@cosmicdrift/kumiko-bundled-features 0.165.0 → 0.165.2

package/src/auth-email-password/web/login-screen.tsx

@@ -11,7 +11,11 @@
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
-import { type LoginFailure, requestEmailVerification } from "./auth-client";
+import {
+  type KnownLoginFailureReason,
+  type LoginFailure,
+  requestEmailVerification,
+} from "./auth-client";
 import { AuthCard } from "./auth-form-primitives";
 import { useSession } from "./session";
 
@@ -144,7 +148,7 @@ export function LoginScreen({
         onMfaChallenge(res.challengeToken);
         return;
       }
-      setError({ reason: "mfa_not_supported" });
+      setError({ reason: "mfa_not_supported" satisfies KnownLoginFailureReason });
       setFailedLoginEmail(email);
       return;
     }
@@ -153,7 +157,7 @@ export function LoginScreen({
         onMfaSetupRequired(res.preauthSetupToken, email);
         return;
       }
-      setError({ reason: "mfa_setup_required" });
+      setError({ reason: "mfa_setup_required" satisfies KnownLoginFailureReason });
       setFailedLoginEmail(email);
       return;
     }

package/src/auth-email-password/web/request-account-unlock-screen.tsx

@@ -50,7 +50,7 @@ export function RequestAccountUnlockScreen({
             : undefined;
         setError(
           minutes !== undefined
-            ? t("auth.errors.accountLockedRetry", { minutes })
+            ? t("auth.requestUnlock.rateLimited", { minutes })
             : t("auth.errors.rateLimited"),
         );
       } else {

package/src/auth-foundation/__tests__/session-store.test.ts

@@ -44,11 +44,9 @@ describe("resolveSessionStore — finds the single registered provider", () => {
 });
 
 describe("validateSessionStoreMultiplicity", () => {
-  test("0 providers registered → throws (fail-fast, nothing to store sessions in)", () => {
+  test("0 providers registered → does not throw (valid: PAT-only / machine-API deployments mount no sessionStore)", () => {
     const registry = createRegistry([authFoundationFeature]);
-    expect(() => validateSessionStoreMultiplicity([...registry.features.values()])).toThrow(
-      /no sessionStore provider registered/,
-    );
+    expect(() => validateSessionStoreMultiplicity([...registry.features.values()])).not.toThrow();
   });
 
   test("exactly 1 provider → no throw", () => {

package/src/auth-foundation/__tests__/tenant-providers.test.ts

@@ -134,3 +134,27 @@ describe("resolveAnonymousAccessFromRegistry — fail-closed trust", () => {
     ).rejects.toThrow(/resolverTrust/);
   });
 });
+
+describe("resolveAnonymousAccessFromRegistry — opt-in only (#1452)", () => {
+  test("a mounted tenantResolver provider alone does not make anonymousAccess defined", async () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("subdomain")]);
+    const result = await resolveAnonymousAccessFromRegistry(undefined, { db: fakeDb, registry });
+    expect(result).toBeUndefined();
+  });
+
+  test("a mounted tenantExists provider alone does not make anonymousAccess defined", async () => {
+    const registry = createRegistry([authFoundationFeature, existenceProvider("db")]);
+    const result = await resolveAnonymousAccessFromRegistry(undefined, { db: fakeDb, registry });
+    expect(result).toBeUndefined();
+  });
+
+  test("an app that explicitly opts in still gets providers merged", async () => {
+    const registry = createRegistry([authFoundationFeature, resolverProvider("subdomain")]);
+    const result = await resolveAnonymousAccessFromRegistry(
+      { defaultTenantId: undefined },
+      { db: fakeDb, registry },
+    );
+    expect(result?.tenantResolver).toBeDefined();
+    expect(result?.resolverTrust).toBe("authoritative");
+  });
+});

package/src/auth-foundation/__tests__/token-verifier.test.ts

@@ -8,7 +8,13 @@ import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { validateTokenVerifierMultiplicity } from "../boot-checks";
 import { authFoundationFeature, resolveTokenVerifier } from "../feature";
-import { type AuthProviderPlugin, EXT_TOKEN_VERIFIER } from "../types";
+import {
+  type AuthProviderPlugin,
+  EXT_SESSION_STORE,
+  EXT_TOKEN_VERIFIER,
+  type SessionStore,
+  type SessionStoreProvider,
+} from "../types";
 
