@cosmicdrift/kumiko-server-runtime 0.319.0 → 0.321.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.319.0",
+  "version": "0.321.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -62,10 +62,6 @@
       "types": "./src/extra-routes-deps.ts",
       "default": "./src/extra-routes-deps.ts"
     },
-    "./inject-schema": {
-      "types": "./src/inject-schema.ts",
-      "default": "./src/inject-schema.ts"
-    },
     "./resolve-tailwind-cli": {
       "types": "./src/resolve-tailwind-cli.ts",
       "default": "./src/resolve-tailwind-cli.ts"
@@ -80,9 +76,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.319.0",
-    "@cosmicdrift/kumiko-framework": "0.319.0",
-    "@cosmicdrift/kumiko-headless": "0.319.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.321.0",
+    "@cosmicdrift/kumiko-framework": "0.321.0",
+    "@cosmicdrift/kumiko-headless": "0.321.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/compose-features-wiring.integration.test.ts

@@ -27,6 +27,9 @@ import {
   AuthErrors,
   AuthHandlers,
   hashPassword,
+  signToken,
+  TokenPurpose,
+  verifyToken,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
 import {
   createChannelEmailFeature,
@@ -50,7 +53,9 @@ import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-featu
 import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
 import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
+import { LOCALE_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import {
   setupTestStack,
   type TestStack,
@@ -59,7 +64,13 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { deleteRows } from "@cosmicdrift/kumiko-framework/testing";
-import { composeFeatures } from "../compose-features";
+import { buildComposeAuthOptions, composeFeatures } from "../compose-features";
+import type { RunProdAppAuthOptions } from "../run-prod-app";
+import { resolveAuthMail } from "../run-prod-app-boot-context";
+
+// resolveMailLocale only recognizes locales with a registered mail bundle;
+// an empty bundle is enough to make "de" negotiable here.
+registerMailTranslations("de", {});
 
 const RESET_HMAC = randomBytes(32).toString("base64");
 const VERIFY_HMAC = randomBytes(32).toString("base64");
@@ -150,6 +161,79 @@ async function bootStack(
   return { stack, emailTransport };
 }
 
