@cosmicdrift/kumiko-bundled-features 0.149.2 → 0.150.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.149.2",
+  "version": "0.150.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -91,6 +91,7 @@
     "./auth-mfa": "./src/auth-mfa/index.ts",
     "./auth-mfa-user-data": "./src/auth-mfa-user-data/index.ts",
     "./auth-mfa/web": "./src/auth-mfa/web/index.ts",
+    "./auth-mfa/testing": "./src/auth-mfa/testing.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
     "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
     "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
@@ -114,11 +115,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.149.2",
-    "@cosmicdrift/kumiko-framework": "0.149.2",
-    "@cosmicdrift/kumiko-headless": "0.149.2",
-    "@cosmicdrift/kumiko-renderer": "0.149.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.149.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.150.0",
+    "@cosmicdrift/kumiko-framework": "0.150.0",
+    "@cosmicdrift/kumiko-headless": "0.150.0",
+    "@cosmicdrift/kumiko-renderer": "0.150.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.150.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/admin-shell/__tests__/admin-shell-security.integration.test.ts

@@ -16,7 +16,6 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { createAuditFeature } from "../../audit/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { ConfigQueries } from "../../config/constants";
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -26,6 +25,7 @@ import { globalFeatureStateTable } from "../../feature-toggles/global-feature-st
 import { JobQueries } from "../../jobs/constants";
 import { createJobsFeature } from "../../jobs/feature";
 import { jobRunLogsTable, jobRunsTable } from "../../jobs/job-run-table";
+import { hashPassword } from "../../shared";
 import { TenantQueries } from "../../tenant/constants";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantInvitationEntity } from "../../tenant/invitation-table";

package/src/audit/__tests__/audit-security.integration.test.ts

@@ -23,8 +23,8 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { createConfigFeature } from "../../config/feature";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";

package/src/auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts

@@ -25,6 +25,7 @@ import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing"
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/account-lockout.integration.test.ts

@@ -24,6 +24,7 @@ import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing"
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { getLockoutState, type LockoutState } from "../lockout-store";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -15,6 +15,7 @@ import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -24,7 +25,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // Sample-style extension feature that shows the real-world shape of a claims
 // hook: look something up in a tenant-scoped table and stuff it into the JWT.

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -20,6 +20,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -29,7 +30,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -23,6 +23,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -33,7 +34,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 import { signVerificationToken } from "../verification-token";
 

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -31,6 +31,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
@@ -41,7 +42,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
 const APP_ACCEPT_URL = "https://app.example.com/invite/accept";

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -37,6 +37,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import {
@@ -52,7 +53,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { storeInviteToken } from "../invite-token-store";
-import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
 const APP_ACCEPT_URL = "https://app.example.com/invite/accept";

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -23,6 +23,7 @@ import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -31,7 +32,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 const systemAdmin = TestUsers.systemAdmin;

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -20,6 +20,7 @@ import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createSessionsFeature, userSessionTable } from "../../sessions";
+import { hashPassword, verifyPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -30,7 +31,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword, verifyPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 
 // Reset mails now go through delivery (ctx.notify → channel-email). The

package/src/auth-email-password/__tests__/seed-admin.integration.test.ts

@@ -23,12 +23,12 @@ import {
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { verifyPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { verifyPassword } from "../password-hashing";
 import { seedAdmin } from "../testing";
 
 let stack: TestStack;

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -14,6 +14,7 @@ import * as jose from "jose";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -23,7 +24,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // In-memory fake of a real sessions-store — just enough to observe that the
 // framework calls the callbacks at the right moments and threads the sid back

package/src/auth-email-password/handlers/change-password.write.ts

@@ -5,9 +5,9 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { hashPassword, verifyPassword } from "../../shared";
 import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
-import { hashPassword, verifyPassword } from "../password-hashing";
 
 // Change-password — authenticated. The user supplies their current password
 // (re-auth) and the new one. The new hash is written via ctx.writeAs(system)

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,7 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -46,7 +46,6 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
-import { verifyPassword } from "../password-hashing";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),

package/src/auth-email-password/handlers/login.write.ts

@@ -9,6 +9,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { parseAuthUserRow } from "../auth-user-row";
 import {
@@ -23,7 +24,6 @@ import {
   noMembership,
 } from "../errors";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store";
-import { verifyDummyPassword, verifyPassword } from "../password-hashing";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -1,9 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { hashPassword } from "../../shared";
 import { AuthErrors } from "../constants";
 import { invalidResetToken } from "../errors";
-import { hashPassword } from "../password-hashing";
 import { verifyResetToken } from "../reset-token";
 import { runConfirmTokenFlow } from "./confirm-token-flow";
 