 // Mock providers never read `deps.db` — a real provider (personal-access-
 // tokens/resolver.ts) does a point-read + live-role-resolution against it.
@@ -38,6 +44,23 @@ function jwtProvider(entityName = "jwt-mock"): ReturnType<typeof defineFeature>
   });
 }
 
+function mockStore(): SessionStore {
+  return {
+    creator: async () => "sid-1",
+    revoker: async () => undefined,
+    checker: async () => "live",
+    massRevoker: async () => 0,
+    revokeAllOthers: async () => 0,
+  };
+}
+
+function storeProvider(entityName = "mock-store"): ReturnType<typeof defineFeature> {
+  const plugin: SessionStoreProvider = { build: () => mockStore() };
+  return defineFeature(`mock-${entityName}`, (r) => {
+    r.useExtension(EXT_SESSION_STORE, entityName, plugin);
+  });
+}
+
 describe("resolveTokenVerifier — middleware finds the matching provider", () => {
   test("routes a prefixed token to the prefix-shape provider", async () => {
     const registry = createRegistry([authFoundationFeature, prefixProvider("pat-mock", "kpat_")]);
@@ -65,13 +88,23 @@ describe("resolveTokenVerifier — middleware finds the matching provider", () =
 });
 
 describe("validateTokenVerifierMultiplicity", () => {
-  test("0 providers registered → throws (fail-fast, no provider to route to)", () => {
+  test("0 tokenVerifier + 0 sessionStore → throws (neither auth path mounted)", () => {
     const registry = createRegistry([authFoundationFeature]);
     expect(() => validateTokenVerifierMultiplicity([...registry.features.values()])).toThrow(
-      /no tokenVerifier providers registered/,
+      /no tokenVerifier providers and no sessionStore registered/,
     );
   });
 
+  test("0 tokenVerifier + sessionStore → no throw (session-only / #1570)", () => {
+    const registry = createRegistry([authFoundationFeature, storeProvider()]);
+    expect(() => validateTokenVerifierMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
+  test("tokenVerifier alone (PAT-only) → no throw", () => {
+    const registry = createRegistry([authFoundationFeature, prefixProvider("pat-mock", "kpat_")]);
+    expect(() => validateTokenVerifierMultiplicity([...registry.features.values()])).not.toThrow();
+  });
+
   test("1 provider per shape → no throw", () => {
     const registry = createRegistry([
       authFoundationFeature,

package/src/auth-foundation/boot-checks.ts

@@ -1,14 +1,16 @@
 // Multiplicity boot-check for auth-foundation's `tokenVerifier` extension
-// point (#1368). Two static-shape conflicts a boot-check CAN catch (a
+// point (#1368, #1570). Two static-shape conflicts a boot-check CAN catch (a
 // runtime shape-match predicate's overlap can't be proven at boot): a
 // malformed plugin registration, and two providers both claiming the same
-// shape (resolveTokenVerifier can't tell them apart). Zero registered
-// providers is ALSO caught here — fail-fast at boot ("you mounted the
-// foundation but forgot a provider") rather than a runtime 401 nobody
-// can attribute, unlike file-foundation/mail-foundation which defer that
-// check to request-time (their provider is picked from tenant config,
-// which doesn't exist at boot; auth-foundation's providers are static
-// per-deployment, so boot is the right time to catch it).
+// shape (resolveTokenVerifier can't tell them apart). Zero tokenVerifier
+// providers is OK when ≥1 sessionStore is mounted (session-only cookie
+// apps never use Bearer routing). Zero of both is caught here — fail-fast
+// at boot ("you mounted the foundation but forgot sessions or a provider")
+// rather than a runtime 401 nobody can attribute, unlike
+// file-foundation/mail-foundation which defer that check to request-time
+// (their provider is picked from tenant config, which doesn't exist at
+// boot; auth-foundation's providers are static per-deployment, so boot is
+// the right time to catch it).
 
