@cosmicdrift/kumiko-renderer-web 0.234.0 → 0.235.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer-web",
-  "version": "0.234.0",
+  "version": "0.235.1",
   "description": "Web-platform bindings for @cosmicdrift/kumiko-renderer. HTML default-primitives, browser history-based navigation, EventSource-backed live events, and a one-call createKumikoApp that mounts the whole stack via react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -16,9 +16,9 @@
     "./styles.css": "./src/styles.css"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.234.0",
-    "@cosmicdrift/kumiko-headless": "0.234.0",
-    "@cosmicdrift/kumiko-renderer": "0.234.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.235.1",
+    "@cosmicdrift/kumiko-headless": "0.235.1",
+    "@cosmicdrift/kumiko-renderer": "0.235.1",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-label": "^2.1.8",
@@ -64,7 +64,7 @@
     "@types/react-dom": "^19.2.3",
     "jsdom": "^29.1.1",
     "tailwindcss": "^4.3.0",
-    "@cosmicdrift/kumiko-locale-de": "0.234.0"
+    "@cosmicdrift/kumiko-locale-de": "0.235.1"
   },
   "repository": {
     "type": "git",

package/src/__tests__/projection-detail-record-layout.test.tsx

@@ -486,6 +486,34 @@ describe("KumikoScreen / projectionDetail — layout.mode: 'tabs'", () => {
     // draws its own card frame, so a second nested Card would double it up.
     expect(screen.queryByTestId("related-list-Payments")).toBeNull();
   });
+
+  test("without a Tabs primitive, falls back to the stacked all-sections layout instead of truncating to the first section (fw#2501)", async () => {
+    const dispatcher = dispatcherReturning(rowData);
+    const { navApi } = navWithTab(undefined);
+
+    renderWithPrimitivesOverride(
+      <NavProvider value={navApi}>
+        <DispatcherProvider dispatcher={dispatcher}>
+          <KumikoScreen
+            schema={schemaFor(tabsScreen)}
+            qn="rentals:screen:rent-detail"
+            entityId="rent-1"
+          />
+        </DispatcherProvider>
+      </NavProvider>,
+      { Tabs: undefined },
+    );
+
+    await waitFor(() => screen.getByTestId("field-description"));
+    // Pre-fix: activeSection stayed truncated to sections[0] even without a
+    // Tabs primitive to switch away from it — payments/invoices content was
+    // permanently unreachable, with no tab strip to reach it either.
+    await waitFor(() =>
+      expect(dispatcher.calls.some((c) => c.type === "rentals:query:rent:payments")).toBe(true),
+    );
+    expect(dispatcher.calls.some((c) => c.type === "rentals:query:rent:invoices")).toBe(true);
+    expect(screen.queryByTestId("kumiko-screen-projection-detail-tabs")).toBeNull();
+  });
 });
 
 // Only guard against a solon-shaped screen (relatedList-heavy) silently regressing.

