@cosmicdrift/kumiko-dev-server 1.0.0 → 2.0.0

package/src/__tests__/session-wiring.test.ts

@@ -1,51 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import {
-  createSessionsFeature,
-  SESSIONS_FEATURE,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { resolveProdSessionsConfig, shouldWireProdSessions } from "../session-wiring";
-
-describe("shouldWireProdSessions — secure-by-default with opt-out (KF-1)", () => {
-  it("wires sessions when the feature is mounted, even without an explicit config", () => {
-    // The publicstatus bug: sessions feature mounted + auth set, but no auth.sessions —
-    // previously left stateless (no revocation). Now it wires automatically.
-    expect(shouldWireProdSessions(true, true, undefined)).toBe(true);
-  });
-
-  it("wires sessions when a config object is given", () => {
-    expect(shouldWireProdSessions(true, true, { expiresInMs: 1000 })).toBe(true);
-  });
-
-  it("does not wire when sessions: false (explicit opt-out)", () => {
-    expect(shouldWireProdSessions(true, true, false)).toBe(false);
-  });
-
-  it("does not wire when the sessions feature is not mounted", () => {
-    expect(shouldWireProdSessions(true, false, undefined)).toBe(false);
-  });
-
-  it("does not wire when the app has no auth at all", () => {
-    expect(shouldWireProdSessions(false, true, undefined)).toBe(false);
-  });
-});
-
-describe("SESSIONS_FEATURE constant matches the real feature name", () => {
-  it("createSessionsFeature()'s name equals SESSIONS_FEATURE", () => {
-    // shouldWireProdSessions's own arm only tests the pure boolean helper —
-    // the actual run-prod-app.ts integration seam
-    // (`features.some((f) => f.name === SESSIONS_FEATURE)`) drifts silently
-    // if the feature is ever renamed without updating this constant.
-    expect(createSessionsFeature().name).toBe(SESSIONS_FEATURE);
-  });
-});
-
-describe("resolveProdSessionsConfig", () => {
-  it("passes a config object through", () => {
-    expect(resolveProdSessionsConfig({ expiresInMs: 5000 })).toEqual({ expiresInMs: 5000 });
-  });
-
-  it("collapses false / undefined to defaults", () => {
-    expect(resolveProdSessionsConfig(undefined)).toEqual({});
-    expect(resolveProdSessionsConfig(false)).toEqual({});
-  });
-});

package/src/__tests__/try-hono-first.test.ts

@@ -1,63 +0,0 @@
-// Pure-function pin für tryHonoFirst. Trivial aber load-bearing:
-// Drift zwischen dev (createKumikoServer) und prod (runProdApp) hat
-// schon einen Bug verursacht (legal-pages funktionierten in prod aber
-// nicht in dev). Beide nutzen jetzt diesen helper — wenn die Semantik
-// sich ändert (z.B. "matched" auch für 4xx anders als 404), MÜSSEN
-// beide Pfade synchron updaten.
-
-import { describe, expect, test } from "bun:test";
-import { type HonoLikeApp, tryHonoFirst } from "../try-hono-first";
-
-function makeApp(response: Response): HonoLikeApp {
-  return { fetch: () => response };
-}
-
-function makeAsyncApp(response: Response): HonoLikeApp {
-  return { fetch: async () => response };
-}
-
-describe("tryHonoFirst", () => {
-  test("matched=true bei 200 (Hono-route greift)", async () => {
-    const app = makeApp(new Response("ok", { status: 200 }));
-    const res = await tryHonoFirst(app, new Request("http://test/foo"));
-    expect(res.matched).toBe(true);
-    expect(res.response.status).toBe(200);
-  });
-
-  test("matched=false bei 404 (keine Route — caller fällt auf SPA-fallback)", async () => {
-    const app = makeApp(new Response("not found", { status: 404 }));
-    const res = await tryHonoFirst(app, new Request("http://test/unknown"));
-    expect(res.matched).toBe(false);
-    // response wird trotzdem zurückgegeben — caller kann den 404 als
-    // letztes Sicherheitsnetz nutzen wenn auch SPA-fallback nichts liefert.
-    expect(res.response.status).toBe(404);
-  });
-
-  test("matched=true bei 401/403/500 (Hono hat geantwortet — kein SPA-fallback)", async () => {
-    // Bug-Pin: matched darf NUR bei status=404 false sein. Wenn Hono
-    // 401 (auth required) returnt, war die Route klar gefunden + hat
-    // bewusst rejected — SPA-fallback würde das überschreiben und den
-    // User auf eine SPA leiten statt die 401-message zu zeigen.
-    for (const status of [401, 403, 422, 500] as const) {
-      const app = makeApp(new Response(null, { status }));
-      const res = await tryHonoFirst(app, new Request("http://test/x"));
-      expect(res.matched, `status ${status} should be matched`).toBe(true);
-    }
-  });
-
-  test("akzeptiert sowohl sync als auch async fetch (Hono-Variation)", async () => {
-    // Hono.app.fetch returnt Response | Promise<Response> abhängig vom
-    // handler-mix. createApiEntrypoint's apiHandler dasselbe. Helper
-    // muss beide schluckable.
-    const sync = await tryHonoFirst(
-      makeApp(new Response("s", { status: 200 })),
-      new Request("http://t/"),
-    );
-    const asyncRes = await tryHonoFirst(
-      makeAsyncApp(new Response("a", { status: 200 })),
-      new Request("http://t/"),
-    );
-    expect(sync.matched).toBe(true);
-    expect(asyncRes.matched).toBe(true);
-  });
-});

package/src/boot/apply-boot-seeds.ts

@@ -1,18 +0,0 @@
-import { seedAllConfigValues } from "@cosmicdrift/kumiko-bundled-features/config";
-import type { DbConnection, EncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-
-// Single boot-seed entry-point. runDevApp + runProdApp both call this
-// from their post-stack hook, so the wiring lives in exactly one place
-// — config-seed-boot.integration.ts pins this helper, which means a
-// missing call site (e.g. someone deletes the line from runDevApp)
-// surfaces as a missing-helper-use in code review rather than silently
-// shipping a server that never seeds.
-// @wrapper-known semantic-alias
-export async function applyBootSeeds(deps: {
-  registry: Registry;
-  db: DbConnection;
-  encryption?: EncryptionProvider;
-}): Promise<void> {
-  await seedAllConfigValues(deps.registry, deps.db, deps.encryption);
-}