+// Boots via resolveAuthMail's `auth.mail` convenience with its own
+// hmacSecret, distinct from the resolveAuthMail call-site secret.
+async function bootMailConventionStack(
+  mailHmacSecret: string,
+  callSiteSecret = "unused-call-site-secret",
+): Promise<{ stack: TestStack; emailTransport: ReturnType<typeof createInMemoryTransport> }> {
+  const emailTransport = createInMemoryTransport();
+
+  const mailAuth = resolveAuthMail<RunProdAppAuthOptions>(
+    {
+      admin: {
+        email: "admin@example.com",
+        password: "pw-long-enough",
+        displayName: "Admin",
+        memberships: [],
+      },
+      mail: {
+        baseUrl: "https://app.example.com",
+        hmacSecret: mailHmacSecret,
+        paths: {
+          resetPassword: (locale) => (locale === "de" ? "/de/reset-password" : "/reset-password"),
+        },
+      },
+    },
+    callSiteSecret,
+    { SMTP_HOST: "localhost" },
+  );
+
+  const features = composeFeatures(
+    [
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+    ],
+    {
+      includeBundled: true,
+      authOptions: buildComposeAuthOptions(mailAuth),
+    },
+  );
+
+  const stack = await setupTestStack({
+    features,
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      passwordReset: {
+        requestHandler: AuthHandlers.requestPasswordReset,
+        confirmHandler: AuthHandlers.resetPassword,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+
+  return { stack, emailTransport };
+}
+
 async function seedUser(
   stack: TestStack,
   opts: { email: string; password: string },
@@ -449,3 +533,77 @@ describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
     expect(suite.emailTransport.sent).toHaveLength(0);
   });
 });
+
+describe("composeFeatures wiring — auth.mail convenience locale + secret", () => {
+  // mailHmacSecret and callSiteSecret are deliberately different values: a
+  // live reset roundtrip must validate against mailHmacSecret, not callSiteSecret.
+  const mailHmacSecret = randomBytes(32).toString("base64");
+  const callSiteSecret = randomBytes(32).toString("base64");
+  let suite: Awaited<ReturnType<typeof bootMailConventionStack>>;
+
+  beforeAll(async () => {
+    suite = await bootMailConventionStack(mailHmacSecret, callSiteSecret);
+  });
+
+  afterAll(async () => {
+    await suite.stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
+    suite.emailTransport.sent.length = 0;
+  });
+
+  test("X-Locale: de → reset link carries the localized path and its token is accepted", async () => {
+    await seedUser(suite.stack, { email: "greta@example.com", password: "old-password-1234" });
+
+    const res = await suite.stack.http.raw(
+      "POST",
+      "/api/auth/request-password-reset",
+      { email: "greta@example.com" },
+      { [LOCALE_HEADER_NAME]: "de" },
+    );
+    expect(res.status).toBe(200);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    const resetUrl = tokenUrlFromHtml(sent.html);
+    expect(resetUrl.pathname).toBe("/de/reset-password");
+    const token = resetUrl.searchParams.get("token");
+    if (!token) throw new Error("no token in mail link");
+    expect(verifyToken(token, TokenPurpose.passwordReset, mailHmacSecret).ok).toBe(true);
+    expect(verifyToken(token, TokenPurpose.passwordReset, callSiteSecret).ok).toBe(false);
+
+    const confirmRes = await suite.stack.http.raw("POST", "/api/auth/reset-password", {
+      token,
+      newPassword: "brand-new-pw-9876",
+    });
+    expect(confirmRes.status).toBe(200);
+  });
+
+  test("no X-Locale → reset link falls back to the default path", async () => {
+    await seedUser(suite.stack, { email: "henry@example.com", password: "old-password-1234" });
+
+    const res = await suite.stack.http.raw("POST", "/api/auth/request-password-reset", {
+      email: "henry@example.com",
+    });
+    expect(res.status).toBe(200);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(tokenUrlFromHtml(sent.html).pathname).toBe("/reset-password");
+  });
+
+  test("a token signed with the resolveAuthMail call-site secret is rejected", async () => {
+    const seeded = await seedUser(suite.stack, {
+      email: "ivy@example.com",
+      password: "old-password-1234",
+    });
+    const { token } = signToken(seeded.id, TokenPurpose.passwordReset, 15, callSiteSecret);
+
+    const res = await suite.stack.http.raw("POST", "/api/auth/reset-password", {
+      token,
+      newPassword: "should-not-stick-1234",
+    });
+    expect(res.status).toBe(422);
+  });
+});

package/src/__tests__/require-env.test.ts

@@ -5,9 +5,14 @@
 // missing local .env var.
 
 import { describe, expect, test } from "bun:test";
+import { requireEnv as requireEnvFromPackageExport } from "@cosmicdrift/kumiko-server-runtime";
 import { requireEnv } from "../run-prod-app";
 
 describe("requireEnv", () => {
+  test("is part of the package's public export, not just the internal run-prod-app module", () => {
+    expect(requireEnvFromPackageExport).toBe(requireEnv);
+  });
+
   test("default context (runProdApp) gives container/production advice", () => {
     expect(() => requireEnv("MISSING_VAR", {})).toThrow(/container env.*Coolify secrets/);
   });

