@cosmicdrift/kumiko-renderer-web 0.157.2 → 0.159.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer-web",
-  "version": "0.157.2",
+  "version": "0.159.1",
   "description": "Web-platform bindings for @cosmicdrift/kumiko-renderer. HTML default-primitives, browser history-based navigation, EventSource-backed live events, and a one-call createKumikoApp that mounts the whole stack via react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -16,9 +16,9 @@
     "./styles.css": "./src/styles.css"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.157.2",
-    "@cosmicdrift/kumiko-headless": "0.157.2",
-    "@cosmicdrift/kumiko-renderer": "0.157.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.159.1",
+    "@cosmicdrift/kumiko-headless": "0.159.1",
+    "@cosmicdrift/kumiko-renderer": "0.159.1",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-label": "^2.1.8",

package/src/__tests__/create-app.test.tsx

@@ -61,6 +61,7 @@ const baseSchema: FeatureSchema = {
   featureName: "tasks",
   entities: { task: taskEntity },
   screens: [editScreen, listScreen],
+  navs: [{ id: "task-edit", label: "tasks:nav.task-edit", screen: "tasks:screen:task-edit" }],
 };
 
 // createKumikoApp ruft createRoot(...).render(...) direkt auf — React 18+
@@ -181,6 +182,7 @@ describe("createKumikoApp", () => {
       featureName: "tasks",
       entities: { task: taskEntity },
       screens: [{ ...listScreen, access: { openToAll: true } }],
+      navs: [{ id: "task-list", label: "tasks:nav.task-list", screen: "tasks:screen:task-list" }],
     };
     const schema: AppSchema = { features: [restrictedFeature, openFeature] };
     await mountApp({ schema, dispatcher: makeDispatcher() });
@@ -230,6 +232,9 @@ describe("createKumikoApp", () => {
           columns: [{ field: "color", renderer: { react: { __component: "Swatch" } } }],
         },
       ],
+      navs: [
+        { id: "color-list", label: "tasks:nav.color-list", screen: "tasks:screen:color-list" },
+      ],
     };
 
     mountRoot();
@@ -283,6 +288,9 @@ describe("createKumikoApp", () => {
       featureName: "tasks",
       entities: { task: colorEntity },
       screens: [colorListScreen],
+      navs: [
+        { id: "color-list", label: "tasks:nav.color-list", screen: "tasks:screen:color-list" },
+      ],
     };
     const dispatcher = createMockDispatcher({
       query: (async () => ({
@@ -328,6 +336,13 @@ describe("createKumikoApp", () => {
       featureName: "cap-counter",
       entities: {},
       screens: [dashboardScreen],
+      navs: [
+        {
+          id: "overview",
+          label: "cap-counter:nav.cap-list",
+          screen: "cap-counter:screen:overview",
+        },
+      ],
       translations: {
         "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
       },
@@ -371,6 +386,13 @@ describe("createKumikoApp", () => {
       featureName: "cap-counter",
       entities: {},
       screens: [dashboardScreen],
+      navs: [
+        {
+          id: "overview",
+          label: "cap-counter:nav.cap-list",
+          screen: "cap-counter:screen:overview",
+        },
+      ],
       translations: {
         "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
       },

package/src/__tests__/kumiko-screen.test.tsx

@@ -499,6 +499,31 @@ describe("KumikoScreen", () => {
     expect(bannerText).not.toBe("errors.access.denied");
   });
 
