@cosmicdrift/kumiko-bundled-features 0.200.1 → 0.202.0

package/src/personal-access-tokens/__tests__/pat.integration.test.ts

@@ -37,11 +37,12 @@ import { userSessionEntity } from "../../sessions/schema/user-session";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
-import { USER_STATUS } from "../../user";
+import { USER_STATUS, UserHandlers, UserQueries } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { PatHandlers, PatQueries } from "../constants";
+import { PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors, PatHandlers, PatQueries } from "../constants";
 import { createPersonalAccessTokensFeature } from "../feature";
+import { revokeAllPatTokensForUser } from "../revoke-for-user";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token";
 import type { PatScopeConfig } from "../scopes";
 
@@ -66,14 +67,21 @@ const SCOPES: PatScopeConfig = {
 
 async function mintToken(
   actor: SessionUser,
-  opts?: { scopes?: string[]; expiresInDays?: number },
+  opts?: {
+    scopes?: string[];
+    expiresInDays?: number;
+    currentPassword?: string;
+    mfaCode?: string;
+  },
 ): Promise<string> {
   const res = await stack.http.writeOk<{ id: string; token: string }>(
     PatHandlers.create,
     {
       name: "test",
       scopes: opts?.scopes ?? ["tokens:read"],
+      currentPassword: opts?.currentPassword ?? "pw",
       ...(opts?.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}),
+      ...(opts?.mfaCode ? { mfaCode: opts.mfaCode } : {}),
     },
     actor,
   );
@@ -91,7 +99,12 @@ beforeAll(async () => {
       createTenantFeature(),
       createAuthEmailPasswordFeature(),
       createSessionsFeature(),
-      createPersonalAccessTokensFeature({ scopes: SCOPES }),
+      createPersonalAccessTokensFeature({
+        scopes: SCOPES,
+        // Closure over `stack` is fine here: the hook only invokes this at
+        // fire-time, well after setupTestStack below has assigned it.
+        autoRevokeOnPasswordChange: (userId) => revokeAllPatTokensForUser(stack.db, userId),
+      }),
       authFoundationFeature,
     ],
     extraContext: { configResolver: resolver, configEncryption: encryption },
@@ -253,3 +266,157 @@ describe("PAT with active KMS (#820): token name is userOwned PII", () => {
     }
   });
 });
+
+describe("PAT create: re-auth (#security)", () => {
+  test("missing currentPassword → rejected, no token minted", async () => {
+    const actor = await actorFor("reauth-missing@example.com");
+    const err = await stack.http.writeErr(
+      PatHandlers.create,
+      { name: "test", scopes: ["tokens:read"] },
+      actor,
+    );
+    expect(err.httpStatus).toBeGreaterThanOrEqual(400);
+    const rows = await stack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor);
+    expect(rows).toHaveLength(0);
+  });
+
+  test("wrong currentPassword → rejected, no token minted", async () => {
+    const actor = await actorFor("reauth-wrong@example.com");
+    const err = await stack.http.writeErr(
+      PatHandlers.create,
+      { name: "test", scopes: ["tokens:read"], currentPassword: "not-the-password" },
+      actor,
+    );
+    expect(err.details).toMatchObject({ reason: PatErrors.reauthRequired });
+    const rows = await stack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor);
+    expect(rows).toHaveLength(0);
+  });
+
+  test("expiresInDays omitted → defaults to ~90 days, not never-expiring", async () => {
+    const actor = await actorFor("reauth-expiry@example.com");
+    await mintToken(actor);
+    const rows = await stack.http.queryOk<Array<{ id: string; expiresAt: string | null }>>(
+      PatQueries.mine,
+      {},
+      actor,
+    );
+    expect(rows[0]?.expiresAt).not.toBeNull();
+    const expiresAt = Temporal.Instant.from(rows[0]?.expiresAt as string);
+    const expected = Temporal.Now.instant().add({ hours: 24 * PAT_DEFAULT_EXPIRES_IN_DAYS });
+    const driftHours = Math.abs(expiresAt.since(expected).total({ unit: "hours" }));
+    expect(driftHours).toBeLessThan(1);
+  });
+});
+
+describe("PAT create: MFA re-auth gate", () => {
+  let mfaStack: TestStack;
+  let mfaH: ReturnType<typeof makeSessionHelpers>;
+
+  beforeAll(async () => {
+    const encryption = createTestEnvelopeCipher(encryptionKey);
+    const resolver = createConfigResolver({ cipher: encryption });
