@tuturuuu/utils 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## [0.21.0](https://github.com/tutur3u/platform/compare/utils-v0.20.0...utils-v0.21.0) (2026-07-28)
+
+
+### Features
+
+* **git:** add fast repository satellite ([51982ae](https://github.com/tutur3u/platform/commit/51982ae8618bb7463e30c97f6e731551ec673660))
+
+
+### Bug Fixes
+
+* **workspaces:** preserve creator administration access ([cea32ea](https://github.com/tutur3u/platform/commit/cea32ea22acaae6be6e39552be4af47e6f4dcdc7))
+
+## [0.20.0](https://github.com/tutur3u/platform/compare/utils-v0.19.0...utils-v0.20.0) (2026-07-27)
+
+
+### Features
+
+* **ai:** add workspace AI Studio and legal coverage ([6de4e39](https://github.com/tutur3u/platform/commit/6de4e395cc5568f4943604ac667e3cebf324be13))
+* **apps:** unify and redesign app catalog ([b679068](https://github.com/tutur3u/platform/commit/b679068339143a83b38610f363bec7f53ddc3706))
+* **contacts:** migrate users attendance; add satellite-safe workspace-user link helper ([8f53453](https://github.com/tutur3u/platform/commit/8f534533793af8d25e7c2eca6e0147e459d78bbe))
+* **contacts:** migrate users topic-announcements module ([01e19ab](https://github.com/tutur3u/platform/commit/01e19ab60461ccd94a0374bed74ce6e4d5d38a3b))
+* **forms:** merge satellite migration ([e739f1b](https://github.com/tutur3u/platform/commit/e739f1bead568905458a42373ae24d13cd778907))
+* **forms:** migrate product to satellite app ([51b9392](https://github.com/tutur3u/platform/commit/51b93928f1a12ebd4f4c753595fb33902ebfa66c))
+* **infrastructure:** manage internal accounts ([02fd9f3](https://github.com/tutur3u/platform/commit/02fd9f3d1b4edb23c881e2dbb04bf244b36e6ed0))
+* **inventory:** secure Square POS event checkout ([532b463](https://github.com/tutur3u/platform/commit/532b46372116ee0bebfd83ba2af762cc9f668c3c))
+* **offline:** own service worker runtime and refresh dependencies ([ae44477](https://github.com/tutur3u/platform/commit/ae44477603c39f0513244514771653287338a89f))
+* **reports:** add periodic reporting automation ([ec7bd5e](https://github.com/tutur3u/platform/commit/ec7bd5e10abb137e217d1dcf143624530276392f))
+* **seo:** improve discovery metadata ([a574409](https://github.com/tutur3u/platform/commit/a57440984df45086c4989db07b02d402dd93c828))
+* **seo:** improve discovery metadata ([8e2420d](https://github.com/tutur3u/platform/commit/8e2420d49e7b94c462d92222ea8f239ab92564f6))
+* **seo:** improve page metadata ([0c621cb](https://github.com/tutur3u/platform/commit/0c621cb7fc1253b0a11ea21992503274052c6be0))
+* **seo:** standardize app metadata ([6523d91](https://github.com/tutur3u/platform/commit/6523d91fedf38e19804d10ea3b82890db180bc6f))
+
+
+### Bug Fixes
+
+* **chat:** harden personal Zalo integration ([f1d12c6](https://github.com/tutur3u/platform/commit/f1d12c60fe12ab3b01a1be3f0381573d44a32226))
+* **ci:** keep task helper collection source-only ([7355a05](https://github.com/tutur3u/platform/commit/7355a05385ccd8d1e2d1bcf6ac15ae5297e057ad))
+* **contacts:** restore group post mutations ([fe621e4](https://github.com/tutur3u/platform/commit/fe621e4d7e4126f705082cc3e815aafdeebe535a))
+* **e2e:** run tasks lifecycle in CI ([bed2cd5](https://github.com/tutur3u/platform/commit/bed2cd590572748f65e75fcb15b7e4b714b9034c))
+* **inventory:** harden sales analytics and access ([53968d3](https://github.com/tutur3u/platform/commit/53968d38a0c5425a3c1065ab2f645e30a0145c8f))
+* **mobile:** preserve bearer auth across satellites ([f890170](https://github.com/tutur3u/platform/commit/f89017044cf3aaaa6a1b15c31c64a81d75cfdab2))
+* resolve code quality findings ([63f10b5](https://github.com/tutur3u/platform/commit/63f10b5ec22a4194f48f448ee2b1b088b5da8f08))
+* **security:** prevent clickjacking across apps ([c8ed36e](https://github.com/tutur3u/platform/commit/c8ed36e708c08ebe3b17ee7f6249513644108c48))
+* **security:** remediate code scanning findings ([023db2e](https://github.com/tutur3u/platform/commit/023db2edf4b0557be108a9d772cbc7e2223af947))
+
+
+### Performance Improvements
+
+* **ci:** enable repository-wide remote caching ([6250f91](https://github.com/tutur3u/platform/commit/6250f91d745ef987a4fc86c797aedf41542f421b))
+* **storefront:** share customer navigation shell ([21cb78d](https://github.com/tutur3u/platform/commit/21cb78db484d1e1fdb9f2469fcac4e3a948bd176))
+
 ## [0.19.0](https://github.com/tutur3u/platform/compare/utils-v0.18.0...utils-v0.19.0) (2026-07-27)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.28.0",
     "@tuturuuu/google": "0.1.0",
     "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.23.0",
+    "@tuturuuu/internal-api": "0.25.0",
     "@tuturuuu/supabase": "0.5.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -45,7 +45,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.22.0",
+    "@tuturuuu/types": "0.24.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.1.1",

