@michaelthielemann/kestrel 3.0.1 → 4.0.0

package/layers/access/server/utils/policy.ts

@@ -1,98 +0,0 @@
-export type Role = 'admin' | 'renderer' | 'anonymous'
-export type Action = 'read' | 'write'
-export interface Principal { userId: string | null; role: Role }
-export interface Grant { action: Action; resource: string; scope?: 'published' | 'all' }
-export interface AccessResult { allowed: boolean; readScope: 'published' | 'all' }
-
-/** Hardcoded authorization policy. Role -> grants. `resource: '*'` matches any. */
-export const POLICY: Record<Role, Grant[]> = {
-  admin: [{ action: 'write', resource: '*' }, { action: 'read', resource: '*' }],
-  // The renderer is ONLY ever the build-time prerender or the runtime publisher; both produce the
-  // public static site, which is published-only by definition. Scope its read to 'published' so the
-  // generic /api/<collection> reads never leak drafts into the generated HTML (admin live preview is
-  // unaffected — it renders under the admin principal, scope 'all').
-  renderer: [{ action: 'read', resource: '*', scope: 'published' }],
-  // Anonymous published-read is data-driven from the registry (every page-like collection), not a
-  // literal allow-list — see the `publicResources` branch in `resolveAccess`.
-  anonymous: [],
-}
-
-export function resolveAccess(principal: Principal, action: Action, resource: string, publicResources: readonly string[] = [], extraGrants: readonly Grant[] = []): AccessResult {
-  let allowed = false
-  // readScope reflects the principal's READ permission for this resource, INDEPENDENT of the requested
-  // action, and is fail-closed to 'published': a granted WRITE must never silently confer draft-read
-  // ('all'). Only an explicit read grant with scope 'all' (i.e. admin) upgrades it.
-  let readScope: 'published' | 'all' = 'published'
-  // Hardcoded policy first, then any registry-contributed grants for this role (the opt-in seam). Extra
-  // grants only ever ADD permissions for the role they were registered under — they can't revoke.
-  for (const g of [...(POLICY[principal.role] ?? []), ...extraGrants]) {
-    if (g.resource !== '*' && g.resource !== resource) continue
-    if (g.action === action) allowed = true
-    if (g.action === 'read' && (g.scope ?? 'all') === 'all') readScope = 'all' // a draft-read grant wins
-  }
-  // An anonymous visitor gets published read on every page-like collection (the registry-driven public
-  // set), so a consumer's own pageLike collection is reachable without editing a literal allow-list.
-  // Published-only and gated to the public set — never widens to drafts or non-pageLike collections.
-  if (!allowed && principal.role === 'anonymous' && action === 'read' && publicResources.includes(resource)) {
-    allowed = true
-    readScope = 'published'
-  }
-  return { allowed, readScope }
-}
-
-/**
- * Whether an anonymous visitor may read a collection — i.e. whether its pages are publicly reachable.
- * The single source of truth for "what belongs in a public sitemap": a sitemap must list only URLs an
- * unauthenticated crawler can actually fetch, so the sitemap filters pageLike collections through this.
- */
-export function isPubliclyReadable(resource: string, publicResources: readonly string[] = []): boolean {
-  return resolveAccess({ userId: null, role: 'anonymous' }, 'read', resource, publicResources).allowed
-}
-
-/**
- * Whether a read at this `readScope` must be limited to published rows. Fail-CLOSED: only the explicit
- * `'all'` scope (admin / live preview) sees drafts; anything else — `'published'`, an unexpected value,
- * or a missing scope (a guard regression) — stays published-only. Mirrors the public render path so the
- * two read entry points can't drift to opposite defaults.
- */
-export function publishedOnlyForScope(readScope: string | undefined): boolean {
-  return readScope !== 'all'
-}
-
-const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
-export function actionForMethod(method: string): Action {
-  return SAFE_METHODS.has(method.toUpperCase()) ? 'read' : 'write'
-}
-
-/**
- * Resource for an /api path: the collection segment, except the tooling sub-routes
- * (`/options`, `/translations`, `/:id/translations`, `/:id/dead-refs`) map to a distinct
- * `<collection>/<tool>` resource so the public content grant (read on the bare collection) never covers
- * admin-only tooling — a pageLike collection's `translations` / `dead-refs` maps must NOT be readable by
- * anonymous visitors. The group-keyed and per-record translations routes share one resource: they expose
- * the same sibling ids (drafts included), so they must be gated identically.
- */
-export function resourceForPath(path: string): string {
-  const segs = (path.split('?')[0] ?? '').split('/').filter(Boolean)
-  if (segs[0] !== 'api' || !segs[1]) return ''
-  if (segs[2] === 'options' || segs[2] === 'translations') return `${segs[1]}/${segs[2]}`
-  if (segs[3] === 'translations' || segs[3] === 'dead-refs') return `${segs[1]}/${segs[3]}`
-  return segs[1]
-}
-
-/** Auth bootstrap endpoints, always permitted so the SPA can authenticate under default-deny. */
-export function isBootstrapPath(method: string, path: string): boolean {
-  const clean = path.split('?')[0]
-  const m = method.toUpperCase()
-  return (m === 'POST' && clean === '/api/auth/login') || (m === 'GET' && clean === '/api/auth/session')
-}
-
-/**
- * The public render entry (`GET /api/route`) the live page resolver calls. Readable by everyone — it is
- * the runtime equivalent of serving a static page — but the read SCOPE follows the principal: anonymous
- * gets published-only, an authenticated admin gets 'all' so the handler can surface a draft preview.
- * The handler itself re-forces published-only for any static-generation render (prerender / publisher).
- */
-export function isPublicRenderPath(method: string, path: string): boolean {
-  return method.toUpperCase() === 'GET' && path.split('?')[0] === '/api/route'
-}

