@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -362,6 +362,25 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
     expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
   });
+
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    // A 400 for a completely different reason (bad token format, email
+    // shape) would also pass a bare status assertion — pin the field-level
+    // reason so the test actually proves the breach-list rejection fired.
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
 });
 
 describe("invite-signup-complete (Branch 3: anon + new email)", () => {
@@ -397,6 +416,21 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
     expect(loginRes.status).toBe(200);
   });
 
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
+
   test("Existing email → invalid_invite_token (User soll Branch 2 nutzen)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");
 

package/src/auth-email-password/__tests__/self-registration-toggle.integration.test.ts

@@ -239,31 +239,26 @@ describe("auth-self-registration toggle — companion feature NOT composed", ()
     await bareStack.cleanup();
   });
 
-  // KNOWN GAP (found while writing this regression pin, not yet decided):
-  // ctx.hasFeature() checks the effective-feature SET, which only ever
-  // contains registered feature names (computeEffectiveFeatures iterates
-  // registry.features). A name nothing ever registered is never a member,
-  // so hasFeature("auth-self-registration") is false here — signup-request
-  // silently no-ops (200, anti-enumeration success shape, but no mail) the
-  // moment an app wires a real effectiveFeatures resolver without also
-  // composing createAuthSelfRegistrationToggleFeature. This pins the
-  // CURRENT (broken) behavior rather than asserting the desired one —
-  // flagged for a follow-up decision, not silently fixed here.
-  test("[KNOWN GAP] signup-request silently drops mail when the companion toggle feature was never composed", async () => {
+  // Fixed (#1468): ctx.hasFeature() is fail-closed for a name nothing ever
+  // registered — signup-request and the status query now only gate on the
+  // toggle when registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) proves
+  // the companion feature is actually composed, so an app that mounts
+  // auth-email-password without it keeps self-signup working.
+  test("signup-request still sends mail when the companion toggle feature was never composed", async () => {
     const res = await bareStack.http.raw("POST", "/api/auth/signup-request", {
       email: "not-toggle-aware@example.com",
     });
     expect(res.status).toBe(200);
-    expect(bareEmailTransport.sent).toHaveLength(0);
+    expect(bareEmailTransport.sent).toHaveLength(1);
   });
 
-  test("[KNOWN GAP] signup-registration-status reports enabled:false with no toggle feature mounted", async () => {
+  test("signup-registration-status reports enabled:true with no toggle feature mounted", async () => {
     const res = await bareStack.http.raw("POST", "/api/query", {
       type: "auth-email-password:query:signup-registration-status",
       payload: {},
     });
     expect((await res.json()) as { data?: { enabled: boolean } }).toMatchObject({
-      data: { enabled: false },
+      data: { enabled: true },
     });
   });
 });

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -120,6 +120,22 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Prime request-helper's per-user sid cache for systemAdmin (the seed
+  // actor every test's seedUser() call authenticates as) here, once,
+  // before any test's observation window opens — otherwise whichever
+  // test happens to call seedUser() first would observe an extra
+  // store.created entry for seed plumbing, not the auth-route behavior
+  // under test (#1452: authHeader() now mints one sid per user.id, not
+  // one per call, so this only ever fires here).
+  await seedUser({
+    email: "warmup-seed-actor@example.com",
+    password: "warmup-password-not-asserted-on",
+    tenants: [],
+  });
+  store.live.clear();
+  store.created.length = 0;
+  store.revoked.length = 0;
 });
 
 afterAll(async () => {
@@ -158,11 +174,6 @@ async function seedUser(opts: {
       roles: t.roles,
     });
   }
-  // request-helper mints a sid for systemAdmin when sessionCreator is wired
-  // (#1372) — that is seed plumbing, not the auth-route behavior under test.
-  store.live.clear();
-  store.created.length = 0;
-  store.revoked.length = 0;
   return { userId: created.id };
 }
 

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -27,6 +27,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -57,6 +58,41 @@ import { createAuthEmailPasswordFeature } from "../feature";
 
