@cosmicdrift/kumiko-framework 0.105.1 → 0.105.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.105.1",
+  "version": "0.105.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.105.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.105.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/jwt.test.ts

@@ -26,6 +26,17 @@ function forge(claims: Record<string, unknown>): Promise<string> {
     .sign(new TextEncoder().encode(SECRET));
 }
 
+// Same as forge(), but never calls .setSubject() — the only way to produce a
+// validly-signed token with no `sub` claim at all (forge() always sets one).
+function forgeNoSub(claims: Record<string, unknown>): Promise<string> {
+  return new jose.SignJWT(claims)
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuer(ISSUER)
+    .setIssuedAt()
+    .setExpirationTime("1h")
+    .sign(new TextEncoder().encode(SECRET));
+}
+
 describe("createJwtHelper.verify — payload validation (KF-2)", () => {
   const jwt = createJwtHelper(SECRET);
 
@@ -55,4 +66,20 @@ describe("createJwtHelper.verify — payload validation (KF-2)", () => {
     const token = await forge({ tenantId: TENANT, roles: ["ok", 7] });
     await expect(jwt.verify(token)).rejects.toThrow(/roles/);
   });
+
+  it("rejects a validly-signed token with no sub claim", async () => {
+    const token = await forgeNoSub({ tenantId: TENANT, roles: ["TenantAdmin"] });
+    await expect(jwt.verify(token)).rejects.toThrow(/sub/);
+  });
+
+  it("rejects a token whose sub claim is an empty string", async () => {
+    const token = await new jose.SignJWT({ tenantId: TENANT, roles: ["TenantAdmin"] })
+      .setProtectedHeader({ alg: "HS256" })
+      .setSubject("")
+      .setIssuer(ISSUER)
+      .setIssuedAt()
+      .setExpirationTime("1h")
+      .sign(new TextEncoder().encode(SECRET));
+    await expect(jwt.verify(token)).rejects.toThrow(/sub/);
+  });
 });

package/src/api/jwt.ts

@@ -69,9 +69,12 @@ export function createJwtHelper(secret: string, issuer = "kumiko"): JwtHelper {
         }
         roles.push(role);
       }
+      if (typeof payload.sub !== "string" || payload.sub === "") {
+        throw new Error("JWT payload validation failed: sub claim is missing or malformed");
+      }
 
       const result: JwtPayload = {
-        sub: String(payload.sub),
+        sub: payload.sub,
         tenantId,
         roles,
       };

package/src/engine/__tests__/required-surface-keys.test.ts

@@ -1,11 +1,18 @@
 import { describe, expect, test } from "bun:test";
 import {
   ACTION_FORM_ENTITY,
+  CONFIG_EDIT_ENTITY,
   fieldLabelKey,
+  requiredKeysFromNav,
   requiredKeysFromScreen,
+  requiredKeysFromWorkspace,
   screenTitleKey,
 } from "../../i18n/required-surface-keys";
-import type { EntityListScreenDefinition } from "../types";
+import type {
+  ConfigEditScreenDefinition,
+  EntityEditScreenDefinition,
+  EntityListScreenDefinition,
+} from "../types";
 
