@nextsparkjs/theme-default 0.1.0-beta.2 → 0.1.0-beta.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/theme-default",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0-beta.21",
   "private": false,
   "type": "module",
   "main": "./config/theme.config.ts",
@@ -9,6 +9,7 @@
   ],
   "dependencies": {},
   "peerDependencies": {
+    "@nextsparkjs/core": "workspace:*",
     "@tanstack/react-query": "^5.0.0",
     "lucide-react": "^0.539.0",
     "next": "^15.0.0",
@@ -16,7 +17,10 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-markdown": "^10.1.0",
-    "zod": "^4.0.0",
-    "@nextsparkjs/core": "0.1.0-beta.6"
+    "zod": "^4.0.0"
+  },
+  "nextspark": {
+    "type": "theme",
+    "name": "default"
   }
-}
+}

package/templates/(public)/page.tsx

@@ -69,7 +69,7 @@ function Home() {
                       <span className="text-sm font-medium">{t('auth.authenticated')}</span>
                     </div>
                     <p className="text-lg">
-                      {t('auth.welcomeBack', { email: user.email })}
+                      {t('auth.welcomeBack', { email: user.email || '' })}
                     </p>
                     <Link href="/dashboard">
                       <Button size="lg" className="gap-2">

package/tests/cypress/e2e/_devtools/access.bdd.md

@@ -0,0 +1,262 @@
+---
+feature: DevTools Access Control
+priority: critical
+tags: [dev-area, access-control, security, roles]
+grepTags: [uat, feat-dev-area, smoke, regression]
+coverage: 7
+---
+
+# DevTools Access Control
+
+> Role-based access control tests for the /devtools area. Validates that Developer users can access all /devtools routes and /admin, while Superadmin and Member users are blocked.
+
+## @test ACCESS-001: Developer can access /devtools
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** developer, access, home
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Developer can access /devtools home page
+
+Given I am logged in as Developer (developer@nextspark.dev)
+When I visit /devtools
+Then I should be on /devtools home page
+And the home page container should be visible
+```
+
+```gherkin:es
+Scenario: Developer puede acceder a /devtools home page
+
+Given estoy logueado como Developer (developer@nextspark.dev)
+When visito /devtools
+Then deberia estar en /devtools home page
+And el contenedor de home page deberia estar visible
+```
+
+### Expected Results
+- Developer successfully accesses /devtools
+- Home page renders correctly
+- No access denied errors
+
+---
+
+## @test ACCESS-002: Developer can access /devtools/style
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** developer, access, style-gallery
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Developer can access Style Gallery
+
+Given I am logged in as Developer (developer@nextspark.dev)
+When I visit /devtools/style
+Then the URL should include /devtools/style
+And the style page should be visible
+```
+
+```gherkin:es
+Scenario: Developer puede acceder a Style Gallery
+
+Given estoy logueado como Developer (developer@nextspark.dev)
+When visito /devtools/style
+Then la URL deberia incluir /devtools/style
+And la pagina de estilos deberia estar visible
+```
+
+### Expected Results
+- Style Gallery page loads successfully
+- All component sections available
+
+---
+
+## @test ACCESS-003: Developer can access /devtools/tests
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** developer, access, test-cases
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Developer can access Test Cases viewer
+
+Given I am logged in as Developer (developer@nextspark.dev)
+When I visit /devtools/tests
+Then the URL should include /devtools/tests
+And the tests page should be visible
+```
+
+```gherkin:es
+Scenario: Developer puede acceder al visor de Test Cases
+
+Given estoy logueado como Developer (developer@nextspark.dev)
+When visito /devtools/tests
+Then la URL deberia incluir /devtools/tests
+And la pagina de tests deberia estar visible
+```
+
+### Expected Results
+- Test Cases viewer loads successfully
+- File tree or empty state visible
+
+---
+
+## @test ACCESS-004: Developer can access /devtools/config
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** developer, access, config
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Developer can access Config Viewer
