@cosmicdrift/kumiko-dev-server 0.196.1 → 0.197.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.196.1",
+  "version": "0.197.1",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -54,9 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.196.1",
-    "@cosmicdrift/kumiko-framework": "0.196.1",
-    "@cosmicdrift/kumiko-server-runtime": "0.196.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.197.1",
+    "@cosmicdrift/kumiko-framework": "0.197.1",
+    "@cosmicdrift/kumiko-server-runtime": "0.197.1",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/run-dev-app.integration.test.ts

@@ -5,7 +5,10 @@
 // run-prod-app forwarding pair. Without it a typo or wrong spread-key on the dev
 // path would silently drop the fail-closed guard and dev/prod would diverge.
 
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
+import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import {
   requireTemplateResolver,
   TEXT_BLOCK_KIND,
@@ -16,8 +19,10 @@ import {
   createTextField,
   defineFeature,
   defineQueryHandler,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import * as jose from "jose";
 import { z } from "zod";
 import type { KumikoServerHandle } from "../create-kumiko-server";
 import { runDevApp } from "../run-dev-app";
@@ -174,3 +179,66 @@ describe("runDevApp — extraContext merge order: app values win over boot defau
     expect(res?.title).toBe("from caller extraContext");
   });
 });
+
+// runDevApp had no equivalent of runProdApp's session boot gate (#1262/#1275):
+// a forgotten sessions mount left session-list silently empty instead of
+// saying anything (#2027). Unlike prod, dev warns rather than aborts —
+// mirrors assertPiiBootInvariants' dev/prod split.
+describe("runDevApp — session boot gate (#2027)", () => {
+  const ADMIN = {
+    email: "session-gate-dev@example.eu",
+    password: "test-pw-strong-1234",
+    displayName: "Admin",
+    emailVerified: true,
+    memberships: [
+      {
+        tenantId: "00000000-0000-4000-8000-000000000002" as TenantId,
+        tenantKey: "session-gate-dev",
+        tenantName: "Session Gate Dev",
+        roles: ["Admin"],
+      },
+    ],
+  };
+
+  test("auth mounted, sessions feature missing → warns but still boots (dev doesn't abort)", async () => {
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+    try {
+      handle = await runDevApp({
+        features: [validFeature()],
+        port: 0,
+        auth: { admin: ADMIN },
+      });
+      expect(handle).toBeDefined();
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("sessionStore"));
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("[runDevApp]"));
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
+  test("auth mounted, sessions feature mounted → login actually creates a session (sid on the JWT)", async () => {
+    // The bug this issue reports: a mounted sessions feature whose sessionCreator
+    // never reached the auth config, so login never got a `sid` and
+    // store_user_sessions never got a row — session-list stayed empty with no
+    // error anywhere. A boot that doesn't throw proves nothing about that; only
+    // a real login + decoded JWT does.
+    handle = await runDevApp({
+      features: [
+        authFoundationFeature,
+        createPersonalAccessTokensFeature({ scopes: {} }),
+        createSessionsFeature(),
+      ],
+      port: 0,
+      auth: { admin: ADMIN },
+    });
+
+    const login = await handle.stack.http.raw("POST", "/api/auth/login", {
+      email: ADMIN.email,
+      password: ADMIN.password,
+    });
+    expect(login.status).toBe(200);
+    const body = (await login.json()) as { token?: string };
+    expect(body.token).toBeTypeOf("string");
+    expect(typeof jose.decodeJwt(body.token!).jti).toBe("string");
+  });
+});

package/src/run-dev-app.ts

@@ -78,6 +78,7 @@ import {
   composeFeatures,
 } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { assertPiiBootInvariants } from "@cosmicdrift/kumiko-server-runtime/pii-boot-gate";
+import { assertSessionBootInvariants } from "@cosmicdrift/kumiko-server-runtime/session-boot-gate";
 import { watchAndRegenerate } from "./codegen";
 import {
   type CreateKumikoServerOptions,
@@ -371,13 +372,21 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     blindIndexKey: options.blindIndexKey,
     mode: "dev",
   });
-  const cfgExtra = effectiveAuth
-    ? mergeConfigResolverDefault(
-        options.extraContext,
-        createRegistry(features),
-        envSource,
-        bootCrypto.configCipher,
-      )
+  // Throwaway registry, built once and reused below — mirrors runProdApp's
+  // `createRegistry(features)` right after validateBoot (#2027). Symmetric
+  // sessionStoreProviderMounted check to runProdApp's (registry.getExtension-
+  // Usages, not a raw features.some(...) scan) so dev and prod never ask the
+  // same question two different ways again.
+  const registry = effectiveAuth ? createRegistry(features) : undefined;
+  const sessionStoreProviderMounted =
+    registry !== undefined && registry.getExtensionUsages(EXT_SESSION_STORE).length > 0;
+  assertSessionBootInvariants({
+    hasAuth: Boolean(effectiveAuth),
+    sessionStoreProviderMounted,
+    mode: "dev",
+  });
+  const cfgExtra = registry
+    ? mergeConfigResolverDefault(options.extraContext, registry, envSource, bootCrypto.configCipher)
     : options.extraContext;
   // Auto-wire templateResolver (immer) + secrets (feature-gated), symmetrisch zu
   // runProdApp. Anders als prod existiert die db hier erst im Factory-deps
@@ -444,10 +453,9 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     : {};
 
   // Parity with runProdApp (#1372 review): gate on sessionStore provider, not
-  // the sessions feature name — a custom provider must also wire auth callbacks.
-  const sessionStoreProviderMounted = features.some((f) =>
-    f.extensionUsages.some((u) => u.extensionName === EXT_SESSION_STORE),
-  );
+  // the sessions feature name — a custom provider must also wire auth
+  // callbacks. sessionStoreProviderMounted computed above via the registry
+  // (same check as runProdApp, #2027) — not recomputed here.
   const sessionAuthFragment =
     effectiveAuth && sessionStoreProviderMounted
       ? {