@k2b/cloud 0.8.0 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -98,7 +98,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.0",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.4.0",
+    "@k2b/ui": "0.4.2",
     "@k2b/stdlib": "0.25.0",
     "@k2b/sync": "6.4.0",
     "@nats-io/transport-node": "3.4.0",

package/scripts/build.ts

@@ -17,6 +17,7 @@
  *   _ssr/<island>.js     hydration bundles (auto-emitted by the SSR plugin)
  *   public/<id>/app.css  Tailwind, if the app has src/styles/app.css
  *   public/<id>/...      anything from <appDir>/public/
+ *   assets/...           anything from <appDir>/src/assets/ (appAssetPath)
  *
  * If the app needs additional artefacts (core's global.css, logo, katex),
  * it ships a `scripts/build-extras.ts` that this script runs at the end.
@@ -129,6 +130,7 @@ try {
       __CLOUD_RELEASE__: JSON.stringify(release),
       __CLOUD_SYNC_VERSION__: JSON.stringify(syncVersion),
       __CLOUD_PDF_RENDER_WORKER__: JSON.stringify("./pdf-render/worker.js"),
+      __CLOUD_APP_ASSETS__: JSON.stringify("./assets/"),
     },
     plugins: [(app?.plugin ?? plugin)()],
   });
@@ -167,6 +169,12 @@ if (existsSync(appPublic)) {
   await cp(appPublic, resolve(distPublic, appId), { recursive: true });
 }
 
+// Server-side assets the bundle reads through appAssetPath().
+const appAssets = resolve(appDir, "src/assets");
+if (existsSync(appAssets)) {
+  await cp(appAssets, resolve(dist, "assets"), { recursive: true });
+}
+
 if (appId !== "core" && app) {
   await writeAppFavicon({
     publicDir: distPublic,

package/src/api/auth/schemas.ts

@@ -9,7 +9,13 @@ export const LoginSchema = z.object({
 });
 
 export const EmailLoginSchema = z.object({
-  email: z.email(),
+  email: z
+    .string()
+    .trim()
+    .min(1)
+    .max(254)
+    .refine((value) => !value.includes("@") || z.email().safeParse(value).success, "Invalid email address")
+    .describe("Email address or username of the account"),
   category: z.enum(["guest", "login"]).optional(),
   acceptedAgb: z.literal(true).optional(),
   redirectTo: z.string().max(2048).optional(),

package/src/api/auth.ts

@@ -188,7 +188,8 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
       describeRoute({
         tags: ["Auth"],
         summary: "Request magic link login",
-        description: "Request a magic link token via email for local account sign-in.",
+        description:
+          "Request a magic link token for local account sign-in. The `email` field accepts the email address or the username of the account; the link is always sent to the account's email address.",
         responses: {
           200: jsonResponse(MessageResponseSchema, "Request accepted"),
           400: jsonResponse(ErrorResponseSchema, "Email sign-in not available"),
@@ -203,7 +204,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return c.json({ message: requestResult.message }, requestResult.status);
         }
 
-        log.info("Magic link requested", { email });
+        log.info("Magic link requested", { identifier: email });
         return c.json({
           message: "If this email can sign in with a login code, a code has been sent.",
         });

package/src/server/app-assets.ts

@@ -0,0 +1,31 @@
+import { resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { env } from "../config/env";
+
+/** Set by `scripts/build.ts`; the bundle lives next to `dist/assets/`. */
+declare const __CLOUD_APP_ASSETS__: string | undefined;
+
+// `resolve` normalizes both forms: a file URL keeps its trailing slash, which
+// would otherwise break the containment check below (`/app/assets//...`).
+const assetsRoot = (): string =>
+  resolve(
+    typeof __CLOUD_APP_ASSETS__ === "string"
+      ? fileURLToPath(new URL(__CLOUD_APP_ASSETS__, import.meta.url))
+      : resolve(env.APP_DIR ?? process.cwd(), "src/assets"),
+  );
+
+/**
+ * Absolute path of a server-side application asset.
+ *
+ * Applications keep files their server reads at runtime (document templates,
+ * seed data, binaries) under `src/assets/`. The production build copies that
+ * directory to `dist/assets/`, so the same call works from the source tree
+ * (`APP_DIR`, or the working directory, plus `src/assets`) and from the
+ * bundled image. The path must stay inside the assets directory.
+ */
+export function appAssetPath(...segments: string[]): string {
+  const root = assetsRoot();
+  const path = resolve(root, ...segments);
+  if (path !== root && !path.startsWith(root + sep)) throw new Error(`Asset path escapes src/assets: ${segments.join("/")}`);
+  return path;
+}