 describe("requiredKeysFromScreen", () => {
   test("entityList emits screen title + column field labels", () => {
@@ -35,4 +42,130 @@ describe("requiredKeysFromScreen", () => {
     });
     expect(keys).toContain(fieldLabelKey("publicstatus", ACTION_FORM_ENTITY, "title"));
   });
+
+  test("entityEdit emits submitLabel + section titles + field labels (override honored)", () => {
+    const screen: EntityEditScreenDefinition = {
+      id: "component-edit",
+      type: "entityEdit",
+      entity: "component",
+      submitLabel: "publicstatus:actions.saveComponent",
+      fieldLabels: { name: "publicstatus:override.name" },
+      layout: {
+        sections: [{ title: "publicstatus:section.basics", fields: ["name", "status"] }],
+      },
+    };
+    const keys = requiredKeysFromScreen("publicstatus", screen);
+    expect(keys).toContain("publicstatus:actions.saveComponent");
+    expect(keys).toContain("publicstatus:section.basics");
+    // override wins over the default entity:field convention
+    expect(keys).toContain("publicstatus:override.name");
+    expect(keys).not.toContain(fieldLabelKey("publicstatus", "component", "name"));
+    expect(keys).toContain(fieldLabelKey("publicstatus", "component", "status"));
+  });
+
+  test("entityEdit extension section pushes only the section title (no field labels)", () => {
+    const screen: EntityEditScreenDefinition = {
+      id: "component-edit",
+      type: "entityEdit",
+      entity: "component",
+      layout: {
+        sections: [
+          {
+            kind: "extension",
+            title: "publicstatus:section.customFields",
+            component: { react: {} },
+          },
+        ],
+      },
+    };
+    const keys = requiredKeysFromScreen("publicstatus", screen);
+    expect(keys).toEqual([screenTitleKey("component-edit"), "publicstatus:section.customFields"]);
+  });
+
+  test("configEdit uses the CONFIG_EDIT_ENTITY namespace, honors fieldLabels override", () => {
+    const screen: ConfigEditScreenDefinition = {
+      id: "settings-retention",
+      type: "configEdit",
+      scope: "tenant",
+      configKeys: { days: "publicstatus:config:retentionDays" },
+      fieldLabels: { days: "publicstatus:override.retentionDays" },
+      fields: { days: { type: "number" } },
+      layout: { sections: [{ fields: ["days"] }] },
+    };
+    const keys = requiredKeysFromScreen("publicstatus", screen);
+    expect(keys).toContain("publicstatus:override.retentionDays");
+    expect(keys).not.toContain(fieldLabelKey("publicstatus", CONFIG_EDIT_ENTITY, "days"));
+  });
+
+  test("configEdit without a fieldLabels override falls back to the CONFIG_EDIT_ENTITY convention", () => {
+    const screen: ConfigEditScreenDefinition = {
+      id: "settings-retention",
+      type: "configEdit",
+      scope: "tenant",
+      configKeys: { days: "publicstatus:config:retentionDays" },
+      fields: { days: { type: "number" } },
+      layout: { sections: [{ fields: ["days"] }] },
+    };
+    const keys = requiredKeysFromScreen("publicstatus", screen);
+    expect(keys).toContain(fieldLabelKey("publicstatus", CONFIG_EDIT_ENTITY, "days"));
+  });
+
+  test("custom screen emits only the screen title — no field surface to validate", () => {
+    const keys = requiredKeysFromScreen("publicstatus", {
+      id: "dashboard",
+      type: "custom",
+      renderer: { react: {} },
+    });
+    expect(keys).toEqual([screenTitleKey("dashboard")]);
+  });
+
+  test("entityList rowActions/toolbarActions emit label + confirm + confirmLabel", () => {
+    const screen: EntityListScreenDefinition = {
+      id: "component-list",
+      type: "entityList",
+      entity: "component",
+      columns: ["name"],
+      rowActions: [
+        {
+          id: "delete",
+          label: "publicstatus:actions.delete",
+          handler: "publicstatus:write:component:delete",
+          confirm: "publicstatus:confirm.deleteComponent",
+          confirmLabel: "publicstatus:confirm.deleteComponentButton",
+          style: "danger",
+        },
+      ],
+      toolbarActions: [
+        {
+          kind: "writeHandler",
+          id: "sync-all",
+          label: "publicstatus:actions.syncAll",
+          handler: "publicstatus:write:component:syncAll",
+          confirm: "publicstatus:confirm.syncAll",
+          confirmLabel: "publicstatus:confirm.syncAllButton",
+        },
+      ],
+    };
+    const keys = requiredKeysFromScreen("publicstatus", screen);
+    expect(keys).toContain("publicstatus:actions.delete");
+    expect(keys).toContain("publicstatus:confirm.deleteComponent");
+    expect(keys).toContain("publicstatus:confirm.deleteComponentButton");
+    expect(keys).toContain("publicstatus:actions.syncAll");
+    expect(keys).toContain("publicstatus:confirm.syncAll");
+    expect(keys).toContain("publicstatus:confirm.syncAllButton");
+  });
+});
+
+describe("requiredKeysFromNav / requiredKeysFromWorkspace", () => {
+  test("nav label is a required key", () => {
+    expect(requiredKeysFromNav({ id: "catalog", label: "shop:nav.catalog" })).toEqual([
+      "shop:nav.catalog",
+    ]);
+  });
+
+  test("workspace label is a required key", () => {
+    expect(
+      requiredKeysFromWorkspace({ id: "disposition", label: "bmc:workspace.disposition" }),
+    ).toEqual(["bmc:workspace.disposition"]);
+  });
 });

