@cosmicdrift/kumiko-server-runtime 0.163.3 → 0.165.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.163.3",
+  "version": "0.165.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.163.3",
-    "@cosmicdrift/kumiko-framework": "0.163.3",
+    "@cosmicdrift/kumiko-bundled-features": "0.165.0",
+    "@cosmicdrift/kumiko-framework": "0.165.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/build-prod-bundle.inprocess.test.ts

@@ -5,12 +5,10 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { existsSync } from "node:fs";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join, resolve } from "node:path";
 import { buildProdBundle } from "../build-prod-bundle";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = resolve(__dirname, "../../../..");
+const REPO_ROOT = resolve(import.meta.dir, "../../../..");
 
 describe("buildProdBundle in-process (Bun.build)", () => {
   let tmp = "";

package/src/__tests__/compose-features.test.ts

@@ -87,6 +87,11 @@ describe("composeFeatures", () => {
     });
     const toggle = features.find((f) => f.name === "auth-self-registration");
     expect(toggle).toBeDefined();
+    // The security-relevant part isn't that the feature is mounted, it's
+    // that self-signup defaults ON — a flip to `default: false` upstream
+    // would silently no-op signup (always-200 anti-enumeration masks it)
+    // while this assertion alone (toBeDefined) stayed green.
+    expect(toggle?.toggleableDefault).toBe(true);
   });
 
   test("no authOptions.signup → auth-self-registration NOT mounted", () => {
@@ -94,6 +99,16 @@ describe("composeFeatures", () => {
     expect(features.map((f) => f.name)).not.toContain("auth-self-registration");
   });
 
+  test("authOptions.signup + app also mounts its own auth-self-registration stub → deduped to exactly one", () => {
+    const pickerSelfRegDupe = defineFeature("auth-self-registration", () => {});
+    const features = composeFeatures([noopFeature, pickerSelfRegDupe], {
+      includeBundled: true,
+      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
+    });
+    const names = features.map((f) => f.name).filter((n) => n === "auth-self-registration");
+    expect(names).toEqual(["auth-self-registration"]);
+  });
+
   test("OHNE authOptions → KEINE reset/verify-handlers (anti-default-deploy-bug)", () => {
     // Genau der Bug der vom Review-Agent gefangen wurde: composeFeatures
     // ohne authOptions registriert die handler nicht. Wenn jemand das

package/src/__tests__/run-prod-app-static-files.test.ts

@@ -1,7 +1,7 @@
 // Unit coverage for mimeTypeFor + hostDispatch edge in buildStaticFallback.
 
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
@@ -57,6 +57,12 @@ describe("readStaticFile / serveDiskFile", () => {
     expect(await readStaticFile(join(tmp, "missing.css"))).toBeUndefined();
   });
 
+  test("readStaticFile on a directory → undefined (EISDIR), not a throw", async () => {
+    const dirPath = join(tmp, "sub");
+    await mkdir(dirPath);
+    expect(await readStaticFile(dirPath)).toBeUndefined();
+  });
+
   test("serveDiskFile sets content-type from mime", async () => {
     const path = join(tmp, "a.svg");
     await writeFile(path, "<svg/>");
@@ -126,6 +132,15 @@ describe("buildStaticFallback hostDispatch", () => {
     expect(await res.text()).toBe("PNGDATA");
   });
 
+  test("a request for a directory copied verbatim from public/ falls back to index.html instead of 500ing", async () => {
+    await mkdir(join(tmp, "sub"));
+    await writeFile(join(tmp, "index.html"), "<!doctype html><html><body>spa-shell</body></html>");
+    const handler = buildStaticFallback(() => new Response("404", { status: 404 }), tmp, "{}");
+    const res = await handler(new Request("http://t/sub"));
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain("spa-shell");
+  });
+
   test("hostDispatch html with CSP + Vary: Host", async () => {
     await writeFile(join(tmp, "tenant.html"), "<!doctype html><html><body>ok</body></html>");
     const handler = buildStaticFallback(

package/src/__tests__/run-prod-app.integration.test.ts

@@ -836,8 +836,8 @@ describe("runProdApp — auth allowedOrigins forwarding", () => {
 
   test("cookieDomain + allowedOrigins clears the guard — allowlist reaches buildServer", async () => {
     // Without the forwarding fix this would ALSO throw /allowedOrigins is empty/.
-    // It may still fail later on the minimal harness (no auth tables migrated),
-    // but never on the origin guard — that is the forwarding proof.
+    // auth tables are migrated for this file (migrateTestDb() above); this test
+    // isolates only that a later boot failure is never the origin-guard message.
     let bootError: unknown;
     try {
       const handle = await boot(undefined, {

package/src/compose-features.ts

@@ -1,15 +1,17 @@
-// composeFeatures — single source of truth für die Feature-Liste die
-// Boot UND Schema-Generator sehen.
+// composeFeatures — single source of truth for the feature list that
+// boot AND the schema generator see.
 //
-// Sowohl runDevApp als auch runProdApp mischen im auth-mode dieselben
-// vier Bundled-Features dazu (config + user + tenant + auth-email-pw).
-// Damit der drizzle-Schema-Generator pro App genau dieselbe Feature-
-// Liste sieht wie die Runtime, leben die Komposition hier — beide
-// Bootstrap-Wrapper UND der per-app drizzle/generate.ts rufen sie auf.
+// Both runDevApp and runProdApp mix in the same bundled features in
+// auth-mode (config + user + tenant + auth-email-password, plus
+// auth-self-registration when authOptions.signup is set). So the
+// drizzle schema generator sees the exact same feature list per app as
+// the runtime, the composition lives here — both bootstrap wrappers AND
+// each app's drizzle/generate.ts call it.
 //
-// Reihenfolge: Infrastruktur-Features (config/user/tenant) zuerst, dann
-// auth-email-password, dann die App-Features. Spätere Features dürfen
-// auf Frühere referenzieren (z.B. authClaims-Hooks an user/tenant).
+// Order: infrastructure features (config/user/tenant) first, then
+// auth-email-password (+ auth-self-registration when authOptions.signup
+// is set), then the app features. Later features may reference earlier
+// ones (e.g. authClaims hooks on user/tenant).
 
 import {
   type AccountUnlockOptions,
@@ -33,7 +35,8 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 
 export type ComposeFeaturesOptions = {
   /** When true, prepends config + user + tenant + auth-email-password
-   *  before the app features. Mirror of "auth-mode" in run{Dev,Prod}App. */
+   *  (+ auth-self-registration when authOptions.signup is set) before the
+   *  app features. Mirror of "auth-mode" in run{Dev,Prod}App. */
   readonly includeBundled: boolean;
   /** Optional auth-feature-options durchgereicht an
    *  createAuthEmailPasswordFeature. Wenn passwordReset / emailVerification

package/src/run-prod-app-static-files.ts

@@ -43,7 +43,12 @@ export async function readStaticFile(
     const [bytes, fileStat] = await Promise.all([readFile(filePath), stat(filePath)]);
     return { bytes, mime: mimeTypeFor(filePath), mtimeMs: fileStat.mtimeMs };
   } catch (err) {
-    if ((err as { code?: string }).code === "ENOENT") return undefined;
+    const code = (err as { code?: string }).code;
+    // ENOENT: no such path. EISDIR: readFile() on a directory (e.g. GET
+    // /assets where "assets" is a subfolder copied verbatim from public/)
+    // — both mean "not a servable file", so fall through to the SPA
+    // fallback instead of a 500.
+    if (code === "ENOENT" || code === "EISDIR") return undefined;
     throw err;
   }
 }