@tuturuuu/utils 0.12.1 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # Changelog
 
+## [0.15.0](https://github.com/tutur3u/platform/compare/utils-v0.14.0...utils-v0.15.0) (2026-07-11)
+
+
+### Features
+
+* **contacts:** migrate users attendance; add satellite-safe workspace-user link helper ([8f53453](https://github.com/tutur3u/platform/commit/8f534533793af8d25e7c2eca6e0147e459d78bbe))
+* **contacts:** migrate users topic-announcements module ([01e19ab](https://github.com/tutur3u/platform/commit/01e19ab60461ccd94a0374bed74ce6e4d5d38a3b))
+* **contacts:** scaffold contacts.tuturuuu.com satellite shell + monorepo registration ([7e335fc](https://github.com/tutur3u/platform/commit/7e335fc036c4a45ed189095ecd10a43ee002294b))
+* **infrastructure:** add abuse protection controls ([0e09692](https://github.com/tutur3u/platform/commit/0e09692a553cb10fbbb521e921951c2a6863281d))
+* **infrastructure:** add rate-limit appeals ([f1e50e9](https://github.com/tutur3u/platform/commit/f1e50e9fd805dca6c80da8daab60ed24199f24ab))
+* **pay:** scaffold apps/pay satellite (pay.tuturuuu.com, port 7826) ([3d6e45c](https://github.com/tutur3u/platform/commit/3d6e45cca6a315fe67213e438144b73103bae2f5))
+* **tools:** add apps/tools public tools app, remove apps/qr ([204aae8](https://github.com/tutur3u/platform/commit/204aae89a04b4163f2859561f8e832526642e271))
+
+
+### Bug Fixes
+
+* **auth:** share account preference cookies ([8c1848a](https://github.com/tutur3u/platform/commit/8c1848a941c1b3f91337104c975e4bc0d8f68fc9))
+* **ci:** keep cache components enabled in production ([75e6e2b](https://github.com/tutur3u/platform/commit/75e6e2bbbf6fa432bc496ee95b75ade5f8847f9f))
+* **cli:** preserve markdown tables in task descriptions ([9faf8ba](https://github.com/tutur3u/platform/commit/9faf8ba44b92565a9dfc2949c496654fc1fea9b3))
+* **infrastructure:** default docker web to native builds ([7d89f00](https://github.com/tutur3u/platform/commit/7d89f004f75ab12eddc3cb92df5a1e6a7255fe0d))
+* **infrastructure:** restore canonical auth host access ([9f6715f](https://github.com/tutur3u/platform/commit/9f6715fb1c5a89598556cba33b16938b76995fc6))
+* restore apps launcher categories ([5c5b571](https://github.com/tutur3u/platform/commit/5c5b571ce920013bcfa5f327c4bb208ea9fbf23e))
+* **satellite:** widen apps launcher grid ([90e3106](https://github.com/tutur3u/platform/commit/90e31066830f535a7fdd0f7bc249e5bc8b273cfc))
+* **security:** limit auth recovery code attempts ([72d454c](https://github.com/tutur3u/platform/commit/72d454c507b0d4b7e69c7b38ad2099dbb83193b2))
+* **tasks:** route native personal task moves normally ([5bbba3c](https://github.com/tutur3u/platform/commit/5bbba3c3f193e722cc87cdfe2eb2734f61442cd0))
+* update launchable app catalog ([cb31207](https://github.com/tutur3u/platform/commit/cb312076aee227de9a8f99105d681911d14a63ac))
+* **web:** fail open without redis ([74bfcc7](https://github.com/tutur3u/platform/commit/74bfcc7ea5f188a56f49802c6a48bde0b109e02d))
+
+
+### Performance Improvements
+
+* **ci:** enable repository-wide remote caching ([6250f91](https://github.com/tutur3u/platform/commit/6250f91d745ef987a4fc86c797aedf41542f421b))
+
+## [0.14.0](https://github.com/tutur3u/platform/compare/utils-v0.13.0...utils-v0.14.0) (2026-07-11)
+
+
+### Features
+
+* **contacts:** migrate users attendance; add satellite-safe workspace-user link helper ([8f53453](https://github.com/tutur3u/platform/commit/8f534533793af8d25e7c2eca6e0147e459d78bbe))
