@cosmicdrift/kumiko-bundled-features 0.165.0 → 0.165.2

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -362,6 +362,25 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
     expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
   });
+
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    // A 400 for a completely different reason (bad token format, email
+    // shape) would also pass a bare status assertion — pin the field-level
+    // reason so the test actually proves the breach-list rejection fired.
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
 });
 
 describe("invite-signup-complete (Branch 3: anon + new email)", () => {
@@ -397,6 +416,21 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
     expect(loginRes.status).toBe(200);
   });
 
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
+
   test("Existing email → invalid_invite_token (User soll Branch 2 nutzen)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");
 

package/src/auth-email-password/__tests__/login-gates.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { USER_STATUS } from "../../user";
+import type { AuthUserRow } from "../auth-user-row";
+import { gateEnforceAccountStatus, gateEnforceEmailVerified } from "../handlers/login.write";
+
+function row(over: Partial<AuthUserRow> = {}): AuthUserRow {
+  return { id: "00000000-0000-4000-8000-000000000001", passwordHash: "x", ...over };
+}
+
+describe("login.write gates (fw#1284)", () => {
+  test("gateEnforceEmailVerified rejects when strict and unverified", () => {
+    const g = gateEnforceEmailVerified(row({ emailVerified: false }), true);
+    expect(g.ok).toBe(false);
+    if (!g.ok) expect(g.result.isSuccess).toBe(false);
+  });
+
+  test("gateEnforceEmailVerified passes when not strict", () => {
+    expect(gateEnforceEmailVerified(row({ emailVerified: false }), false).ok).toBe(true);
+  });
+
+  test("gateEnforceAccountStatus rejects restricted", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.Restricted }));
+    expect(g.ok).toBe(false);
+  });
+
+  test("gateEnforceAccountStatus rejects deletion_requested as invalid_creds shape", () => {
+    const g = gateEnforceAccountStatus(row({ status: USER_STATUS.DeletionRequested }));
+    expect(g.ok).toBe(false);
+    if (!g.ok) {
+      expect(g.result.isSuccess).toBe(false);
+      // anti-enumeration — same family as invalid credentials
+      expect(g.result).toMatchObject({ isSuccess: false });
+    }
+  });
+
+  test("gateEnforceAccountStatus passes active", () => {
+    expect(gateEnforceAccountStatus(row({ status: USER_STATUS.Active })).ok).toBe(true);
+  });
+});

package/src/auth-email-password/__tests__/self-registration-toggle.integration.test.ts

@@ -239,31 +239,26 @@ describe("auth-self-registration toggle — companion feature NOT composed", ()
     await bareStack.cleanup();
   });
 
-  // KNOWN GAP (found while writing this regression pin, not yet decided):
-  // ctx.hasFeature() checks the effective-feature SET, which only ever
-  // contains registered feature names (computeEffectiveFeatures iterates
-  // registry.features). A name nothing ever registered is never a member,
-  // so hasFeature("auth-self-registration") is false here — signup-request
-  // silently no-ops (200, anti-enumeration success shape, but no mail) the
-  // moment an app wires a real effectiveFeatures resolver without also
-  // composing createAuthSelfRegistrationToggleFeature. This pins the
-  // CURRENT (broken) behavior rather than asserting the desired one —
-  // flagged for a follow-up decision, not silently fixed here.
-  test("[KNOWN GAP] signup-request silently drops mail when the companion toggle feature was never composed", async () => {
+  // Fixed (#1468): ctx.hasFeature() is fail-closed for a name nothing ever
+  // registered — signup-request and the status query now only gate on the
+  // toggle when registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) proves
+  // the companion feature is actually composed, so an app that mounts
+  // auth-email-password without it keeps self-signup working.
+  test("signup-request still sends mail when the companion toggle feature was never composed", async () => {
     const res = await bareStack.http.raw("POST", "/api/auth/signup-request", {
       email: "not-toggle-aware@example.com",
     });
     expect(res.status).toBe(200);
-    expect(bareEmailTransport.sent).toHaveLength(0);
+    expect(bareEmailTransport.sent).toHaveLength(1);
   });
 