package/src/__tests__/secrets-edit.test.tsx

@@ -0,0 +1,287 @@
+//
+// Unit tests for the secretsEdit screen type. Secrets are write-only — the
+// security invariant this file exists to pin: an input NEVER starts pre-filled
+// with the redacted preview, and no dispatched payload ever carries that
+// preview string next to the plaintext the user typed.
+//
+// `as unknown as Dispatcher["query"/"batch"/"write"]` throughout: each inline
+// mock lambda only implements the one overload a given test exercises, never
+// the full overloaded Dispatcher signature — the missing overloads are never
+// called at runtime.
+
+import { describe, expect, mock, test } from "bun:test";
+import type { SecretsEditScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import type { Dispatcher, DispatcherError } from "@cosmicdrift/kumiko-headless";
+import type { FeatureSchema } from "@cosmicdrift/kumiko-renderer";
+import { DispatcherProvider, KumikoScreen } from "@cosmicdrift/kumiko-renderer";
+import userEvent from "@testing-library/user-event";
+import { createMockDispatcher, render, screen, waitFor } from "./test-utils";
+
+const secretsScreen: SecretsEditScreenDefinition = {
+  id: "secrets",
+  type: "secretsEdit",
+  secretKeys: { "stripe-api-key": "stripe:secret:api-key" },
+  fieldLabels: { "stripe-api-key": "config.secret.stripe.api-key.label" },
+  sections: [{ fields: ["stripe-api-key"] }],
+};
+
+const schema: FeatureSchema = {
+  featureName: "config",
+  entities: {},
+  screens: [secretsScreen],
+};
+
+describe("KumikoScreen / secretsEdit", () => {
+  test("a set secret shows its redacted preview while the input stays empty", async () => {
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({
+        isSuccess: true,
+        data: [{ key: "stripe:secret:api-key", redactedPreview: "sk_***abc", hint: null }],
+      })) as unknown as Dispatcher["query"],
+    });
+
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    await waitFor(() => screen.getByText("sk_***abc"));
+    const input = screen.getByTestId("secret-input-stripe-api-key") as HTMLInputElement;
+    expect(input.value).toBe("");
+  });
+
+  test("submitting with no input dispatches nothing", async () => {
+    const batchSpy = mock(async (_commands: ReadonlyArray<{ type: string; payload: unknown }>) => ({
+      isSuccess: true as const,
+      results: [],
+    }));
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({ isSuccess: true, data: [] })) as unknown as Dispatcher["query"],
+      batch: batchSpy as unknown as Dispatcher["batch"],
+    });
+
+    const user = userEvent.setup();
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    await user.click(screen.getByTestId("secrets-edit-submit"));
+    expect(batchSpy).not.toHaveBeenCalled();
+  });
+
+  test("typing a value and saving dispatches exactly one secrets:write:set with the plaintext, never the redacted preview", async () => {
+    const batchSpy = mock(async (_commands: ReadonlyArray<{ type: string; payload: unknown }>) => ({
+      isSuccess: true as const,
+      results: [],
+    }));
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({
+        isSuccess: true,
+        data: [{ key: "stripe:secret:api-key", redactedPreview: "sk_***abc", hint: null }],
+      })) as unknown as Dispatcher["query"],
+      batch: batchSpy as unknown as Dispatcher["batch"],
+    });
+
+    const user = userEvent.setup();
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    const input = screen.getByTestId("secret-input-stripe-api-key");
+    await user.type(input, "sk_live_newvalue");
+    await user.click(screen.getByTestId("secrets-edit-submit"));
+
+    await waitFor(() => expect(batchSpy).toHaveBeenCalledTimes(1));
+    const commands = batchSpy.mock.calls[0]?.[0];
+    if (!commands) throw new Error("batchSpy not called");
+    expect(commands).toEqual([
+      {
+        type: "secrets:write:set",
+        payload: { key: "stripe:secret:api-key", value: "sk_live_newvalue" },
+      },
+    ]);
+    // The security invariant this test exists for: the preview never rides
+    // along in a write payload next to the plaintext.
+    expect(JSON.stringify(commands)).not.toContain("sk_***abc");
+  });
+
+  test("an unset required secret shows the required marker; a set one does not", async () => {
+    const requiredScreen: SecretsEditScreenDefinition = {
+      ...secretsScreen,
+      requiredFields: ["stripe-api-key"],
+    };
+    const requiredSchema: FeatureSchema = {
+      featureName: "config",
+      entities: {},
+      screens: [requiredScreen],
+    };
+
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({ isSuccess: true, data: [] })) as unknown as Dispatcher["query"],
+    });
+
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={requiredSchema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    await waitFor(() => screen.getByTestId("required-marker-stripe-api-key"));
+  });
+
+  test("a set required secret does not show the required marker", async () => {
+    const requiredScreen: SecretsEditScreenDefinition = {
+      ...secretsScreen,
+      requiredFields: ["stripe-api-key"],