package/layers/access/server/utils/public-resources.ts

@@ -1,11 +0,0 @@
-import { allCollections } from '../../../core/server/utils/registry'
-
-/**
- * Collections an anonymous visitor may read (published only): every page-like collection. The single,
- * registry-driven source for public reachability — consumed by the access guard (runtime serving) and
- * the sitemap (which URLs to advertise), so a consumer's own pageLike collection is public without
- * editing a literal allow-list. Page-like ⟺ has a `path`, i.e. it is routable to a static URL.
- */
-export function publicReadableResources(): string[] {
-  return allCollections().filter((c) => c.def.pageLike).map((c) => c.def.name)
-}

package/layers/access/server/utils/render-context.ts

@@ -1,41 +0,0 @@
-import { AsyncLocalStorage } from 'node:async_hooks'
-
-/**
- * Marks an in-process request chain as the runtime publisher's render, so the access guard grants it the
- * same `renderer` principal that build-time prerender gets. The publisher's render does a nested
- * `$fetch('/api/route')`, which is NOT a public endpoint; without this it would 401 at runtime. Set via
- * AsyncLocalStorage — never a header — so an external HTTP request can't forge renderer access (and
- * resolvePage still enforces published-only, so drafts never reach the output regardless).
- */
-const ctx = new AsyncLocalStorage<true>()
-
-/** Run a publish render (and its nested API fetches) as the renderer principal. */
-export function runAsRenderer<T>(fn: () => T): T {
-  return ctx.run(true, fn)
-}
-
-/** True when executing inside a publisher render, so the access guard grants the renderer principal. */
-export function isRendererContext(): boolean {
-  return ctx.getStore() === true
-}
-
-const stageGate = new AsyncLocalStorage<true>()
-
-/**
- * Marks the current request's async context as classified by the stage IP gate, so the in-process
- * sub-requests it spawns (the SSR page's own `$fetch`, the editor preview) are not gated again — they
- * reach the middleware stack on a mocked socket with no peer address and could never match a CIDR.
- *
- * `enterWith` rather than `run` because a middleware has no handle on the rest of its own request; the
- * mark is therefore reachable only from work descending from a request the gate already admitted, which
- * is what makes it unforgeable — unlike "this request has no socket peer", a property whole listeners
- * (unix domain sockets) have for every external client.
- */
-export function markStageGatePassed(): void {
-  stageGate.enterWith(true)
-}
-
-/** True inside a request whose originating request was already classified by the stage IP gate. */
-export function isStageGatePassedContext(): boolean {
-  return stageGate.getStore() === true
-}

