@cosmicdrift/kumiko-bundled-features 0.176.0 → 0.176.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.176.0",
+  "version": "0.176.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -120,12 +120,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.176.0",
-    "@cosmicdrift/kumiko-framework": "0.176.0",
-    "@cosmicdrift/kumiko-headless": "0.176.0",
-    "@cosmicdrift/kumiko-renderer": "0.176.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.176.0",
-    "@cosmicdrift/kumiko-types": "0.176.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.176.1",
+    "@cosmicdrift/kumiko-framework": "0.176.1",
+    "@cosmicdrift/kumiko-headless": "0.176.1",
+    "@cosmicdrift/kumiko-renderer": "0.176.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.176.1",
+    "@cosmicdrift/kumiko-types": "0.176.1",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -351,6 +351,37 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     expect(memberships).toHaveLength(2);
   });
 
+  test("Bob accepts with a timezone → JWT retains the timezone", async () => {
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", bobId],
+    );
+    try {
+      const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+      const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+        token,
+        email: BOB_EMAIL,
+        password: BOB_PASSWORD,
+      });
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { token?: string };
+      expect(body.token).toBeTypeOf("string");
+      if (!body.token) throw new Error("invite acceptance did not return a token");
+
+      const payload = await stack.jwt.verify(body.token);
+      expect(payload.timezone).toBe("Europe/Berlin");
+    } finally {
+      // Bob is shared across this describe block (other tests rely on his
+      // membership state persisting) — restore his timezone so later tests
+      // don't silently inherit it.
+      await asRawClient(stack.db).unsafe(
+        `UPDATE "${userTable.tableName}" SET timezone = NULL WHERE id = $1`,
+        [bobId],
+      );
+    }
+  });
+
   test("Wrong password → 422 invalid_invite_token (anti-enum)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Editor");
     const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -28,7 +28,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii, verifyPassword } from "../../shared";
+import { decryptStoredPii, sessionTimezoneField, verifyPassword } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
@@ -96,7 +96,11 @@ export function createInviteAcceptWithLoginHandler() {
         readonly role: string;
         readonly version: number;
       };
-      type UserAuthRow = { readonly id: string; readonly passwordHash: string | null };
+      type UserAuthRow = {
+        readonly id: string;
+        readonly passwordHash: string | null;
+        readonly timezone?: string | null;
+      };
 
       let committed = false;
       try {
@@ -173,6 +177,7 @@ export function createInviteAcceptWithLoginHandler() {
           // buildSessionRoles calls stripForbiddenMembershipRoles internally —
           // a reserved role on the invitation itself must never reach the session.
           roles: buildSessionRoles([], [invitationRole]),
+          ...sessionTimezoneField(userRow.timezone),
         };
 
         committed = true;

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -14,9 +14,12 @@ import {
   expectErrorIncludes,
   seedRow,
 } from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers as AuthEmailPasswordHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -25,7 +28,7 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { base32Decode } from "../base32";
 import { AuthMfaHandlers } from "../constants";
-import { createAuthMfaFeature } from "../feature";
+import { createAuthMfaFeature, mfaStatusCheckerFromFeature } from "../feature";
 import { signMfaChallengeToken } from "../mfa-challenge-token";
 import { userMfaEntity } from "../schema/user-mfa";
 import { currentTotpCode } from "../totp";
@@ -49,18 +52,26 @@ beforeAll(async () => {
   const encryption = createTestEnvelopeCipher();
   configureEntityFieldEncryption(encryption);
   const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
   stack = await setupTestStack({
     features: [
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
-      createAuthMfaFeature({
-        setupTokenSecret: SETUP_TOKEN_SECRET,
-        issuer: "Kumiko Test",
-        challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
       }),
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthEmailPasswordHandlers.login,
+    },
   });
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
@@ -76,8 +87,10 @@ async function enableMfaFor(idSeed: number): Promise<{
   user: ReturnType<typeof createTestUser>;
   secret: Buffer;
   recoveryCodes: string[];
+  password: string;
 }> {
   const user = createTestUser({ id: idSeed, roles: ["User"] });
+  const password = `password-${idSeed}-long-enough`;
   const start = await stack.http.writeOk<{
     setupToken: string;
     otpauthUri: string;
@@ -103,14 +116,14 @@ async function enableMfaFor(idSeed: number): Promise<{
     id: user.id,
     tenantId: user.tenantId,
     email: `user-${user.id}@example.com`,
-    passwordHash: "h",
+    passwordHash: await hashPassword(password),
     displayName: `Test User ${idSeed}`,
     locale: "de",
     emailVerified: true,
     roles: "[]",
     status: USER_STATUS.Active,
   });
-  return { user, secret, recoveryCodes: start.recoveryCodes };
+  return { user, secret, recoveryCodes: start.recoveryCodes, password };
 }
 
