@cosmicdrift/kumiko-bundled-features 0.108.0 → 0.110.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.108.0",
+  "version": "0.110.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.108.0",
-    "@cosmicdrift/kumiko-framework": "0.108.0",
-    "@cosmicdrift/kumiko-headless": "0.108.0",
-    "@cosmicdrift/kumiko-renderer": "0.108.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.108.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.110.0",
+    "@cosmicdrift/kumiko-framework": "0.110.0",
+    "@cosmicdrift/kumiko-headless": "0.110.0",
+    "@cosmicdrift/kumiko-renderer": "0.110.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.110.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/feature-options.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import { MIN_HMAC_SECRET_LENGTH } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+// A short HMAC secret makes reset/verify tokens forgeable (account takeover),
+// so the factory must fail fast — same bar as the ≥32-char JWT_SECRET check.
+
+const okSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH);
+const shortSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH - 1);
+const appUrl = "https://app.example.com/flow";
+
+describe("createAuthEmailPasswordFeature hmacSecret validation", () => {
+  test("rejects a short passwordReset.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ passwordReset: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/passwordReset\.hmacSecret must be/);
+  });
+
+  test("rejects a short emailVerification.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ emailVerification: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/emailVerification\.hmacSecret must be/);
+  });
+
+  test("accepts secrets at the minimum length", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({
+        passwordReset: { hmacSecret: okSecret, appUrl },
+        emailVerification: { hmacSecret: okSecret, appUrl },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/auth-email-password/constants.ts

@@ -6,6 +6,10 @@
 // der server-side Zugriff (handlers, dispatcher) erhalten.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password" as const;
 
+// Minimum length for reset/verify hmacSecret — mirrors the ≥32-char
+// JWT_SECRET env check (HMAC-SHA256 key material).
+export const MIN_HMAC_SECRET_LENGTH = 32;
+
 // Qualified handler names. Non-CRUD handlers, no entity prefix.
 export const AuthHandlers = {
   login: "auth-email-password:write:login",

package/src/auth-email-password/feature.ts

@@ -1,5 +1,6 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { MIN_HMAC_SECRET_LENGTH } from "./constants";
 import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write";
@@ -122,14 +123,17 @@ export type AuthEmailPasswordOptions = {
 export function createAuthEmailPasswordFeature(
   opts: AuthEmailPasswordOptions = {},
 ): FeatureDefinition {
-  if (opts.passwordReset && !opts.passwordReset.hmacSecret) {
+  // ≥32 chars, symmetric to the JWT_SECRET env check: a short HMAC secret
+  // makes reset/verify tokens forgeable — that's account takeover, so the
+  // factory fails fast instead of trusting the caller.
+  if (opts.passwordReset && opts.passwordReset.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] passwordReset.hmacSecret must be non-empty when passwordReset is configured",
+      `[auth-email-password] passwordReset.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
-  if (opts.emailVerification && !opts.emailVerification.hmacSecret) {
+  if (opts.emailVerification && opts.emailVerification.hmacSecret.length < MIN_HMAC_SECRET_LENGTH) {
     throw new Error(
-      "[auth-email-password] emailVerification.hmacSecret must be non-empty when emailVerification is configured",
+      `[auth-email-password] emailVerification.hmacSecret must be ≥${MIN_HMAC_SECRET_LENGTH} chars (HMAC-SHA256 token signing)`,
     );
   }
 

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -49,10 +49,11 @@ let patResolver: PatResolver | undefined;
 const encryptionKey = randomBytes(32).toString("base64");
 const TENANT: TenantId = testTenantId(1);
 
-// One scope "tokens" grants exactly the two PAT queries — deliberately NOT
-// sessions:query:user-session:mine, so that QN is the out-of-scope probe.
+// One domain "tokens" whose read set is exactly the two PAT queries —
+// deliberately NOT sessions:query:user-session:mine, so that QN is the
+// out-of-scope probe. Granted as "tokens:read".
 const SCOPES: PatScopeConfig = {
-  tokens: { label: "Tokens", qns: [PatQueries.mine, PatQueries.availableScopes] },
+  tokens: { label: "Tokens", read: [PatQueries.mine, PatQueries.availableScopes] },
 };
 
 async function mintToken(
@@ -63,7 +64,7 @@ async function mintToken(
     PatHandlers.create,
     {
       name: "test",
-      scopes: opts?.scopes ?? ["tokens"],
+      scopes: opts?.scopes ?? ["tokens:read"],
       ...(opts?.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}),
     },
     actor,

