@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -3,16 +3,17 @@
 // useSession() throws without a provider, so any consumer mounting this
 // screen on a public route outside SessionAuthGate crashed at runtime.
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import {
   createStaticLocaleResolver,
   LocaleProvider,
   PrimitivesProvider,
 } from "@cosmicdrift/kumiko-renderer";
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
-import { render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { defaultTranslations } from "../../i18n";
 import { InviteAcceptScreen } from "../invite-accept-screen";
+import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 const resolver = createStaticLocaleResolver({ locale: "de" });
 
@@ -26,6 +27,24 @@ function renderWithoutSessionProvider(token: string) {
   );
 }
 
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(JSON.stringify({ tenantId: "tenant-new" }), { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+
+// Capture once — afterEach must restore the real Location, not `{...location}`
+// (plain objects break `new URL(window.location.href)` in useUrlToken → ResetPasswordScreen).
+const originalLocation = window.location;
+
+afterEach(() => {
+  Object.defineProperty(window, "location", {
+    configurable: true,
+    writable: true,
+    value: originalLocation,
+  });
+});
+
 describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
   test("renders the anonymous accept-form instead of throwing", () => {
     renderWithoutSessionProvider("tok-123");
@@ -40,5 +59,110 @@ describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
     expect(
       screen.getByText("Der Einladungs-Link enthält keinen Token oder ist ungültig."),
     ).toBeTruthy();
+    expect(screen.getByRole("link", { name: "Zum Login" }).getAttribute("href")).toBe("/login");
+  });
+});
+
+describe("InviteAcceptScreen — logged-in branch", () => {
+  test("authenticated session shows 1-click accept form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    expect(screen.getByText(/Du bist eingeloggt/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Annehmen" })).toBeTruthy();
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+  });
+
+  test("accept logged-in success redirects via loggedInHref function", async () => {
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+    renderWithProviders(
+      <InviteAcceptScreen token="tok-123" loggedInHref={({ tenantId }) => `/${tenantId}/home`} />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/tenant-new/home");
+    });
+  });
+
+  test("accept logged-in failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithProviders(<InviteAcceptScreen token="bad" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
+  });
+
+  test("use other account switches to anon-existing form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Mit anderem Account anmelden" }));
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+});
+
+describe("InviteAcceptScreen — anonymous branches", () => {
+  test("anon-existing submit posts invite-accept-with-login", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-accept-with-login",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ token: "tok-123", email: "a@example.com", password: "secret123" }),
+        }),
+      );
+    });
+  });
+
+  test("toggle to anon-new hides email and posts invite-signup-complete", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.click(screen.getByRole("button", { name: "Ich habe noch keinen Account" }));
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "newpass123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-signup-complete",
+        expect.objectContaining({
+          body: JSON.stringify({ token: "tok-123", password: "newpass123" }),
+        }),
+      );
+    });
+  });
+
+  test("anon failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "wrong" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
   });
 });