+* **contacts:** migrate users topic-announcements module ([01e19ab](https://github.com/tutur3u/platform/commit/01e19ab60461ccd94a0374bed74ce6e4d5d38a3b))
+* **contacts:** scaffold contacts.tuturuuu.com satellite shell + monorepo registration ([7e335fc](https://github.com/tutur3u/platform/commit/7e335fc036c4a45ed189095ecd10a43ee002294b))
+* **pay:** scaffold apps/pay satellite (pay.tuturuuu.com, port 7826) ([3d6e45c](https://github.com/tutur3u/platform/commit/3d6e45cca6a315fe67213e438144b73103bae2f5))
+
+
+### Bug Fixes
+
+* **auth:** share account preference cookies ([8c1848a](https://github.com/tutur3u/platform/commit/8c1848a941c1b3f91337104c975e4bc0d8f68fc9))
+* restore apps launcher categories ([5c5b571](https://github.com/tutur3u/platform/commit/5c5b571ce920013bcfa5f327c4bb208ea9fbf23e))
+* **satellite:** widen apps launcher grid ([90e3106](https://github.com/tutur3u/platform/commit/90e31066830f535a7fdd0f7bc249e5bc8b273cfc))
+* update launchable app catalog ([cb31207](https://github.com/tutur3u/platform/commit/cb312076aee227de9a8f99105d681911d14a63ac))
+
+
+### Performance Improvements
+
+* **ci:** enable repository-wide remote caching ([6250f91](https://github.com/tutur3u/platform/commit/6250f91d745ef987a4fc86c797aedf41542f421b))
+
+## [0.13.0](https://github.com/tutur3u/platform/compare/utils-v0.12.1...utils-v0.13.0) (2026-07-05)
+
+
+### Features
+
+* **tools:** add apps/tools public tools app, remove apps/qr ([204aae8](https://github.com/tutur3u/platform/commit/204aae89a04b4163f2859561f8e832526642e271))
+
+
+### Bug Fixes
+
+* **tasks:** route native personal task moves normally ([5bbba3c](https://github.com/tutur3u/platform/commit/5bbba3c3f193e722cc87cdfe2eb2734f61442cd0))
+* **web:** fail open without redis ([74bfcc7](https://github.com/tutur3u/platform/commit/74bfcc7ea5f188a56f49802c6a48bde0b109e02d))
+
 ## [0.12.1](https://github.com/tutur3u/platform/compare/utils-v0.12.0...utils-v0.12.1) (2026-07-03)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.3/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.12.1",
+  "version": "0.15.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -20,11 +20,11 @@
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
     "@tanstack/react-query": "^5.101.2",
-    "@tiptap/core": "3.27.1",
-    "@tiptap/react": "3.27.1",
+    "@tiptap/core": "3.27.3",
+    "@tiptap/react": "3.27.3",
     "@tuturuuu/google": "0.0.3",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.14.0",
+    "@tuturuuu/internal-api": "0.17.0",
     "@tuturuuu/supabase": "0.4.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -35,7 +35,7 @@
     "effect": "^3.21.4",
     "moment": "^2.30.1",
     "next": "^16.3.0-preview.5",
-    "prosemirror-model": "^1.25.9",
+    "prosemirror-model": "^1.25.11",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "tailwind-merge": "^3.6.0",
@@ -45,15 +45,15 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.14.0",
+    "@tuturuuu/types": "0.16.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
-    "@types/node": "^26.0.1",
+    "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@vitejs/plugin-react": "^6.0.3",
-    "typescript": "7.0.1-rc",
-    "vite": "^8.1.2",
-    "vitest": "^4.1.9"
+    "typescript": "7.0.2",
+    "vite": "^8.1.4",
+    "vitest": "^4.1.10"
   },
   "exports": {
     "./timezones": "./src/timezones.json",

package/src/__tests__/api-proxy-guard.test.ts

@@ -278,6 +278,36 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).toHaveBeenCalled();
   });
 
