@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -0,0 +1,52 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import {
+  crossTenantOverrideDenied,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { z } from "zod";
+import { type PageRow, pagesTable } from "../table";
+
+// Public-Read aller published Pages eines Tenants — Discovery-Quelle für
+// sitemap.xml/llms.txt (siehe seo-Feature). Anders als by-slug (single-row,
+// nur der angefragte Slug) listet dies alle published Slugs auf einmal, SQL-
+// seitig auf `published = true` gefiltert (Drafts nie im Ergebnis, kein
+// Body-Content — Discovery-Zweck braucht nur Slug/Title/updatedAt).
+// Anonymous: explizit in roles, symmetrisch zu text-content's by-tenant.
+export type PublishedPageSummary = {
+  readonly slug: string;
+  readonly lang: string;
+  readonly title: string;
+  readonly updatedAt: Date;
+};
+
+export const byTenantPublishedQuery = defineQueryHandler({
+  name: "by-tenant-published",
+  schema: z.object({
+    /** Optional cross-tenant read — nur für SystemAdmin. Symmetrisch zur
+     *  by-slug.query Override-Logik. */
+    tenantIdOverride: z.string().min(1).optional(),
+  }),
+  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  handler: async (query, ctx) => {
+    const override = query.payload.tenantIdOverride;
+    const overrideDenied = crossTenantOverrideDenied(
+      query.user,
+      override,
+      "managedPages.errors.tenantOverrideRequiresSystemAdmin",
+    );
+    if (overrideDenied) throw overrideDenied;
+    const tenantId = override ?? query.user.tenantId;
+    const rows = castTenantRows<PageRow>(
+      await selectMany(ctx.db, pagesTable, { tenantId: tenantId, published: true }),
+    );
+    return {
+      pages: rows.map((row) => ({
+        slug: row.slug,
+        lang: row.lang,
+        title: row.title,
+        updatedAt: row.updatedAt,
+      })),
+    };
+  },
+});

package/src/managed-pages/i18n.ts

@@ -0,0 +1,66 @@
+// @runtime client
+// Pure-Data (i18n-Keys) — client-marked, damit das web/-Bundle sie in den
+// Browser-Store pivotieren darf; feature.ts (server) importiert sie ebenso
+// (server darf client-safe Pure-Data importieren, wie PAT constants.ts).
+//
+// Übersetzungs-Bundle für die managed-pages Admin-Screens. Ohne diese Keys
+// rendert die UI die Roh-i18n-Keys (screen:*.title, entity:*:field:*, Section-
+// Header). Der Boot-Validator (required-surface-keys) verlangt — sobald ein
+// Feature r.translations ruft — den KOMPLETTEN Required-Surface-Satz in de+en;
+// diese Datei deckt jeden Screen/Feld/Section-Key ab, den managed-pages
+// registriert. Die zwei customCss-Keys werden unconditional geliefert (schaden
+// bei allowCustomCss:false nicht, sind aber Pflicht für Consumer die es aktivieren).
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
+  // Screen-Titel (global/unpräfixiert — screenTitleKey = screen:<id>.title)
+  "screen:page-list.title": { de: "Seiten", en: "Pages" },
+  "screen:page-edit.title": { de: "Seite bearbeiten", en: "Edit page" },
+  "screen:branding-settings.title": { de: "Branding", en: "Branding" },
+
+  // Page-Entity Feld-Labels (managed-pages:entity:page:field:*)
+  "managed-pages:entity:page:field:slug": { de: "Slug", en: "Slug" },
+  "managed-pages:entity:page:field:lang": { de: "Sprache", en: "Language" },
+  "managed-pages:entity:page:field:title": { de: "Titel", en: "Title" },
+  "managed-pages:entity:page:field:published": { de: "Veröffentlicht", en: "Published" },
+  "managed-pages:entity:page:field:published:option:true": {
+    de: "Veröffentlicht",
+    en: "Published",
+  },
+  "managed-pages:entity:page:field:published:option:false": { de: "Entwurf", en: "Draft" },
+  "managed-pages:entity:page:field:description": { de: "Beschreibung", en: "Description" },
+  "managed-pages:entity:page:field:ogImage": { de: "OG-Bild", en: "OG image" },
+  "managed-pages:entity:page:field:body": { de: "Inhalt", en: "Content" },
+
+  // Config-Edit Feld-Labels (managed-pages:entity:__config-edit__:field:*, camelCase Form-Keys)
+  "managed-pages:entity:__config-edit__:field:title": { de: "Website-Titel", en: "Site title" },
+  "managed-pages:entity:__config-edit__:field:description": {
+    de: "Beschreibung",
+    en: "Description",
+  },
+  "managed-pages:entity:__config-edit__:field:siteUrl": { de: "Website-URL", en: "Site URL" },
+  "managed-pages:entity:__config-edit__:field:accentColor": {
+    de: "Akzentfarbe",
+    en: "Accent color",
+  },
+  "managed-pages:entity:__config-edit__:field:logoUrl": { de: "Logo-URL", en: "Logo URL" },
+  "managed-pages:entity:__config-edit__:field:layoutPreset": { de: "Layout", en: "Layout" },
+
+  // Section-Header
+  "managed-pages:section.meta": { de: "Metadaten", en: "Metadata" },
+  "managed-pages:section.body": { de: "Inhalt", en: "Content" },
+  "managed-pages:branding.section.identity": { de: "Identität", en: "Identity" },
+
+  // Row-Actions + Confirm (pageListScreen)
+  "managed-pages:actions.edit": { de: "Bearbeiten", en: "Edit" },
+  "managed-pages:actions.delete": { de: "Löschen", en: "Delete" },
+  "managed-pages:confirms.page-delete": {
+    de: "Diese Seite wirklich löschen?",
+    en: "Delete this page?",
+  },
+
+  // Nur bei allowCustomCss:true im Screen — unconditional geliefert
+  "managed-pages:entity:__config-edit__:field:customCss": { de: "Eigenes CSS", en: "Custom CSS" },
+  "managed-pages:branding.section.custom-css": { de: "Eigenes CSS", en: "Custom CSS" },
+};