package/src/personal-access-tokens/__tests__/scopes.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "bun:test";
+import { expandScopes, type PatScopeConfig, parseGrant } from "../scopes";
+
+const CONFIG: PatScopeConfig = {
+  credit: { label: "Kredite", read: ["credit:query:*"], write: ["credit:write:*"] },
+  miete: { label: "Mieten", read: ["ledger:query:*"] }, // read-only domain
+};
+
+describe("parseGrant", () => {
+  it("splits domain:level on the last colon", () => {
+    expect(parseGrant("credit:write")).toEqual({ domain: "credit", level: "write" });
+  });
+  it("rejects a bare token", () => {
+    expect(parseGrant("credit")).toBeNull();
+  });
+});
+
+describe("expandScopes", () => {
+  it("read grants only the read QNs", () => {
+    expect(expandScopes(CONFIG, ["credit:read"])).toEqual(["credit:query:*"]);
+  });
+
+  it("write grants read + write QNs", () => {
+    expect(expandScopes(CONFIG, ["credit:write"]).sort()).toEqual(
+      ["credit:query:*", "credit:write:*"].sort(),
+    );
+  });
+
+  it("read-only domain ignores a write grant's missing write set", () => {
+    expect(expandScopes(CONFIG, ["miete:write"])).toEqual(["ledger:query:*"]);
+  });
+
+  it("unknown domain contributes nothing (fail-closed)", () => {
+    expect(expandScopes(CONFIG, ["ghost:write"])).toEqual([]);
+  });
+
+  it("unions across multiple grants without duplicates", () => {
+    expect(expandScopes(CONFIG, ["credit:read", "miete:read"]).sort()).toEqual(
+      ["credit:query:*", "ledger:query:*"].sort(),
+    );
+  });
+});

package/src/personal-access-tokens/handlers/available-scopes.query.ts

@@ -2,14 +2,20 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
 import type { PatScopeConfig } from "../scopes";
 
-// Returns the app-declared scopes ({name, label}) so the mint UI can render a
-// checkbox per scope. Built from the config the feature was mounted with — the
-// list is static per deployment, not per user.
+// Returns the app-declared scope domains ({name, label, canWrite}) so the mint
+// UI can render a per-domain level picker (no access / read / read & write).
+// canWrite is false for read-only domains → the UI hides the write option.
+// Static per deployment, not per user.
 export function buildAvailableScopesQuery(scopes: PatScopeConfig) {
   return defineQueryHandler({
     name: "available-scopes",
     schema: z.object({}),
     access: { openToAll: true },
-    handler: async () => Object.entries(scopes).map(([name, def]) => ({ name, label: def.label })),
+    handler: async () =>
+      Object.entries(scopes).map(([name, def]) => ({
+        name,
+        label: def.label,
+        canWrite: (def.write?.length ?? 0) > 0,
+      })),
   });
 }

package/src/personal-access-tokens/scopes.ts

@@ -1,22 +1,43 @@
-// App-declared scopes. Each scope is a named bundle of QN globs the app author
-// wires when mounting the feature — a scope may span features (e.g. a "miete"
-// scope granting ledger + folders QNs). The token stores granted scope NAMES;
-// the resolver expands them to globs at request time.
+// @runtime client
+// Pure scope helpers + types — client-marked so the web screen (web/) may import
+// parseGrant without pulling the feature's server runtime barrel.
+//
+// App-declared scopes — two axes, like GitHub fine-grained PATs: WHICH API
+// (the domain, keyed here) × the permission LEVEL (read vs read+write). Each
+// domain declares its read-QN globs and (optionally) its write-QN globs. A
+// domain may span features (e.g. a "miete" domain granting ledger + folders).
 export type PatScopeDef = {
   readonly label: string;
-  readonly qns: readonly string[];
+  readonly read: readonly string[];
+  // Omit for a read-only domain — the UI then offers only "no access" / "read".
+  readonly write?: readonly string[];
 };
 
 export type PatScopeConfig = Readonly<Record<string, PatScopeDef>>;
 
