@cosmicdrift/kumiko-bundled-features 0.197.1 → 0.199.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.197.1",
+  "version": "0.199.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -125,12 +125,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.197.1",
-    "@cosmicdrift/kumiko-framework": "0.197.1",
-    "@cosmicdrift/kumiko-headless": "0.197.1",
-    "@cosmicdrift/kumiko-renderer": "0.197.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.197.1",
-    "@cosmicdrift/kumiko-types": "0.197.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.199.0",
+    "@cosmicdrift/kumiko-framework": "0.199.0",
+    "@cosmicdrift/kumiko-headless": "0.199.0",
+    "@cosmicdrift/kumiko-renderer": "0.199.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.199.0",
+    "@cosmicdrift/kumiko-types": "0.199.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",

package/src/auth-email-password/__tests__/invite-accept-with-login-gates.integration.test.ts

@@ -0,0 +1,272 @@
+// invite-accept-with-login used to mint a full session straight off a bare
+// verifyPassword call, skipping every gate login.write.ts runs (lockout,
+// account-status, MFA). This suite proves the shared gates are wired in:
+// an MFA-enrolled invitee gets a challenge instead of a session, and a
+// restricted/deleted invitee never gets a session at all.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  AuthMfaHandlers,
+  base32Decode,
+  createAuthMfaFeature,
+  mfaStatusCheckerFromFeature,
+  userMfaEntity,
+  userMfaTable,
+} from "../../auth-mfa";
+import { currentTotpCode } from "../../auth-mfa/totp";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
+import { USER_STATUS } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+const ALICE_EMAIL = "alice@example.com";
+
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+let aliceId: string;
+let TENANT_A_ID: TenantId;
+
+function newTenantId(): TenantId {
+  return crypto.randomUUID() as TenantId;
+}
+
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in invite mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: "test-mfa-setup-token-secret-at-least-32-bytes!!",
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-token-secret-at-least-32-bytes!!",
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: resolver,
+      configEncryption: encryption,
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userMfaTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const allKeys = await stack.redis.redis.keys("invite:*");
+  if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
+
+  TENANT_A_ID = newTenantId();
+  await seedTenant(stack.db, {
+    id: TENANT_A_ID,
+    key: `tenant-a-${TENANT_A_ID.slice(0, 8)}`,
+    name: "Tenant A",
+  });
+
+  aliceId = crypto.randomUUID();
+  await seedRow(stack.db, userTable, {
+    id: aliceId,
+    tenantId: TENANT_A_ID,
+    email: ALICE_EMAIL,
+    displayName: "Alice",
+    passwordHash: await hashPassword("alice-pw-1234"),
+    locale: "de",
+    emailVerified: true,
+    roles: "[]",
+    status: USER_STATUS.Active,
+  });
+  await seedTenantMembership(stack.db, {
+    userId: aliceId,
+    tenantId: TENANT_A_ID,
+    roles: ["Admin"],
+  });
+});
+
+function aliceSession(): SessionUser {
+  return { id: aliceId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+}
+
+async function inviteEmail(email: string, role: string): Promise<string> {
+  await stack.http.writeOk(AuthHandlers.inviteCreate, { email, role }, aliceSession());
+  const sent = emailTransport.sent.at(-1);
+  if (!sent) throw new Error("invite-create didn't send a mail");
+  return extractTokenFromMail(sent.html);
+}
+
+describe("invite-accept-with-login: MFA gate", () => {
+  test("an MFA-enrolled invitee gets an mfa-challenge, not a session", async () => {
+    const email = "mfa-invitee@example.com";
+    const password = "mfa-invitee-pw-1234";
+
+    // Enroll MFA for this user in TENANT_A BEFORE they're invited — userMfaEntity
+    // rows are keyed (userId, tenantId), so enrollment must target the tenant
+    // the invite will later grant membership in.
+    const mfaActor = createTestUser({ id: 701, tenantId: TENANT_A_ID, roles: ["User"] });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: email },
+      mfaActor,
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      mfaActor,
+    );
+
+    // Real user row matching the synthetic actor's id — invite-accept-with-login
+    // reads this row for password/status, gateEnforceMfa reads userMfaEntity
+    // by (mfaActor.id, TENANT_A_ID).
+    await seedRow(stack.db, userTable, {
+      id: mfaActor.id,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(password),
+      displayName: "MFA Invitee",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+
+    const token = await inviteEmail(email, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password,
+    });
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      mfaRequired?: boolean;
+      challengeToken?: string;
+      token?: string;
+    };
+    expect(body.isSuccess).toBe(true);
+    expect(body.mfaRequired).toBe(true);
+    expect(typeof body.challengeToken).toBe("string");
+    // No session — a challenge, not a JWT.
+    expect(body.token).toBeUndefined();
+  });
+});
+
+describe("invite-accept-with-login: account-status gate", () => {
+  test("a Restricted invitee is refused — no session minted", async () => {
+    const email = "restricted-invitee@example.com";
+    const password = "restricted-invitee-pw-1234";
+    const userId = crypto.randomUUID();
+
+    await seedRow(stack.db, userTable, {
+      id: userId,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(password),
+      displayName: "Restricted Invitee",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET status = $1 WHERE id = $2`,
+      [USER_STATUS.Restricted, userId],
+    );
+
+    const token = await inviteEmail(email, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password,
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; token?: string };
+    expect(body.isSuccess).toBe(false);
+    expect(body.token).toBeUndefined();
+
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, { userId });
+    expect(memberships).toHaveLength(0);
+  });
+});