+  it('skips proxy route buckets when Redis is not configured', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 1,
+      remaining: 0,
+      reset: Date.now() + 60_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'GET'),
+      {
+        prefixBase: 'proxy:test:api',
+        routePolicies: singleReadRoutePolicies(),
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.redis).not.toHaveBeenCalled();
+    expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalled();
+  });
+
   it('allows a blocked IP to submit the rate-limit appeal endpoint only', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1186,7 +1216,7 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).not.toHaveBeenCalled();
   });
 
-  it('uses local rate limits when the Redis rate limiter is unreachable', async () => {
+  it('skips proxy route buckets when the Redis rate limiter is unreachable', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv(
       'UPSTASH_REDIS_REST_URL',
@@ -1196,7 +1226,7 @@ describe('guardApiProxyRequest', () => {
     mocks.redis.mockReturnValue({});
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockRejectedValueOnce(new TypeError('fetch failed'));
+    mocks.limit.mockRejectedValue(new TypeError('fetch failed'));
     mocks.validateEmoji.mockResolvedValue(null);
 
     const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
@@ -1216,22 +1246,17 @@ describe('guardApiProxyRequest', () => {
     expect(response).toBeNull();
     expect(mocks.limit).toHaveBeenCalledTimes(1);
 
-    const blockedResponse = await guardApiProxyRequest(
+    const allowedResponse = await guardApiProxyRequest(
       makeRequest('/api/test', 'GET'),
       options
     );
 
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
-    );
-    expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe(
-      'redis-fallback-test'
-    );
-    expect(mocks.limit).toHaveBeenCalledTimes(1);
+    expect(allowedResponse).toBeNull();
+    expect(mocks.limit).toHaveBeenCalledTimes(2);
+    expect(mocks.validateEmoji).toHaveBeenCalledTimes(2);
   });
 
-  it('uses local rate limits when Redis client initialization fails', async () => {
+  it('skips proxy route buckets when Redis client initialization fails', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -1258,16 +1283,14 @@ describe('guardApiProxyRequest', () => {
 
     expect(response).toBeNull();
 
-    const blockedResponse = await guardApiProxyRequest(
+    const allowedResponse = await guardApiProxyRequest(
       makeRequest('/api/test', 'GET'),
       options
     );
 
-    expect(blockedResponse?.status).toBe(429);
-    expect(blockedResponse?.headers.get('X-Proxy-Block-Reason')).toBe(
-      'route-rate-limit'
-    );
+    expect(allowedResponse).toBeNull();
     expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalledTimes(2);
   });
 
   it('rate limits anonymous users/me reads', async () => {

package/src/__tests__/app-url.test.ts

@@ -231,8 +231,10 @@ describe('getLocalInternalAppUrl', () => {
     ['cms', 'https://cms.tuturuuu.localhost'],
     ['calendar', 'https://calendar.tuturuuu.localhost'],
     ['chat', 'https://chat.tuturuuu.localhost'],
+    ['docs', 'https://docs.tuturuuu.localhost'],
     ['drive', 'https://drive.tuturuuu.localhost'],
     ['qr', 'https://qr.tuturuuu.localhost'],
+    ['tools', 'https://tools.tuturuuu.localhost'],
     ['nova', 'https://nova.tuturuuu.localhost'],
     ['rewise', 'https://rewise.tuturuuu.localhost'],
     ['tasks', 'https://tasks.tuturuuu.localhost'],
@@ -289,6 +291,8 @@ describe('Portless app origin registry', () => {
       'https://calendar.tuturuuu.localhost',
       'https://chat.tuturuuu.localhost',
       'https://cms.tuturuuu.localhost',
+      'https://contacts.tuturuuu.localhost',
+      'https://docs.tuturuuu.localhost',
       'https://drive.tuturuuu.localhost',
       'https://external.tuturuuu.localhost',
       'https://finance.tuturuuu.localhost',
@@ -301,10 +305,12 @@ describe('Portless app origin registry', () => {
       'https://meet.tuturuuu.localhost',
       'https://mind.tuturuuu.localhost',
       'https://nova.tuturuuu.localhost',
+      'https://pay.tuturuuu.localhost',
       'https://tuturuuu.localhost',
       'https://playground.tuturuuu.localhost',
       'https://qr.tuturuuu.localhost',
       'https://rewise.tuturuuu.localhost',
+      'https://tools.tuturuuu.localhost',
       'https://shortener.tuturuuu.localhost',
       'https://storefront.tuturuuu.localhost',
       'https://tanstack.tuturuuu.localhost',