-// Expand granted scope names into the union of their QN globs. Unknown names
-// (scope dropped from config after a token was minted) contribute nothing —
-// fail-closed: the token silently loses that capability rather than erroring.
+export type PatLevel = "read" | "write";
+
+// A granted scope is the string "<domain>:<level>" (e.g. "credit:write"). The
+// domain key never contains a colon, so split on the LAST one.
+export function parseGrant(grant: string): { domain: string; level: string } | null {
+  const idx = grant.lastIndexOf(":");
+  if (idx <= 0) return null;
+  return { domain: grant.slice(0, idx), level: grant.slice(idx + 1) };
+}
+
+// Expand granted "<domain>:<level>" entries into the union of QN globs: read
+// always grants the read QNs; write additionally grants the write QNs. Unknown
+// domains contribute nothing (fail-closed — a scope dropped from config after a
+// token was minted silently loses that capability).
 export function expandScopes(config: PatScopeConfig, granted: readonly string[]): string[] {
   const out = new Set<string>();
-  for (const name of granted) {
-    const def = config[name];
-    if (def) for (const qn of def.qns) out.add(qn);
+  for (const grant of granted) {
+    const parsed = parseGrant(grant);
+    if (!parsed) continue;
+    const def = config[parsed.domain];
+    if (!def) continue;
+    for (const q of def.read) out.add(q);
+    if (parsed.level === "write") for (const q of def.write ?? []) out.add(q);
   }
   return [...out];
 }

package/src/personal-access-tokens/web/i18n.ts

@@ -5,41 +5,65 @@ export const defaultTranslations: TranslationsByLocale = {
   de: {
     "pat.title": "Personal Access Tokens",
     "pat.create.title": "Neuen Token erstellen",
+    "pat.create.subtitle":
+      "Wähle Berechtigungen und eine Gültigkeit. Der Token wird nur einmal angezeigt.",
     "pat.create.name": "Name",
     "pat.create.namePlaceholder": "z. B. CLI-Automatisierung",
-    "pat.create.scopes": "Berechtigungen",
+    "pat.create.scopes": "Zugriff pro Bereich",
+    "pat.level.none": "Kein Zugriff",
+    "pat.level.read": "Lesen",
+    "pat.level.write": "Lesen & Schreiben",
+    "pat.create.expiry": "Gültig bis",
     "pat.create.submit": "Token erstellen",
     "pat.create.needName": "Bitte einen Namen vergeben.",
     "pat.create.needScope": "Bitte mindestens eine Berechtigung wählen.",
-    "pat.created.title": "Token erstellt — jetzt kopieren",
-    "pat.created.hint": "Dieser Token wird nur einmal angezeigt. Kopiere ihn jetzt.",
-    "pat.created.dismiss": "Verstanden",
+    "pat.expiry.30d": "30 Tage",
+    "pat.expiry.90d": "90 Tage",
+    "pat.expiry.1y": "1 Jahr",
+    "pat.expiry.never": "Unbegrenzt",
+    "pat.created.hint":
+      "Kopiere diesen Token jetzt — er wird aus Sicherheitsgründen nur dieses eine Mal angezeigt.",
+    "pat.created.copy": "Kopieren",
+    "pat.created.copied": "Kopiert ✓",
+    "pat.created.dismiss": "Fertig",
     "pat.list.title": "Deine Tokens",
     "pat.list.empty": "Noch keine Tokens.",
-    "pat.list.created": "Erstellt",
-    "pat.list.revoked": "Widerrufen",
-    "pat.list.expired": "Abgelaufen",
     "pat.list.revoke": "Widerrufen",
+    "pat.list.revoked": "Widerrufen",
+    "pat.list.validUntil": "Gültig bis {date}",
+    "pat.list.neverExpires": "Unbegrenzt gültig",
+    "pat.list.created": "Erstellt {date}",
     "pat.error.generic": "Aktion fehlgeschlagen.",
   },
   en: {
     "pat.title": "Personal Access Tokens",
     "pat.create.title": "Create a new token",
+    "pat.create.subtitle": "Pick permissions and an expiration. The token is shown only once.",
     "pat.create.name": "Name",
     "pat.create.namePlaceholder": "e.g. CLI automation",
-    "pat.create.scopes": "Permissions",
+    "pat.create.scopes": "Per-API access",
+    "pat.level.none": "No access",
+    "pat.level.read": "Read",
+    "pat.level.write": "Read & write",
+    "pat.create.expiry": "Expiration",
     "pat.create.submit": "Create token",
     "pat.create.needName": "Please enter a name.",
     "pat.create.needScope": "Please select at least one permission.",
-    "pat.created.title": "Token created — copy it now",
-    "pat.created.hint": "This token is shown only once. Copy it now.",
-    "pat.created.dismiss": "Got it",
+    "pat.expiry.30d": "30 days",
+    "pat.expiry.90d": "90 days",
+    "pat.expiry.1y": "1 year",
+    "pat.expiry.never": "No expiration",
+    "pat.created.hint": "Copy this token now — for security it is shown only this once.",
+    "pat.created.copy": "Copy",
+    "pat.created.copied": "Copied ✓",
+    "pat.created.dismiss": "Done",
     "pat.list.title": "Your tokens",
     "pat.list.empty": "No tokens yet.",
-    "pat.list.created": "Created",
-    "pat.list.revoked": "Revoked",
-    "pat.list.expired": "Expired",
     "pat.list.revoke": "Revoke",
+    "pat.list.revoked": "Revoked",
+    "pat.list.validUntil": "Valid until {date}",
+    "pat.list.neverExpires": "Never expires",
+    "pat.list.created": "Created {date}",
     "pat.error.generic": "Action failed.",
   },
 };