package/src/managed-pages/screens/page-screens.ts

@@ -24,7 +24,11 @@ export const pageListScreen: EntityListScreenDefinition = {
     "title",
     {
       field: "published",
-      renderer: { format: "boolean", trueLabel: "Published", falseLabel: "Draft" },
+      renderer: {
+        format: "boolean",
+        trueLabel: "managed-pages:entity:page:field:published:option:true",
+        falseLabel: "managed-pages:entity:page:field:published:option:false",
+      },
     },
   ],
   defaultSort: { field: "slug", dir: "asc" },

package/src/managed-pages/web/client-plugin.tsx

@@ -0,0 +1,22 @@
+// @runtime client
+// Client-Feature-Factory für managed-pages. Bringt NUR die Übersetzungen mit —
+// die Screens (page-list/page-edit/branding-settings) sind schema-driven
+// (entityList/entityEdit/configEdit), also keine custom-React-Components zu
+// registrieren. Apps mounten es in createKumikoApp({ clientFeatures:
+// [managedPagesClient()] }), damit die Admin-Labels übersetzt rendern.
+
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { defaultTranslations } from "./i18n";
+
+export type ManagedPagesClientOptions = {
+  /** Key-wise Overrides über die Default-Bundles (de/en). */
+  readonly translations?: TranslationsByLocale;
+};
+
+export function managedPagesClient(options?: ManagedPagesClientOptions): ClientFeatureDefinition {
+  return {
+    name: "managed-pages",
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+  };
+}

package/src/managed-pages/web/i18n.ts

@@ -0,0 +1,24 @@
+// @runtime client
+// Client-i18n-Bundle für die managed-pages Admin-Screens. Der Browser-Renderer
+// baut seinen Fallback-Locale-Store NUR aus clientFeatures[].translations — der
+// server-seitige r.translations-Bundle (feature.ts) erreicht ihn nie. Damit die
+// configEdit/entityEdit-Labels im Client übersetzt rendern statt roh, spiegeln
+// wir hier dieselben Keys.
+//
+// Single source: pivotiert MANAGED_PAGES_I18N (key-first { key: {de,en} },
+// Server-Form) in die locale-first TranslationsByLocale-Form die der Client
+// erwartet — kein Key-Duplikat, kein Drift.
+
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import { MANAGED_PAGES_I18N } from "../i18n";
+
+const LOCALES = ["de", "en"] as const;
+
+export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
+  LOCALES.map((locale) => [
+    locale,
+    Object.fromEntries(
+      Object.entries(MANAGED_PAGES_I18N).map(([key, value]) => [key, value[locale]]),
+    ),
+  ]),
+);