package/src/server/index.ts

@@ -3,6 +3,7 @@ export type { ApiErrorBody, ApiErrorResponse, ApiErrorStatus } from "./api";
 export { api, respond, respondMessage } from "./api";
 export type { CreateApiClientConfig } from "./api-client";
 export { api as apiClient } from "./api-client";
+export { appAssetPath } from "./app-assets";
 export type { AppContext } from "./app-context";
 export { defineHelp, defineHelpCollection, type HelpCollection, type HelpDefinition, type HelpDefinitionDocument } from "./help";
 export { DEFAULT_LOCALE, getLocale, LOCALE_COOKIE, LOCALE_HEADER, locale, preferredLocale, resolveLocale } from "./locale";

package/src/services/account-lifecycle/index.ts

@@ -457,7 +457,6 @@ export const accountLifecycle = {
           });
           await tx`DELETE FROM auth.users WHERE id = ${userId}::uuid`;
         });
-        await session.revokeAllForUser(userId);
         summary.changed += 1;
       } catch (error) {
         summary.failed += 1;
@@ -507,7 +506,6 @@ export const accountLifecycle = {
           });
           await tx`DELETE FROM auth.users WHERE id = ${userId}::uuid`;
         });
-        await session.revokeAllForUser(userId);
         summary.changed += 1;
       } catch (error) {
         summary.failed += 1;

package/src/services/auth-flows/magic-link.ts

@@ -50,11 +50,23 @@ const sendIpaEmailLoginHint = async (
   if (result.status === "error") log.error("FreeIPA login hint delivery failed", { notificationId: result.id });
 };
 
+// A username resolves to the stored email of exactly one account; anything
+// else (unknown, ambiguous casing, no email) behaves like an unknown email.
+const resolveEmailForUsername = async (username: string): Promise<string | null> => {
+  const rows = await sql<{ mail: string | null }[]>`
+    SELECT mail FROM auth.users WHERE lower(uid) = lower(${username}) LIMIT 2
+  `;
+  const mail = rows.length === 1 ? rows[0]?.mail : null;
+  return mail ? normalizeEmail(mail) : null;
+};
+
 export const request = async (
   params: { email: string; redirectTo?: string; locale?: string; category?: "guest" | "login" },
   notificationSender: AuthNotificationSender,
 ): Promise<{ ok: true } | { ok: false; status: 400; message: string }> => {
-  const email = normalizeEmail(params.email);
+  const identifier = params.email.trim();
+  const email = identifier.includes("@") ? normalizeEmail(identifier) : await resolveEmailForUsername(identifier);
+  if (!email) return { ok: true };
   const hasIpaUser = await hasIpaAccountForEmail(email);
   const userRows = hasIpaUser
     ? []

package/src/services/ipa/users.ts

@@ -847,7 +847,7 @@ export const deleteUser = async (params: {
     });
     throw dbError;
   }
-  await session.revokeAllForUser(id);
+  // Deleting the row invalidates every session; no epoch bump is possible or needed.
 
   return { ok: true, data: undefined };
 };

package/src/services/providers/local/users.ts

@@ -8,7 +8,6 @@ import { writeLocalAccount } from "../../accounts/posix";
 import type { AuditActor } from "../../audit";
 import { generateUniqueAbbreviation } from "../../ipa/users";
 import { isUniqueViolation } from "../../postgres";
-import { session } from "../../session";
 import * as settings from "../../settings";
 
 type DbRow = Record<string, unknown>;
@@ -265,8 +264,8 @@ export const remove = async (params: { id: string; actor: { userId: string; uid:
     });
     await tx`DELETE FROM auth.users WHERE id = ${params.id}::uuid`;
   });
-
-  await session.revokeAllForUser(params.id);
+  // Deleting the row invalidates every session: session lookups find no user.
+  // A separate epoch bump would fail because the row is gone.
 