package/src/auth-email-password/i18n.ts

@@ -32,6 +32,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.rateLimited": "Zu viele Login-Versuche. Bitte kurz warten.",
     "auth.errors.invalidBody": "Ungültige Eingabe.",
     "auth.errors.loginFailed": "Login fehlgeschlagen.",
+    "auth.errors.mfaNotSupported":
+      "Diese App unterstützt keine Zwei-Faktor-Bestätigung. Bitte an den Support wenden.",
     "auth.errors.invalidResetToken":
       "Der Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
     "auth.errors.invalidVerificationToken": "Der Bestätigungs-Link ist ungültig oder abgelaufen.",
@@ -134,6 +136,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.rateLimited": "Too many login attempts. Please wait briefly.",
     "auth.errors.invalidBody": "Invalid input.",
     "auth.errors.loginFailed": "Login failed.",
+    "auth.errors.mfaNotSupported":
+      "This app doesn't support two-factor verification. Please contact support.",
     "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
     "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
     "auth.errors.invalidSignupToken":

package/src/auth-email-password/index.ts

@@ -1,5 +1,11 @@
 // Convention paths for the auth pages (reset/verify/signup/invite); apps build
 // their magic-link appUrls from these. All mail now goes through delivery.
+
+// Kept as a public re-export (not just internal call sites) — this feature's
+// barrel is where consumers of the published package have always found
+// hashPassword/verifyPassword; removing it is a breaking change that needs
+// its own changeset + deliberate deprecation window, not a silent drop.
+export { hashPassword, verifyPassword } from "../shared/password-hashing";
 export { type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers } from "./constants";
 // Renderers for the auth mails. All four magic-link flows (reset, verify,
@@ -27,7 +33,6 @@ export type {
   SignupOptions,
 } from "./feature";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature";
-export { hashPassword, verifyPassword } from "./password-hashing";
 // Generic HMAC-signed single-purpose token helpers. Re-exported damit
 // app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
 // invite-tokens) denselben battle-tested signer/verifier nutzen können

package/src/auth-email-password/seeding.ts

@@ -17,13 +17,13 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { hashPassword } from "../shared";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedTenant, seedTenantMembership } from "../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
 import { userTable } from "../user/schema/user";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedUser } from "../user/seeding";
-import { hashPassword } from "./password-hashing";
 
 // Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
 // Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit

package/src/auth-email-password/web/auth-gate.tsx

@@ -20,6 +20,7 @@ import { SessionProvider, useSession } from "./session";
 export type MfaVerifyComponentProps = {
   readonly challengeToken: string;
   readonly onSuccess?: () => void;
+  readonly onCancel?: () => void;
 };
 
 export function makeAuthGate(
@@ -45,6 +46,7 @@ export function makeAuthGate(
           <MfaVerifyComponent
             challengeToken={challengeToken}
             onSuccess={() => setChallengeToken(null)}
+            onCancel={() => setChallengeToken(null)}
           />
         );
       }

package/src/auth-email-password/web/login-screen.tsx

@@ -88,6 +88,8 @@ function reasonToKey(failure: LoginFailure): {
       return { key: "auth.errors.rateLimited" };
     case "invalid_body":
       return { key: "auth.errors.invalidBody" };
+    case "mfa_not_supported":
+      return { key: "auth.errors.mfaNotSupported" };
     default:
       return { key: "auth.errors.loginFailed" };
   }

package/src/auth-mfa/__tests__/base32.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { base32Decode, base32Encode } from "../base32";
+
+describe("base32 encode/decode", () => {
+  test("round-trips arbitrary bytes", () => {
+    const bytes = Buffer.from("12345678901234567890", "ascii");
+    expect(base32Decode(base32Encode(bytes))).toEqual(bytes);
+  });
+
+  test("decodes lowercase and RFC 4648 '=' padding", () => {
+    const bytes = Buffer.from("12345678901234567890", "ascii");
+    const encoded = base32Encode(bytes);
+    const paddingLength = (8 - (encoded.length % 8)) % 8;
+    const withPadding = encoded + "=".repeat(paddingLength);
+    expect(base32Decode(withPadding.toLowerCase())).toEqual(bytes);
+  });
+
+  test("rejects a non-canonical length with non-zero residual bits", () => {
+    // "AA" decodes to 10 residual bits of all-zero value — canonical (padding
+    // zeros). A single stray char (5 bits, below the byte boundary but not a
+    // clean multiple) with non-zero value must be rejected, not truncated.
+    expect(() => base32Decode("B")).toThrow(/invalid length/);
+  });
+
+  test("throws on a genuinely invalid character", () => {
+    expect(() => base32Decode("01")).toThrow(/invalid character/);
+  });
+});

package/src/auth-mfa/__tests__/disable-and-regenerate.integration.test.ts

@@ -14,6 +14,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -34,6 +35,7 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
+      createTenantFeature(),
       createAuthMfaFeature({
         setupTokenSecret: SETUP_TOKEN_SECRET,
         issuer: "Kumiko Test",
@@ -139,6 +141,20 @@ describe("disable", () => {
     expect(res.disabled).toBe(true);
   });
 