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 
+// Regression-proof for #1478: provisionSignupAccount only threaded `hooks`
+// into seedTenant, leaving seedUserWithPassword's `user`-entity and
+// seedTenantMembership's `tenantMembership`-entity postSave hooks unfired
+// on self-signup — same bug class as #1463, just for the other two
+// entities in the same call. This vendor feature's hook is the user-side
+// analog of tier-engine's tenant hook above.
+const userPostSaveFired = { count: 0 };
+const userHookVendorFeature = defineFeature("user-hook-vendor-test", (r) => {
+  r.requires("user");
+  r.hook("postSave", { allOf: "user" }, async (ctx) => {
+    if (ctx.isNew) userPostSaveFired.count++;
+  });
+});
+
+// Regression-proof for #1478/#1526: seedTenantMembership must fire the
+// `tenantMembership` entity's postSave hooks (e.g. a Welcome-notification
+// hook) on self-signup too — pins the `fireEntityPostSave` call added at
+// seeding.ts's seedTenantMembership, not just the `user`/`tenant` ones.
+// #1566: also record ctx._tenantId so a shallow-only rescope regresses.
+const tenantMembershipPostSaveFired = { count: 0, seenTenantIds: [] as string[] };
+const tenantMembershipHookVendorFeature = defineFeature(
+  "tenant-membership-hook-vendor-test",
+  (r) => {
+    r.requires("tenant");
+    r.hook("postSave", { allOf: "tenant-membership" }, async (result, context) => {
+      if (result.isNew) {
+        tenantMembershipPostSaveFired.count++;
+        if (context._tenantId !== undefined) {
+          tenantMembershipPostSaveFired.seenTenantIds.push(String(context._tenantId));
+        }
+      }
+    });
+  },
+);
+
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
 
 // Activation mails now go through delivery (ctx.notify → channel-email). The
@@ -92,6 +128,8 @@ beforeAll(async () => {
         defaultTier: "free",
         tierMap: { free: { features: [], caps: {} } },
       }),
+      userHookVendorFeature,
+      tenantMembershipHookVendorFeature,
     ],
     extraContext: (deps) => ({
       ...createDeliveryTestContext(deps),
@@ -130,6 +168,9 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tierAssignmentTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
+  userPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.seenTenantIds = [];
   // Redis-cleanup damit Resend-Tests keine state-leaks haben.
   const allKeys = await stack.redis.redis.keys("signup:*");
   if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
@@ -245,6 +286,19 @@ describe("POST /api/auth/signup-confirm", () => {
     expect(tierRows).toHaveLength(1);
     expect(tierRows[0]?.["tier"]).toBe("free");
 
+    // #1478 regression: seedUserWithPassword (called from
+    // provisionSignupAccount) fires the `user` entity's postSave hooks too —
+    // before this fix, only seedTenant's hooks param was wired through.
+    expect(userPostSaveFired.count).toBe(1);
+
+    // #1478/#1526 regression: seedTenantMembership (called from
+    // provisionSignupAccount) fires the `tenant-membership` entity's postSave
+    // hooks too — before this fix, only seedTenant's hooks param was wired.
+    expect(tenantMembershipPostSaveFired.count).toBe(1);
+    // #1566: rescope must put the new tenant on the hook context, not the
+    // anonymous/system caller's tenantId.
+    expect(tenantMembershipPostSaveFired.seenTenantIds).toEqual([body.user?.tenantId ?? ""]);
+
     // Authority-Beweis: Login mit dem gesetzten Password funktioniert.
     const loginRes = await postLogin(email, password);
     expect(loginRes.status).toBe(200);

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -46,11 +46,12 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
+import { passwordSchema } from "../password-policy";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),
   email: z.email(),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteAcceptWithLoginData = {

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -50,12 +50,13 @@ import {
   getInvitationIdForToken,
   unburnInviteToken,
 } from "../invite-token-store";
+import { passwordSchema } from "../password-policy";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
 import { seedUserWithPassword } from "../seeding";
 
 const InviteSignupCompleteSchema = z.object({
   token: z.string().min(1),
-  password: z.string().min(8).max(200),
+  password: passwordSchema,
 });
 
 export type InviteSignupCompleteData = {

package/src/auth-email-password/handlers/login.write.ts

@@ -113,6 +113,14 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       // for a timing-oracle on the bcrypt verify). If Redis isn't wired,
       // lockout is silently skipped — login still works, brute-force
       // protection just degrades to the IP-rate-limiter at the edge.
+      //
+      // Deliberately fail-open here, unlike auth-mfa's enable-confirm-preauth
+      // (which fails closed without Redis): the secret guarded by THIS gate
+      // is a full password, not a 6-digit code — locking out every login
+      // app-wide because Redis is briefly unavailable is a self-inflicted
+      // outage across every tenant, for a backstop that the IP-rate-limiter
+      // still partially covers. auth-mfa's blast radius is one user's MFA
+      // enrollment, not global login availability — different tradeoff.
       if (ctx.redis) {
         const state = await getLockoutState(ctx.redis, found.id);
         if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -14,7 +14,10 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
   name: "signup-registration-status",
   schema: z.object({}),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-  handler: async (_query, ctx) => ({
-    enabled: await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE),
-  }),
+  handler: async (_query, ctx) => {
+    // Same fail-open reasoning as signup-request.write.ts (#1468): only
+    // report disabled when the toggle feature is actually composed.
+    const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
+    return { enabled: gated ? await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE) : true };
+  },
 });

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -76,7 +76,18 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
       // email" either way. The client-visible signal is the `status` query
       // on auth-self-registration, which the signup page uses to hide its
       // own link/form instead of collecting input that silently no-ops.
-      if (!(await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))) {
+      // Fail-open when the companion toggle feature isn't composed at all —
+      // ctx.hasFeature() is fail-closed for *unregistered* names the moment
+      // feature-toggles/tier-engine is wired, which silently kills
+      // self-signup for every existing app that mounts auth-email-password
+      // without also composing createAuthSelfRegistrationToggleFeature()
+      // (#1468). Only gate when the toggle actually exists.
+      const gated = ctx.registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) !== undefined;
+      if (gated && !(await ctx.hasFeature(AUTH_SELF_REGISTRATION_FEATURE))) {
+        // No email address here — this fires on every no-op request, PII
+        // must not accumulate in logs just for the "was this toggled off"
+        // signal a support ticket needs.
+        ctx.log?.info("signup-request skipped: self-registration disabled");
         return { isSuccess: true, data: { kind: "no-op" } };
       }
       if (!ctx.redis) {

package/src/auth-email-password/i18n.ts

@@ -89,6 +89,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.requestUnlock.successBody":
       "Falls die E-Mail in unserem System existiert und gesperrt ist, ist eine Nachricht mit einem Entsperren-Link unterwegs. Bitte schau in deinen Posteingang.",
     "auth.requestUnlock.backToLogin": "Zurück zum Login",
+    "auth.requestUnlock.rateLimited": "Zu viele Anfragen. Neuer Versuch in {minutes} Minuten.",
     "auth.unlockAccount.verifying": "Konto wird entsperrt …",
     "auth.unlockAccount.successTitle": "Konto entsperrt",
     "auth.unlockAccount.successBody":
@@ -215,6 +216,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.requestUnlock.successBody":
       "If that email exists in our system and is locked, a message with an unlock link is on its way. Please check your inbox.",
     "auth.requestUnlock.backToLogin": "Back to sign in",
+    "auth.requestUnlock.rateLimited": "Too many requests. Try again in {minutes} minutes.",
     "auth.unlockAccount.verifying": "Unlocking account …",
     "auth.unlockAccount.successTitle": "Account unlocked",
     "auth.unlockAccount.successBody": "Your account is unlocked again. You can sign in now.",