+    mfaStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createAuthEmailPasswordFeature(),
+        createSessionsFeature(),
+        createPersonalAccessTokensFeature({
+          scopes: SCOPES,
+          // Stub verifier: always enrolled, code never accepted — exercises
+          // the real gate over HTTP without depending on auth-mfa's TOTP
+          // machinery (same shape as sessions' massRevokeSpy tests).
+          mfaVerifier: async () => ({ enrolled: true, ok: false }),
+        }),
+        authFoundationFeature,
+      ],
+      extraContext: { configResolver: resolver, configEncryption: encryption },
+      authConfig: {
+        membershipQuery: "tenant:query:memberships",
+        loginHandler: AuthHandlers.login,
+        tokenVerifier: (raw: string) =>
+          resolveTokenVerifier({ db: mfaStack.db, registry: mfaStack.registry }, raw),
+        patRateLimiter: createInMemoryLoginRateLimiter(10, 60_000),
+      },
+    });
+    mfaH = makeSessionHelpers(mfaStack, TENANT);
+    await unsafeCreateEntityTable(mfaStack.db, userEntity);
+    await unsafeCreateEntityTable(mfaStack.db, tenantEntity);
+    await unsafeCreateEntityTable(mfaStack.db, userSessionEntity);
+    await unsafeCreateEntityTable(mfaStack.db, apiTokenEntity);
+    await unsafePushTables(mfaStack.db, { configValuesTable, tenantMembershipsTable });
+  });
+
+  afterAll(async () => {
+    await mfaStack.cleanup();
+  });
+
+  test("MFA-enrolled user without mfaCode → rejected, no token minted", async () => {
+    const { userId } = await mfaH.seedUser("mfa-missing-code@example.com", "pw");
+    const actor: SessionUser = { id: userId, tenantId: TENANT, roles: ["User"] };
+    const err = await mfaStack.http.writeErr(
+      PatHandlers.create,
+      { name: "test", scopes: ["tokens:read"], currentPassword: "pw" },
+      actor,
+    );
+    expect(err.details).toMatchObject({ reason: PatErrors.reauthRequired });
+    const rows = await mfaStack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor);
+    expect(rows).toHaveLength(0);
+  });
+
+  test("MFA-enrolled user with wrong mfaCode → rejected, no token minted", async () => {
+    const { userId } = await mfaH.seedUser("mfa-wrong-code@example.com", "pw");
+    const actor: SessionUser = { id: userId, tenantId: TENANT, roles: ["User"] };
+    const err = await mfaStack.http.writeErr(
+      PatHandlers.create,
+      { name: "test", scopes: ["tokens:read"], currentPassword: "pw", mfaCode: "000000" },
+      actor,
+    );
+    expect(err.details).toMatchObject({ reason: PatErrors.reauthRequired });
+    const rows = await mfaStack.http.queryOk<Array<{ id: string }>>(PatQueries.mine, {}, actor);
+    expect(rows).toHaveLength(0);
+  });
+});
+
+describe("PAT revoke on password change (#security)", () => {
+  test("changing password revokes all of the user's live PAT tokens", async () => {
+    const actor = await actorFor("pat-revoke-pwchange@example.com");
+    const token = await mintToken(actor);
+    const preCheck = await h.authedPost("/api/query", token, {
+      type: PatQueries.mine,
+      payload: {},
+    });
+    expect(preCheck.status).toBe(200);
+
+    await stack.http.writeOk(
+      AuthHandlers.changePassword,
+      { oldPassword: "pw", newPassword: "NewPassw0rd!42" },
+      actor,
+    );
+
+    const rows = await selectMany<{ revokedAt: string | null }>(stack.db, apiTokenTable, {
+      userId: actor.id,
+    });
+    expect(rows.length).toBeGreaterThan(0);
+    expect(rows.every((row) => row.revokedAt !== null)).toBe(true);
+
+    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
+    expect(res.status).toBe(401);
+  });
+
+  test("editing a non-password field does NOT revoke PAT tokens", async () => {
+    const actor = await actorFor("pat-no-revoke-other-field@example.com");
+    const token = await mintToken(actor);
+
+    const me = await stack.http.queryOk<{ version: number }>(UserQueries.me, {}, actor);
+    await stack.http.writeOk(
+      UserHandlers.update,
+      { id: actor.id, version: me.version, changes: { displayName: "New Name" } },
+      actor,
+    );
+
+    const res = await h.authedPost("/api/query", token, { type: PatQueries.mine, payload: {} });
+    expect(res.status).toBe(200);
+  });
+});

