@cosmicdrift/kumiko-bundled-features 0.149.2 → 0.151.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.149.2",
+  "version": "0.151.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -91,6 +91,7 @@
     "./auth-mfa": "./src/auth-mfa/index.ts",
     "./auth-mfa-user-data": "./src/auth-mfa-user-data/index.ts",
     "./auth-mfa/web": "./src/auth-mfa/web/index.ts",
+    "./auth-mfa/testing": "./src/auth-mfa/testing.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
     "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
     "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
@@ -114,11 +115,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.149.2",
-    "@cosmicdrift/kumiko-framework": "0.149.2",
-    "@cosmicdrift/kumiko-headless": "0.149.2",
-    "@cosmicdrift/kumiko-renderer": "0.149.2",
-    "@cosmicdrift/kumiko-renderer-web": "0.149.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.151.0",
+    "@cosmicdrift/kumiko-framework": "0.151.0",
+    "@cosmicdrift/kumiko-headless": "0.151.0",
+    "@cosmicdrift/kumiko-renderer": "0.151.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.151.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/admin-shell/__tests__/admin-shell-security.integration.test.ts

@@ -16,7 +16,6 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { createAuditFeature } from "../../audit/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { ConfigQueries } from "../../config/constants";
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
@@ -26,6 +25,7 @@ import { globalFeatureStateTable } from "../../feature-toggles/global-feature-st
 import { JobQueries } from "../../jobs/constants";
 import { createJobsFeature } from "../../jobs/feature";
 import { jobRunLogsTable, jobRunsTable } from "../../jobs/job-run-table";
+import { hashPassword } from "../../shared";
 import { TenantQueries } from "../../tenant/constants";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantInvitationEntity } from "../../tenant/invitation-table";

package/src/audit/__tests__/audit-security.integration.test.ts

@@ -23,8 +23,8 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import { createConfigFeature } from "../../config/feature";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";

package/src/auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts

@@ -25,6 +25,7 @@ import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing"
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/account-lockout.integration.test.ts

@@ -24,6 +24,7 @@ import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing"
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { getLockoutState, type LockoutState } from "../lockout-store";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -15,6 +15,7 @@ import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -24,7 +25,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // Sample-style extension feature that shows the real-world shape of a claims
 // hook: look something up in a tenant-scoped table and stuff it into the JWT.

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -20,6 +20,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -29,7 +30,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -23,6 +23,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -33,7 +34,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 import { signVerificationToken } from "../verification-token";
 

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -31,6 +31,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
@@ -41,7 +42,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
 const APP_ACCEPT_URL = "https://app.example.com/invite/accept";

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -37,6 +37,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import {
@@ -52,7 +53,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { storeInviteToken } from "../invite-token-store";
-import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
 const APP_ACCEPT_URL = "https://app.example.com/invite/accept";

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -23,6 +23,7 @@ import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -31,7 +32,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 const systemAdmin = TestUsers.systemAdmin;

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -20,6 +20,7 @@ import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createSessionsFeature, userSessionTable } from "../../sessions";
+import { hashPassword, verifyPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -30,7 +31,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword, verifyPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 
 // Reset mails now go through delivery (ctx.notify → channel-email). The

package/src/auth-email-password/__tests__/seed-admin.integration.test.ts

@@ -23,12 +23,12 @@ import {
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { verifyPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { verifyPassword } from "../password-hashing";
 import { seedAdmin } from "../testing";
 
 let stack: TestStack;

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -14,6 +14,7 @@ import * as jose from "jose";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -23,7 +24,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // In-memory fake of a real sessions-store — just enough to observe that the
 // framework calls the callbacks at the right moments and threads the sid back

package/src/auth-email-password/handlers/change-password.write.ts

@@ -5,9 +5,9 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { hashPassword, verifyPassword } from "../../shared";
 import { UserHandlers, UserQueries } from "../../user";
 import { invalidCredentials } from "../errors";
-import { hashPassword, verifyPassword } from "../password-hashing";
 
