@cosmicdrift/kumiko-bundled-features 0.147.1 → 0.147.2

package/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -0,0 +1,106 @@
+// @runtime client
+// Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
+// (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
+// useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein
+// JWT. Nach Erfolg ruft es session.refresh() statt eines Hard-Reloads, weil
+// der Aufrufer (typisch ein Wizard-State im App-Root) sofort neu rendern
+// will, sobald status:"authenticated" ankommt.
+
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type FormEvent, type ReactNode, useState } from "react";
+// kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
+import { AuthCard, useSession } from "../../auth-email-password/web";
+import { verifyMfaChallenge } from "./mfa-client";
+
+export type MfaVerifyScreenProps = {
+  readonly challengeToken: string;
+  readonly title?: string;
+  readonly subtitle?: ReactNode;
+  readonly submitLabel?: string;
+  /** Called after the server confirms the code and the session state has
+   *  refreshed. Optional — apps that swap this screen back out purely on
+   *  session.status changing to "authenticated" don't need it. */
+  readonly onSuccess?: () => void;
+};
+
+function reasonToKey(reason: string): string {
+  switch (reason) {
+    case "invalid_totp_code":
+    case "invalid_recovery_code":
+    case "invalid_code":
+      return "auth.mfa.errors.invalidCode";
+    case "challenge_expired":
+    case "invalid_challenge_token":
+      return "auth.mfa.errors.challengeExpired";
+    case "too_many_attempts":
+      return "auth.mfa.errors.tooManyAttempts";
+    case "rate_limited":
+      return "auth.errors.rateLimited";
+    default:
+      return "auth.mfa.errors.verifyFailed";
+  }
+}
+
+export function MfaVerifyScreen({
+  challengeToken,
+  title,
+  subtitle,
+  submitLabel,
+  onSuccess,
+}: MfaVerifyScreenProps): ReactNode {
+  const t = useTranslation();
+  const { Form, Field, Input, Button, Banner } = usePrimitives();
+  const session = useSession();
+  const [code, setCode] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const doSubmit = async (): Promise<void> => {
+    setSubmitting(true);
+    setError(null);
+    const res = await verifyMfaChallenge(challengeToken, code);
+    if (res.kind === "success") {
+      await session.refresh();
+      setSubmitting(false);
+      onSuccess?.();
+      return;
+    }
+    setSubmitting(false);
+    setError(res.error.reason);
+  };
+
+  const onSubmit = (e?: FormEvent): void => {
+    e?.preventDefault();
+    void doSubmit();
+  };
+
+  return (
+    <AuthCard
+      title={title ?? t("auth.mfa.verify.title")}
+      subtitle={subtitle ?? t("auth.mfa.verify.subtitle")}
+    >
+      <div className="p-6 pt-0 flex flex-col gap-4">
+        <Form onSubmit={onSubmit}>
+          <Field id="mfa-verify-code" label={t("auth.mfa.verify.code")} required>
+            <Input
+              kind="text"
+              id="mfa-verify-code"
+              name="mfa-verify-code"
+              value={code}
+              onChange={setCode}
+              disabled={submitting}
+              required
+              autoComplete="one-time-code"
+            />
+          </Field>
+          {error !== null ? <Banner variant="error">{t(reasonToKey(error))}</Banner> : null}
+          <Button type="submit" loading={submitting} disabled={submitting}>
+            {submitting
+              ? t("auth.mfa.verify.submitting")
+              : (submitLabel ?? t("auth.mfa.verify.submit"))}
+          </Button>
+        </Form>
+      </div>
+    </AuthCard>
+  );
+}