+
+Given I am logged in as Developer (developer@nextspark.dev)
+When I visit /devtools/config
+Then the URL should include /devtools/config
+And the config page should be visible
+```
+
+```gherkin:es
+Scenario: Developer puede acceder al Config Viewer
+
+Given estoy logueado como Developer (developer@nextspark.dev)
+When visito /devtools/config
+Then la URL deberia incluir /devtools/config
+And la pagina de config deberia estar visible
+```
+
+### Expected Results
+- Config Viewer loads successfully
+- Theme and Entities tabs available
+
+---
+
+## @test ACCESS-005: Developer can access /admin (inherited)
+
+### Metadata
+- **Priority:** High
+- **Type:** Regression
+- **Tags:** developer, admin, inherited
+
+```gherkin:en
+Scenario: Developer can access Admin area
+
+Given I am logged in as Developer (developer@nextspark.dev)
+When I visit /admin
+Then the URL should include /admin
+And the Admin container should be visible
+```
+
+```gherkin:es
+Scenario: Developer puede acceder al area Admin
+
+Given estoy logueado como Developer (developer@nextspark.dev)
+When visito /admin
+Then la URL deberia incluir /admin
+And el contenedor de Admin deberia estar visible
+```
+
+### Expected Results
+- Developer inherits superadmin privileges for Admin
+- Admin control panel accessible
+- No access denied redirect
+
+---
+
+## @test ACCESS-006: Superadmin is BLOCKED from /devtools
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** superadmin, blocked, security
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Superadmin is redirected when attempting to access /devtools
+
+Given I am logged in as Superadmin (superadmin@nextspark.dev)
+When I attempt to visit /devtools
+Then I should be redirected to /dashboard
+And the URL should include error=access_denied
+```
+
+```gherkin:es
+Scenario: Superadmin es redirigido al intentar acceder a /devtools
+
+Given estoy logueado como Superadmin (superadmin@nextspark.dev)
+When intento visitar /devtools
+Then deberia ser redirigido a /dashboard
+And la URL deberia incluir error=access_denied
+```
+
+### Expected Results
+- Superadmin cannot access /devtools area
+- Redirect to dashboard with error parameter
+- Access control working correctly
+
+---
+
+## @test ACCESS-007: Member is BLOCKED from /devtools
+
+### Metadata
+- **Priority:** Critical
+- **Type:** Smoke
+- **Tags:** member, blocked, security
+- **Grep:** `@smoke`
+
+```gherkin:en
+Scenario: Member is redirected when attempting to access /devtools
+
+Given I am logged in as Member (emily.johnson@nextspark.dev)
+When I attempt to visit /devtools
+Then I should be redirected to /dashboard
+And the URL should include error=access_denied
+```
+
+```gherkin:es
+Scenario: Member es redirigido al intentar acceder a /devtools
+
+Given estoy logueado como Member (emily.johnson@nextspark.dev)
+When intento visitar /devtools
+Then deberia ser redirigido a /dashboard
+And la URL deberia incluir error=access_denied
+```
+
+### Expected Results
+- Member cannot access /devtools area
+- Redirect to dashboard with error parameter
+- Access control working correctly
+
+---
+
+## UI Elements
+
+| Element | Selector | Description |
+|---------|----------|-------------|
+| Home Page | `[data-cy="dev-home-page"]` | Dev area home page container |
+| Style Page | `[data-cy="dev-style-page"]` | Style Gallery page container |
+| Tests Page | `[data-cy="dev-tests-page"]` | Test Cases viewer container |
+| Config Page | `[data-cy="dev-config-page"]` | Config Viewer page container |
+| Admin Container | `[data-cy="admin-container"]` | Admin main container |
+
+---
+
+## Summary
+
+| Test ID | Block | Description | Tags |
+|---------|-------|-------------|------|
+| ACCESS-001 | Developer Access | Developer can access /devtools home | `@smoke` |
+| ACCESS-002 | Developer Access | Developer can access /devtools/style | `@smoke` |
+| ACCESS-003 | Developer Access | Developer can access /devtools/tests | `@smoke` |
+| ACCESS-004 | Developer Access | Developer can access /devtools/config | `@smoke` |
+| ACCESS-005 | Inherited Access | Developer can access /admin | |
+| ACCESS-006 | Blocked Access | Superadmin BLOCKED from /devtools | `@smoke` |
+| ACCESS-007 | Blocked Access | Member BLOCKED from /devtools | `@smoke` |