package/src/auth-email-password/seeding.ts

@@ -55,17 +55,25 @@ export type SeedUserWithPasswordOptions = {
 export async function seedUserWithPassword(
   db: DbConnection,
   options: SeedUserWithPasswordOptions,
+  // Optional, append-only — same rationale as provisionSignupAccount's
+  // hooks param (#1478): the self-signup path passes it through so `user`'s
+  // postSave hooks fire on self-signup same as on the regular create path.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   const passwordHash = await hashPassword(options.password);
-  return seedUser(db, {
-    email: options.email,
-    displayName: options.displayName,
-    passwordHash,
-    ...(options.locale !== undefined && { locale: options.locale }),
-    ...(options.roles !== undefined && { roles: options.roles }),
-    ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
-    ...(options.by !== undefined && { by: options.by }),
-  });
+  return seedUser(
+    db,
+    {
+      email: options.email,
+      displayName: options.displayName,
+      passwordHash,
+      ...(options.locale !== undefined && { locale: options.locale }),
+      ...(options.roles !== undefined && { roles: options.roles }),
+      ...(options.emailVerified !== undefined && { emailVerified: options.emailVerified }),
+      ...(options.by !== undefined && { by: options.by }),
+    },
+    hooks,
+  );
 }
 
 /** Provisioning-Helper für Self-Signup-Confirm. Legt einen frischen
@@ -117,9 +125,11 @@ export async function provisionSignupAccount(
   options: ProvisionSignupAccountOptions,
   // Optional, append-only — existing callers (tests, seed scripts) that
   // don't pass hooks keep today's behavior. The real signup-confirm
-  // handler DOES pass it (#1463) so seedTenant's postSave hooks
-  // (tier-engine's auto-default-tier, app auto-default-compliance) fire
-  // on self-signup, same as they do on the regular tenant-create path.
+  // handler DOES pass it (#1463) so seedTenant/seedUserWithPassword/
+  // seedTenantMembership's postSave hooks (tier-engine's auto-default-tier,
+  // app auto-default-compliance, a Welcome-notification hook, ...) fire on
+  // self-signup for all three entities, same as they do on the regular
+  // create paths (#1478 — this was only wired for tenant before).
   hooks?: SeedTenantHooks,
 ): Promise<{ readonly userId: string; readonly tenantId: TenantId }> {
   // Create-only-Guard VOR seedTenant: bei bereits registrierter Email hart
@@ -139,17 +149,25 @@ export async function provisionSignupAccount(
     },
     hooks,
   );
-  const { id: userId } = await seedUserWithPassword(db, {
-    email: options.email,
-    password: options.password,
-    displayName: options.displayName,
-    emailVerified: true,
-  });
-  await seedTenantMembership(db, {
-    userId,
-    tenantId: options.tenantId,
-    roles: options.memberRoles ?? INITIAL_SIGNUP_ROLES,
-  });
+  const { id: userId } = await seedUserWithPassword(
+    db,
+    {
+      email: options.email,
+      password: options.password,
+      displayName: options.displayName,
+      emailVerified: true,
+    },
+    hooks,
+  );
+  await seedTenantMembership(
+    db,
+    {
+      userId,
+      tenantId: options.tenantId,
+      roles: options.memberRoles ?? INITIAL_SIGNUP_ROLES,
+    },
+    hooks,
+  );
   return { userId, tenantId: options.tenantId };
 }
 

package/src/auth-email-password/web/__tests__/auth-client.test.ts

@@ -33,6 +33,8 @@ function withoutCsrfDocument(): void {
   delete (globalThis as { document?: { cookie: string } }).document;
 }
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
@@ -41,6 +43,7 @@ beforeEach(() => {
 
 afterEach(() => {
   withoutCsrfDocument();
+  globalThis.fetch = originalFetch;
 });
 
 describe("csrfHeader", () => {
@@ -107,6 +110,16 @@ describe("login", () => {
     expect(res).toEqual({ kind: "mfa-setup-required", preauthSetupToken: "setup-token-value" });
   });
 
