kempo 4.2.21 → 4.2.23

package/README.md

@@ -362,13 +362,45 @@ Refer to the [kempo-css docs](https://github.com/dustinpoissant/kempo-css) and [
 
 ## Development
 
-### Running the Dev Server
+### Running the framework
+
+Kempo is developed against **[kempo-demo](https://github.com/dustinpoissant/kempo-demo)**, a real consumer project that installs kempo, kempo-blog and the rest the way a user would. Running a server inside this repo instead was misleading: paths resolve differently when the framework runs from within `node_modules/kempo` than when it runs from its own directory, so problems appeared here that users never hit, and vice versa.
+
+```bash
+cd ../kempo-demo
+npm install
+npm run link:local     # symlink the sibling checkouts into node_modules
+npm start              # http://localhost:9876
+```
+
+After editing `src/` here, rebuild so the demo picks it up — `dist/` is what actually gets served:
+
+```bash
+npm run build:deps     # from kempo-demo; builds kempo, kempo-server, kempo-ui, kempo-css
+```
+
+To edit the admin portal without rebuilding on every change, point the middleware at the source instead of the build by adding `adminRoot` to the demo's `public/.config.json`:
+
+```json
+{
+  "middleware": {
+    "custom": ["../node_modules/kempo/middleware/kempo.js"],
+    "adminRoot": "node_modules/kempo/src/admin"
+  }
+}
+```
+
+### Running the tests
+
+Most of the suite needs nothing, but the extension-lifecycle and HTTP-contract tests drive a real database and skip themselves when none is reachable. To run everything:
 
 ```bash
-npm run dev
+docker compose up -d                 # postgres on 5434, separate from kempo-demo's on 5433
+npx drizzle-kit push --force         # apply the schema
+npm test
 ```
 
-This serves `app-public/` at `http://localhost:9876` for testing the consumer-facing boilerplate. The dev server watches for changes and auto-reloads.
+`.env.example` has the matching `DATABASE_URL`. The suite seeds its own groups and permissions, and cleans up the rows it creates.
 
 ### Building for Distribution
 

package/dist/kempo/api/settings/public/GET.js

@@ -1,2 +1,2 @@
-import e from"../../../../../server/utils/settings/getPublicSettings.js";export default async t=>{const[s,n]=await e();return s?new Response(JSON.stringify({error:s.msg}),{status:s.code,headers:{"Content-Type":"application/json"}}):new Response(JSON.stringify(n),{headers:{"Content-Type":"application/json"}})};
+import t from"../../../../../server/utils/settings/getPublicSettings.js";export default async(s,e)=>{const[r,o]=await t();if(r)return e.status(r.code).json({error:r.msg});e.json(o)};
 //# sourceMappingURL=C:\Users\dusti\dev\kempo\dist\kempo\api\settings\public\GET.js.map

