+  r.requires("config");
+
+  r.entity("documentExtract", documentExtractEntity);
+
+  const ocrLanguageConfigKey = r.config(
+    "ocrLanguage",
+    createTenantConfig("text", {
+      default: "deu+eng",
+      // Tesseract -l argument syntax: one or more 3-letter language codes
+      // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
+      // reach the OCR provider call unvalidated (#1501).
+      pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
+      write: access.roles("TenantAdmin", "SystemAdmin"),
+      read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+    }),
+  );
+  const maxPagesPerFileConfigKey = r.config(
+    "maxPagesPerFile",
+    createTenantConfig("number", {
+      default: 50,
+      // Without a bound a tenant could set 0 (silently kills ingest) or an
+      // unbounded value (OCR worker runs per-file for as long as the PDF
+      // has pages — job-queue starvation) (#1501).
+      bounds: { min: 1, max: 500 },
+      write: access.roles("TenantAdmin", "SystemAdmin"),
+      read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+    }),
+  );
+
+  r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema);
+
+  r.multiStreamProjection({
+    name: "request-ingest",
+    apply: {
+      [FILE_REF_CREATED]: async (event, _tx, ctx) => {
+        // entity-event payloads are generic Record<string, unknown> — parse
+        // at the MSP boundary (same pattern as storage-tracking's readNumber).
+        const parsed = fileRefCreatedPayloadSchema.safeParse(event.payload);
+        // skip: malformed / incomplete payload — don't poison the consumer
+        if (!parsed.success) return;
+        const payload = parsed.data;
+
+        // skip: over the fixed cap — no ingest requested, upload itself already succeeded
+        if (payload.size > MAX_FILE_BYTES) return;
+        // skip: outside the Phase-1 mime allowlist — no ingest requested
+        if (!ALLOWED_MIME_TYPES.has(payload.mimeType)) return;
+
+        await ctx.unsafeAppendEvent({
+          aggregateId: event.aggregateId,
+          aggregateType: DOCUMENT_INGEST_AGGREGATE_TYPE,
+          type: DOCUMENT_INGEST_REQUESTED_EVENT_QN,
+          payload: {
+            fileRefId: event.aggregateId,
+            storageKey: payload.storageKey,
+            fileName: payload.fileName,
+            mimeType: payload.mimeType,
+            size: payload.size,
+          },
+        });
+      },
+    },
+  });
+
+  return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
+});

package/src/document-ingest-foundation/index.ts

@@ -0,0 +1,12 @@
+// Public API of the document-ingest-foundation bundled-feature.
+
+export { type DocumentExtractMeta, documentExtractEntity, type IngestPage } from "./entity";
+export {
+  DOCUMENT_INGEST_AGGREGATE_TYPE,
+  DOCUMENT_INGEST_REQUESTED_EVENT_QN,
+  DOCUMENT_INGEST_REQUESTED_EVENT_SHORT,
+  type DocumentIngestRequestedPayload,
+  documentIngestRequestedPayloadSchema,
+} from "./events";
+export { documentIngestFoundationFeature } from "./feature";
+export { readIngestPages, writeIngestPages } from "./pages";

package/src/document-ingest-foundation/pages.ts

@@ -0,0 +1,34 @@
+// Wire-format helpers for `documentExtract.pages` — the column is encrypted
+// longText (jsonb has no encryption support), so writers must persist
+// JSON.stringify(IngestPage[]) and readers must parse back. Centralising
+// the codec here keeps liteparse + recipe consumers lockstep with the
+// entity shape (kumiko-framework#1549/1).
+
+import type { IngestPage } from "./entity";
+
+export function writeIngestPages(pages: readonly IngestPage[]): string {
+  return JSON.stringify(pages);
+}
+
+export function readIngestPages(raw: unknown): IngestPage[] {
+  if (raw == null) return [];
+  // Executor decrypt returns the plaintext string; raw SQL / stale jsonb
+  // rows may still surface as an already-parsed array — accept both.
+  const parsed: unknown = typeof raw === "string" ? parseJson(raw) : raw;
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter(isIngestPage);
+}
+
+function parseJson(raw: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function isIngestPage(value: unknown): value is IngestPage {
+  if (value === null || typeof value !== "object") return false;
+  const page = value as { pageNumber?: unknown; text?: unknown };
+  return typeof page.pageNumber === "number" && typeof page.text === "string";
+}