package/src/__tests__/app-url.test.ts

@@ -298,6 +298,7 @@ describe('Portless app origin registry', () => {
       'https://external.tuturuuu.localhost',
       'https://finance.tuturuuu.localhost',
       'https://forms.tuturuuu.localhost',
+      'https://git.tuturuuu.localhost',
       'https://hive.tuturuuu.localhost',
       'https://realtime.hive.tuturuuu.localhost',
       'https://infra.tuturuuu.localhost',

package/src/__tests__/permissions.test.tsx

@@ -32,6 +32,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).not.toContain('view_infrastructure');
     expect(permissionIds).not.toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).not.toContain('manage_internal_accounts');
+    expect(permissionIds).not.toContain('manage_git_repositories');
     expect(permissionIds).not.toContain('manage_workspace_secrets');
   });
 
@@ -42,6 +43,7 @@ describe('workspace permission catalog', () => {
     }).map((permission) => permission.id);
 
     expect(rootPermissionIds).toContain('manage_internal_accounts');
+    expect(rootPermissionIds).toContain('manage_git_repositories');
   });
 
   it('keeps internal account permission translations in shared role editors', () => {
@@ -75,6 +77,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).toContain('view_infrastructure');
     expect(permissionIds).toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).toContain('manage_internal_accounts');
+    expect(permissionIds).toContain('manage_git_repositories');
     expect(permissionIds).toContain('manage_external_migrations');
     expect(permissionIds).toContain('manage_workspace_secrets');
     expect(new Set(permissionIds).size).toBe(permissionIds.length);

package/src/__tests__/workspace-helper.test.ts

@@ -560,24 +560,153 @@ describe('getPermissions membership type gate', () => {
     expect(adminAuthGetUser).not.toHaveBeenCalled();
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith('personal', true);
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith(
-      'workspace_members.user_id',
+      'creator_id',
       'user-1'
     );
     expect(membershipQuery.eq).toHaveBeenCalledWith(
       'ws_id',
       personalWorkspaceId
     );
-    expect(roleMembersQuery.eq).toHaveBeenCalledWith(
-      'workspace_roles.ws_id',
-      personalWorkspaceId
-    );
     expect(workspaceQuery.eq).toHaveBeenCalledWith('id', personalWorkspaceId);
-    expect(defaultPermissionsQuery.eq).toHaveBeenCalledWith(
-      'ws_id',
-      personalWorkspaceId
+    expect(roleMembersQuery.select).not.toHaveBeenCalled();
+    expect(defaultPermissionsQuery.select).not.toHaveBeenCalled();
+  });
+
+  it('grants full member permissions to a creator with a missing membership row', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_settings')).toBe(
+      true
+    );
+    expect(permissions?.containsPermission('manage_workspace_members')).toBe(
+      true
+    );
+  });
+
+  it('normalizes a creator GUEST membership to effective MEMBER permissions', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: { type: 'GUEST' },
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_roles')).toBe(
+      true
     );
   });
 
