@cosmicdrift/kumiko-bundled-features 0.105.1 → 0.108.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.105.1",
+  "version": "0.108.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -77,6 +77,8 @@
     "./secrets": "./src/secrets/index.ts",
     "./sessions": "./src/sessions/index.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
+    "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
+    "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./text-content": "./src/text-content/index.ts",
     "./text-content/seeding": "./src/text-content/seeding.ts",
@@ -93,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.105.1",
-    "@cosmicdrift/kumiko-framework": "0.105.1",
-    "@cosmicdrift/kumiko-headless": "0.105.1",
-    "@cosmicdrift/kumiko-renderer": "0.105.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.105.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.108.0",
+    "@cosmicdrift/kumiko-framework": "0.108.0",
+    "@cosmicdrift/kumiko-headless": "0.108.0",
+    "@cosmicdrift/kumiko-renderer": "0.108.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.108.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -12,6 +12,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -119,7 +120,7 @@ async function seedUser(email: string, password: string): Promise<string> {
 }
 
 async function addMembership(userId: string, tenantId: TenantId, roles: string[]): Promise<void> {
-  await insertOne(stack.db, tenantMembershipsTable, {
+  await seedRow(stack.db, tenantMembershipsTable, {
     userId,
     tenantId,
     roles: JSON.stringify(roles),

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -1,11 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import {
-  asRawClient,
-  insertOne,
-  selectMany,
-  updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -15,6 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -146,7 +142,7 @@ async function seedUser(opts: {
   // it directly via SQL after create. Row.version is left at 1; no
   // subsequent event-store writes happen on this row in these tests.
   if (opts.emailVerified === true) {
-    await updateMany(stack.db, userTable, { emailVerified: true }, { id: created.id });
+    await updateRows(stack.db, userTable, { emailVerified: true }, { id: created.id });
   }
   const tenantId = opts.tenantId ?? "00000000-0000-4000-8000-000000000001";
   await seedTenantMembership(stack.db, {
@@ -252,7 +248,7 @@ describe("POST /auth/verify-email", () => {
     const firstAttempt = await post("/api/auth/verify-email", { token });
     expect(firstAttempt.status).toBe(422);
 
-    await insertOne(stack.db, userTable, userRow);
+    await seedRow(stack.db, userTable, userRow);
 
     const secondAttempt = await post("/api/auth/verify-email", { token });
     expect(secondAttempt.status).toBe(200);
@@ -296,7 +292,7 @@ describe("POST /auth/verify-email", () => {
     await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
 
     const orphanId = "00000000-0000-4000-8000-0000000000ff";
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       ...donorRow,
       id: orphanId,
       email: "orphan@example.com",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -28,6 +28,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -38,7 +39,11 @@ import { createRendererFoundationFeature } from "../../renderer-foundation/featu
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
-import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import {
+  INVITATION_STATUS,
+  tenantInvitationEntity,
+  tenantInvitationsTable,
+} from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
@@ -46,6 +51,7 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
+import { storeInviteToken } from "../invite-token-store";
 import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
@@ -254,6 +260,12 @@ describe("invite-create", () => {
     const rows = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["role"]).toBe("Editor");
+
+    // inviteEmail() only reads emailTransport.sent.at(-1) — a silent second-
+    // dispatch failure would still leave sent.length===1 and .at(-1) pointing
+    // at the FIRST mail, making secondToken===firstToken pass for the wrong
+    // reason. Assert an actual second dispatch happened.
+    expect(emailTransport.sent).toHaveLength(2);
   });
 });
 
@@ -403,6 +415,105 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
   });
 });
 
