@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/auth-foundation/boot-checks.ts

@@ -0,0 +1,91 @@
+// Multiplicity boot-check for auth-foundation's `tokenVerifier` extension
+// point (#1368). Two static-shape conflicts a boot-check CAN catch (a
+// runtime shape-match predicate's overlap can't be proven at boot): a
+// malformed plugin registration, and two providers both claiming the same
+// shape (resolveTokenVerifier can't tell them apart). Zero registered
+// providers is ALSO caught here — fail-fast at boot ("you mounted the
+// foundation but forgot a provider") rather than a runtime 401 nobody
+// can attribute, unlike file-foundation/mail-foundation which defer that
+// check to request-time (their provider is picked from tenant config,
+// which doesn't exist at boot; auth-foundation's providers are static
+// per-deployment, so boot is the right time to catch it).
+
+import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  EXT_SESSION_STORE,
+  EXT_TOKEN_VERIFIER,
+  isAuthProviderPlugin,
+  isSessionStoreProvider,
+  tokenShapeKey,
+} from "./types";
+
+export function validateTokenVerifierMultiplicity(features: readonly FeatureDefinition[]): void {
+  const namesByShape = new Map<string, string[]>();
+
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_TOKEN_VERIFIER) continue;
+      if (!isAuthProviderPlugin(usage.options)) {
+        throw new Error(
+          `[auth-foundation] tokenVerifier provider "${usage.entityName}" (feature "${feature.name}") ` +
+            `registered without a valid AuthProviderPlugin — options must have a { shape, build } shape.`,
+        );
+      }
+      const key = tokenShapeKey(usage.options.shape);
+      const names = namesByShape.get(key) ?? [];
+      names.push(usage.entityName);
+      namesByShape.set(key, names);
+    }
+  }
+
+  if (namesByShape.size === 0) {
+    throw new Error(
+      "[auth-foundation] no tokenVerifier providers registered — mount at least one " +
+        "auth-provider-* feature (e.g. auth-provider-jwt) alongside auth-foundation.",
+    );
+  }
+
+  for (const [key, names] of namesByShape) {
+    if (names.length >= 2) {
+      throw new Error(
+        `[auth-foundation] ${names.length} tokenVerifier providers claim the same shape "${key}" ` +
+          `(${names.join(", ")}) — resolveTokenVerifier can't route between them unambiguously. ` +
+          `Give each provider a distinct shape.`,
+      );
+    }
+  }
+}
+
+// Multiplicity boot-check for the `sessionStore` extension point (#1370).
+// Single-provider, unlike tokenVerifier — no shape to route on, so exactly
+// one registration is required; 0 or ≥2 both fail boot.
+export function validateSessionStoreMultiplicity(features: readonly FeatureDefinition[]): void {
+  const names: string[] = [];
+
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_SESSION_STORE) continue;
+      if (!isSessionStoreProvider(usage.options)) {
+        throw new Error(
+          `[auth-foundation] sessionStore provider "${usage.entityName}" (feature "${feature.name}") ` +
+            `registered without a valid SessionStoreProvider — options must have a { build } shape.`,
+        );
+      }
+      names.push(usage.entityName);
+    }
+  }
+
+  if (names.length === 0) {
+    throw new Error(
+      "[auth-foundation] no sessionStore provider registered — mount a feature that " +
+        "registers one via r.useExtension(EXT_SESSION_STORE, ...) alongside auth-foundation.",
+    );
+  }
+
+  if (names.length >= 2) {
+    throw new Error(
+      `[auth-foundation] ${names.length} sessionStore providers registered (${names.join(", ")}) — ` +
+        `only one sessionStore provider may be mounted at a time.`,
+    );
+  }
+}