package/src/__tests__/resolve-auth-mail.test.ts

@@ -66,4 +66,79 @@ describe("resolveAuthMail", () => {
     expect(out.passwordReset?.appUrl).toBe("https://app.example.com/pw");
     expect(out.emailVerification?.appUrl).toBe("https://app.example.com/verify-email");
   });
+
+  test("function path → locale-aware appUrl, still signed with the resolved hmacSecret", () => {
+    const localeAware: RunProdAppAuthOptions = {
+      admin,
+      mail: {
+        baseUrl: "https://app.example.com",
+        paths: {
+          resetPassword: (locale) => (locale === "de" ? "/de/reset-password" : "/reset-password"),
+        },
+      },
+    };
+    const out = resolveAuthMail(localeAware, "secret", { SMTP_HOST: "localhost" });
+    const appUrl = out.passwordReset?.appUrl;
+    if (typeof appUrl !== "function") throw new Error("expected a locale-aware appUrl function");
+    expect(appUrl("de")).toBe("https://app.example.com/de/reset-password");
+    expect(appUrl("en")).toBe("https://app.example.com/reset-password");
+    expect(out.passwordReset?.hmacSecret).toBe("secret");
+  });
+
+  test("mail.hmacSecret overrides the call-site secret for passwordReset and emailVerification", () => {
+    const dedicatedSecret: RunProdAppAuthOptions = {
+      admin,
+      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
+    };
+    const out = resolveAuthMail(dedicatedSecret, "jwt-secret", { SMTP_HOST: "localhost" });
+    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
+    expect(out.emailVerification?.hmacSecret).toBe("mail-only-secret");
+  });
+
+  test("no mail.hmacSecret → falls back to the call-site secret", () => {
+    const out = resolveAuthMail(withMail, "jwt-secret", { SMTP_HOST: "localhost" });
+    expect(out.passwordReset?.hmacSecret).toBe("jwt-secret");
+  });
+
+  test("explicit passwordReset/emailVerification without hmacSecret is backfilled from mail.hmacSecret", () => {
+    const explicitNoSecret: RunProdAppAuthOptions = {
+      admin,
+      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
+      passwordReset: { appUrl: "https://custom.example.com/pw" },
+      emailVerification: { appUrl: "https://custom.example.com/verify" },
+    };
+    const out = resolveAuthMail(explicitNoSecret, "jwt-secret", { SMTP_HOST: "localhost" });
+    expect(out.passwordReset?.appUrl).toBe("https://custom.example.com/pw");
+    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
+    expect(out.emailVerification?.hmacSecret).toBe("mail-only-secret");
+  });
+
+  test("explicit passwordReset with its own hmacSecret wins over mail.hmacSecret", () => {
+    const explicitOwnSecret: RunProdAppAuthOptions = {
+      admin,
+      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
+      passwordReset: { appUrl: "https://custom.example.com/pw", hmacSecret: "app-own-secret" },
+    };
+    const out = resolveAuthMail(explicitOwnSecret, "jwt-secret", { SMTP_HOST: "localhost" });
+    expect(out.passwordReset?.hmacSecret).toBe("app-own-secret");
+  });
+
+  test("explicit passwordReset without hmacSecret and no mail block falls back to the call-site secret", () => {
+    const explicitNoMail: RunProdAppAuthOptions = {
+      admin,
+      passwordReset: { appUrl: "https://custom.example.com/pw" },
+    };
+    const out = resolveAuthMail(explicitNoMail, "jwt-secret", {});
+    expect(out.passwordReset?.hmacSecret).toBe("jwt-secret");
+  });
+
+  test("explicit passwordReset without hmacSecret is still backfilled when SMTP_HOST is unset", () => {
+    const explicitNoSmtp: RunProdAppAuthOptions = {
+      admin,
+      mail: { baseUrl: "https://app.example.com", hmacSecret: "mail-only-secret" },
+      passwordReset: { appUrl: "https://custom.example.com/pw" },
+    };
+    const out = resolveAuthMail(explicitNoSmtp, "jwt-secret", {});
+    expect(out.passwordReset?.hmacSecret).toBe("mail-only-secret");
+  });
 });

package/src/__tests__/run-prod-app-spec.test.ts

@@ -6,6 +6,17 @@
 
 import { describe, expect, test } from "bun:test";
 import { SSE_HEARTBEAT_INTERVAL_MS } from "@cosmicdrift/kumiko-framework/api";
+import {
+  createEntity,
+  createFileField,
+  createRegistry,
+  defineFeature,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature, resolveMaxUploadBodyBytes } from "@cosmicdrift/kumiko-framework/files";
+import {
+  DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES,
+  resolveDerivedMaxRequestBodySize,
+} from "../bun-serve-options";
 import { buildBunServeOptions } from "../run-prod-app";
 
 describe("Bun.serve options for production", () => {
@@ -19,11 +30,53 @@ describe("Bun.serve options for production", () => {
     expect(opts.idleTimeout).toBe(0);
   });
 