package/layers/access/server/utils/require-admin.ts

@@ -1,15 +0,0 @@
-import { createError, type H3Event } from 'h3'
-
-/**
- * Per-handler write-authorization backstop. The access-guard middleware is the PRIMARY enforcement, but
- * it is gated on an `/api/` path-prefix string and is the only check — a future mutating route mounted
- * outside `/api/` (a `server/routes/*` action, a webhook), or any guard-vs-router path divergence, would
- * otherwise run unauthenticated. Every mutating handler calls this so authorization never depends solely
- * on that prefix heuristic. Throws 401 unless the resolved principal is the admin (the only role with
- * write grants — `renderer` is read-only, `anonymous` has no grants).
- */
-export function requireAdmin(event: H3Event): void {
-  if (event.context.principal?.role !== 'admin') {
-    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
-  }
-}

package/layers/admin/app/pages/admin/[collection]/[id].nuxt.test.ts

@@ -1,200 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { useState } from '#imports'
-import { flushPromises } from '@vue/test-utils'
-import { readBody } from 'h3'
-import { mountSuspended, registerEndpoint, mockNuxtImport } from '@nuxt/test-utils/runtime'
-import RecordPage from './[id].vue'
-
-const thingsSchema = {
-  name: 'things', mode: 'multi', translatable: false, pageLike: false, seo: false, status: false,
-  blocks: { enabled: false }, label: { singular: 'Thing', plural: 'Things' },
-  fields: { title: { type: 'text', required: true, unique: false } },
-}
-// Carries an explicit `label.new` — the create heading must use it verbatim, not the generic template.
-const articlesSchema = {
-  name: 'articles', mode: 'multi', translatable: false, pageLike: false, seo: false, status: false,
-  blocks: { enabled: false }, label: { singular: 'Article', plural: 'Articles', new: 'Compose article' },
-  fields: { title: { type: 'text', required: true, unique: false } },
-}
-registerEndpoint('/api/collections', () => ({ data: [thingsSchema, articlesSchema] }))
-registerEndpoint('/api/articles', () => ({ data: [], total: 0, page: 1, perPage: 25 }))
-
-let patched: Record<string, unknown> | null = null
-let posted: Record<string, unknown> | null = null
-registerEndpoint('/api/things/1', async (event) => {
-  if (event.method === 'PATCH') { patched = await readBody(event); return { id: 1, ...patched } }
-  return { id: 1, title: 'Existing' }
-})
-// A record whose title field is blank — the heading must fall back to the generic "#id" phrase.
-registerEndpoint('/api/things/2', () => ({ id: 2, title: '   ' }))
-registerEndpoint('/api/things', async (event) => {
-  if (event.method === 'POST') { posted = await readBody(event); return { id: 7, ...posted } }
-  return { data: [], total: 0, page: 1, perPage: 25 }
-})
-
-// The editor's Delete flows through the shared batch endpoint + the referrer-aggregate preview.
-let bulkBody: Record<string, unknown> | null = null
-registerEndpoint('/api/things/bulk', async (event) => {
-  bulkBody = await readBody(event)
-  return { action: bulkBody!.action, count: 1, ids: bulkBody!.ids }
-})
-registerEndpoint('/api/references/referrers', () => ({ counts: {} }))
-
-// Route + navigation are mocked so the page reads collection/id from `h.params` and navigations are captured.
-const h = vi.hoisted(() => ({ params: { collection: 'things', id: '1' }, nav: [] as unknown[] }))
-mockNuxtImport('useRoute', () => () => ({ params: h.params, query: {}, fullPath: `/admin/${h.params.collection}/${h.params.id}` }))
-mockNuxtImport('navigateTo', () => (to: unknown) => { h.nav.push(to); return Promise.resolve() })
-
-beforeEach(() => {
-  h.params = { collection: 'things', id: '1' }
-  h.nav.length = 0
-  patched = null
-  posted = null
-  bulkBody = null
-  useState('kestrel-collections').value = null
-  useState('kestrel-blocks').value = null
-})
-
-const settle = async () => {
-  await new Promise((r) => setTimeout(r, 20))
-  await flushPromises()
-}
-
-describe('record editor page header', () => {
-  it('merges Save, Cancel and Delete into the record head, each with an icon', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-
-    const head = w.find('.record__head')
-    expect(head.exists()).toBe(true)
-    const buttons = head.findAll('.ui-button')
-    expect(buttons.map((b) => b.text())).toEqual(expect.arrayContaining(['Save', 'Cancel', 'Delete']))
-    for (const b of buttons) expect(b.find('.ui-icon').exists()).toBe(true)
-    expect(w.find('.editor__actions').exists()).toBe(false)
-
-    // Cancel carries real button chrome — it sits beside the solid Delete/Save, not as bare text…
-    expect(buttons.find((b) => b.text() === 'Cancel')!.classes()).toContain('ui-button--secondary')
-    // …while the icon-only tools (undo/redo/open) stay quiet ghosts.
-    const iconOnly = buttons.filter((b) => b.text() === '')
-    expect(iconOnly.length).toBeGreaterThan(0)
-    for (const b of iconOnly) expect(b.classes()).toContain('ui-button--ghost')
-  })
