@tuturuuu/utils 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.7.0](https://github.com/tutur3u/platform/compare/utils-v0.6.1...utils-v0.7.0) (2026-06-15)
+
+
+### Features
+
+* **infrastructure:** protect mobile deployment vault ([bea31f2](https://github.com/tutur3u/platform/commit/bea31f2f71de509c5bc5e1b154ba62928ecea9c6))
+* **web:** add external user profile-completion links ([0effeb8](https://github.com/tutur3u/platform/commit/0effeb860f999227f673a55212d2cfd0c822105a))
+
+
+### Bug Fixes
+
+* **users:** keep database search recoverable ([46066aa](https://github.com/tutur3u/platform/commit/46066aac9b281fb8365038193e420a90bb522e88))
+
+## [0.6.1](https://github.com/tutur3u/platform/compare/utils-v0.6.0...utils-v0.6.1) (2026-06-13)
+
+
+### Bug Fixes
+
+* **auth:** allow local portless e2e auth ([928da7d](https://github.com/tutur3u/platform/commit/928da7d75ff72298bd1f0d2af6872e951decae3b))
+* **ui:** make package graph installable ([f3eb0ff](https://github.com/tutur3u/platform/commit/f3eb0ff3cbed2e43fd77dfb8164e60c5d195a36b))
+
 ## [0.6.0](https://github.com/tutur3u/platform/compare/utils-v0.5.1...utils-v0.6.0) (2026-06-11)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -22,9 +22,9 @@
     "@tanstack/react-query": "^5.101.0",
     "@tiptap/core": "3.26.1",
     "@tiptap/react": "3.26.1",
-    "@tuturuuu/google": "0.0.1",
-    "@tuturuuu/icons": "0.0.5",
-    "@tuturuuu/internal-api": "0.5.0",
+    "@tuturuuu/google": "0.0.2",
+    "@tuturuuu/icons": "0.0.6",
+    "@tuturuuu/internal-api": "0.8.0",
     "@tuturuuu/supabase": "0.3.3",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -44,7 +44,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.7.0",
+    "@tuturuuu/types": "0.9.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^25.9.3",

package/src/__tests__/api-proxy-guard.test.ts

@@ -542,6 +542,90 @@ describe('guardApiProxyRequest', () => {
     });
   });
 
+  it('uses the users database read-over-post bucket for search and filter POST reads', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 300,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    for (const path of [
+      '/api/v1/workspaces/ws-1/users/database',
+      '/api/v1/workspaces/ws-1/users/groups/featured-counts',
+      '/api/v1/workspaces/ws-1/users/groups/possible-excluded',
+    ]) {
+      const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+        prefixBase: 'proxy:test:api',
+      });
+
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Limit')).toBe('300');
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+        'users-database-read-over-post'
+      );
+    }
+
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 300,
+      window: '1 m',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 3000,
+      window: '1 h',
+    });
+    expect(mocks.ratelimitConfigs).toContainEqual({
+      limit: 20_000,
+      window: '1 d',
+    });
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:users-database-read-over-post:anonymous:mutate:minute'
+    );
+  });
+
+  it('keeps users mutations on the default mutation bucket', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 30,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest(
+        '/api/v1/workspaces/ws-1/users/11111111-1111-4111-8111-111111111111/referrals',
+        'POST'
+      ),
+      {
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+  });
+
   it('keeps finance invoice mutations on the default mutation bucket', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');

package/src/api-proxy-guard.ts

@@ -259,6 +259,15 @@ const TASK_BOARD_READ_RATE_LIMITS: RateLimitProfile = {
   mutate: DEFAULT_MUTATE_RATE_LIMITS,
 };
 
+const USERS_DATABASE_READ_OVER_POST_RATE_LIMITS: RateLimitProfile = {
+  get: NO_READ_RATE_LIMITS,
+  mutate: [
+    { window: 'minute', limit: 300, duration: '1 m' },
+    { window: 'hour', limit: 3000, duration: '1 h' },
+    { window: 'day', limit: 20_000, duration: '1 d' },
+  ],
+};
+
 const FINANCE_READ_RATE_LIMITS: RateLimitProfile = {
   get: [
     createConfig('minute', '1 m', 1200, 'API_PROXY_FINANCE_READ_LIMIT_MINUTE', [
@@ -299,6 +308,16 @@ function isFinanceRead(req: NextRequest) {
   );
 }
 
+function isUsersDatabaseReadOverPost(req: NextRequest) {
+  if (req.method !== 'POST') {
+    return false;
+  }
+
+  return /^\/api\/v1\/workspaces\/[^/]+\/users\/(?:database|groups\/(?:featured-counts|possible-excluded))\/?$/u.test(
+    req.nextUrl.pathname
+  );
+}
+
 const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
   {
     key: 'cron',
@@ -363,6 +382,11 @@ const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
         )),
     rateLimits: TASK_BOARD_READ_RATE_LIMITS,
   },
+  {
+    key: 'users-database-read-over-post',
+    matches: isUsersDatabaseReadOverPost,
+    rateLimits: USERS_DATABASE_READ_OVER_POST_RATE_LIMITS,
+  },
   {
     key: 'finance-read',
     matches: isFinanceRead,

package/src/permissions.tsx

@@ -42,6 +42,7 @@ import {
   UserCheck,
   UserCog,
   UserMinus,
+  UserPen,
   UserPlus,
   Users,
   UserX,
@@ -120,6 +121,16 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
+                {
+                  id: 'manage_mobile_deployment_vault' as PermissionId,
+                  icon: <FileKey2 />,
+                  title: t('ws-roles.manage_mobile_deployment_vault'),
+                  description: t(
+                    'ws-roles.manage_mobile_deployment_vault_description'
+                  ),
+                  disableOnProduction: false,
+                  disabled: false,
+                },
                 {
                   id: 'manage_external_migrations',
                   icon: <DatabaseZap />,
@@ -531,6 +542,14 @@ export const permissionGroups = ({
             disableOnProduction: false,
             disabled: false,
           },
+          {
+            id: 'manage_user_profile_links',
+            icon: <UserPen />,
+            title: t('ws-roles.manage_user_profile_links'),
+            description: t('ws-roles.manage_user_profile_links_description'),
+            disableOnProduction: false,
+            disabled: false,
+          },
           {
             id: 'delete_users',
             icon: <UserMinus />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.8.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.11.0'); // x-release-please-version
   });
 
   it('normalizes generated metadata and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.8.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.11.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   builtAt?: string | null;