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -42,7 +42,10 @@ import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { tenantInvitationDeleteHook } from "../../user-data-rights-defaults";
+import {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "../../user-data-rights-defaults";
 import { AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { seedUser } from "../seeding";
@@ -300,6 +303,33 @@ describe("auth flows with active KMS + blind index", () => {
     expect(list[0]?.invitedBy).toBe(aliceId);
   });
 
+  // fw-review #8: the export hook returned the raw stored `email` column —
+  // under active KMS that's base64 ciphertext, not the address, so a GDPR
+  // export contained an unreadable blob instead of the invited email. The
+  // hook matches on the EXPORTING user's own (decrypted) email, i.e. the
+  // invitee side — Bob is the invitee here, Alice the inviter.
+  test("Art.15 export decrypts the invitation email under active KMS", async () => {
+    await inviteEmail(BOB_EMAIL, "Editor");
+
+    const [rawInvitation] = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
+      `SELECT * FROM "${tenantInvitationsTable.tableName}" WHERE tenant_id = $1`,
+      [TENANT_A_ID],
+    );
+    if (!rawInvitation) throw new Error("no invitation row seeded");
+    expect(isPiiCiphertext(rawInvitation["email"])).toBe(true);
+
+    const result = await tenantInvitationExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: TENANT_A_ID,
+      userId: bobId,
+    });
+
+    expect(result?.entity).toBe("tenant-invitation");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["email"]).toBe(BOB_EMAIL);
+  });
+
   // fw-review #7: the inviter-forget arm compared a plaintext userId against
   // the encrypted `invitedBy` column via selectMany's equality filter — with
   // no lookupable/blind-index column on `invitedBy`, that filter matched

package/src/auth-email-password/feature.ts

@@ -238,7 +238,15 @@ export function createAuthEmailPasswordFeature(
     if (opts.invite) {
       r.writeHandler(createInviteCreateHandler(opts.invite));
       r.writeHandler(createInviteAcceptHandler());
-      r.writeHandler(createInviteAcceptWithLoginHandler());
+      // Same gates as the `login` handler above (lockout, password,
+      // email-verified, account-status, MFA) — see invite-accept-with-login.write.ts.
+      r.writeHandler(
+        createInviteAcceptWithLoginHandler({
+          mfaStatusChecker: opts.mfaStatusChecker,
+          accountLockout: opts.accountLockout,
+          strictEmailVerification: strictVerification,
+        }),
+      );
       r.writeHandler(createInviteSignupCompleteHandler());
     }
 