package/src/personal-access-tokens/constants.ts

@@ -6,8 +6,16 @@ export const PAT_FEATURE = "personal-access-tokens";
 // Snake_case reason strings (Error-Reasons guard: no colons/dashes).
 export const PatErrors = {
   ownershipDenied: "ownership_denied",
+  // Uniform for wrong-password AND missing/wrong MFA code — a distinct
+  // reason per case would leak whether the account has MFA enrolled.
+  reauthRequired: "reauth_required",
 } as const;
 
+// expiresInDays default when omitted at mint time. A silent "never expires"
+// default is a standing-credential risk; the existing 3650-day cap still
+// lets callers who genuinely want a long-lived token pass it explicitly.
+export const PAT_DEFAULT_EXPIRES_IN_DAYS = 90;
+
 // Dormant custom-screen id (r.screen) — the app places it via r.nav. The client
 // maps it to the PatTokensScreen component.
 export const PAT_SCREEN_ID = "api-tokens";

package/src/personal-access-tokens/feature.ts

@@ -7,7 +7,7 @@ import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PAT_SCREEN_ID, type PatRateLimit } from "./constants";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query";
-import { createPatWrite } from "./handlers/create.write";
+import { type CreatePatOptions, createPatCreateHandler } from "./handlers/create.write";
 import { listPatQuery } from "./handlers/list.query";
 import { revokePatWrite } from "./handlers/revoke.write";
 import { PAT_FEATURE_I18N } from "./i18n";
@@ -15,6 +15,36 @@ import { createPatResolver } from "./resolver";
 import { apiTokenEntity } from "./schema/api-token";
 import type { PatScopeConfig } from "./scopes";
 
+// Password-change is the only field-level trigger — see the postSave hook
+// below. MFA-enable/disable is wired separately (auth-mfa's
+// revokeAllPatTokens callback, late-bound at app-composition time) since
+// that's a different entity ("user-mfa") this feature doesn't own or
+// require.
+const PAT_REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
+
+export type BindPatAutoRevokeOnPasswordChange = (
+  revoker: (userId: string) => Promise<number>,
+) => void;
+
+// Reads the late-bind setter off a mounted personal-access-tokens feature's
+// exports — run{Prod,Dev}App call this once a concrete db is available,
+// mirrors sessions' own bindAutoRevokeFromFeature/bindAutoRevokeOnPasswordChange.
+export function bindPatAutoRevokeOnPasswordChangeFromFeature(
+  feature: FeatureDefinition,
+): BindPatAutoRevokeOnPasswordChange | undefined {
+  const exports = feature.exports;
+  if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
+    const { bindAutoRevokeOnPasswordChange } = exports as {
+      bindAutoRevokeOnPasswordChange: unknown;
+    };
+    if (typeof bindAutoRevokeOnPasswordChange === "function") {
+      // @cast-boundary exports-walk — feature.exports is untyped by design
+      return bindAutoRevokeOnPasswordChange as BindPatAutoRevokeOnPasswordChange;
+    }
+  }
+  return undefined;
+}
+
 export type PersonalAccessTokensOptions = {
   // The scopes this deployment offers. Each is a named bundle of QN globs a PAT
   // may be granted (a scope can span features). Closed over by available-scopes
@@ -28,10 +58,20 @@ export type PersonalAccessTokensOptions = {
    *  { default: false } for fail-closed gating (feature off until a tier grants
    *  it). Omit to keep PAT always-on (default). */
   readonly toggleable?: { readonly default: boolean };
+  // Opt-in MFA re-auth gate for minting a token — wired via
+  // mfaVerifierFromFeature (auth-mfa/feature.ts) at app-composition time. No
+  // hard dependency on the optional auth-mfa feature.
+  readonly mfaVerifier?: CreatePatOptions["mfaVerifier"];
+  // Password-change revoker — same constructor-option-or-late-bind duality as
+  // sessions' own autoRevokeOnPasswordChange (bindAutoRevokeOnPasswordChange
+  // below wins only if this is unset). Lets tests pass a revoker directly
+  // instead of needing a post-setupTestStack bind call.
+  readonly autoRevokeOnPasswordChange?: (userId: string) => Promise<number>;
 };
 
 export type PatFeatureExports = {
   readonly rateLimit: PatRateLimit;
+  readonly bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange;
 };
 