package/src/managed-pages/web/index.ts

@@ -0,0 +1,3 @@
+// @runtime client
+export { type ManagedPagesClientOptions, managedPagesClient } from "./client-plugin";
+export { defaultTranslations } from "./i18n";

package/src/page-render/__tests__/layout.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, test } from "bun:test";
+import { wrapInLayout } from "../layout";
+
+describe("wrapInLayout :: seo (opt-in OG/JSON-LD extension)", () => {
+  test("without `seo` — unchanged minimal title+description head (no regression)", () => {
+    const html = wrapInLayout({
+      title: "About",
+      bodyHtml: "<p>x</p>",
+      lang: "en",
+      description: "About us",
+    });
+    expect(html).toContain("<title>About</title>");
+    expect(html).toContain('<meta name="description" content="About us">');
+    expect(html).not.toContain("og:title");
+    expect(html).not.toContain("application/ld+json");
+  });
+
+  test("with `seo` — emits OG/canonical/JSON-LD via the shared apex head renderer", () => {
+    const html = wrapInLayout({
+      title: "About",
+      bodyHtml: "<p>x</p>",
+      lang: "en",
+      description: "About us",
+      seo: {
+        canonicalUrl: "https://acme.test/about",
+        ogImage: "https://acme.test/og.png",
+        siteName: "Acme",
+        schemaJson: { "@context": "https://schema.org", "@type": "WebPage", name: "About" },
+      },
+    });
+    expect(html).toContain("<title>About</title>");
+    expect(html).toContain('<meta property="og:title" content="About" />');
+    expect(html).toContain('<meta property="og:description" content="About us" />');
+    expect(html).toContain('<link rel="canonical" href="https://acme.test/about" />');
+    expect(html).toContain('<meta property="og:image" content="https://acme.test/og.png" />');
+    expect(html).toContain('<meta property="og:site_name" content="Acme" />');
+    expect(html).toContain('<script type="application/ld+json">');
+    expect(html).toContain('"@type":"WebPage"');
+    // no-`seo` minimal-description meta must NOT also appear (headTags replaces it)
+    expect(html).not.toContain('<meta name="description" content="About us">');
+  });
+
+  test('with `seo` — no description means no <meta name="description"> at all (not an empty one)', () => {
+    const html = wrapInLayout({
+      title: "About",
+      bodyHtml: "<p>x</p>",
+      lang: "en",
+      seo: {},
+    });
+    expect(html).not.toContain('<meta name="description"');
+  });
+
+  test("with `seo` — escapes title/description same as the non-seo path", () => {
+    const html = wrapInLayout({
+      title: "<script>alert(1)</script>",
+      bodyHtml: "x",
+      lang: "en",
+      seo: {},
+    });
+    expect(html).not.toContain("<script>alert(1)</script>");
+    expect(html).toContain("&lt;script&gt;");
+  });
+});

package/src/page-render/__tests__/markdown.test.ts

@@ -20,6 +20,35 @@ describe("renderSafeMarkdown — XSS-Härtung", () => {
     expect(html).toContain('href="#"');
   });
 
+  // kumiko-framework#1522/#1523: CommonMark allows a tab inside a
+  // <...>-bracketed link destination; `.trim()` only strips leading/
+  // trailing whitespace, so "java\tscript:" survived isSafeHref's scheme
+  // regex (the tab breaks the character class before ":", the check falls
+  // through to `return true`) and the browser normalizes it back to
+  // "javascript:" on click. Mirrors xss-safety.test.tsx's UNSAFE_HREFS.
+  test("java\\tscript:-Link-href (tab-obfuscated scheme via <...> destination) wird neutralisiert", () => {
+    const html = renderSafeMarkdown("[klick](<java\tscript:alert(1)>)");
+    expect(html.toLowerCase()).not.toContain("javascript:");
+    expect(html).toContain('href="#"');
+  });
+
+  // kumiko-framework#1545: HTML character references decode client-side
+  // (the browser parses them before the URL parser ever sees the value),
+  // so "javascript&colon;", "java&Tab;script:" and "java&#9;script:" all
+  // normalize to an executable javascript: URL on click even though none
+  // contains a literal ":" for isSafeHref's pre-decode scheme check.
+  test("HTML-entity-obfuscated javascript: hrefs are neutralized", () => {
+    for (const href of [
+      "javascript&colon;alert(1)",
+      "java&Tab;script:alert(1)",
+      "java&#9;script:alert(1)",
+    ]) {
+      const html = renderSafeMarkdown(`[klick](<${href}>)`);
+      expect(html.toLowerCase()).not.toContain("javascript:");
+      expect(html).toContain('href="#"');
+    }
+  });
+
   test("data:-Image-src wird neutralisiert", () => {
     const html = renderSafeMarkdown("![x](data:text/html;base64,PHNjcmlwdD4=)");
     expect(html.toLowerCase()).not.toContain("data:");