 function challengeFor(userId: string, tenantId: TenantId): string {
@@ -131,6 +144,50 @@ describe("mfa verify — completes a two-step login", () => {
     expect(res.session.tenantId).toBe(user.tenantId);
   });
 
+  test("a password login followed by MFA verify retains the user's timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(9);
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET timezone = $1 WHERE id = $2`,
+      ["Europe/Berlin", user.id],
+    );
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBe("Europe/Berlin");
+  });
+
+  test("a password login followed by MFA verify omits an unset timezone", async () => {
+    const { user, password, secret } = await enableMfaFor(10);
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: `user-${user.id}@example.com`,
+      password,
+    });
+    expect(loginRes.status).toBe(200);
+    const login = (await loginRes.json()) as { challengeToken?: string };
+    expect(login.challengeToken).toBeTypeOf("string");
+    if (!login.challengeToken) throw new Error("MFA login did not return a challenge token");
+
+    const verified = await stack.http.writeOk<{ session: SessionUser }>(
+      AuthMfaHandlers.verify,
+      { challengeToken: login.challengeToken, code: currentTotpCode(secret) },
+      GUEST,
+    );
+    expect(verified.session.timezone).toBeUndefined();
+  });
+
   test("a wrong TOTP code is rejected", async () => {
     const { user } = await enableMfaFor(2);
     const challengeToken = challengeFor(user.id, user.tenantId);

package/src/auth-mfa/handlers/verify.write.ts

@@ -8,7 +8,7 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
-import { burnToken } from "../../shared";
+import { burnToken, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants";
 import { findUserMfaRow } from "../db/queries";
@@ -135,7 +135,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
       const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
         id: userId,
-      })) as { roles?: string | null; status?: string } | null; // @cast-boundary engine-payload
+      })) as { roles?: string | null; status?: string; timezone?: string | null } | null; // @cast-boundary engine-payload
 
       // Re-check status + membership the way login.write.ts does after its
       // password check — the challenge token only proves "password was
@@ -168,7 +168,12 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
       // read-time backstop against a rebuild-resurrected role.
       const mergedRoles = buildSessionRoles(globalRoles, membership.roles);
 
-      const baseSession: SessionUser = { id: userId, tenantId, roles: mergedRoles };
+      const baseSession: SessionUser = {
+        id: userId,
+        tenantId,
+        roles: mergedRoles,
+        ...sessionTimezoneField(userRow?.timezone),
+      };
       const claims = await ctx.resolveAuthClaims(baseSession);
       const session: SessionUser =
         Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;

package/src/shared/index.ts

@@ -16,5 +16,6 @@ export { isWithinGracePeriod } from "./grace-period";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
 export { mapWithConcurrency } from "./map-with-concurrency";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";
+export { sessionTimezoneField } from "./session-timezone-field";
 export type { SystemQueryFn } from "./system-query";
 export { type BurnResult, burnToken, unburnToken } from "./token-burn-store";

package/src/shared/session-timezone-field.ts

@@ -0,0 +1,7 @@
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+
+export function sessionTimezoneField(
+  timezone: string | null | undefined,
+): Pick<SessionUser, "timezone"> | Record<string, never> {
+  return timezone !== null && timezone !== undefined ? { timezone } : {};
+}