@cosmicdrift/kumiko-samples 0.383.1 → 0.385.0

package/packages/bundled-features/src/audit/web/i18n.ts

@@ -24,8 +24,55 @@ export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
   "audit.log.col.tenant": { en: "Tenant" },
   "audit.log.col.when": { en: "When" },
   "audit.log.col.type": { en: "Event" },
-  "audit.log.col.aggregateType": { en: "Aggregate type" },
   "audit.log.col.aggregateId": { en: "Aggregate ID" },
+  "audit.log.col.aggregateType": { en: "Object" },
+  "audit.log.event": { en: "{entity} {action}" },
+  "audit.log.action.created": { en: "created" },
+  "audit.log.action.updated": { en: "updated" },
+  "audit.log.action.deleted": { en: "deleted" },
+  "audit.log.action.restored": { en: "restored" },
+  "audit.log.facet.technical": { en: "Technical entries" },
+  "audit.log.facet.technical.include": { en: "Show technical entries" },
+  "audit.log.event.custom-field-set": { en: "Custom field value set" },
+  "audit.log.event.custom-field-cleared": { en: "Custom field value cleared" },
+  "audit.log.event.field-definition-deleted": { en: "Custom field deleted" },
+  "audit.log.event.secret-read": { en: "Secret read" },
+  "audit.log.event.session-revoked": { en: "Session ended" },
+  "audit.log.event.subject-forgotten": { en: "Person forgotten (data erased)" },
+  "audit.log.event.forget-denied": { en: "Erasure request denied" },
+  "audit.log.event.pat-revoked": { en: "Access token revoked" },
+  "audit.log.event.mail-account-connected": { en: "Mail account connected" },
+  "audit.log.event.mail-account-updated": { en: "Mail account updated" },
+  "audit.log.event.mail-account-disconnected": { en: "Mail account disconnected" },
+  "audit.log.event.subscription-created": { en: "Subscription created" },
+  "audit.log.event.subscription-updated": { en: "Subscription updated" },
+  "audit.log.event.subscription-canceled": { en: "Subscription canceled" },
+  "audit.log.event.invoice-paid": { en: "Invoice paid" },
+  "audit.log.event.invoice-payment-failed": { en: "Invoice payment failed" },
+  "audit.log.event.payment-received": { en: "Payment received" },
+  "audit.log.event.checkout-consent-recorded": { en: "Checkout consent recorded" },
+  "audit.log.event.contract-confirmation-issued": { en: "Contract confirmation issued" },
+  "audit.log.event.contract-termination-revoked": { en: "Contract termination revoked" },
+  "audit.log.event.destruction-requested": { en: "Tenant deletion requested" },
+  "audit.log.event.destruction-cancelled": { en: "Tenant deletion cancelled" },
+  "audit.log.event.tenant-destruction-started": { en: "Tenant deletion started" },
+  "audit.log.event.tenant-destruction-completed": { en: "Tenant deletion completed" },
+  "audit.log.event.tenant-destruction-failed": { en: "Tenant deletion failed" },
+  "audit.log.event.tenant-handover-claimed": { en: "Tenant handover claimed" },
+  "audit.log.event.waitlist-exported": { en: "Waitlist exported" },
+  "audit.log.event.waitlist-purged": { en: "Waitlist purged" },
+  "audit.log.event.feature-toggle-set": { en: "Feature toggle changed" },
+  "audit.log.event.contract-termination-requested": { en: "Contract termination requested" },
+  "audit.log.event.contract-termination-declared": { en: "Contract termination declared" },
+  "audit.log.event.contract-termination-unmatched": { en: "Contract termination not matched" },
+  "audit.log.entity.tenant": { en: "Tenant" },
+  "audit.log.entity.tenant-membership": { en: "Membership" },
+  "audit.log.entity.tenant-invitation": { en: "Invitation" },
+  "audit.log.entity.user": { en: "User" },
+  "audit.log.entity.folder": { en: "Folder" },
+  "audit.log.entity.folder-assignment": { en: "Folder assignment" },
+  "audit.log.entity.field-definition": { en: "Custom field" },
+  "audit.log.entity.template-resource": { en: "Template" },
   "audit.log.col.actor": { en: "Actor" },
   "audit.log.details": { en: "Details" },
   "audit.log.detail.payload": { en: "Event payload" },