+  it('denies an unrelated user when the membership row is missing', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'owner-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'unrelated@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions).toBeNull();
+  });
+
   it('returns a read-only permission context for a guest without defaults', async () => {
     const membershipQuery = {
       select: vi.fn(),

package/src/internal-domains.ts

@@ -116,6 +116,10 @@ export const PRODUCTION_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'https://forms.tuturuuu.com',
   },
+  {
+    name: 'git',
+    url: 'https://git.tuturuuu.com',
+  },
   {
     name: 'hive',
     url: 'https://hive.tuturuuu.com',
@@ -231,6 +235,10 @@ export const PORTLESS_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: getTuturuuuPortlessAppOrigin('forms'),
   },
+  {
+    name: 'git',
+    url: getTuturuuuPortlessAppOrigin('git'),
+  },
   {
     name: 'hive',
     url: getTuturuuuPortlessAppOrigin('hive'),
@@ -342,6 +350,10 @@ export const LOCALHOST_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'http://localhost:7828',
   },
+  {
+    name: 'git',
+    url: 'http://localhost:7830',
+  },
   {
     name: 'hive',
     url: 'http://localhost:7814',

package/src/launchable-apps.test.ts

@@ -32,6 +32,7 @@ describe('launchable apps', () => {
     });
     expect(getLaunchableAppByTitle('Tuturuuu')?.slug).toBe('platform');
     expect(getLaunchableAppByTitle('questionnaires')?.slug).toBe('forms');
+    expect(getLaunchableAppByTitle('repositories')?.slug).toBe('git');
     expect(getLaunchableAppByTitle('apps gateway')?.slug).toBe('apps');
   });
 
@@ -45,6 +46,11 @@ describe('launchable apps', () => {
     expect(getLaunchableApp('external')).toBeNull();
     expect(getLaunchableApp('playground')).toBeNull();
     expect(getLaunchableApp('platform')?.category).toBe('productivity');
+    expect(getLaunchableApp('git')).toMatchObject({
+      defaultPath: '/tutur3u/platform',
+      localhostOrigin: 'http://localhost:7830',
+      productionUrl: 'https://git.tuturuuu.com',
+    });
     expect(getLaunchableApp('apps')?.category).toBe('miscellaneous');
     expect(getLaunchableApp('cms')?.category).toBe('operations');
     expect(getLaunchableApp('rewise')?.category).toBe('ai');

package/src/launchable-apps.ts

@@ -113,6 +113,18 @@ export const LAUNCHABLE_APPS = [
     title: 'Drive',
     workspacePathResolver: workspaceRootPath,
   },
+  {
+    aliases: ['Source', 'Repositories', 'GitHub', 'Code'],
+    appRoot: 'apps/git',
+    category: 'productivity',
+    defaultPath: '/tutur3u/platform',
+    localhostOrigin: 'http://localhost:7830',
+    packageName: '@tuturuuu/git',
+    portlessApp: 'git',
+    productionUrl: 'https://git.tuturuuu.com',
+    slug: 'git',
+    title: 'Git',
+  },
   {
     aliases: ['App Launcher', 'Gateway', 'Apps Gateway'],
     appRoot: 'apps/apps',

package/src/permissions.tsx

@@ -19,6 +19,7 @@ import {
   FileKey2,
   FileText,
   FlaskConical,
+  GitBranch,
   HandCoins,
   HardDrive,
   House,
@@ -131,6 +132,16 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
+                {
+                  id: 'manage_git_repositories' as PermissionId,
+                  icon: <GitBranch />,
+                  title: t('ws-roles.manage_git_repositories'),
+                  description: t(
+                    'ws-roles.manage_git_repositories_description'
+                  ),
+                  disableOnProduction: false,
+                  disabled: false,
+                },
                 {
                   id: 'manage_mobile_deployment_vault' as PermissionId,
                   icon: <FileKey2 />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.28.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.30.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.28.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.30.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/portless.ts

@@ -17,6 +17,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   external: `https://external.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   finance: `https://finance.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   forms: `https://forms.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  git: `https://git.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   hive: `https://hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   'hive-realtime': `https://realtime.hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   infra: `https://infra.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/workspace-helper.ts

@@ -689,19 +689,32 @@ async function resolveWorkspaceIdForPermissions({
     return normalizeWorkspaceId(wsId, authorizationClient);
   }
 
-  const { data: workspace, error } = await authorizationClient
-    .from('workspaces')
-    .select('id, workspace_members!inner(user_id, type)')
-    .eq('personal', true)
-    .eq('workspace_members.user_id', principal.id)
-    .eq('workspace_members.type', 'MEMBER')
-    .maybeSingle();
+  const { data: creatorWorkspace, error: creatorWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id')
+      .eq('personal', true)
+      .eq('creator_id', principal.id)
+      .maybeSingle();
+
+  if (!creatorWorkspaceError && creatorWorkspace?.id) {
+    return creatorWorkspace.id;
+  }
 