-  test("port + fetch werden 1:1 durchgereicht", () => {
-    const fetchHandler = (_req: Request) => new Response("test");
+  test("port wird 1:1 durchgereicht, fetch reicht req + Socket-Adresse an den Handler weiter", async () => {
+    let received: [Request, string | undefined] | undefined;
+    const fetchHandler = (req: Request, socketAddress?: string) => {
+      received = [req, socketAddress];
+      return new Response("test");
+    };
     const opts = buildBunServeOptions(3000, fetchHandler);
     expect(opts.port).toBe(3000);
-    expect(opts.fetch).toBe(fetchHandler);
+    const req = new Request("http://localhost/");
+    const fakeServer = { requestIP: () => ({ address: "203.0.113.1", port: 1, family: "IPv4" }) };
+    await opts.fetch(req, fakeServer as unknown as Bun.Server<unknown>);
+    expect(received?.[0]).toBe(req);
+    expect(received?.[1]).toBe("203.0.113.1");
+  });
+
+  test("maxRequestBodySize defaults well below Bun's own 128 MiB", () => {
+    // Bun.serve's undocumented-in-our-code default (128 MiB) buffers every
+    // concurrent request up to that size before any app-level body-limit
+    // middleware runs. Pins the lowered default against a silent revert to
+    // "just let Bun handle it".
+    const opts = buildBunServeOptions(0, () => new Response("ok"));
+    expect(opts.maxRequestBodySize).toBe(DEFAULT_MAX_REQUEST_BODY_SIZE_BYTES);
+    expect(opts.maxRequestBodySize).toBeLessThan(128 * 1024 * 1024);
+  });
+
+  test("maxRequestBodySize is overridable for apps with larger maxUploadSize", () => {
+    const opts = buildBunServeOptions(0, () => new Response("ok"), 64 * 1024 * 1024);
+    expect(opts.maxRequestBodySize).toBe(64 * 1024 * 1024);
+  });
+});
+
+describe("resolveDerivedMaxRequestBodySize", () => {
+  test("stays above the files route's own derived bodyLimit", () => {
+    // Otherwise Bun's bare rejection would fire before the route's own,
+    // more specific 413 ever runs.
+    const registry = createRegistry([createFilesFeature({ maxUploadSize: "50mb" })]);
+    const routeBodyLimit = resolveMaxUploadBodyBytes({ registry, maxUploadSize: "50mb" });
+    expect(resolveDerivedMaxRequestBodySize(registry)).toBeGreaterThan(routeBodyLimit);
+  });
+
+  test("accounts for a field maxSize configured above the global default", () => {
+    const entity = createEntity({
+      fields: { attachment: createFileField({ maxSize: "50mb" }) },
+    });
+    const feature = defineFeature("attachments", (r) => r.entity("attachment", entity));
+    const registry = createRegistry([feature, createFilesFeature()]);
+    expect(resolveDerivedMaxRequestBodySize(registry)).toBeGreaterThanOrEqual(50 * 1024 * 1024);
   });
 });
 

package/src/__tests__/run-prod-app-static-files.test.ts

@@ -106,7 +106,6 @@ describe("buildStaticFallback hostDispatch", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "gone.html" }),
     );
     const res = await handler(new Request("http://t/"));
@@ -118,7 +117,6 @@ describe("buildStaticFallback hostDispatch", () => {
     const notFound = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "not-found" }),
     );
     expect((await notFound(new Request("http://t/"))).status).toBe(404);
@@ -126,7 +124,6 @@ describe("buildStaticFallback hostDispatch", () => {
     const redirect = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "redirect", to: "https://example.com/", status: 301 }),
     );
     const res = await redirect(new Request("http://t/"));
@@ -135,7 +132,7 @@ describe("buildStaticFallback hostDispatch", () => {
   });
 
