@cosmicdrift/kumiko-framework 0.60.0 → 0.60.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.60.0",
+  "version": "0.60.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/api/__tests__/auth-routes-cookie.test.ts

@@ -204,6 +204,34 @@ describe("auth-routes cookieDomain", () => {
     expect(getSetCookieRaw(res, CSRF_COOKIE_NAME)).toMatch(/Domain=example\.eu/i);
   });
 
+  // Symmetrisch zum Logout (#321/1): wer mit cookieDomain SETZT, muss die
+  // host-only-Variante mit-invalidieren — sonst koexistiert nach dem ersten
+  // Deploy mit cookieDomain das alte host-only-Cookie neben dem neuen
+  // Domain-Cookie und der Server liest umgebungsabhängig das veraltete.
+  test("login: cookieDomain invalidiert zusätzlich die host-only-Variante", async () => {
+    const { app } = await buildApp({ cookieDomain: "example.eu" });
+    const raw = (await login(app)).headers.getSetCookie();
+    const authCookies = raw.filter((c) => c.startsWith(`${AUTH_COOKIE_NAME}=`));
+    const csrfCookies = raw.filter((c) => c.startsWith(`${CSRF_COOKIE_NAME}=`));
+    // host-only-Delete: Max-Age=0 ohne Domain-Attribut.
+    expect(authCookies.some((c) => /Max-Age=0/i.test(c) && !/Domain=/i.test(c))).toBe(true);
+    expect(csrfCookies.some((c) => /Max-Age=0/i.test(c) && !/Domain=/i.test(c))).toBe(true);
+    // ...neben dem echten Domain-Cookie (positive Max-Age).
+    expect(authCookies.some((c) => /Domain=example\.eu/i.test(c) && !/Max-Age=0/i.test(c))).toBe(
+      true,
+    );
+  });
+
+  test("ohne cookieDomain: KEIN zusätzlicher host-only-Delete beim Login", async () => {
+    const { app } = await buildApp();
+    const raw = (await login(app)).headers.getSetCookie();
+    // Nur das eine Set-Cookie pro Name, kein Max-Age=0-Delete.
+    expect(raw.filter((c) => c.startsWith(`${AUTH_COOKIE_NAME}=`)).length).toBe(1);
+    expect(raw.some((c) => c.startsWith(`${AUTH_COOKIE_NAME}=`) && /Max-Age=0/i.test(c))).toBe(
+      false,
+    );
+  });
+
   test("switch-tenant: rotierte Cookies tragen das Domain-Attribut", async () => {
     const otherTenant = TestUsers.otherTenant;
     const dispatcher = createStubDispatcher({

package/src/api/auth-routes.ts

@@ -56,6 +56,16 @@ function setAuthCookies(
     ...(opts.domain !== undefined && { domain: opts.domain }),
   } as const;
 
+  // Bei gesetzter Domain zuerst die host-only-Variante invalidieren (analog
+  // clearAuthCookies): sonst koexistiert nach einem Deploy mit neuem
+  // cookieDomain das alte host-only-Cookie mit dem neuen Domain-Cookie
+  // (RFC 6265: name+domain ist distinct) und der Server bindet
+  // umgebungsabhängig potenziell ans veraltete host-only-Token.
+  if (opts.domain !== undefined) {
+    deleteCookie(c, AUTH_COOKIE_NAME, { path: "/" });
+    deleteCookie(c, CSRF_COOKIE_NAME, { path: "/" });
+  }
+
   setCookie(c, AUTH_COOKIE_NAME, opts.token, { ...common, httpOnly: true });
   // Intentionally NOT HttpOnly — the web client has to read this from
   // document.cookie to include it in the X-CSRF-Token request header.

package/src/engine/__tests__/screen-filter-ops.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import { createDecimalField, createMoneyField, createNumberField } from "../factories";
+import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops";
+import type { ScreenFilterOp } from "../types";
+
+const COMPARABLE: ScreenFilterOp[] = ["eq", "ne", "lt", "gt", "in"];
+
+describe("getAllowedFilterOps — decimal is comparable (#343/1)", () => {
+  test("decimal yields the full comparable op-set, not the empty default", () => {
+    const ops = getAllowedFilterOps(createDecimalField({ precision: 10, scale: 2 }));
+    expect([...ops].sort()).toEqual([...COMPARABLE].sort());
+    expect(ops.length).toBeGreaterThan(0);
+  });
+
+  test("decimal matches number/money — same comparable surface", () => {
+    const decimal = getAllowedFilterOps(createDecimalField({ precision: 6, scale: 2 }));
+    const number = getAllowedFilterOps(createNumberField({}));
+    const money = getAllowedFilterOps(createMoneyField({}));
+    expect([...decimal].sort()).toEqual([...number].sort());
+    expect([...decimal].sort()).toEqual([...money].sort());
+  });
+
+  test("a filterable decimal field is usable: filterable AND non-empty ops", () => {
+    const field = createDecimalField({ precision: 8, scale: 2, filterable: true });
+    expect(isFieldFilterable(field)).toBe(true);
+    // Regression guard: before the fix this returned [] → the boot-validator
+    // rejected EVERY filter op on a filterable decimal field ("Allowed ops:
+    // (none)"), making the field unusable.
+    expect(getAllowedFilterOps(field).length).toBeGreaterThan(0);
+  });
+});

package/src/engine/screen-filter-ops.ts

@@ -6,8 +6,8 @@
 //     compare nutzt der Author selten bewusst); Author kann den
 //     Filter dann einfach nicht setzen.
 //   - boolean: eq, ne (in/lt/gt sinnlos für 2-Werte-Type).
-//   - number/money/date/timestamp/locatedTimestamp: alle 5 Ops —
-//     die Felder sind natürlich vergleichbar.
+//   - number/money/decimal/date/timestamp/locatedTimestamp: alle 5
+//     Ops — die Felder sind natürlich vergleichbar.
 //
 // Boot-Validator nutzt diese Map um Author-Fehler früh zu fangen
 // ("filter mit op:lt auf einem text-Feld" → Boot-Fail). Erweitert sich
@@ -30,6 +30,7 @@ export function getAllowedFilterOps(field: FieldDefinition): readonly ScreenFilt
       return BOOL_OPS;
     case "number":
     case "money":
+    case "decimal":
     case "date":
     case "timestamp":
     case "locatedTimestamp":