+  test("a recovery code typed lowercase and without the dash still matches", async () => {
+    const { user, recoveryCodes } = await enableMfaFor("disable-recovery-normalize-1");
+    const code = recoveryCodes[0];
+    if (code === undefined) throw new Error("test setup produced no recovery code");
+
+    const sloppy = code.toLowerCase().replace("-", "");
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: sloppy },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
   test("a wrong code is rejected and MFA stays enabled", async () => {
     const { user, secret } = await enableMfaFor("disable-wrong-1");
 

package/src/auth-mfa/__tests__/enable-flow.integration.test.ts

@@ -14,6 +14,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -36,6 +37,7 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
+      createTenantFeature(),
       createAuthMfaFeature({
         setupTokenSecret: SETUP_TOKEN_SECRET,
         issuer: "Kumiko Test",
@@ -171,3 +173,61 @@ describe("enable-start + enable-confirm round trip", () => {
     expect(after.enabled).toBe(true);
   });
 });
+
+describe("enable-confirm burns the setup token on first success", () => {
+  test("replaying the same setup token after a disable does not silently re-enable MFA", async () => {
+    const user = createTestUser({ id: "setup-token-replay-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "replay@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const code = currentTotpCode(base32Decode(secretParam));
+
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code },
+      user,
+    );
+    await stack.http.writeOk(AuthMfaHandlers.disable, { code }, user);
+
+    // Same setupToken + a still-computable code for the disabled secret —
+    // without burning the token on first confirm this would re-create the
+    // row with the secret the user just discarded.
+    const replay = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(base32Decode(secretParam)) },
+      user,
+    );
+    expectErrorIncludes(replay, "invalid_setup_token");
+
+    const after = await stack.http.queryOk<{ enabled: boolean }>(AuthMfaQueries.status, {}, user);
+    expect(after.enabled).toBe(false);
+  });
+
+  test("a second confirm of the same setup token (already enabled) is rejected, not a raw db error", async () => {
+    const user = createTestUser({ id: "setup-token-double-confirm-1", roles: ["User"] });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "double@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const code = currentTotpCode(base32Decode(secretParam));
+
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code },
+      user,
+    );
+    const second = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(base32Decode(secretParam)) },
+      user,
+    );
+    expectErrorIncludes(second, "invalid_setup_token");
+  });
+});

package/src/auth-mfa/__tests__/pii-subject-encryption.integration.test.ts

@@ -27,6 +27,7 @@ import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing"
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -47,6 +48,7 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
+      createTenantFeature(),
       createAuthMfaFeature({
         setupTokenSecret: SETUP_TOKEN_SECRET,
         issuer: "Kumiko Test",

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -32,6 +32,7 @@ import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/te
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -64,6 +65,7 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
+      createTenantFeature(),
       createAuthMfaFeature({
         setupTokenSecret: SETUP_TOKEN_SECRET,
         issuer: "Kumiko Test",

package/src/auth-mfa/__tests__/session-auto-revoke.integration.test.ts

@@ -17,6 +17,7 @@ import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks } from "../../sessions/session-callbacks";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -44,7 +45,7 @@ beforeAll(async () => {
     challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
   });
   stack = await setupTestStack({
-    features: [createConfigFeature(), createUserFeature(), mfaFeature],
+    features: [createConfigFeature(), createUserFeature(), createTenantFeature(), mfaFeature],
     extraContext: { configResolver: resolver, configEncryption: encryption },
   });
 

package/src/auth-mfa/__tests__/totp.test.ts

@@ -37,12 +37,20 @@ describe("TOTP — RFC 6238 vectors", () => {
   test("accepts a code one step in the past or future (clock drift)", () => {
     const secret = generateTotpSecret();
     const now = 1_700_000_000_000;
-    // Derive the code for now, then verify it's still accepted 25s later —
-    // same 30s step, no window needed, sanity check for the step math.
+    // now + 25s crosses the 30s step boundary (deliberately) — this exercises
+    // the ±1 window, not same-step reuse. See the ±2-steps negative test below
+    // for the window's upper bound.
     const codeAtNow = deriveCodeForTest(secret, now);
     expect(verifyTotp(secret, codeAtNow, now + 25_000)).toBe(true);
   });
 
+  test("rejects a code two steps in the future (outside the ±1 window)", () => {
+    const secret = generateTotpSecret();
+    const now = 1_700_000_000_000;
+    const codeAtNow = deriveCodeForTest(secret, now);
+    expect(verifyTotp(secret, codeAtNow, now + 2 * 30_000 + 5_000)).toBe(false);
+  });
+
   test("rejects wrong-length or non-numeric input without throwing", () => {
     const secret = generateTotpSecret();
     expect(verifyTotp(secret, "12345")).toBe(false);
@@ -56,6 +64,7 @@ describe("TOTP — RFC 6238 vectors", () => {
     const b = generateTotpSecret();
     expect(a.length).toBe(20);
     expect(a.equals(b)).toBe(false);
+    expect(a.some((byte) => byte !== 0)).toBe(true);
   });
 });