 // Personal Access Tokens — long-lived, revocable bearer credentials for the
@@ -73,8 +113,31 @@ export function createPersonalAccessTokensFeature(
       piiEncryptedOnWrite: true,
     });
 
+    // Password-change auto-revoke — mirrors sessions' own
+    // autoRevokeOnPasswordChange postSave hook, including WHY it's a
+    // late-bind callback rather than direct ctx.db use: user:write:user:update
+    // is r.systemScope()'d (the user aggregate is a systemStream, framework
+    // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
+    // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
+    let autoRevokeOnPasswordChange = options.autoRevokeOnPasswordChange;
+    r.hook("postSave", { allOf: "user" }, async (result) => {
+      // skip: nothing bound — same late-bind pattern as sessions/feature.ts
+      if (!autoRevokeOnPasswordChange) return;
+      // skip: brand-new user, no PATs can exist yet
+      if (result.isNew) return;
+      // skip: handler didn't touch any revoke-triggering field
+      if (!PAT_REVOKE_TRIGGERING_FIELDS.some((field) => result.changes[field] !== undefined)) {
+        return;
+      }
+      await autoRevokeOnPasswordChange(String(result.id));
+    });
+    const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
+      // explicit constructor option wins over the runtime binding
+      autoRevokeOnPasswordChange ??= revoker;
+    };
+
     const handlers = {
-      create: r.writeHandler(createPatWrite),
+      create: r.writeHandler(createPatCreateHandler({ mfaVerifier: options.mfaVerifier })),
       revoke: r.writeHandler(revokePatWrite),
     };
     const queries = {
@@ -102,6 +165,7 @@ export function createPersonalAccessTokensFeature(
     return {
       handlers,
       queries,
+      bindAutoRevokeOnPasswordChange,
       rateLimit: options.rateLimit ?? PAT_DEFAULT_RATE_LIMIT,
     } satisfies { handlers: unknown; queries: unknown } & PatFeatureExports;
   });

package/src/personal-access-tokens/handlers/create.write.ts

@@ -1,47 +1,105 @@
 import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  defineWriteHandler,
+  type HandlerContext,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
-import { encryptForDirectWrite } from "../../shared";
+import { encryptForDirectWrite, verifyPassword } from "../../shared";
+import { UserQueries } from "../../user";
+import { PAT_DEFAULT_EXPIRES_IN_DAYS, PatErrors } from "../constants";
 import { mintPatToken } from "../hash";
 import { apiTokenEntity, apiTokenTable } from "../schema/api-token";
 