   return { ok: true, data: undefined };
 };

package/src/ssr/Layout.tsx

@@ -26,6 +26,7 @@ import type { LayoutBreadcrumb } from "./layout-runtime";
 import { platformMessages } from "./platform-messages";
 import RegisteredHelpDocuments from "./RegisteredHelpDocuments.island";
 import { sortRailApps } from "./rail-navigation";
+import { requestPath } from "./request-path";
 import { getLocalizedRuntimeContext, type RuntimeContext } from "./runtime";
 import TimezoneCookie from "./TimezoneCookie.island";
 
@@ -257,7 +258,7 @@ export default function Layout(props: LayoutProps) {
             openAppsLabel={t.openApps}
             apps={allApps}
             railSettings={c.get("railPreferences") ?? defaultRailPreferences()}
-            currentUrl={c.req.raw.url}
+            currentPath={requestPath(c)}
             profileAvatarSrc={profileAvatarSrc}
             profileName={profileName}
             searchHelpApps={searchHelpApps}

package/src/ssr/LayoutRail.tsx

@@ -19,7 +19,8 @@ type LayoutRailProps = {
   openAppsLabel: string;
   apps: RailApp[];
   railSettings: RailSnapshot;
-  currentUrl: string;
+  /** `pathname + search` of the request; the island resolves it against the browser origin. */
+  currentPath: string;
   profileAvatarSrc?: string;
   profileName: string;
   searchHelpApps: GlobalSearchHelpApp[];
@@ -46,7 +47,7 @@ export default function LayoutRail(props: LayoutRailProps) {
           </a>
         </div>
         <nav class="layout-rail-navigation flex min-h-0 flex-1 flex-col items-center gap-1" aria-label={props.appsLabel}>
-          <RailApps apps={props.apps} settings={props.railSettings} currentUrl={props.currentUrl} />
+          <RailApps apps={props.apps} settings={props.railSettings} currentPath={props.currentPath} />
           <AppLaunchpad
             profile={{ name: props.profileName, theme: props.theme }}
             apps={props.launchpadApps}

package/src/ssr/MobileNavigation.tsx

@@ -32,11 +32,13 @@ function MobileNavigation(props: {
   );
   return (
     <BottomSheet onDismiss={props.dismiss}>
-      <BottomSheet.Header
-        title={workspace()?.label || t().apps}
-        close={() => void props.dismiss()}
-        actions={
-          <Show when={workspace()} fallback={<span class="font-semibold">{t().allApps}</span>}>
+      {/* Without an app menu the launchpad gets the whole sheet; the hidden
+          heading still names the dialog, and the handle and backdrop dismiss it. */}
+      <Show when={workspace()} fallback={<h2 class="sr-only">{t().allApps}</h2>}>
+        <BottomSheet.Header
+          title={workspace()?.label || t().apps}
+          close={() => void props.dismiss()}
+          actions={
             <SegmentedControl
               class="cloud-mobile-menu__switch"
               size="md"
@@ -48,9 +50,9 @@ function MobileNavigation(props: {
                 { value: "apps", label: t().allApps },
               ]}
             />
-          </Show>
-        }
-      />
+          }
+        />
+      </Show>
       <BottomSheet.Body>
         <Show
           when={workspace() && tab() === "app"}

package/src/ssr/RailApps.island.tsx

@@ -5,9 +5,9 @@ import { appAccentStyle } from "./app-appearance";
 import { RAIL_PREFERENCES_EVENT, readRailContext } from "./rail-context";
 import { projectRailNavigation, type RailApp, type RailLink, railLinkActive } from "./rail-navigation";
 
