kempo 4.2.22 → 4.2.23

package/README.md

@@ -362,13 +362,45 @@ Refer to the [kempo-css docs](https://github.com/dustinpoissant/kempo-css) and [
 
 ## Development
 
-### Running the Dev Server
+### Running the framework
+
+Kempo is developed against **[kempo-demo](https://github.com/dustinpoissant/kempo-demo)**, a real consumer project that installs kempo, kempo-blog and the rest the way a user would. Running a server inside this repo instead was misleading: paths resolve differently when the framework runs from within `node_modules/kempo` than when it runs from its own directory, so problems appeared here that users never hit, and vice versa.
+
+```bash
+cd ../kempo-demo
+npm install
+npm run link:local     # symlink the sibling checkouts into node_modules
+npm start              # http://localhost:9876
+```
+
+After editing `src/` here, rebuild so the demo picks it up — `dist/` is what actually gets served:
+
+```bash
+npm run build:deps     # from kempo-demo; builds kempo, kempo-server, kempo-ui, kempo-css
+```
+
+To edit the admin portal without rebuilding on every change, point the middleware at the source instead of the build by adding `adminRoot` to the demo's `public/.config.json`:
+
+```json
+{
+  "middleware": {
+    "custom": ["../node_modules/kempo/middleware/kempo.js"],
+    "adminRoot": "node_modules/kempo/src/admin"
+  }
+}
+```
+
+### Running the tests
+
+Most of the suite needs nothing, but the extension-lifecycle and HTTP-contract tests drive a real database and skip themselves when none is reachable. To run everything:
 
 ```bash
-npm run dev
+docker compose up -d                 # postgres on 5434, separate from kempo-demo's on 5433
+npx drizzle-kit push --force         # apply the schema
+npm test
 ```
 
-This serves `app-public/` at `http://localhost:9876` for testing the consumer-facing boilerplate. The dev server watches for changes and auto-reloads.
+`.env.example` has the matching `DATABASE_URL`. The suite seeds its own groups and permissions, and cleans up the rows it creates.
 
 ### Building for Distribution
 

package/package.json

@@ -1,21 +1,21 @@
 {
   "name": "kempo",
-  "version": "4.2.22",
+  "version": "4.2.23",
   "type": "module",
   "description": "A fullstack CMS framework for creating websites with user authentication",
   "scripts": {
-    "dev": "node scripts/dev.js",
     "build": "node scripts/build.js",
     "db:generate": "drizzle-kit generate",
     "db:migrate": "drizzle-kit migrate",
     "db:push": "drizzle-kit push",
     "db:studio": "drizzle-kit studio",
     "makeAdmin": "node ./scripts/make-admin.js",
-    "removeAdmin": "node ./scripts/removeAdmin.js",
+    "removeAdmin": "node ./scripts/remove-admin.js",
     "test:email": "node ./scripts/test-email.js",
     "test": "kempo-test -n",
     "test:node": "kempo-test -n",
-    "link:local": "npm install ../kempo-server ../kempo-ui --no-save"
+    "link:local": "npm install ../kempo-server ../kempo-ui --no-save",
+    "db:reset": "node ./scripts/reset-db.js"
   },
   "author": "Dustin Poissant",
   "license": "MIT",
@@ -46,10 +46,10 @@
     "bcrypt": "^6.0.0",
     "dotenv": "^17.2.3",
     "drizzle-kit": "^0.31.7",
-    "drizzle-orm": "^0.44.7",
+    "drizzle-orm": "^0.45.2",
     "inquirer": "^12.6.1",
     "lexical": "^0.42.0",
-    "monaco-editor": "^0.55.1",
+    "monaco-editor": "^0.56.0",
     "postgres": "^3.4.7",
     "resend": "^6.5.2"
   },

package/server/utils/permissions/currentUserHasPermission.js

@@ -1,24 +1,28 @@
 import getSession from '../auth/getSession.js';
 import userHasPermission from './userHasPermission.js';
 
+/*
+  Distinguishes "not signed in" from "signed in but not allowed", because they are different
+  answers: 401 means authenticate and try again, 403 means authenticating again will not help.
+
+  A missing permission name is a caller mistake rather than anything about the request, so it stays
+  a 400. Returning [null, false] is reserved for a valid session that simply lacks the permission,
+  which callers turn into 403.
+*/
 export default async (token, permissionName) => {
-  if(!token){
-    return [{ code: 400, msg: 'Session token is required' }, null];
-  }
-  
   if(!permissionName){
     return [{ code: 400, msg: 'Permission name is required' }, null];
   }
-  
-  const [error, sessionData] = await getSession({ token });
-  
-  if(error){
-    return [null, false];
+
+  if(!token){
+    return [{ code: 401, msg: 'Authentication required' }, null];
   }
-  
-  if(!sessionData || !sessionData.user){
-    return [null, false];
+
+  const [error, sessionData] = await getSession({ token });
+
+  if(error || !sessionData?.user){
+    return [{ code: 401, msg: 'Authentication required' }, null];
   }
-  
+
   return await userHasPermission(sessionData.user.id, permissionName);
 };