@cosmicdrift/kumiko-testing 0.319.0 → 0.320.0

package/README.md

@@ -11,12 +11,14 @@ const persisted = await seedTenant(stack, { persist: true }); // real rows via t
 await tenant.api.writeOk("my-feature:write:thing:create", { title: "x" });
 ```
 
-- `preload/{temporal,ci-log,scrub-env,env,real,dom}`: bunfig `preload` entries. `scrub-env` removes
-  `PROVIDER_ENV_KEYS` (unit default); `env` adds the localhost service defaults (integration);
-  `real` refuses to run without `KUMIKO_REAL_PROVIDERS=1` and in CI, and keeps the keys; `dom`
-  registers happy-dom (window/document/HTMLElement) while preserving Bun's native
-  fetch/Request/Response, and cleans up (`@testing-library/react` unmount, Radix DOM/style leaks,
-  `window.location`) after every test.
+- `preload/{temporal,ci-log,scrub-env,schema-env-defaults,env,real,dom}`: bunfig `preload` entries.
+  `scrub-env` removes `PROVIDER_ENV_KEYS` (unit default); `schema-env-defaults` fills `JWT_SECRET`
+  and the `KUMIKO_SECRETS_MASTER_KEY_*` pair that the framework's own env schema requires (unit,
+  DOM, integration, real — never a service endpoint); `env` adds `schema-env-defaults` plus the
+  localhost service defaults (integration); `real` refuses to run without
+  `KUMIKO_REAL_PROVIDERS=1` and in CI, and keeps the keys; `dom` registers happy-dom
+  (window/document/HTMLElement) while preserving Bun's native fetch/Request/Response, and cleans up
+  (`@testing-library/react` unmount, Radix DOM/style leaks, `window.location`) after every test.
 - `kumiko-testing bunfig [--dom] [--coverage]`: writes `bunfig.toml`,
   `bunfig.integration.toml` and `bunfig.real.toml` (plus `bunfig.dom.toml`). `--dom` adds
   `preload/dom` (happy-dom + testing-library/react cleanup); `@happy-dom/global-registrator` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-testing",
-  "version": "0.319.0",
+  "version": "0.320.0",
   "description": "Test template for Kumiko apps: per-flow seedTenant, app test stack, canonical test preloads, bunfig generator and integration runner.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -42,6 +42,10 @@
       "types": "./src/preload/scrub-env.ts",
       "default": "./src/preload/scrub-env.ts"
     },
+    "./preload/schema-env-defaults": {
+      "types": "./src/preload/schema-env-defaults.ts",
+      "default": "./src/preload/schema-env-defaults.ts"
+    },
     "./preload/env": {
       "types": "./src/preload/env.ts",
       "default": "./src/preload/env.ts"
@@ -71,9 +75,9 @@
     "kumiko-testing": "./bin/kumiko-testing.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.319.0",
-    "@cosmicdrift/kumiko-dev-server": "0.319.0",
-    "@cosmicdrift/kumiko-framework": "0.319.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.320.0",
+    "@cosmicdrift/kumiko-dev-server": "0.320.0",
+    "@cosmicdrift/kumiko-framework": "0.320.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {

package/src/bunfig.ts

@@ -28,7 +28,11 @@ const PRELOAD_PREFIX = "@cosmicdrift/kumiko-testing/preload";
 const DOM_PRELOAD = `${PRELOAD_PREFIX}/dom`;
 
 const PRELOADS = {
-  unit: [`${PRELOAD_PREFIX}/temporal`, `${PRELOAD_PREFIX}/scrub-env`],
+  unit: [
+    `${PRELOAD_PREFIX}/temporal`,
+    `${PRELOAD_PREFIX}/scrub-env`,
+    `${PRELOAD_PREFIX}/schema-env-defaults`,
+  ],
   integration: [`${PRELOAD_PREFIX}/temporal`, `${PRELOAD_PREFIX}/env`],
   real: [`${PRELOAD_PREFIX}/temporal`, `${PRELOAD_PREFIX}/real`],
 } as const satisfies Record<BunfigVariant, readonly string[]>;

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.320.0",
+    "type": "improvement",
+    "title": "requireRealProviders from kumiko-testing/e2e, SSE events for seedTenant tenants",
+    "detail": "`@cosmicdrift/kumiko-testing/e2e` re-exports `requireRealProviders`, `isRealProviderRun` and `REAL_PROVIDERS_ENV` from the framework's `testing/real-providers` subpath instead of keeping its own copy. Playwright specs and configs, which load under Node, no longer have to avoid the framework's `./testing` barrel.\n\n`seedTenant(stack, …)` subscribes `stack.events.sse` to the seeded tenant's SSE channel. Before, `setupTestStack` only listened on test tenant 1, so writes in a seeded tenant never showed up on `events.sse` and tests had to call `stack.sseBroker.addClient(tenantChannel(id), …)` themselves; that manual call can go. Events from `persist: true` seeding (tenant, user, membership) now also land on `events.sse` after the next drain."