package/src/__tests__/task-transformers.test.ts

@@ -58,5 +58,26 @@ describe('transformTaskRecord', () => {
     expect(transformed.projects).toEqual([
       { id: 'project-1', name: 'Platform', status: 'active' },
     ]);
+    expect(transformed).toMatchObject({
+      is_personal_external: false,
+      is_personal_external_default: false,
+    });
+  });
+
+  it('preserves explicit personal external flags from API responses', () => {
+    const transformed = transformTaskRecord({
+      id: 'task-1',
+      name: 'Task',
+      list_id: 'list-1',
+      display_number: 1,
+      created_at: '2026-01-01T00:00:00.000Z',
+      is_personal_external: true,
+      is_personal_external_default: true,
+    });
+
+    expect(transformed).toMatchObject({
+      is_personal_external: true,
+      is_personal_external_default: true,
+    });
   });
 });

package/src/abuse-protection/__tests__/index-fail-open.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+describe('abuse protection Redis fail-open behavior', () => {
+  afterEach(() => {
+    vi.doUnmock('../../upstash-rest');
+    vi.doUnmock('@tuturuuu/supabase/next/server');
+    vi.resetModules();
+    vi.restoreAllMocks();
+  });
+
+  it('allows checks and skips persistent IP block lookups when Redis is not configured', async () => {
+    const from = vi.fn(() => ({
+      insert: vi.fn(async () => ({ error: null })),
+    }));
+    const rpc = vi.fn();
+    const createAdminClient = vi.fn(async () => ({ from, rpc }));
+    const getRedis = vi.fn();
+
+    vi.doMock('../../upstash-rest', () => ({
+      getUpstashRestRedisClient: getRedis,
+      hasUpstashRestEnv: () => false,
+    }));
+    vi.doMock('@tuturuuu/supabase/next/server', () => ({
+      createAdminClient,
+    }));
+
+    const { checkPasswordLoginLimit, isIPBlocked, recordPasswordLoginFailure } =
+      await import('../index.js');
+
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+      await recordPasswordLoginFailure('203.0.113.80', 'user@example.com');
+    }
+
+    await expect(isIPBlocked('203.0.113.80')).resolves.toBeNull();
+    await expect(
+      checkPasswordLoginLimit('203.0.113.80', 'user@example.com')
+    ).resolves.toMatchObject({
+      allowed: true,
+    });
+    expect(getRedis).not.toHaveBeenCalled();
+    expect(rpc).not.toHaveBeenCalledWith('get_active_ip_block', {
+      p_ip_address: '203.0.113.80',
+    });
+    expect(from).not.toHaveBeenCalledWith('blocked_ips');
+  });
+
+  it('allows checks and skips counter writes after Redis commands fail', async () => {
+    const from = vi.fn(() => ({
+      insert: vi.fn(async () => ({ error: null })),
+    }));
+    const rpc = vi.fn();
+    const createAdminClient = vi.fn(async () => ({ from, rpc }));
+    const redis = {
+      del: vi.fn(),
+      expire: vi.fn(),
+      get: vi.fn(async () => {
+        throw new Error('redis unavailable');
+      }),
+      incr: vi.fn(async () => {
+        throw new Error('redis unavailable');
+      }),
+      set: vi.fn(),
+      ttl: vi.fn(),
+    };
+
+    vi.doMock('../../upstash-rest', () => ({
+      getUpstashRestRedisClient: async () => redis,
+      hasUpstashRestEnv: () => true,
+    }));
+    vi.doMock('@tuturuuu/supabase/next/server', () => ({
+      createAdminClient,
+    }));
+
+    const { checkPasswordLoginLimit, isIPBlocked, recordPasswordLoginFailure } =
+      await import('../index.js');
+
+    await expect(isIPBlocked('203.0.113.81')).resolves.toBeNull();
+    await expect(
+      checkPasswordLoginLimit('203.0.113.81', 'user@example.com')
+    ).resolves.toMatchObject({
+      allowed: true,
+    });
+    await expect(
+      recordPasswordLoginFailure('203.0.113.81', 'user@example.com')
+    ).resolves.toBeUndefined();
+    expect(redis.expire).not.toHaveBeenCalled();
+    expect(redis.set).not.toHaveBeenCalled();
+    expect(rpc).not.toHaveBeenCalledWith('get_active_ip_block', {
+      p_ip_address: '203.0.113.81',
+    });
+    expect(from).not.toHaveBeenCalledWith('blocked_ips');
+  });
+});

