@cosmicdrift/kumiko-bundled-features 0.157.0 → 0.157.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.157.0",
+  "version": "0.157.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -116,11 +116,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.157.0",
-    "@cosmicdrift/kumiko-framework": "0.157.0",
-    "@cosmicdrift/kumiko-headless": "0.157.0",
-    "@cosmicdrift/kumiko-renderer": "0.157.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.157.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.157.1",
+    "@cosmicdrift/kumiko-framework": "0.157.1",
+    "@cosmicdrift/kumiko-headless": "0.157.1",
+    "@cosmicdrift/kumiko-renderer": "0.157.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.157.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-mfa/__tests__/errors-i18n-parity.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import {
+  invalidChallengeToken,
+  invalidRecoveryCode,
+  invalidSetupToken,
+  invalidTotpCode,
+  mfaAlreadyEnabled,
+  mfaNotEnabled,
+  tooManyAttempts,
+} from "../errors";
+import { defaultTranslations } from "../web/i18n";
+
+const failures = {
+  mfaAlreadyEnabled: mfaAlreadyEnabled(),
+  mfaNotEnabled: mfaNotEnabled(),
+  invalidSetupToken: invalidSetupToken(),
+  invalidTotpCode: invalidTotpCode(),
+  invalidRecoveryCode: invalidRecoveryCode(),
+  invalidChallengeToken: invalidChallengeToken(),
+  tooManyAttempts: tooManyAttempts(30),
+};
+
+describe("auth-mfa errors.ts i18nKey / client-bundle parity", () => {
+  for (const [name, failure] of Object.entries(failures)) {
+    test(`${name}'s i18nKey is registered in en/de translations`, () => {
+      const key = failure.error.i18nKey;
+      expect(defaultTranslations["en"]?.[key]).toBeDefined();
+      expect(defaultTranslations["de"]?.[key]).toBeDefined();
+    });
+  }
+});

package/src/auth-mfa/constants.ts

@@ -19,10 +19,9 @@ export const AuthMfaQueries = {
   status: "auth-mfa:query:user-mfa:status",
 } as const;
 
-// Write-failure codes shared between errors.ts (server, mints them into
-// UnprocessableError) and web/mfa-error-keys.ts (client, maps them to i18n
-// keys) — one source so a renamed code can't drift out of sync between the
-// two switches.
+// Write-failure codes minted server-side into UnprocessableError (errors.ts).
+// The client reads the i18n key straight off the write result
+// (res.error.i18nKey) instead of re-deriving it from these codes.
 export const AuthMfaErrorCodes = {
   mfaAlreadyEnabled: "mfa_already_enabled",
   mfaNotEnabled: "mfa_not_enabled",
@@ -31,10 +30,6 @@ export const AuthMfaErrorCodes = {
   invalidRecoveryCode: "invalid_recovery_code",
   invalidChallengeToken: "invalid_challenge_token",
   tooManyAttempts: "too_many_attempts",
-  // Client-only: minted by mfa-enable-screen.tsx on a network/QR-render
-  // failure during enrollment, never by errors.ts server-side — kept here
-  // anyway so mfa-error-keys.ts's key-parity test covers it automatically.
-  setupFailed: "setup_failed",
 } as const;
 
 export const MFA_SETUP_TOKEN_TTL_MINUTES = 10;

package/src/auth-mfa/errors.ts

@@ -10,7 +10,7 @@ export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants";
 export function mfaAlreadyEnabled(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.mfaAlreadyEnabled, {
-      i18nKey: "authMfa.errors.mfaAlreadyEnabled",
+      i18nKey: "auth.mfa.errors.mfaAlreadyEnabled",
     }),
   );
 }
@@ -18,7 +18,7 @@ export function mfaAlreadyEnabled(): WriteFailure {
 export function mfaNotEnabled(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.mfaNotEnabled, {
-      i18nKey: "authMfa.errors.mfaNotEnabled",
+      i18nKey: "auth.mfa.errors.mfaNotEnabled",
     }),
   );
 }
@@ -26,7 +26,7 @@ export function mfaNotEnabled(): WriteFailure {
 export function invalidSetupToken(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidSetupToken, {
-      i18nKey: "authMfa.errors.invalidSetupToken",
+      i18nKey: "auth.mfa.errors.invalidSetupToken",
     }),
   );
 }
@@ -34,7 +34,7 @@ export function invalidSetupToken(): WriteFailure {
 export function invalidTotpCode(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidTotpCode, {
-      i18nKey: "authMfa.errors.invalidTotpCode",
+      i18nKey: "auth.mfa.errors.invalidTotpCode",
     }),
   );
 }
@@ -42,7 +42,7 @@ export function invalidTotpCode(): WriteFailure {
 export function invalidRecoveryCode(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidRecoveryCode, {
-      i18nKey: "authMfa.errors.invalidRecoveryCode",
+      i18nKey: "auth.mfa.errors.invalidRecoveryCode",
     }),
   );
 }
@@ -50,7 +50,7 @@ export function invalidRecoveryCode(): WriteFailure {
 export function invalidChallengeToken(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidChallengeToken, {
-      i18nKey: "authMfa.errors.invalidChallengeToken",
+      i18nKey: "auth.mfa.errors.invalidChallengeToken",
     }),
   );
 }
@@ -59,7 +59,7 @@ export function invalidChallengeToken(): WriteFailure {
 export function tooManyAttempts(retryAfterSeconds: number): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.tooManyAttempts, {
-      i18nKey: "authMfa.errors.tooManyAttempts",
+      i18nKey: "auth.mfa.errors.tooManyAttempts",
       details: { retryAfterSeconds },
     }),
   );