 // Change-password — authenticated. The user supplies their current password
 // (re-auth) and the new one. The new hash is written via ctx.writeAs(system)

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,7 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -46,7 +46,6 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
-import { verifyPassword } from "../password-hashing";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),

package/src/auth-email-password/handlers/login.write.ts

@@ -9,6 +9,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { parseAuthUserRow } from "../auth-user-row";
 import {
@@ -23,7 +24,6 @@ import {
   noMembership,
 } from "../errors";
 import { clearLockoutState, getLockoutState, recordFailedAttempt } from "../lockout-store";
-import { verifyDummyPassword, verifyPassword } from "../password-hashing";
 
 export type LoginHandlerOptions = {
   // When true, a valid (email + password) login fails with email_not_verified

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -1,9 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
+import { hashPassword } from "../../shared";
 import { AuthErrors } from "../constants";
 import { invalidResetToken } from "../errors";
-import { hashPassword } from "../password-hashing";
 import { verifyResetToken } from "../reset-token";
 import { runConfirmTokenFlow } from "./confirm-token-flow";
 

package/src/auth-email-password/i18n.ts

@@ -32,6 +32,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.rateLimited": "Zu viele Login-Versuche. Bitte kurz warten.",
     "auth.errors.invalidBody": "Ungültige Eingabe.",
     "auth.errors.loginFailed": "Login fehlgeschlagen.",
+    "auth.errors.mfaNotSupported":
+      "Diese App unterstützt keine Zwei-Faktor-Bestätigung. Bitte an den Support wenden.",
     "auth.errors.invalidResetToken":
       "Der Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
     "auth.errors.invalidVerificationToken": "Der Bestätigungs-Link ist ungültig oder abgelaufen.",
@@ -134,6 +136,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.rateLimited": "Too many login attempts. Please wait briefly.",
     "auth.errors.invalidBody": "Invalid input.",
     "auth.errors.loginFailed": "Login failed.",
+    "auth.errors.mfaNotSupported":
+      "This app doesn't support two-factor verification. Please contact support.",
     "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
     "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
     "auth.errors.invalidSignupToken":

package/src/auth-email-password/index.ts

@@ -1,5 +1,11 @@
 // Convention paths for the auth pages (reset/verify/signup/invite); apps build
 // their magic-link appUrls from these. All mail now goes through delivery.
+
+// Kept as a public re-export (not just internal call sites) — this feature's
+// barrel is where consumers of the published package have always found
+// hashPassword/verifyPassword; removing it is a breaking change that needs
+// its own changeset + deliberate deprecation window, not a silent drop.
+export { hashPassword, verifyPassword } from "../shared/password-hashing";
 export { type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers } from "./constants";
 // Renderers for the auth mails. All four magic-link flows (reset, verify,
@@ -27,7 +33,6 @@ export type {
   SignupOptions,
 } from "./feature";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature";
-export { hashPassword, verifyPassword } from "./password-hashing";
 // Generic HMAC-signed single-purpose token helpers. Re-exported damit
 // app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,
 // invite-tokens) denselben battle-tested signer/verifier nutzen können

package/src/auth-email-password/seeding.ts

@@ -17,13 +17,13 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { hashPassword } from "../shared";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedTenant, seedTenantMembership } from "../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
 import { userTable } from "../user/schema/user";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
 import { seedUser } from "../user/seeding";
-import { hashPassword } from "./password-hashing";
 
 // Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
 // Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit

package/src/auth-email-password/web/auth-gate.tsx

@@ -9,7 +9,7 @@
 // (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 
-import { type ComponentType, type ReactNode, useState } from "react";
+import { type ComponentType, type ReactNode, useEffect, useState } from "react";
 import { LoginScreen, type LoginScreenProps } from "./login-screen";
 import { SessionProvider, useSession } from "./session";
 
@@ -20,42 +20,87 @@ import { SessionProvider, useSession } from "./session";
 export type MfaVerifyComponentProps = {
   readonly challengeToken: string;
   readonly onSuccess?: () => void;
+  readonly onCancel?: () => void;
 };
 
-export function makeAuthGate(
-  LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
-  loginProps?: LoginScreenProps,
-  MfaVerifyComponent?: ComponentType<MfaVerifyComponentProps>,
-): ComponentType<{ children: ReactNode }> {
-  function AuthGate({ children }: { readonly children: ReactNode }): ReactNode {
+export type LoginRouteOptions = {
+  readonly loginScreen?: ComponentType<LoginScreenProps>;
+  readonly loginScreenProps?: LoginScreenProps;
+  readonly mfaVerifyScreen?: ComponentType<MfaVerifyComponentProps>;
+  /** Called once the session becomes authenticated. makeAuthGate ignores
+   *  this (it renders `children` on its own authenticated branch instead);
+   *  standalone routes — no parent gate, e.g. an anonymous apex/marketing
+   *  surface — use it to redirect. */
+  readonly onAuthenticated?: () => void;
+};
+
+// The one sanctioned way to render a login flow that correctly completes
+// an MFA challenge — makeAuthGate below is just this wrapped for the
+// `{ children }` gate shape. Also exported directly for apps that render
+// their own standalone login route outside any gate (createPublicSurface
+// apex pages stack providers, not gates — see auth-mount.tsx recipes).
+// Handing an app raw LoginScreen + telling it to hand-roll the challenge-
+// token swap itself is exactly how kumiko-framework#266's login-time MFA
+// step went missing in a real apex surface; this makes that mistake
+// structurally unavailable — there is no lower-level piece left to misuse.
+export function createLoginRoute(
+  opts: LoginRouteOptions = {},
+): ComponentType<Record<string, never>> {
+  const LoginComponent = opts.loginScreen ?? LoginScreen;
+  const MfaVerifyComponent = opts.mfaVerifyScreen;
+
+  function LoginRoute(): ReactNode {
     const { status } = useSession();
     // Pending challenge-token from LoginScreen's onMfaChallenge. Lives here
     // (not in SessionState) because it's a UI-only transition — the server
     // never considers this session authenticated until verify succeeds.
     const [challengeToken, setChallengeToken] = useState<string | null>(null);
 
+    useEffect(() => {
+      if (status === "authenticated") opts.onAuthenticated?.();
+    }, [status]);
+
     if (status === "loading") {
       return (
         <div className="min-h-screen flex items-center justify-center text-muted-foreground text-sm" />
       );
     }
-    if (status === "unauthenticated") {
-      if (challengeToken !== null && MfaVerifyComponent) {
-        return (
-          <MfaVerifyComponent
-            challengeToken={challengeToken}
-            onSuccess={() => setChallengeToken(null)}
-          />
-        );
-      }
+    if (status === "authenticated") return null;
+    if (challengeToken !== null && MfaVerifyComponent) {
       return (
-        <LoginComponent
-          {...loginProps}
-          onMfaChallenge={MfaVerifyComponent ? setChallengeToken : loginProps?.onMfaChallenge}
+        <MfaVerifyComponent
+          challengeToken={challengeToken}
+          onSuccess={() => setChallengeToken(null)}
+          onCancel={() => setChallengeToken(null)}
         />
       );
     }
-    return <>{children}</>;
+    return (
+      <LoginComponent
+        {...opts.loginScreenProps}
+        onMfaChallenge={
+          MfaVerifyComponent ? setChallengeToken : opts.loginScreenProps?.onMfaChallenge
+        }
+      />
+    );
+  }
+  return LoginRoute;
+}
+
+export function makeAuthGate(
+  LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
+  loginProps?: LoginScreenProps,
+  MfaVerifyComponent?: ComponentType<MfaVerifyComponentProps>,
+): ComponentType<{ children: ReactNode }> {
+  const LoginRoute = createLoginRoute({
+    loginScreen: LoginComponent,
+    loginScreenProps: loginProps,
+    mfaVerifyScreen: MfaVerifyComponent,
+  });
+  function AuthGate({ children }: { readonly children: ReactNode }): ReactNode {
+    const { status } = useSession();
+    if (status === "authenticated") return <>{children}</>;
+    return <LoginRoute />;
   }
   return AuthGate;
 }