+  test("mfaSetupRequired without preauthSetupToken → explicit mfa_setup_required failure", async () => {
+    globalThis.fetch = mock(async () =>
+      jsonResponse({ isSuccess: true, mfaSetupRequired: true }),
+    ) as unknown as typeof fetch;
+
+    const res = await login({ email: "a@b.c", password: "secret" });
+
+    expect(res).toEqual({ kind: "failure", error: { reason: "mfa_setup_required" } });
+  });
+
   test("string error → kind:failure with reason from string", async () => {
     globalThis.fetch = mock(async () =>
       jsonResponse({ isSuccess: false, error: "invalid_credentials" }),

package/src/auth-email-password/web/__tests__/auth-gate.test.tsx

@@ -1,5 +1,5 @@
 import { describe, expect, mock, test } from "bun:test";
-import { fireEvent, screen } from "@testing-library/react";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { createLoginRoute, makeAuthGate } from "../auth-gate";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
@@ -10,7 +10,7 @@ describe("makeAuthGate", () => {
   }
 
   test("loading → renders placeholder, not children, not login", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     const session = makeSessionApi({ status: "loading", user: null });
     const { container } = renderWithProviders(
       <Gate>
@@ -25,7 +25,7 @@ describe("makeAuthGate", () => {
   });
 
   test("unauthenticated → renders LoginComponent, not children", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     const session = makeSessionApi({ status: "unauthenticated", user: null });
     renderWithProviders(
       <Gate>
@@ -38,7 +38,7 @@ describe("makeAuthGate", () => {
   });
 
   test("authenticated → renders children, not login", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     renderWithProviders(
       <Gate>
         <div data-testid="protected">secret</div>
@@ -134,8 +134,30 @@ describe("createLoginRoute", () => {
     expect(screen.getByTestId("mfa-verify").textContent).toBe("token-123");
   });
 
+  test("no mfaVerifyScreen → onMfaChallenge passes through to loginScreenProps.onMfaChallenge (#266 footgun)", () => {
+    // The silent-no-MFA-fallback path: an app that wires its own
+    // onMfaChallenge via loginScreenProps but forgets mfaVerifyScreen still
+    // gets that callback invoked (createLoginRoute can't detect the
+    // omission) instead of the internal setChallengeToken/MfaVerifyComponent
+    // machinery kicking in. Covered here so a future refactor of that
+    // ternary can't silently swap the fallback direction.
+    const onMfaChallenge = mock<(challengeToken: string) => void>();
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaTrigger,
+      loginScreenProps: { onMfaChallenge },
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa"));
+    expect(onMfaChallenge).toHaveBeenCalledWith("token-123");
+    expect(screen.queryByTestId("mfa-verify")).toBeNull();
+  });
+
   test("makeAuthGate delegates mfaVerifyScreen wiring to createLoginRoute", () => {
-    const Gate = makeAuthGate(LoginWithMfaTrigger, undefined, CustomMfaVerify);
+    const Gate = makeAuthGate({
+      loginScreen: LoginWithMfaTrigger,
+      mfaVerifyScreen: CustomMfaVerify,
+    });
     const session = makeSessionApi({ status: "unauthenticated" });
     renderWithProviders(
       <Gate>
@@ -160,7 +182,7 @@ describe("createLoginRoute", () => {
     );
   });
 
-  test("MfaSetupComponent onSuccess → gate clears the request and refreshes the session", () => {
+  test("MfaSetupComponent onSuccess → gate clears the request and refreshes the session", async () => {
     const LoginRoute = createLoginRoute({
       loginScreen: LoginWithMfaSetupTrigger,
       mfaSetupScreen: CustomMfaSetup,
@@ -171,11 +193,36 @@ describe("createLoginRoute", () => {
     expect(screen.getByTestId("mfa-setup")).toBeTruthy();
     fireEvent.click(screen.getByTestId("complete-mfa-setup"));
     expect(session.refresh).toHaveBeenCalledTimes(1);
-    expect(screen.queryByTestId("mfa-setup")).toBeNull();
+    await waitFor(() => {
+      expect(screen.queryByTestId("mfa-setup")).toBeNull();
+    });
+  });
+
+  test("MfaSetupComponent onSuccess → keeps setup screen when refresh rejects", async () => {
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      refresh: mock(async () => {
+        throw new Error("refresh failed");
+      }),
+    });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa-setup"));
+    fireEvent.click(screen.getByTestId("complete-mfa-setup"));
+    expect(session.refresh).toHaveBeenCalledTimes(1);
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(screen.getByTestId("mfa-setup")).toBeTruthy();
   });
 