   test("/api/* always hits apiHandler", async () => {
-    const handler = buildStaticFallback(() => new Response("from-api", { status: 200 }), tmp, "{}");
+    const handler = buildStaticFallback(() => new Response("from-api", { status: 200 }), tmp);
     const res = await handler(new Request("http://t/api/query", { method: "POST" }));
     expect(res.status).toBe(200);
     expect(await res.text()).toBe("from-api");
@@ -143,7 +140,7 @@ describe("buildStaticFallback hostDispatch", () => {
 
   test("serves disk asset under staticDir", async () => {
     await writeFile(join(tmp, "logo.png"), "PNGDATA");
-    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp, "{}");
+    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp);
     const res = await handler(new Request("http://t/logo.png"));
     expect(res.status).toBe(200);
     expect(res.headers.get("content-type")).toBe("image/png");
@@ -153,7 +150,7 @@ describe("buildStaticFallback hostDispatch", () => {
   test("a request for a directory copied verbatim from public/ falls back to index.html instead of 500ing", async () => {
     await mkdir(join(tmp, "sub"));
     await writeFile(join(tmp, "index.html"), "<!doctype html><html><body>spa-shell</body></html>");
-    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp, "{}");
+    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp);
     const res = await handler(new Request("http://t/sub"));
     expect(res.status).toBe(200);
     expect(await res.text()).toContain("spa-shell");
@@ -164,11 +161,9 @@ describe("buildStaticFallback hostDispatch", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      '{"screens":[]}',
       () => ({
         kind: "html",
         file: "tenant.html",
-        injectSchema: false,
         csp: "default-src 'self'",
       }),
     );
@@ -185,11 +180,7 @@ describe("buildStaticFallback hostDispatch", () => {
     // matched route (e.g. file-derivatives' public-variant default-deny)
     // that never carries NO_ROUTE_MATCH_HEADER_NAME.
     await writeFile(join(tmp, "index.html"), "<!doctype html><html><body>spa-shell</body></html>");
-    const handler = buildStaticFallback(
-      () => new Response("not found", { status: 404 }),
-      tmp,
-      "{}",
-    );
+    const handler = buildStaticFallback(() => new Response("not found", { status: 404 }), tmp);
     const res = await handler(new Request("http://t/files/deadbeef/thumb"));
     expect(res.status).toBe(404);
     expect(await res.text()).toBe("not found");
@@ -197,7 +188,7 @@ describe("buildStaticFallback hostDispatch", () => {
 
   test("an unknown SPA route with no matching handler still gets the SPA shell", async () => {
     await writeFile(join(tmp, "index.html"), "<!doctype html><html><body>spa-shell</body></html>");
-    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp, "{}");
+    const handler = buildStaticFallback(() => noRouteMatchedResponse(), tmp);
     const res = await handler(new Request("http://t/some/client-side/route"));
     expect(res.status).toBe(200);
     expect(await res.text()).toContain("spa-shell");
@@ -230,7 +221,6 @@ describe("buildStaticFallback resolvePageHead", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "tenant.html" }),
       {
         resolvePageHead: async () => ({
@@ -252,7 +242,6 @@ describe("buildStaticFallback resolvePageHead", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "tenant.html" }),
       {
         resolvePageHead: async () => {
@@ -270,7 +259,6 @@ describe("buildStaticFallback resolvePageHead", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "tenant.html" }),
       {
         resolvePageHead: () => new Promise(() => {}),
@@ -286,7 +274,6 @@ describe("buildStaticFallback resolvePageHead", () => {
     const handler = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "tenant.html" }),
       {
         resolvePageHead: async ({ path }) => ({ title: `Title for ${path}` }),
@@ -302,7 +289,6 @@ describe("buildStaticFallback resolvePageHead", () => {
     const withoutPageHead = buildStaticFallback(
       () => noRouteMatchedResponse(),
       tmp,
-      "{}",
       () => ({ kind: "html", file: "tenant.html" }),
     );
     const res = await withoutPageHead(new Request("http://t/"));