@cosmicdrift/kumiko-bundled-features 0.147.0 → 0.147.2

package/src/auth-mfa/__tests__/disable-and-regenerate.integration.test.ts

@@ -0,0 +1,202 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// Runs enable-start + enable-confirm for a fresh user and returns the
+// user + the live secret so tests can derive current TOTP codes.
+async function enableMfaFor(userId: string): Promise<{
+  user: ReturnType<typeof createTestUser>;
+  secret: Buffer;
+  recoveryCodes: string[];
+}> {
+  const user = createTestUser({ id: userId, roles: ["User"] });
+  const start = await stack.http.writeOk<{
+    setupToken: string;
+    otpauthUri: string;
+    recoveryCodes: string[];
+  }>(AuthMfaHandlers.enableStart, { accountLabel: `${userId}@example.com` }, user);
+
+  const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+  const secret = base32Decode(secretParam);
+  await stack.http.writeOk(
+    AuthMfaHandlers.enableConfirm,
+    { setupToken: start.setupToken, code: currentTotpCode(secret) },
+    user,
+  );
+
+  return { user, secret, recoveryCodes: start.recoveryCodes };
+}
+
+describe("disable", () => {
+  test("a valid TOTP code disables MFA, and a fresh enable-start succeeds afterward", async () => {
+    const { user, secret } = await enableMfaFor("disable-totp-1");
+
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+
+    const secondStart = await stack.http.writeOk<{ setupToken: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "disable-totp-1@example.com" },
+      user,
+    );
+    expect(secondStart.setupToken).toBeTruthy();
+  });
+
+  test("MFA can be fully re-enabled after disable (re-create on a deleted aggregate)", async () => {
+    const { user, secret: firstSecret } = await enableMfaFor("disable-reenable-1");
+
+    await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(firstSecret) },
+      user,
+    );
+
+    const restart = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "disable-reenable-1@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(restart.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secondSecret = base32Decode(secretParam);
+
+    const confirm = await stack.http.writeOk<{ enabled: boolean }>(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: restart.setupToken, code: currentTotpCode(secondSecret) },
+      user,
+    );
+    expect(confirm.enabled).toBe(true);
+
+    // The re-enabled row is fully usable — a real code disables it again.
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secondSecret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("a valid recovery code also disables MFA", async () => {
+    const { user, recoveryCodes } = await enableMfaFor("disable-recovery-1");
+
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: recoveryCodes[0] },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("a wrong code is rejected and MFA stays enabled", async () => {
+    const { user, secret } = await enableMfaFor("disable-wrong-1");
+
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "000000" }, user);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    // Still enabled — a real code still works.
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("disable on a user without MFA is rejected", async () => {
+    const user = createTestUser({ id: "disable-never-enabled-1", roles: ["User"] });
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "123456" }, user);
+    expectErrorIncludes(err, "mfa_not_enabled");
+  });
+});
+
+describe("regenerate-recovery", () => {
+  test("issues 8 fresh codes and invalidates the old ones", async () => {
+    const { user, secret, recoveryCodes: oldCodes } = await enableMfaFor("regen-1");
+
+    const res = await stack.http.writeOk<{ recoveryCodes: string[] }>(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.recoveryCodes).toHaveLength(8);
+    expect(res.recoveryCodes).not.toEqual(oldCodes);
+
+    // An old code no longer works to disable MFA.
+    const oldCode = oldCodes[0];
+    if (oldCode === undefined) throw new Error("test setup produced no old recovery code");
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: oldCode }, user);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    // A NEW code works.
+    const newCode = res.recoveryCodes[0];
+    if (newCode === undefined) throw new Error("regenerate produced no new recovery code");
+    const disableRes = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: newCode },
+      user,
+    );
+    expect(disableRes.disabled).toBe(true);
+  });
+
+  test("regenerate on a user without MFA is rejected", async () => {
+    const user = createTestUser({ id: "regen-never-enabled-1", roles: ["User"] });
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: "123456" },
+      user,
+    );
+    expectErrorIncludes(err, "mfa_not_enabled");
+  });
+});