package/src/auth-mfa-user-data/__tests__/hooks.integration.test.ts

@@ -0,0 +1,132 @@
+// userMfaExportHook/userMfaDeleteHook — GDPR export must never surface the
+// TOTP secret or recovery codes, and forget must actually remove the row
+// (not just leave it dangling for a future projection rebuild to resurrect).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { base32Decode } from "../../auth-mfa/base32";
+import { AuthMfaHandlers } from "../../auth-mfa/constants";
+import { createAuthMfaFeature } from "../../auth-mfa/feature";
+import { userMfaEntity } from "../../auth-mfa/schema/user-mfa";
+import { currentTotpCode } from "../../auth-mfa/totp";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { userMfaDeleteHook, userMfaExportHook } from "../hooks";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+async function enrollUser(userId: string) {
+  const user = createTestUser({ id: userId, roles: ["User"] });
+  const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+    AuthMfaHandlers.enableStart,
+    { accountLabel: `${userId}@example.com` },
+    user,
+  );
+  const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+  const secret = base32Decode(secretParam);
+  await stack.http.writeOk(
+    AuthMfaHandlers.enableConfirm,
+    { setupToken: start.setupToken, code: currentTotpCode(secret) },
+    user,
+  );
+  return user;
+}
+
+describe("userMfaExportHook / userMfaDeleteHook", () => {
+  test("export confirms enrollment without leaking the TOTP secret or recovery codes", async () => {
+    const user = await enrollUser("export-1");
+
+    const snippet = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+
+    expect(snippet).not.toBeNull();
+    expect(snippet?.rows).toHaveLength(1);
+    const row = snippet?.rows[0] as Record<string, unknown>;
+    expect(row["enrolled"]).toBe(true);
+    expect(JSON.stringify(row)).not.toContain("totpSecret");
+    expect(JSON.stringify(row)).not.toContain("recoveryCodes");
+  });
+
+  test("export returns null for a user who never enrolled", async () => {
+    const user = createTestUser({ id: "never-enrolled", roles: ["User"] });
+    const snippet = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(snippet).toBeNull();
+  });
+
+  test("delete hard-removes the row via forget (rebuild-safe)", async () => {
+    const user = await enrollUser("delete-1");
+
+    const before = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(before).not.toBeNull();
+
+    await userMfaDeleteHook(
+      {
+        db: stack.db,
+        registry: stack.registry,
+        tenantId: user.tenantId,
+        userId: user.id,
+      },
+      "delete",
+    );
+
+    const after = await userMfaExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: user.tenantId,
+      userId: user.id,
+    });
+    expect(after).toBeNull();
+  });
+});

package/src/auth-mfa-user-data/hooks.ts

@@ -0,0 +1,53 @@
+// EXT_USER_DATA hooks for userMfa (GDPR Art. 15/17/20). Both totpSecret and
+// recoveryCodes are marked userOwned in the schema for exactly this: on
+// forget, the row must actually disappear — a leftover TOTP secret or
+// recovery-code hash under an anonymized user is still a live credential
+// nobody can rotate. Mirrors folders-user-data/hooks.ts's executor-based
+// delete (rebuild-safe: forget replays via the event, a raw DELETE would be
+// resurrected by a projection rebuild).
+
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { userMfaEntity, userMfaTable } from "../auth-mfa";
+
+const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
+  entityName: "user-mfa",
+});
+
+// Never includes totpSecret/recoveryCodes — secret-derived credential
+// material, not portable personal data (same reasoning as api-token's
+// tokenHash exclusion in user-data-rights-defaults). Just confirms
+// enrollment + when, which is what a data subject actually needs to see.
+export const userMfaExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<{ id: string; enabledAt: unknown }>(ctx.db, userMfaTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-mfa",
+    rows: rows.map((r) => ({ enrolled: true, enabledAt: String(r.enabledAt ?? "") })),
+  };
+};
+
+// Always a real hard-delete regardless of the incoming strategy — a 2FA
+// secret can't be anonymized, and userOwned already means this row belongs
+// to exactly one user (never shared tenant data).
+export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const rows = await selectMany<{ id: string }>(ctx.db, userMfaTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  // skip: nothing enrolled for this user — no row to erase
+  if (rows.length === 0) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  for (const row of rows) {
+    await executor.forget({ id: row.id }, systemUser, tdb);
+  }
+};