package/src/auth-mfa/web/i18n.ts

@@ -15,6 +15,9 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.verify.submitting": "…",
     "auth.mfa.verify.backToLogin": "Zurück zum Login",
     "auth.mfa.errors.invalidCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidTotpCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidChallengeToken":
+      "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
     "auth.mfa.errors.challengeExpired": "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
     "auth.mfa.errors.tooManyAttempts": "Zu viele Fehlversuche. Bitte erneut einloggen.",
     "auth.mfa.errors.verifyFailed": "Bestätigung fehlgeschlagen.",
@@ -66,6 +69,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.verify.submitting": "…",
     "auth.mfa.verify.backToLogin": "Back to login",
     "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
     "auth.mfa.errors.challengeExpired": "Your sign-in has expired. Please sign in again.",
     "auth.mfa.errors.tooManyAttempts": "Too many failed attempts. Please sign in again.",
     "auth.mfa.errors.verifyFailed": "Verification failed.",

package/src/auth-mfa/web/index.ts

@@ -13,7 +13,6 @@ export type { MfaDisableDialogProps } from "./mfa-disable-dialog";
 export { MfaDisableDialog } from "./mfa-disable-dialog";
 export type { MfaEnableScreenProps } from "./mfa-enable-screen";
 export { MfaEnableScreen } from "./mfa-enable-screen";
-export { mfaManageErrorKey } from "./mfa-error-keys";
 export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal";
 export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal";
 export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog";

package/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -13,7 +13,6 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 export type MfaDisableDialogProps = {
   readonly open: boolean;
@@ -37,7 +36,7 @@ export function MfaDisableDialog({
     const res = await dispatcher.write<{ disabled: boolean }>(AuthMfaHandlers.disable, { code });
     setCode("");
     if (!res.isSuccess) {
-      onError(mfaManageErrorKey(res.error.code));
+      onError(res.error.i18nKey);
       return;
     }
     onDisabled();

package/src/auth-mfa/web/mfa-enable-screen.tsx

@@ -21,7 +21,6 @@ import { type ReactNode, useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only hook, the feature's server barrel has no web/ re-export
 import { useSession } from "../../auth-email-password/web";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 type EnableStartResponse = {
   readonly setupToken: string;
@@ -77,7 +76,7 @@ export function MfaEnableScreen({
         accountLabel: session.user?.email ?? "",
       });
       if (!res.isSuccess) {
-        setError(res.error.code);
+        setError(res.error.i18nKey);
         return;
       }
       // errorCorrectionLevel "H" (~30% redundancy) — more resilient to
@@ -96,7 +95,7 @@ export function MfaEnableScreen({
       setAcknowledged(false);
       setCode("");
     } catch {
-      setError("setup_failed");
+      setError("auth.mfa.errors.setupFailed");
     } finally {
       setBusy(false);
     }
@@ -112,14 +111,14 @@ export function MfaEnableScreen({
         code,
       });
       if (!res.isSuccess) {
-        setError(res.error.code);
+        setError(res.error.i18nKey);
         return;
       }
       setEnabled(true);
       setSetup(null);
       onEnabled?.();
     } catch {
-      setError("setup_failed");
+      setError("auth.mfa.errors.setupFailed");
     } finally {
       setBusy(false);
     }
@@ -130,7 +129,7 @@ export function MfaEnableScreen({
       <Heading>{t("auth.mfa.enable.title")}</Heading>
 
       {enabled && <Banner variant="info">{t("auth.mfa.enable.success")}</Banner>}
-      {error !== null && <Banner variant="error">{t(mfaManageErrorKey(error))}</Banner>}
+      {error !== null && <Banner variant="error">{t(error)}</Banner>}
 