-  test("[KNOWN GAP] signup-registration-status reports enabled:false with no toggle feature mounted", async () => {
+  test("signup-registration-status reports enabled:true with no toggle feature mounted", async () => {
     const res = await bareStack.http.raw("POST", "/api/query", {
       type: "auth-email-password:query:signup-registration-status",
       payload: {},
     });
     expect((await res.json()) as { data?: { enabled: boolean } }).toMatchObject({
-      data: { enabled: false },
+      data: { enabled: true },
     });
   });
 });

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -120,6 +120,22 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Prime request-helper's per-user sid cache for systemAdmin (the seed
+  // actor every test's seedUser() call authenticates as) here, once,
+  // before any test's observation window opens — otherwise whichever
+  // test happens to call seedUser() first would observe an extra
+  // store.created entry for seed plumbing, not the auth-route behavior
+  // under test (#1452: authHeader() now mints one sid per user.id, not
+  // one per call, so this only ever fires here).
+  await seedUser({
+    email: "warmup-seed-actor@example.com",
+    password: "warmup-password-not-asserted-on",
+    tenants: [],
+  });
+  store.live.clear();
+  store.created.length = 0;
+  store.revoked.length = 0;
 });
 
 afterAll(async () => {
@@ -158,11 +174,6 @@ async function seedUser(opts: {
       roles: t.roles,
     });
   }
-  // request-helper mints a sid for systemAdmin when sessionCreator is wired
-  // (#1372) — that is seed plumbing, not the auth-route behavior under test.
-  store.live.clear();
-  store.created.length = 0;
-  store.revoked.length = 0;
   return { userId: created.id };
 }
 

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -27,6 +27,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -57,6 +58,41 @@ import { createAuthEmailPasswordFeature } from "../feature";
 
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 
+// Regression-proof for #1478: provisionSignupAccount only threaded `hooks`
+// into seedTenant, leaving seedUserWithPassword's `user`-entity and
+// seedTenantMembership's `tenantMembership`-entity postSave hooks unfired
+// on self-signup — same bug class as #1463, just for the other two
+// entities in the same call. This vendor feature's hook is the user-side
+// analog of tier-engine's tenant hook above.
+const userPostSaveFired = { count: 0 };
+const userHookVendorFeature = defineFeature("user-hook-vendor-test", (r) => {
+  r.requires("user");
+  r.hook("postSave", { allOf: "user" }, async (ctx) => {
+    if (ctx.isNew) userPostSaveFired.count++;
+  });
+});
+
+// Regression-proof for #1478/#1526: seedTenantMembership must fire the
+// `tenantMembership` entity's postSave hooks (e.g. a Welcome-notification
+// hook) on self-signup too — pins the `fireEntityPostSave` call added at
+// seeding.ts's seedTenantMembership, not just the `user`/`tenant` ones.
+// #1566: also record ctx._tenantId so a shallow-only rescope regresses.
+const tenantMembershipPostSaveFired = { count: 0, seenTenantIds: [] as string[] };
+const tenantMembershipHookVendorFeature = defineFeature(
+  "tenant-membership-hook-vendor-test",
+  (r) => {
+    r.requires("tenant");
+    r.hook("postSave", { allOf: "tenant-membership" }, async (result, context) => {
+      if (result.isNew) {
+        tenantMembershipPostSaveFired.count++;
+        if (context._tenantId !== undefined) {
+          tenantMembershipPostSaveFired.seenTenantIds.push(String(context._tenantId));
+        }
+      }
+    });
+  },
+);
+
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
 
 // Activation mails now go through delivery (ctx.notify → channel-email). The
@@ -92,6 +128,8 @@ beforeAll(async () => {
         defaultTier: "free",
         tierMap: { free: { features: [], caps: {} } },
       }),
+      userHookVendorFeature,
+      tenantMembershipHookVendorFeature,
     ],
     extraContext: (deps) => ({
       ...createDeliveryTestContext(deps),
@@ -130,6 +168,9 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tierAssignmentTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
+  userPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.seenTenantIds = [];
   // Redis-cleanup damit Resend-Tests keine state-leaks haben.
   const allKeys = await stack.redis.redis.keys("signup:*");
   if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
@@ -245,6 +286,19 @@ describe("POST /api/auth/signup-confirm", () => {
     expect(tierRows).toHaveLength(1);
     expect(tierRows[0]?.["tier"]).toBe("free");
 