+  test("entityList: query-Error zeigt übersetzten Text statt rohem i18nKey (issue #1193)", async () => {
+    const dispatcher = makeDispatcher({
+      query: (async () => ({
+        isSuccess: false,
+        error: {
+          code: "access_denied",
+          httpStatus: 403,
+          i18nKey: "errors.access.denied",
+          message: "",
+        },
+      })) as unknown as Dispatcher["query"],
+    });
+
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="tasks:screen:task-list" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => expect(screen.queryByTestId("kumiko-screen-error")).toBeTruthy());
+    const bannerText = screen.getByTestId("kumiko-screen-error").textContent;
+    expect(bannerText).toBe(kumikoDefaultTranslations["en"]?.["errors.access.denied"] ?? "");
+    expect(bannerText).not.toBe("errors.access.denied");
+  });
+
   // RowActions-Mapping (Tier 2.7a Resolution-Layer): pinst dass
   // EntityListBody die Schema-Form (handler-QN, label-i18nKey, payload-
   // builder, visible-Function, confirmLabel) zu DataTableRowAction

package/src/__tests__/xss-safety.test.tsx

@@ -0,0 +1,58 @@
+//
+// Pins the XSS-escaping behavior for tenant-/pattern-authored content
+// (kumiko-framework#1321). renderer-web has no dangerouslySetInnerHTML
+// and no field-renderer path that wires tenant data into href/src — this
+// test guards JSX auto-escaping against future regressions (e.g. if
+// someone adds rich-text/markdown support via dangerouslySetInnerHTML),
+// and pins the Link primitive's scheme guard (kumiko-framework#1365)
+// against javascript:/data: hrefs as defense-in-depth.
+
+import { describe, expect, test } from "bun:test";
+import { defaultPrimitives } from "../primitives";
+import { StatCard } from "../widgets/stat";
+import { render, screen } from "./test-utils";
+
+const PAYLOAD = '<script>window.__xss = true;</script><img src=x onerror="window.__xss = true">';
+const UNSAFE_HREFS = [
+  "javascript:window.__xss = true",
+  "data:text/html,<script>window.__xss=true</script>",
+];
+
+describe("XSS-safety (tenant-authored content)", () => {
+  test("Text-Primitive rendert Payload als Text, nicht als HTML", () => {
+    render(<defaultPrimitives.Text testId="txt">{PAYLOAD}</defaultPrimitives.Text>);
+    const node = screen.getByTestId("txt");
+    expect(node.textContent).toBe(PAYLOAD);
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+  });
+
+  test("StatCard-Widget rendert label/value/sub als Text, nicht als HTML", () => {
+    render(<StatCard testId="stat" label={PAYLOAD} value={PAYLOAD} sub={PAYLOAD} />);
+    const node = screen.getByTestId("stat");
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+    expect(node.textContent).toContain(PAYLOAD);
+  });
+
+  test.each(UNSAFE_HREFS)("Link-Primitive neutralisiert unsicheren href-Scheme: %s", (href) => {
+    render(
+      <defaultPrimitives.Link testId="link" href={href}>
+        text
+      </defaultPrimitives.Link>,
+    );
+    const node = screen.getByTestId("link");
+    expect(node.getAttribute("href")).toBe("#");
+  });
+
+  test("Link-Primitive lässt sichere hrefs (https/mailto/relativ) unverändert", () => {
+    for (const href of ["https://example.com", "mailto:a@example.com", "/relative/path"]) {
+      render(
+        <defaultPrimitives.Link testId={`link-${href}`} href={href}>
+          text
+        </defaultPrimitives.Link>,
+      );
+      expect(screen.getByTestId(`link-${href}`).getAttribute("href")).toBe(href);
+    }
+  });
+});

package/src/app/__tests__/first-open-screen-qn.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "bun:test";
+import type { CustomScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import type { FeatureSchema } from "@cosmicdrift/kumiko-renderer";
+import { firstOpenScreenQn } from "../create-app";
+
+function feature(
+  overrides: Partial<FeatureSchema> & { readonly featureName: string },
+): FeatureSchema {
+  return { entities: {}, screens: [], ...overrides };
+}
+
+function customScreen(
+  overrides: Partial<CustomScreenDefinition> & { readonly id: string },
+): CustomScreenDefinition {
+  return { type: "custom", renderer: {}, ...overrides };
+}
+
+describe("firstOpenScreenQn", () => {
+  test("picks an open screen that is placed in nav", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "shop:screen:catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+
+  test("skips a dormant open screen that has no nav entry (#1258)", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "auth-mfa",
+        screens: [customScreen({ id: "auth-mfa-enable", access: { openToAll: true } })],
+        // No nav entry — this is auth-mfa's dormant custom-screen convention.
+      }),
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "shop:screen:catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+
+  test("skips role-restricted screens even when placed in nav", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "admin",
+        screens: [customScreen({ id: "dashboard", access: { roles: ["Admin"] } })],
+        navs: [{ id: "dashboard", label: "admin:nav.dashboard", screen: "admin:screen:dashboard" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBeUndefined();
+  });
+
+  test("returns undefined when no screen is both open and nav-placed", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "auth-mfa",
+        screens: [customScreen({ id: "auth-mfa-enable", access: { openToAll: true } })],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBeUndefined();
+  });
+
+  test("resolves a bare screen id in nav to the qualified screen name", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+});