+export type PatMfaVerifyResult = { readonly enrolled: boolean; readonly ok: boolean };
+
+export type CreatePatOptions = {
+  // Opt-in MFA re-auth gate — auth-mfa (if mounted) wires this in at
+  // app-composition time via mfaVerifierFromFeature. Deliberately generic
+  // here, same decoupling as login.write.ts's mfaStatusChecker: this
+  // feature must not import auth-mfa's types, only this shape.
+  readonly mfaVerifier?: (
+    ctx: HandlerContext,
+    userId: string,
+    tenantId: TenantId,
+    code: string | undefined,
+  ) => Promise<PatMfaVerifyResult>;
+};
+
+function reauthFailed() {
+  return writeFailure(
+    new UnprocessableError(PatErrors.reauthRequired, {
+      i18nKey: "errors.reauthRequired",
+    }),
+  );
+}
+
 // Mint a PAT for the calling user in their active tenant. The plaintext token
 // is returned ONCE (data.token) and never again — only the hash is stored.
 // `scopes` are granted scope names; unknown names simply grant nothing at
 // resolve time (fail-closed), so no cross-check against the app config here.
-export const createPatWrite = defineWriteHandler({
-  name: "create",
-  schema: z.object({
-    name: z.string().min(1).max(120),
-    scopes: z.array(z.string().min(1)).min(1),
-    expiresInDays: z.number().int().positive().max(3650).optional(),
-  }),
-  access: { openToAll: true },
-  handler: async (event, ctx) => {
-    const { raw, hash, prefix } = mintPatToken();
-    const now = Temporal.Now.instant();
-    const id = generateId();
-    const row = await encryptForDirectWrite(
-      apiTokenEntity,
-      {
-        id,
-        userId: event.user.id,
-        tenantId: event.user.tenantId,
-        name: event.payload.name,
-        tokenHash: hash,
-        prefix,
-        scopes: JSON.stringify(event.payload.scopes),
-        createdAt: now,
-        expiresAt: event.payload.expiresInDays
-          ? now.add({ hours: 24 * event.payload.expiresInDays })
-          : null,
-        revokedAt: null,
-      },
-      "pat:create",
-    );
-    await insertOne(ctx.db, apiTokenTable, row);
-    return { isSuccess: true, data: { id, token: raw, prefix } };
-  },
-});
+//
+// Minting a long-lived bearer credential re-verifies the caller's password
+// (and MFA code, if enrolled) even though the request is already
+// session-authed — a stolen/leaked session cookie must not be enough to
+// stand up a durable API credential.
+export function createPatCreateHandler(opts: CreatePatOptions = {}) {
+  return defineWriteHandler({
+    name: "create",
+    schema: z.object({
+      name: z.string().min(1).max(120),
+      scopes: z.array(z.string().min(1)).min(1),
+      expiresInDays: z.number().int().positive().max(3650).optional(),
+      currentPassword: z.string().min(1),
+      mfaCode: z.string().optional(),
+    }),
+    access: { openToAll: true },
+    handler: async (event, ctx) => {
+      const systemUser = createSystemUser(event.user.tenantId);
+      const me = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+        id: event.user.id,
+      })) as { passwordHash: string | null } | null; // @cast-boundary db-runner
+      if (!me?.passwordHash) return reauthFailed();
+      const passwordOk = await verifyPassword(me.passwordHash, event.payload.currentPassword);
+      if (!passwordOk) return reauthFailed();
+
+      if (opts.mfaVerifier) {
+        const mfa = await opts.mfaVerifier(
+          ctx,
+          event.user.id,
+          event.user.tenantId,
+          event.payload.mfaCode,
+        );
+        if (mfa.enrolled && !mfa.ok) return reauthFailed();
+      }
+
+      const { raw, hash, prefix } = mintPatToken();
+      const now = Temporal.Now.instant();
+      const id = generateId();
+      const row = await encryptForDirectWrite(
+        apiTokenEntity,
+        {
+          id,
+          userId: event.user.id,
+          tenantId: event.user.tenantId,
+          name: event.payload.name,
+          tokenHash: hash,
+          prefix,
+          scopes: JSON.stringify(event.payload.scopes),
+          createdAt: now,
+          expiresAt: now.add({
+            hours: 24 * (event.payload.expiresInDays ?? PAT_DEFAULT_EXPIRES_IN_DAYS),
+          }),
+          revokedAt: null,
+        },
+        "pat:create",
+      );
+      await insertOne(ctx.db, apiTokenTable, row);
+      return { isSuccess: true, data: { id, token: raw, prefix } };
+    },
+  });
+}

package/src/personal-access-tokens/index.ts

@@ -3,10 +3,15 @@ import { PAT_DEFAULT_RATE_LIMIT, type PatRateLimit } from "./constants";
 
 export type { PatRateLimit } from "./constants";
 export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants";
-export type { PersonalAccessTokensOptions } from "./feature";
-export { createPersonalAccessTokensFeature } from "./feature";
+export type { BindPatAutoRevokeOnPasswordChange, PersonalAccessTokensOptions } from "./feature";
+export {
+  bindPatAutoRevokeOnPasswordChangeFromFeature,
+  createPersonalAccessTokensFeature,
+} from "./feature";
+export type { CreatePatOptions, PatMfaVerifyResult } from "./handlers/create.write";
 export { hashPatToken, mintPatToken } from "./hash";
 export { createPatResolver } from "./resolver";
+export { revokeAllPatTokensForUser } from "./revoke-for-user";
 export { apiTokenEntity, apiTokenTable } from "./schema/api-token";
 export type { PatScopeConfig, PatScopeDef } from "./scopes";
 export { expandScopes } from "./scopes";