package/src/page-render/branding.ts

@@ -73,6 +73,7 @@ export function brandingStyleBlock(tokens: BrandingTokens): string {
     decls.push(`--accent:${tokens.accentColor}`);
   }
   decls.push(`--page-max-width:${layoutMaxWidth(tokens.layoutPreset)}`);
+  // html-ok: decls are CSS custom-property declarations (regex-validated hex color or fixed table lookup), never raw user text.
   return `<style id="tenant-theme">:root{${decls.join(";")}}</style>`;
 }
 
@@ -91,9 +92,9 @@ export function brandingHeaderHtml(tokens: BrandingTokens): string {
   }
   if (parts.length === 0) return "";
 
-  const inner = parts.join("\n");
+  const innerHtml = parts.join("\n");
   if (isSafeHttpsUrl(tokens.siteUrl)) {
-    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${inner}</a></header>`;
+    return `<header class="brand-header"><a href="${escapeHtmlAttr(tokens.siteUrl)}">${innerHtml}</a></header>`;
   }
-  return `<header class="brand-header">${inner}</header>`;
+  return `<header class="brand-header">${innerHtml}</header>`;
 }

package/src/page-render/index.ts

@@ -12,6 +12,6 @@ export {
   cachedSecurePageResponse,
 } from "./cached-page-response";
 export { sanitizeTenantCss } from "./css-sanitize";
-export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout";
+export { type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout";
 export { renderSafeMarkdown } from "./markdown";
 export { securePageHeaders } from "./security-headers";

package/src/page-render/layout.ts

@@ -1,7 +1,13 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { type ApexHead, renderApexHeadTags } from "@cosmicdrift/kumiko-headless/apex";
 import { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock } from "./branding";
 import { sanitizeTenantCss } from "./css-sanitize";
 
+// Optional OG/JSON-LD/canonical extension for wrapInLayout — the same field
+// set renderApexPage accepts, minus title/description/lang (those come from
+// wrapInLayout's own opts, so callers don't repeat them).
+export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
+
 // Attribute marking the content container. The page body lives in
 // `<main data-tenant-content>`; tenant custom CSS is scoped to its descendants
 // and host containment clips its paint to this box. A custom wrapLayout that
@@ -33,6 +39,7 @@ const TENANT_CLIP = `${TENANT_SCOPE}{overflow:hidden}`;
 export function tenantStyleBlock(customCss: string): string {
   const sanitized = sanitizeTenantCss(customCss, TENANT_SCOPE);
   if (!sanitized) return "";
+  // html-ok: sanitizeTenantCss ist die Escaping-Boundary (Allowlist, strippt `<`).
   return `\n<style data-tenant-css>${TENANT_CONTAINMENT}\n${TENANT_CLIP}\n${sanitized}</style>`;
 }
 
@@ -51,8 +58,11 @@ export function wrapInLayout(opts: {
   lang: string;
   description?: string | null;
   branding?: BrandingTokens;
+  /** Adds Open Graph/Twitter/canonical/JSON-LD tags via the shared apex head
+   *  renderer. Omitted → unchanged minimal title+description behavior. */
+  seo?: SeoHeadInput;
 }): string {
-  const themeStyle = opts.branding ? brandingStyleBlock(opts.branding) : "";
+  const themeStyleHtml = opts.branding ? brandingStyleBlock(opts.branding) : "";
   const header = opts.branding ? brandingHeaderHtml(opts.branding) : "";
   // Untrusted per-tenant CSS — scoped, allowlist-sanitized and host-contained
   // at the render boundary by tenantStyleBlock (same helper a custom wrapLayout
@@ -68,12 +78,17 @@ export function wrapInLayout(opts: {
   const metaDescription = description
     ? `\n<meta name="description" content="${escapeHtmlAttr(description)}">`
     : "";
+  // Without `seo`: identical title+description emission as before (no
+  // behavior change for legal-pages/managed-pages callers that don't pass it).
+  const headHtml = opts.seo
+    ? renderApexHeadTags({ title: opts.title, description, lang: opts.lang, ...opts.seo })
+    : `<title>${escapeHtml(opts.title)}</title>${metaDescription}`;
   return `<!doctype html>
 <html lang="${escapeHtmlAttr(opts.lang)}">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtml(opts.title)}</title>${metaDescription}
+${headHtml}
 <style>
   :root { --accent: #0066cc; --page-max-width: 720px; }
   body { font-family: system-ui, -apple-system, sans-serif; max-width: var(--page-max-width);
@@ -88,7 +103,7 @@ export function wrapInLayout(opts: {
   .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }
   .brand-logo { height: 2rem; width: auto; }
   .brand-title { font-weight: 600; font-size: 1.1rem; }
-</style>${themeStyle}${tenantStyle}
+</style>${themeStyleHtml}${tenantStyle}
 </head>
 <body>
 ${header}

