@cosmicdrift/kumiko-bundled-features 0.165.0 → 2.0.0

package/src/auth-foundation/types.ts

@@ -14,11 +14,14 @@
 import type {
   SessionChecker,
   SessionCreator,
+  SessionMassRevoker,
   SessionRevoker,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 
+export type { SessionMassRevoker };
+
 export const EXT_TOKEN_VERIFIER = "tokenVerifier";
 
 /**
@@ -83,9 +86,6 @@ export function tokenShapeKey(shape: TokenShape): string {
 
 export const EXT_SESSION_STORE = "sessionStore";
 
-/** Mass-revoke every live session for a user. Used by password-change and "sign out everywhere". */
-export type SessionMassRevoker = (userId: string) => Promise<number>;
-
 /** Keep current sid (if any); revoke every other live session. Used by auth-mfa. */
 export type SessionRevokeAllOthers = (
   userId: string,

package/src/auth-mfa/__tests__/enable-confirm-preauth.integration.test.ts

@@ -37,11 +37,16 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { base32Decode } from "../base32";
 import { mfaRequiredConfigHandle } from "../config";
 import { AuthMfaHandlers } from "../constants";
-import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
+import {
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  createAuthMfaFeature,
+  mfaStatusCheckerFromFeature,
+} from "../feature";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
 
 let stack: TestStack;
+const revokedForUserIds: string[] = [];
 
 const CHALLENGE_TOKEN_SECRET = "integration-test-challenge-token-secret-not-real-0001";
 const SETUP_TOKEN_SECRET = "integration-test-setup-token-secret-not-real-0002";
@@ -84,6 +89,20 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, userMfaEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Wire a spy in place of the real session-revoke callback (run-prod-app
+  // only binds this once the sessions feature is mounted — not the case in
+  // this test stack) so #1467's regression can observe whether
+  // revokeAllOtherSessions actually fires, instead of silently no-op'ing.
+  const bind = bindMfaRevokeAllOtherSessionsFromFeature(authMfaFeature);
+  // If the binder ever returns undefined, the spy below never wires up and
+  // the #1467 regression check further down would pass vacuously (nothing
+  // to revoke because nothing observed) instead of catching a real re-break.
+  expect(bind).toBeDefined();
+  bind?.((userId) => {
+    revokedForUserIds.push(userId);
+    return Promise.resolve(0);
+  });
 });
 
 afterAll(async () => {
@@ -93,6 +112,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  revokedForUserIds.length = 0;
 });
 
 async function loginBlockedByEnforcement(
@@ -159,6 +179,10 @@ describe("POST /auth/mfa/preauth-confirm", () => {
       { Authorization: `Bearer ${body.token}` },
     );
     expect(meRes.status).toBe(200);
+
+    // Positive control for the #1467 regression below — proves the spy
+    // wiring actually observes a real revoke call, not just silent no-ops.
+    expect(revokedForUserIds).toContain(body.user.id);
   });
 
   test("wrong TOTP code → invalid_totp_code, no enrollment persisted", async () => {
@@ -247,6 +271,42 @@ describe("POST /auth/mfa/preauth-confirm", () => {
     expect(body.error.details.reason).toBe("invalid_setup_token");
   });
 
+  // #1467: findForAuth's status check + membership lookup used to run AFTER
+  // the entity-write and the revokeAllOtherSessions call — an admin
+  // restricting/deleting the account between preauth-enable-start and
+  // preauth-confirm still got invalid_setup_token back correctly (the
+  // handler's whole DB transaction rolls back on a non-success return, so
+  // the MFA row itself never actually persisted), but revokeAllOtherSessions
+  // is an external side effect outside that transaction — it fired
+  // regardless, logging the user's other devices out over an enrollment
+  // attempt that was rejected. Regression: with status/membership checked
+  // BEFORE the write, the revoke call must not fire at all for this case.
+  test("user restricted between start and confirm → invalid_setup_token, no session revoked (#1467)", async () => {
+    const email = "restricted-midflight@example.com";
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
+    const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
+
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET "status" = 'restricted' WHERE "id" = $1`,
+      [userId],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code: currentTotpCode(secret),
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.error.details.reason).toBe("invalid_setup_token");
+    expect(revokedForUserIds).not.toContain(userId);
+    // Enrollment write itself rolls back with the handler's failure return —
+    // pinned here too so a future change to that transactional behavior
+    // doesn't silently reintroduce the original "row persists" half of the bug.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(0);
+  });
+
   test("expired/garbage setupToken → invalid_setup_token, no session minted", async () => {
     const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
       setupToken: "not-a-real-token",

