@cosmicdrift/kumiko-samples 0.400.0 → 0.402.0

package/packages/bundled-features/src/template-resolver/index.ts

@@ -160,6 +160,7 @@ export {
   DocumentVariable,
   documentExtensions,
   isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,

package/packages/bundled-features/src/template-resolver/web/document-schema.ts

@@ -45,15 +45,32 @@ function hasAllowedLinkScheme(href: string): boolean {
   return ALLOWED_LINK_SCHEMES.some((scheme) => href.startsWith(scheme));
 }
 
+// Relative references are matched by their literal leading character so a
+// scheme can never hide in them: a value starting with a letter ("x:y",
+// "javascript:") is not relative. Protocol-relative "//host" and any backslash
+// (browsers read "/\\host" as "//host") would leave the site.
+const RELATIVE_HREF_PREFIXES = ["/", "./", "../", "#", "?"] as const;
+
+function isRelativeHref(href: string): boolean {
+  if (href.includes("\\") || href.startsWith("//")) return false;
+  return RELATIVE_HREF_PREFIXES.some((prefix) => href.startsWith(prefix));
+}
+
 // Exact lowercase prefix on the unchanged value: no trim, no case folding, so
 // "JaVaScRiPt:", "HTTPS://" or a leading tab can never slip through as a
 // scheme variant. Markup and control characters are refused outright because
 // downstream parsers (MJML, PDF renderer) re-read the serialized attribute.
-export function isAllowedDocumentLinkHref(href: string): boolean {
+export function isAllowedDocumentUrlHref(href: string): boolean {
   if (hasUnsafeUrlCharacter(href)) return false;
   return hasAllowedLinkScheme(href) || isDocumentPlaceholderHref(href);
 }
 
+// Anchors only: other URL attributes (form action, svg href) resolve against the
+// page and must stay on explicit schemes or placeholders.
+export function isAllowedDocumentLinkHref(href: string): boolean {
+  return isAllowedDocumentUrlHref(href) || (!hasUnsafeUrlCharacter(href) && isRelativeHref(href));
+}
+
 export function isDocumentResourceKey(value: string): boolean {
   return RESOURCE_KEY.test(value);
 }

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -22,7 +22,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
     "template-resolver.documentEditor.invalidImageAlt": "The alt text must not contain < or >.",
     "template-resolver.documentEditor.invalidLink":
-      "This link target is not allowed. Use https, http, mailto, tel or a placeholder.",
+      "This link target is not allowed. Use https, http, mailto, tel, a relative path or a placeholder.",
     "template-resolver.documentEditor.invalidResourceKey": "This resource key is not valid.",
     "template-resolver.documentEditor.link": "Link",
     "template-resolver.documentEditor.linkHref": "Link target",
@@ -64,7 +64,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.document.buttonHrefNotPlaceholder":
       "The button target “{detail}” must be a placeholder.",
     "templateResolver.errors.document.disallowedLinkHref":
-      "Link target “{detail}” is not allowed; use https, http, mailto, tel or a placeholder.",
+      "Link target “{detail}” is not allowed; use https, http, mailto, tel, a relative path or a placeholder.",
     "templateResolver.errors.document.documentRequiresHtmlFormat":
       "This template kind requires the html format, got “{detail}”.",
     "templateResolver.errors.document.layoutRequiresMjmlFormat":

package/packages/bundled-features/src/template-resolver/web/use-collection-entry-create.ts

@@ -36,9 +36,11 @@ export function useCollectionEntryCreate(target: TargetRef, tenantId: string | u
 
   const slugValid = slug.length <= SLUG_MAX_LENGTH && SLUG_PATTERN.test(slug);
   const disabled = submitting || !canWrite || collectionId === undefined;
-  const headerTitle = t("template-resolver.editor.newEntryTitle", {
-    label: collection !== undefined ? t(collection.nav.label) : "",
-  });
+  const entryLabel = collection?.nav.entryLabel;
+  const headerTitle =
+    entryLabel !== undefined
+      ? t("template-resolver.editor.newEntryTitle", { label: t(entryLabel) })
+      : t("template-resolver.editor.newEntry");
 
   const create = async (): Promise<void> => {
     // skip: nothing to write to, or the slug is invalid (the field already shows the issue)

package/packages/bundled-features/src/user-data-rights/boot-checks.ts

@@ -1,9 +1,12 @@
 import {
+  bootRuleError,
+  collectBootRuleViolations,
   EXT_USER_DATA,
   type FeatureDefinition,
   type ResolvedPiiFlags,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.ts";
+import { USER_DATA_RIGHTS_BOOT_RULES } from "./boot-rules.ts";
 