+describe("invite-accept defense-in-depth (assertAssignableMembershipRoles)", () => {
+  test("a forbidden role planted directly on the invitation row (bug/migration) is rejected, not silently granted", async () => {
+    // Simulates the ONE scenario this depth-layer exists for: a forbidden role
+    // reaching the invitation row through some path OTHER than invite-create
+    // (which already validates at request time — see "privilege escalation"
+    // below). A DB migration or direct write is the only realistic vector.
+    const fakeInvitationId = crypto.randomUUID();
+    await seedRow(stack.db, tenantInvitationsTable, {
+      id: fakeInvitationId,
+      tenantId: TENANT_A_ID,
+      email: BOB_EMAIL,
+      role: "SystemAdmin",
+      status: INVITATION_STATUS.pending,
+      invitedBy: aliceId,
+      expiresAt: "2030-01-01T00:00:00Z",
+    });
+    const token = crypto.randomUUID();
+    await storeInviteToken(stack.redis.redis, {
+      invitationId: fakeInvitationId,
+      token,
+      ttlSeconds: 3600,
+    });
+
+    const res = await authedRaw("POST", "/api/auth/invite-accept", { token }, bobSession());
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error?: { code?: string } };
+    expect(body.error?.code).toBe("access_denied");
+
+    // No membership was granted.
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, { userId: bobId });
+    expect(memberships).toHaveLength(1); // only the seeded Tenant-B membership
+  });
+});
+
+describe("invite-accept-with-login/signup-complete defense-in-depth (637/1)", () => {
+  // Branch 1 (invite-accept, logged-in) and Branch 3 (invite-signup-complete)
+  // both route every new membership through seedTenantMembership, which
+  // calls assertAssignableMembershipRoles unconditionally (tenant/seeding.ts)
+  // — a forbidden invitation role is rejected outright, 403, before it ever
+  // reaches stripForbiddenMembershipRoles. Branch 2 (invite-accept-with-login)
+  // is different: it skips seedTenantMembership entirely when the user is
+  // ALREADY a member of the invited tenant (idempotent-accept path) — for
+  // that one case, stripForbiddenMembershipRoles at the session mint is the
+  // ONLY protection. Removing that call would silently mint a
+  // SystemAdmin-carrying session with no other test catching it.
+  test("invite-accept-with-login: already-member path strips a forbidden invitation role (seedTenantMembership's guard is skipped here)", async () => {
+    // Bob already has a (legitimate) membership in TENANT_A_ID — the
+    // handler's alreadyMember check short-circuits before seedTenantMembership,
+    // so assertAssignableMembershipRoles never runs for this accept.
+    await seedTenantMembership(stack.db, {
+      userId: bobId,
+      tenantId: TENANT_A_ID,
+      roles: ["User"],
+    });
+
+    // Create through the real command (valid role → real stream + version),
+    // then corrupt the row directly — the migration/DB-surgery scenario this
+    // depth-layer guards against, same framing as the Branch-1 test above.
+    const token = await inviteEmail(BOB_EMAIL, "Admin");
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${tenantInvitationsTable.tableName}" SET "role" = 'SystemAdmin' WHERE "email" = $1`,
+      [BOB_EMAIL],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user: { roles: string[] } };
+    expect(body.user.roles).toEqual([]);
+  });
+
+  test("invite-signup-complete: a brand-new user always hits seedTenantMembership's guard — forbidden role rejected, not silently stripped", async () => {
+    // Unlike Branch 2, a brand-new user can never be "already a member" —
+    // seedTenantMembership (and its assertAssignableMembershipRoles guard)
+    // runs unconditionally. Pins that this branch is NOT exposed to the
+    // Branch-2 gap, so a future refactor that adds an alreadyMember-style
+    // skip here would be caught immediately.
+    const daveEmail = "dave@example.com";
+    const token = await inviteEmail(daveEmail, "Admin");
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${tenantInvitationsTable.tableName}" SET "role" = 'SystemAdmin' WHERE "email" = $1`,
+      [daveEmail],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "dave-new-pw-1234",
+    });
+    expect(res.status).toBe(403);
+
+    // No user or membership was created — the whole write rolled back.
+    const daveRows = await selectMany(stack.db, userTable, { email: daveEmail });
+    expect(daveRows).toHaveLength(0);
+  });
+});
+
 describe("Single-Use-Burn (alle Branches)", () => {
   test("Branch 1: zweiter accept mit gleichem Token → invalid", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -9,7 +9,7 @@
 // (nur tenant-membership-roles in der Session).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -19,6 +19,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -102,7 +103,7 @@ async function addMembership(
   tenantId: TenantId,
   roles: readonly string[],
 ): Promise<void> {
-  await insertOne(stack.db, tenantMembershipsTable, {
+  await seedRow(stack.db, tenantMembershipsTable, {
     userId,
     tenantId,
     roles: JSON.stringify(roles),

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -10,6 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -302,7 +303,7 @@ describe("POST /auth/reset-password", () => {
 
     // Re-insert the captured row verbatim. Same userId, same version, same
     // token still valid.
-    await insertOne(stack.db, userTable, userRow);
+    await seedRow(stack.db, userTable, userRow);
 
     const secondAttempt = await post("/api/auth/reset-password", {
       token,
@@ -357,7 +358,7 @@ describe("POST /auth/reset-password", () => {
     await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
 
     const orphanId = "00000000-0000-4000-8000-0000000000ff";
-    await insertOne(stack.db, userTable, {
+    await seedRow(stack.db, userTable, {
       ...donorRow,
       id: orphanId,
       email: "orphan@example.com",

package/src/auth-email-password/handlers/change-password.write.ts

@@ -1,7 +1,11 @@
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  access,
+  createSystemUser,
+  defineWriteHandler,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
 import { hashPassword, verifyPassword } from "../password-hashing";
 
@@ -35,14 +39,10 @@ export const changePasswordWrite = defineWriteHandler({
 
     const newHash = await hashPassword(event.payload.newPassword);
 
-    // The user aggregate is r.systemScope(): its event stream can live in a
-    // tenant that isn't the session tenant (a platform operator's stream sits
-    // in the seed executor's tenant, not their membership). Write against the
-    // real stream tenant so optimistic locking targets the right stream instead
-    // of version_conflict-ing against an empty one. Falls back to the session
-    // tenant when the lookup finds nothing (fresh/unknown stream).
-    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
-    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
+    // The user aggregate is systemStream (#497): its event stream lives on
+    // SYSTEM_TENANT_ID deterministically. Pre-#497 scattered streams need the
+    // one-time backfillUserStreamTenants migration (#762).
+    const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     // Apply via user feature's update handler — writeAs(system) satisfies
     // the privileged-only write rule on passwordHash. Pass the current version

package/src/auth-email-password/handlers/confirm-token-flow.ts

@@ -5,9 +5,8 @@
 //   1. Redis check + burn (single-use enforcement)
 //   2. Load user + deleted/missing/no-version guard
 //   3. Optional idempotent short-circuit (verify-email when already done)
-//   4. Resolve memberships → tenant-order for stream-matching
-//   5. Try each tenant's stream with the handler-specific `changes`
-//   6. Release the burn on ANY non-success path so a legit retry isn't
+//   4. Apply the handler-specific `changes` on the user's SYSTEM stream
+//   5. Release the burn on ANY non-success path so a legit retry isn't
 //      locked out by a stale marker
 //
 // The top-level `runConfirmTokenFlow` orchestrates and owns the
@@ -15,26 +14,26 @@
 // burn (success, already-done) flips `committed = true`; everything
 // else — including future branches a maintainer adds — releases
 // automatically.
+//
+// The user aggregate is systemStream (#497): its event stream lives on
+// SYSTEM_TENANT_ID deterministically, so the write targets exactly one
+// stream. The former membership-probing (`tryWriteAcrossTenants`) existed
+// for pre-#497 scattered streams; those need the one-time
+// backfillUserStreamTenants migration (#762) — probing them stopped working
+// the moment the executor's stream choke-point landed anyway.
 
 import {
   createSystemUser,
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
-  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  InternalError,
-  type WriteFailure,
-  writeFailure,
-} from "@cosmicdrift/kumiko-framework/errors";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type Redis from "ioredis";
-import { USER_FEATURE, UserHandlers, UserQueries } from "../../user";
+import { UserHandlers, UserQueries } from "../../user";
 import type { AuthUserRow } from "../auth-user-row";
 import { parseAuthUserRow } from "../auth-user-row";
-import { orderTenantsByPreference } from "../stream-tenant";
 import { burnToken, unburnToken } from "../token-burn-store";
 
 export type ConfirmTokenFlowSpec<TSuccessData> = {
@@ -46,13 +45,11 @@ export type ConfirmTokenFlowSpec<TSuccessData> = {
   // is misconfigured, not the caller's fault.
   readonly redisRequiredMessage: string;
   // Standard failure returned for every "token can't be consumed" path
-  // (bad state, missing memberships, every tenant rejected). The route
-  // layer returns 422 with a uniform code so the caller can't tell which
-  // branch fired.
+  // (bad state, version conflict on the stream). The route layer returns
+  // 422 with a uniform code so the caller can't tell which branch fired.
   readonly invalidToken: () => ReturnType<typeof writeFailure>;
-  // Handler-specific payload for user:update. Runs once per token — the
-  // result is shared across every tenant-stream attempt. Can be async
-  // (password-reset hashes here).
+  // Handler-specific payload for user:update. Runs once per token. Can be
+  // async (password-reset hashes here).
   readonly buildChanges: (me: AuthUserRow) => Promise<Record<string, unknown>>;
   // Returned verbatim on a successful write.
   readonly successData: TSuccessData;
@@ -96,20 +93,21 @@ export async function runConfirmTokenFlow<TSuccessData>(
       return { isSuccess: true, data: spec.alreadyDone.data };
     }
 
-    const tenantOrder = await resolveStreamTenants(ctx, systemUser, me);
-    if (tenantOrder.length === 0) return spec.invalidToken();
-
     const changes = await spec.buildChanges(me);
-    const writeResult = await tryWriteAcrossTenants(ctx, me, tenantOrder, changes);
-    if (writeResult.isSuccess) {
+    const writeRes = await ctx.writeAs(systemUser, UserHandlers.update, {
+      id: me.id,
+      version: me.version,
+      changes,
+    });
+    if (writeRes.isSuccess) {
       committed = true;
       return { isSuccess: true, data: spec.successData };
     }
-    // `all_conflicts` = every tenant returned version_conflict → token-level
-    // failure. `hard_failure` = a real write error (DB down, access
-    // denied) that bubbles unchanged.
-    if (writeResult.reason === "all_conflicts") return spec.invalidToken();
-    return writeResult.failure;
+    // version_conflict = concurrent modification (or an un-migrated pre-#497
+    // stream, see header) → token-level failure. Anything else (DB down,
+    // access denied) bubbles unchanged so ops sees the real failure class.
+    if (writeRes.error.code === "version_conflict") return spec.invalidToken();
+    return writeRes;
   } finally {
     // committed===false covers EVERY failure path — including branches a
     // future maintainer adds without reading this file. The original
@@ -121,14 +119,13 @@ export async function runConfirmTokenFlow<TSuccessData>(
   }
 }
 
-// --- Private helpers ------------------------------------------------------
-
 // Fetches the user row via the privileged findForAuth query and validates
-// it's usable for a write: not deleted, has a row.version (the version
-// column is a findForAuth contract field — absence is a schema bug, but
-// we still handle it gracefully rather than throwing past the burn).
-// Return type narrows `version` to `number` so the write-callsite doesn't
-// need a `?? 0` fallback — the guard lives here, not at every callsite.
+// it's usable for a write: not deleted, has a row.version >= 1 (a row
+// without any event stream — e.g. inserted straight into read_users — must
+// not be confirmable: the write would otherwise seed a fresh stream with a
+// bare user.updated). Return type narrows `version` to `number` so the
+// write-callsite doesn't need a `?? 0` fallback — the guard lives here,
+// not at every callsite.
 async function loadValidatedUser(
   ctx: HandlerContext,
   systemUser: SessionUser,
@@ -137,74 +134,6 @@ async function loadValidatedUser(
   const me = parseAuthUserRow(
     await ctx.queryAs(systemUser, UserQueries.findForAuth, { id: userId }),
   );
-  if (!me || me.isDeleted || me.version === undefined) return null;
+  if (!me || me.isDeleted || me.version === undefined || me.version < 1) return null;
   return { ...me, version: me.version };
 }
-
-// Loads the user's memberships and returns a prioritised tenant list, with the
-// aggregate's real stream tenant recovered from the event log prepended.
-//
-// Empty only when the user has NO memberships AND no recoverable stream tenant
-// — the caller treats that as invalid_token. A zero-membership systemScope user
-// whose stream lives outside any membership (a platform operator seeded under a
-// fixture/SYSTEM tenant) still resolves, because the stream-tenant lookup runs
-// before the empty check rather than being short-circuited by it.
-async function resolveStreamTenants(
-  ctx: HandlerContext,
-  systemUser: SessionUser,
-  me: AuthUserRow,
-): Promise<readonly TenantId[]> {
-  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-    userId: me.id,
-  })) as Array<{ tenantId: TenantId }>; // @cast-boundary db-runner
-  const ordered = orderTenantsByPreference(memberships, me.lastActiveTenantId);
-
-  // The user aggregate is r.systemScope(): its event stream lives in whichever
-  // tenant the creating executor used, which need NOT be a membership tenant.
-  // A platform operator seeded under a fixture/platform tenant is the live case
-  // — its stream tenant is absent from `ordered`, so a membership-only search
-  // rejects every write and collapses to invalid_token. Recover the real stream
-  // tenant from the event log and try it first; memberships stay as fallback.
-  // Pulled BEFORE the empty-membership check so a zero-membership operator whose
-  // stream lives in SYSTEM_TENANT is recoverable instead of collapsing to
-  // invalid_token — mirrors change-password.write.ts's unconditional recovery.
-  const streamTenant = await getAggregateStreamTenant(ctx.db.raw, me.id, USER_FEATURE);
-  if (streamTenant && !ordered.includes(streamTenant)) {
-    return [streamTenant, ...ordered];
-  }
-  return ordered;
-}
-
-// Discriminated result for the write-across-tenants loop.
-//   all_conflicts → every candidate rejected with version_conflict →
-//                   token-level failure; caller returns invalidToken.
-//   hard_failure  → a non-conflict error that should bubble unchanged
-//                   (DB down, access denied, …); caller returns it as-is.
-type TenantWriteResult =
-  | { isSuccess: true }
-  | { isSuccess: false; reason: "all_conflicts" }
-  | { isSuccess: false; reason: "hard_failure"; failure: WriteFailure };
-
-// Attempts the update against each candidate stream. memberships-query
-// has no deterministic ORDER BY, so the matching stream is discovered by
-// attempt: version_conflict → try the next candidate, anything else →
-// bubble immediately so ops sees the real failure class.
-async function tryWriteAcrossTenants(
-  ctx: HandlerContext,
-  me: AuthUserRow & { version: number },
-  tenantOrder: readonly TenantId[],
-  changes: Record<string, unknown>,
-): Promise<TenantWriteResult> {
-  for (const tenantId of tenantOrder) {
-    const writeRes = await ctx.writeAs(createSystemUser(tenantId), UserHandlers.update, {
-      id: me.id,
-      version: me.version,
-      changes,
-    });
-    if (writeRes.isSuccess) return { isSuccess: true };
-    if (writeRes.error.code !== "version_conflict") {
-      return { isSuccess: false, reason: "hard_failure", failure: writeRes };
-    }
-  }
-  return { isSuccess: false, reason: "all_conflicts" };
-}

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -0,0 +1,44 @@
+// InviteAcceptScreen is a public route — anon invite-links are the
+// documented use case (no <SessionProvider> ancestor). Regression 632/1:
+// useSession() throws without a provider, so any consumer mounting this
+// screen on a public route outside SessionAuthGate crashed at runtime.
+
+import { describe, expect, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { render, screen } from "@testing-library/react";
+import { defaultTranslations } from "../../i18n";
+import { InviteAcceptScreen } from "../invite-accept-screen";
+
+const resolver = createStaticLocaleResolver({ locale: "de" });
+
+function renderWithoutSessionProvider(token: string) {
+  return render(
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+        <InviteAcceptScreen token={token} />
+      </LocaleProvider>
+    </PrimitivesProvider>,
+  );
+}
+
+describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
+  test("renders the anonymous accept-form instead of throwing", () => {
+    renderWithoutSessionProvider("tok-123");
+    expect(screen.getByText("Einladung annehmen")).toBeTruthy();
+    expect(screen.getByLabelText(/^Passwort/)).toBeTruthy();
+    // Anon default mode is "anon-existing" — email field is shown too.
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+
+  test("missing token still renders (no session access needed for that branch)", () => {
+    renderWithoutSessionProvider("");
+    expect(
+      screen.getByText("Der Einladungs-Link enthält keinen Token oder ist ungültig."),
+    ).toBeTruthy();
+  });
+});

package/src/auth-email-password/web/__tests__/user-menu.test.tsx

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { SidebarProvider } from "@cosmicdrift/kumiko-renderer-web";
-import { screen } from "@testing-library/react";
+import { screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { UserMenu } from "../user-menu";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
@@ -31,6 +31,19 @@ describe("UserMenu", () => {
     // Trim "" → leerer displayName → fallback auf email → erste 2 Chars
     expect(screen.getByText("BO")).toBeTruthy();
   });
+  test("no displayName → dropdown label shows the email exactly once (not duplicated)", async () => {
+    const user = userEvent.setup();
+    const session = makeSessionApi({
+      user: { id: "u1", email: "bob@example.com", displayName: "", globalRoles: [] },
+    });
+    renderWithProviders(<UserMenu />, { session });
+    await user.click(screen.getByRole("button", { name: /bob@example.com/ }));
+    const menu = within(screen.getByRole("menu"));
+    // getByText throws if the email appears more than once inside the
+    // dropdown panel — displayName falls back to the email, so without the
+    // hasName guard the second (redundant) email line would duplicate it.
+    expect(menu.getByText("bob@example.com")).toBeTruthy();
+  });
   test("opens dropdown on click and shows logout button", async () => {
     const user = userEvent.setup();
     const session = makeSessionApi();

package/src/auth-email-password/web/auth-gate.tsx

@@ -32,10 +32,9 @@ export function makeAuthGate(
   return AuthGate;
 }
 
-/** SessionProvider + AuthGate als ein Gate — damit öffentliche Gates davor
- *  (z.B. /rechner) den Session-Bootstrap nicht mounten. createKumikoApp
- *  stackt providers außerhalb aller gates; SessionProvider darf deshalb
- *  kein provider mehr sein. */
+// SessionProvider + AuthGate as one gate, so a public gate in front (e.g.
+// /calculator) doesn't mount the session bootstrap — createKumikoApp stacks
+// providers outside all gates, so SessionProvider can't be a provider anymore.
 export function makeSessionAuthGate(
   LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
   loginProps?: LoginScreenProps,