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -1,8 +1,10 @@
 // @runtime client
-// PatTokensScreen — logged-in self-service for Personal Access Tokens: mint a
-// token (name + scope toggles, plaintext shown once), list your tokens and
-// revoke them. The feature registers it dormant (r.screen); the app places it
-// via r.nav. Imports only from ../constants (pure) — no server pull-in.
+// PatTokensScreen — logged-in self-service for Personal Access Tokens. Two-axis
+// scopes (like GitHub fine-grained PATs): per API domain pick a permission LEVEL
+// (no access / read / read & write). Mint → copy the plaintext ONCE → it's never
+// re-displayed. Layout follows the framework's polished-screen convention (Form
+// primitive + Tailwind), cards match the mh style. The feature registers this
+// dormant (r.screen); the app places it via r.nav.
 
 import {
   useDispatcher,
@@ -12,95 +14,160 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { PatHandlers, PatQueries } from "../constants";
+import { parseGrant } from "../scopes";
 
-type ScopeOption = { readonly name: string; readonly label: string };
+type ScopeDomain = { readonly name: string; readonly label: string; readonly canWrite: boolean };
 type TokenRow = {
   readonly id: string;
   readonly name: string;
-  readonly prefix: string;
   readonly scopes: readonly string[];
   readonly createdAt: string | null;
   readonly expiresAt: string | null;
   readonly revokedAt: string | null;
 };
 
-function isExpired(expiresAt: string | null): boolean {
-  return expiresAt !== null && new Date(expiresAt).getTime() <= Date.now();
+type Level = "none" | "read" | "write";
+type ExpiryKey = "30d" | "90d" | "1y" | "never";
+const EXPIRY_DAYS: Record<ExpiryKey, number | undefined> = {
+  "30d": 30,
+  "90d": 90,
+  "1y": 365,
+  never: undefined,
+};
+
+// Timestamps arrive as ISO strings over the JSON API — slice the date part
+// without touching the banned Date API.
+function isoDate(value: string | null): string | null {
+  return typeof value === "string" && value.length >= 10 ? value.slice(0, 10) : null;
 }
 
 export function PatTokensScreen(): ReactNode {
   const t = useTranslation();
-  const { Section, Heading, Field, Input, Button, Banner, Card, Text } = usePrimitives();
+  const { Form, Field, Input, Button, Banner, Card, Heading } = usePrimitives();
   const dispatcher = useDispatcher();
 
-  const scopesQuery = useQuery<readonly ScopeOption[]>(PatQueries.availableScopes, {});
+  const scopesQuery = useQuery<readonly ScopeDomain[]>(PatQueries.availableScopes, {});
   const listQuery = useQuery<readonly TokenRow[]>(PatQueries.mine, {});
 
   const [name, setName] = useState("");
-  const [selected, setSelected] = useState<readonly string[]>([]);
-  const [minted, setMinted] = useState<{ token: string; prefix: string } | null>(null);
+  const [levels, setLevels] = useState<Readonly<Record<string, Level>>>({});
+  const [expiry, setExpiry] = useState<ExpiryKey>("90d");
+  const [minted, setMinted] = useState<{ token: string } | null>(null);
+  const [copied, setCopied] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
 
-  const scopes = scopesQuery.data ?? [];
+  const domains = scopesQuery.data ?? [];
   const tokens = listQuery.data ?? [];
+  const labelOf = (domain: string): string =>
+    domains.find((d) => d.name === domain)?.label ?? domain;
+
+  // Granted scopes = "<domain>:<level>" for every domain not set to "none".
+  const grants = (): string[] =>
+    Object.entries(levels)
+      .filter(([, l]) => l !== "none")
+      .map(([domain, l]) => `${domain}:${l}`);
 
