@cosmicdrift/kumiko-framework 0.157.1 → 0.158.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.157.1",
+  "version": "0.158.2",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -193,7 +193,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.157.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.158.2",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/redis-login-rate-limiter.integration.test.ts

@@ -0,0 +1,66 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { createTestRedis, type TestRedis } from "../../stack";
+import { createRedisLoginRateLimiter } from "../auth-routes";
+
+let testRedis: TestRedis;
+
+beforeAll(async () => {
+  testRedis = await createTestRedis();
+});
+
+afterAll(async () => {
+  await testRedis.cleanup();
+});
+
+beforeEach(async () => {
+  await testRedis.flushNamespace();
+});
+
+describe("createRedisLoginRateLimiter", () => {
+  test("allows exactly maxAttempts checks, then blocks", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 3, 60_000);
+
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(true);
+    expect(await limiter.check("1.2.3.4|user@test.local")).toBe(false);
+  });
+
+  test("reset clears the counter for that key", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000);
+
+    expect(await limiter.check("k")).toBe(true);
+    expect(await limiter.check("k")).toBe(false);
+
+    await limiter.reset("k");
+    expect(await limiter.check("k")).toBe(true);
+  });
+
+  test("buckets are independent per key", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000);
+
+    expect(await limiter.check("a")).toBe(true);
+    expect(await limiter.check("b")).toBe(true);
+    expect(await limiter.check("a")).toBe(false);
+    expect(await limiter.check("b")).toBe(false);
+  });
+
+  test("namespace keeps two limiter instances from sharing a keyspace", async () => {
+    const login = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000, "login");
+    const mfa = createRedisLoginRateLimiter(testRedis.redis, 1, 60_000, "mfa-verify");
+
+    expect(await login.check("1.2.3.4")).toBe(true);
+    expect(await mfa.check("1.2.3.4")).toBe(true);
+  });
+
+  test("counter resets once windowMs elapses", async () => {
+    const limiter = createRedisLoginRateLimiter(testRedis.redis, 1, 150);
+
+    expect(await limiter.check("k")).toBe(true);
+    expect(await limiter.check("k")).toBe(false);
+
+    await Bun.sleep(200);
+
+    expect(await limiter.check("k")).toBe(true);
+  });
+});

package/src/api/auth-routes.ts

@@ -1,6 +1,7 @@
 import type { Context } from "hono";
 import { Hono } from "hono";
 import { deleteCookie, setCookie } from "hono/cookie";
+import type Redis from "ioredis";
 import { z } from "zod";
 import { buildSessionRoles } from "../engine/membership-roles";
 import { createSystemUser } from "../engine/system-user";
@@ -461,6 +462,37 @@ export function createInMemoryLoginRateLimiter(
   };
 }
 
+// Redis-backed sibling of createInMemoryLoginRateLimiter — same fixed-window
+// semantics (count <= maxAttempts allows, window anchored on first hit), but
+// shared across replicas via INCR/PEXPIRE instead of an in-process Map.
+// runProdApp defaults to this: an in-memory limiter only rate-limits within
+// a single instance, so a multi-replica prod deployment would silently give
+// each replica its own bucket. namespace separates the login-key keyspace
+// from the mfa-verify one (they share the same LoginRateLimiter shape but
+// key on different values).
+export function createRedisLoginRateLimiter(
+  redis: Redis,
+  maxAttempts = 10,
+  windowMs = 5 * 60_000,
+  namespace = "login",
+): LoginRateLimiter {
+  const prefix = `kumiko:auth:ratelimit:${namespace}:`;
+
+  return {
+    async check(key) {
+      const redisKey = `${prefix}${key}`;
+      const count = await redis.incr(redisKey);
+      if (count === 1) {
+        await redis.pexpire(redisKey, windowMs);
+      }
+      return count <= maxAttempts;
+    },
+    async reset(key) {
+      await redis.del(`${prefix}${key}`);
+    },
+  };
+}
+
 export function createAuthRoutes(
   dispatcher: Dispatcher,
   jwt: JwtHelper,

package/src/api/index.ts

@@ -19,7 +19,11 @@ export type {
   SessionMetadata,
   SessionRevoker,
 } from "./auth-routes";
-export { createAuthRoutes, createInMemoryLoginRateLimiter } from "./auth-routes";
+export {
+  createAuthRoutes,
+  createInMemoryLoginRateLimiter,
+  createRedisLoginRateLimiter,
+} from "./auth-routes";
 export type { CachedResponseInit, CachePolicy } from "./http-cache";
 export {
   cacheControlHeader,