package/src/abuse-protection/__tests__/index.test.ts

@@ -2,7 +2,76 @@
  * Unit tests for OTP Abuse Protection System
  */
 
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => {
+  const store = new Map<string, { expiresAt: number | null; value: unknown }>();
+
+  function getEntry(key: string) {
+    const entry = store.get(key);
+    if (!entry) return null;
+
+    if (entry.expiresAt != null && entry.expiresAt <= Date.now()) {
+      store.delete(key);
+      return null;
+    }
+
+    return entry;
+  }
+
+  return {
+    getRedis: vi.fn(),
+    redis: {
+      del: vi.fn(async (...keys: string[]) => {
+        let deleted = 0;
+        for (const key of keys) {
+          if (store.delete(key)) deleted += 1;
+        }
+        return deleted;
+      }),
+      expire: vi.fn(async (key: string, seconds: number) => {
+        const entry = getEntry(key);
+        if (!entry) return 0;
+        entry.expiresAt = Date.now() + seconds * 1000;
+        return 1;
+      }),
+      get: vi.fn(async <T = unknown>(key: string): Promise<T | null> => {
+        return (getEntry(key)?.value as T | undefined) ?? null;
+      }),
+      incr: vi.fn(async (key: string) => {
+        const entry = getEntry(key);
+        const nextValue =
+          typeof entry?.value === 'number' ? entry.value + 1 : 1;
+        store.set(key, {
+          expiresAt: entry?.expiresAt ?? null,
+          value: nextValue,
+        });
+        return nextValue;
+      }),
+      set: vi.fn(
+        async (key: string, value: unknown, options?: { ex?: number }) => {
+          store.set(key, {
+            expiresAt: options?.ex ? Date.now() + options.ex * 1000 : null,
+            value,
+          });
+          return 'OK';
+        }
+      ),
+      ttl: vi.fn(async (key: string) => {
+        const entry = getEntry(key);
+        if (!entry) return -2;
+        if (entry.expiresAt == null) return -1;
+        return Math.ceil((entry.expiresAt - Date.now()) / 1000);
+      }),
+    },
+    store,
+  };
+});
+
+vi.mock('../../upstash-rest', () => ({
+  getUpstashRestRedisClient: () => mocks.getRedis(),
+  hasUpstashRestEnv: () => true,
+}));
 
 import {
   ABUSE_THRESHOLDS,
@@ -29,6 +98,12 @@ import {
 } from '../index';
 
 describe('abuse-protection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.store.clear();
+    mocks.getRedis.mockResolvedValue(mocks.redis);
+  });
+
   afterEach(() => {
     vi.useRealTimers();
     vi.unstubAllEnvs();