package/src/feature-toggles/__tests__/compose-tier-resolver.test.ts

@@ -0,0 +1,304 @@
+// Unit test (no DB) — the composition logic is pure given a tier resolver
+// function + a GlobalFeatureToggleRuntime whose in-memory snapshot is set
+// directly via .apply(). Pins the semantics documented in
+// compose-tier-resolver.ts:
+//   - tier-managed toggleables (in SOME tier's `features` list, per the
+//     tierResolver(SYSTEM_TENANT_ID) union convention): the global layer
+//     only NARROWS what the tier grants — an explicit `false` removes it,
+//     no row / `true` leaves the tier's grant untouched, it can never widen
+//     beyond what the tenant's own tier includes.
+//   - tier-unaware toggleables (in NO tier's `features` list at all, e.g. a
+//     pure operator kill-switch like auth-self-registration): membership
+//     comes entirely from computeEffectiveFeatures' normal cascade
+//     (override ?? toggleableDefault) since no tier ever votes on them.
+
+import { describe, expect, test } from "bun:test";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createRegistry,
+  defineFeature,
+  type EffectiveFeaturesResolver,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { composeTierResolverWithGlobalToggles } from "../compose-tier-resolver";
+import { GlobalFeatureToggleRuntime } from "../toggle-runtime";
+
+// Never touched by .apply()/.readOverride() — the runtime only does I/O in
+// .initialize()/.refresh(), which this test never calls.
+const fakeDb = {} as unknown as DbConnection;
+
+// Mirrors publicstatus's real mix: "personal-access-tokens" is Team-tier-
+// gated (toggleable, default false), "auth-self-registration" is a global
+// kill-switch no tier ever lists (toggleable, default true).
+const testRegistry = createRegistry([
+  defineFeature("personal-access-tokens", (r) => {
+    r.toggleable({ default: false });
+  }),
+  defineFeature("auth-self-registration", (r) => {
+    r.toggleable({ default: true });
+  }),
+]);
+
+// Mirrors tier-engine's real resolver contract (tier-engine/feature.ts's
+// mergeAlwaysOn calls): SYSTEM_TENANT_ID always includes at least the
+// always-on features merged in, even when zero tiers grant anything —
+// tests exercising "no tier grants this feature" must still see a non-empty
+// SYSTEM_TENANT_ID union, exactly like a real app always has.
+function tierResolverGranting(...features: readonly string[]): EffectiveFeaturesResolver {
+  return (tenantId: TenantId) =>
+    tenantId === SYSTEM_TENANT_ID
+      ? new Set([...features, "always-on-stand-in"])
+      : new Set(features);
+}
+
+describe("composeTierResolverWithGlobalToggles", () => {
+  test("no override → tier's grant stands", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("personal-access-tokens"),
+      runtime,
+      testRegistry,
+    );
+    // auth-self-registration joins via the tier-unaware cascade (default
+    // true, no override) — see the dedicated tier-unaware tests below.
+    expect([...composed("t1" as TenantId)].sort()).toEqual([
+      "auth-self-registration",
+      "personal-access-tokens",
+    ]);
+  });
+
+  test("explicit override=false removes a tier-granted feature", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("personal-access-tokens", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("personal-access-tokens"),
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("explicit override=true cannot widen a tier-managed feature beyond the tenant's own tier", () => {
+    // "personal-access-tokens" IS tier-managed (it's in SOME tier's list,
+    // per the SYSTEM_TENANT_ID union), but THIS tenant's own tier grants
+    // nothing (e.g. Free). An operator flipping the global row to true
+    // must not leak it in — that decision belongs to the tier, not the
+    // toggle.
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["personal-access-tokens"]) // union of all tiers' features
+        : new Set<string>(); // this tenant's (Free) tier grants nothing
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("personal-access-tokens", true);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, testRegistry);
+    // auth-self-registration still joins via the tier-unaware cascade.
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("a tier-gated toggleable feature with NO override row stays on — no fallback to its own default", () => {
+    // Regression pin for the exact bug this composer exists to avoid:
+    // a Team-tier feature declared `toggleable({default:false})` must stay
+    // granted when the tier includes it and no operator has touched it —
+    // computeEffectiveFeatures' cascade would otherwise fall back to