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -1,21 +1,25 @@
-// Tenant-Invite Step 2 — Branch 2 (anon User mit existing email).
+// Tenant-Invite Step 2 — Branch 2 (anon user with an existing email).
 //
 // Flow:
-//   1. User (nicht eingeloggt) klickt Invite-Link → /invite/accept?token=...
-//   2. Frontend zeigt Login-Form mit pre-filled email (von der Invitation-
-//      Page geliefert via separate Lookup-Query, oder vom User getippt)
-//   3. User submitted email + password + token an diesen Handler
-//   4. Server: login + accept in einem Schritt:
+//   1. User (not logged in) clicks the invite link → /invite/accept?token=...
+//   2. Frontend shows a login form with the pre-filled email (delivered by
+//      the invitation page via a separate lookup query, or typed by the user)
+//   3. User submits email + password + token to this handler
+//   4. Server: login + accept in one step:
 //      a. Token → invitationId → invitation row
-//      b. Login-Check: Password gegen userTable für invitation.email
-//      c. Email-Match (vom User-Input) === invitation.email
-//      d. Membership-Add im invited Tenant
-//      e. Invitation → status=accepted, Token gelöscht
-//   5. Response: SessionUser + tenantKey für Auto-Login (analog signup-confirm)
+//      b. Login check: password against userTable for invitation.email — via
+//         the same login.write.ts gates (lockout, password, email-verified,
+//         account-status, MFA), not a standalone verifyPassword call
+//      c. Email match (from user input) === invitation.email
+//      d. Membership added in the invited tenant
+//      e. Invitation → status=accepted, token deleted
+//   5. Response: SessionUser + tenantId/role for auto-login (analog to
+//      signup-confirm), or an mfa-challenge/mfa-setup-required if an MFA
+//      gate fires — identical shape to login.write.ts (see LoginResult).
 //
-// Anders als signup-confirm: KEIN neuer Tenant entsteht, KEIN neuer
-// User entsteht — beide existieren bereits. Magic ist die kombinierte
-// Login+Accept-Operation in einem Roundtrip.
+// Unlike signup-confirm: no new tenant is created, no new user is created —
+// both already exist. The magic is the combined login+accept operation in
+// one round trip.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
@@ -28,17 +32,21 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii, sessionTimezoneField, verifyPassword } from "../../shared";
+import { decryptStoredPii, sessionTimezoneField } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
   INVITATION_STATUS,
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
-// kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
+// kumiko-lint-ignore cross-feature-import membership-seed-helper for a privileged cross-tenant add
 import { seedTenantMembership } from "../../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import login-style password-check
 import { userTable } from "../../user/schema/user";
+import {
+  AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES,
+  AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS,
+} from "../constants";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors";
 import {
   burnInviteToken,
@@ -47,6 +55,15 @@ import {
   unburnInviteToken,
 } from "../invite-token-store";
 import { passwordSchema } from "../password-policy";
+import {
+  gateEnforceAccountStatus,
+  gateEnforceEmailVerified,
+  gateEnforceLockout,
+  gateEnforceMfa,
+  gateVerifyPassword,
+  type LoginHandlerOptions,
+  type LoginResult,
+} from "./login.write";
 
 const InviteAcceptWithLoginSchema = z.object({
   token: z.string().min(1),
@@ -54,11 +71,23 @@ const InviteAcceptWithLoginSchema = z.object({
   password: passwordSchema,
 });
 
-export type InviteAcceptWithLoginData = {
-  readonly kind: "auth-session";
-  readonly session: SessionUser;
-  readonly tenantId: TenantId;
-  readonly role: string;
+// Reuses login.write.ts's MFA branches unmodified (see LoginResult) so a
+// client handles an invite-accept-with-login MFA challenge exactly like a
+// regular login one. The auth-session branch stays invite-specific — it
+// additionally carries tenantId/role for the invited tenant.
+export type InviteAcceptWithLoginData =
+  | {
+      readonly kind: "auth-session";
+      readonly session: SessionUser;
+      readonly tenantId: TenantId;
+      readonly role: string;
+    }
+  | Exclude<LoginResult, { readonly kind: "auth-session" }>;
+
+export type InviteAcceptWithLoginOptions = {
+  readonly mfaStatusChecker?: LoginHandlerOptions["mfaStatusChecker"];
+  readonly accountLockout?: LoginHandlerOptions["accountLockout"];
+  readonly strictEmailVerification?: boolean;
 };
 
 const invitationExecutor = createEventStoreExecutor(
@@ -67,7 +96,13 @@ const invitationExecutor = createEventStoreExecutor(
   { entityName: "tenant-invitation" },
 );
 