package/src/engine/extensions/user-data.ts

@@ -90,6 +90,12 @@ export interface UserDataHookCtx {
    * touch tenant-scoped rows. Absent → treat as `"multi-user"` (no erasure).
    */
   readonly tenantModel?: TenantUserModel;
+  /**
+   * Original user email captured before the forget transaction anonymizes it.
+   * Set on delete hooks during `runForgetCleanup` so matchers (e.g. email
+   * subscriptions) work in every tenant pass. Absent on export hooks.
+   */
+  readonly userEmailBeforeDelete?: string | null;
 }
 
 /**

package/src/files/__tests__/storage-tracking.integration.test.ts

@@ -224,4 +224,12 @@ describe("file download roundtrip (GET /files/:id)", () => {
     await deleteFile(admin, id);
     expect((await download(admin, id)).status).toBe(404);
   });
+
+  test("a cross-tenant download is rejected (404, no existence oracle)", async () => {
+    const id = await upload(admin, "tenant-a-only.png", SMALL);
+    const res = await download(otherAdmin, id);
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { error?: string };
+    expect(body.error).toBe("not_found");
+  });
 });

package/src/files/file-routes.ts

@@ -150,8 +150,8 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
     // are orphaned in the provider; cleanup-jobs sweep those later. Losing a
     // row on append-failure is acceptable; corrupting a committed row with a
     // missing binary is not.
-    const data = new Uint8Array(await file.arrayBuffer());
     const storageProvider = await options.resolveProvider(user.tenantId);
+    const data = new Uint8Array(await file.arrayBuffer());
     await storageProvider.write(storageKey, data, file.type);
 
     // Create via the standard entity executor: emits fileRef.created +

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -547,6 +547,49 @@ describe("write-handler shape guard", () => {
   });
 });
 
+// --- Dispatch: geoTzProvider seam ---
+
+describe("dispatcher context.geoTzProvider (680/1)", () => {
+  test("ctx.tz.fromCoordinates reaches the app-injected geoTzProvider through a real dispatch", async () => {
+    // All geo-tz.test.ts coverage calls createTzContext({ geoTz }) directly —
+    // none go through the dispatcher or read context.geoTzProvider. A typo in
+    // the property forwarding at dispatcher.ts would make the injection a
+    // silent no-op (provider configured, ctx.tz.fromCoordinates still throws).
+    const geoFeature = defineFeature("geo", (r) => {
+      r.queryHandler(
+        "resolve-zone",
+        z.object({ latitude: z.number(), longitude: z.number() }),
+        async (query, ctx) => ({
+          zone: await ctx.tz.fromCoordinates({
+            latitude: query.payload.latitude,
+            longitude: query.payload.longitude,
+          }),
+        }),
+        { access: { openToAll: true } },
+      );
+    });
+    const registry = createRegistry([geoFeature]);
+    const calls: Array<{ latitude: number; longitude: number }> = [];
+    const dispatcher = createDispatcher(registry, {
+      geoTzProvider: {
+        fromCoordinates: ({ latitude, longitude }) => {
+          calls.push({ latitude, longitude });
+          return "Europe/Berlin";
+        },
+      },
+    });
+
+    const result = await dispatcher.query(
+      "geo:query:resolve-zone",
+      { latitude: 52.52, longitude: 13.405 },
+      createTestUser(),
+    );
+
+    expect(result).toEqual({ zone: "Europe/Berlin" });
+    expect(calls).toEqual([{ latitude: 52.52, longitude: 13.405 }]);
+  });
+});
+
 // --- Mock helpers ---
 
 function createMockIdempotencyGuard() {

package/src/pipeline/__tests__/projection-rebuild.integration.test.ts

@@ -750,6 +750,30 @@ describe("rebuildProjection — live-tail catch-up (#363 Phase 2)", () => {
     expect(await getCount(groupX)).toBe(1); // #443 fixed: fenced count re-check re-replayed the missed low-id event
   });
 