-
-  it('titles the header with the singular label, not the raw (plural) route param', async () => {
-    h.params = { collection: 'things', id: 'new' }
-    const wNew = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(wNew.find('.record__title').text()).toBe('New Thing')
-    expect(wNew.find('.record__back').text()).toContain('Things')
-    // The generic phrase is title-cased; a real record title would not be.
-    expect(wNew.find('.record__title').classes()).toContain('record__title--generic')
-  })
-
-  it('keeps the back link on the heading row (one line, so the panes keep the vertical space)', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(w.find('.record__head .record__back').exists()).toBe(true)
-  })
-
-  it('titles a saved record with its own title — an id means nothing to an editor', async () => {
-    h.params = { collection: 'things', id: '1' }
-    const wEdit = await mountSuspended(RecordPage)
-    await settle()
-    expect(wEdit.find('.record__title').text()).toBe('Existing')
-    expect(wEdit.find('.record__title').classes()).not.toContain('record__title--generic')
-  })
-
-  it('falls back to "Edit {collection} #{id}" when the record has no usable title', async () => {
-    h.params = { collection: 'things', id: '2' }
-    const wEdit = await mountSuspended(RecordPage)
-    await settle()
-    expect(wEdit.find('.record__title').text()).toBe('Edit Thing #2')
-    expect(wEdit.find('.record__title').classes()).toContain('record__title--generic')
-  })
-
-  it('uses the collection\'s explicit label.new for the create heading (no generic "New X")', async () => {
-    h.params = { collection: 'articles', id: 'new' }
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    expect(w.find('.record__title').text()).toBe('Compose article')
-  })
-
-  it('wires the header Save button to submit the editor form', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const save = w.findAll('.record__head .ui-button').find((b) => b.text() === 'Save')!
-    expect(save.attributes('type')).toBe('submit')
-    expect(save.attributes('form')).toBe('record-editor')
-    expect(w.find('form.editor').attributes('id')).toBe('record-editor')
-  })
-
-  it('shows the back link with a centered SVG arrow (no text arrow glyph)', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const back = w.find('.record__back')
-    expect(back.exists()).toBe(true)
-    expect(back.find('.ui-icon').exists()).toBe(true)
-    expect(back.text()).not.toContain('←')
-  })
-
-  it('saving an existing record stays on the page — Save only saves', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.find('form.editor').trigger('submit')
-    await settle()
-    expect(patched).toMatchObject({ title: 'Existing' })
-    expect(h.nav).toEqual([])
-  })
-
-  it('saving a NEW record moves to its own editor, not back to the list', async () => {
-    h.params = { collection: 'things', id: 'new' }
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.findAll('input')[0]!.setValue('Fresh')
-    await w.find('form.editor').trigger('submit')
-    await settle()
-    expect(posted).toMatchObject({ title: 'Fresh' })
-    // navigates to the created record's editor (id 7), never to the list path
-    expect(h.nav).toContain('/admin/things/7')
-    expect(h.nav).not.toContain('/admin/things')
-  })
-
-  it('deletes through the confirm dialog (shared batch op) and navigates back to the list', async () => {
-    const w = await mountSuspended(RecordPage)
-    await settle()
-    // the header Delete opens the dialog rather than window.confirm
-    const del = w.findAll('.record__head .ui-button').find((b) => b.text() === 'Delete')!
-    await del.trigger('click')
-    await settle()
-    expect(w.find('.ui-dialog__content').exists()).toBe(true)
-    // confirming posts the bulk delete for this one id and then navigates to the list
-    const confirm = w.findAll('.ui-dialog__content .ui-button').find((b) => /^delete$/i.test(b.text().trim()))!
-    await confirm.trigger('click')
-    await settle()
-    expect(bulkBody).toEqual({ action: 'delete', ids: [1] })
-    expect(h.nav).toContain('/admin/things')
-  })
-
-  it('a native beforeunload (tab close / reload) is blocked only while there are unsaved changes', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-
-    // pristine → unload is NOT blocked
-    const clean = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(clean)
-    expect(clean.defaultPrevented).toBe(false)
-
-    // edit a field → dirty → unload IS blocked (browser shows its native prompt)
-    await w.findAll('input')[0]!.setValue('Changed')
-    await settle()
-    const dirty = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(dirty)
-    expect(dirty.defaultPrevented).toBe(true)
-
-    // unmounting removes the listener (no leak across pages)
-    w.unmount()
-    const afterUnmount = new Event('beforeunload', { cancelable: true })
-    window.dispatchEvent(afterUnmount)
-    expect(afterUnmount.defaultPrevented).toBe(false)
-  })
-})