package/tests/cypress/e2e/_devtools/access.cy.ts

@@ -0,0 +1,171 @@
+/// <reference types="cypress" />
+
+import * as allure from 'allure-cypress'
+import { DevtoolsPOM } from '../../src/features/DevtoolsPOM'
+import {
+  loginAsDefaultDeveloper,
+  loginAsDefaultSuperadmin,
+  loginAsDefaultMember,
+  CORE_USERS
+} from '../../src/session-helpers'
+
+/**
+ * DevTools Access Control Tests
+ *
+ * Tests the role-based access control for the /devtools area:
+ * - Developer users can access all /devtools routes
+ * - Developer users can access /admin (inherited privileges)
+ * - Superadmin users are BLOCKED from /devtools
+ * - Member users are BLOCKED from /devtools
+ *
+ * Test Users (from session-helpers):
+ * - Developer: developer@nextspark.dev (CORE_USERS.DEVELOPER)
+ * - Superadmin: superadmin@nextspark.dev (CORE_USERS.SUPERADMIN)
+ * - Member: emily.johnson@nextspark.dev (DEFAULT_THEME_USERS.MEMBER)
+ */
+
+describe('DevTools - Access Control', {
+  tags: ['@uat', '@feat-devtools', '@smoke', '@regression']
+}, () => {
+  const devtools = DevtoolsPOM.create()
+
+  beforeEach(() => {
+    allure.epic('UAT')
+    allure.feature('DevTools')
+    allure.story('Access Control')
+  })
+
+  describe('ACCESS-001: Developer can access /devtools', { tags: '@smoke' }, () => {
+    it('should allow developer to access /devtools home page', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit /devtools
+      devtools.visitHome()
+
+      // 3. Verify access granted
+      devtools.assertOnDevtoolsHome()
+      devtools.assertHomePageVisible()
+
+      cy.log(`✅ Developer (${CORE_USERS.DEVELOPER}) can access /devtools home page`)
+    })
+  })
+
+  describe('ACCESS-002: Developer can access /devtools/style', { tags: '@smoke' }, () => {
+    it('should allow developer to access Style Gallery', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit /devtools/style
+      devtools.visitStyleGallery()
+
+      // 3. Verify access granted
+      devtools.assertOnStyleGallery()
+      devtools.assertStylePageVisible()
+
+      cy.log(`✅ Developer can access /devtools/style`)
+    })
+  })
+
+  describe('ACCESS-003: Developer can access /devtools/tests', { tags: '@smoke' }, () => {
+    it('should allow developer to access Test Cases viewer', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit /devtools/tests
+      devtools.visitTestCases()
+
+      // 3. Verify access granted
+      devtools.assertOnTestCases()
+      devtools.assertTestsPageVisible()
+
+      cy.log(`✅ Developer can access /devtools/tests`)
+    })
+  })
+
+  describe('ACCESS-004: Developer can access /devtools/config', { tags: '@smoke' }, () => {
+    it('should allow developer to access Config Viewer', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit /devtools/config
+      devtools.visitConfig()
+
+      // 3. Verify access granted
+      devtools.assertOnConfig()
+      devtools.assertConfigPageVisible()
+
+      cy.log(`✅ Developer can access /devtools/config`)
+    })
+  })
+
+  describe('ACCESS-005: Developer can access /superadmin (inherited)', () => {
+    it('should allow developer to access Superadmin area', () => {
+      allure.severity('high')
+
+      // 1. Login as developer
+      loginAsDefaultDeveloper()
+
+      // 2. Visit /superadmin
+      cy.visit('/superadmin')
+
+      // 3. Verify access granted (developer inherits superadmin privileges)
+      devtools.assertOnSuperadmin()
+      cy.get('[data-cy="superadmin-container"]').should('be.visible')
+
+      cy.log(`✅ Developer can access /superadmin (inherited superadmin privileges)`)
+    })
+  })
+
+  describe('ACCESS-006: Superadmin is BLOCKED from /devtools', { tags: '@smoke' }, () => {
+    it('should redirect superadmin to /dashboard when attempting to access /devtools', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as superadmin
+      loginAsDefaultSuperadmin()
+
+      // 2. Attempt to visit /devtools (should be blocked)
+      cy.visit('/devtools', { failOnStatusCode: false })
+
+      // 3. Verify redirected to /dashboard (access denied)
+      devtools.assertRedirectedToDashboard()
+
+      // 4. Should show access_denied error in URL
+      cy.url().should('include', 'error=access_denied')
+
+      cy.log(`✅ Superadmin (${CORE_USERS.SUPERADMIN}) correctly blocked from /devtools`)
+    })
+  })
+
+  describe('ACCESS-007: Member is BLOCKED from /devtools', { tags: '@smoke' }, () => {
+    it('should redirect member to /dashboard when attempting to access /devtools', { tags: '@smoke' }, () => {
+      allure.severity('critical')
+
+      // 1. Login as member
+      loginAsDefaultMember()
+
+      // 2. Attempt to visit /devtools (should be blocked)
+      cy.visit('/devtools', { failOnStatusCode: false })
+
+      // 3. Verify redirected to /dashboard (access denied)
+      devtools.assertRedirectedToDashboard()
+
+      // 4. Should show access_denied error in URL
+      cy.url().should('include', 'error=access_denied')
+
+      cy.log(`✅ Member correctly blocked from /devtools`)
+    })
+  })
+
+  after(() => {
+    cy.log('✅ DevTools access control tests completed')
+  })
+})