package/src/auth-mfa-user-data/index.ts

@@ -0,0 +1,21 @@
+// Provides the EXT_USER_DATA export/delete hooks for the `user-mfa` entity as
+// a standalone feature — mount it alongside `auth-mfa` + `user-data-rights`
+// when an app needs 2FA enrollment in its GDPR export/forget pipeline. Kept
+// separate from `auth-mfa` (which only requires "user"/"config") so auth-mfa
+// consumers without the user-data-rights stack don't pull a hard dependency.
+// Mirrors folders-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { userMfaDeleteHook, userMfaExportHook } from "./hooks";
+
+export const authMfaUserDataFeature = defineFeature("auth-mfa-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `auth-mfa` feature's `user-mfa` entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user's TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from `auth-mfa` so consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `auth-mfa`.",
+  );
+  r.requires("user-data-rights");
+  r.optionalRequires("auth-mfa");
+  r.useExtension(EXT_USER_DATA, "user-mfa", {
+    export: userMfaExportHook,
+    delete: userMfaDeleteHook,
+  });
+});

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -238,6 +238,10 @@ describe("legal-pages :: SYSTEM_TENANT-routing (production-bug-regression)", ()
         // Resolver gibt IMMER einen anderen Tenant zurück — wenn legal-
         // pages den respektieren würde, wäre der DB-Lookup leer.
         tenantResolver: () => otherTenantId,
+        // Mirrors publicstatus's real subdomain resolver: the tenant is
+        // derived from the host, which the client cannot forge — trusted
+        // over any client-supplied tenant.
+        resolverTrust: "authoritative",
         tenantExists: async (id) => id === otherTenantId || id === SYSTEM_TENANT_ID,
       },
       extraContext: ({ db }) => ({

package/src/legal-pages/feature.ts

@@ -21,10 +21,8 @@ import { renderMarkdownToHtml, wrapInLayout } from "./markdown";
 // wie bei jedem API-Endpunkt.
 const TEXT_CONTENT_BY_SLUG_QN = "text-content:query:by-slug";
 
-// Wire-Body-Shape von /api/query — das, was bySlugQuery returnt.
-type ByslugQueryBody = {
-  data: { title: string; body: string | null; updatedAt: string } | null;
-};
+// Return-Shape von bySlugQuery (text-content/handlers/by-slug.query.ts).
+type TextBlockQueryResult = { title: string; body: string | null; updatedAt: string } | null;
 
 // 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
@@ -81,35 +79,28 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
         method: "GET",
         path: route.path,
         anonymous: true,
-        handler: async (c, { app }) => {
-          const url = new URL(c.req.url);
+        handler: async (c, { systemQuery }) => {
           // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
           // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
-          // legal-pages serven IMMER die SYSTEM_TENANT-Texte. Deshalb
-          // explizit X-Tenant-Header setzen statt host weiterreichen
-          // (sonst würde ein host-basierter anonymousAccess-Resolver
-          // die tenant-Subdomain auf tenant-tenantId resolven und
-          // tenant-x's leere imprint-Tabelle abfragen → 404).
-          const queryRes = await app.fetch(
-            new Request(`${url.origin}/api/query`, {
-              method: "POST",
-              headers: {
-                "content-type": "application/json",
-                "X-Tenant": SYSTEM_TENANT_ID,
-              },
-              body: JSON.stringify({
-                type: TEXT_CONTENT_BY_SLUG_QN,
-                payload: { slug: route.slug, lang: route.lang },
-              }),
-            }),
-          );
-
-          if (!queryRes.ok) {
+          // legal-pages serven IMMER die SYSTEM_TENANT-Texte. systemQuery
+          // erzwingt SYSTEM_TENANT_ID in-process (kein X-Tenant-Header-
+          // Trick über app.fetch — der sähe für einen host-basierten
+          // anonymousAccess-Resolver wie ein Client-Override aus und würde
+          // von resolverTrust: "authoritative" zurecht abgelehnt).
+          let data: TextBlockQueryResult;
+          try {
+            // @cast-boundary engine-payload — dispatcher.query returnt
+            // unknown; Shape ist durch bySlugQuery's Handler-Return-Type
+            // (siehe text-content/handlers/by-slug.query.ts) vertraut.
+            data = (await systemQuery(
+              TEXT_CONTENT_BY_SLUG_QN,
+              { slug: route.slug, lang: route.lang },
+              SYSTEM_TENANT_ID,
+            )) as TextBlockQueryResult;
+          } catch {
             return c.text("legal page unavailable", 503);
           }
 