-  if (error || !workspace?.id) {
+  const { data: memberWorkspace, error: memberWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id, workspace_members!inner(user_id, type)')
+      .eq('personal', true)
+      .eq('workspace_members.user_id', principal.id)
+      .eq('workspace_members.type', 'MEMBER')
+      .maybeSingle();
+
+  if (memberWorkspaceError || !memberWorkspace?.id) {
     throw new Error('Personal workspace not found');
   }
 
-  return workspace.id;
+  return memberWorkspace.id;
 }
 
 /**
@@ -761,7 +774,7 @@ async function getPermissionsImpl({
   let resolvedWorkspaceId: string;
   try {
     resolvedWorkspaceId = await resolveWorkspaceIdForPermissions({
-      authorizationClient: authorizationClient as TypedSupabaseClient,
+      authorizationClient: sbAdmin,
       principal,
       wsId,
     });
@@ -769,21 +782,39 @@ async function getPermissionsImpl({
     return null;
   }
 
-  const membership = await verifyWorkspaceMembershipType({
-    wsId: resolvedWorkspaceId,
-    userId,
-    supabase: authorizationClient as TypedSupabaseClient,
-    requiredType: 'ANY',
-  });
+  const [membership, workspaceRes] = await Promise.all([
+    verifyWorkspaceMembershipType({
+      wsId: resolvedWorkspaceId,
+      userId,
+      supabase: authorizationClient as TypedSupabaseClient,
+      requiredType: 'ANY',
+    }),
+    sbAdmin
+      .from('workspaces')
+      .select('creator_id')
+      .eq('id', resolvedWorkspaceId)
+      .single(),
+  ]);
 
-  if (!membership.ok) {
+  const { data: workspaceData, error: workspaceError } = workspaceRes;
+
+  if (workspaceError || !workspaceData) {
+    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
     return null;
   }
 
-  const membershipType = membership.membershipType ?? 'MEMBER';
+  const isCreator = workspaceData.creator_id === userId;
+
+  if (!isCreator && !membership.ok) {
+    return null;
+  }
+
+  const membershipType = isCreator
+    ? 'MEMBER'
+    : (membership.membershipType ?? 'MEMBER');
 
   const permissionsQuery =
-    membershipType === 'MEMBER'
+    membershipType === 'MEMBER' && !isCreator
       ? sbAdmin
           .from('workspace_role_members')
           .select(
@@ -794,40 +825,26 @@ async function getPermissionsImpl({
           .eq('workspace_roles.workspace_role_permissions.enabled', true)
       : Promise.resolve({ data: [], error: null });
 
-  const workspaceQuery = sbAdmin
-    .from('workspaces')
-    .select('creator_id')
-    .eq('id', resolvedWorkspaceId)
-    .single();
+  const defaultQuery = isCreator
+    ? Promise.resolve({ data: [], error: null })
+    : sbAdmin
+        .from('workspace_default_permissions')
+        .select('permission')
+        .eq('ws_id', resolvedWorkspaceId)
+        .eq('member_type', membershipType)
+        .eq('enabled', true);
 
-  const defaultQuery = sbAdmin
-    .from('workspace_default_permissions')
-    .select('permission')
-    .eq('ws_id', resolvedWorkspaceId)
-    .eq('member_type', membershipType)
-    .eq('enabled', true);
-
-  const [permissionsRes, workspaceRes, defaultRes] = await Promise.all([
+  const [permissionsRes, defaultRes] = await Promise.all([
     permissionsQuery,
-    workspaceQuery,
     defaultQuery,
   ]);
 
   const { data: permissionsData, error: permissionsError } = permissionsRes;
-  const { data: workspaceData, error: workspaceError } = workspaceRes;
   const { data: defaultData, error: defaultError } = defaultRes;
 
-  if (!workspaceData) {
-    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
-    return null;
-  }
-
   if (permissionsError) return null;
-  if (workspaceError) return null;
   if (defaultError) return null;
 
-  const isCreator =
-    membershipType === 'MEMBER' && workspaceData.creator_id === userId;
   // if (DEV_MODE) {
   //   console.log('--------------------');
   //   console.log('Is creator', isCreator);