       {!setup && !enabled && (
         <Section

package/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -10,7 +10,6 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 export type MfaRegenerateRecoveryDialogProps = {
   readonly open: boolean;
@@ -37,7 +36,7 @@ export function MfaRegenerateRecoveryDialog({
     );
     setCode("");
     if (!res.isSuccess) {
-      onError(mfaManageErrorKey(res.error.code));
+      onError(res.error.i18nKey);
       return;
     }
     onRegenerated(res.data.recoveryCodes);

package/src/tenant/handlers/invitations.query.ts

@@ -25,9 +25,14 @@ export const invitationsQuery = defineQueryHandler({
     return Promise.all(
       (rows ?? []).map(async (row) => {
         const email = row["email"];
-        return typeof email === "string"
-          ? { ...row, email: await decryptStoredPii(email, "tenant:invitations") }
-          : row;
+        const invitedBy = row["invitedBy"];
+        const decryptedEmail =
+          typeof email === "string" ? await decryptStoredPii(email, "tenant:invitations") : email;
+        const decryptedInvitedBy =
+          typeof invitedBy === "string"
+            ? await decryptStoredPii(invitedBy, "tenant:invitations")
+            : invitedBy;
+        return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
       }),
     );
   },

package/src/tenant/handlers/members.query.ts

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";
 
@@ -21,16 +22,24 @@ export const membersQuery = defineQueryHandler({
       userIds.length > 0 ? await selectMany<UserRow>(ctx.db, userTable, { id: userIds }) : [];
     const userById = new Map(users.map((u) => [String(u.id), u]));
 
-    return rows.map((row) => {
-      const user = userById.get(String(row["userId"]));
-      const email = typeof user?.email === "string" ? user.email : null;
-      const displayName = typeof user?.displayName === "string" ? user.displayName : null;
-      return {
-        ...row,
-        email,
-        displayName,
-        roles: parseRoles(row["roles"]),
-      };
-    });
+    return Promise.all(
+      rows.map(async (row) => {
+        const user = userById.get(String(row["userId"]));
+        const email =
+          typeof user?.email === "string"
+            ? await decryptStoredPii(user.email, "tenant:members")
+            : null;
+        const displayName =
+          typeof user?.displayName === "string"
+            ? await decryptStoredPii(user.displayName, "tenant:members")
+            : null;
+        return {
+          ...row,
+          email,
+          displayName,
+          roles: parseRoles(row["roles"]),
+        };
+      }),
+    );
   },
 });

package/src/auth-mfa/web/__tests__/mfa-error-keys.test.ts

@@ -1,20 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { AuthMfaErrorCodes } from "../../constants";
-import { defaultTranslations } from "../i18n";
-import { mfaManageErrorKey } from "../mfa-error-keys";
-
-describe("mfaManageErrorKey", () => {
-  for (const code of Object.values(AuthMfaErrorCodes)) {
-    test(`${code} maps to a key registered in en/de translations`, () => {
-      const key = mfaManageErrorKey(code);
-      expect(defaultTranslations["en"]?.[key]).toBeDefined();
-      expect(defaultTranslations["de"]?.[key]).toBeDefined();
-    });
-  }
-
-  test("unknown code falls back to the generic verifyFailed key", () => {
-    const key = mfaManageErrorKey("some_future_server_code");
-    expect(key).toBe("auth.mfa.errors.verifyFailed");
-    expect(defaultTranslations["en"]?.[key]).toBeDefined();
-  });
-});

package/src/auth-mfa/web/mfa-error-keys.ts

@@ -1,29 +0,0 @@
-// @runtime client
-// Shared error-code → i18n-key mapping for the account-management write
-// handlers (enable-confirm/disable/regenerate-recovery) — distinct from
-// mfa-verify-screen.tsx's own mapper, which covers the login-challenge
-// error surface (challenge_expired/rate_limited) that these handlers never
-// return. Centralized so enable/disable/regenerate stay in sync instead of
-// each re-deriving the key ad hoc (enable-screen used to template-string
-// the raw snake_case code straight into the key, which never matched the
-// camelCase keys actually registered below).
-import { AuthMfaErrorCodes } from "../constants";
-
-export function mfaManageErrorKey(code: string): string {
-  switch (code) {
-    case AuthMfaErrorCodes.invalidTotpCode:
-      return "auth.mfa.errors.invalidCode";
-    case AuthMfaErrorCodes.invalidRecoveryCode:
-      return "auth.mfa.errors.invalidRecoveryCode";
-    case AuthMfaErrorCodes.mfaAlreadyEnabled:
-      return "auth.mfa.errors.mfaAlreadyEnabled";
-    case AuthMfaErrorCodes.mfaNotEnabled:
-      return "auth.mfa.errors.mfaNotEnabled";
-    case AuthMfaErrorCodes.invalidSetupToken:
-      return "auth.mfa.errors.invalidSetupToken";
-    case AuthMfaErrorCodes.setupFailed:
-      return "auth.mfa.errors.setupFailed";
-    default:
-      return "auth.mfa.errors.verifyFailed";
-  }
-}