+  },
+  {
+    "version": "0.320.0",
+    "type": "improvement",
+    "title": "Schema-required test env keys (JWT_SECRET, secrets master key) now default in every bunfig variant",
+    "detail": "Apps with the secrets, field-encryption or auth-mfa features previously had\nto hand-roll a `test-setup/env.preload.ts` to satisfy the env schema's\n`JWT_SECRET` and `KUMIKO_SECRETS_MASTER_KEY_*` in unit and DOM tests, since\nonly `SERVICE_ENV_DEFAULTS` (integration/real only) carried a `JWT_SECRET`\ndefault and no map carried the master key. The new `SCHEMA_ENV_DEFAULTS`\nmap lives next to `SERVICE_ENV_DEFAULTS` and is preloaded in all four bunfig\nvariants (unit, DOM, integration, real) via a new `preload/schema-env-defaults`\nmodule, filled with `??=` so an app's own value is kept; only a\n`JWT_SECRET` shorter than 32 characters is replaced.\n`SERVICE_ENV_DEFAULTS` no longer duplicates `JWT_SECRET` — it has one home\nnow. Unit and DOM still carry no service-endpoint defaults."
+  },
   {
     "version": "0.318.0",
     "type": "improvement",

package/src/e2e/constants.ts

@@ -15,18 +15,6 @@ export const SEED_TOKEN_ENV = "KUMIKO_TEST_SEED_TOKEN";
 export const SEED_TOKEN_HEADER = "x-kumiko-test-seed";
 export const E2E_WORKERS_ENV = "KUMIKO_E2E_WORKERS";
 
-// Same literal as the framework's requireRealProviders()/isRealProviderRun(),
-// duplicated because the Playwright config runs under Node and importing the
-// framework's "./testing" barrel there would pull in its full Bun-toolchain
-// dependency graph for a single string constant.
-export const REAL_PROVIDERS_ENV = "KUMIKO_REAL_PROVIDERS";
-
-export function isRealProviderRun(
-  env: Readonly<Record<string, string | undefined>> = process.env,
-): boolean {
-  return env[REAL_PROVIDERS_ENV] === "1";
-}
-
 // Same literal as kumiko-dev-server's createKumikoServer (STYLESHEET_WATCH_ENV),
 // duplicated because the Playwright config runs under Node and can't import
 // that Bun-toolchain-adjacent module.

package/src/e2e/define-app-e2e-config.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { availableParallelism } from "node:os";
+import { isRealProviderRun } from "@cosmicdrift/kumiko-framework/testing/real-providers";
 import {
   defineConfig,
   devices,
@@ -12,7 +13,6 @@ import { SERVICE_ENV_DEFAULTS } from "../preload/service-env-defaults-values";
 import {
   DESKTOP_VIEWPORT,
   E2E_WORKERS_ENV,
-  isRealProviderRun,
   PLAYWRIGHT_DEMO_ENV,
   PROD_BUNDLES_ENV,
   SCREENSHOT_DEVICE_SCALE_FACTOR,

package/src/e2e/index.ts

@@ -1,3 +1,8 @@
+export {
+  isRealProviderRun,
+  REAL_PROVIDERS_ENV,
+  requireRealProviders,
+} from "@cosmicdrift/kumiko-framework/testing/real-providers";
 export { expect } from "@playwright/test";
 export {
   apiCommand,
@@ -16,10 +21,8 @@ export {
   CSRF_COOKIE_NAME,
   CSRF_HEADER_NAME,
   E2E_WORKERS_ENV,
-  isRealProviderRun,
   KUMIKO_SECRETS_MASTER_KEY_V1,
   PLAYWRIGHT_DEMO_ENV,
-  REAL_PROVIDERS_ENV,
   SEED_ENABLE_ENV,
   SEED_TOKEN_ENV,
 } from "./constants";

package/src/e2e/screenshots.ts

@@ -1,8 +1,9 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, statSync } from "node:fs";
 import { dirname } from "node:path";
+import { isRealProviderRun } from "@cosmicdrift/kumiko-framework/testing/real-providers";
 import { expect, type Page, type Request } from "@playwright/test";
-import { DESKTOP_VIEWPORT, isRealProviderRun } from "./constants";
+import { DESKTOP_VIEWPORT } from "./constants";
 import { pinEnglishLocale } from "./pin-english-locale";
 import { requireScreenshotDir, SCREENSHOT_DIR_ENV } from "./screenshot-dir";
 import { type SeedTenantFixture, test } from "./seeded-tenant-fixture";

package/src/preload/env.ts

@@ -1,2 +1,3 @@
 import "./scrub-env";
+import "./schema-env-defaults";
 import "./service-env-defaults";

package/src/preload/real.ts

@@ -1,4 +1,5 @@
 import { requireRealProviders } from "@cosmicdrift/kumiko-framework/testing";
+import "./schema-env-defaults";
 import "./service-env-defaults";
 
 requireRealProviders();

package/src/preload/schema-env-defaults-values.ts

@@ -0,0 +1,6 @@
+// KUMIKO_SECRETS_MASTER_KEY_V1 must base64-decode to exactly 32 bytes (AES-256 KEK).
