@mccaskie-labs/workbench-config 0.1.22 → 0.1.23

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.23
+
+### Patch Changes
+
+- Probes for the sign-in kit. `email`: `email.account.kit-clean`, `email.account.sign-in-code`, `email.hook.unsigned-refused`, `email.hook.signed-refused-action` and `email.brand.logo-public`. `database`: `database.plain-error`.
+
 ## 0.1.22
 
 ### Patch Changes

package/capabilities/database.json

@@ -202,6 +202,14 @@
       "expect": "pass",
       "cost_hint_usd": 0,
       "note": "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included"
+    },
+    {
+      "id": "database.plain-error",
+      "half": "runtime",
+      "expect": "pass",
+      "smoke": true,
+      "cost_hint_usd": 0,
+      "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
     }
   ]
 }

package/capabilities/email.json

@@ -57,6 +57,11 @@
     { "id": "email.send.dev-key-recipient-refused", "half": "runtime", "expect": "refused_as_expected", "refusal": "recipient_not_allowed", "cost_hint_usd": 0 },
     { "id": "email.send.sender-not-allowed", "half": "runtime", "expect": "refused_as_expected", "refusal": "sender_not_allowed", "cost_hint_usd": 0 },
     { "id": "email.capture-refused-in-staging", "half": "runtime", "expect": "pass", "cost_hint_usd": 0, "note": "createMailer with transport capture and WORKBENCH_ENV=staging throws invalid_config" },
-    { "id": "email.send.new-sender", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "Runs after the Control drill's gw_sender_add step; skipped without it" }
+    { "id": "email.send.new-sender", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "Runs after the Control drill's gw_sender_add step; skipped without it" },
+    { "id": "email.account.kit-clean", "half": "runtime", "expect": "pass", "smoke": true, "cost_hint_usd": 0, "note": "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing" },
+    { "id": "email.account.sign-in-code", "half": "runtime", "expect": "pass", "cost_hint_usd": 0.00035, "note": "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run" },
+    { "id": "email.hook.unsigned-refused", "half": "runtime", "expect": "refused_as_expected", "refusal": "unauthorised", "smoke": true, "cost_hint_usd": 0, "note": "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret" },
+    { "id": "email.hook.signed-refused-action", "half": "runtime", "expect": "refused_as_expected", "refusal": "refused", "cost_hint_usd": 0, "note": "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret" },
+    { "id": "email.brand.logo-public", "half": "runtime", "expect": "pass", "smoke": true, "cost_hint_usd": 0, "note": "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type" }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "2216125e22d4";
+export declare const MANIFEST_VERSION: "7f14dfc78268";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -563,6 +563,13 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
             readonly note: "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included";
+        }, {
+            readonly id: "database.plain-error";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists";
         }];
     };
     readonly email: {
@@ -771,6 +778,41 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0.00035;
             readonly note: "Runs after the Control drill's gw_sender_add step; skipped without it";
+        }, {
+            readonly id: "email.account.kit-clean";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing";
+        }, {
+            readonly id: "email.account.sign-in-code";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0.00035;
+            readonly note: "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run";
+        }, {
+            readonly id: "email.hook.unsigned-refused";
+            readonly half: "runtime";
+            readonly expect: "refused_as_expected";
+            readonly refusal: "unauthorised";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret";
+        }, {
+            readonly id: "email.hook.signed-refused-action";
+            readonly half: "runtime";
+            readonly expect: "refused_as_expected";
+            readonly refusal: "refused";
+            readonly cost_hint_usd: 0;
+            readonly note: "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret";
+        }, {
+            readonly id: "email.brand.logo-public";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type";
         }];
     };
     readonly "email-inbound": {

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "2216125e22d4";
+export const MANIFEST_VERSION = "7f14dfc78268";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -810,6 +810,14 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0,
                 "note": "vendor_settings_apply check_only reports that both databases match the baseline, the Send Email hook included"
+            },
+            {
+                "id": "database.plain-error",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "plainError and plainAuthError (workbench-supabase) turn a raw database error and an email_exists auth error into plain words that name the app and never say whether an account exists"
             }
         ]
     },
@@ -1073,6 +1081,46 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0.00035,
                 "note": "Runs after the Control drill's gw_sender_add step; skipped without it"
+            },
+            {
+                "id": "email.account.kit-clean",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "emailKitProblems over the app's catalogue (ACCOUNT_EMAILS), strings and brand.json returns []; runs in the Worker and sends nothing"
+            },
+            {
+                "id": "email.account.sign-in-code",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0.00035,
+                "note": "renderTemplate account_sign_in_code with the app's brand.json, sent to Robert through the Gateway; check the logo, colours and code, and that there is no link. Not in the daily smoke run"
+            },
+            {
+                "id": "email.hook.unsigned-refused",
+                "half": "runtime",
+                "expect": "refused_as_expected",
+                "refusal": "unauthorised",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "POST /auth/send-email from outside with no signature answers 401, not a sign-in redirect: proves the Access path bypass and the handler. Needs no secret"
+            },
+            {
+                "id": "email.hook.signed-refused-action",
+                "half": "runtime",
+                "expect": "refused_as_expected",
+                "refusal": "refused",
+                "cost_hint_usd": 0,
+                "note": "A request signed with SEND_EMAIL_HOOK_SECRET for email_action_type recovery answers 422 and sends nothing; skipped while the Worker has no hook secret"
+            },
+            {
+                "id": "email.brand.logo-public",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "GET brand.json's logo.url from outside with no sign-in answers 200 with an image content type"
             }
         ]
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",