 // V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
 // export hook without a matching delete hook exports data under Art.20 but
@@ -19,25 +22,27 @@ import { entitiesOf } from "../shared/index.ts";
 // fails otherwise); running this from user-data-rights' own bootCheck is
 // equivalent to the framework-internal call it replaces.
 export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_USER_DATA) continue;
-      const hasExport = typeof usage.options?.["export"] === "function";
-      const hasDelete = typeof usage.options?.["delete"] === "function";
-      // The compile-time "at least one hook" type is bypassed by string-typed
-      // extension names and casts; without this an empty bag registers nothing.
-      if (!hasExport && !hasDelete) {
-        throw new Error(
-          `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
-        );
-      }
-      if (hasExport && !hasDelete) {
-        throw new Error(
-          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
-        );
-      }
+  const usages = features.flatMap((feature) =>
+    feature.extensionUsages
+      .filter((usage) => usage.extensionName === EXT_USER_DATA)
+      .map((usage) => ({ feature, usage })),
+  );
+  collectBootRuleViolations(usages, ({ feature, usage }) => {
+    const hasExport = typeof usage.options?.["export"] === "function";
+    const hasDelete = typeof usage.options?.["delete"] === "function";
+    // The compile-time "at least one hook" type is bypassed by string-typed
+    // extension names and casts; without this an empty bag registers nothing.
+    if (!hasExport && !hasDelete) {
+      throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.emptyHook, {
+        message: `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
+      });
     }
-  }
+    if (hasExport && !hasDelete) {
+      throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.exportWithoutDelete, {
+        message: `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+      });
+    }
+  });
 }
 
 // V3: PII-entity-without-hook gate. V2 checks registered hooks for
@@ -60,19 +65,22 @@ export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition
     }
   }
 
-  for (const feature of features) {
-    for (const [entityName, entity] of entitiesOf(feature)) {
-      if (hookedEntities.has(entityName)) continue;
-      const subjectFields = Object.entries(entity.fields)
-        .filter(([, field]) => {
-          const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
-          return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
-        })
-        .map(([name]) => name);
-      if (subjectFields.length === 0) continue;
-      throw new Error(
-        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
-      );
-    }
-  }
+  const entities = features.flatMap((feature) =>
+    [...entitiesOf(feature)].map(([entityName, entity]) => ({ feature, entityName, entity })),
+  );
+  collectBootRuleViolations(entities, ({ feature, entityName, entity }) => {
+    // skip: an entity with a registered hook is covered
+    if (hookedEntities.has(entityName)) return;
+    const subjectFields = Object.entries(entity.fields)
+      .filter(([, field]) => {
+        const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
+        return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
+      })
+      .map(([name]) => name);
+    // skip: an entity without user-subject fields stays out of the pipeline by design
+    if (subjectFields.length === 0) return;
+    throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.missingHook, {
+      message: `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+    });
+  });
 }

package/packages/bundled-features/src/user-data-rights/boot-rules.ts

@@ -0,0 +1,19 @@
+import type { BootRuleTable } from "@cosmicdrift/kumiko-framework/engine";
+
+export const USER_DATA_RIGHTS_BOOT_RULES = {
+  emptyHook: {
+    id: "user-data-rights/empty-hook",
+    summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.",
+    fix: "Register at least one hook.",
+  },
+  exportWithoutDelete: {
+    id: "user-data-rights/export-without-delete",
+    summary: "An entity exported via EXT_USER_DATA also registers a delete hook.",
+    fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.",
+  },
+  missingHook: {
+    id: "user-data-rights/missing-hook",
+    summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.",
+    fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.",
+  },
+} as const satisfies BootRuleTable;

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "user-data-rights boot checks report rule ids",
+    "detail": "The bootChecks of user-data-rights report `user-data-rights/empty-hook`, `user-data-rights/export-without-delete` and `user-data-rights/missing-hook` with a fix, and list every missing or empty hook of a run instead of stopping at the first. Message texts are unchanged."
+  },
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "request-deletion-screen shows one deletion card",
+    "detail": "The request form no longer draws its own card inside the screen's card, so the screen shows one deletion card."
+  },
   {
     "version": "0.390.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/web/i18n.ts

@@ -21,6 +21,10 @@ export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> =
   },
   "user-data-rights:entity:export-job:field:userId": { en: "User" },
   "user-data-rights:entity:export-job:field:status": { en: "Status" },
+  "user-data-rights:entity:export-job:field:status:option:pending": { en: "Pending" },
+  "user-data-rights:entity:export-job:field:status:option:running": { en: "Running" },
+  "user-data-rights:entity:export-job:field:status:option:done": { en: "Done" },
+  "user-data-rights:entity:export-job:field:status:option:failed": { en: "Failed" },
   "user-data-rights:entity:export-job:field:requestedAt": { en: "Requested" },
   "user-data-rights:entity:export-job:field:completedAt": { en: "Completed" },
   "user-data-rights:entity:export-job:field:expiresAt": { en: "Expires" },

package/packages/bundled-features/src/user-data-rights/web/request-deletion-screen.tsx