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.385.0",
+    "type": "improvement",
+    "title": "Denser common-password list, comments name postgres-js as the only driver",
+    "detail": "The common-password list is wrapped densely and split on whitespace; a test pins its 2086 entries. Comments across the bundled features that referred to the removed Bun.SQL driver now name postgres-js. No behavior change."
+  },
+  {
+    "version": "0.384.0",
+    "type": "improvement",
+    "title": "Forgot-password and account-unlock work without app wiring",
+    "detail": "With auth.mail and SMTP configured, runProdApp and runDevApp now also wire the account-unlock flow (POST /api/auth/request-account-unlock and /api/auth/confirm-account-unlock, mail link to /unlock-account) because the login lockout is always on. emailPasswordClient serves ForgotPasswordScreen, ResetPasswordScreen (with token) and the unlock screens at /forgot-password, /reset-password and /unlock-account; gates registered earlier by the app win, and defaultAuthPages: false turns it off. LoginScreen reads the new anonymous login-options query and shows the forgot and unlock links when the flows exist; explicit forgotPasswordHref and unlockAccountHref still win and null hides a link. The query needs anonymousAccess on the app, otherwise no link appears."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -14,6 +14,7 @@ import {
 import { inviteInfoQuery } from "./handlers/invite-info.query.ts";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.ts";
 import { createLoginHandler, type LoginHandlerOptions } from "./handlers/login.write.ts";
+import { loginOptionsQuery } from "./handlers/login-options.query.ts";
 import { logoutWrite } from "./handlers/logout.write.ts";
 import {
   createRequestAccountUnlockHandler,
@@ -197,8 +198,7 @@ export function createAuthEmailPasswordFeature(
         { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
       ],
     });
-    r.requires({ features: ["user"] });
-    r.requires({ features: ["tenant"] });
+    r.requires({ features: ["user", "tenant"] });
     // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
     // via ctx.notify → delivery must be mounted. Fail closed at boot instead
     // of silently dropping the mail.
@@ -256,6 +256,7 @@ export function createAuthEmailPasswordFeature(
     }
 
     const queries = {
+      loginOptions: r.queryHandler(loginOptionsQuery),
       ...(opts.signup && {
         signupRegistrationStatus: r.queryHandler(selfRegistrationStatusQuery),
       }),

package/packages/bundled-features/src/auth-email-password/handlers/login-options.query.ts

@@ -0,0 +1,19 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { AuthHandlers } from "../web/constants.ts";
+
+// Anonymous-readable so the (unauthenticated) login screen can show the
+// forgot-password and unlock links only when the matching mail flows are
+// actually mounted, without every app having to pass hrefs by hand.
+export const loginOptionsQuery = defineQueryHandler({
+  name: "login-options",
+  schema: z.object({}),
+  access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
+  description:
+    "Reports which optional login-page flows (password reset, account unlock) are available, readable without signing in, so the login screen links only to flows that exist.",
+  handler: async (_query, ctx) => ({
+    passwordReset: ctx.registry.getWriteHandler(AuthHandlers.requestPasswordReset) !== undefined,
+    accountUnlock: ctx.registry.getWriteHandler(AuthHandlers.requestAccountUnlock) !== undefined,
+  }),
+});

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -6,7 +6,6 @@
 // hashPassword/verifyPassword; removing it is a breaking change that needs
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.ts";
-export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.ts";
 export type {
   BootstrapConfigValue,
   BootstrapDeps,
@@ -54,6 +53,13 @@ export {
   SIGNUP_TOKEN_KEY_PREFIXES,
   storeSignupToken,
 } from "./signup-token-store.ts";
+export {
+  type AuthPath,
+  type AuthPaths,
+  DEFAULT_AUTH_PATHS,
+  DEFAULT_FORGOT_PASSWORD_PATH,
+  makeAuthPaths,
+} from "./web/auth-paths.ts";
 export {
   AUTH_EMAIL_PASSWORD_FEATURE,
   AuthErrors,