@cosmicdrift/kumiko-dev-server 0.105.1 → 0.108.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.105.1",
+  "version": "0.108.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.105.1",
-    "@cosmicdrift/kumiko-framework": "0.105.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.108.0",
+    "@cosmicdrift/kumiko-framework": "0.108.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-features-wiring.integration.test.ts

@@ -50,7 +50,6 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
 import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
-import { deleteMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -59,6 +58,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { deleteRows } from "@cosmicdrift/kumiko-framework/testing";
 import { composeFeatures } from "../compose-features";
 
 const RESET_HMAC = randomBytes(32).toString("base64");
@@ -184,8 +184,8 @@ describe("composeFeatures wiring — passwordReset", () => {
   });
 
   beforeEach(async () => {
-    await deleteMany(suite.stack.db, userTable, {});
-    await deleteMany(suite.stack.db, tenantMembershipsTable, {});
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
     suite.emailTransport.sent.length = 0;
   });
 
@@ -257,8 +257,8 @@ describe("composeFeatures wiring — emailVerification", () => {
   });
 
   beforeEach(async () => {
-    await deleteMany(suite.stack.db, userTable, {});
-    await deleteMany(suite.stack.db, tenantMembershipsTable, {});
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
     suite.emailTransport.sent.length = 0;
   });
 
@@ -302,8 +302,8 @@ describe("composeFeatures wiring — asymmetric activation", () => {
   });
 
   beforeEach(async () => {
-    await deleteMany(suite.stack.db, userTable, {});
-    await deleteMany(suite.stack.db, tenantMembershipsTable, {});
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
     suite.emailTransport.sent.length = 0;
   });
 
@@ -355,8 +355,8 @@ describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
   });
 
   afterEach(async () => {
-    await deleteMany(suite.stack.db, userTable, {});
-    await deleteMany(suite.stack.db, tenantMembershipsTable, {});
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
     suite.emailTransport.sent.length = 0;
   });
 

package/src/__tests__/compose-features.test.ts

@@ -7,7 +7,7 @@
 // aber die Handler fehlen → POST /api/auth/request-password-reset
 // dispatched ins Leere → 500.
 
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "../compose-features";
 
@@ -104,9 +104,14 @@ describe("composeFeatures", () => {
     // copy via includeBundled:true, and createRegistry throws "Duplicate
     // feature: auth-email-password". The dedupe path keeps the bundled
     // instance (it carries authOptions wiring) and drops the app stub.
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     const features = composeFeatures([pickerAuthDupe, noopFeature], {
       includeBundled: true,
     });
+    // The warn is part of the fix contract (changeset: "warn so the user can
+    // remove the line") — without this assertion the warn is removable with no RED.
+    expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("auth-email-password"));
+    warnSpy.mockRestore();
     expect(features.map((f) => f.name)).toEqual([
       "config",
       "user",

package/src/__tests__/config-resolver-default.integration.test.ts

@@ -5,13 +5,19 @@ import {
   createConfigFeature,
   createConfigResolver,
 } from "@cosmicdrift/kumiko-bundled-features/config";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createTenantConfig,
+  defineFeature,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
 import { mergeConfigResolverDefault } from "../run-dev-app";
 
 // Pins runDevApp's ENV→config-app-override wiring: mergeConfigResolverDefault
@@ -22,6 +28,18 @@ import { mergeConfigResolverDefault } from "../run-dev-app";
 
 const PAGE_SIZE = "devcfg:config:page-size";
 
+// Reads ctx.config directly — the exact consumption seam mergeConfigResolverDefault
+// wires the dispatcher through. Every other test in this file inspects the returned
+// {configResolver, _configAccessorFactory} object without ever dispatching a handler
+// that actually reads ctx.config; a "Boot writes field A, dispatcher expects field B"
+// drift (the original #359-adjacent bug class) would be invisible to all of them.
+const readPageSizeQuery = defineQueryHandler({
+  name: "read-page-size",
+  schema: z.object({}),
+  access: { openToAll: true },
+  handler: async (_query, ctx) => ({ pageSize: await ctx.config?.(PAGE_SIZE) }),
+});
+
 const devcfgFeature = defineFeature("devcfg", (r) => {
   r.requires("config");
   r.config({
@@ -34,6 +52,7 @@ const devcfgFeature = defineFeature("devcfg", (r) => {
       }),
     },
   });
+  r.queryHandler(readPageSizeQuery);
 });
 
 // ctx=undefined → object form, configResolver is the only key (test boundary).
@@ -128,4 +147,19 @@ describe("runDevApp configResolver-default — ENV→app-override bridge", () =>
     // was built from the caller's resolver, exactly like money-horse's "s3-env".
     expect(await accessor(PAGE_SIZE)).toBe("99");
   });
+
+  test("a real dispatch through stack.http resolves ctx.config end-to-end (not the factory called directly)", async () => {
+    // Every test above calls mergeConfigResolverDefault()/_configAccessorFactory
+    // directly — none go through an actual dispatched request. The original bug
+    // this feature guards against ("boot writes configResolver, dispatcher reads
+    // a different field") only manifests on a REAL dispatch, where the
+    // dispatcher's own wiring (not test code) builds ctx.config from
+    // _configAccessorFactory. This is that missing end-to-end proof.
+    const res = await stack.http.queryOk<{ pageSize: number | undefined }>(
+      "devcfg:query:read-page-size",
+      {},
+      TestUsers.systemAdmin,
+    );
+    expect(res.pageSize).toBe(10); // keyDef.default — no env override wired on this stack
+  });
 });

package/src/__tests__/require-env.test.ts

@@ -0,0 +1,29 @@
+// requireEnv — the missing-var error message must match the actual caller.
+// Regression (728/2): the advice text was hardcoded to prod/container
+// wording ("Coolify secrets") regardless of the `context` param, so a
+// runDevApp caller got misleading production-deploy instructions for a
+// missing local .env var.
+
+import { describe, expect, test } from "bun:test";
+import { requireEnv } from "../run-prod-app";
+
+describe("requireEnv", () => {
+  test("default context (runProdApp) gives container/production advice", () => {
+    expect(() => requireEnv("MISSING_VAR", {})).toThrow(/container env.*Coolify secrets/);
+  });
+
+  test("runDevApp context gives local .env advice, not production advice", () => {
+    expect(() => requireEnv("MISSING_VAR", {}, "runDevApp")).toThrow(
+      /\.env \/ shell before running the dev server/,
+    );
+  });
+
+  test("runDevApp context error does NOT mention Coolify", () => {
+    try {
+      requireEnv("MISSING_VAR", {}, "runDevApp");
+      throw new Error("expected requireEnv to throw");
+    } catch (err) {
+      expect(String(err)).not.toContain("Coolify");
+    }
+  });
+});

package/src/__tests__/run-dev-app.integration.test.ts

@@ -6,7 +6,18 @@
 // path would silently drop the fail-closed guard and dev/prod would diverge.
 
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  requireTextContent,
+  type TextContentApi,
+} from "@cosmicdrift/kumiko-bundled-features/text-content";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
 import type { KumikoServerHandle } from "../create-kumiko-server";
 import { runDevApp } from "../run-dev-app";
 
@@ -37,6 +48,24 @@ afterEach(async () => {
   else process.env["JWT_SECRET"] = savedJwtSecret;
 });
 
+describe("runDevApp — auth.mail fail-fast on missing JWT_SECRET", () => {
+  test("options.auth set but JWT_SECRET missing → throws, no dev-fallback", async () => {
+    // beforeEach sets JWT_SECRET unconditionally for every OTHER test in this
+    // file — none of them ever exercise the missing-secret path, so it's
+    // unclear whether the fail-closed guard (requireEnv, not the old dev-
+    // fallback) actually fires or was silently dropped. Pass a custom
+    // envSource without JWT_SECRET instead of touching process.env.
+    const { JWT_SECRET: _drop, ...envWithoutJwtSecret } = process.env;
+    await expect(
+      runDevApp({
+        features: [validFeature()],
+        auth: { admin: ADMIN, cookieDomain: "example.eu", allowedOrigins: ["https://example.eu"] },
+        envSource: envWithoutJwtSecret,
+      }),
+    ).rejects.toThrow(/JWT_SECRET/);
+  });
+});
+
 describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {
   test("cookieDomain without allowedOrigins fails closed — guard is wired through runDevApp", async () => {
     await expect(
@@ -80,3 +109,48 @@ describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {
     expect(handle).toBeDefined();
   });
 });
+
+describe("runDevApp — extraContext merge order: app values win over boot defaults (707/1)", () => {
+  test("a caller-supplied extraContext.textContent wins over the auto-wired boot default", async () => {
+    // runDevApp's extraContext factory does `{ ...boot, ...base }` — boot's
+    // auto-wired textContent must lose to a caller-supplied override, exactly
+    // the "app values win" parity claim this PR made against runProdApp. Every
+    // OTHER test in this file only checks that runDevApp boots without
+    // throwing; none dispatch a request that actually reads the merged value.
+    const sentinel: TextContentApi = {
+      getBlock: async () => ({
+        slug: "sentinel",
+        lang: "en",
+        title: "from caller extraContext",
+        body: null,
+        updatedAt: new Date(0),
+      }),
+    };
+    const readBlockQuery = defineQueryHandler({
+      name: "read-block",
+      schema: z.object({}),
+      access: { openToAll: true },
+      handler: async (_query, ctx) => {
+        const api = requireTextContent(ctx, "textcheck:query:read-block");
+        return api.getBlock({ tenantId: TestUsers.systemAdmin.tenantId, slug: "x", lang: "en" });
+      },
+    });
+    const textcheckFeature = defineFeature("textcheck", (r) => {
+      r.queryHandler(readBlockQuery);
+    });
+
+    handle = await runDevApp({
+      features: [validFeature(), textcheckFeature],
+      port: 0,
+      extraContext: { textContent: sentinel },
+    });
+
+    const res = await handle.stack.http.queryOk<{ title: string } | null>(
+      "textcheck:query:read-block",
+      {},
+      TestUsers.systemAdmin,
+    );
+
+    expect(res?.title).toBe("from caller extraContext");
+  });
+});

package/src/__tests__/scaffold-app-feature.test.ts

@@ -10,10 +10,10 @@ import { scaffoldAppFeature } from "../scaffold-app-feature";
 describe("scaffoldAppFeature", () => {
   let tmp: string;
   let appRoot: string;
-  beforeEach(() => {
+  beforeEach(async () => {
     tmp = mkdtempSync(join(tmpdir(), "scaffold-app-feature-"));
     appRoot = join(tmp, "my-shop");
-    scaffoldApp({ name: "my-shop", destination: appRoot });
+    await scaffoldApp({ name: "my-shop", destination: appRoot });
   });
   afterEach(() => {
     rmSync(tmp, { recursive: true, force: true });