@cosmicdrift/kumiko-framework 0.197.0 → 0.198.0

package/src/files/__tests__/files.integration.test.ts

@@ -581,6 +581,22 @@ describe("error handling", () => {
     expect(res.status).toBe(404);
   });
 
+  // #1950: a malformed (non-UUID) id used to reach `selectMany` unchecked —
+  // Postgres rejects it with 22P02, which the pooled Bun.SQL connection
+  // treated as poisoned (see the NONEXISTENT_UUID comment above, added as a
+  // workaround before this guard existed). 404, same as a real-but-absent
+  // id, not the raw DB error.
+  test("download with a malformed (non-UUID) id returns 404, not a DB error", async () => {
+    const res = await getFile(adminUser, "not-a-uuid");
+    expect(res.status).toBe(404);
+  });
+
+  test("a malformed id doesn't poison the pooled connection for the next request", async () => {
+    await getFile(adminUser, "not-a-uuid");
+    const res = await getFile(adminUser, NONEXISTENT_UUID);
+    expect(res.status).toBe(404);
+  });
+
   test("upload wrong file type for entity field is rejected", async () => {
     const pdfContent = new TextEncoder().encode("fake-pdf-content");
     const res = await uploadFile(adminUser, "document.pdf", pdfContent, "application/pdf", {

package/src/files/file-routes.ts

@@ -5,7 +5,13 @@ import type { DbConnection } from "../db/connection";
 import { createEventStoreExecutor } from "../db/event-store-executor";
 import { createTenantDb } from "../db/tenant-db";
 import { createDerivativesContext, resolveFieldVariant, resolveRenderer } from "../derivatives";
-import { isFileField, type Registry, type SessionUser, type TenantId } from "../engine/types";
+import {
+  isFileField,
+  isUuid,
+  type Registry,
+  type SessionUser,
+  type TenantId,
+} from "../engine/types";
 import { generateId } from "../utils";
 import { buildContentDispositionHeader } from "./content-disposition";
 import { createFileContext } from "./file-handle";
@@ -396,6 +402,11 @@ export function createFileRoutes(options: FileRoutesOptions): Hono {
   });
 
   async function loadFileForTenant(id: string, tenantId: TenantId): Promise<FileRef | null> {
+    // fileRefsTable.id is a UUID column — a malformed id must fail here, not
+    // at Postgres (22P02 poisons the pooled Bun.SQL connection). 404, not
+    // 400: an authenticated caller sending a bad id must see the same
+    // response as a nonexistent one, no existence-oracle.
+    if (!isUuid(id)) return null;
     // isDeleted:false — soft-deleted (trashed) rows stay recoverable but must
     // never surface to reads/guards.
     const [row] = await selectMany(db, fileRefsTable, { id, tenantId, isDeleted: false });

package/src/jobs/__tests__/jobs.integration.test.ts

@@ -201,6 +201,13 @@ const testFeature = defineFeature("test", (r) => {
     const value = await ctx.config!("test:config:probe-key");
     jobLog.push({ name: "test:job:config-probe", payload: { value }, timestamp: Date.now() });
   });
+
+  // ctx.write/queryAs throw until JobRunner.attachDispatcher() has run —
+  // regression guard for framework#2043. No test runner here ever calls
+  // attachDispatcher(), so this always hits the stub.
+  r.job("writeProbe", { trigger: { manual: true }, retries: 0 }, async (_payload, ctx) => {
+    await ctx.write("test:write:probe", {});
+  });
 });
 
 beforeAll(async () => {
@@ -803,6 +810,27 @@ describe("error handling", () => {
     );
   });
 