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -43,9 +45,18 @@ export function validateTokenVerifierMultiplicity(features: readonly FeatureDefi
   }
 
   if (namesByShape.size === 0) {
+    // Session-only apps (email-password + sessions) never hit tokenVerifier —
+    // cookie JWT auth uses sessionStore alone (#1570 / phronexsis#296).
+    for (const feature of features) {
+      for (const usage of feature.extensionUsages) {
+        // skip: sessionStore present — tokenVerifier optional for cookie-session apps.
+        if (usage.extensionName === EXT_SESSION_STORE) return;
+      }
+    }
     throw new Error(
-      "[auth-foundation] no tokenVerifier providers registered — mount at least one " +
-        "auth-provider-* feature (e.g. auth-provider-jwt) alongside auth-foundation.",
+      "[auth-foundation] no tokenVerifier providers and no sessionStore registered — mount " +
+        "at least one auth-provider-* feature (e.g. auth-provider-jwt / personal-access-tokens) " +
+        "or a sessionStore (e.g. sessions) alongside auth-foundation.",
     );
   }
 
@@ -60,86 +71,80 @@ export function validateTokenVerifierMultiplicity(features: readonly FeatureDefi
   }
 }
 
-// Multiplicity boot-check for the `sessionStore` extension point (#1370).
-// Single-provider, unlike tokenVerifier — no shape to route on, so exactly
-// one registration is required; 0 or ≥2 both fail boot.
-export function validateSessionStoreMultiplicity(features: readonly FeatureDefinition[]): void {
+// Shared by the three single-provider extension points below: collect every
+// registration for `ext`, validating each usage's options against `guard`,
+// then fail boot on ≥2 (resolve*() has no way to route between them). Zero
+// registrations is NOT checked here — it's valid for all three (a
+// machine-API-only auth-foundation with PAT-bearer auth and no browser
+// sessions, single-tenant deployments with no tenantResolver, etc.); the
+// runtime already models "extension point unmounted" as a legal
+// configuration (run-prod-app.ts only wires sessions when
+// EXT_SESSION_STORE has ≥1 usage), and resolve*() throws its own clear
+// error if a caller requests a provider that was never registered.
+function validateSingleProvider(
+  features: readonly FeatureDefinition[],
+  opts: {
+    readonly ext: string;
+    readonly label: string;
+    readonly guard: (options: unknown) => boolean;
+    readonly shapeHint: string;
+  },
+): void {
+  const { ext, label, guard, shapeHint } = opts;
   const names: string[] = [];
 
   for (const feature of features) {
     for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_SESSION_STORE) continue;
-      if (!isSessionStoreProvider(usage.options)) {
+      if (usage.extensionName !== ext) continue;
+      if (!guard(usage.options)) {
         throw new Error(
-          `[auth-foundation] sessionStore provider "${usage.entityName}" (feature "${feature.name}") ` +
-            `registered without a valid SessionStoreProvider — options must have a { build } shape.`,
+          `[auth-foundation] ${label} provider "${usage.entityName}" (feature "${feature.name}") ` +
+            `registered without a valid ${shapeHint}.`,
         );
       }
       names.push(usage.entityName);
     }
   }
 
-  if (names.length === 0) {
-    throw new Error(
-      "[auth-foundation] no sessionStore provider registered — mount a feature that " +
-        "registers one via r.useExtension(EXT_SESSION_STORE, ...) alongside auth-foundation.",
-    );
-  }
-
   if (names.length >= 2) {
     throw new Error(
-      `[auth-foundation] ${names.length} sessionStore providers registered (${names.join(", ")}) — ` +
-        `only one sessionStore provider may be mounted at a time.`,
+      `[auth-foundation] ${names.length} ${label} providers registered (${names.join(", ")}) — ` +
+        `only one ${label} provider may be mounted at a time.`,
     );
   }
 }
 