package/layers/admin/app/pages/admin/[collection]/publish-preview.nuxt.test.ts

@@ -1,142 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest'
-import { useState } from '#imports'
-import { flushPromises } from '@vue/test-utils'
-import { readBody } from 'h3'
-import { mountSuspended, registerEndpoint, mockNuxtImport } from '@nuxt/test-utils/runtime'
-import RecordPage from './[id].vue'
-
-// A pageLike, status-bearing collection — the page-builder case the Save/Publish split is for.
-const pagesSchema = {
-  name: 'pages', mode: 'multi', translatable: false, pageLike: true, seo: false, status: true,
-  blocks: { enabled: false }, label: { singular: 'Page', plural: 'Pages' },
-  fields: { title: { type: 'text', required: true, unique: false } },
-}
-registerEndpoint('/api/collections', () => ({ data: [pagesSchema] }))
-
-const calls = vi.hoisted(() => ({
-  publishOnSave: false,
-  writes: [] as Record<string, unknown>[],
-  publishes: [] as Record<string, unknown>[],
-  tickets: [] as Record<string, unknown>[],
-}))
-
-registerEndpoint('/api/pages/1', async (event) => {
-  if (event.method === 'PATCH') {
-    const b = await readBody(event)
-    calls.writes.push(b)
-    return { id: 1, ...b, updatedAt: '2026-08-13T10:00:00.000Z' }
-  }
-  return { id: 1, title: 'Existing', path: '/existing', status: 'draft', updatedAt: '2026-08-13T09:00:00.000Z' }
-})
-registerEndpoint('/api/pages', () => ({ data: [], total: 0, page: 1, perPage: 25 }))
-registerEndpoint('/api/pages/1/dead-refs', () => [])
-registerEndpoint('/api/publish-status', () => ({ route: '/existing', status: 'success', pending: !calls.publishOnSave, generates: true, publishOnSave: calls.publishOnSave, updatedAt: '2026-08-13T09:30:00.000Z' }))
-registerEndpoint('/api/publish', async (event) => {
-  calls.publishes.push(await readBody(event))
-  return { queued: true, generates: true, routes: ['/existing'], pruned: [], drafts: [] }
-})
-registerEndpoint('/api/preview', async (event) => {
-  if (event.method === 'POST') {
-    calls.tickets.push(await readBody(event))
-    return { token: 'pv_abc', expiresAt: Date.now() + 600_000 }
-  }
-  return null
-})
-
-const h = vi.hoisted(() => ({ params: { collection: 'pages', id: '1' }, nav: [] as unknown[] }))
-mockNuxtImport('useRoute', () => () => ({ params: h.params, query: {}, fullPath: `/admin/${h.params.collection}/${h.params.id}` }))
-mockNuxtImport('navigateTo', () => (to: unknown) => { h.nav.push(to); return Promise.resolve() })
-
-let opened: Array<{ url: string }>
-let lastTab: { location: { replace: (url: string) => void }; close: () => void } | null
-
-beforeEach(() => {
-  h.params = { collection: 'pages', id: '1' }
-  h.nav.length = 0
-  calls.publishOnSave = false
-  calls.writes.length = 0
-  calls.publishes.length = 0
-  calls.tickets.length = 0
-  opened = []
-  lastTab = null
-  useState('kestrel-collections').value = null
-  useState('kestrel-blocks').value = null
-  vi.spyOn(window, 'open').mockImplementation(((url?: string) => {
-    // The real code opens a blank tab synchronously and redirects it once the ticket is minted.
-    if (url) { opened.push({ url }); return null }