-function RailIcon(props: { link: RailLink; currentUrl: string }) {
+function RailIcon(props: { link: RailLink; currentPath: string }) {
   let target: HTMLAnchorElement | undefined;
-  const active = () => railLinkActive(props.link, props.currentUrl);
+  const active = () => railLinkActive(props.link, props.currentPath);
   return (
     <>
       <a
@@ -26,14 +26,14 @@ function RailIcon(props: { link: RailLink; currentUrl: string }) {
   );
 }
 
-export default function RailApps(props: { apps: RailApp[]; settings: RailSnapshot; currentUrl: string }) {
+export default function RailApps(props: { apps: RailApp[]; settings: RailSnapshot; currentPath: string }) {
   const locale = useLocale();
   const [settings, setSettings] = createSignal(props.settings);
-  const [currentUrl, setCurrentUrl] = createSignal(props.currentUrl);
+  const [currentPath, setCurrentPath] = createSignal(props.currentPath);
   const navigation = createMemo(() => projectRailNavigation(props.apps, settings(), locale()));
   onMount(() => {
     const sync = () => setSettings(readRailContext()?.settings ?? props.settings);
-    const syncLocation = () => setCurrentUrl(window.location.href);
+    const syncLocation = () => setCurrentPath(`${window.location.pathname}${window.location.search}${window.location.hash}`);
     sync();
     syncLocation();
     window.addEventListener(RAIL_PREFERENCES_EVENT, sync);
@@ -51,11 +51,11 @@ export default function RailApps(props: { apps: RailApp[]; settings: RailSnapsho
       style={{ flex: "0 1 auto", "scrollbar-width": "none", "scrollbar-gutter": "auto", "overflow-x": "hidden" }}
       data-cloud-rail-apps
     >
-      <For each={navigation().shortcuts}>{(link) => <RailIcon link={link} currentUrl={currentUrl()} />}</For>
+      <For each={navigation().shortcuts}>{(link) => <RailIcon link={link} currentPath={currentPath()} />}</For>
       <Show when={navigation().shortcuts.length > 0 && navigation().apps.length > 0}>
         <div role="separator" class="my-1 h-px w-5 shrink-0" style={{ background: "var(--ui-divider)" }} />
       </Show>
-      <For each={navigation().apps}>{(link) => <RailIcon link={link} currentUrl={currentUrl()} />}</For>
+      <For each={navigation().apps}>{(link) => <RailIcon link={link} currentPath={currentPath()} />}</For>
     </ScrollArea>
   );
 }

package/src/ssr/index.ts

@@ -9,6 +9,7 @@ export {
   type MinimalLayoutPreferencePosition,
   type MinimalLayoutProps,
 } from "./MinimalLayout";
+export { requestPath } from "./request-path";
 export { getLocalizedRuntimeContext, getRuntimeContext, type RuntimeContext } from "./runtime";
 export type { UrlFilterField } from "./url-filter";
 export { createUrlFilter, flag, list, oneOf, page, text } from "./url-filter";

package/src/ssr/rail-navigation.ts

@@ -48,8 +48,9 @@ export const projectRailNavigation = (apps: readonly RailApp[], settings: RailSn
   };
 };
 
-export const railLinkActive = (link: RailLink, currentUrl: string): boolean => {
-  const current = new URL(currentUrl, "https://cloud.invalid");
+/** `currentPath` is the route as `pathname + search`; an absolute URL is accepted but never required. */
+export const railLinkActive = (link: RailLink, currentPath: string): boolean => {
+  const current = new URL(currentPath, "https://cloud.invalid");
   const target = new URL(link.match, current);
   if (target.origin !== current.origin) return false;
   if (link.exact) return target.pathname === current.pathname && target.search === current.search && target.hash === current.hash;

package/src/ssr/request-path.ts

@@ -0,0 +1,12 @@
+/**
+ * The route of the current request as `pathname + search`.
+ *
+ * Behind the gateway `c.req.raw.url` carries the internal upstream origin
+ * (`http://app-mail:3000`), never the public one. Islands and links must
+ * therefore receive the route as a path and resolve it against
+ * `window.location.origin` in the browser.
+ */
+export const requestPath = (c: { req: { raw: { url: string } } }): string => {
+  const url = new URL(c.req.raw.url);
+  return `${url.pathname}${url.search}`;
+};