+    // `false` the moment feature-toggles is composed in.
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting("personal-access-tokens"),
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)].sort()).toEqual([
+      "auth-self-registration",
+      "personal-access-tokens",
+    ]);
+  });
+
+  test("tier-unaware toggleable (in no tier's feature list) defaults on via the global cascade", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting(), // no tier grants anything
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("tier-unaware toggleable — explicit override=false turns it off for every tenant", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("auth-self-registration", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting(),
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual([]);
+  });
+
+  test("flip back on restores a tier-unaware feature's default", () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    runtime.apply("auth-self-registration", false);
+    const composed = composeTierResolverWithGlobalToggles(
+      tierResolverGranting(),
+      runtime,
+      testRegistry,
+    );
+    expect([...composed("t1" as TenantId)]).toEqual([]);
+
+    runtime.apply("auth-self-registration", true);
+    expect([...composed("t1" as TenantId)]).toEqual(["auth-self-registration"]);
+  });
+
+  test("kumiko-framework#1479/2: an empty SYSTEM_TENANT_ID union throws instead of silently disabling all tier-gating", () => {
+    // A tierResolver that doesn't implement the SYSTEM_TENANT_ID convention
+    // at all (e.g. always returns per-tenant grants, never the union) —
+    // the old code would treat this as "zero tier-managed features", so
+    // EVERY toggleable feature falls through to the tier-unaware cascade
+    // and tier-gating is silently defeated.
+    const brokenTierResolver: EffectiveFeaturesResolver = (_tenantId: TenantId) =>
+      new Set<string>();
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const composed = composeTierResolverWithGlobalToggles(
+      brokenTierResolver,
+      runtime,
+      testRegistry,
+    );
+    expect(() => composed("t1" as TenantId)).toThrow(/SYSTEM_TENANT_ID/);
+  });
+
+  test("kumiko-framework#1479/2: tierManaged is computed lazily — a resolver not ready at compose-time is fine as long as it's ready by first call", () => {
+    let ready = false;
+    const lateBoundResolver: EffectiveFeaturesResolver = (tenantId: TenantId) => {
+      if (!ready) throw new Error("tierResolver not wired yet");
+      return tenantId === SYSTEM_TENANT_ID
+        ? new Set(["personal-access-tokens"])
+        : new Set<string>();
+    };
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    // Composing must NOT eagerly call tierResolver(SYSTEM_TENANT_ID) — the
+    // late-bound holder pattern (run-dev-app.ts) builds the real resolver
+    // only after composeTierResolverWithGlobalToggles has already run.
+    const composed = composeTierResolverWithGlobalToggles(lateBoundResolver, runtime, testRegistry);
+    ready = true;
+    expect(() => composed("t1" as TenantId)).not.toThrow();
+  });
+
+  test("preserves the tier resolver's trialGate", async () => {
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, testRegistry);
+    const trialGate = async (_tenantId: TenantId, _featureName: string) => true;
+    const tierResolver: EffectiveFeaturesResolver = Object.assign(tierResolverGranting(), {
+      trialGate,
+    });
+
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, testRegistry);
+    expect(composed.trialGate).toBe(trialGate);
+  });
+});
+
+describe("composeTierResolverWithGlobalToggles — non-toggleable + requires() interaction", () => {
+  // Separate registry from the toggleable-only one above: a non-toggleable
+  // (always-on) feature and a toggleable one that requires() a tier-managed
+  // feature. Kept in its own describe so these additions can't shift the
+  // exact-array assertions in the suite above.
+  const registry = createRegistry([
+    defineFeature("personal-access-tokens", (r) => {
+      r.toggleable({ default: false });
+    }),
+    // Always-on, non-toggleable — no `r.toggleable()` call at all.
+    defineFeature("tenant", () => {}),
+    // Tier-unaware (no tier ever lists it) but depends on a tier-managed
+    // feature — its own eligibility must still respect that dependency.
+    defineFeature("pat-companion", (r) => {
+      r.toggleable({ default: true });
+      r.requires("personal-access-tokens");
+    }),
+  ]);
+
+  test("a non-toggleable feature stays granted even when the real tierResolver's mergeAlwaysOn puts it in the SYSTEM union", () => {