+    };
+    const requiredSchema: FeatureSchema = {
+      featureName: "config",
+      entities: {},
+      screens: [requiredScreen],
+    };
+    const qualifiedKey = requiredScreen.secretKeys["stripe-api-key"];
+
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({
+        isSuccess: true,
+        data: [{ key: qualifiedKey, redactedPreview: "sk_***abc", hint: null }],
+      })) as unknown as Dispatcher["query"],
+    });
+
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={requiredSchema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    await waitFor(() => screen.getByText("sk_***abc"));
+    expect(screen.queryByTestId("required-marker-stripe-api-key")).toBeNull();
+  });
+
+  test("an unset required secret does not block saving a different secret", async () => {
+    const twoFieldScreen: SecretsEditScreenDefinition = {
+      id: "secrets",
+      type: "secretsEdit",
+      secretKeys: {
+        "stripe-api-key": "stripe:secret:[REDACTED:API key param]",
+        "webhook-secret": "stripe:secret:[REDACTED:webhook param]",
+      },
+      fieldLabels: {
+        "stripe-api-key": "config.secret.stripe.api-key.label",
+        "webhook-secret": "config.secret.stripe.webhook.label",
+      },
+      sections: [{ fields: ["stripe-api-key", "webhook-secret"] }],
+      requiredFields: ["stripe-api-key"],
+    };
+    const twoFieldSchema: FeatureSchema = {
+      featureName: "config",
+      entities: {},
+      screens: [twoFieldScreen],
+    };
+    const batchSpy = mock(async (_commands: ReadonlyArray<{ type: string; payload: unknown }>) => ({
+      isSuccess: true as const,
+      results: [],
+    }));
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({ isSuccess: true, data: [] })) as unknown as Dispatcher["query"],
+      batch: batchSpy as unknown as Dispatcher["batch"],
+    });
+
+    const user = userEvent.setup();
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={twoFieldSchema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    const requiredInput = screen.getByTestId("secret-input-stripe-api-key") as HTMLInputElement;
+    expect(requiredInput.required).toBe(false);
+
+    await user.type(screen.getByTestId("secret-input-webhook-secret"), "whsec_newvalue");
+    await user.click(screen.getByTestId("secrets-edit-submit"));
+
+    await waitFor(() => expect(batchSpy).toHaveBeenCalledTimes(1));
+    const commands = batchSpy.mock.calls[0]?.[0];
+    if (!commands) throw new Error("batchSpy not called");
+    expect(commands).toEqual([
+      {
+        type: "secrets:write:set",
+        payload: { key: "stripe:secret:[REDACTED:webhook param]", value: "whsec_newvalue" },
+      },
+    ]);
+  });
+
+  test("delete dispatches secrets:write:delete with the qualified key", async () => {
+    const writeSpy = mock(async (_type: string, _payload: unknown) => ({
+      isSuccess: true as const,
+      data: {},
+    }));
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({
+        isSuccess: true,
+        data: [{ key: "stripe:secret:api-key", redactedPreview: "sk_***abc", hint: null }],
+      })) as unknown as Dispatcher["query"],
+      write: writeSpy as unknown as Dispatcher["write"],
+    });
+
+    const user = userEvent.setup();
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    await user.click(screen.getByTestId("secret-delete-stripe-api-key"));
+
+    await waitFor(() => expect(writeSpy).toHaveBeenCalledTimes(1));
+    expect(writeSpy).toHaveBeenCalledWith("secrets:write:delete", { key: "stripe:secret:api-key" });
+  });
+
+  test("a failed save shows the error and never renders the typed plaintext", async () => {
+    const plaintext = "sk_live_wouldbeleakedifechoed";
+    const serverError: DispatcherError = {
+      code: "TENANT_SECRET_WRITE_CONFLICT",
+      httpStatus: 409,
+      i18nKey: "secrets:errors.writeConflict",
+      message: "Could not save secret: a concurrent update conflicted, please retry.",
+    };
+    const batchSpy = mock(async (_commands: ReadonlyArray<{ type: string; payload: unknown }>) => ({
+      isSuccess: false as const,
+      error: serverError,
+    }));
+    const dispatcher: Dispatcher = createMockDispatcher({
+      query: (async () => ({ isSuccess: true, data: [] })) as unknown as Dispatcher["query"],
+      batch: batchSpy as unknown as Dispatcher["batch"],
+    });
+
+    const user = userEvent.setup();
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="config:screen:secrets" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => screen.getByTestId("secrets-edit-form"));
+    const input = screen.getByTestId("secret-input-stripe-api-key");
+    await user.type(input, plaintext);
+    await user.click(screen.getByTestId("secrets-edit-submit"));
+
+    await waitFor(() => screen.getByTestId("secrets-edit-error"));
+    expect(screen.getByTestId("secrets-edit-error").textContent).toContain(serverError.message);
+    // The drafted plaintext must never leak into the error surface (or
+    // anywhere else in the DOM besides the input's own `value`).
+    expect(document.body.textContent).not.toContain(plaintext);
+  });
+});