package/src/auth-mfa/__tests__/no-redis.integration.test.ts

@@ -0,0 +1,209 @@
+// #1467: verify / enable-confirm / enable-confirm-preauth used to silently
+// skip their brute-force cap and single-use burn when ctx.redis was
+// unavailable, instead of failing closed. Real HTTP through setupTestStack
+// with redis explicitly unwired (same pattern as
+// auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts),
+// asserting each handler now returns an internal_error instead of silently
+// degrading and continuing to the TOTP check.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import {
+  configureEntityFieldEncryption,
+  createEventStoreExecutor,
+  createTenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { base32Encode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { signMfaChallengeToken } from "../mfa-challenge-token";
+import { signMfaSetupToken } from "../mfa-setup-token";
+import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa";
+import { generateTotpSecret } from "../totp";
+
+let stack: TestStack;
+
+const CHALLENGE_TOKEN_SECRET = "no-redis-test-challenge-token-secret-not-real-0001";
+const SETUP_TOKEN_SECRET = "no-redis-test-setup-token-secret-not-real-0002";
+const TENANT_ID: TenantId = testTenantId(421);
+
+// Mirrors framework's auth-routes.ts GUEST_USER — verify/enable-confirm-preauth
+// are guest-callable (access: { roles: ["all"] }), the real identity comes
+// entirely from the signed token, not from this dispatch-level user.
+const GUEST_USER: SessionUser = {
+  id: "00000000-0000-0000-0000-000000000000",
+  tenantId: SYSTEM_TENANT_ID,
+  roles: ["all"],
+};
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      }),
+    ],
+    // extraContext runs after the default `redis: testRedis.redis` spread —
+    // setting redis:undefined here overrides it on the handler-facing
+    // AppContext (see account-lockout-no-redis.integration.test.ts).
+    extraContext: () => ({
+      configResolver: resolver,
+      configEncryption: encryption,
+      redis: undefined,
+    }),
+  });
+
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// disable/regenerate-recovery are session-authed and only reachable once
+// MFA is already enabled — but enable-confirm itself now requires
+// ctx.redis (#1467), so it can't run against this no-redis stack to seed
+// the row. Insert the row directly via the same executor.create the
+// handler uses, bypassing the HTTP layer entirely (irrelevant to what
+// this test is pinning: the handler's own ctx.redis gate).
+const userMfaExecutor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
+  entityName: "user-mfa",
+});
+
+async function seedEnabledMfa(user: SessionUser): Promise<void> {
+  const tdb = createTenantDb(stack.db, user.tenantId, "system");
+  const result = await userMfaExecutor.create(
+    {
+      userId: user.id,
+      totpSecret: base32Encode(generateTotpSecret()),
+      recoveryCodes: encodeRecoveryCodes([]),
+      enabledAt: Temporal.Now.instant(),
+      lastUsedAt: null,
+    },
+    user,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seedEnabledMfa failed: ${result.error.code}`);
+}
+
+describe("auth-mfa handlers — ctx.redis unset (#1467)", () => {
+  test("verify: fails closed with internal_error instead of skipping the brute-force cap/burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaChallengeToken(
+      { userId: user.id, tenantId: TENANT_ID },
+      5,
+      CHALLENGE_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.verify,
+      { challengeToken: token, code: "123456" },
+      GUEST_USER,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("enable-confirm-preauth: fails closed with internal_error instead of skipping the brute-force cap/burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaSetupToken(
+      {
+        userId: user.id,
+        tenantId: TENANT_ID,
+        totpSecretBase32: base32Encode(generateTotpSecret()),
+        recoveryCodeHashes: [],
+      },
+      5,
+      SETUP_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirmPreauth,
+      { setupToken: token, code: "123456" },
+      GUEST_USER,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("enable-confirm: fails closed with internal_error instead of skipping the single-use burn", async () => {
+    const user = createTestUser({ tenantId: TENANT_ID });
+    const { token } = signMfaSetupToken(
+      {
+        userId: user.id,
+        totpSecretBase32: base32Encode(generateTotpSecret()),
+        recoveryCodeHashes: [],
+      },
+      5,
+      SETUP_TOKEN_SECRET,
+    );
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: token, code: "123456" },
+      user,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  // kumiko-framework#1534: disable/regenerate-recovery used to keep the
+  // old two-factor-authenticate-then-verify flow working even without
+  // ctx.redis (verifyMfaFactor's replay-burn silently no-ops), so an
+  // observed TOTP code could be replayed within the ±1-step window against
+  // a session-authed route — unlike verify/enable-confirm-preauth, no
+  // guest-token expiry limits the attack window.
+  test("disable: fails closed with internal_error instead of skipping TOTP replay protection", async () => {
+    const user = createTestUser({ id: 501, tenantId: TENANT_ID });
+    await seedEnabledMfa(user);
+
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "123456" }, user);
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+
+  test("regenerate-recovery: fails closed with internal_error instead of skipping TOTP replay protection", async () => {
+    const user = createTestUser({ id: 502, tenantId: TENANT_ID });
+    await seedEnabledMfa(user);
+
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: "123456" },
+      user,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(500);
+    expect(err.code).toBe("internal_error");
+    expect(err.message).toContain("requires ctx.redis");
+  });
+});