+  test("ctx.write throws before attachDispatcher() has run (framework#2043)", async () => {
+    clearLog();
+    const failures: string[] = [];
+    await withRunner(
+      async (runner) => {
+        await runner.dispatch("test:job:write-probe");
+        await waitFor(() => {
+          expect(failures.length).toBeGreaterThanOrEqual(1);
+        });
+        expect(failures[0]).toContain(
+          "JobContext.write called before dispatcher attached — call attachDispatcher() first",
+        );
+      },
+      {
+        onJobFailed: (jobName, _id, error) => {
+          if (jobName === "test:job:write-probe") failures.push(error);
+        },
+      },
+    );
+  });
+
   test("perTenant without getActiveTenantIds fails wrapper; worker stays alive", async () => {
     clearLog();
     await withRunner(async (runner) => {

package/src/jobs/job-runner.ts

@@ -7,6 +7,8 @@ import { createDerivativesContext } from "../derivatives/derivatives-context";
 import { createSystemUser } from "../engine/system-user";
 import {
   type AppContext,
+  type DispatchWriteRef,
+  type JobContext,
   type JobRunIn,
   type Registry,
   type SessionUser,
@@ -114,6 +116,10 @@ export type JobRunner = {
     payload: Record<string, unknown>,
     user?: SessionUser,
   ): Promise<void>;
+  // Wires JobContext.write/queryAs to the real dispatcher — called once at
+  // boot, after the dispatcher exists (job-runner construction happens
+  // before it). Before this runs, JobContext.write/queryAs throw.
+  attachDispatcher(ref: DispatchWriteRef): void;
 };
 
 export type JobRunnerOptions = {
@@ -285,6 +291,9 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
   // delivery.render → delivery.send). Assigned just before return; reads happen
   // at job-execution time (after start()), so it is always defined by then.
   let selfRunner: JobRunner | undefined;
+  // Set by attachDispatcher() once the boot-level dispatcher exists.
+  // JobContext.write/queryAs throw until this is set — see JobContext doc.
+  let dispatchWriteRef: DispatchWriteRef | undefined;
 
   // Counts active + waiting jobs with this name for this tenant across
   // BOTH lane queues. Jobs with the same name should only live in one
@@ -439,8 +448,11 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             tenantId,
           })
         : context.derivatives;
-    const jobContext: AppContext = {
+    const jobContext: JobContext = {
       ...context,
+      // Same union as configDb above — job runners are always constructed
+      // with a real DbConnection; JobContext requires it non-optional.
+      db: configDb as DbConnection, // @cast-boundary db-operator
       files,
       derivatives,
       ...(notify !== undefined && { notify }),
@@ -456,6 +468,22 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       triggeredBy: triggeredById !== null ? { id: triggeredById, tenantId } : null,
       log: createJobLogger(logs),
       ...(triggerName !== undefined && { triggerName }),
+      write: (qn: string, payload: unknown) => {
+        if (!dispatchWriteRef) {
+          throw new Error(
+            "JobContext.write called before dispatcher attached — call attachDispatcher() first",
+          );
+        }
+        return dispatchWriteRef.write(jobSystemUser, qn, payload);
+      },
+      queryAs: (user: SessionUser, qn: string, payload: unknown) => {
+        if (!dispatchWriteRef) {
+          throw new Error(
+            "JobContext.queryAs called before dispatcher attached — call attachDispatcher() first",
+          );
+        }
+        return dispatchWriteRef.queryAs(user, qn, payload);
+      },
     };
 
     await options.onJobStart?.(jobName, jobId, meta);
@@ -769,6 +797,9 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         await queues[laneForJob(jobDef)].add(name, data);
       }
     },
+    attachDispatcher(ref: DispatchWriteRef): void {
+      dispatchWriteRef = ref;
+    },
   };
 
   selfRunner = runnerApi;

package/src/migrations/__tests__/pending-rebuilds.integration.test.ts

@@ -318,6 +318,7 @@ describe("enqueueProjectionRebuild — inline fallback (jobRunner without the jo
         dispatchCalls++;
         return "should-not-happen";
       },
+      attachDispatcher: () => {},
     };
 
     const outcome = await enqueueProjectionRebuild("pendingtest:projection:pending-counts", {