package/src/auth-email-password/web/index.ts

@@ -27,8 +27,8 @@ export {
 } from "./auth-client";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives";
-export type { MfaVerifyComponentProps } from "./auth-gate";
-export { makeAuthGate, makeSessionAuthGate } from "./auth-gate";
+export type { LoginRouteOptions, MfaVerifyComponentProps } from "./auth-gate";
+export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate";
 export type {
   EmailPasswordClientFeature,
   EmailPasswordClientOptions,
@@ -40,8 +40,6 @@ export type { ForgotPasswordScreenProps } from "./forgot-password-screen";
 export { ForgotPasswordScreen } from "./forgot-password-screen";
 export type { InviteAcceptScreenProps } from "./invite-accept-screen";
 export { InviteAcceptScreen } from "./invite-accept-screen";
-export type { LoginScreenProps } from "./login-screen";
-export { LoginScreen } from "./login-screen";
 export type { ResetPasswordScreenProps } from "./reset-password-screen";
 export { ResetPasswordScreen } from "./reset-password-screen";
 export type { SessionApi, SessionState, SessionStatus } from "./session";

package/src/auth-email-password/web/login-screen.tsx

@@ -88,6 +88,8 @@ function reasonToKey(failure: LoginFailure): {
       return { key: "auth.errors.rateLimited" };
     case "invalid_body":
       return { key: "auth.errors.invalidBody" };
+    case "mfa_not_supported":
+      return { key: "auth.errors.mfaNotSupported" };
     default:
       return { key: "auth.errors.loginFailed" };
   }

package/src/auth-mfa/__tests__/base32.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { base32Decode, base32Encode } from "../base32";
+
+describe("base32 encode/decode", () => {
+  test("round-trips arbitrary bytes", () => {
+    const bytes = Buffer.from("12345678901234567890", "ascii");
+    expect(base32Decode(base32Encode(bytes))).toEqual(bytes);
+  });
+
+  test("decodes lowercase and RFC 4648 '=' padding", () => {
+    const bytes = Buffer.from("12345678901234567890", "ascii");
+    const encoded = base32Encode(bytes);
+    const paddingLength = (8 - (encoded.length % 8)) % 8;
+    const withPadding = encoded + "=".repeat(paddingLength);
+    expect(base32Decode(withPadding.toLowerCase())).toEqual(bytes);
+  });
+
+  test("rejects a non-canonical length with non-zero residual bits", () => {
+    // "AA" decodes to 10 residual bits of all-zero value — canonical (padding
+    // zeros). A single stray char (5 bits, below the byte boundary but not a
+    // clean multiple) with non-zero value must be rejected, not truncated.
+    expect(() => base32Decode("B")).toThrow(/invalid length/);
+  });
+
+  test("throws on a genuinely invalid character", () => {
+    expect(() => base32Decode("01")).toThrow(/invalid character/);
+  });
+});

package/src/auth-mfa/__tests__/disable-and-regenerate.integration.test.ts

@@ -14,6 +14,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity } from "../../user/schema/user";
 import { base32Decode } from "../base32";
@@ -34,6 +35,7 @@ beforeAll(async () => {
     features: [
       createConfigFeature(),
       createUserFeature(),
+      createTenantFeature(),
       createAuthMfaFeature({
         setupTokenSecret: SETUP_TOKEN_SECRET,
         issuer: "Kumiko Test",
@@ -139,6 +141,20 @@ describe("disable", () => {
     expect(res.disabled).toBe(true);
   });
 
+  test("a recovery code typed lowercase and without the dash still matches", async () => {
+    const { user, recoveryCodes } = await enableMfaFor("disable-recovery-normalize-1");
+    const code = recoveryCodes[0];
+    if (code === undefined) throw new Error("test setup produced no recovery code");
+
+    const sloppy = code.toLowerCase().replace("-", "");
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: sloppy },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
   test("a wrong code is rejected and MFA stays enabled", async () => {
     const { user, secret } = await enableMfaFor("disable-wrong-1");