package/src/auth-mfa/__tests__/reencrypt-job.integration.test.ts

@@ -13,7 +13,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
 import type { AppContext } from "@cosmicdrift/kumiko-framework/engine";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -167,3 +167,81 @@ describe("auth-mfa KEK-rotation job — kumiko-framework#266 Step 8", () => {
     await stack.http.writeOk(AuthMfaHandlers.disable, { code: currentTotpCode(secret) }, user);
   });
 });
+
+describe("auth-mfa KEK-rotation job — unrecognized values are not silently skipped (kumiko-framework#1541)", () => {
+  test("a non-envelope totpSecret is counted failed, never alreadyCurrent, and is left untouched", async () => {
+    // Reset provider to V1 so a freshly-enabled row is "current" (nothing to
+    // rotate) — the garbage field is the only failure we expect.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+        },
+      }),
+    );
+
+    const user = createTestUser({ id: 2, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "user-2@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      user,
+    );
+
+    const beforeRow = await readRawRow();
+    const garbage = "not-a-stored-envelope";
+    await asRawClient(stack.db).unsafe(`UPDATE read_user_mfa SET totp_secret = $1 WHERE id = $2`, [
+      garbage,
+      beforeRow.id,
+    ]);
+
+    type CapturedLog = { info: string[]; warn: string[] };
+    const captured: CapturedLog = { info: [], warn: [] };
+    const capturingLog = {
+      info: (msg: string) => {
+        captured.info.push(msg);
+      },
+      warn: (msg: string) => {
+        captured.warn.push(msg);
+      },
+      error: () => {},
+      debug: () => {},
+      child: () => capturingLog,
+    };
+
+    await mfaReencryptJob({}, {
+      db: stack.db,
+      registry: stack.registry,
+      masterKeyProvider: mutableProvider,
+      log: capturingLog,
+    } as AppContext);
+
+    const completeLine = captured.info.find((line) =>
+      line.includes("[auth-mfa:reencrypt] complete:"),
+    );
+    if (!completeLine) throw new Error("job did not log a completion summary");
+    const result = JSON.parse(completeLine.slice(completeLine.indexOf("{"))) as {
+      migrated: number;
+      failed: number;
+      alreadyCurrent: number;
+    };
+    expect(result.migrated).toBe(0);
+    expect(result.failed).toBe(1);
+    expect(result.alreadyCurrent).toBe(0);
+
+    const rejectedWarning = captured.warn.find((line) =>
+      line.includes("not a current-cipher envelope"),
+    );
+    expect(rejectedWarning).toBeDefined();
+
+    const afterRow = await readRawRow();
+    expect(afterRow.totpSecret).toBe(garbage);
+  });
+});

package/src/auth-mfa/handlers/disable.write.ts

@@ -1,5 +1,6 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { findUserMfaRow } from "../db/queries";
 import { invalidTotpCode, mfaNotEnabled } from "../errors";
@@ -30,7 +31,21 @@ export function createDisableHandler(opts: DisableOptions) {
       const row = await findUserMfaRow(ctx.db, event.user);
       if (!row) return mfaNotEnabled();
 
-      const replay = ctx.redis ? { redis: ctx.redis, userId: event.user.id } : undefined;
+      // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
+      // (#1467): without ctx.redis, verifyMfaFactor's TOTP-replay burn is
+      // skipped, and a code observed once (phishing proxy/shoulder-surfing)
+      // could be replayed within the ±1-step window to disable MFA outright.
+      // "no ctx.redis means no one gets through MFA login" doesn't cover
+      // this route — it's session-authed, and JWTs issued before Redis was
+      // unwired stay valid until they expire.
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message: "disable (mfa) requires ctx.redis for TOTP replay protection",
+          }),
+        );
+      }
+      const replay = { redis: ctx.redis, userId: event.user.id };
       const verify = await verifyMfaFactor(row, event.payload.code, replay);
       if (!verify.ok) return invalidTotpCode();
 