package/src/entrypoint/__tests__/entrypoint-job-wiring.integration.test.ts

@@ -225,3 +225,69 @@ describe("createAllInOneEntrypoint — kumiko_job_queue_depth sees the SAME mete
     }
   });
 });
+
+// Regression test for #1253 — effectiveFeatures was wired into
+// dispatcherOptions (command-dispatcher's feature-gate) but never merged
+// into the job-runner's context. A job handler reading
+// `context.effectiveFeatures?.(tenantId)` always saw undefined in prod.
+const featuresSeenByJob: Array<ReadonlySet<string> | undefined> = [];
+
+const featureGateJobFeature = defineFeature("featuregate", (r) => {
+  r.writeHandler(
+    "ping",
+    z.object({ msg: z.string() }),
+    async (event) => ({
+      isSuccess: true as const,
+      data: { id: 1, msg: event.payload.msg },
+    }),
+    { access: { openToAll: true } },
+  );
+  r.job(
+    "record-features",
+    { trigger: { on: "featuregate:write:ping" }, runIn: "worker" },
+    async (_payload, context) => {
+      featuresSeenByJob.push(context.effectiveFeatures?.(adminUser.tenantId));
+    },
+  );
+});
+
+describe("createAllInOneEntrypoint — job context sees dispatcherOptions.effectiveFeatures (#1253)", () => {
+  test("job handler reads the same effectiveFeatures resolver as the command-dispatcher's feature-gate", async () => {
+    featuresSeenByJob.length = 0;
+    const registry = createRegistry([featureGateJobFeature]);
+    const redisUrl = `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+    const entry = createAllInOneEntrypoint({
+      registry,
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl,
+      queueNamePrefix: `wiring-features-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+      dispatcherOptions: {
+        effectiveFeatures: () => new Set(["featuregate", "some-feature"]),
+      },
+    });
+    await entry.start();
+    try {
+      const token = await entry.jwt.sign(adminUser);
+      const res = await entry.app.request("/api/write", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`,
+        },
+        body: JSON.stringify({ type: "featuregate:write:ping", payload: { msg: "hi" } }),
+      });
+      const result = (await res.json()) as { isSuccess: boolean };
+      expect(result.isSuccess).toBe(true);
+
+      // Without the fix, context.effectiveFeatures is undefined and this
+      // stays empty forever — waitFor times out on the missing entry.
+      await waitFor(() => {
+        expect(featuresSeenByJob.length).toBeGreaterThan(0);
+        expect(featuresSeenByJob[0]?.has("some-feature")).toBe(true);
+      });
+    } finally {
+      await entry.stop();
+    }
+  });
+});

package/src/entrypoint/index.ts

@@ -37,6 +37,7 @@ import type { KumikoServer, ServerOptions } from "../api/server";
 import { buildServer } from "../api/server";
 import type { SseBroker } from "../api/sse-broker";
 import type { PgClient } from "../db/connection";
+import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension";
 import type { AppContext, JobRunIn, Registry, RunIn } from "../engine/types";
 import type { JobRunner, JobRunnerOptions } from "../jobs/job-runner";
 import { createJobRunner } from "../jobs/job-runner";
@@ -188,8 +189,17 @@ function resolveObservability(
 function contextWithObservability(
   context: AppContext,
   observability: ObservabilityProvider,
+  effectiveFeatures: EffectiveFeaturesResolver | undefined,
 ): AppContext {
-  return { ...context, tracer: observability.tracer, meter: observability.meter };
+  return {
+    ...context,
+    // Same source of truth as buildServer's contextWithObservability
+    // (api/server.ts) — job handlers reading ctx.effectiveFeatures should
+    // see the same resolver as command handlers, not just dispatcherOptions.
+    ...(effectiveFeatures && { effectiveFeatures }),
+    tracer: observability.tracer,
+    meter: observability.meter,
+  };
 }
 
 // buildApiServer shapes ServerOptions from API-mode caller-options.
@@ -342,7 +352,11 @@ export function createApiEntrypoint(options: ApiEntrypointOptions): ApiEntrypoin
   const apiJobRunner = options.jobs
     ? buildJobRunnerWithHook(
         options.registry,
-        contextWithObservability(options.context, observability),
+        contextWithObservability(
+          options.context,
+          observability,
+          options.dispatcherOptions?.effectiveFeatures,
+        ),
         options.jobs,
         options.jobs.runLocalJobs ? "api" : undefined,
         lifecycle,
@@ -396,7 +410,11 @@ export function createWorkerEntrypoint(options: WorkerEntrypointOptions): Worker
   const observability = resolveObservability(options.observability);
   const jobRunner = buildJobRunnerWithHook(
     options.registry,
-    contextWithObservability(options.context, observability),
+    contextWithObservability(
+      options.context,
+      observability,
+      options.dispatcherOptions?.effectiveFeatures,
+    ),
     options,
     "worker",
     lifecycle,
@@ -426,7 +444,11 @@ export function createWorkerEntrypoint(options: WorkerEntrypointOptions): Worker
 export function createAllInOneEntrypoint(options: AllInOneEntrypointOptions): AllInOneEntrypoint {
   const lifecycle = options.lifecycle ?? createLifecycle({ startReady: true });
   const observability = resolveObservability(options.observability);
-  const jobRunnerContext = contextWithObservability(options.context, observability);
+  const jobRunnerContext = contextWithObservability(
+    options.context,
+    observability,
+    options.dispatcherOptions?.effectiveFeatures,
+  );
 