package/src/auth-foundation/feature.ts

@@ -0,0 +1,103 @@
+// kumiko-feature-version: 1
+//
+// auth-foundation — declares the `tokenVerifier` extension point for Bearer-
+// token verification. Provider-features (auth-provider-jwt, auth-provider-
+// pat, ...) register via `r.useExtension(EXT_TOKEN_VERIFIER, "<name>", plugin)`.
+//
+// **Scaffold only:** not wired into `api/auth-middleware.ts` yet —
+// personal-access-tokens still uses its own direct `patResolver` callback
+// (kumiko-framework#745). A future issue migrates the middleware onto this
+// extension point; #1368 only lays the groundwork (PAT-Plan-Doc Phase-1-
+// Sub-Step-1).
+//
+// **Pattern precedent:** file-foundation/mail-foundation for the extension-
+// point + plugin-registry shape. Diverges on ROUTING: those pick one active
+// provider per tenant via a config-key; auth-foundation has no tenant yet
+// at verify-time, so providers are tried in shape-match order instead (see
+// types.ts).
+
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { validateSessionStoreMultiplicity, validateTokenVerifierMultiplicity } from "./boot-checks";
+import {
+  type AuthProviderBuildDeps,
+  EXT_SESSION_STORE,
+  EXT_TOKEN_VERIFIER,
+  isAuthProviderPlugin,
+  isSessionStoreProvider,
+  type SessionStore,
+  tokenShapeMatches,
+} from "./types";
+
+export { EXT_SESSION_STORE, EXT_TOKEN_VERIFIER } from "./types";
+
+const FEATURE_NAME = "auth-foundation";
+
+export const authFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
+  r.describe(
+    "Declares the `tokenVerifier` (Bearer-token auth) and `sessionStore` extension points. Provider-features register a static `shape` plus a `build()` for tokenVerifier — mount together with at least one auth-provider-* feature (e.g. personal-access-tokens) and call `resolveTokenVerifier(deps, rawToken)` to find the matching one; sessions self-registers as the single sessionStore provider.",
+  );
+  r.uiHints({
+    displayLabel: "Auth Provider Foundation",
+    category: "identity",
+    recommended: false,
+  });
+
+  r.extendsRegistrar(EXT_TOKEN_VERIFIER, {
+    onRegister: () => {
+      // No side-effects at register-time — registry stores the usage,
+      // resolveTokenVerifier looks it up at request-time.
+    },
+  });
+
+  // Owns EXT_TOKEN_VERIFIER, so its own mount is the trigger — same
+  // convention as tenant-lifecycle/user-data-rights' self-bootCheck.
+  r.bootCheck(({ features }) => validateTokenVerifierMultiplicity(features));
+
+  r.extendsRegistrar(EXT_SESSION_STORE, {
+    onRegister: () => {
+      // No side-effects at register-time — registry stores the usage,
+      // resolveSessionStore looks it up at request-time.
+    },
+  });
+
+  r.bootCheck(({ features }) => validateSessionStoreMultiplicity(features));
+});
+
+/**
+ * Tries every registered tokenVerifier provider's shape against `rawToken`
+ * in registration order and calls the first match's verifier. Returns null
+ * when no provider's shape matches, or when the matching provider's
+ * verifier rejects the token.
+ */
+export async function resolveTokenVerifier(
+  deps: AuthProviderBuildDeps & { readonly registry: Registry },
+  rawToken: string,
+): Promise<SessionUser | null> {
+  const usages = deps.registry.getExtensionUsages(EXT_TOKEN_VERIFIER);
+  for (const usage of usages) {
+    if (!isAuthProviderPlugin(usage.options)) continue;
+    if (!tokenShapeMatches(usage.options.shape, rawToken)) continue;
+    const verify = await usage.options.build(deps);
+    return verify(rawToken);
+  }
+  return null;
+}
+
+/**
+ * Resolves the single registered sessionStore provider. Assumes
+ * validateSessionStoreMultiplicity already ran at boot — a missing provider
+ * here means the app booted without going through the framework's boot
+ * validator, not a runtime state resolveSessionStore should model.
+ */
+export async function resolveSessionStore(
+  deps: AuthProviderBuildDeps & { readonly registry: Registry },
+): Promise<SessionStore> {
+  const usage = deps.registry.getExtensionUsages(EXT_SESSION_STORE)[0];
+  if (!usage || !isSessionStoreProvider(usage.options)) {
+    throw new Error(
+      "[auth-foundation] no sessionStore provider registered — did the boot validator run?",
+    );
+  }
+  return usage.options.build(deps);
+}

package/src/auth-foundation/index.ts

@@ -0,0 +1,23 @@
+// Public API of the auth-foundation bundled-feature.
+
+export {
+  authFoundationFeature,
+  resolveSessionStore,
+  resolveTokenVerifier,
+} from "./feature";
+export {
+  type AuthProviderBuildDeps,
+  type AuthProviderPlugin,
+  type AuthVerifier,
+  EXT_SESSION_STORE,
+  EXT_TOKEN_VERIFIER,
+  isAuthProviderPlugin,
+  isSessionStoreProvider,
+  isValidTokenShape,
+  type SessionMassRevoker,
+  type SessionStore,
+  type SessionStoreProvider,
+  type TokenShape,
+  tokenShapeKey,
+  tokenShapeMatches,
+} from "./types";

package/src/auth-foundation/types.ts

@@ -0,0 +1,107 @@
+// kumiko-feature-version: 1
+//
+// Type contracts for auth-foundation's `tokenVerifier` extension point.
+// Provider-features (future: auth-provider-jwt, auth-provider-pat) register
+// an AuthProviderPlugin via `r.useExtension(EXT_TOKEN_VERIFIER, "<name>", plugin)`.
+//
+// **Shape-match routing:** unlike file-foundation/mail-foundation (one active
+// provider per tenant, chosen via a config-key), token verification happens
+// BEFORE the tenant is known — there's nothing to select on. Every registered
+// provider declares a static `shape` (how to recognize its own tokens by
+// looking at the raw bearer value); `resolveTokenVerifier` tries each
+// provider's shape in turn and calls the first match's verifier.
+
+import type {
+  SessionChecker,
+  SessionCreator,
+  SessionRevoker,
+} from "@cosmicdrift/kumiko-framework/api";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+
+export const EXT_TOKEN_VERIFIER = "tokenVerifier";
+
+/**
+ * Deps available to a provider's `build()`. DB access only — a hot-path
+ * resolver (see personal-access-tokens/resolver.ts) needs a raw-DB handle
+ * for a point-read + live-role-resolution, not a per-request ctx (there is
+ * no tenant/session yet at verify-time).
+ */
+export type AuthProviderBuildDeps = {
+  readonly db: DbConnection;
+};
+
+/** How to recognize this provider's tokens by looking at the raw bearer value. */
+export type TokenShape =
+  | { readonly kind: "jwt" }
+  | { readonly kind: "prefix"; readonly prefix: string };
+
+export type AuthVerifier = (rawToken: string) => Promise<SessionUser | null>;
+
+export type AuthProviderPlugin = {
+  readonly shape: TokenShape;
+  readonly build: (deps: AuthProviderBuildDeps) => Promise<AuthVerifier> | AuthVerifier;
+};
+
+export function isValidTokenShape(shape: unknown): shape is TokenShape {
+  if (typeof shape !== "object" || shape === null || !("kind" in shape)) return false;
+  const kind = (shape as { kind: unknown }).kind;
+  if (kind === "jwt") return true;
+  if (kind === "prefix") {
+    const prefix = "prefix" in shape ? (shape as { prefix: unknown }).prefix : undefined;
+    return typeof prefix === "string" && prefix.length > 0;
+  }
+  return false;
+}
+
+// extension-usage `options` is engine-payload (unknown) — structurally validate
+// instead of casting blind. Mirrors file-foundation's isFileProviderPlugin.
+export function isAuthProviderPlugin(o: unknown): o is AuthProviderPlugin {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "build" in o &&
+    typeof (o as { build: unknown }).build === "function" &&
+    "shape" in o &&
+    isValidTokenShape((o as { shape: unknown }).shape)
+  );
+}
+
+export function tokenShapeMatches(shape: TokenShape, rawToken: string): boolean {
+  if (shape.kind === "prefix") return rawToken.startsWith(shape.prefix);
+  return rawToken.split(".").length === 3;
+}
+
+/** Static discriminator used by the multiplicity boot-check to detect two providers claiming the same shape. */
+export function tokenShapeKey(shape: TokenShape): string {
+  return shape.kind === "jwt" ? "jwt" : `prefix:${shape.prefix}`;
+}
+
+// Session-store extension point (#1370). Unlike EXT_TOKEN_VERIFIER, this is
+// single-provider — sessions have no per-provider shape to route on, so
+// exactly one implementation must be registered (boot-fails on 0 or ≥2).
+
+export const EXT_SESSION_STORE = "sessionStore";
+
+/** Mass-revoke every live session for a user. Used by password-change and "sign out everywhere". */
+export type SessionMassRevoker = (userId: string) => Promise<number>;
+
+export type SessionStore = {
+  readonly creator: SessionCreator;
+  readonly revoker: SessionRevoker;
+  readonly checker: SessionChecker;
+  readonly massRevoker: SessionMassRevoker;
+};
+
+export type SessionStoreProvider = {
+  readonly build: (deps: AuthProviderBuildDeps) => Promise<SessionStore> | SessionStore;
+};
+
+export function isSessionStoreProvider(o: unknown): o is SessionStoreProvider {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "build" in o &&
+    typeof (o as { build: unknown }).build === "function"
+  );
+}

package/src/auth-mfa/__tests__/errors-i18n-parity.test.ts

@@ -28,4 +28,12 @@ describe("auth-mfa errors.ts i18nKey / client-bundle parity", () => {
       expect(defaultTranslations["de"]?.[key]).toBeDefined();
     });
   }
+
+  // Client-only key: mfa-enable-screen.tsx sets this directly (not via a
+  // DispatcherError), so it isn't covered by the failures loop above.
+  test("client-only auth.mfa.errors.setupFailed is registered in en/de translations", () => {
+    const key = "auth.mfa.errors.setupFailed";
+    expect(defaultTranslations["en"]?.[key]).toBeDefined();
+    expect(defaultTranslations["de"]?.[key]).toBeDefined();
+  });
 });

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -272,4 +272,24 @@ describe("mfa verify — re-checks account state the way login.write.ts does", (
     );
     expectErrorIncludes(err, "invalid_challenge_token");
   });
+
+  test("user row deleted between login and verify → challenge rejected (the !userRow gate)", async () => {
+    const { user, secret } = await enableMfaFor(7);
+    const challengeToken = challengeFor(user.id, user.tenantId);
+
+    // Simulate the read_users row disappearing after the challenge token
+    // was issued but before verify runs — hits verify.write.ts's
+    // `if (!userRow) return invalidChallengeToken()` gate directly, distinct
+    // from a revoked membership or a restricted-but-present user row.
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}" WHERE id = $1`, [
+      user.id,
+    ]);
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.verify,
+      { challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expectErrorIncludes(err, "invalid_challenge_token");
+  });
 });

package/src/auth-mfa/web/__tests__/mfa-client.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { verifyMfaChallenge } from "../mfa-client";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+describe("verifyMfaChallenge", () => {
+  test("posts challengeToken + code to /api/auth/mfa/verify", async () => {
+    const fetchMock = mock(async () =>
+      jsonResponse({ isSuccess: true, token: "t", user: { id: "u1", tenantId: "t1", roles: [] } }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/auth/mfa/verify",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "same-origin",
+        body: JSON.stringify({ challengeToken: "challenge-1", code: "123456" }),
+      }),
+    );
+  });
+
+  test("success → kind:success mit token+user", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        token: "test-token",
+        user: { id: "u1", tenantId: "t1", roles: ["Admin"] },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(res).toEqual({
+      kind: "success",
+      data: { token: "test-token", user: { id: "u1", tenantId: "t1", roles: ["Admin"] } },
+    });
+  });
+
+  test("HTTP 429 → kind:failure reason:rate_limited (ohne Body-Parse)", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "rate_limited" } });
+  });
+
+  test("error als String → kind:failure reason:<string>", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: "invalid_totp_code" }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_totp_code" } });
+  });
+
+  test("error-Objekt mit details.reason → reason aus details, message+retryAfterSeconds übernommen", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: false,
+        error: {
+          code: "mfa_verify_failed",
+          message: "too many attempts",
+          details: { reason: "too_many_attempts", retryAfterSeconds: 60 },
+        },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({
+      kind: "failure",
+      error: { reason: "too_many_attempts", message: "too many attempts", retryAfterSeconds: 60 },
+    });
+  });
+
+  test("error-Objekt ohne details.reason → fällt auf error.code zurück", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: { code: "invalid_challenge_token" } }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_challenge_token" } });
+  });
+
+  test("kein error-Feld, kein isSuccess → default reason mfa_verify_failed", async () => {
+    globalThis.fetch = mock(async () => jsonResponse({})) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+
+  test("kaputtes JSON → leeres Body-Objekt, default reason", async () => {
+    globalThis.fetch = mock(
+      async () => new Response("not json", { status: 200 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+});

package/src/auth-mfa/web/__tests__/mfa-enable-screen.test.tsx

@@ -0,0 +1,173 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
+import { SessionContext } from "../../../auth-email-password/web/session";
+import { defaultTranslations } from "../i18n";
+
+type WriteResult =
+  | { readonly isSuccess: true; readonly data: unknown }
+  | { readonly isSuccess: false; readonly error: { readonly i18nKey: string } };
+
+const dispatchSpy = mock<() => Promise<WriteResult>>(async () => ({
+  isSuccess: true,
+  data: {
+    setupToken: "setup-token-1",
+    otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+    recoveryCodes: ["code-1", "code-2"],
+  },
+}));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
+}));
+
+mock.module("qrcode/lib/browser", () => ({
+  default: { toString: mock(async () => "<svg></svg>") },
+}));
+
+const { MfaEnableScreen } = await import("../mfa-enable-screen");
+
+const session = makeSessionApi();
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        <SessionContext.Provider value={session}>{children}</SessionContext.Provider>
+      </LocaleProvider>
+    </PrimitivesProvider>
+  );
+}
+
+beforeEach(() => {
+  dispatchSpy.mockClear();
+});
+
+describe("MfaEnableScreen", () => {
+  test("rendert Intro + Start-Button, kein Setup-Bereich vor dem Start", () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Zwei-Faktor-Authentifizierung")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    expect(screen.queryByLabelText("Code aus der Authenticator-App")).toBeNull();
+  });
+
+  test("Start-Klick → dispatcher.write ruft enable-start, danach Setup-Bereich mit Secret + Recovery-Codes", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-start",
+        expect.objectContaining({ accountLabel: "user@example.com" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    expect(screen.getByText(/code-1/)).toBeTruthy();
+    expect(screen.getByText(/code-2/)).toBeTruthy();
+  });
+
+  test("Bestätigen-Button bleibt disabled bis Recovery-Codes bestätigt + 6-stelliger Code eingegeben", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+
+    const confirm = screen.getByRole("button", { name: "Aktivieren" }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    expect(confirm.disabled).toBe(false);
+  });
+
+  test("Bestätigen → dispatcher.write ruft enable-confirm, danach Success-Banner", async () => {
+    dispatchSpy
+      .mockImplementationOnce(async () => ({
+        isSuccess: true,
+        data: {
+          setupToken: "setup-token-1",
+          otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+          recoveryCodes: ["code-1", "code-2"],
+        },
+      }))
+      .mockImplementationOnce(async () => ({ isSuccess: true, data: undefined }));
+    const onEnabled = mock(() => {});
+    render(
+      <Wrapper>
+        <MfaEnableScreen onEnabled={onEnabled} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: "Aktivieren" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-confirm",
+        expect.objectContaining({ setupToken: "setup-token-1", code: "123456" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist jetzt aktiv.")).toBeTruthy();
+      expect(onEnabled).toHaveBeenCalled();
+    });
+  });
+
+  test("enable-start schlägt fehl → übersetztes Fehler-Banner, kein Setup-Bereich", async () => {
+    dispatchSpy.mockImplementationOnce(async () => ({
+      isSuccess: false,
+      error: { i18nKey: "auth.mfa.errors.mfaAlreadyEnabled" },
+    }));
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist bereits aktiv.")).toBeTruthy();
+    });
+    expect(screen.queryByText("ABCD1234")).toBeNull();
+  });
+});