@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.160.0

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -272,4 +272,48 @@ describe("mfa verify — re-checks account state the way login.write.ts does", (
     );
     expectErrorIncludes(err, "invalid_challenge_token");
   });
+
+  test("user row deleted between login and verify → challenge rejected (the !userRow gate)", async () => {
+    const { user, secret } = await enableMfaFor(7);
+    const challengeToken = challengeFor(user.id, user.tenantId);
+
+    // Simulate the read_users row disappearing after the challenge token
+    // was issued but before verify runs — hits verify.write.ts's
+    // `if (!userRow) return invalidChallengeToken()` gate directly, distinct
+    // from a revoked membership or a restricted-but-present user row.
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}" WHERE id = $1`, [
+      user.id,
+    ]);
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.verify,
+      { challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expectErrorIncludes(err, "invalid_challenge_token");
+  });
+
+  test("user row homed in a DIFFERENT tenant than the challenge → verify succeeds (#1235)", async () => {
+    const { user, secret } = await enableMfaFor(8);
+
+    // Re-home the read_users row into another tenant — the #1235 layout:
+    // the user entity is tenant-agnostic (systemStream), so its row's
+    // tenant_id need not match the tenant being logged into. The old
+    // tenant-scoped UserQueries.detail lookup returned null here and every
+    // verify died with invalid_challenge_token; the unscoped findForAuth
+    // must resolve the row regardless.
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET tenant_id = $1 WHERE id = $2`,
+      ["00000000-0000-4000-8000-0000000000fe", user.id],
+    );
+
+    const challengeToken = challengeFor(user.id, user.tenantId);
+    const res = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(res.session.id).toBe(user.id);
+    expect(res.session.tenantId).toBe(user.tenantId);
+  });
 });

package/src/auth-mfa/handlers/verify.write.ts

@@ -129,7 +129,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // the SAME tenant the challenge token already committed to (no
       // "pick a tenant" step here — that already happened at login time).
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
-      const userRow = (await ctx.queryAs(systemUser, UserQueries.detail, {
+      const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
       })) as { roles?: string | null; status?: string } | null; // @cast-boundary engine-payload
 

package/src/auth-mfa/web/__tests__/mfa-client.test.ts

@@ -0,0 +1,118 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { verifyMfaChallenge } from "../mfa-client";
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+function jsonResponse(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), { status });
+}
+
+describe("verifyMfaChallenge", () => {
+  test("posts challengeToken + code to /api/auth/mfa/verify", async () => {
+    const fetchMock = mock(async () =>
+      jsonResponse({ isSuccess: true, token: "t", user: { id: "u1", tenantId: "t1", roles: [] } }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "/api/auth/mfa/verify",
+      expect.objectContaining({
+        method: "POST",
+        credentials: "same-origin",
+        body: JSON.stringify({ challengeToken: "challenge-1", code: "123456" }),
+      }),
+    );
+  });
+
+  test("success → kind:success mit token+user", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: true,
+        token: "test-token",
+        user: { id: "u1", tenantId: "t1", roles: ["Admin"] },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "123456");
+
+    expect(res).toEqual({
+      kind: "success",
+      data: { token: "test-token", user: { id: "u1", tenantId: "t1", roles: ["Admin"] } },
+    });
+  });
+
+  test("HTTP 429 → kind:failure reason:rate_limited (ohne Body-Parse)", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "rate_limited" } });
+  });
+
+  test("error als String → kind:failure reason:<string>", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: "invalid_totp_code" }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_totp_code" } });
+  });
+
+  test("error-Objekt mit details.reason → reason aus details, message+retryAfterSeconds übernommen", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({
+        isSuccess: false,
+        error: {
+          code: "mfa_verify_failed",
+          message: "too many attempts",
+          details: { reason: "too_many_attempts", retryAfterSeconds: 60 },
+        },
+      }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({
+      kind: "failure",
+      error: { reason: "too_many_attempts", message: "too many attempts", retryAfterSeconds: 60 },
+    });
+  });
+
+  test("error-Objekt ohne details.reason → fällt auf error.code zurück", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: false, error: { code: "invalid_challenge_token" } }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "invalid_challenge_token" } });
+  });
+
+  test("kein error-Feld, kein isSuccess → default reason mfa_verify_failed", async () => {
+    globalThis.fetch = mock(async () => jsonResponse({})) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+
+  test("kaputtes JSON → leeres Body-Objekt, default reason", async () => {
+    globalThis.fetch = mock(
+      async () => new Response("not json", { status: 200 }),
+    ) as unknown as typeof fetch;
+
+    const res = await verifyMfaChallenge("challenge-1", "000000");
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_verify_failed" } });
+  });
+});

