@cosmicdrift/kumiko-types 0.319.0 → 0.320.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.319.0",
+  "version": "0.320.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/__tests__/handlers.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from "bun:test";
+import { isUiAccessGranted } from "../handlers";
+
+describe("isUiAccessGranted", () => {
+  test("unset access is visible to every signed-in user", () => {
+    expect(isUiAccessGranted(undefined, [])).toBe(true);
+    expect(isUiAccessGranted(undefined, undefined)).toBe(true);
+  });
+
+  test("openToAll with a non-empty reason grants regardless of roles", () => {
+    expect(isUiAccessGranted({ openToAll: { reason: "any signed-in user" } }, [])).toBe(true);
+    expect(isUiAccessGranted({ openToAll: { reason: "any signed-in user" } }, undefined)).toBe(
+      true,
+    );
+  });
+
+  test("openToAll with a blank reason denies — malformed/untyped input narrowed defensively", () => {
+    expect(isUiAccessGranted({ openToAll: { reason: "   " } }, [])).toBe(false);
+  });
+
+  test("roles rule grants on overlap", () => {
+    expect(isUiAccessGranted({ roles: ["Admin", "SystemAdmin"] }, ["User", "Admin"])).toBe(true);
+  });
+
+  test("roles rule denies without overlap", () => {
+    expect(isUiAccessGranted({ roles: ["Admin"] }, ["User"])).toBe(false);
+  });
+
+  test("roles rule denies when caller has no roles", () => {
+    expect(isUiAccessGranted({ roles: ["Admin"] }, [])).toBe(false);
+  });
+
+  test("roles rule denies when caller roles are undefined", () => {
+    expect(isUiAccessGranted({ roles: ["Admin"] }, undefined)).toBe(false);
+  });
+
+  test("empty roles rule denies everyone (explicit default-deny opt-in)", () => {
+    expect(isUiAccessGranted({ roles: [] }, ["Admin"])).toBe(false);
+  });
+});

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.320.0",
+    "type": "improvement",
+    "title": "ToolbarAction's navigate variant gets `tab`",
+    "detail": "The navigate-kind ToolbarAction (entityList, projectionList and\nrelatedList-section toolbars) accepts `tab?: string`, the section id of the\ntab to activate on the target projectionDetail (layout.mode \"tabs\"),\nanalogous to RowActionNavigate.tab and MetricNavigate.tab."
+  },
   {
     "version": "0.310.0",
     "type": "improvement",

package/src/config.ts

@@ -375,6 +375,10 @@ export type JobDefinition = {
   readonly name: string;
   readonly handler: JobHandlerFn;
   readonly trigger: JobTrigger;
+  // "sequential" is mutual exclusion, not a FIFO queue: same-name dispatches
+  // never run concurrently, but a loser of the per-name lock is re-enqueued
+  // to the back of its queue, so a job dispatched later can still complete
+  // before one dispatched earlier (fw#3265). Don't rely on dispatch order.
   readonly concurrency?: ConcurrencyMode | undefined;
   readonly maxPerTenant?: number | undefined;
   readonly debounceMs?: number | undefined;

package/src/handlers.ts

@@ -56,6 +56,24 @@ export function isOpenToAllGranted(rule: AccessRule): boolean {
   return openToAll.reason.trim().length > 0;
 }
 
+// UI-visibility predicate — DEFAULT-VISIBLE, the opposite stance from
+// `hasAccess`/AccessRule's own default-deny doc above: an unset `access`
+// means every signed-in user may see the screen/nav/workspace, not nobody.
+// The engine's dispatcher access check stays default-deny; this only
+// decides what a client renders/lists, never what a handler accepts.
+// Same `unknown`-narrowing caution as isOpenToAllGranted — `access` can
+// arrive from untyped sources.
+export function isUiAccessGranted(
+  access: AccessRule | undefined,
+  userRoles: readonly string[] | undefined,
+): boolean {
+  if (access === undefined) return true;
+  if ("openToAll" in access) return isOpenToAllGranted(access);
+  if (userRoles === undefined) return false;
+  if (!("roles" in access)) return false;
+  return access.roles.some((role) => userRoles.includes(role));
+}
+
 // --- Pipeline User ---
 