package/src/auth-mfa/__tests__/enable-flow.integration.test.ts

@@ -0,0 +1,150 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  // totpSecret is `encrypted: true` — needs a cipher configured before any
+  // enable-confirm write, same as any other encrypted-entity-field test.
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("enable-start + enable-confirm round trip", () => {
+  test("start returns a setup token + otpauth URI + 8 recovery codes", async () => {
+    const user = createTestUser({ id: "enable-start-1", roles: ["User"] });
+
+    const res = await stack.http.writeOk<{
+      setupToken: string;
+      otpauthUri: string;
+      recoveryCodes: string[];
+    }>(AuthMfaHandlers.enableStart, { accountLabel: "jane@example.com" }, user);
+
+    expect(res.setupToken.split(".").length).toBe(2);
+    expect(res.otpauthUri).toStartWith("otpauth://totp/");
+    expect(res.otpauthUri).toContain("jane%40example.com");
+    expect(res.recoveryCodes).toHaveLength(8);
+    // Format XXXX-XXXX
+    for (const code of res.recoveryCodes) {
+      expect(code).toMatch(/^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
+    }
+  });
+
+  test("confirm with the right code enables MFA", async () => {
+    const user = createTestUser({ id: "enable-confirm-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "confirm@example.com" },
+      user,
+    );
+
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    const code = currentTotpCode(secret);
+
+    const confirmed = await stack.http.writeOk<{ enabled: boolean }>(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code },
+      user,
+    );
+    expect(confirmed.enabled).toBe(true);
+
+    // Second enable-start now rejects — MFA already enabled for this user.
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "confirm@example.com" },
+      user,
+    );
+    expectErrorIncludes(err, "mfa_already_enabled");
+  });
+
+  test("confirm with a wrong code is rejected and does not create a row", async () => {
+    const user = createTestUser({ id: "enable-confirm-wrong-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "wrong@example.com" },
+      user,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: "000000" },
+      user,
+    );
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    // MFA is still not enabled — a fresh enable-start succeeds.
+    const secondStart = await stack.http.writeOk<{ setupToken: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "wrong@example.com" },
+      user,
+    );
+    expect(secondStart.setupToken).toBeTruthy();
+  });
+
+  test("confirm rejects a setup token signed for a different user", async () => {
+    const userA = createTestUser({ id: "enable-confirm-cross-a", roles: ["User"] });
+    const userB = createTestUser({ id: "enable-confirm-cross-b", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "cross@example.com" },
+      userA,
+    );
+
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const code = currentTotpCode(base32Decode(secretParam));
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code },
+      userB,
+    );
+    expectErrorIncludes(err, "invalid_setup_token");
+  });
+});

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -0,0 +1,167 @@
+// KEK-rotation job for kumiko-framework#266 Step 8. Proves two things:
+//
+//   1. The job actually rewraps totpSecret onto the current KEK version.
+//   2. Advisor-flagged trap: rotation must not just touch the live
+//      projection — a FULL PROJECTION REBUILD after rotation must still
+//      decrypt correctly. Events store CIPHERTEXT (see #967 — "the
+//      immutable log never sees plaintext, replay reproduces the row
+//      byte-identically"), so a rebuild replays events in order and lands
+//      on the LATEST event's ciphertext. That's only true if the rotation
+//      job goes through executor.update() (which appends a real event)
+//      instead of a raw UPDATE on the projection table — this test is the
+//      regression guard for that specific design choice.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { mfaReencryptJob } from "../handlers/reencrypt.job";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+
+let stack: TestStack;
+const v1Key = randomBytes(32).toString("base64");
+const v2Key = randomBytes(32).toString("base64");
+const mutableProvider = createMutableMasterKeyProvider(
+  createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  }),
+);
+
+beforeAll(async () => {
+  const cipher = createEnvelopeCipher(mutableProvider, {});
+  configureEntityFieldEncryption(cipher);
+  const resolver = createConfigResolver({ cipher });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      }),
+    ],
+    masterKeyProvider: mutableProvider,
+    extraContext: { configResolver: resolver, configEncryption: cipher },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+type RawUserMfaRow = { id: string; totpSecret: string; version: number };
+
+async function readRawRow(): Promise<RawUserMfaRow> {
+  const rows = await selectMany<RawUserMfaRow>(stack.db, userMfaTable, {});
+  const row = rows[0];
+  if (!row) throw new Error("no user-mfa row");
+  return row;
+}
+
+const noopLog = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  child: () => noopLog,
+};
+
+function jobCtx(): AppContext {
+  return {
+    db: stack.db,
+    registry: stack.registry,
+    masterKeyProvider: mutableProvider,
+    log: noopLog,
+  } as AppContext; // @cast-boundary test-seam — job only reads db/registry/masterKeyProvider/log
+}
+
+describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
+  test("rotation rewraps totpSecret onto the current KEK, and a full projection rebuild still decrypts correctly", async () => {
+    const user = createTestUser({ id: 1, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "user-1@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const beforeRow = await readRawRow();
+    expect(JSON.parse(beforeRow.totpSecret).kekVersion).toBe(1);
+
+    // Simulate "ops added a new master key version and flipped CURRENT=2" —
+    // same simulate-rotation-without-restart helper secrets/rotate uses.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_V2: v2Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+        },
+      }),
+    );
+
+    await mfaReencryptJob({}, jobCtx());
+
+    const afterJobRow = await readRawRow();
+    expect(JSON.parse(afterJobRow.totpSecret).kekVersion).toBe(2);
+
+    // The regression guard: rebuild the projection from scratch (replays
+    // every event for this aggregate) and confirm it still lands on the
+    // V2 envelope — NOT a resurrected V1 wrap from the original
+    // enable-confirm event.
+    await rebuildProjection("auth-mfa:projection:user-mfa-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+
+    const afterRebuildRow = await readRawRow();
+    expect(JSON.parse(afterRebuildRow.totpSecret).kekVersion).toBe(2);
+
+    // Decrypt-level proof, not just the version tag: a valid TOTP code
+    // against the post-rebuild secret still verifies — the plaintext
+    // survived rotation + rebuild byte-identically. disable() decrypts
+    // totpSecret to check the code, so a decrypt failure (wrong key)
+    // would surface here as invalid_totp_code or a hard error, not a
+    // silent pass.
+    await stack.http.writeOk(AuthMfaHandlers.disable, { code: currentTotpCode(secret) }, user);
+  });
+});

package/src/auth-mfa/__tests__/session-auto-revoke.integration.test.ts

@@ -0,0 +1,168 @@
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionCallbacks } from "../../sessions/session-callbacks";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { bindMfaRevokeAllOtherSessionsFromFeature, createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+// Enable/disable/regenerate are security-relevant state changes on the
+// account — every OTHER live session must be signed out (stolen-session
+// defense), but the session that performed the change must survive.
+
+let stack: TestStack;
+let sessionCallbacks: ReturnType<typeof createSessionCallbacks>;
+
+const SETUP_TOKEN_SECRET = "test-mfa-setup-secret-at-least-32-bytes-long!!";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+  });
+  stack = await setupTestStack({
+    features: [createConfigFeature(), createUserFeature(), mfaFeature],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+
+  sessionCallbacks = createSessionCallbacks({ db: stack.db });
+  const bind = bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature);
+  if (!bind) throw new Error("auth-mfa did not export bindRevokeAllOtherSessions");
+  bind(sessionCallbacks.sessionRevokeAllOthers);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
+});
+
+describe("session auto-revoke on MFA state changes", () => {
+  test("enable-confirm revokes every OTHER session but keeps the caller's", async () => {
+    const userId = "revoke-enable-1";
+    const currentSid = await sessionCallbacks.sessionCreator(createTestUser({ id: userId }), {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(createTestUser({ id: userId }), {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const user = createTestUser({ id: userId, sid: currentSid });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+  });
+
+  test("disable revokes every OTHER session but keeps the caller's", async () => {
+    const userId = "revoke-disable-1";
+    const setupUser = createTestUser({ id: userId });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      setupUser,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      setupUser,
+    );
+
+    const currentSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const caller = createTestUser({ id: userId, sid: currentSid });
+    await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      caller,
+    );
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("revoked");
+  });
+
+  test("a failed disable attempt does NOT revoke any session", async () => {
+    const userId = "revoke-fail-1";
+    const setupUser = createTestUser({ id: userId });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: `${userId}@example.com` },
+      setupUser,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      setupUser,
+    );
+
+    const currentSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+    const otherSid = await sessionCallbacks.sessionCreator(setupUser, {
+      ip: "127.0.0.1",
+      userAgent: "test",
+    });
+
+    const caller = createTestUser({ id: userId, sid: currentSid });
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "000000" }, caller);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    expect(await sessionCallbacks.sessionChecker(currentSid, userId)).toBe("live");
+    expect(await sessionCallbacks.sessionChecker(otherSid, userId)).toBe("live");
+  });
+});