+    // Mirrors tier-engine's real mergeAlwaysOn: always-on features are
+    // merged into every tenant's set, not just the SYSTEM_TENANT_ID union —
+    // otherwise composeTierResolverWithGlobalToggles' `!tierManaged.has()`
+    // filter would incorrectly drop it (tier-managed but absent from this
+    // tenant's own tier subset).
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["tenant", "personal-access-tokens"])
+        : new Set(["tenant"]);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    expect([...composed("t1" as TenantId)]).toContain("tenant");
+  });
+
+  test("a tier-unaware feature requiring a tier-managed feature the tenant's tier doesn't grant is excluded", () => {
+    // "pat-companion" is tier-unaware (no tier ever lists it) but requires
+    // "personal-access-tokens", which IS tier-managed and this tenant's own
+    // tier grants nothing — the dependency must not silently resolve true.
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID ? new Set(["personal-access-tokens"]) : new Set<string>();
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    expect([...composed("t1" as TenantId)]).not.toContain("pat-companion");
+  });
+
+  test("kumiko-framework#1471/1: a tier-granted feature whose requires() dependency is globally disabled is excluded too", () => {
+    // "pat-companion" IS in this tenant's tier grant this time (unlike the
+    // test above) — the tenant's tier says yes, but its requires()
+    // dependency "personal-access-tokens" is killed globally via override.
+    // The old code only checked `readOverride(name) !== false` on
+    // "pat-companion" itself (which has no override, so it stayed) without
+    // ever re-running the requires() cascade over the tier-granted set —
+    // exactly the class of bug #1471/1 describes (channel-email staying up
+    // after its `delivery` dependency is killed).
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["personal-access-tokens", "pat-companion"])
+        : new Set(["personal-access-tokens", "pat-companion"]);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    runtime.apply("personal-access-tokens", false);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    const result = [...composed("t1" as TenantId)];
+    expect(result).not.toContain("personal-access-tokens");
+    expect(result).not.toContain("pat-companion");
+  });
+
+  test("kumiko-framework#1471/2: a global override cannot disable a non-toggleable (always-on) feature", () => {
+    // "tenant" has no r.toggleable() call at all — computeEffectiveFeatures'
+    // Rule 1 says non-toggleable features ignore overrides entirely. The old
+    // code applied `readOverride(name) !== false` to every name in tierSet
+    // with no toggleability check, so a stray override row (seed script,
+    // ops SQL, or a feature that used to be toggleable and had `r.toggleable()`
+    // removed) could disable an always-on feature outright.
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID ? new Set(["tenant"]) : new Set(["tenant"]);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    runtime.apply("tenant", false);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    expect([...composed("t1" as TenantId)]).toContain("tenant");
+  });
+
+  test("framework#1528: a resolver satisfying the emptiness guard but not merging always-on per-tenant still surfaces the always-on feature", () => {
+    // Custom composeApp resolver: implements the SYSTEM_TENANT_ID convention
+    // (union includes "tenant") but, unlike tier-engine's own mergeAlwaysOn,
+    // returns only the tier-only set for real tenants. Before the Rule-1
+    // structural fix, "tenant" landed in the raw (unfiltered) tierManaged set
+    // and got skipped by the globalCascade loop too, since it's absent from
+    // this tenant's own tierSet — a silent 403 on every always-on handler.
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["tenant", "personal-access-tokens"])
+        : new Set<string>();
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    expect([...composed("t1" as TenantId)]).toContain("tenant");
+  });
+
+  test("a tier-granted name with no registry entry is dropped by the requires() cascade fixpoint", () => {
+    const tierResolver: EffectiveFeaturesResolver = (tenantId: TenantId) =>
+      tenantId === SYSTEM_TENANT_ID
+        ? new Set(["tenant", "ghost-feature"])
+        : new Set(["tenant", "ghost-feature"]);
+    const runtime = new GlobalFeatureToggleRuntime(fakeDb, registry);
+    const composed = composeTierResolverWithGlobalToggles(tierResolver, runtime, registry);
+    expect([...composed("t1" as TenantId)]).not.toContain("ghost-feature");
+  });
+});