+    // #1478 regression: seedUserWithPassword (called from
+    // provisionSignupAccount) fires the `user` entity's postSave hooks too —
+    // before this fix, only seedTenant's hooks param was wired through.
+    expect(userPostSaveFired.count).toBe(1);
+
+    // #1478/#1526 regression: seedTenantMembership (called from
+    // provisionSignupAccount) fires the `tenant-membership` entity's postSave
+    // hooks too — before this fix, only seedTenant's hooks param was wired.
+    expect(tenantMembershipPostSaveFired.count).toBe(1);
+    // #1566: rescope must put the new tenant on the hook context, not the
+    // anonymous/system caller's tenantId.
+    expect(tenantMembershipPostSaveFired.seenTenantIds).toEqual([body.user?.tenantId ?? ""]);
+
     // Authority-Beweis: Login mit dem gesetzten Password funktioniert.
     const loginRes = await postLogin(email, password);
     expect(loginRes.status).toBe(200);

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -46,11 +46,12 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
+import { passwordSchema } from "../password-policy";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),
   email: z.email(),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteAcceptWithLoginData = {

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -50,12 +50,13 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
+import { passwordSchema } from "../password-policy";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
 import { seedUserWithPassword } from "../seeding";
 
 const InviteSignupCompleteSchema = z.object({
   token: z.string().min(1),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteSignupCompleteData = {

package/src/auth-email-password/handlers/login.write.ts

@@ -11,7 +11,7 @@ import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
-import { parseAuthUserRow } from "../auth-user-row";
+import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
 import {
   AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
   AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
@@ -72,6 +72,170 @@ type LoginResult =
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
   | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string };
 