-          const body: ByslugQueryBody = await queryRes.json();
-          const data = body.data;
           if (!data?.body) {
             return c.text(
               `${route.titleFallback} not configured. Tenant-Admin must set this text-block.`,

package/src/managed-pages/feature.ts

@@ -162,7 +162,7 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
   return defineFeature("managed-pages", (r) => {
     r.describe(
-      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
+      "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );
     r.uiHints({
       displayLabel: "Managed Pages · Public CMS",

package/src/sessions/feature.ts

@@ -7,7 +7,7 @@ import { revokeWrite } from "./handlers/revoke.write";
 import { revokeAllForUserWrite } from "./handlers/revoke-all-for-user.write";
 import { revokeAllOthersWrite } from "./handlers/revoke-all-others.write";
 import { userSessionEntity } from "./schema/user-session";
-import type { SessionMassRevoker } from "./session-callbacks";
+import type { SessionAllOthersRevoker, SessionMassRevoker } from "./session-callbacks";
 
 export type SessionsFeatureOptions = {
   // A successful update on the `user` entity that changes the `passwordHash`
@@ -29,6 +29,7 @@ export type SessionsFeatureOptions = {
 };
 
 export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
 
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature

package/src/sessions/session-callbacks.ts

@@ -33,6 +33,16 @@ const BLOCKED_STATUSES: ReadonlySet<UserStatus> = new Set([
 // caller can log "revoked N other sessions".
 export type SessionMassRevoker = (userId: string) => Promise<number>;
 
+// "Sign out everywhere else, keep this one" — used both by the user-facing
+// revoke-all-others handler and by other features (auth-mfa) that need the
+// same effect from a raw callback instead of a dispatcher round-trip.
+// currentSid undefined (stateless-JWT / no sid claim) revokes everything —
+// there is no "current" row to spare.
+export type SessionAllOthersRevoker = (
+  userId: string,
+  currentSid: string | undefined,
+) => Promise<number>;
+
 export type SessionCallbacksOptions = {
   readonly db: DbConnection;
   // Session lifetime. MVP uses a single flat window; per-app policies can
@@ -45,6 +55,7 @@ export type SessionCallbacks = {
   sessionRevoker: SessionRevoker;
   sessionChecker: SessionChecker;
   sessionMassRevoker: SessionMassRevoker;
+  sessionRevokeAllOthers: SessionAllOthersRevoker;
 };
 
 export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCallbacks {
@@ -135,5 +146,17 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       );
       return result.length;
     },
+
+    async sessionRevokeAllOthers(userId: string, currentSid: string | undefined): Promise<number> {
+      const result = await updateMany(
+        db,
+        userSessionTable,
+        { revokedAt: Temporal.Now.instant() },
+        currentSid
+          ? { userId, revokedAt: null, id: { ne: currentSid } }
+          : { userId, revokedAt: null },
+      );
+      return result.length;
+    },
   };
 }

package/src/shared/index.ts

@@ -9,3 +9,4 @@ export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/{auth-email-password → shared}/token-burn-store.ts

@@ -1,5 +1,5 @@
 // Single-use enforcement for HMAC-signed auth tokens (password-reset,
-// email-verification).
+// email-verification, MFA setup/challenge).
 //
 // Problem: the token itself carries only userId + expiry + signature.
 // Without server-side burn, the same token can be replayed within its