package/src/auth-mfa/web/__tests__/mfa-enable-screen.test.tsx

@@ -0,0 +1,173 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
+import { SessionContext } from "../../../auth-email-password/web/session";
+import { defaultTranslations } from "../i18n";
+
+type WriteResult =
+  | { readonly isSuccess: true; readonly data: unknown }
+  | { readonly isSuccess: false; readonly error: { readonly i18nKey: string } };
+
+const dispatchSpy = mock<() => Promise<WriteResult>>(async () => ({
+  isSuccess: true,
+  data: {
+    setupToken: "setup-token-1",
+    otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+    recoveryCodes: ["code-1", "code-2"],
+  },
+}));
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
+}));
+
+mock.module("qrcode/lib/browser", () => ({
+  default: { toString: mock(async () => "<svg></svg>") },
+}));
+
+const { MfaEnableScreen } = await import("../mfa-enable-screen");
+
+const session = makeSessionApi();
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        <SessionContext.Provider value={session}>{children}</SessionContext.Provider>
+      </LocaleProvider>
+    </PrimitivesProvider>
+  );
+}
+
+beforeEach(() => {
+  dispatchSpy.mockClear();
+});
+
+describe("MfaEnableScreen", () => {
+  test("rendert Intro + Start-Button, kein Setup-Bereich vor dem Start", () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    expect(screen.getByText("Zwei-Faktor-Authentifizierung")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Einrichtung starten" })).toBeTruthy();
+    expect(screen.queryByLabelText("Code aus der Authenticator-App")).toBeNull();
+  });
+
+  test("Start-Klick → dispatcher.write ruft enable-start, danach Setup-Bereich mit Secret + Recovery-Codes", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-start",
+        expect.objectContaining({ accountLabel: "user@example.com" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    expect(screen.getByText(/code-1/)).toBeTruthy();
+    expect(screen.getByText(/code-2/)).toBeTruthy();
+  });
+
+  test("Bestätigen-Button bleibt disabled bis Recovery-Codes bestätigt + 6-stelliger Code eingegeben", async () => {
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+
+    const confirm = screen.getByRole("button", { name: "Aktivieren" }) as HTMLButtonElement;
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    expect(confirm.disabled).toBe(true);
+
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+    expect(confirm.disabled).toBe(false);
+  });
+
+  test("Bestätigen → dispatcher.write ruft enable-confirm, danach Success-Banner", async () => {
+    dispatchSpy
+      .mockImplementationOnce(async () => ({
+        isSuccess: true,
+        data: {
+          setupToken: "setup-token-1",
+          otpauthUri: "otpauth://totp/App:user@example.com?secret=ABCD1234&issuer=App",
+          recoveryCodes: ["code-1", "code-2"],
+        },
+      }))
+      .mockImplementationOnce(async () => ({ isSuccess: true, data: undefined }));
+    const onEnabled = mock(() => {});
+    render(
+      <Wrapper>
+        <MfaEnableScreen onEnabled={onEnabled} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+    await waitFor(() => {
+      expect(screen.getByText("ABCD1234")).toBeTruthy();
+    });
+    fireEvent.click(screen.getByLabelText("Ich habe die Recovery-Codes gespeichert."));
+    fireEvent.change(screen.getByLabelText(/^Code aus der Authenticator-App/), {
+      target: { value: "123456" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: "Aktivieren" }));
+
+    await waitFor(() => {
+      expect(dispatchSpy).toHaveBeenCalledWith(
+        "auth-mfa:write:enable-confirm",
+        expect.objectContaining({ setupToken: "setup-token-1", code: "123456" }),
+      );
+    });
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist jetzt aktiv.")).toBeTruthy();
+      expect(onEnabled).toHaveBeenCalled();
+    });
+  });
+
+  test("enable-start schlägt fehl → übersetztes Fehler-Banner, kein Setup-Bereich", async () => {
+    dispatchSpy.mockImplementationOnce(async () => ({
+      isSuccess: false,
+      error: { i18nKey: "auth.mfa.errors.mfaAlreadyEnabled" },
+    }));
+    render(
+      <Wrapper>
+        <MfaEnableScreen />
+      </Wrapper>,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Einrichtung starten" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Zwei-Faktor-Authentifizierung ist bereits aktiv.")).toBeTruthy();
+    });
+    expect(screen.queryByText("ABCD1234")).toBeNull();
+  });
+});

package/src/auth-mfa/web/__tests__/mfa-verify-screen.test.tsx

@@ -0,0 +1,100 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, type RenderResult, render, screen, waitFor } from "@testing-library/react";
+import type { ReactElement } from "react";
+import { makeSessionApi } from "../../../auth-email-password/web/__tests__/test-utils";
+import { SessionContext } from "../../../auth-email-password/web/session";
+import { defaultTranslations } from "../i18n";
+import { MfaVerifyScreen } from "../mfa-verify-screen";
+
+function renderScreen(ui: ReactElement, session = makeSessionApi()): RenderResult {
+  return render(
+    <PrimitivesProvider value={defaultPrimitives}>
+      <LocaleProvider
+        resolver={createStaticLocaleResolver({ locale: "de" })}
+        fallbackBundles={[defaultTranslations]}
+      >
+        <SessionContext.Provider value={session}>{ui}</SessionContext.Provider>
+      </LocaleProvider>
+    </PrimitivesProvider>,
+  );
+}
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {});
+
+describe("MfaVerifyScreen", () => {
+  test("rendert Titel + Code-Feld + Submit-Button (de)", () => {
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+    expect(screen.getByText("Zwei-Faktor-Bestätigung")).toBeTruthy();
+    expect(screen.getByLabelText(/^Code/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Bestätigen" })).toBeTruthy();
+  });
+
+  test("richtiger Code → ruft session.refresh() + onSuccess()", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            isSuccess: true,
+            token: "t",
+            user: { id: "u1", tenantId: "t1", roles: [] },
+          }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const session = makeSessionApi();
+    const onSuccess = mock(() => {});
+    void renderScreen(
+      <MfaVerifyScreen challengeToken="challenge-1" onSuccess={onSuccess} />,
+      session,
+    );
+
+    fireEvent.change(screen.getByLabelText(/^Code/), { target: { value: "123456" } });
+    fireEvent.click(screen.getByRole("button", { name: "Bestätigen" }));
+
+    await waitFor(() => {
+      expect(session.refresh).toHaveBeenCalled();
+      expect(onSuccess).toHaveBeenCalled();
+    });
+  });
+
+  test("falscher Code (invalid_totp_code) → Banner mit übersetztem Text", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ isSuccess: false, error: "invalid_totp_code" }), {
+          status: 200,
+        }),
+    ) as unknown as typeof fetch;
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+
+    fireEvent.change(screen.getByLabelText(/^Code/), { target: { value: "000000" } });
+    fireEvent.click(screen.getByRole("button", { name: "Bestätigen" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Ungültiger Code. Bitte erneut versuchen.")).toBeTruthy();
+    });
+  });
+
+  test("onCancel gesetzt → 'Zurück zum Login'-Button vorhanden, klick ruft onCancel", () => {
+    const onCancel = mock(() => {});
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" onCancel={onCancel} />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Zurück zum Login" }));
+    expect(onCancel).toHaveBeenCalled();
+  });
+
+  test("ohne onCancel → kein 'Zurück zum Login'-Button", () => {
+    void renderScreen(<MfaVerifyScreen challengeToken="challenge-1" />);
+    expect(screen.queryByRole("button", { name: "Zurück zum Login" })).toBeNull();
+  });
+});

package/src/billing-foundation/__tests__/subscription-provider-contract.ts

@@ -0,0 +1,69 @@
+import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { SubscriptionProviderPlugin } from "../types";
+
+export type SubscriptionProviderContractFixture = {
+  readonly plugin: SubscriptionProviderPlugin;
+  readonly ctx: HandlerContext;
+  readonly checkout: Parameters<
+    NonNullable<SubscriptionProviderPlugin["createCheckoutSession"]>
+  >[1];
+  // Providers without a customer-portal (e.g. Mollie) omit this — the
+  // portal-test then skips, mirroring `createPortalSession` being optional.
+  readonly portal?: Parameters<NonNullable<SubscriptionProviderPlugin["createPortalSession"]>>[1];
+  readonly cancelSubscriptionId?: string;
+  // A real, provider-signed/verifiable webhook payload for the happy path.
+  // Providers without a fixture skip the webhook-parsing test — building one
+  // needs provider-specific signing (Stripe HMAC) or a mocked API client
+  // (Mollie lazy-fetch), which the provider's own verify-webhook.test.ts
+  // already assembles.
+  readonly webhook?: {
+    readonly rawBody: string;
+    readonly headers: Record<string, string>;
+    readonly expectedTenantId: string;
+    readonly expectedTier: string;
+  };
+};
+
+export function describeSubscriptionProviderContract(
+  name: string,
+  factory: () => SubscriptionProviderContractFixture | Promise<SubscriptionProviderContractFixture>,
+): void {
+  describe(`${name} — SubscriptionProviderPlugin contract`, () => {
+    test("implements verifyAndParseWebhook", async () => {
+      const { plugin } = await factory();
+      expect(typeof plugin.verifyAndParseWebhook).toBe("function");
+    });
+
+    test("verifyAndParseWebhook parses a valid provider event into a SubscriptionEvent", async () => {
+      const { plugin, webhook } = await factory();
+      if (!webhook) return;
+      const event = await plugin.verifyAndParseWebhook(webhook.rawBody, webhook.headers);
+      expect(event).not.toBeNull();
+      expect(event?.tenantId).toBe(webhook.expectedTenantId);
+      expect(event?.tier).toBe(webhook.expectedTier);
+    });
+
+    test("createCheckoutSession returns a hosted-page url", async () => {
+      const { plugin, ctx, checkout } = await factory();
+      if (!plugin.createCheckoutSession) return;
+      const result = await plugin.createCheckoutSession(ctx, checkout);
+      expect(typeof result.url).toBe("string");
+      expect(result.url.length).toBeGreaterThan(0);
+    });
+
+    test("createPortalSession returns a hosted-page url — providers without a portal skip", async () => {
+      const { plugin, ctx, portal } = await factory();
+      if (!plugin.createPortalSession || !portal) return;
+      const result = await plugin.createPortalSession(ctx, portal);
+      expect(typeof result.url).toBe("string");
+      expect(result.url.length).toBeGreaterThan(0);
+    });
+
+    test("cancelSubscription resolves without throwing — providers without cancel-support skip", async () => {
+      const { plugin, ctx, cancelSubscriptionId } = await factory();
+      if (!plugin.cancelSubscription || !cancelSubscriptionId) return;
+      await expect(plugin.cancelSubscription(ctx, cancelSubscriptionId)).resolves.toBeUndefined();
+    });
+  });
+}

package/src/channel-email/pii-guard.ts

@@ -2,21 +2,24 @@ import { PII_CIPHERTEXT_PREFIX } from "@cosmicdrift/kumiko-framework/crypto";
 import type { EmailMessage, EmailTransport } from "./types";
 
 const isProductionEnv = () => process.env["NODE_ENV"] === "production";
-const CIPHERTEXT_RE = /kumiko-pii:v1:[^"\s<>\\]*/g;
+// Version-agnostic: catches both the current PII_CIPHERTEXT_PREFIX and any
+// older/decrypt-only format version still present in unmigrated rows.
+const CIPHERTEXT_MARKER = "kumiko-pii:v";
+const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 
 // A PII ciphertext never belongs in an outgoing mail. A ciphertext RECIPIENT
 // is always refused (the address is garbage — better no mail than a leaked
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
 export function guardEmailMessage(message: EmailMessage): EmailMessage {
-  if (message.to.includes(PII_CIPHERTEXT_PREFIX)) {
+  if (message.to.includes(CIPHERTEXT_MARKER)) {
     throw new Error(
       "[channel-email] refusing to send: recipient address is a PII ciphertext " +
         `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`,
     );
   }
   const leaking =
-    message.subject.includes(PII_CIPHERTEXT_PREFIX) || message.html.includes(PII_CIPHERTEXT_PREFIX);
+    message.subject.includes(CIPHERTEXT_MARKER) || message.html.includes(CIPHERTEXT_MARKER);
   if (!leaking) return message;
   const detail =
     "[channel-email] mail subject/body contains a PII ciphertext " +

package/src/config/__tests__/app-overrides.test.ts

@@ -115,4 +115,15 @@ describe("validateAppOverrides", () => {
       }),
     ).toThrow(/computed resolver.*app-overrides would silently bypass/i);
   });
+
+  test("throws on type mismatch — text key, number value", () => {
+    const reg = registryStub({
+      "a:config:s": createTenantConfig("text"),
+    });
+    expect(() =>
+      validateAppOverrides(reg, {
+        "a:config:s": 42,
+      }),
+    ).toThrow(/expected string, got number/i);
+  });
 });

package/src/config/__tests__/backing-secrets.integration.test.ts

@@ -203,6 +203,24 @@ describe("config backing=secrets — fail-loud when secrets unwired", () => {
       await unwired.cleanup();
     }
   });
+
+  test("cascade read on backing=secrets without secretsReader throws", async () => {
+    // Write succeeds on the wired stack; then resolve via a bare resolver
+    // (no secretsReader) so readBackingSecret fails loud on the cascade path.
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: API_KEY, value: "sk-live-planted", scope: "system" },
+      systemAdmin,
+    );
+
+    const bare = createConfigResolver();
+    const keyDef = stack.registry.getConfigKey(API_KEY);
+    expect(keyDef).toBeDefined();
+
+    await expect(
+      bare.getCascade(API_KEY, keyDef!, systemAdmin.tenantId, systemAdmin.id, stack.db),
+    ).rejects.toThrow(/backing="secrets".*without a secrets/);
+  });
 });
 
 describe("config backing=secrets — reset dispatch", () => {

package/src/config/__tests__/cascade.integration.test.ts

@@ -527,3 +527,42 @@ describe("config:query:cascade handler", () => {
     expect(data[TENANT_KEY]).toBeDefined();
   });
 });
+
+// getAll / getAllWithSource are bulk readers used by admin UIs — never
+// reached via the cascade query handlers above, so they stay uncovered
+// unless called directly on the resolver.
+describe("getAll / getAllWithSource", () => {
+  test("getAll picks the most specific row (user > tenant > system)", async () => {
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: TENANT_KEY, value: "TENANT_BULK" },
+      tenantAdmin,
+    );
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: USER_KEY, value: "USER_BULK" },
+      tenantAdmin,
+    );
+
+    const all = await resolver.getAll(tenantAdmin.tenantId, tenantAdmin.id, db);
+    // getAll returns raw stored strings (JSON-serialized); deserialize for asserts.
+    expect(JSON.parse(all.get(TENANT_KEY)?.value ?? "null")).toBe("TENANT_BULK");
+    expect(JSON.parse(all.get(USER_KEY)?.value ?? "null")).toBe("USER_BULK");
+    // System seed still present for keys without a more-specific row.
+    expect(JSON.parse(all.get(SYSTEM_KEY)?.value ?? "null")).toBe("SEED_SYSTEM");
+  });
+
+  test("getAllWithSource tags the winning row's source", async () => {
+    const withSource = await resolver.getAllWithSource(tenantAdmin.tenantId, tenantAdmin.id, db);
+
+    const userRow = withSource.get(USER_KEY);
+    expect(userRow?.source).toBe("user-row");
+    expect(JSON.parse(userRow?.value ?? "null")).toBe("USER_BULK");
+
+    const tenantRow = withSource.get(TENANT_KEY);
+    expect(tenantRow?.source).toBe("tenant-row");
+
+    const systemRow = withSource.get(SYSTEM_KEY);
+    expect(systemRow?.source).toBe("system-row");
+  });
+});

package/src/config/__tests__/config.integration.test.ts

@@ -1086,6 +1086,20 @@ describe("encrypted config", () => {
     const value = await configFn("integration:config:api-secret");
     expect(value).toBe("sk-super-secret-key-12345");
   });
+
+  test("reading an encrypted value with no cipher wired throws instead of leaking ciphertext", async () => {
+    const noCipherResolver = createConfigResolver({});
+    const configFn = createConfigAccessor(
+      stack.registry,
+      noCipherResolver,
+      "00000000-0000-4000-8000-000000000001",
+      systemAdmin.id,
+      db,
+    );
+    await expect(configFn("integration:config:api-secret")).rejects.toThrow(
+      /encrypted but no cipher/,
+    );
+  });
 });
 
 // --- Config lifecycle events ---