package/src/page-render/markdown.ts

@@ -1,4 +1,4 @@
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-headless";
 import { Marked } from "marked";
 
 // Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-
@@ -24,14 +24,6 @@ safeRenderer.use({
   },
 });
 
-// http(s)/mailto oder schema-los (relativ/anchor) erlaubt; javascript:, data:,
-// vbscript: u.a. abgelehnt. Ein relativer href hat kein `scheme:`-Präfix.
-function isSafeHref(href: string): boolean {
-  const trimmed = href.trim().toLowerCase();
-  if (!/^[a-z][a-z0-9+.-]*:/.test(trimmed)) return true;
-  return /^(?:https?|mailto):/.test(trimmed);
-}
-
 export function renderSafeMarkdown(markdown: string): string {
   // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
   // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.

package/src/page-render/web.ts

@@ -0,0 +1,13 @@
+export {
+  type BrandingTokens,
+  brandingHeaderHtml,
+  brandingStyleBlock,
+  EMPTY_BRANDING,
+  isSafeHexColor,
+  isSafeHttpsUrl,
+  layoutMaxWidth,
+} from "./branding";
+export { sanitizeTenantCss } from "./css-sanitize";
+export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout";
+export { renderSafeMarkdown } from "./markdown";
+export { securePageHeaders } from "./security-headers";

package/src/personal-access-tokens/__tests__/feature.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, test } from "bun:test";
+import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
+import { EXT_TOKEN_VERIFIER } from "../../auth-foundation";
+import { createPersonalAccessTokensFeature } from "../feature";
+
+describe("createPersonalAccessTokensFeature toggleable-option (tier-gating)", () => {
+  test("without toggleable: feature is always-on (toggleableDefault undefined)", () => {
+    expect(createPersonalAccessTokensFeature({ scopes: {} }).toggleableDefault).toBeUndefined();
+  });
+
+  test("toggleable:{default:false} makes the feature tier-gatable, fail-closed", () => {
+    const feature = createPersonalAccessTokensFeature({
+      scopes: {},
+      toggleable: { default: false },
+    });
+    expect(feature.toggleableDefault).toBe(false);
+  });
+
+  test("toggleable:{default:true} declares toggleable, enabled-by-default", () => {
+    const feature = createPersonalAccessTokensFeature({
+      scopes: {},
+      toggleable: { default: true },
+    });
+    expect(feature.toggleableDefault).toBe(true);
+  });
+});
+
+describe("createPersonalAccessTokensFeature — tokenVerifier registration (#1369)", () => {
+  test('registers via r.useExtension(EXT_TOKEN_VERIFIER, "pat", ...) instead of a patResolver field', () => {
+    const feature = createPersonalAccessTokensFeature({ scopes: {} });
+    expect(feature.extensionUsages).toHaveLength(1);
+    const [usage] = feature.extensionUsages;
+    expect(usage?.extensionName).toBe(EXT_TOKEN_VERIFIER);
+    expect(usage?.entityName).toBe("pat");
+    expect(usage?.options).toMatchObject({ shape: { kind: "prefix", prefix: PAT_TOKEN_PREFIX } });
+  });
+
+  test("requires auth-foundation (owner of EXT_TOKEN_VERIFIER)", () => {
+    const feature = createPersonalAccessTokensFeature({ scopes: {} });
+    expect(feature.requires).toContain("auth-foundation");
+  });
+});