+export const SCHEMA_ENV_DEFAULTS = {
+  JWT_SECRET: "test-jwt-secret-at-least-32-characters-long",
+  KUMIKO_SECRETS_MASTER_KEY_V1: "a3VtaWtvLXNjaGVtYS1lbnYtZGVmYXVsdC0zMmJ5dGU=",
+  KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+} as const satisfies Record<string, string>;

package/src/preload/schema-env-defaults.ts

@@ -0,0 +1,18 @@
+import { SCHEMA_ENV_DEFAULTS } from "./schema-env-defaults-values";
+
+// Mirrors authEmailPasswordEnvSchema's JWT_SECRET.min(32) / jwt.ts's HS256
+// floor: a too-short value from a stray .env is replaced, not kept, same as
+// the app-local preloads this centralizes did before it.
+const MIN_JWT_SECRET_LENGTH = 32;
+
+function isTooShortJwtSecret(key: string, value: string | undefined): boolean {
+  return key === "JWT_SECRET" && (!value || value.length < MIN_JWT_SECRET_LENGTH);
+}
+
+for (const [key, value] of Object.entries(SCHEMA_ENV_DEFAULTS)) {
+  if (isTooShortJwtSecret(key, process.env[key])) {
+    process.env[key] = value;
+    continue;
+  }
+  process.env[key] ??= value;
+}

package/src/preload/service-env-defaults-values.ts

@@ -4,7 +4,6 @@ export const SERVICE_ENV_DEFAULTS = {
   REDIS_URL: "redis://localhost:16379",
   MEILI_URL: "http://localhost:17700",
   MEILI_MASTER_KEY: "kumiko-dev-key",
-  JWT_SECRET: "test-jwt-secret-at-least-32-characters-long",
   MINIO_ENDPOINT: "http://localhost:19000",
   MINIO_ACCESS_KEY: "kumiko",
   MINIO_SECRET_KEY: "kumiko-dev-secret",

package/src/scaffold.ts

@@ -1,6 +1,6 @@
 // @runtime tooling
+import { REAL_PROVIDERS_ENV } from "@cosmicdrift/kumiko-framework/testing/real-providers";
 import { BUNFIG_FILES, renderBunfigFiles, TEST_TIMEOUT_MS } from "./bunfig";
-import { REAL_PROVIDERS_ENV } from "./e2e/constants";
 
 export type ScaffoldTestSetup = {
   readonly files: Readonly<Record<string, string>>;

package/src/seed-tenant.ts

@@ -7,6 +7,7 @@ import {
   createSystemUser,
   type SessionUser,
   type TenantId,
+  tenantChannel,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
@@ -177,6 +178,13 @@ export async function seedTenant(
   const rows = persist ? await persistTenantRows(write, opts) : lightTenantRows(opts);
   const { id } = rows;
 
+  // setupTestStack subscribes events.sse only to test tenant 1; a seeded tenant has a fresh random id.
+  stack.sseBroker.addClient(
+    tenantChannel(id),
+    (event) => stack.events.sse.push(event),
+    () => {},
+  );
+
   const admin = withSession(rows.admin, id, [ROLES.TenantAdmin]);
   const tenant: SeededTenant = {
     id,