@@ -77,24 +77,26 @@ export function RequestAccountDeletionScreen({
           <p className="text-sm text-muted-foreground">
             {t("userDataRights.deletion.request.intro")}
           </p>
-          <Form onSubmit={onSubmit}>
-            <Field id="delete-email" label={t("userDataRights.deletion.request.email")} required>
-              <Input
-                kind="text"
-                id="delete-email"
-                name="delete-email"
-                value={email}
-                onChange={setEmail}
-                disabled={submitting}
-                required
-              />
-            </Field>
-            {error !== null && <Banner variant="error">{error}</Banner>}
-            <Button type="submit" loading={submitting} disabled={submitting}>
-              {submitting
-                ? t("userDataRights.deletion.request.submitting")
-                : t("userDataRights.deletion.request.submit")}
-            </Button>
+          <Form chromeless onSubmit={onSubmit}>
+            <div className="flex flex-col gap-4">
+              <Field id="delete-email" label={t("userDataRights.deletion.request.email")} required>
+                <Input
+                  kind="text"
+                  id="delete-email"
+                  name="delete-email"
+                  value={email}
+                  onChange={setEmail}
+                  disabled={submitting}
+                  required
+                />
+              </Field>
+              {error !== null && <Banner variant="error">{error}</Banner>}
+              <Button type="submit" loading={submitting} disabled={submitting}>
+                {submitting
+                  ? t("userDataRights.deletion.request.submitting")
+                  : t("userDataRights.deletion.request.submit")}
+              </Button>
+            </div>
           </Form>
         </div>
       )}

package/samples/apps/use-all-bundled/src/app/collection-labels-feature.ts

@@ -1,6 +1,6 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
-// Nav labels for the two content collections this app mounts. Collection ids
+// Nav and entry labels for the two content collections this app mounts. Collection ids
 // are the app's choice, so their labels are too — a bundled feature cannot ship
 // a translation key for a collection it never named. Every app that declares a
 // collection carries its labels the same way.
@@ -9,7 +9,9 @@ export const collectionLabelsFeature = defineFeature("collection-labels", (r) =>
   r.translations({
     keys: {
       "templateResolver:nav.snippets": { de: "Bausteine", en: "Snippets" },
+      "templateResolver:nav.snippet": { de: "Baustein", en: "Snippet" },
       "templateResolver:nav.signatures": { de: "Signaturen", en: "Signatures" },
+      "templateResolver:nav.signature": { de: "Signatur", en: "Signature" },
     },
   });
   return {};

package/samples/apps/use-all-bundled/src/run-config.ts

@@ -315,6 +315,7 @@ export const APP_FEATURES = [
         // shells and the collection is unreachable in the UI.
         nav: {
           label: "templateResolver:nav.snippets",
+          entryLabel: "templateResolver:nav.snippet",
           workspaces: ["admin-shell:workspace:platform"],
         },
         // document + variableSchema so the smoke app renders the WYSIWYG with
@@ -334,6 +335,7 @@ export const APP_FEATURES = [
         access: { roles: ["TenantAdmin", "TenantMember", "SystemAdmin"] },
         nav: {
           label: "templateResolver:nav.signatures",
+          entryLabel: "templateResolver:nav.signature",
           workspaces: ["admin-shell:workspace:platform"],
         },
         contentFormat: "document",

package/samples/recipes/relations/src/feature.ts

@@ -1,5 +1,10 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createReferenceField,
+  createTextField,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
 
 export const teamEntity = createEntity({
   table: "read_sample_teams",
@@ -12,7 +17,12 @@ export const memberEntity = createEntity({
   table: "read_sample_members",
   fields: {
     name: createTextField({ personal: { of: "id" }, find: "none", required: true }),
-    teamId: createTextField({ personal: false, reason: "is_system_identifier", required: true }),
+    teamId: createReferenceField({
+      entity: "team",
+      personal: false,
+      reason: "is_system_identifier",
+      required: true,
+    }),
     role: createTextField({ personal: false, reason: "is_business_data" }),
   },
 });
@@ -21,7 +31,7 @@ export const taskEntity = createEntity({
   table: "read_sample_member_tasks",
   fields: {
     title: createTextField({ personal: false, reason: "is_business_data", required: true }),
-    memberId: createTextField({ personal: "ref", required: true }),
+    memberId: createReferenceField({ entity: "member", personal: "ref", required: true }),
   },
 });