package/src/personal-access-tokens/revoke-for-user.ts

@@ -0,0 +1,18 @@
+import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { Temporal } from "temporal-polyfill";
+import { apiTokenTable } from "./schema/api-token";
+
+// Cross-tenant revoke: password-change and MFA-enable/disable are account-
+// level security events, not scoped to one tenant. Mirrors sessions'
+// sessionMassRevoker (session-callbacks.ts) which passes the boot-time
+// DbConnection directly — not ctx.db, which would be tenant-scoped in a hook.
+export async function revokeAllPatTokensForUser(db: DbConnection, userId: string): Promise<number> {
+  const updated = await updateMany<{ id: string }>(
+    db,
+    apiTokenTable,
+    { revokedAt: Temporal.Now.instant() },
+    { userId, revokedAt: null },
+  );
+  return updated.length;
+}

package/src/personal-access-tokens/web/i18n.ts

@@ -17,6 +17,10 @@ export const defaultTranslations: TranslationsByLocale = {
     "pat.create.submit": "Token erstellen",
     "pat.create.needName": "Bitte einen Namen vergeben.",
     "pat.create.needScope": "Bitte mindestens eine Berechtigung wählen.",
+    "pat.create.needPassword": "Bitte dein Passwort zur Bestätigung eingeben.",
+    "pat.create.currentPassword": "Passwort (zur Bestätigung)",
+    "pat.create.mfaCode": "2FA-Code (falls aktiviert)",
+    "pat.create.mfaCodePlaceholder": "6-stelliger Code",
     "pat.expiry.30d": "30 Tage",
     "pat.expiry.90d": "90 Tage",
     "pat.expiry.1y": "1 Jahr",
@@ -49,6 +53,10 @@ export const defaultTranslations: TranslationsByLocale = {
     "pat.create.submit": "Create token",
     "pat.create.needName": "Please enter a name.",
     "pat.create.needScope": "Please select at least one permission.",
+    "pat.create.needPassword": "Please enter your password to confirm.",
+    "pat.create.currentPassword": "Password (to confirm)",
+    "pat.create.mfaCode": "2FA code (if enabled)",
+    "pat.create.mfaCodePlaceholder": "6-digit code",
     "pat.expiry.30d": "30 days",
     "pat.expiry.90d": "90 days",
     "pat.expiry.1y": "1 year",

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -57,6 +57,8 @@ export function PatTokensScreen({
   const [name, setName] = useState("");
   const [levels, setLevels] = useState<Readonly<Record<string, Level>>>({});
   const [expiry, setExpiry] = useState<ExpiryKey>("90d");
+  const [currentPassword, setCurrentPassword] = useState("");
+  const [mfaCode, setMfaCode] = useState("");
   const [minted, setMinted] = useState<{ token: string } | null>(null);
   const [copied, setCopied] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -80,15 +82,21 @@ export function PatTokensScreen({
     if (name.trim() === "") return setError(t("pat.create.needName"));
     const scopes = grants();
     if (scopes.length === 0) return setError(t("pat.create.needScope"));
+    if (currentPassword === "") return setError(t("pat.create.needPassword"));
     setBusy(true);
     setError(null);
     const days = EXPIRY_DAYS[expiry];
     const res = await dispatcher.write(PatHandlers.create, {
       name: name.trim(),
       scopes,
+      currentPassword,
       ...(days !== undefined ? { expiresInDays: days } : {}),
+      ...(mfaCode.trim() !== "" ? { mfaCode: mfaCode.trim() } : {}),
     });
     setBusy(false);
+    // Never leave a submitted password/MFA code sitting in state, success or not.
+    setCurrentPassword("");
+    setMfaCode("");
     if (!res.isSuccess) return setError(t("pat.error.generic"));
     setMinted({ token: (res.data as { token: string }).token });
     setCopied(false);
@@ -219,6 +227,29 @@ export function PatTokensScreen({
             disabled={busy}
           />
         </Field>
+
+        <Field id="pat-current-password" label={t("pat.create.currentPassword")} required>
+          <Input
+            kind="password"
+            id="pat-current-password"
+            name="currentPassword"
+            value={currentPassword}
+            onChange={setCurrentPassword}
+            disabled={busy}
+          />
+        </Field>
+
+        <Field id="pat-mfa-code" label={t("pat.create.mfaCode")}>
+          <Input
+            kind="text"
+            id="pat-mfa-code"
+            name="mfaCode"
+            value={mfaCode}
+            onChange={setMfaCode}
+            placeholder={t("pat.create.mfaCodePlaceholder")}
+            disabled={busy}
+          />
+        </Field>
       </Form>
 
       <div className="flex flex-col gap-3">