-  const toggle = (scope: string): void =>
-    setSelected((cur) => (cur.includes(scope) ? cur.filter((s) => s !== scope) : [...cur, scope]));
+  const setLevel = (domain: string, level: Level): void =>
+    setLevels((cur) => ({ ...cur, [domain]: level }));
 
   const create = async (): Promise<void> => {
     if (name.trim() === "") return setError(t("pat.create.needName"));
-    if (selected.length === 0) return setError(t("pat.create.needScope"));
+    const scopes = grants();
+    if (scopes.length === 0) return setError(t("pat.create.needScope"));
     setBusy(true);
     setError(null);
+    const days = EXPIRY_DAYS[expiry];
     const res = await dispatcher.write(PatHandlers.create, {
       name: name.trim(),
-      scopes: selected,
+      scopes,
+      ...(days !== undefined ? { expiresInDays: days } : {}),
     });
     setBusy(false);
     if (!res.isSuccess) return setError(t("pat.error.generic"));
-    const data = res.data as { token: string; prefix: string };
-    setMinted({ token: data.token, prefix: data.prefix });
+    setMinted({ token: (res.data as { token: string }).token });
+    setCopied(false);
     setName("");
-    setSelected([]);
+    setLevels({});
+    setExpiry("90d");
     void listQuery.refetch?.();
   };
 
+  const copy = async (): Promise<void> => {
+    if (!minted) return;
+    try {
+      await navigator.clipboard.writeText(minted.token);
+      setCopied(true);
+    } catch {
+      // clipboard blocked (non-secure context) — the token stays selectable in place
+    }
+  };
+
   const revoke = async (id: string): Promise<void> => {
     const res = await dispatcher.write(PatHandlers.revoke, { id });
     if (!res.isSuccess) return setError(t("pat.error.generic"));
     void listQuery.refetch?.();
   };
 
-  const status = (row: TokenRow): string => {
-    if (row.revokedAt !== null) return t("pat.list.revoked");
-    if (isExpired(row.expiresAt)) return t("pat.list.expired");
-    return "";
+  // "Pages (read & write) · Tags (read) · Valid until … · Created …"
+  const meta = (row: TokenRow): string => {
+    const scopeText = row.scopes
+      .map((g) => {
+        const p = parseGrant(g);
+        if (!p) return g;
+        const lvl = p.level === "write" ? t("pat.level.write") : t("pat.level.read");
+        return `${labelOf(p.domain)} (${lvl})`;
+      })
+      .join(" · ");
+    const d = isoDate(row.expiresAt);
+    const parts = [
+      scopeText,
+      d ? t("pat.list.validUntil", { date: d }) : t("pat.list.neverExpires"),
+    ];
+    const created = isoDate(row.createdAt);
+    if (created) parts.push(t("pat.list.created", { date: created }));
+    return parts.join("  ·  ");
   };
 
   return (
-    <Section>
+    <div className="flex max-w-3xl flex-col gap-6 p-6">
       <Heading>{t("pat.title")}</Heading>
 
       {minted && (
         <Banner
           variant="info"
           actions={
-            <Button variant="secondary" onClick={() => setMinted(null)}>
-              {t("pat.created.dismiss")}
-            </Button>
+            <>
+              <Button variant="primary" onClick={copy}>
+                {copied ? t("pat.created.copied") : t("pat.created.copy")}
+              </Button>
+              <Button variant="secondary" onClick={() => setMinted(null)}>
+                {t("pat.created.dismiss")}
+              </Button>
+            </>
           }
         >
-          <Heading>{t("pat.created.title")}</Heading>
-          <Text>{minted.token}</Text>
-          <Text>{t("pat.created.hint")}</Text>
+          <div className="flex flex-col gap-2">
+            <span className="text-sm">{t("pat.created.hint")}</span>
+            <code className="block break-all rounded bg-muted px-3 py-2 font-mono text-sm">
+              {minted.token}
+            </code>
+          </div>
         </Banner>
       )}
 
       {error && <Banner variant="error">{error}</Banner>}
 
-      <Section>
-        <Heading>{t("pat.create.title")}</Heading>
+      <Form
+        title={t("pat.create.title")}
+        subtitle={t("pat.create.subtitle")}
+        onSubmit={create}
+        actions={
+          <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
+            {t("pat.create.submit")}
+          </Button>
+        }
+      >
         <Field id="pat-name" label={t("pat.create.name")} required>
           <Input
             kind="text"
@@ -112,39 +179,73 @@ export function PatTokensScreen(): ReactNode {
             disabled={busy}
           />
         </Field>
-        <Text>{t("pat.create.scopes")}</Text>
-        {scopes.map((s) => (
-          <Button
-            key={s.name}
-            variant={selected.includes(s.name) ? "primary" : "secondary"}
-            onClick={() => toggle(s.name)}
-            disabled={busy}
-          >
-            {s.label}
-          </Button>
+
+        {domains.map((d) => (
+          <Field key={d.name} id={`pat-scope-${d.name}`} label={d.label}>
+            <Input
+              kind="select"
+              id={`pat-scope-${d.name}`}
+              name={d.name}
+              value={levels[d.name] ?? "none"}
+              onChange={(v) => setLevel(d.name, v as Level)}
+              options={[
+                { value: "none", label: t("pat.level.none") },
+                { value: "read", label: t("pat.level.read") },
+                ...(d.canWrite ? [{ value: "write", label: t("pat.level.write") }] : []),
+              ]}
+              disabled={busy}
+            />
+          </Field>
         ))}
-        <Button type="submit" variant="primary" onClick={create} loading={busy} disabled={busy}>
-          {t("pat.create.submit")}
-        </Button>
-      </Section>
 
-      <Section>
+        <Field id="pat-expiry" label={t("pat.create.expiry")}>
+          <Input
+            kind="select"
+            id="pat-expiry"
+            name="expiry"
+            value={expiry}
+            onChange={(v) => setExpiry(v as ExpiryKey)}
+            options={[
+              { value: "30d", label: t("pat.expiry.30d") },
+              { value: "90d", label: t("pat.expiry.90d") },
+              { value: "1y", label: t("pat.expiry.1y") },
+              { value: "never", label: t("pat.expiry.never") },
+            ]}
+            disabled={busy}
+          />
+        </Field>
+      </Form>
+
+      <div className="flex flex-col gap-3">
         <Heading>{t("pat.list.title")}</Heading>
-        {tokens.length === 0 && <Text>{t("pat.list.empty")}</Text>}
-        {tokens.map((row) => (
-          <Card key={row.id}>
-            <Text>
-              {row.name} — {row.prefix}… {status(row)}
-            </Text>
-            <Text>{row.scopes.join(", ")}</Text>
-            {row.revokedAt === null && (
-              <Button variant="danger" onClick={() => revoke(row.id)}>
-                {t("pat.list.revoke")}
-              </Button>
-            )}
-          </Card>
-        ))}
-      </Section>
-    </Section>
+        {tokens.length === 0 && (
+          <span className="text-sm text-muted-foreground">{t("pat.list.empty")}</span>
+        )}
+        {tokens.map((row) => {
+          const revoked = row.revokedAt !== null;
+          return (
+            <Card
+              key={row.id}
+              options={{ padded: false }}
+              className={`p-4 ${revoked ? "opacity-60" : ""}`}
+            >
+              <div className="flex items-center justify-between gap-3">
+                <div className="flex min-w-0 flex-col gap-0.5">
+                  <span className="truncate text-sm font-semibold">{row.name}</span>
+                  <span className="truncate text-xs text-muted-foreground">
+                    {revoked ? t("pat.list.revoked") : meta(row)}
+                  </span>
+                </div>
+                {!revoked && (
+                  <Button variant="danger" onClick={() => revoke(row.id)}>
+                    {t("pat.list.revoke")}
+                  </Button>
+                )}
+              </div>
+            </Card>
+          );
+        })}
+      </div>
+    </div>
   );
 }

package/src/sessions/__tests__/auto-revoke-binding.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, mock, test } from "bun:test";
+import type { AppContext, SaveContext } from "@cosmicdrift/kumiko-framework/engine";
+import { bindAutoRevokeFromFeature, createSessionsFeature } from "../feature";
+
+// The postSave hook is registered unconditionally; the revoker arrives either
+// as the explicit constructor option or late-bound by run{Prod,Dev}App via
+// bindAutoRevokeOnPasswordChange. These tests pin the binding + precedence
+// semantics at the hook level — the full DB sweep is covered by
+// password-auto-revoke.integration.test.ts.
+
+const passwordChange: SaveContext = {
+  kind: "save",
+  id: "user-1",
+  data: {},
+  changes: { passwordHash: "new-hash" },
+  previous: {},
+  isNew: false,
+};
+
+// @cast-boundary test fixture — the hook never touches AppContext
+const appContext = {} as unknown as AppContext;
+
+function userPostSaveHook(feature: ReturnType<typeof createSessionsFeature>) {
+  const hook = feature.entityHooks?.postSave?.["user"]?.[0];
+  if (!hook) throw new Error("sessions feature did not register the user postSave hook");
+  return (ctx: SaveContext) => hook.fn(ctx, appContext);
+}
+
+describe("sessions auto-revoke binding", () => {
+  test("late-bound revoker fires on password change", async () => {
+    const revoker = mock(async (_userId: string) => 1);
+    const feature = createSessionsFeature();
+
+    const bind = bindAutoRevokeFromFeature(feature);
+    expect(bind).toBeDefined();
+    bind?.(revoker);
+
+    await userPostSaveHook(feature)(passwordChange);
+    expect(revoker).toHaveBeenCalledTimes(1);
+    expect(revoker).toHaveBeenCalledWith("user-1");
+  });
+
+  test("unbound hook is a silent no-op", async () => {
+    const feature = createSessionsFeature();
+    // must resolve without throwing — stateless-JWT deployments have no revoker
+    const result = await userPostSaveHook(feature)(passwordChange);
+    expect(result).toBeUndefined();
+  });
+
+  test("skips isNew and non-passwordHash changes", async () => {
+    const revoker = mock(async (_userId: string) => 1);
+    const feature = createSessionsFeature();
+    bindAutoRevokeFromFeature(feature)?.(revoker);
+
+    await userPostSaveHook(feature)({ ...passwordChange, isNew: true });
+    await userPostSaveHook(feature)({ ...passwordChange, changes: { displayName: "x" } });
+    expect(revoker).not.toHaveBeenCalled();
+  });
+
+  test("explicit constructor option wins over the runtime binding", async () => {
+    const explicit = mock(async (_userId: string) => 1);
+    const lateBound = mock(async (_userId: string) => 1);
+    const feature = createSessionsFeature({ autoRevokeOnPasswordChange: explicit });
+
+    bindAutoRevokeFromFeature(feature)?.(lateBound);
+    await userPostSaveHook(feature)(passwordChange);
+
+    expect(explicit).toHaveBeenCalledWith("user-1");
+    expect(lateBound).not.toHaveBeenCalled();
+  });
+});

package/src/sessions/feature.ts

@@ -10,19 +10,46 @@ import { userSessionEntity } from "./schema/user-session";
 import type { SessionMassRevoker } from "./session-callbacks";
 
 export type SessionsFeatureOptions = {
-  // When wired, a successful update on the `user` entity that changes the
-  // `passwordHash` column triggers a mass-revoke of every live session for
-  // that user. Industry-standard "password-change signs you out everywhere"
-  // flow, including the session that did the change itself — the client has
+  // A successful update on the `user` entity that changes the `passwordHash`
+  // column triggers a mass-revoke of every live session for that user.
+  // Industry-standard "password-change signs you out everywhere" flow,
+  // including the session that did the change itself — the client has
   // to re-login after a password change.
   //
   // Runs as an afterCommit postSave hook: the password-change commits first,
   // then the sessions are revoked. Best-effort — if the mass-revoker throws,
   // the password change is NOT rolled back (a password change with a stale
   // session still wins over a user-visible error on the change itself).
+  //
+  // Default: run{Prod,Dev}App bind their own sessionMassRevoker via
+  // `bindAutoRevokeOnPasswordChange` (secure-by-default). Set this option
+  // only to supply a custom revoker — an explicit value wins over the
+  // runtime binding.
   readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
 };
 
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
+
+// Reads the late-bind setter off a mounted sessions feature's exports.
+// run{Prod,Dev}App call it once the DB connection is concrete — the feature
+// itself is constructed in app run-config long before a db exists, so the
+// revoker can't be a constructor argument.
+export function bindAutoRevokeFromFeature(
+  feature: FeatureDefinition,
+): BindAutoRevokeOnPasswordChange | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
+    const { bindAutoRevokeOnPasswordChange } = exports as {
+      bindAutoRevokeOnPasswordChange: unknown;
+    };
+    if (typeof bindAutoRevokeOnPasswordChange === "function") {
+      // @cast-boundary exports-walk — feature.exports is untyped by design
+      return bindAutoRevokeOnPasswordChange as BindAutoRevokeOnPasswordChange;
+    }
+  }
+  return undefined;
+}
+
 // The sessions feature registers the read_user_sessions table (as an
 // unmanaged direct-write store, NOT an r.entity — see below) and the three
 // user-facing handlers (mine/revoke/revoke-all-others). It intentionally does NOT
@@ -93,20 +120,26 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // "the handler didn't touch this column", which is exactly the signal
     // we want to skip on. Works for both direct user:update calls and any
     // other handler that happens to write the column.
-    const autoRevoke = options?.autoRevokeOnPasswordChange;
-    if (autoRevoke) {
-      r.entityHook("postSave", "user", async (ctx) => {
-        // skip: brand-new user, no sessions can possibly exist yet. The
-        // initial passwordHash on a user:create would trip the second guard
-        // otherwise — every registration would do a mass-revoke roundtrip
-        // for a user who literally has no rows in user_sessions.
-        if (ctx.isNew) return;
-        // skip: handler didn't touch passwordHash, nothing to revoke
-        if (ctx.changes["passwordHash"] === undefined) return;
-        await autoRevoke(String(ctx.id));
-      });
-    }
+    let autoRevoke = options?.autoRevokeOnPasswordChange;
+    r.entityHook("postSave", "user", async (ctx) => {
+      // skip: nothing bound — stateless-JWT deployments without a runtime
+      // that calls bindAutoRevokeOnPasswordChange keep the old behavior.
+      if (!autoRevoke) return;
+      // skip: brand-new user, no sessions can possibly exist yet. The
+      // initial passwordHash on a user:create would trip the second guard
+      // otherwise — every registration would do a mass-revoke roundtrip
+      // for a user who literally has no rows in user_sessions.
+      if (ctx.isNew) return;
+      // skip: handler didn't touch passwordHash, nothing to revoke
+      if (ctx.changes["passwordHash"] === undefined) return;
+      await autoRevoke(String(ctx.id));
+    });
+
+    const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
+      // explicit constructor option wins over the runtime binding
+      autoRevoke ??= revoker;
+    };
 
-    return { handlers, queries };
+    return { handlers, queries, bindAutoRevokeOnPasswordChange };
   });
 }

package/src/sessions/index.ts

@@ -6,8 +6,8 @@ export {
   SessionHandlers,
   SessionQueries,
 } from "./constants";
-export type { SessionsFeatureOptions } from "./feature";
-export { createSessionsFeature } from "./feature";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature";
 export { userSessionEntity, userSessionTable } from "./schema/user-session";
 export type {
   SessionCallbacks,

package/src/user/__tests__/user.integration.test.ts

@@ -109,6 +109,32 @@ describe("scenario 2: field-level read access", () => {
   });
 });
 
+// --- find-for-auth is system-only: it returns the raw row incl. passwordHash,
+// and every query handler is reachable via POST /api/query — so even a
+// SystemAdmin (assignable app role) must be denied over HTTP. ---
+
+describe("scenario 2b: find-for-auth is system-only", () => {
+  test("SystemAdmin over HTTP is denied — passwordHash must not leak", async () => {
+    await seedUser({
+      email: "auth-lookup@example.com",
+      displayName: "AuthLookup",
+      passwordHash: "must-never-leave-the-server",
+    });
+
+    const res = await stack.http.queryWithHeaders(
+      UserQueries.findForAuth,
+      { email: "auth-lookup@example.com" },
+      systemAdmin,
+      {},
+    );
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    const body = await res.text();
+    expect(body).toContain("access_denied");
+    expect(body).not.toContain("must-never-leave-the-server");
+  });
+});
+
 // --- Scenario 3: user edits own profile, email/passwordHash are system-locked ---
 
 describe("scenario 3: self-update + field-level write access", () => {

package/src/user/handlers/find-for-auth.query.ts

@@ -7,10 +7,12 @@ import { userTable } from "../schema/user";
 // by email OR id (exactly one, enforced by the schema). Used by the auth
 // features via ctx.queryAs(systemUser, ...).
 //
-// Field-level read rules allow passwordHash for the "privileged" role set,
-// so system callers see everything; any other caller is filtered even if
-// they somehow reach this handler. Access is also restricted to privileged
-// — regular users or tenant admins cannot call this at all.
+// Access is system-only, NOT access.privileged: every query handler is
+// reachable via POST /api/query, and "SystemAdmin" is an assignable app
+// role — privileged would hand any SystemAdmin the raw passwordHash over
+// HTTP. The "system" role can't be minted into a session (only
+// createSystemUser() carries it), so system-only keeps this handler
+// internal to ctx.queryAs(systemUser, ...) callers.
 export const findForAuthQuery = defineQueryHandler({
   name: "user:find-for-auth",
   schema: z
@@ -24,7 +26,7 @@ export const findForAuthQuery = defineQueryHandler({
       (v) => (v.email !== undefined) !== (v.id !== undefined),
       { message: "exactly one of email or id must be set" },
     ),
-  access: { roles: access.privileged },
+  access: { roles: access.system },
   handler: async (query, ctx) => {
     const where =
       query.payload.email !== undefined