   // All-in-one consumes BOTH lanes: two runners, each with a BullMQ worker
   // for its own lane's queue. Both runners hold queue-clients for both

package/src/stack/__tests__/setup-test-stack-jobs.integration.test.ts

@@ -36,6 +36,27 @@ const manualDispatchFeature = defineFeature("manualdispatch", (r) => {
   });
 });
 
+// kumiko-framework#1232: setupTestStack used to hand jobs a bare
+// `{ db, registry }` context literal — nothing else buildServer's request
+// path gets (tracer/meter, searchAdapter, ...). A job could pass in tests
+// while reading a field only prod's context has, then break silently on
+// deploy. This job records which fields actually arrived.
+const jobContextFields: Array<{
+  hasTracer: boolean;
+  hasSearchAdapter: boolean;
+  hasEffectiveFeatures: boolean;
+}> = [];
+
+const jobContextFeature = defineFeature("jobcontextcheck", (r) => {
+  r.job("record", { trigger: { manual: true }, runIn: "worker" }, async (_payload, context) => {
+    jobContextFields.push({
+      hasTracer: context.tracer !== undefined,
+      hasSearchAdapter: context.searchAdapter !== undefined,
+      hasEffectiveFeatures: context.effectiveFeatures !== undefined,
+    });
+  });
+});
+
 let stack: TestStack | undefined;
 
 afterEach(async () => {
@@ -76,3 +97,25 @@ describe("setupTestStack({ jobs }) wires ctx.jobRunner for manual dispatch", ()
     expect(err.code).toBe("internal_error");
   });
 });
+
+describe("setupTestStack({ jobs }) job context matches the request-path context", () => {
+  test("job handler's context carries tracer + searchAdapter + effectiveFeatures, not a reduced literal", async () => {
+    jobContextFields.length = 0;
+    stack = await setupTestStack({
+      features: [jobContextFeature],
+      jobs: { consumerLane: "worker" },
+      effectiveFeatures: () => new Set(["jobcontextcheck"]),
+    });
+
+    await stack.jobRunner?.dispatch("jobcontextcheck:job:record");
+
+    await waitFor(() => {
+      expect(jobContextFields.length).toBeGreaterThan(0);
+    });
+    expect(jobContextFields[0]).toEqual({
+      hasTracer: true,
+      hasSearchAdapter: true,
+      hasEffectiveFeatures: true,
+    });
+  });
+});

package/src/stack/test-stack.ts

@@ -10,7 +10,7 @@ import type { FeatureDefinition, JobRunIn, Registry, TenantId } from "../engine/
 import { createArchivedStreamsTable, createEventsTable } from "../event-store";
 import { createJobRunner, type JobRunner } from "../jobs";
 import type { Lifecycle } from "../lifecycle";
-import type { ObservabilityProvider } from "../observability";
+import { createNoopProvider, type ObservabilityProvider } from "../observability";
 import type { Dispatcher, EventDispatcher } from "../pipeline";
 import { createEntityCache, createEventDedup, createIdempotencyGuard } from "../pipeline";
 import { createInMemorySearchAdapter } from "../search";
@@ -230,16 +230,66 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
   const events = createEventCollector();
   const registry = createRegistry([...options.features]);
 
