@cosmicdrift/kumiko-dev-server 0.105.1 → 0.105.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.105.1",
+  "version": "0.105.2",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.105.1",
-    "@cosmicdrift/kumiko-framework": "0.105.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.105.2",
+    "@cosmicdrift/kumiko-framework": "0.105.2",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-features.test.ts

@@ -7,7 +7,7 @@
 // aber die Handler fehlen → POST /api/auth/request-password-reset
 // dispatched ins Leere → 500.
 
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "../compose-features";
 
@@ -104,9 +104,14 @@ describe("composeFeatures", () => {
     // copy via includeBundled:true, and createRegistry throws "Duplicate
     // feature: auth-email-password". The dedupe path keeps the bundled
     // instance (it carries authOptions wiring) and drops the app stub.
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     const features = composeFeatures([pickerAuthDupe, noopFeature], {
       includeBundled: true,
     });
+    // The warn is part of the fix contract (changeset: "warn so the user can
+    // remove the line") — without this assertion the warn is removable with no RED.
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("auth-email-password"));
+    warnSpy.mockRestore();
     expect(features.map((f) => f.name)).toEqual([
       "config",
       "user",

package/src/__tests__/config-resolver-default.integration.test.ts

@@ -5,13 +5,19 @@ import {
   createConfigFeature,
   createConfigResolver,
 } from "@cosmicdrift/kumiko-bundled-features/config";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createTenantConfig,
+  defineFeature,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
 import { mergeConfigResolverDefault } from "../run-dev-app";
 
 // Pins runDevApp's ENV→config-app-override wiring: mergeConfigResolverDefault
@@ -22,6 +28,18 @@ import { mergeConfigResolverDefault } from "../run-dev-app";
 
 const PAGE_SIZE = "devcfg:config:page-size";
 
+// Reads ctx.config directly — the exact consumption seam mergeConfigResolverDefault
+// wires the dispatcher through. Every other test in this file inspects the returned
+// {configResolver, _configAccessorFactory} object without ever dispatching a handler
+// that actually reads ctx.config; a "Boot writes field A, dispatcher expects field B"
+// drift (the original #359-adjacent bug class) would be invisible to all of them.
+const readPageSizeQuery = defineQueryHandler({
+  name: "read-page-size",
+  schema: z.object({}),
+  access: { openToAll: true },
+  handler: async (_query, ctx) => ({ pageSize: await ctx.config?.(PAGE_SIZE) }),
+});
+
 const devcfgFeature = defineFeature("devcfg", (r) => {
   r.requires("config");
   r.config({
@@ -34,6 +52,7 @@ const devcfgFeature = defineFeature("devcfg", (r) => {
       }),
     },
   });
+  r.queryHandler(readPageSizeQuery);
 });
 
 // ctx=undefined → object form, configResolver is the only key (test boundary).
@@ -128,4 +147,19 @@ describe("runDevApp configResolver-default — ENV→app-override bridge", () =>
     // was built from the caller's resolver, exactly like money-horse's "s3-env".
     expect(await accessor(PAGE_SIZE)).toBe("99");
   });
+
+  test("a real dispatch through stack.http resolves ctx.config end-to-end (not the factory called directly)", async () => {
+    // Every test above calls mergeConfigResolverDefault()/_configAccessorFactory
+    // directly — none go through an actual dispatched request. The original bug
+    // this feature guards against ("boot writes configResolver, dispatcher reads
+    // a different field") only manifests on a REAL dispatch, where the
+    // dispatcher's own wiring (not test code) builds ctx.config from
+    // _configAccessorFactory. This is that missing end-to-end proof.
+    const res = await stack.http.queryOk<{ pageSize: number | undefined }>(
+      "devcfg:query:read-page-size",
+      {},
+      TestUsers.systemAdmin,
+    );
+    expect(res.pageSize).toBe(10); // keyDef.default — no env override wired on this stack
+  });
 });

package/src/__tests__/run-dev-app.integration.test.ts

@@ -6,7 +6,18 @@
 // path would silently drop the fail-closed guard and dev/prod would diverge.
 