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -5,6 +5,7 @@ import {
   defineWriteHandler,
   type SessionUser,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
@@ -69,34 +70,45 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       const { userId, tenantId } = verify.payload;
       if (tenantId === undefined) return invalidSetupToken();
 
+      // Fail closed: unlike verify.write.ts/enable-confirm.write.ts, this
+      // endpoint has NO gate before it (access: { roles: ["all"] }, no JWT,
+      // no prior challenge-token from a successful login) — its only secret
+      // is a 6-digit TOTP code. Silently skipping the brute-force cap and
+      // single-use burn when ctx.redis is absent would let the setup token
+      // be guessed against unboundedly until its TTL expires. The route's
+      // IP rate limiter is not a substitute: it's IP-scoped and resets on
+      // every success.
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message:
+              "enable-confirm-preauth requires ctx.redis for the brute-force cap and single-use burn",
+          }),
+        );
+      }
+
       // Same guessing surface as /auth/mfa/verify (a short TOTP code) and
       // the same per-userId cap — deliberately shared counter, see
       // mfa-verify-attempts.ts.
-      if (ctx.redis) {
-        const state = await getMfaVerifyLockoutState(ctx.redis, userId);
-        if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
-          const now = Date.now();
-          if (state.lockedUntil > now) {
-            const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
-            return tooManyAttempts(retryAfterSeconds);
-          }
+      const state = await getMfaVerifyLockoutState(ctx.redis, userId);
+      if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
+        const now = Date.now();
+        if (state.lockedUntil > now) {
+          const retryAfterSeconds = Math.max(1, Math.ceil((state.lockedUntil - now) / 1000));
+          return tooManyAttempts(retryAfterSeconds);
         }
       }
 
       const secret = base32Decode(verify.payload.totpSecretBase32);
       if (verifyTotp(secret, event.payload.code) === false) {
-        if (ctx.redis) {
-          await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
-        }
+        await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
         return invalidTotpCode();
       }
 
       // Burn the setup token on the first successful confirm — same
       // single-use guarantee as enable-confirm.write.ts.
-      if (ctx.redis) {
-        const burnResult = await burnToken(ctx.redis, "mfa-setup", userId, verify.expiresAtMs);
-        if (burnResult === "already-used") return invalidSetupToken();
-      }
+      const burnResult = await burnToken(ctx.redis, "mfa-setup", userId, verify.expiresAtMs);
+      if (burnResult === "already-used") return invalidSetupToken();
 
       // "system" mode: no session exists yet, tenantId comes from the
       // verified token, mirroring enable-start-preauth.write.ts.
@@ -105,33 +117,20 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       const existing = await findUserMfaRow(scopedDb, scopedUser);
       if (existing) return mfaAlreadyEnabled();
 
