@cosmicdrift/kumiko-dev-server 0.104.0 → 0.105.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.104.0",
+  "version": "0.105.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.104.0",
-    "@cosmicdrift/kumiko-framework": "0.104.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.105.0",
+    "@cosmicdrift/kumiko-framework": "0.105.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/run-dev-app.integration.test.ts

@@ -5,7 +5,7 @@
 // run-prod-app forwarding pair. Without it a typo or wrong spread-key on the dev
 // path would silently drop the fail-closed guard and dev/prod would diverge.
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import type { KumikoServerHandle } from "../create-kumiko-server";
 import { runDevApp } from "../run-dev-app";
@@ -24,10 +24,17 @@ const ADMIN = {
 };
 
 let handle: KumikoServerHandle | undefined;
+const savedJwtSecret = process.env["JWT_SECRET"];
+
+beforeEach(() => {
+  process.env["JWT_SECRET"] = "test-rundev-secret-32-chars-min!!!!";
+});
 
 afterEach(async () => {
   await handle?.stop();
   handle = undefined;
+  if (savedJwtSecret === undefined) delete process.env["JWT_SECRET"];
+  else process.env["JWT_SECRET"] = savedJwtSecret;
 });
 
 describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {

package/src/run-dev-app.ts

@@ -73,7 +73,12 @@ import type {
   PasswordResetSetup,
   SignupSetup,
 } from "./run-prod-app";
-import { addConfigAccessorFactory, buildBootExtraContext, resolveAuthMail } from "./run-prod-app";
+import {
+  addConfigAccessorFactory,
+  buildBootExtraContext,
+  requireEnv,
+  resolveAuthMail,
+} from "./run-prod-app";
 
 export type RunDevAppAuthOptions = {
   /** Admin user to seed at boot. Idempotent — re-runs in persistent-DB
@@ -210,15 +215,10 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // auseinanderdriften können).
   const envSource = options.envSource ?? process.env;
   // auth.mail → normalisiert in die expliziten Flow-Felder (symmetrisch zu
-  // runProdApp). hmacSecret = JWT_SECRET-env mit Dev-Fallback (der Dev-Server
-  // mintet JWTs selbst; der Reset-Token-HMAC teilt denselben Key wie in den
-  // Apps). Ab hier IMMER effectiveAuth statt options.auth.
+  // runProdApp). hmacSecret = JWT_SECRET-env (fail-fast, symmetrisch zu
+  // runProdApp). Ab hier IMMER effectiveAuth statt options.auth.
   const effectiveAuth = options.auth
-    ? resolveAuthMail(
-        options.auth,
-        envSource["JWT_SECRET"] ?? "kumiko-dev-auth-mail-hmac-fallback-secret",
-        envSource,
-      )
+    ? resolveAuthMail(options.auth, requireEnv("JWT_SECRET", envSource, "runDevApp"), envSource)
     : undefined;
   const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
   const features = composeFeatures(options.features, {

package/src/run-prod-app.ts

@@ -163,11 +163,15 @@ export function buildBunServeOptions(
 // `src` defaults to process.env but is threaded from the caller's envSource
 // so the boot-path reads the SAME env-quelle that was validated above —
 // injected dummies in test-mode must not silently fall back to process.env.
-function requireEnv(name: string, src: Record<string, string | undefined> = process.env): string {
+export function requireEnv(
+  name: string,
+  src: Record<string, string | undefined> = process.env,
+  context = "runProdApp",
+): string {
   const value = src[name];
   if (value === undefined || value === "") {
     throw new Error(
-      `runProdApp: required env var "${name}" is missing or empty. ` +
+      `${context}: required env var "${name}" is missing or empty. ` +
         `Set it in your container env / .env.production / Coolify secrets.`,
     );
   }