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -1021,11 +1021,11 @@ describe("dispatcher context.geoTzProvider (680/1)", () => {
 function createMockIdempotencyGuard() {
   const cache = new Map<string, string>();
   return {
-    async check(requestId: string) {
-      return cache.get(requestId) ?? null;
+    async check(tenantId: string, userId: string, requestId: string) {
+      return cache.get(`${tenantId}:${userId}:${requestId}`) ?? null;
     },
-    async store(requestId: string, result: unknown) {
-      cache.set(requestId, JSON.stringify(result));
+    async store(tenantId: string, userId: string, requestId: string, result: unknown) {
+      cache.set(`${tenantId}:${userId}:${requestId}`, JSON.stringify(result));
     },
   };
 }

package/src/pipeline/__tests__/redis-pipeline.integration.test.ts

@@ -19,9 +19,12 @@ afterAll(async () => {
 // --- Idempotency ---
 
 describe("idempotency guard", () => {
+  const tenantA = "00000000-0000-4000-8000-00000000000a";
+  const userA = "00000000-0000-4000-8000-0000000000a1";
+
   test("returns null for new request", async () => {
     const guard = createIdempotencyGuard(testRedis.redis);
-    const result = await guard.check("req-new-123");
+    const result = await guard.check(tenantA, userA, "req-new-123");
     expect(result).toBeNull();
   });
 
@@ -29,8 +32,8 @@ describe("idempotency guard", () => {
     const guard = createIdempotencyGuard(testRedis.redis);
     const requestId = "req-dup-456";
 
-    await guard.store(requestId, { isSuccess: true, data: { id: 1 } });
-    const cached = await guard.check(requestId);
+    await guard.store(tenantA, userA, requestId, { isSuccess: true, data: { id: 1 } });
+    const cached = await guard.check(tenantA, userA, requestId);
 
     expect(cached).not.toBeNull();
     if (!cached) throw new Error("expected cached value");
@@ -41,15 +44,15 @@ describe("idempotency guard", () => {
     const guard = createIdempotencyGuard(testRedis.redis, { ttlSeconds: 1 });
     const requestId = "req-ttl-789";
 
-    await guard.store(requestId, { done: true });
+    await guard.store(tenantA, userA, requestId, { done: true });
 
     // Should exist immediately
-    expect(await guard.check(requestId)).not.toBeNull();
+    expect(await guard.check(tenantA, userA, requestId)).not.toBeNull();
 
     // Wait for expiry
     await new Promise((r) => setTimeout(r, 1100));
 
-    expect(await guard.check(requestId)).toBeNull();
+    expect(await guard.check(tenantA, userA, requestId)).toBeNull();
   });
 
   test("parallel check(): second caller waits for the first's store() instead of racing", async () => {
@@ -61,11 +64,11 @@ describe("idempotency guard", () => {
     const requestId = "req-race-1";
 
     // Request #1 starts — claims the in-progress lock.
-    const first = await guard.check(requestId);
+    const first = await guard.check(tenantA, userA, requestId);
     expect(first).toBeNull(); // got the lock
 
     // Request #2 runs concurrently — must block until #1 stores a result.
-    const secondPromise = guard.check(requestId);
+    const secondPromise = guard.check(tenantA, userA, requestId);
 
     // After a tick the second must still be pending: no result yet.
     await new Promise((r) => setTimeout(r, 80));
@@ -77,7 +80,7 @@ describe("idempotency guard", () => {
     expect(quickResult.done).toBe(false);
 
     // Request #1 finishes.
-    await guard.store(requestId, { isSuccess: true, data: { id: 99 } });
+    await guard.store(tenantA, userA, requestId, { isSuccess: true, data: { id: 99 } });
 
     // Request #2 should now see the stored result, not null — no duplicate work.
     const second = await secondPromise;
@@ -93,13 +96,39 @@ describe("idempotency guard", () => {
     });
     const requestId = "req-crashed";
 
-    const first = await guard.check(requestId);
+    const first = await guard.check(tenantA, userA, requestId);
     expect(first).toBeNull(); // we acquired the lock, then "crash" — never call store()
 