+type Membership = { readonly tenantId: TenantId; readonly roles: readonly string[] };
+
+type GateReject = { readonly ok: false; readonly result: WriteResult<LoginResult> };
+type GateOk<T> = { readonly ok: true; readonly value: T };
+type GateOutcome<T> = GateReject | GateOk<T>;
+
+function reject(result: WriteResult<LoginResult>): GateReject {
+  return { ok: false, result };
+}
+
+function ok<T>(value: T): GateOk<T> {
+  return { ok: true, value };
+}
+
+/** Uniform response on any credential miss — burns argon2 cost (#774). */
+export async function gateResolveAuthUser(
+  ctx: HandlerContext,
+  systemUser: SessionUser,
+  email: string,
+  password: string,
+): Promise<GateOutcome<AuthUserRow>> {
+  const found = parseAuthUserRow(await ctx.queryAs(systemUser, UserQueries.findForAuth, { email }));
+  if (!found?.passwordHash || found.isDeleted) {
+    await verifyDummyPassword(password);
+    return reject(invalidCredentials());
+  }
+  return ok(found);
+}
+
+/**
+ * Lockout BEFORE password verify — locked accounts can't be password-probed.
+ * Fail-open without Redis (IP rate-limit still covers partially).
+ */
+export async function gateEnforceLockout(
+  ctx: HandlerContext,
+  userId: string,
+): Promise<GateOutcome<undefined>> {
+  if (!ctx.redis) return ok(undefined);
+  const state = await getLockoutState(ctx.redis, userId);
+  if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
+    const now = Date.now();
+    if (state.lockedUntil > now) {
+      const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
+      return reject(accountLocked(retryAfterSeconds));
+    }
+  }
+  return ok(undefined);
+}
+
+/** Verify password; record miss / clear lockout on hit. */
+export async function gateVerifyPassword(
+  ctx: HandlerContext,
+  found: AuthUserRow,
+  password: string,
+  maxFailedAttempts: number,
+  lockoutDurationMinutes: number,
+): Promise<GateOutcome<undefined>> {
+  const passwordHash = found.passwordHash;
+  if (!passwordHash) return reject(invalidCredentials());
+  const passwordOk = await verifyPassword(passwordHash, password);
+  if (!passwordOk) {
+    if (ctx.redis) {
+      await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
+    }
+    return reject(invalidCredentials());
+  }
+  // Clear before MFA — MFA has its own attempt-cap; don't password-lock
+  // users who occasionally mistype across otherwise-successful logins.
+  if (ctx.redis) {
+    await clearLockoutState(ctx.redis, found.id);
+  }
+  return ok(undefined);
+}
+
+/** Strict email verification — after password, before session. */
+export function gateEnforceEmailVerified(
+  found: AuthUserRow,
+  strictVerification: boolean,
+): GateOutcome<undefined> {
+  if (strictVerification && found.emailVerified !== true) {
+    return reject(emailNotVerified());
+  }
+  return ok(undefined);
+}
+
+/** DSGVO Art. 18 freeze + forget-path anti-enumeration. */
+export function gateEnforceAccountStatus(found: AuthUserRow): GateOutcome<undefined> {
+  if (found.status === USER_STATUS.Restricted) {
+    return reject(accountRestricted());
+  }
+  if (found.status === USER_STATUS.DeletionRequested || found.status === USER_STATUS.Deleted) {
+    return reject(invalidCredentials());
+  }
+  return ok(undefined);
+}
+
+/** Pick membership (last-active preferred); merge global + tenant roles. */
+export async function gateResolveMembership(
+  ctx: HandlerContext,
+  systemUser: SessionUser,
+  found: AuthUserRow,
+): Promise<GateOutcome<{ readonly chosen: Membership; readonly mergedRoles: readonly string[] }>> {
+  const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
+    userId: found.id,
+  })) as Array<Membership>; // @cast-boundary db-runner
+
+  if (memberships.length === 0) {
+    return reject(noMembership());
+  }
+
+  const preferred =
+    found.lastActiveTenantId !== null && found.lastActiveTenantId !== undefined
+      ? memberships.find((m) => m.tenantId === found.lastActiveTenantId)
+      : undefined;
+  const chosen = preferred ?? memberships[0];
+  if (!chosen) {
+    return reject(noMembership());
+  }
+
+  const globalRoles = parseRoles(found.roles ?? null);
+  // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
+  // roles only (globalRoles keeps SystemAdmin) — read-time backstop against a
+  // rebuild-resurrected role.
+  const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
+  return ok({ chosen, mergedRoles });
+}
+
+/** MFA challenge / setup-required / proceed. */
+export async function gateEnforceMfa(
+  ctx: HandlerContext,
+  opts: LoginHandlerOptions,
+  userId: string,
+  tenantId: TenantId,
+  mergedRoles: readonly string[],
+): Promise<GateOutcome<LoginResult | undefined>> {
+  if (!opts.mfaStatusChecker) return ok(undefined);
+  const mfaStatus = await opts.mfaStatusChecker(ctx, userId, tenantId, mergedRoles);
+  if ("challengeToken" in mfaStatus) {
+    return ok({ kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken });
+  }
+  if ("setupRequired" in mfaStatus) {
+    return ok({ kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken });
+  }
+  return ok(undefined);
+}
+
+/** Auth-claims hooks → session. */
+export async function gateBuildSession(
+  ctx: HandlerContext,
+  userId: string,
+  tenantId: TenantId,
+  mergedRoles: readonly string[],
+): Promise<GateOutcome<{ readonly kind: "auth-session"; readonly session: SessionUser }>> {
+  const baseSession: SessionUser = {
+    id: userId,
+    tenantId,
+    roles: mergedRoles,
+  };
+  const claims = await ctx.resolveAuthClaims(baseSession);
+  const session: SessionUser =
+    Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
+  return ok({ kind: "auth-session", session });
+}
+
 // Login — unauthenticated entry point. The route is wired public (no JWT
 // middleware), synthesising a guest SessionUser for the handler's access
 // check. Everything inside the handler goes through ctx.queryAs(system, ...)
@@ -93,169 +257,46 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
     handler: async (event, ctx): Promise<WriteResult<LoginResult>> => {
       const systemUser = createSystemUser(SYSTEM_USER_ID);
 
-      const found = parseAuthUserRow(
-        await ctx.queryAs(systemUser, UserQueries.findForAuth, {
-          email: event.payload.email,
-        }),
+      const userGate = await gateResolveAuthUser(
+        ctx,
+        systemUser,
+        event.payload.email,
+        event.payload.password,
       );
+      if (!userGate.ok) return userGate.result;
+      const found = userGate.value;
 
