@cosmicdrift/kumiko-renderer-web 0.154.1 → 0.155.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer-web",
-  "version": "0.154.1",
+  "version": "0.155.0",
   "description": "Web-platform bindings for @cosmicdrift/kumiko-renderer. HTML default-primitives, browser history-based navigation, EventSource-backed live events, and a one-call createKumikoApp that mounts the whole stack via react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -16,9 +16,9 @@
     "./styles.css": "./src/styles.css"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.154.1",
-    "@cosmicdrift/kumiko-headless": "0.154.1",
-    "@cosmicdrift/kumiko-renderer": "0.154.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.155.0",
+    "@cosmicdrift/kumiko-headless": "0.155.0",
+    "@cosmicdrift/kumiko-renderer": "0.155.0",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-label": "^2.1.8",

package/src/layout/__tests__/nav-registry.test.ts

@@ -9,13 +9,23 @@ import type {
   AppSchema,
   FeatureSchema,
   NavDefinition,
+  ScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/ui-types";
+import { resolveNavigation } from "@cosmicdrift/kumiko-headless";
 import { buildNavRegistrySlice, buildNavRegistrySliceForApp } from "../nav-tree";
 
 function feature(navs: readonly NavDefinition[], featureName = "tasks"): FeatureSchema {
   return { featureName, entities: {}, screens: [], navs };
 }
 
+function featureWithScreens(
+  navs: readonly NavDefinition[],
+  screens: readonly ScreenDefinition[],
+  featureName = "tasks",
+): FeatureSchema {
+  return { featureName, entities: {}, screens, navs };
+}
+
 describe("buildNavRegistrySlice", () => {
   test("qualifiziert Nav-IDs zu feature:nav:id", () => {
     const slice = buildNavRegistrySlice(feature([{ id: "main", label: "Main" }]));
@@ -70,4 +80,80 @@ describe("buildNavRegistrySliceForApp", () => {
     const slice = buildNavRegistrySliceForApp(app);
     expect(slice.topLevel.map((n) => n.id)).toEqual(["shop:nav:catalog", "admin:nav:users"]);
   });
+
+  test("nav ohne eigene access erbt access vom referenzierten Screen (#1099)", () => {
+    const app: AppSchema = {
+      features: [
+        featureWithScreens(
+          [{ id: "members", label: "Members", screen: "members" }],
+          [
+            {
+              id: "members",
+              type: "custom",
+              renderer: { react: { __component: "Members" } },
+              access: { roles: ["Admin"] },
+            },
+          ],
+        ),
+      ],
+    };
+    const slice = buildNavRegistrySliceForApp(app);
+    expect(slice.topLevel[0]?.access).toEqual({ roles: ["Admin"] });
+  });
+
+  test("nav mit eigener access ignoriert die Screen-Access (expliziter Override gewinnt)", () => {
+    const app: AppSchema = {
+      features: [
+        featureWithScreens(
+          [
+            {
+              id: "members",
+              label: "Members",
+              screen: "members",
+              access: { roles: ["Admin", "Editor"] },
+            },
+          ],
+          [
+            {
+              id: "members",
+              type: "custom",
+              renderer: { react: { __component: "Members" } },
+              access: { roles: ["Admin"] },
+            },
+          ],
+        ),
+      ],
+    };
+    const slice = buildNavRegistrySliceForApp(app);
+    expect(slice.topLevel[0]?.access).toEqual({ roles: ["Admin", "Editor"] });
+  });
+
+  test("nav ohne screen bleibt ohne access (nichts zum Erben da)", () => {
+    const app: AppSchema = {
+      features: [feature([{ id: "group", label: "Group" }])],
+    };
+    const slice = buildNavRegistrySliceForApp(app);
+    expect(slice.topLevel[0]?.access).toBeUndefined();
+  });
+
+  test("end-to-end: resolveNavigation versteckt den Eintrag fuer eine Rolle, die den Ziel-Screen nicht sehen darf", () => {
+    const app: AppSchema = {
+      features: [
+        featureWithScreens(
+          [{ id: "members", label: "Members", screen: "members" }],
+          [
+            {
+              id: "members",
+              type: "custom",
+              renderer: { react: { __component: "Members" } },
+              access: { roles: ["Admin"] },
+            },
+          ],
+        ),
+      ],
+    };
+    const source = buildNavRegistrySliceForApp(app);
+    const tree = resolveNavigation({ source, user: { id: "u1", roles: ["Editor"] } });
+    expect(tree).toEqual([]);
+  });
 });

package/src/layout/nav-tree.tsx

@@ -11,7 +11,12 @@
 // auf/zu. State lebt lokal im NavTree (useState); Default expanded
 // für alles, Caller kann später localStorage-Persistenz drüberlegen.
 
-import type { TargetRef, TreeAction, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
+import type {
+  AccessRule,
+  TargetRef,
+  TreeAction,
+  TreeNode,
+} from "@cosmicdrift/kumiko-framework/engine";
 import type { NavDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 import type { NavNode, NavRegistrySlice } from "@cosmicdrift/kumiko-headless";
 import { resolveNavigation } from "@cosmicdrift/kumiko-headless";
@@ -816,14 +821,24 @@ export function buildNavRegistrySliceForApp(
   app: AppSchema,
   allowedNavQns?: ReadonlySet<string>,
 ): NavRegistrySlice {
+  const screenAccessByQn = buildScreenAccessMap(app);
   const qualified: NavDefinition[] = [];
   for (const feature of app.features) {
     for (const n of feature.navs ?? []) {
+      const screen =
+        n.screen !== undefined ? qualifyScreenId(feature.featureName, n.screen) : undefined;
+      // Nav entries without their own `access` inherit the referenced
+      // screen's access rule — otherwise a broader workspace/parent access
+      // lets a role see a nav entry whose target screen 403s them (#1099).
+      // An explicit `n.access` always wins; inheritance only fills the gap.
+      const inheritedAccess =
+        n.access ?? (screen !== undefined ? screenAccessByQn.get(screen) : undefined);
       qualified.push({
         ...n,
         id: qualifyNavId(feature.featureName, n.id),
         ...(n.parent !== undefined && { parent: qualifyNavId(feature.featureName, n.parent) }),
-        ...(n.screen !== undefined && { screen: qualifyScreenId(feature.featureName, n.screen) }),
+        ...(screen !== undefined && { screen }),
+        ...(inheritedAccess !== undefined && { access: inheritedAccess }),
       });
     }
   }
@@ -863,6 +878,16 @@ function qualifyScreenId(feature: string, id: string): string {
   return id.includes(":screen:") ? id : `${feature}:screen:${id}`;
 }
 
+function buildScreenAccessMap(app: AppSchema): Map<string, AccessRule | undefined> {
+  const map = new Map<string, AccessRule | undefined>();
+  for (const feature of app.features) {
+    for (const s of feature.screens) {
+      map.set(qualifyScreenId(feature.featureName, s.id), s.access);
+    }
+  }
+  return map;
+}
+
 // `lastSegment` lebt jetzt in @cosmicdrift/kumiko-renderer (./app/qn) — eine
 // Quelle, beide Pakete teilen sie.
 export { lastSegment };