-    lastTab = { location: { replace: (to: string) => opened.push({ url: to }) }, close: () => {} }
-    return lastTab as unknown as Window
-  }) as typeof window.open)
-})
-
-const settle = async () => {
-  await new Promise((r) => setTimeout(r, 20))
-  await flushPromises()
-}
-const button = (w: Awaited<ReturnType<typeof mountSuspended>>, label: string) =>
-  w.findAll('.ui-button').find((b) => b.text() === label)
-
-describe('record editor — Save and Publish are separate actions', () => {
-  it('offers Publish next to Save', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const labels = w.find('.record__actions').findAll('.ui-button').map((b) => b.text()).filter(Boolean)
-    expect(labels).toContain('Publish')
-    expect(labels.indexOf('Publish')).toBe(labels.indexOf('Save') + 1)
-  })
-
-  // `output.publishOnSave` is the way back to the pre-2.0 model, where a save republished on its own.
-  it('drops the Publish button when the consumer turned the split off', async () => {
-    calls.publishOnSave = true
-    const w = await mountSuspended(RecordPage)
-    await settle()
-    expect(w.find('.record__actions').findAll('.ui-button').map((b) => b.text())).not.toContain('Publish')
-  })
-
-  it('Save writes the record and asks for no publish at all', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.find('input[type="text"]').setValue('Edited')
-    // The header Save is a `type=submit` bound to the form by id — which only the real browser follows.
-    await w.find('form.editor').trigger('submit')
-    await settle()
-    expect(calls.writes).toHaveLength(1)
-    expect(calls.writes[0]).toMatchObject({ title: 'Edited', status: 'draft' }) // status untouched by a save
-    expect(calls.publishes).toEqual([])
-  })
-
-  it('Publish saves first, promotes the draft, and then writes the static output', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.find('input[type="text"]').setValue('Ready to go')
-    await button(w, 'Publish')!.trigger('click')
-    await settle()
-    expect(calls.writes[0]).toMatchObject({ title: 'Ready to go', status: 'published' })
-    expect(calls.publishes).toEqual([{ collection: 'pages', id: 1 }])
-  })
-})
-
-describe('record editor — previewing in a new tab', () => {
-  it('opens the saved URL directly when there is nothing unsaved', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Open in new tab')!
-    await preview.trigger('click')
-    await settle()
-    expect(opened.map((o) => o.url)).toContain('/existing')
-    expect(calls.tickets).toEqual([])
-  })
-
-  it('mints a ticket for unsaved changes instead of saving them', async () => {
-    const w = await mountSuspended(RecordPage)
-    await flushPromises()
-    await w.find('input[type="text"]').setValue('Not saved')
-    await flushPromises()
-    const preview = w.findAll('.ui-button').find((b) => b.attributes('aria-label') === 'Preview unsaved changes in a new tab')!
-    await preview.trigger('click')
-    await settle()
-    expect(calls.writes).toEqual([]) // the whole point: no save
-    expect(calls.tickets[0]).toMatchObject({ collection: 'pages', id: 1, values: { title: 'Not saved' } })
-    expect(opened.at(-1)!.url).toBe('/existing?kestrel-preview-token=pv_abc')
-  })
-})