-      // Uniform response on any credential mismatch (no user, wrong password,
-      // soft-deleted user) — prevents email enumeration.
-      if (!found?.passwordHash || found.isDeleted) {
-        // Burn the same argon2 verify cost as the hit path so response
-        // latency doesn't reveal whether the email is registered (#774).
-        await verifyDummyPassword(event.payload.password);
-        return invalidCredentials();
-      }
-
-      // Lockout gate — runs BEFORE password verification so a locked account
-      // can't be bruteforce-probed for passwords (and also can't be probed
-      // for a timing-oracle on the bcrypt verify). If Redis isn't wired,
-      // lockout is silently skipped — login still works, brute-force
-      // protection just degrades to the IP-rate-limiter at the edge.
-      if (ctx.redis) {
-        const state = await getLockoutState(ctx.redis, found.id);
-        if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
-          const now = Date.now();
-          if (state.lockedUntil > now) {
-            const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
-            return accountLocked(retryAfterSeconds);
-          }
-          // lockedUntil in the past — shouldn't normally happen because the
-          // Redis TTL on the until-key expires the key at the same moment
-          // as the value. Clock skew / replication lag could surface this;
-          // fall through to password verification. The counter is NOT
-          // reset — next miss re-locks immediately (strict-semantic, see
-          // lockout-store.ts).
-        }
-      }
-
-      const passwordOk = await verifyPassword(found.passwordHash, event.payload.password);
-      if (!passwordOk) {
-        if (ctx.redis) {
-          await recordFailedAttempt(ctx.redis, found.id, maxFailedAttempts, lockoutDurationMinutes);
-        }
-        return invalidCredentials();
-      }
-
-      // Clear the lockout state as soon as the password is proven — the
-      // password itself is the thing this counter guards, and MFA (if
-      // gated below) has its own separate attempt-cap. Doing this before
-      // the MFA gate matters: without it, an MFA user who occasionally
-      // mistypes their password accumulates failures across otherwise-
-      // successful logins and eventually gets password-locked out even
-      // though every login they completed was legitimate.
-      if (ctx.redis) {
-        await clearLockoutState(ctx.redis, found.id);
-      }
+      const lockoutGate = await gateEnforceLockout(ctx, found.id);
+      if (!lockoutGate.ok) return lockoutGate.result;
 
-      // Strict verification gate — runs AFTER password check so an attacker
-      // probing "email_not_verified" needs valid credentials first. The
-      // remaining enumeration surface is "valid-cred + unverified" → accepted
-      // leak because the signup flow already told the user "check your email".
-      if (strictVerification && found.emailVerified !== true) {
-        return emailNotVerified();
-      }
-
-      // S2.U6 — DSGVO Art. 18 Account-Freeze. Restricted users koennen sich
-      // nicht einloggen; lift-restriction-Endpoint ist der einzige Ausgang
-      // (siehe lift-restriction.write.ts Header — typisch via Magic-Link
-      // oder Operator-Tool, da Login geblockt). Auth-side Block ist hard-
-      // requirement; ohne den koennte der User mit Login-Sessions trotz
-      // Restriction-Flag durchschreiben.
-      //
-      // DeletionRequested + Deleted kollabieren bewusst auf invalid_creds
-      // (anti-enumeration im Forget-Pfad) — Restricted ist user-initiiert,
-      // distinct error ist hier safe.
-      if (found.status === USER_STATUS.Restricted) {
-        return accountRestricted();
-      }
-      if (found.status === USER_STATUS.DeletionRequested || found.status === USER_STATUS.Deleted) {
-        return invalidCredentials();
-      }
-
-      // Resolve tenant + roles via the tenant feature's memberships query.
-      // Returns [] if the user has no memberships — MVP: no login without an
-      // invitation, so we refuse with a dedicated error.
-      const memberships = (await ctx.queryAs(systemUser, "tenant:query:memberships", {
-        userId: found.id,
-      })) as Array<{ tenantId: TenantId; roles: readonly string[] }>; // @cast-boundary db-runner
+      const passwordGate = await gateVerifyPassword(
+        ctx,
+        found,
+        event.payload.password,
+        maxFailedAttempts,
+        lockoutDurationMinutes,
+      );
+      if (!passwordGate.ok) return passwordGate.result;
 