-export function createInviteAcceptWithLoginHandler() {
+export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOptions = {}) {
+  const strictVerification = opts.strictEmailVerification === true;
+  const maxFailedAttempts =
+    opts.accountLockout?.maxFailedAttempts ?? AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS;
+  const lockoutDurationMinutes =
+    opts.accountLockout?.lockoutDurationMinutes ?? AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES;
+
   return defineWriteHandler<
     "invite-accept-with-login",
     typeof InviteAcceptWithLoginSchema,
@@ -76,6 +111,7 @@ export function createInviteAcceptWithLoginHandler() {
     name: "invite-accept-with-login",
     schema: InviteAcceptWithLoginSchema,
     access: { roles: ["all"] },
+    // kumiko-lint-ignore complexity-budget reuses login.write.ts's gate chain (lockout/password/email/status/membership/mfa) plus invite-specific branches (email match, already-member check, invitation update, unburn-on-failure) — splitting would scatter gate order across functions without reducing risk
     handler: async (event, ctx) => {
       if (!ctx.redis) {
         return writeFailure(
@@ -100,6 +136,8 @@ export function createInviteAcceptWithLoginHandler() {
         readonly id: string;
         readonly passwordHash: string | null;
         readonly timezone?: string | null;
+        readonly emailVerified?: boolean | null;
+        readonly status?: string | null;
       };
 
       let committed = false;
@@ -119,24 +157,42 @@ export function createInviteAcceptWithLoginHandler() {
         const invitationRole = invitation.role;
         const invitationVersion = invitation.version;
 
-        // Email-Match vom User-Input (nicht aus session — User ist anon)
+        // Email match from user input (not from session — user is anon)
         if (event.payload.email.toLowerCase() !== invitationEmail) {
           return inviteEmailMismatch();
         }
 
-        // Password-Check gegen userTable. Anti-enumeration: bei
-        // user-not-found ODER wrong-password collapsed beides auf
-        // invalidInviteToken (gleicher anti-enum-Trade-off wie reset).
+        // Password check against userTable, through the same gates
+        // login.write.ts runs (see login-gates.test.ts for the gate contracts).
         const userRow = await fetchOne<UserAuthRow>(ctx.db.raw, userTable, {
           email: invitationEmail,
         });
         if (!userRow?.passwordHash) return invalidInviteToken();
-        const passwordValid = await verifyPassword(userRow.passwordHash, event.payload.password);
-        if (!passwordValid) return invalidInviteToken();
+
+        const lockoutGate = await gateEnforceLockout(ctx, userRow.id);
+        if (!lockoutGate.ok) return lockoutGate.result;
+
+        // Wrong password still collapses to invalidInviteToken (existing
+        // anti-enum contract for this endpoint) — gateVerifyPassword runs
+        // regardless, for its failed-attempt recording side effect.
+        const passwordGate = await gateVerifyPassword(
+          ctx,
+          { id: userRow.id, passwordHash: userRow.passwordHash },
+          event.payload.password,
+          maxFailedAttempts,
+          lockoutDurationMinutes,
+        );
+        if (!passwordGate.ok) return invalidInviteToken();
+
+        const emailGate = gateEnforceEmailVerified(userRow, strictVerification);
+        if (!emailGate.ok) return emailGate.result;
+
+        const statusGate = gateEnforceAccountStatus(userRow);
+        if (!statusGate.ok) return statusGate.result;
 
         const userId = userRow.id;
 
-        // Already-Member-Check (idempotent)
+        // Already-member check (idempotent)
         const memberships = (await ctx.queryAs(
           createSystemUser(invitationTenantId),
           "tenant:query:memberships",
@@ -154,7 +210,7 @@ export function createInviteAcceptWithLoginHandler() {
           });
         }
 