     // After the pending-TTL lapses, a retry should be allowed to take over.
-    const second = await guard.check(requestId);
+    const second = await guard.check(tenantA, userA, requestId);
     expect(second).toBeNull(); // reclaimed
   });
+
+  test("same requestId from different tenant/user does not hit the same cache entry", async () => {
+    const guard = createIdempotencyGuard(testRedis.redis);
+    const requestId = "req-shared-across-tenants";
+    const tenantB = "00000000-0000-4000-8000-00000000000b";
+    const userB = "00000000-0000-4000-8000-0000000000b1";
+
+    // Tenant A / user A owns the request and stores its result.
+    const firstCheck = await guard.check(tenantA, userA, requestId);
+    expect(firstCheck).toBeNull();
+    await guard.store(tenantA, userA, requestId, { isSuccess: true, data: { tenant: "A" } });
+
+    // Same requestId, different tenant+user: must be treated as a fresh
+    // request, not see tenant A's cached/pending state.
+    const otherTenantCheck = await guard.check(tenantB, userB, requestId);
+    expect(otherTenantCheck).toBeNull();
+
+    // Different user, same tenant: also isolated.
+    const otherUserCheck = await guard.check(tenantA, userB, requestId);
+    expect(otherUserCheck).toBeNull();
+
+    // Tenant A's own result is still retrievable and unaffected.
+    const ownResult = await guard.check(tenantA, userA, requestId);
+    expect(ownResult).not.toBeNull();
+    expect(JSON.parse(ownResult as string)).toEqual({ isSuccess: true, data: { tenant: "A" } });
+  });
 });
 
 // --- Event Dedup ---

package/src/pipeline/dispatch-batch.ts

@@ -30,7 +30,7 @@ export async function runBatch(
   // Idempotency: if the same requestId has already been processed, return the
   // cached result without re-executing. The cache holds the full BatchResult.
   if (requestId && idempotency) {
-    const cached = await idempotency.check(requestId);
+    const cached = await idempotency.check(user.tenantId, user.id, requestId);
     if (cached) {
       const parsed = parseJsonSafe<BatchResult | null>(cached, null);
       if (parsed) return parsed;
@@ -42,7 +42,7 @@ export async function runBatch(
   // the same answer (both success and failure results are cached).
   const finalize = async (result: BatchResult): Promise<BatchResult> => {
     if (requestId && idempotency) {
-      await idempotency.store(requestId, result);
+      await idempotency.store(user.tenantId, user.id, requestId, result);
     }
     return result;
   };

package/src/pipeline/idempotency.ts

@@ -2,8 +2,8 @@ import type Redis from "ioredis";
 import { RedisKeys } from "./redis-keys";
 
 export type IdempotencyGuard = {
-  check(requestId: string): Promise<string | null>;
-  store(requestId: string, result: unknown): Promise<void>;
+  check(tenantId: string, userId: string, requestId: string): Promise<string | null>;
+  store(tenantId: string, userId: string, requestId: string, result: unknown): Promise<void>;
 };
 
 // Sentinel stored under the key while the handler is running. A second
@@ -39,8 +39,8 @@ export function createIdempotencyGuard(
     // both see a cache miss, both execute side-effects, and only one persist
     // the result. This version uses a pending-marker lock so the second caller
     // waits for the first to finish and reuses its result.
-    async check(requestId) {
-      const key = `${prefix}${requestId}`;
+    async check(tenantId, userId, requestId) {
+      const key = `${prefix}${tenantId}:${userId}:${requestId}`;
 
       // Try to acquire the in-progress lock.
       const acquired = await redis.set(key, PENDING_MARKER, "EX", pendingTtl, "NX");
@@ -67,10 +67,15 @@ export function createIdempotencyGuard(
       return null;
     },
 
-    async store(requestId, result) {
+    async store(tenantId, userId, requestId, result) {
       // Overwrite the pending marker with the real result. Plain SET (no NX)
       // on purpose: we own the lock; writing the result is the final step.
-      await redis.set(`${prefix}${requestId}`, JSON.stringify(result), "EX", ttl);
+      await redis.set(
+        `${prefix}${tenantId}:${userId}:${requestId}`,
+        JSON.stringify(result),
+        "EX",
+        ttl,
+      );
     },
   };
 }

package/src/ui-types/index.ts

@@ -51,7 +51,7 @@ export type {
   TextFieldDef,
 } from "../engine/types/fields";
 export type { AccessRule } from "../engine/types/handlers";
-export type { NavDefinition } from "../engine/types/nav";
+export type { NavDefinition, NavIconKey } from "../engine/types/nav";
 export type {
   ActionFormScreenDefinition,
   ConfigEditScreenDefinition,