-      if (memberships.length === 0) {
-        return noMembership();
-      }
+      const emailGate = gateEnforceEmailVerified(found, strictVerification);
+      if (!emailGate.ok) return emailGate.result;
 
-      const preferred =
-        found.lastActiveTenantId !== null && found.lastActiveTenantId !== undefined
-          ? memberships.find((m) => m.tenantId === found.lastActiveTenantId)
-          : undefined;
-      const chosen = preferred ?? memberships[0];
-      if (!chosen) {
-        return noMembership();
-      }
+      const statusGate = gateEnforceAccountStatus(found);
+      if (!statusGate.ok) return statusGate.result;
 
-      // Globale Rollen aus user.roles + tenant-membership-roles mergen.
-      // Globale Rollen (SystemAdmin etc.) bleiben so über alle tenants
-      // gleich; tenant-spezifische Rollen (Admin, User) kommen aus der
-      // membership. Dedupe via Set damit eine Rolle die in beiden Quellen
-      // steht nicht doppelt im Session-Roles landet.
-      //
-      // Computed BEFORE the MFA gate (moved up from its original spot below
-      // baseSession) because the gate's "admins" enforcement policy needs
-      // the MERGED set — a SystemAdmin whose admin-ness lives only in
-      // globalRoles would be missed if only chosen.roles were passed.
-      const globalRoles = parseRoles(found.roles ?? null);
-      // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
-      // only (globalRoles keeps SystemAdmin) — read-time backstop against a
-      // rebuild-resurrected role.
-      const mergedRoles = buildSessionRoles(globalRoles, chosen.roles);
+      const membershipGate = await gateResolveMembership(ctx, systemUser, found);
+      if (!membershipGate.ok) return membershipGate.result;
+      const { chosen, mergedRoles } = membershipGate.value;
 
-      // Second-factor gate. Runs AFTER password verification (correct
-      // credentials proven) and AFTER tenant resolution (need chosen.tenantId
-      // to scope the MFA-enabled check). Three outcomes: enrolled → mint a
-      // challenge instead of a session (/auth/mfa/verify completes the
-      // login); policy demands MFA but the user never enrolled → block with
-      // mfa-setup-required (no session, no challenge — see auth-mfa's
-      // config.ts for why this deliberately hard-blocks); neither → proceed.
-      if (opts.mfaStatusChecker) {
-        const mfaStatus = await opts.mfaStatusChecker(ctx, found.id, chosen.tenantId, mergedRoles);
-        if ("challengeToken" in mfaStatus) {
-          return {
-            isSuccess: true,
-            data: { kind: "mfa-challenge", challengeToken: mfaStatus.challengeToken },
-          };
-        }
-        if ("setupRequired" in mfaStatus) {
-          return {
-            isSuccess: true,
-            data: { kind: "mfa-setup-required", preauthSetupToken: mfaStatus.preauthSetupToken },
-          };
-        }
+      const mfaGate = await gateEnforceMfa(ctx, opts, found.id, chosen.tenantId, mergedRoles);
+      if (!mfaGate.ok) return mfaGate.result;
+      if (mfaGate.value !== undefined) {
+        return { isSuccess: true, data: mfaGate.value };
       }
 
-      const baseSession: SessionUser = {
-        id: found.id,
-        tenantId: chosen.tenantId,
-        roles: mergedRoles,
-      };
-
-      // Features can contribute identity facts (team IDs, feature flags, ...)
-      // via r.authClaims(). ctx.resolveAuthClaims is a thin pass-through to
-      // dispatcher.resolveAuthClaims — same impl also used by the switch-tenant
-      // route, so login + tenant-switch stay in sync.
-      //
-      // Best-effort: if no feature registered a hook, we get an empty record
-      // back and simply omit the `claims` field from the session (keeps the
-      // shape clean for the JWT layer, which already spreads claims
-      // conditionally based on presence).
-      const claims = await ctx.resolveAuthClaims(baseSession);
-      const session: SessionUser =
-        Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
-
-      return {
-        isSuccess: true,
-        data: { kind: "auth-session", session },
-      };
+      const sessionGate = await gateBuildSession(ctx, found.id, chosen.tenantId, mergedRoles);
+      if (!sessionGate.ok) return sessionGate.result;
+      return { isSuccess: true, data: sessionGate.value };
     },
   });
 }