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  requireTextContent,
+  type TextContentApi,
+} from "@cosmicdrift/kumiko-bundled-features/text-content";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
 import type { KumikoServerHandle } from "../create-kumiko-server";
 import { runDevApp } from "../run-dev-app";
 
@@ -37,6 +48,24 @@ afterEach(async () => {
   else process.env["JWT_SECRET"] = savedJwtSecret;
 });
 
+describe("runDevApp — auth.mail fail-fast on missing JWT_SECRET", () => {
+  test("options.auth set but JWT_SECRET missing → throws, no dev-fallback", async () => {
+    // beforeEach sets JWT_SECRET unconditionally for every OTHER test in this
+    // file — none of them ever exercise the missing-secret path, so it's
+    // unclear whether the fail-closed guard (requireEnv, not the old dev-
+    // fallback) actually fires or was silently dropped. Pass a custom
+    // envSource without JWT_SECRET instead of touching process.env.
+    const { JWT_SECRET: _drop, ...envWithoutJwtSecret } = process.env;
+    await expect(
+      runDevApp({
+        features: [validFeature()],
+        auth: { admin: ADMIN, cookieDomain: "example.eu", allowedOrigins: ["https://example.eu"] },
+        envSource: envWithoutJwtSecret,
+      }),
+    ).rejects.toThrow(/JWT_SECRET/);
+  });
+});
+
 describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {
   test("cookieDomain without allowedOrigins fails closed — guard is wired through runDevApp", async () => {
     await expect(
@@ -80,3 +109,48 @@ describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {
     expect(handle).toBeDefined();
   });
 });
+
+describe("runDevApp — extraContext merge order: app values win over boot defaults (707/1)", () => {
+  test("a caller-supplied extraContext.textContent wins over the auto-wired boot default", async () => {
+    // runDevApp's extraContext factory does `{ ...boot, ...base }` — boot's
+    // auto-wired textContent must lose to a caller-supplied override, exactly
+    // the "app values win" parity claim this PR made against runProdApp. Every
+    // OTHER test in this file only checks that runDevApp boots without
+    // throwing; none dispatch a request that actually reads the merged value.
+    const sentinel: TextContentApi = {
+      getBlock: async () => ({
+        slug: "sentinel",
+        lang: "en",
+        title: "from caller extraContext",
+        body: null,
+        updatedAt: new Date(0),
+      }),
+    };
+    const readBlockQuery = defineQueryHandler({
+      name: "read-block",
+      schema: z.object({}),
+      access: { openToAll: true },
+      handler: async (_query, ctx) => {
+        const api = requireTextContent(ctx, "textcheck:query:read-block");
+        return api.getBlock({ tenantId: TestUsers.systemAdmin.tenantId, slug: "x", lang: "en" });
+      },
+    });
+    const textcheckFeature = defineFeature("textcheck", (r) => {
+      r.queryHandler(readBlockQuery);
+    });
+
+    handle = await runDevApp({
+      features: [validFeature(), textcheckFeature],
+      port: 0,
+      extraContext: { textContent: sentinel },
+    });
+
+    const res = await handle.stack.http.queryOk<{ title: string } | null>(
+      "textcheck:query:read-block",
+      {},
+      TestUsers.systemAdmin,
+    );
+
+    expect(res?.title).toBe("from caller extraContext");
+  });
+});

package/src/__tests__/session-wiring.test.ts

@@ -1,4 +1,8 @@
 import { describe, expect, it } from "bun:test";
+import {
+  createSessionsFeature,
+  SESSIONS_FEATURE,
+} from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { resolveProdSessionsConfig, shouldWireProdSessions } from "../session-wiring";
 
 describe("shouldWireProdSessions — secure-by-default with opt-out (KF-1)", () => {
@@ -25,6 +29,16 @@ describe("shouldWireProdSessions — secure-by-default with opt-out (KF-1)", ()
   });
 });
 
+describe("SESSIONS_FEATURE constant matches the real feature name", () => {
+  it("createSessionsFeature()'s name equals SESSIONS_FEATURE", () => {
+    // shouldWireProdSessions's own arm only tests the pure boolean helper —
+    // the actual run-prod-app.ts integration seam
+    // (`features.some((f) => f.name === SESSIONS_FEATURE)`) drifts silently
+    // if the feature is ever renamed without updating this constant.
+    expect(createSessionsFeature().name).toBe(SESSIONS_FEATURE);
+  });
+});
+
 describe("resolveProdSessionsConfig", () => {
   it("passes a config object through", () => {
     expect(resolveProdSessionsConfig({ expiresInMs: 5000 })).toEqual({ expiresInMs: 5000 });