-      const result = await executor.create(
-        {
-          userId,
-          totpSecret: verify.payload.totpSecretBase32,
-          recoveryCodes: encodeRecoveryCodes(verify.payload.recoveryCodeHashes),
-          enabledAt: Temporal.Now.instant(),
-          lastUsedAt: null,
-        },
-        scopedUser,
-        scopedDb,
-      );
-      if (!result.isSuccess) return result;
-
-      if (ctx.redis) {
-        await clearMfaVerifyAttempts(ctx.redis, userId);
-      }
-
-      // No currentSid to exclude — this is the first session for this
-      // login, not a follow-up on an already-running one.
-      if (opts.revokeAllOtherSessions) {
-        await opts.revokeAllOtherSessions(userId, undefined);
-      }
-
-      // Re-derive the full session the way verify.write.ts does — the
-      // setupToken only proves "password + new TOTP secret", not roles;
-      // roles come from a fresh membership lookup, same as every other
-      // login-completing handler.
+      // Status + membership must be verified BEFORE the entity-write below —
+      // an admin can restrict/delete the account or revoke its tenant
+      // membership in the window between preauth-enable-start and
+      // preauth-confirm (up to MFA_SETUP_TOKEN_TTL_MINUTES). Checking after
+      // the write left two irreversible side effects behind an
+      // already-signed, non-forgeable setupToken that then just returns
+      // invalidSetupToken(): the MFA row persisted and (formerly) all other
+      // sessions revoked — with mfaAlreadyEnabled() blocking any
+      // re-enrollment until an operator manually disables MFA. NOT fixed by
+      // this ordering: burnToken() above still runs before this check, so a
+      // mid-flight restricted/deleted user still burns their setup token
+      // (framework#1523/5) — moving the burn later would need care around
+      // the existing userId-unique-constraint backstop between the
+      // `existing` check above and executor.create() below.
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
       const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
@@ -153,6 +152,27 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       })) as ReadonlyArray<{ tenantId: string; roles: readonly string[] }>; // @cast-boundary engine-payload
       const membership = memberships.find((m) => m.tenantId === tenantId);
       if (!membership) return invalidSetupToken();
+
+      const result = await executor.create(
+        {
+          userId,
+          totpSecret: verify.payload.totpSecretBase32,
+          recoveryCodes: encodeRecoveryCodes(verify.payload.recoveryCodeHashes),
+          enabledAt: Temporal.Now.instant(),
+          lastUsedAt: null,
+        },
+        scopedUser,
+        scopedDb,
+      );
+      if (!result.isSuccess) return result;
+
+      // ctx.redis is guaranteed by the fail-closed check above.
+      await clearMfaVerifyAttempts(ctx.redis, userId);
+
+      // Re-derive the full session the way verify.write.ts does — the
+      // setupToken only proves "password + new TOTP secret", not roles;
+      // roles come from the membership lookup above, same as every other
+      // login-completing handler.
       // buildSessionRoles calls stripForbiddenMembershipRoles to strip reserved
       // roles from the membership portion (globalRoles keeps SystemAdmin) —
       // read-time backstop against a rebuild-resurrected role, same as
@@ -164,6 +184,16 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
 
+      // Last step before returning success: every gate above (status,
+      // membership, entity-write) has passed, so this is the point of no
+      // return anyway — revoking here instead of right after the write
+      // means a rejected confirm never touches the user's other sessions.
+      // No currentSid to exclude — this is the first session for this
+      // login, not a follow-up on an already-running one.
+      if (opts.revokeAllOtherSessions) {
+        await opts.revokeAllOtherSessions(userId, undefined);
+      }
+
       return { isSuccess: true, data: { kind: "mfa-preauth-confirm-success", session } };
     },
   });

package/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -1,5 +1,6 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { burnToken } from "../../shared";
@@ -41,6 +42,21 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // already rules that out).
       if (verify.payload.userId !== event.user.id) return invalidSetupToken();
 
+      // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
+      // (#1467): session-authed (lower risk — the caller already has a
+      // valid JWT), but silently skipping the single-use burn here would
+      // still let a double-confirm race complete twice instead of the
+      // second seeing invalidSetupToken(). Checked before the TOTP verify
+      // for the same reason the other two handlers check it early: fail
+      // closed before doing any of the guarded work, not partway through.
+      if (!ctx.redis) {
+        return writeFailure(
+          new InternalError({
+            message: "enable-confirm requires ctx.redis for the single-use setup-token burn",
+          }),
+        );
+      }
+
       const secret = base32Decode(verify.payload.totpSecretBase32);
       if (verifyTotp(secret, event.payload.code) === false) return invalidTotpCode();
 
@@ -51,18 +67,13 @@ export function createEnableConfirmHandler(opts: EnableConfirmOptions) {
       // ponytail: burned here, not unburned on a later executor.create
       // failure (unlike login.write.ts's unburnToken pattern) — self-service
       // enable-start always mints a fresh setup token on demand (no mailed
-      // link to go stale), so the realistic failure path (double-confirm
-      // race sans Redis) is meant to leave the burn standing. Add
-      // unburnToken here if create-failure retries turn out to matter.
-      if (ctx.redis) {
-        const burnResult = await burnToken(
-          ctx.redis,
-          "mfa-setup",
-          event.user.id,
-          verify.expiresAtMs,
-        );
-        if (burnResult === "already-used") return invalidSetupToken();
-      }
+      // link to go stale), so the realistic remaining failure path (a
+      // double-confirm race where executor.create itself fails, e.g. a
+      // concurrent mfa_already_enabled() write) is meant to leave the burn
+      // standing. Add unburnToken here if create-failure retries turn out
+      // to matter.
+      const burnResult = await burnToken(ctx.redis, "mfa-setup", event.user.id, verify.expiresAtMs);
+      if (burnResult === "already-used") return invalidSetupToken();
 
       const existing = await findUserMfaRow(ctx.db, event.user);
       if (existing) return mfaAlreadyEnabled();