package/src/auth-email-password/web/__tests__/login-screen.test.tsx

@@ -247,4 +247,129 @@ describe("LoginScreen", () => {
       expect(screen.queryByRole("button", { name: /erneut senden/i })).toBeNull();
     });
   });
+
+  test("account_locked without retry → unlock link when href set", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "failure",
+        error: { reason: "account_locked" },
+      })),
+    });
+    renderWithProviders(<LoginScreen unlockAccountHref="/unlock" />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("vorübergehend gesperrt");
+    });
+    expect(screen.getByRole("link", { name: /Konto entsperren/i }).getAttribute("href")).toBe(
+      "/unlock",
+    );
+  });
+
+  test("reasonToKey covers no_membership, rate_limited, invalid_body, default", async () => {
+    const cases: Array<{ reason: string; needle: string }> = [
+      { reason: "no_membership", needle: "keinen Tenant-Zugang" },
+      { reason: "rate_limited", needle: "Zu viele Login-Versuche" },
+      { reason: "invalid_body", needle: "Ungültige Eingabe" },
+      { reason: "weird_unknown", needle: "Login fehlgeschlagen" },
+    ];
+    for (const { reason, needle } of cases) {
+      const session = makeSessionApi({
+        status: "unauthenticated",
+        user: null,
+        login: mock<SessionApi["login"]>(async () => ({
+          kind: "failure",
+          error: { reason },
+        })),
+      });
+      const { unmount } = renderWithProviders(<LoginScreen />, { session });
+      fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+      fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+      fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+      await waitFor(() => {
+        expect(screen.getByRole("alert").textContent).toContain(needle);
+      });
+      unmount();
+    }
+  });
+
+  test("mfa-challenge with onMfaChallenge fires token", async () => {
+    const onMfaChallenge = mock<(t: string) => void>();
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen onMfaChallenge={onMfaChallenge} />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaChallenge).toHaveBeenCalledWith("chal-1");
+    });
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  test("mfa-challenge without callback → mfa_not_supported", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/MFA|Zwei-Faktor|nicht unterstützt/i);
+    });
+  });
+
+  test("mfa-setup-required with and without onMfaSetupRequired", async () => {
+    const onMfaSetupRequired = mock<() => void>();
+    const sessionOk = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({ kind: "mfa-setup-required" })),
+    });
+    const { unmount } = renderWithProviders(
+      <LoginScreen onMfaSetupRequired={onMfaSetupRequired} />,
+      { session: sessionOk },
+    );
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaSetupRequired).toHaveBeenCalled();
+    });
+    unmount();
+
+    const sessionBare = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({ kind: "mfa-setup-required" })),
+    });
+    renderWithProviders(<LoginScreen />, { session: sessionBare });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("Zwei-Faktor-Bestätigung");
+    });
+  });
+
+  test("signupHref renders signup link", () => {
+    renderWithProviders(<LoginScreen signupHref="/signup" />);
+    const link = screen.getByRole("link", { name: "Account erstellen" });
+    expect(link.getAttribute("href")).toBe("/signup");
+  });
 });

package/src/auth-email-password/web/__tests__/request-account-unlock-screen.test.tsx

@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { RequestAccountUnlockScreen } from "../request-account-unlock-screen";
+import { renderWithProviders } from "./test-utils";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+describe("RequestAccountUnlockScreen", () => {
+  test("renders title + email input + submit (de)", () => {
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    expect(screen.getByText("Konto entsperren")).toBeTruthy();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Link anfordern" })).toBeTruthy();
+  });
+
+  test("submit posts /api/auth/request-account-unlock with email", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/request-account-unlock",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ email: "user@example.com" }),
+        }),
+      );
+    });
+  });
+
+  test("success → silent-success banner + back-to-login link", async () => {
+    renderWithProviders(<RequestAccountUnlockScreen loginHref="/signin" />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Mail gesendet")).toBeTruthy();
+    });
+    expect(screen.getByRole("link", { name: /Zurück zum Login/i }).getAttribute("href")).toBe(
+      "/signin",
+    );
+  });
+
+  test("429 with retryAfterSeconds → accountLockedRetry banner", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ error: { details: { retryAfterSeconds: 180 } } }), {
+          status: 429,
+        }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("3 Minuten");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+
+  test("429 without retryAfterSeconds → generic rateLimited banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("Zu viele Login-Versuche");
+    });
+  });
+
+  test("server 5xx → unknownError banner, stays on form", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 500 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+
+  test("fetch throw → unknownError banner", async () => {
+    globalThis.fetch = mock(async () => {
+      throw new Error("network down");
+    }) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+  });
+
+  test("custom title prop overrides default", () => {
+    renderWithProviders(<RequestAccountUnlockScreen title="Custom Unlock" />);
+    expect(screen.getByText("Custom Unlock")).toBeTruthy();
+  });
+});

package/src/auth-email-password/web/auth-client.ts

@@ -233,6 +233,39 @@ export async function verifyEmail(
   return { ok: false, error: await parseTokenFailure(res) };
 }
 
+// POST /api/auth/request-account-unlock. Same silent-success semantik wie
+// request-password-reset. 429 → rate-limit-Failure.
+export async function requestAccountUnlock(
+  email: string,
+): Promise<{ ok: true } | { ok: false; error: AuthTokenFailure }> {
+  const res = await fetch("/api/auth/request-account-unlock", {
+    method: "POST",
+    credentials: "same-origin",
+    headers: { "Content-Type": "application/json", ...csrfHeader() },
+    body: JSON.stringify({ email }),
+  });
+  if (res.ok) return { ok: true };
+  return { ok: false, error: await parseTokenFailure(res) };
+}
+
+// POST /api/auth/confirm-account-unlock. Auto-submitted by
+// ConfirmAccountUnlockScreen after parsing `?token=...`. Server collapses
+// every verify failure into `invalid_unlock_token` (anti-enumeration,
+// parallel to reset/verify). Only clears the Redis lockout state, no
+// entity write.
+export async function confirmAccountUnlock(
+  token: string,
+): Promise<{ ok: true } | { ok: false; error: AuthTokenFailure }> {
+  const res = await fetch("/api/auth/confirm-account-unlock", {
+    method: "POST",
+    credentials: "same-origin",
+    headers: { "Content-Type": "application/json", ...csrfHeader() },
+    body: JSON.stringify({ token }),
+  });
+  if (res.ok) return { ok: true };
+  return { ok: false, error: await parseTokenFailure(res) };
+}
+
 // POST /api/auth/signup-request. Always-200 (anti-enumeration; wir
 // sagen nicht ob die Email schon registriert ist). Server schickt
 // Activation-Mail an die Adresse — beim Klick auf den Link landet der

package/src/auth-email-password/web/confirm-account-unlock-screen.tsx

@@ -0,0 +1,95 @@
+// @runtime client
+// ConfirmAccountUnlockScreen — reads `?token=...` from the URL, auto-posts
+// it to /api/auth/confirm-account-unlock on mount, shows success/error.
+// Idempotent server-side (clearLockoutState is a no-op when already
+// unlocked), so no re-submit risk. Mirrors VerifyEmailScreen 1:1.
+//
+// useEffect with empty deps + a once-guard so React Strict Mode's double
+// useEffect dispatch in dev fires the confirm call only once.
+
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useEffect, useRef, useState } from "react";
+import { confirmAccountUnlock } from "./auth-client";
+import { AuthCard, useUrlToken } from "./auth-form-primitives";
+
+export type ConfirmAccountUnlockScreenProps = {
+  readonly title?: string;
+  /** Override for the token from the URL. Default: parsed from `?token=...`. */
+  readonly token?: string;
+  /** href for the "go to sign in" link. Default "/login". */
+  readonly loginHref?: string;
+};
+
+type Status = "verifying" | "success" | "error" | "missing-token";
+
+export function ConfirmAccountUnlockScreen({
+  title,
+  token: tokenProp,
+  loginHref = "/login",
+}: ConfirmAccountUnlockScreenProps): ReactNode {
+  const t = useTranslation();
+  const { Link } = usePrimitives();
+  const token = useUrlToken(tokenProp);
+  const [status, setStatus] = useState<Status>(token === "" ? "missing-token" : "verifying");
+  const startedRef = useRef(false);
+
+  useEffect(() => {
+    if (status !== "verifying") return;
+    if (startedRef.current) return;
+    startedRef.current = true;
+    void (async () => {
+      const res = await confirmAccountUnlock(token);
+      setStatus(res.ok ? "success" : "error");
+    })();
+  }, [status, token]);
+
+  if (status === "missing-token") {
+    return (
+      <AuthCard title={title ?? t("auth.unlockAccount.errorTitle")}>
+        <div className="p-6 pt-0 flex flex-col gap-4">
+          <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.missingToken")}</p>
+          <Link href={loginHref} variant="muted">
+            {t("auth.unlockAccount.goToLogin")}
+          </Link>
+        </div>
+      </AuthCard>
+    );
+  }
+
+  if (status === "verifying") {
+    return (
+      <AuthCard>
+        <div className="p-6">
+          <p className="text-sm text-muted-foreground" role="status">
+            {t("auth.unlockAccount.verifying")}
+          </p>
+        </div>
+      </AuthCard>
+    );
+  }
+
+  if (status === "success") {
+    return (
+      <AuthCard title={title ?? t("auth.unlockAccount.successTitle")}>
+        <div className="p-6 pt-0 flex flex-col gap-4">
+          <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.successBody")}</p>
+          <Link href={loginHref} variant="button">
+            {t("auth.unlockAccount.goToLogin")}
+          </Link>
+        </div>
+      </AuthCard>
+    );
+  }
+
+  // status === "error"
+  return (
+    <AuthCard title={title ?? t("auth.unlockAccount.errorTitle")}>
+      <div className="p-6 pt-0 flex flex-col gap-4">
+        <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.errorBody")}</p>
+        <Link href={loginHref} variant="muted">
+          {t("auth.unlockAccount.goToLogin")}
+        </Link>
+      </div>
+    </AuthCard>
+  );
+}

package/src/auth-email-password/web/index.ts

@@ -18,7 +18,9 @@ export type {
   VerifyEmailFailure,
 } from "./auth-client";
 export {
+  confirmAccountUnlock,
   confirmSignup,
+  requestAccountUnlock,
   requestEmailVerification,
   requestPasswordReset,
   requestSignup,
@@ -34,6 +36,8 @@ export type {
   EmailPasswordClientOptions,
 } from "./client-plugin";
 export { emailPasswordClient } from "./client-plugin";
+export type { ConfirmAccountUnlockScreenProps } from "./confirm-account-unlock-screen";
+export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen";
 export type { DefaultTopbarActionsProps } from "./default-topbar-actions";
 export { DefaultTopbarActions } from "./default-topbar-actions";
 export type { ForgotPasswordScreenProps } from "./forgot-password-screen";
@@ -42,6 +46,8 @@ export type { InviteAcceptScreenProps } from "./invite-accept-screen";
 export { InviteAcceptScreen } from "./invite-accept-screen";
 export type { AuthLegalLink, LoginScreenProps } from "./login-screen";
 export { LoginScreen } from "./login-screen";
+export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-screen";
+export { RequestAccountUnlockScreen } from "./request-account-unlock-screen";
 export type { ResetPasswordScreenProps } from "./reset-password-screen";
 export { ResetPasswordScreen } from "./reset-password-screen";
 export type { SessionApi, SessionState, SessionStatus } from "./session";

package/src/auth-email-password/web/login-screen.tsx

@@ -40,6 +40,13 @@ export type LoginScreenProps = {
    *  Link. Apps die den Reset-Flow NICHT anbieten (z.B. nur Magic-Link),
    *  setzen das einfach nicht — Login bleibt minimalistisch. */
   readonly forgotPasswordHref?: string;
+  /** Optional href to RequestAccountUnlockScreen (#1266). When set, an
+   *  account_locked login error renders an "Unlock account?" link inline —
+   *  the account-lockout escape hatch, since forgotPasswordHref does NOT
+   *  help here: the lockout gate blocks login before password verify even
+   *  runs, so it also blocks the post-reset login. Apps without
+   *  accountUnlock configured just leave this unset. */
+  readonly unlockAccountHref?: string;
   /** Optional href zum SignupScreen. Wenn gesetzt rendert die LoginScreen
    *  einen "Account erstellen"-Link. Apps die kein Self-Signup wollen
    *  (closed-invite-only) setzen das einfach nicht. */
@@ -100,6 +107,7 @@ export function LoginScreen({
   subtitle,
   submitLabel,
   forgotPasswordHref,
+  unlockAccountHref,
   signupHref,
   legalLinks,
   onMfaChallenge,
@@ -229,6 +237,13 @@ export function LoginScreen({
                       </Button>
                     </span>
                   )}
+                {error.reason === "account_locked" && unlockAccountHref !== undefined && (
+                  <span className="self-start">
+                    <Link href={unlockAccountHref} variant="default">
+                      {t("auth.login.unlockAccount")}
+                    </Link>
+                  </span>
+                )}
                 {resendStatus.kind === "rateLimited" && (
                   <span className="text-xs">{t("auth.login.resendRateLimited")}</span>
                 )}