+// Multiplicity boot-check for the `sessionStore` extension point (#1370).
+// Single-provider, unlike tokenVerifier — no shape to route on, so ≥2 fails
+// boot. Zero registrations is a valid configuration (see
+// validateSingleProvider doc) — a pure machine API using auth-foundation for
+// PAT-bearer auth alone can mount it without also pulling in the whole
+// sessions feature.
+export function validateSessionStoreMultiplicity(features: readonly FeatureDefinition[]): void {
+  validateSingleProvider(features, {
+    ext: EXT_SESSION_STORE,
+    label: "sessionStore",
+    guard: isSessionStoreProvider,
+    shapeHint: "SessionStoreProvider — options must have a { build } shape",
+  });
+}
+
 // Optional single-provider (#1373). Zero registrations = OK (single-tenant /
 // header-cookie path). ≥2 or malformed = boot fail.
 export function validateTenantResolverMultiplicity(features: readonly FeatureDefinition[]): void {
-  const names: string[] = [];
-
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_TENANT_RESOLVER) continue;
-      if (!isTenantResolverProvider(usage.options)) {
-        throw new Error(
-          `[auth-foundation] tenantResolver provider "${usage.entityName}" (feature "${feature.name}") ` +
-            `registered without a valid TenantResolverProvider — options must have { trust, build }.`,
-        );
-      }
-      names.push(usage.entityName);
-    }
-  }
-
-  if (names.length >= 2) {
-    throw new Error(
-      `[auth-foundation] ${names.length} tenantResolver providers registered (${names.join(", ")}) — ` +
-        `only one tenantResolver provider may be mounted at a time.`,
-    );
-  }
+  validateSingleProvider(features, {
+    ext: EXT_TENANT_RESOLVER,
+    label: "tenantResolver",
+    guard: isTenantResolverProvider,
+    shapeHint: "TenantResolverProvider — options must have { trust, build }",
+  });
 }
 
 export function validateTenantExistenceMultiplicity(features: readonly FeatureDefinition[]): void {
-  const names: string[] = [];
-
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_TENANT_EXISTENCE) continue;
-      if (!isTenantExistenceProvider(usage.options)) {
-        throw new Error(
-          `[auth-foundation] tenantExistence provider "${usage.entityName}" (feature "${feature.name}") ` +
-            `registered without a valid TenantExistenceProvider — options must have a { build } shape.`,
-        );
-      }
-      names.push(usage.entityName);
-    }
-  }
-
-  if (names.length >= 2) {
-    throw new Error(
-      `[auth-foundation] ${names.length} tenantExistence providers registered (${names.join(", ")}) — ` +
-        `only one tenantExistence provider may be mounted at a time.`,
-    );
-  }
+  validateSingleProvider(features, {
+    ext: EXT_TENANT_EXISTENCE,
+    label: "tenantExistence",
+    guard: isTenantExistenceProvider,
+    shapeHint: "TenantExistenceProvider — options must have a { build } shape",
+  });
 }

package/src/auth-foundation/resolve-anonymous-access.ts

@@ -6,8 +6,6 @@
 import type {
   AnonymousAccessConfig,
   AnonymousAccessResolved,
-  TenantExists,
-  TenantResolver,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { resolveTenantExistence, resolveTenantResolver } from "./feature";
@@ -22,7 +20,12 @@ export async function resolveAnonymousAccessFromRegistry(
     resolveTenantExistence(deps),
   ]);
 
-  if (!base && !tenantResolver && !tenantExists) return undefined;
+  // Anonymous access is app opt-in only: a mounted routing provider
+  // (EXT_TENANT_RESOLVER/EXT_TENANT_EXISTENCE) alone must never make
+  // anonymousAccess become defined for an app that never set it — that
+  // would upgrade every roles:["anonymous"] handler to reachable without
+  // a JWT the moment such a routing feature is mounted (#1452).
+  if (!base) return undefined;
 
   // Fail-closed (#1374 security): inline tenantResolver without trust is the
   // old ambiguous config — providers always carry trust; test stacks must too.
@@ -45,10 +48,15 @@ export async function resolveAnonymousAccessFromRegistry(
     ...(base ?? {}),
     ...(tenantResolver
       ? {
-          tenantResolver: tenantResolver.resolve as TenantResolver,
+          // No cast: TenantResolverFn's `(c: unknown) => string | null`
+          // and the framework's TenantResolver `(c: Context) => TenantId
+          // | null` are structurally identical (TenantId is a plain
+          // string alias, no brand) — `unknown` is a supertype of
+          // Context, so this is already sound by parameter contravariance.
+          tenantResolver: tenantResolver.resolve,
           resolverTrust: tenantResolver.trust,
         }
       : {}),
-    ...(tenantExists ? { tenantExists: tenantExists as TenantExists } : {}),
+    ...(tenantExists ? { tenantExists } : {}),
   };
 }

package/src/auth-foundation/types.ts

@@ -14,11 +14,14 @@
 import type {
   SessionChecker,
   SessionCreator,
+  SessionMassRevoker,
   SessionRevoker,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 
+export type { SessionMassRevoker };
+
 export const EXT_TOKEN_VERIFIER = "tokenVerifier";
 