-        // Invitation → accepted: TenantDb für invitation-tenant.
+        // Invitation → accepted: TenantDb for the invitation's tenant.
         const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
         const updateResult = await invitationExecutor.update(
           {
@@ -169,14 +225,31 @@ export function createInviteAcceptWithLoginHandler() {
 
         await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
 
-        // SessionUser für JWT-Mint im invited Tenant. Roles =
-        // [invitationRole] (Admin/Editor/User je nach invite).
+        // buildSessionRoles calls stripForbiddenMembershipRoles internally —
+        // a reserved role on the invitation itself must never reach the session.
+        const mergedRoles = buildSessionRoles([], [invitationRole]);
+
+        // MFA gate runs after membership is granted (mirrors login.write.ts's
+        // own order: membership resolution before MFA) — a challenge halts
+        // the session mint, not the invite acceptance itself.
+        const mfaGate = await gateEnforceMfa(
+          ctx,
+          { mfaStatusChecker: opts.mfaStatusChecker },
+          userId,
+          invitationTenantId,
+          mergedRoles,
+        );
+        if (mfaGate !== undefined) {
+          committed = true;
+          return { isSuccess: true, data: mfaGate };
+        }
+
+        // SessionUser for the JWT mint in the invited tenant. Roles =
+        // mergedRoles (Admin/Editor/User depending on the invite).
         const session: SessionUser = {
           id: userId,
           tenantId: invitationTenantId,
-          // buildSessionRoles calls stripForbiddenMembershipRoles internally —
-          // a reserved role on the invitation itself must never reach the session.
-          roles: buildSessionRoles([], [invitationRole]),
+          roles: mergedRoles,
           ...sessionTimezoneField(userRow.timezone),
         };
 

package/src/auth-email-password/handlers/login.write.ts

@@ -7,6 +7,7 @@ import {
   type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared";
@@ -67,18 +68,21 @@ const SYSTEM_USER_ID = "00000000-0000-4000-8000-000000000000";
 // Two possible success shapes: a straight login mints a session; a login
 // gated by MFA hands back a challenge instead — auth-routes.ts branches on
 // `kind` to decide whether to mint a JWT now or wait for /auth/mfa/verify.
-type LoginResult =
+export type LoginResult =
   | { readonly kind: "auth-session"; readonly session: SessionUser }
   | { readonly kind: "mfa-challenge"; readonly challengeToken: string }
   | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string };
 
 type Membership = { readonly tenantId: TenantId; readonly roles: readonly string[] };
 
-type GateReject = { readonly ok: false; readonly result: WriteResult<LoginResult> };
+// result is always a WriteFailure at construction (every reject() call site
+// passes one) — typing it that way, not WriteResult<LoginResult>, lets other
+// handlers with a different success-data type reuse these gates unchanged.
+type GateReject = { readonly ok: false; readonly result: WriteFailure };
 type GateOk<T> = { readonly ok: true; readonly value: T };
 type GateOutcome<T> = GateReject | GateOk<T>;
 
-function reject(result: WriteResult<LoginResult>): GateReject {
+function reject(result: WriteFailure): GateReject {
   return { ok: false, result };
 }
 
@@ -199,14 +203,15 @@ export async function gateResolveMembership(
   return ok({ chosen, mergedRoles });
 }
 
-/** MFA challenge / setup-required / proceed. */
+// MFA challenge / setup-required / proceed. Excludes "auth-session" (this
+// gate never builds one) so callers with their own session shape reuse it as-is.
 export async function gateEnforceMfa(
   ctx: HandlerContext,
   opts: LoginHandlerOptions,
   userId: string,
   tenantId: TenantId,
   mergedRoles: readonly string[],
-): Promise<LoginResult | undefined> {
+): Promise<Exclude<LoginResult, { readonly kind: "auth-session" }> | undefined> {
   if (!opts.mfaStatusChecker) return undefined;
   const mfaStatus = await opts.mfaStatusChecker(ctx, userId, tenantId, mergedRoles);
   if ("challengeToken" in mfaStatus) {