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -23,7 +23,6 @@ import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
-  unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { createLateBoundHolder, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
@@ -88,7 +87,7 @@ function widgetAuditFeature(): FeatureDefinition {
     r.toggleable({ default: true });
     r.entity("widget-audit", widgetAuditEntity);
 
-    r.entityHook("postSave", "widget", async (result, ctx) => {
+    r.hook("postSave", { allOf: "widget" }, async (result, ctx) => {
       if (result.kind !== "save" || !result.isNew) return;
       if (!ctx.db) return;
       const name = result.changes!["name"] as string | undefined;
@@ -163,10 +162,12 @@ beforeAll(async () => {
     systemHooks: [],
   });
 
-  await unsafePushTables(stack.db, { globalFeatureStateTable });
-  // widgetTrackerTable is auto-pushed by setupTestStack because it's the
-  // projection-table of a registered r.multiStreamProjection — manually
-  // pushing again would re-run the CREATE TABLE and fail duplicate.
+  // globalFeatureStateTable is auto-provisioned by setupTestStack, same as
+  // any other r.storeTable() feature — no manual unsafePushTables needed
+  // (that used to mask a missing r.storeTable() registration entirely, see
+  // the finding this replaces). widgetTrackerTable is auto-pushed too,
+  // it's the projection-table of a registered r.multiStreamProjection —
+  // manually pushing again would re-run the CREATE TABLE and fail duplicate.
   await unsafeCreateEntityTable(stack.db, widgetEntity);
   await unsafeCreateEntityTable(stack.db, widgetAuditEntity, "widget-audit");
 

package/src/feature-toggles/__tests__/toggle-admin.boot.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID } from "../constants";
+import { createFeatureTogglesFeature } from "../feature";
+
+describe("feature-toggles screen + handler access alignment", () => {
+  const features = [createFeatureTogglesFeature()];
+
+  test("boot-validates with toggle-admin screen registered", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("toggle-admin screen is SystemAdmin-gated", () => {
+    const toggles = createFeatureTogglesFeature();
+    const screen = toggles.screens[TOGGLE_ADMIN_SCREEN_ID];
+    expect(screen?.type).toBe("custom");
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(["SystemAdmin"]);
+    }
+  });
+
+  test("queries and set handler are SystemAdmin-only", () => {
+    const toggles = createFeatureTogglesFeature();
+    expect(rolesOf(toggles.queryHandlers["list"]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(toggles.queryHandlers["registered"]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(toggles.writeHandlers["set"]?.access)).toEqual(["SystemAdmin"]);
+    void FeatureToggleQueries;
+    void FeatureToggleHandlers;
+  });
+});

package/src/feature-toggles/__tests__/toggle-admin.security.integration.test.ts

@@ -0,0 +1,69 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID } from "../constants";
+import { createFeatureTogglesFeature } from "../feature";
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createFeatureTogglesFeature()],
+  });
+  // globalFeatureStateTable is auto-provisioned by setupTestStack — no
+  // manual unsafePushTables needed (that used to mask a missing
+  // r.storeTable() registration entirely).
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("feature-toggles access matrix", () => {
+  test("queries, set, and screen are SystemAdmin-only", () => {
+    expect(rolesOf(stack.registry.getQueryHandler(FeatureToggleQueries.list)?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+    expect(
+      rolesOf(stack.registry.getQueryHandler(FeatureToggleQueries.registered)?.access),
+    ).toEqual(["SystemAdmin"]);
+    expect(rolesOf(stack.registry.getWriteHandler(FeatureToggleHandlers.set)?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+    const feature = createFeatureTogglesFeature();
+    const screen = feature.screens[TOGGLE_ADMIN_SCREEN_ID];
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(["SystemAdmin"]);
+    }
+  });
+});
+
+describe("feature-toggles HTTP access", () => {
+  test("SystemAdmin can query list and registered", async () => {
+    const admin = createTestUser({ id: 21, roles: ["SystemAdmin"] });
+    const list = await stack.http.queryOk<
+      { items?: readonly unknown[] } | { rows?: readonly unknown[] }
+    >(FeatureToggleQueries.list, {}, admin);
+    expect(typeof list).toBe("object");
+    const registered = await stack.http.queryOk<{ items: readonly unknown[] }>(
+      FeatureToggleQueries.registered,
+      {},
+      admin,
+    );
+    expect(Array.isArray(registered.items)).toBe(true);
+  });
+
+  test("TenantAdmin gets 403 on list, registered, and set", async () => {
+    const user = createTestUser({ id: 22, roles: ["TenantAdmin"] });
+    expect((await stack.http.query(FeatureToggleQueries.list, {}, user)).status).toBe(403);
+    expect((await stack.http.query(FeatureToggleQueries.registered, {}, user)).status).toBe(403);
+    expect(
+      (await stack.http.write(FeatureToggleHandlers.set, { featureName: "x", enabled: true }, user))
+        .status,
+    ).toBe(403);
+  });
+});