 /**
@@ -83,9 +86,6 @@ export function tokenShapeKey(shape: TokenShape): string {
 
 export const EXT_SESSION_STORE = "sessionStore";
 
-/** Mass-revoke every live session for a user. Used by password-change and "sign out everywhere". */
-export type SessionMassRevoker = (userId: string) => Promise<number>;
-
 /** Keep current sid (if any); revoke every other live session. Used by auth-mfa. */
 export type SessionRevokeAllOthers = (
   userId: string,

package/src/auth-mfa/__tests__/enable-confirm-preauth.integration.test.ts

@@ -37,11 +37,16 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { base32Decode } from "../base32";
 import { mfaRequiredConfigHandle } from "../config";
 import { AuthMfaHandlers } from "../constants";
-import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
+import {
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  createAuthMfaFeature,
+  mfaStatusCheckerFromFeature,
+} from "../feature";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
 
 let stack: TestStack;
+const revokedForUserIds: string[] = [];
 
 const CHALLENGE_TOKEN_SECRET = "integration-test-challenge-token-secret-not-real-0001";
 const SETUP_TOKEN_SECRET = "integration-test-setup-token-secret-not-real-0002";
@@ -84,6 +89,20 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, userMfaEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Wire a spy in place of the real session-revoke callback (run-prod-app
+  // only binds this once the sessions feature is mounted — not the case in
+  // this test stack) so #1467's regression can observe whether
+  // revokeAllOtherSessions actually fires, instead of silently no-op'ing.
+  const bind = bindMfaRevokeAllOtherSessionsFromFeature(authMfaFeature);
+  // If the binder ever returns undefined, the spy below never wires up and
+  // the #1467 regression check further down would pass vacuously (nothing
+  // to revoke because nothing observed) instead of catching a real re-break.
+  expect(bind).toBeDefined();
+  bind?.((userId) => {
+    revokedForUserIds.push(userId);
+    return Promise.resolve(0);
+  });
 });
 
 afterAll(async () => {
@@ -93,6 +112,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  revokedForUserIds.length = 0;
 });
 
 async function loginBlockedByEnforcement(
@@ -159,6 +179,10 @@ describe("POST /auth/mfa/preauth-confirm", () => {
       { Authorization: `Bearer ${body.token}` },
     );
     expect(meRes.status).toBe(200);
+
+    // Positive control for the #1467 regression below — proves the spy
+    // wiring actually observes a real revoke call, not just silent no-ops.
+    expect(revokedForUserIds).toContain(body.user.id);
   });
 
   test("wrong TOTP code → invalid_totp_code, no enrollment persisted", async () => {
@@ -247,6 +271,42 @@ describe("POST /auth/mfa/preauth-confirm", () => {
     expect(body.error.details.reason).toBe("invalid_setup_token");
   });
 
+  // #1467: findForAuth's status check + membership lookup used to run AFTER
+  // the entity-write and the revokeAllOtherSessions call — an admin
+  // restricting/deleting the account between preauth-enable-start and
+  // preauth-confirm still got invalid_setup_token back correctly (the
+  // handler's whole DB transaction rolls back on a non-success return, so
+  // the MFA row itself never actually persisted), but revokeAllOtherSessions
+  // is an external side effect outside that transaction — it fired
+  // regardless, logging the user's other devices out over an enrollment
+  // attempt that was rejected. Regression: with status/membership checked
+  // BEFORE the write, the revoke call must not fire at all for this case.
+  test("user restricted between start and confirm → invalid_setup_token, no session revoked (#1467)", async () => {
+    const email = "restricted-midflight@example.com";
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
+    const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
+
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET "status" = 'restricted' WHERE "id" = $1`,
+      [userId],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code: currentTotpCode(secret),
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.error.details.reason).toBe("invalid_setup_token");
+    expect(revokedForUserIds).not.toContain(userId);
+    // Enrollment write itself rolls back with the handler's failure return —
+    // pinned here too so a future change to that transactional behavior
+    // doesn't silently reintroduce the original "row persists" half of the bug.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(0);
+  });
+
   test("expired/garbage setupToken → invalid_setup_token, no session minted", async () => {
     const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
       setupToken: "not-a-real-token",