+  test("(656/1) a clean rebuild with no concurrency does not trigger the #443 recompute", async () => {
+    // The #443 shortfall-recompute rebuilds the shadow a 2nd time and re-replays
+    // the whole log — correct on the rare path it guards, but a silent perf
+    // regression if it fired on every rebuild. Its final values are identical
+    // either way (full re-replay is idempotent), so only a call-count seam can
+    // prove it stayed off the happy path.
+    const group = "00000000-0000-4000-8000-000000000203";
+    await appendCreatedEvent(group, "a");
+    await appendCreatedEvent(group, "b");
+
+    let shadowBuilds = 0;
+    const result = await rebuildProjection(qualifiedProjectionName, {
+      db: testDb.db,
+      registry,
+      __test_onBuildShadowTable: () => {
+        shadowBuilds++;
+      },
+    });
+
+    expect(shadowBuilds).toBe(1);
+    expect(result.eventsProcessed).toBe(2);
+    expect(await getCount(group)).toBe(2);
+  });
+
   test("the rebuild tx sees concurrently-committed rows (READ COMMITTED, not a frozen snapshot)", async () => {
     // The catch-up loop only works if each fresh SELECT in the rebuild tx sees
     // rows other connections committed since the previous batch. Under

package/src/pipeline/projection-rebuild.ts

@@ -151,6 +151,10 @@ type RebuildDeps = {
   // a slow callback here delays the cutover fence acquisition, widening the
   // window in which concurrent writers can still commit below the cursor.
   readonly __test_onBeforeFence?: () => void | Promise<void>;
+  // Test-only seam: fires each time the shadow table is (re)built. The #443
+  // recompute is idempotent on final values, so only a call-count seam like
+  // this can prove it didn't fire on a clean, non-concurrent rebuild.
+  readonly __test_onBuildShadowTable?: () => void;
 };
 
 export async function rebuildProjection(
@@ -216,6 +220,7 @@ export async function rebuildProjection(
     await db.begin(async (tx: DbTx) => {
       await markProjectionRebuilding(tx, projectionName);
       await buildShadowTable(tx, meta);
+      deps.__test_onBuildShadowTable?.();
 
       // A projection that subscribes to nothing has no events to replay and no
       // live writer touching its table — skip straight to swapping the empty
@@ -253,6 +258,7 @@ export async function rebuildProjection(
         const expectedEvents = await countSubscribedEvents(tx, sourcesList, subscribedList);
         if (expectedEvents > BigInt(eventsProcessed)) {
           await buildShadowTable(tx, meta);
+          deps.__test_onBuildShadowTable?.();
           lastProcessedEventId = 0n;
           eventsProcessed = 0;
           while ((await drainBatch(tx)) === REBUILD_BATCH_SIZE) {

package/src/time/__tests__/boot-tz-warning.test.ts

@@ -18,7 +18,22 @@ describe("warnIfNonUtcServerTimeZone", () => {
     expect(messages[0]).toContain("UTC");
   });
 
-  test("Default-Aufruf liest die Prozess-TZ ohne zu werfen", () => {
-    expect(() => warnIfNonUtcServerTimeZone(undefined, () => {})).not.toThrow();
+  test("Default-Aufruf liest die ECHTE Prozess-TZ (ambient, nicht injiziert)", () => {
+    // Das ist der einzige Test der ambient-TZ liest statt sie zu injizieren —
+    // der Grund warum der tz-matrix-CI-Job (4 Legs: LA/Berlin/Tokyo/Apia)
+    // überhaupt einen Unterschied zwischen den Legs sehen kann. Ohne diese
+    // Assertion wäre "läuft in jeder Zone ohne zu werfen" in allen 4 Legs
+    // identisch grün — die beworbene Schutzwirkung ("ein `new Date(wallClock)`-
+    // Bug bricht HIER") würde nicht existieren.
+    const ambientTz = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    const messages: string[] = [];
+    const warned = warnIfNonUtcServerTimeZone(undefined, (m) => messages.push(m));
+    if (ambientTz === "UTC") {
+      expect(warned).toBe(false);
+      expect(messages).toHaveLength(0);
+    } else {
+      expect(warned).toBe(true);
+      expect(messages[0]).toContain(ambientTz);
+    }
   });
 });