+  // Wire SSE broker with event collector — built early (not just before
+  // buildServer) because extraContext + the job context below both need it.
+  const sseBroker = createSseBroker();
+  sseBroker.addClient(
+    "tenant:00000000-0000-4000-8000-000000000001",
+    (event) => events.sse.push(event),
+    () => {},
+  );
+
+  const entityCache = createEntityCache(testRedis.redis, { ttlSeconds: 60 });
+
+  // A static `files.storageProvider` is wired as the per-tenant resolver — the
+  // framework test seam that doesn't require mounting config + file-foundation.
+  // (Bundled GDPR tests mount the real provider features instead.)
+  let fileProviderResolver: import("../files").FileProviderResolver | undefined;
+  if (options.files) {
+    const provider = options.files.storageProvider;
+    fileProviderResolver = () => Promise.resolve(provider);
+  }
+
+  const observability = options.observability ?? createNoopProvider();
+
+  // Same AppContext buildServer() gets below (db/redis/searchAdapter/
+  // entityCache/masterKeyProvider/fileProviderResolver/extraContext) —
+  // shared so the job context can't drift from the request-path context
+  // (kumiko-framework#1232: a reduced `{ db, registry }` literal let jobs
+  // pass in tests while reaching for fields only prod's context has).
+  //
+  // effectiveFeatures is included per the issue's explicit ask, even though
+  // prod's job context never gets it today (only dispatcherOptions.
+  // effectiveFeatures, consumed by the command-dispatcher — see
+  // buildJobRunnerWithHook in entrypoint/index.ts). Tracked as a real prod
+  // gap in a follow-up issue rather than silently matched here.
+  const appContext = {
+    db: testDb.db,
+    redis: testRedis.redis,
+    searchAdapter,
+    entityCache,
+    registry,
+    ...(options.masterKeyProvider ? { masterKeyProvider: options.masterKeyProvider } : {}),
+    ...(fileProviderResolver ? { _fileProviderResolver: fileProviderResolver } : {}),
+    ...(options.effectiveFeatures ? { effectiveFeatures: options.effectiveFeatures } : {}),
+    ...(typeof options.extraContext === "function"
+      ? options.extraContext({ registry, db: testDb.db, sseBroker, redis: testRedis.redis })
+      : options.extraContext),
+  };
+
   // Built before buildServer() so it can be merged into dispatcherOptions
   // (write handlers' `ctx.jobRunner.dispatch(...)` and the afterCommit
   // event-trigger hook both need it present at dispatcher-construction
   // time, same as the prod entrypoint's buildJobRunnerWithHook). Uses the
   // test-stack's own ephemeral redis — no separate `redisUrl` seam needed.
+  //
+  // context = appContext + tracer/meter, mirroring the prod entrypoint's
+  // `contextWithObservability(options.context, observability)`.
   let jobRunner: JobRunner | undefined;
   if (options.jobs && registry.getAllJobs().size > 0) {
     jobRunner = createJobRunner({
       registry,
-      context: { db: testDb.db, registry },
+      context: { ...appContext, tracer: observability.tracer, meter: observability.meter },
       // The real REDIS_URL, not one rebuilt from `.options` — that lost
       // password/username/tls/path (pr-review kumiko-framework #1036/2).
       redisUrl: testRedis.redisUrl,
@@ -291,42 +341,14 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
       }
     }
 
-    // Wire SSE broker with event collector
-    const sseBroker = createSseBroker();
-    sseBroker.addClient(
-      "tenant:00000000-0000-4000-8000-000000000001",
-      (event) => events.sse.push(event),
-      () => {},
-    );
-
     const idempotency = createIdempotencyGuard(testRedis.redis, { ttlSeconds: 60 });
     const eventDedup = createEventDedup(testRedis.redis, { ttlSeconds: 60 });
-    const entityCache = createEntityCache(testRedis.redis, { ttlSeconds: 60 });
-
-    // A static `files.storageProvider` is wired as the per-tenant resolver — the
-    // framework test seam that doesn't require mounting config + file-foundation.
-    // (Bundled GDPR tests mount the real provider features instead.)
-    let fileProviderResolver: import("../files").FileProviderResolver | undefined;
-    if (options.files) {
-      const provider = options.files.storageProvider;
-      fileProviderResolver = () => Promise.resolve(provider);
-    }
 
     const server = buildServer({
       registry,
-      context: {
-        db: testDb.db,
-        redis: testRedis.redis,
-        searchAdapter,
-        entityCache,
-        registry,
-        ...(options.masterKeyProvider ? { masterKeyProvider: options.masterKeyProvider } : {}),
-        ...(fileProviderResolver ? { _fileProviderResolver: fileProviderResolver } : {}),
-        ...(typeof options.extraContext === "function"
-          ? options.extraContext({ registry, db: testDb.db, sseBroker, redis: testRedis.redis })
-          : options.extraContext),
-      },
+      context: appContext,
       jwtSecret,
+      ...(options.observability ? { observability: options.observability } : {}),
       dispatcherOptions: {
         idempotency,
         ...(options.effectiveFeatures && { effectiveFeatures: options.effectiveFeatures }),
@@ -358,7 +380,6 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
             },
           }
         : {}),
-      ...(options.observability ? { observability: options.observability } : {}),
       ...(options.lifecycle ? { lifecycle: options.lifecycle } : {}),
       ...(options.rateLimit ? { rateLimit: options.rateLimit } : {}),
       ...(options.anonymousAccess