   test("makeAuthGate delegates mfaSetupScreen wiring to createLoginRoute", () => {
-    const Gate = makeAuthGate(LoginWithMfaSetupTrigger, undefined, undefined, CustomMfaSetup);
+    const Gate = makeAuthGate({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
     const session = makeSessionApi({ status: "unauthenticated" });
     renderWithProviders(
       <Gate>

package/src/auth-email-password/web/__tests__/client-plugin.test.tsx

@@ -0,0 +1,34 @@
+import { describe, expect, mock, test } from "bun:test";
+
+// #1472: emailPasswordClient() built the session gate without threading
+// options.mfaSetupScreen through to makeSessionAuthGate — the option was
+// typed and documented but silently dropped on the standard mount path.
+// makeSessionAuthGate wraps its own real SessionProvider (unlike
+// makeAuthGate, which auth-gate.test.tsx exercises directly), so the
+// cheapest live check is spying on the call args instead of rendering
+// through a real session fetch.
+const makeSessionAuthGateCalls: unknown[][] = [];
+mock.module("../auth-gate", () => ({
+  makeSessionAuthGate: (...args: unknown[]) => {
+    makeSessionAuthGateCalls.push(args);
+    return () => null;
+  },
+}));
+
+const { emailPasswordClient } = await import("../client-plugin");
+
+describe("emailPasswordClient — mfaSetupScreen wiring", () => {
+  test("passes options.mfaSetupScreen through to makeSessionAuthGate", () => {
+    makeSessionAuthGateCalls.length = 0;
+    function CustomMfaSetup() {
+      return null;
+    }
+
+    emailPasswordClient({ mfaSetupScreen: CustomMfaSetup });
+
+    expect(makeSessionAuthGateCalls).toHaveLength(1);
+    expect((makeSessionAuthGateCalls[0]?.[0] as { mfaSetupScreen?: unknown })?.mfaSetupScreen).toBe(
+      CustomMfaSetup,
+    );
+  });
+});

package/src/auth-email-password/web/__tests__/confirm-account-unlock-screen.test.tsx

@@ -3,12 +3,16 @@ import { screen, waitFor } from "@testing-library/react";
 import { ConfirmAccountUnlockScreen } from "../confirm-account-unlock-screen";
 import { renderWithProviders } from "./test-utils";
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
   ) as unknown as typeof fetch;
 });
-afterEach(() => {});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
 
 describe("ConfirmAccountUnlockScreen", () => {
   test("ohne Token → missing-token page", () => {
@@ -28,6 +32,8 @@ describe("ConfirmAccountUnlockScreen", () => {
         "/api/auth/confirm-account-unlock",
         expect.objectContaining({
           method: "POST",
+          headers: expect.objectContaining({ "Content-Type": "application/json" }),
+          credentials: "same-origin",
           body: JSON.stringify({ token: "unlock-tok" }),
         }),
       );
@@ -53,5 +59,6 @@ describe("ConfirmAccountUnlockScreen", () => {
   test("custom title on missing-token uses errorTitle slot only when set", () => {
     renderWithProviders(<ConfirmAccountUnlockScreen title="Unlock kaputt" />);
     expect(screen.getByText("Unlock kaputt")).toBeTruthy();
+    expect(screen.queryByText("Entsperren fehlgeschlagen")).toBeNull();
   });
 });

package/src/auth-email-password/web/__tests__/forgot-password-screen.test.tsx

@@ -3,12 +3,16 @@ import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { ForgotPasswordScreen } from "../forgot-password-screen";
 import { renderWithProviders } from "./test-utils";
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
   ) as unknown as typeof fetch;
 });
-afterEach(() => {});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
 
 describe("ForgotPasswordScreen", () => {
   test("rendert title + email-input + submit-button (de)", () => {

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -27,6 +27,8 @@ function renderWithoutSessionProvider(token: string) {
   );
 }
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(JSON.stringify({ tenantId: "tenant-new" }), { status: 200 }),
@@ -43,6 +45,7 @@ afterEach(() => {
     writable: true,
     value: originalLocation,
   });
+  globalThis.fetch = originalFetch;
 });
 
 describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {