@cosmicdrift/kumiko-bundled-features 0.159.1 → 0.161.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.159.1",
+  "version": "0.161.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -117,11 +117,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.159.1",
-    "@cosmicdrift/kumiko-framework": "0.159.1",
-    "@cosmicdrift/kumiko-headless": "0.159.1",
-    "@cosmicdrift/kumiko-renderer": "0.159.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.159.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.161.0",
+    "@cosmicdrift/kumiko-framework": "0.161.0",
+    "@cosmicdrift/kumiko-headless": "0.161.0",
+    "@cosmicdrift/kumiko-renderer": "0.161.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.161.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/login-mfa-setup-required.integration.test.ts

@@ -0,0 +1,129 @@
+// #1455: enforcement policy blocks an unenrolled user at login
+// (mfa-setup-required) — the response must carry a preauthSetupToken so a
+// later pre-auth enroll step (#1231) can look the user back up without a
+// session. Real HTTP through setupTestStack, both auth-mfa and
+// auth-email-password mounted together (mirrors auth.integration.test.ts).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createAuthMfaFeature,
+  mfaRequiredConfigHandle,
+  mfaStatusCheckerFromFeature,
+} from "../../auth-mfa";
+import { userMfaEntity } from "../../auth-mfa/schema/user-mfa";
+import { ConfigHandlers, createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+let stack: TestStack;
+
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+const TENANT_ID: TenantId = testTenantId(400);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: "test-mfa-setup-token-secret-at-least-32-bytes!!",
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+});
+
+describe("login: mfa-setup-required carries a verifiable preauthSetupToken", () => {
+  test("unenrolled user blocked by 'all' policy gets a token instead of a session", async () => {
+    const password = "correct-horse-battery-2026";
+    const hash = await hashPassword(password);
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "unenrolled@example.com", passwordHash: hash, displayName: "Unenrolled" },
+      createTestUser({ id: 401, tenantId: TENANT_ID, roles: ["SystemAdmin"] }),
+    );
+    await seedTenantMembership(stack.db, {
+      userId: created.id,
+      tenantId: TENANT_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: mfaRequiredConfigHandle.name, value: "all" },
+      createTestUser({ id: 402, tenantId: TENANT_ID, roles: ["Admin"] }),
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "unenrolled@example.com",
+      password,
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(body.mfaSetupRequired).toBe(true);
+    expect(body.token).toBeUndefined();
+    expect(typeof body.preauthSetupToken).toBe("string");
+
+    const { verifyMfaPreauthSetupToken } = await import("../../auth-mfa/mfa-preauth-setup-token");
+    const verified = verifyMfaPreauthSetupToken(body.preauthSetupToken, CHALLENGE_TOKEN_SECRET);
+    expect(verified.ok).toBe(true);
+    if (verified.ok) {
+      expect(verified.payload).toEqual({ userId: created.id, tenantId: TENANT_ID });
+    }
+  });
+});

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -158,6 +158,11 @@ async function seedUser(opts: {
       roles: t.roles,
     });
   }
+  // request-helper mints a sid for systemAdmin when sessionCreator is wired
+  // (#1372) — that is seed plumbing, not the auth-route behavior under test.
+  store.live.clear();
+  store.created.length = 0;
+  store.revoked.length = 0;
   return { userId: created.id };
 }
 

package/src/auth-email-password/handlers/login.write.ts

@@ -58,7 +58,7 @@ export type LoginHandlerOptions = {
   ) => Promise<
     | { readonly required: false }
     | { readonly required: true; readonly challengeToken: string }
-    | { readonly setupRequired: true }
+    | { readonly setupRequired: true; readonly preauthSetupToken: string }
   >;
 };
 
@@ -70,7 +70,7 @@ const SYSTEM_USER_ID = "00000000-0000-4000-8000-000000000000";
 type LoginResult =
   | { readonly kind: "auth-session"; readonly session: SessionUser }
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
-  | { readonly kind: "mfa-setup-required" };
+  | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string };
 
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), synthesising a guest SessionUser for the handler's access
@@ -226,7 +226,10 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
           };
         }
         if ("setupRequired" in mfaStatus) {
-          return { isSuccess: true, data: { kind: "mfa-setup-required" } };
+          return {
+            isSuccess: true,
+            data: { kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken },
+          };
         }
       }
 

package/src/auth-email-password/i18n.ts

@@ -35,6 +35,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.loginFailed": "Login fehlgeschlagen.",
     "auth.errors.mfaNotSupported":
       "Diese App unterstützt keine Zwei-Faktor-Bestätigung. Bitte an den Support wenden.",
+    "auth.errors.mfaSetupRequired":
+      "Zwei-Faktor-Authentifizierung erforderlich. Bitte an den Administrator wenden.",
     "auth.errors.invalidResetToken":
       "Der Link ist ungültig oder abgelaufen. Bitte fordere einen neuen an.",
     "auth.errors.invalidVerificationToken": "Der Bestätigungs-Link ist ungültig oder abgelaufen.",
@@ -161,6 +163,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.errors.loginFailed": "Login failed.",
     "auth.errors.mfaNotSupported":
       "This app doesn't support two-factor verification. Please contact support.",
+    "auth.errors.mfaSetupRequired":
+      "Two-factor authentication required. Please contact your administrator.",
     "auth.errors.invalidResetToken": "Link is invalid or expired. Please request a new one.",
     "auth.errors.invalidVerificationToken": "Verification link is invalid or expired.",
     "auth.errors.invalidUnlockToken":