package/layers/auth/server/api/auth/login.post.ts

@@ -1,38 +0,0 @@
-export default defineEventHandler(async (event) => {
-  const ip = clientIp(event)
-  const key = throttleKey(ip)
-  const now = Date.now()
-  assertBodyLimit(getRequestHeader(event, 'content-length'))
-  // Reserve the attempt up front (assert-not-locked + record, atomically — no await in between) so
-  // concurrent in-flight guesses from the same IP all count toward the cap before the slow hash runs.
-  // The failure is already recorded here; a successful login clears it below.
-  reserveLoginAttempt(key, now)
-  const body = await readBody(event)
-  const password = typeof body?.password === 'string' ? body.password : ''
-
-  let stored: string
-  try {
-    // No hash configured → login is impossible: surface a distinct 503 instead of a confusing 401.
-    stored = requireAdminHash()
-  } catch (error) {
-    // A server-side misconfiguration nobody can guess their way past: refund the reservation so the admin
-    // isn't still locked out once they set the hash. The slot-busy 503 below stays billable by contrast —
-    // it IS attacker-triggerable, and charging it is what makes a flood run into the lockout.
-    releaseLoginAttempt(key, now)
-    throw error
-  }
-  acquireHashSlot()
-  let ok: boolean
-  try {
-    ok = await verifyPassword(password, stored)
-  } finally {
-    releaseHashSlot()
-  }
-
-  if (!ok) {
-    throw createError({ statusCode: 401, statusMessage: 'Invalid credentials' })
-  }
-  clearLoginFailures(key)
-  const exp = setAuthSession(event)
-  return { ok: true, exp }
-})

package/layers/auth/server/api/auth/logout.post.ts

@@ -1,9 +0,0 @@
-export default defineEventHandler((event) => {
-  requireAdmin(event) // write-authorization backstop (defense-in-depth; see require-admin.ts)
-  // Clear the cookie for THIS client AND bump the revocation epoch so any other copy of the token (a synced
-  // backup, a leaked log, another device) is invalidated server-side immediately — a real logout, not just a
-  // cookie clear. Single admin ⇒ logout = logout-everywhere, which is the expected behaviour.
-  clearAuthSession(event)
-  bumpSessionEpoch()
-  return { ok: true }
-})

package/layers/auth/server/api/auth/session.get.ts

@@ -1 +0,0 @@
-export default defineEventHandler((event) => getAuthSession(event))

package/layers/auth/server/utils/admin-credential.ts

@@ -1,42 +0,0 @@
-import { createError } from 'h3'
-
-type Env = Record<string, string | undefined>
-
-/** The configured admin password hash, or `undefined` when `KESTREL_ADMIN_PASSWORD_HASH` is unset/empty. */
-export function adminPasswordHash(env: Env = process.env): string | undefined {
-  const stored = env.KESTREL_ADMIN_PASSWORD_HASH
-  return typeof stored === 'string' && stored.length > 0 ? stored : undefined
-}
-
-let warned = false
-function warnNotConfigured(): void {
-  if (warned) return
-  warned = true
-  console.warn(
-    '[kestrel auth] admin login is not configured — set KESTREL_ADMIN_PASSWORD_HASH to enable sign-in',
-  )
-}
-
-/**
- * Resolve the admin password hash for a login attempt, or fail loudly when it is unset.
- *
- * A missing `KESTREL_ADMIN_PASSWORD_HASH` means login is *impossible*, not that a credential was wrong —
- * answering with the generic 401 makes an operator who simply forgot to set the hash chase a phantom
- * "wrong password". So we surface a distinct **503** (plus a one-time server warning) for that case only.
- *
- * Security: this distinguishes solely the *unconfigured* server. A configured server still answers every
- * bad credential with an opaque 401, so it never leaks which part (user/password) failed. Short-circuiting
- * here is safe — a 503 already states plainly that login is unconfigured, so there is no timing signal to
- * protect.
- */
-export function requireAdminHash(env: Env = process.env, warn: () => void = warnNotConfigured): string {
-  const stored = adminPasswordHash(env)
-  if (!stored) {
-    warn()
-    throw createError({
-      statusCode: 503,
-      statusMessage: 'admin login is not configured (set KESTREL_ADMIN_PASSWORD_HASH)',
-    })
-  }
-  return stored
-}