package/src/app/create-app.tsx

@@ -135,10 +135,30 @@ function readInjectedSchema(): AppSchema | FeatureSchema | undefined {
 // ein role-restricted Screen (z.B. bundled user/tenant, SystemAdmin-only)
 // darf hier nie gewinnen, sonst landet jeder Nicht-Admin auf einem
 // Access-Denied-Screen (#1176).
-function firstOpenScreenQn(features: readonly FeatureSchema[]): string | undefined {
+// Also requires the screen be reachable via r.nav, otherwise a dormant
+// `type: "custom"` screen a feature only registers for manual app-side
+// placement (e.g. auth-mfa's enable screen) can win by declaration order
+// alone, landing every app without an explicit `screenQn` on a screen
+// nobody wired a component for (#1258).
+export function firstOpenScreenQn(features: readonly FeatureSchema[]): string | undefined {
+  // NavDefinition.screen carries two shapes in practice: most bundled
+  // features author it pre-qualified ("tenant:screen:members"), but the
+  // config settings-hub generator emits the bare short id. Index both
+  // forms so nav-reachability doesn't depend on which convention a given
+  // feature happens to use.
+  const navScreenQns = new Set<string>();
+  for (const f of features) {
+    for (const n of f.navs ?? []) {
+      if (n.screen === undefined) continue;
+      navScreenQns.add(n.screen);
+      navScreenQns.add(qualifyScreenId(f.featureName, n.screen));
+    }
+  }
   for (const feature of features) {
     const openScreen = feature.screens.find(
-      (s) => s.access === undefined || "openToAll" in s.access,
+      (s) =>
+        (s.access === undefined || "openToAll" in s.access) &&
+        navScreenQns.has(qualifyScreenId(feature.featureName, s.id)),
     );
     if (openScreen !== undefined) return qualifyScreenId(feature.featureName, openScreen.id);
   }

package/src/primitives/index.tsx

@@ -1661,6 +1661,15 @@ function DefaultText({ variant = "body", children, testId }: TextProps): ReactNo
 
 // ---- Link (anchor mit Button-/Muted-Optik) ----
 
+// http(s)/mailto or scheme-less (relative/anchor) allowed; javascript:, data:,
+// vbscript:, etc. rejected. Mirrors renderer-mail-html's renderSafeMarkdown
+// href guard — no sanitizer dependency needed for a four-line regex check.
+function isSafeHref(href: string): boolean {
+  const trimmed = href.trim().toLowerCase();
+  if (!/^[a-z][a-z0-9+.-]*:/.test(trimmed)) return true;
+  return /^(?:https?|mailto):/.test(trimmed);
+}
+
 // `button` nutzt die Primary-Buttonfläche auf einem semantischen <a> —
 // der Standard für „weiter zu"-Navigationen nach Success-States (ehem.
 // authButtonClass), `muted` der dezente Sekundär-Link (ehem.
@@ -1681,7 +1690,7 @@ function DefaultLink({
         : "text-primary underline-offset-4 hover:underline";
   return (
     <a
-      href={href}
+      href={isSafeHref(href) ? href : "#"}
       target={target}
       rel={target === "_blank" ? "noreferrer" : undefined}
       data-testid={testId}