package/dist/kempo/api/settings/public/GET.js.map

@@ -1 +1 @@
-{"version":3,"file":"src\\kempo\\api\\settings\\public\\GET.js","names":["getPublicSettings","async","request","error","settings","Response","JSON","stringify","msg","status","code","headers"],"sources":["0"],"sourcesContent":["import getPublicSettings from '../../../../../server/utils/settings/getPublicSettings.js';\r\n\r\nexport default async (request) => {\r\n  const [error, settings] = await getPublicSettings();\r\n\r\n  if(error){\r\n    return new Response(JSON.stringify({ error: error.msg }), {\r\n      status: error.code,\r\n      headers: { 'Content-Type': 'application/json' }\r\n    });\r\n  }\r\n\r\n  return new Response(JSON.stringify(settings), {\r\n    headers: { 'Content-Type': 'application/json' }\r\n  });\r\n};\r\n"],"mappings":"OAAOA,MAAuB,2EAEfC,MAAOC,IACpB,MAAOC,EAAOC,SAAkBJ,IAEhC,OAAGG,EACM,IAAIE,SAASC,KAAKC,UAAU,CAAEJ,MAAOA,EAAMK,MAAQ,CACxDC,OAAQN,EAAMO,KACdC,QAAS,CAAE,eAAgB,sBAIxB,IAAIN,SAASC,KAAKC,UAAUH,GAAW,CAC5CO,QAAS,CAAE,eAAgB","ignoreList":[]}
+{"version":3,"file":"src\\kempo\\api\\settings\\public\\GET.js","names":["getPublicSettings","async","request","response","error","settings","status","code","json","msg"],"sources":["0"],"sourcesContent":["import getPublicSettings from '../../../../../server/utils/settings/getPublicSettings.js';\n\nexport default async (request, response) => {\n  const [error, settings] = await getPublicSettings();\n\n  if(error){\n    return response.status(error.code).json({ error: error.msg });\n  }\n\n  response.json(settings);\n};\n"],"mappings":"OAAOA,MAAuB,2EAEfC,MAAOC,EAASC,KAC7B,MAAOC,EAAOC,SAAkBL,IAEhC,GAAGI,EACD,OAAOD,EAASG,OAAOF,EAAMG,MAAMC,KAAK,CAAEJ,MAAOA,EAAMK,MAGzDN,EAASK,KAAKH","ignoreList":[]}

package/package.json

@@ -1,21 +1,21 @@
 {
   "name": "kempo",
-  "version": "4.2.21",
+  "version": "4.2.23",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
-    "dev": "node scripts/dev.js",
     "build": "node scripts/build.js",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
     "db:push": "drizzle-kit push",
     "db:studio": "drizzle-kit studio",
     "makeAdmin": "node ./scripts/make-admin.js",
-    "removeAdmin": "node ./scripts/removeAdmin.js",
+    "removeAdmin": "node ./scripts/remove-admin.js",
     "test:email": "node ./scripts/test-email.js",
     "test": "kempo-test -n",
     "test:node": "kempo-test -n",
-    "link:local": "npm install ../kempo-server ../kempo-ui --no-save"
+    "link:local": "npm install ../kempo-server ../kempo-ui --no-save",
+    "db:reset": "node ./scripts/reset-db.js"
   },
   "author": "Dustin Poissant",
   "license": "MIT",
@@ -46,10 +46,10 @@
     "bcrypt": "^6.0.0",
     "dotenv": "^17.2.3",
     "drizzle-kit": "^0.31.7",
-    "drizzle-orm": "^0.44.7",
+    "drizzle-orm": "^0.45.2",
     "inquirer": "^12.6.1",
     "lexical": "^0.42.0",
-    "monaco-editor": "^0.55.1",
+    "monaco-editor": "^0.56.0",
     "postgres": "^3.4.7",
     "resend": "^6.5.2"
   },

package/server/utils/permissions/currentUserHasPermission.js

@@ -1,24 +1,28 @@
 import getSession from '../auth/getSession.js';
 import userHasPermission from './userHasPermission.js';
 
+/*
+  Distinguishes "not signed in" from "signed in but not allowed", because they are different
+  answers: 401 means authenticate and try again, 403 means authenticating again will not help.
+
+  A missing permission name is a caller mistake rather than anything about the request, so it stays
+  a 400. Returning [null, false] is reserved for a valid session that simply lacks the permission,
+  which callers turn into 403.
+*/
 export default async (token, permissionName) => {
-  if(!token){
-    return [{ code: 400, msg: 'Session token is required' }, null];
-  }
-  
   if(!permissionName){
     return [{ code: 400, msg: 'Permission name is required' }, null];
   }
-  
-  const [error, sessionData] = await getSession({ token });
-  
-  if(error){
-    return [null, false];
+
+  if(!token){
+    return [{ code: 401, msg: 'Authentication required' }, null];
   }
-  
-  if(!sessionData || !sessionData.user){
-    return [null, false];
+
+  const [error, sessionData] = await getSession({ token });
+
+  if(error || !sessionData?.user){
+    return [{ code: 401, msg: 'Authentication required' }, null];
   }
-  
+
   return await userHasPermission(sessionData.user.id, permissionName);
 };