create-kumiko-app 0.4.229 → 0.4.230

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.4.229",
+  "version": "0.4.230",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,9 +27,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.214.0",
-    "@cosmicdrift/kumiko-framework": "0.214.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.214.0",
+    "@cosmicdrift/kumiko-dev-server": "0.215.0",
+    "@cosmicdrift/kumiko-framework": "0.215.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.215.0",
     "@inquirer/core": "^10.0.0",
     "@inquirer/prompts": "^7.4.0"
   },

package/src/__tests__/yes-scaffold-boot.test.ts

@@ -7,12 +7,17 @@
 // only actually booting the resolved set through validateBoot can.
 
 import { describe, expect, test } from "bun:test";
+import { frameworkCoreEnvSchema } from "@cosmicdrift/kumiko-dev-server";
+import { resolveKmsWiring } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createRegistry,
   type FeatureDefinition,
+  type TenantId,
   validateBoot as validateBootRaw,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { composeEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { withBootValidatorFixture } from "@cosmicdrift/kumiko-framework/testing";
+import { runProdApp } from "@cosmicdrift/kumiko-server-runtime";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
 import { resolveDeps } from "../dep-resolver";
 import { FEATURE_CONSTRUCTORS } from "../feature-constructors";
@@ -61,3 +66,94 @@ describe("--yes resolved set boots (issue-1174 regression)", () => {
     expect(() => createRegistry(composed)).not.toThrow();
   });
 });
+
+// kumiko-framework#2330: validateBoot/createRegistry above never reach
+// runProdApp's PII boot gate (assertPiiBootInvariants) — it's not part of
+// validateBoot, it runs a step later. The --yes set mounts PII-annotated
+// entities (user, tenant-invitation, fileRef via user-data-rights), so the
+// generated bin/main.ts must wire kms/allowPlaintextPii or the first
+// `bun run boot` throws BOOT ABORTED. This drives the SAME resolved feature
+// set through the actual runProdApp (KUMIKO_DRY_RUN_ENV=boot — no DB/Redis
+// connect) to pin both halves of the fix.
+describe("--yes resolved set through runProdApp's PII boot gate (issue-2330 regression)", () => {
+  const manifest = loadManifest();
+  const recommended = buildChoices(manifest)
+    .filter((c) => c.recommended)
+    .map((c) => c.name);
+  const resolved = resolveDeps(recommended, manifest);
+
+  const auth = {
+    admin: {
+      email: "admin@test.local",
+      password: "change-me-on-first-deploy",
+      displayName: "Admin",
+      memberships: [
+        {
+          tenantId: "93238e36-e2e5-4e2e-8be4-00004739a98c" as TenantId,
+          tenantKey: "test",
+          tenantName: "test",
+          roles: ["TenantAdmin" as const],
+        },
+      ],
+    },
+  };
+
+  async function bootWithWiring(wiring: Record<string, unknown>) {
+    const instances = await instantiateResolved(resolved.featureNames);
+    const bootFeatures = composeFeatures(instances, { includeBundled: true });
+    const envSchema = composeEnvSchema({ core: frameworkCoreEnvSchema, features: bootFeatures });
+    return runProdApp({
+      features: instances,
+      envSchema,
+      autoListen: false,
+      migrations: false,
+      auth,
+      envSource: {
+        KUMIKO_DRY_RUN_ENV: "boot",
+        JWT_SECRET: "a".repeat(32),
+        KUMIKO_SECRETS_MASTER_KEY_V1: Buffer.alloc(32, 7).toString("base64"),
+        DATABASE_URL: "postgres://dummy:dummy@127.0.0.1:1/dummy",
+        REDIS_URL: "redis://127.0.0.1:1",
+      },
+      ...wiring,
+    });
+  }
+
+  test("without kms/allowPlaintextPii wiring, boot aborts (pins the bug this issue reports)", async () => {
+    await expect(bootWithWiring({})).rejects.toThrow(
+      /BOOT ABORTED.*user.*tenant-invitation.*fileRef/s,
+    );
+  });
+
+  test("with resolveKmsWiring's fallback (what the generated bin/main.ts now does), boot succeeds", async () => {
+    // Empty object, not process.env: a dev machine with the real trio set
+    // would otherwise flip this into the ActiveKmsWiring branch and the test
+    // would stop exercising the plaintext fallback it's meant to pin.
+    const kmsWiring = resolveKmsWiring(
+      {},
+      {
+        logPrefix: "[test]",
+        plaintextReason: "no PLATFORM_KEK / SUBJECT_KEYS_DATABASE_URL / KUMIKO_BLIND_INDEX_KEY set",
+      },
+    );
+    expect(kmsWiring).toHaveProperty("allowPlaintextPii");
+    const handle = await bootWithWiring(kmsWiring);
+    expect(handle).toBeDefined();
+  });
+
+  test("generated .env.example's unset trio (empty string, not absent) still resolves to the plaintext fallback", async () => {
+    // dotenv turns `PLATFORM_KEK=` into process.env.PLATFORM_KEK === "" — the
+    // actual value a user gets from `cp .env.example .env` without filling it
+    // in. resolveKmsWiring reads raw env (not the zod-validated envSchema),
+    // and Boolean("") === Boolean(undefined), so this must behave identically
+    // to the {} case above.
+    const kmsWiring = resolveKmsWiring({
+      PLATFORM_KEK: "",
+      SUBJECT_KEYS_DATABASE_URL: "",
+      KUMIKO_BLIND_INDEX_KEY: "",
+    });
+    expect(kmsWiring).toHaveProperty("allowPlaintextPii");
+    const handle = await bootWithWiring(kmsWiring);
+    expect(handle).toBeDefined();
+  });
+});