 // Set only on a SessionUser the framework resolved internally for a

package/src/http-route.ts

@@ -48,6 +48,12 @@ export type HttpRouteHandlerDeps = {
     payload: unknown,
     tenantId: import("./identifiers").TenantId,
   ) => Promise<unknown>;
+  /** Caller IP resolved via the server's configured, trustedProxyHops-aware
+   *  resolver (same one requestIdMiddleware uses for `/api/*`) — a route
+   *  handler needing the caller's IP (rate limiting, audit) should read
+   *  this instead of parsing X-Forwarded-For itself, which trusts
+   *  whichever hop count the deployment actually has in front of it. */
+  readonly clientIp: string;
 };
 
 export type HttpRouteHandler = (

package/src/screen.ts

@@ -79,7 +79,7 @@ export interface FieldFormatRegistry {
 }
 
 // Discriminated union derived from the registry — one variant per key.
-// JSON-safe: no function members, survives buildAppSchema → window.__KUMIKO_SCHEMA__.
+// JSON-safe: no function members, survives buildAppSchema → GET /api/schema.
 export type FormatSpec = {
   [K in keyof FieldFormatRegistry]: { readonly format: K } & FieldFormatRegistry[K];
 }[keyof FieldFormatRegistry];
@@ -97,7 +97,7 @@ export type FieldRenderer = PlatformComponent | string | FormatSpec;
 //   { field, ne }    — true when row[field] !== ne
 //   { field, in }    — true when row[field] is one of the given values
 //   { field, notIn } — true when row[field] is none of the given values
-// JSON-safe: survives buildAppSchema → window.__KUMIKO_SCHEMA__ stringify.
+// JSON-safe: survives buildAppSchema → GET /api/schema stringify.
 export type FieldCondition =
   | boolean
   | { readonly field: string; readonly eq: unknown }
@@ -196,14 +196,14 @@ export type ScreenFilter = {
   readonly value: unknown;
 };
 
-/** Deklarativer Row-Field-Extraktor — JSON-sicher (kein Function-Prop,
- *  überlebt window.__KUMIKO_SCHEMA__ / buildAppSchema).
+/** Declarative row-field extractor — JSON-safe (no function prop, survives
+ *  GET /api/schema / buildAppSchema).
  *
- *  `pick`: extrahiert Felder 1:1. `{ pick: ["id", "version"] }` → `{ id: row.id, version: row.version }`
- *  `map`:  benennt um.        `{ map: { incidentId: "id" } }` → `{ incidentId: row.id }`
+ *  `pick`: extracts fields 1:1. `{ pick: ["id", "version"] }` → `{ id: row.id, version: row.version }`
+ *  `map`:  renames fields.      `{ map: { incidentId: "id" } }` → `{ incidentId: row.id }`
  *
- *  Limitation: computed/template-Werte können nicht ausgedrückt werden
- *  — solche Logik gehört server-side in den Write-Handler. */
+ *  Limitation: computed/templated values can't be expressed this way —
+ *  that logic belongs server-side in the write handler. */
 export type RowFieldExtractor =
   | { readonly pick: readonly string[] }
   | { readonly map: Readonly<Record<string, string>> };
@@ -350,6 +350,10 @@ export type ToolbarAction =
       readonly label: string;
       /** Screen-id (kurz, unqualified) zu dem navigiert wird. */
       readonly screen: string;
+      /** Section id of the tab to activate on the target projectionDetail
+       *  (layout.mode "tabs"); merged into the navigate search params next to
+       *  returnTo. Boot validator checks the id exists on the target. */
+      readonly tab?: string;
       /** Visual style only — unlike the writeHandler variant, "danger" does
        *  not force a confirm dialog here: the target form is the
        *  confirmation. */