@cosmicdrift/kumiko-bundled-features 0.263.0 → 0.264.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.263.0",
+  "version": "0.264.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -129,12 +129,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.263.0",
-    "@cosmicdrift/kumiko-framework": "0.263.0",
-    "@cosmicdrift/kumiko-headless": "0.263.0",
-    "@cosmicdrift/kumiko-renderer": "0.263.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.263.0",
-    "@cosmicdrift/kumiko-types": "0.263.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.264.1",
+    "@cosmicdrift/kumiko-framework": "0.264.1",
+    "@cosmicdrift/kumiko-headless": "0.264.1",
+    "@cosmicdrift/kumiko-renderer": "0.264.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.264.1",
+    "@cosmicdrift/kumiko-types": "0.264.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -163,7 +163,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.263.0",
-    "@cosmicdrift/kumiko-locale-es": "0.263.0"
+    "@cosmicdrift/kumiko-locale-de": "0.264.1",
+    "@cosmicdrift/kumiko-locale-es": "0.264.1"
   }
 }

package/src/auth-email-password/handlers/change-password.write.ts

@@ -21,6 +21,12 @@ export const changePasswordWrite = defineWriteHandler({
     newPassword: passwordSchema,
   }),
   access: { roles: access.authenticated },
+  escapeHatch: {
+    reason:
+      "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +
+      "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
+      "identity can't reach either, field-access on passwordHash is privileged-only.",
+  },
   description:
     "Replaces the signed-in caller's own password after re-checking the current one; use it for a self-service password change rather than the emailed reset flow.",
   handler: async (event, ctx) => {

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -116,6 +116,11 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
     name: "invite-accept-with-login",
     schema: InviteAcceptWithLoginSchema,
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +
+        "membership via ctx.queryAs(SYSTEM, tenant:query:memberships) of the invitation's tenant.",
+    },
     agent: { expose: false },
     // kumiko-lint-ignore complexity-budget reuses login.write.ts's gate chain (lockout/password/email/status/membership/mfa) plus invite-specific branches (email match, already-member check, invitation update, unburn-on-failure) — splitting would scatter gate order across functions without reducing risk
     handler: async (event, ctx) => {

package/src/auth-email-password/handlers/login.write.ts

@@ -263,6 +263,12 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       password: z.string().min(1),
     }),
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Unauthenticated login has no caller identity yet — it looks up the user row by " +
+        "email and resolves tenant memberships via ctx.queryAs(SYSTEM, ...) before a " +
+        "session exists.",
+    },
     description:
       "Signs a user in with email and password, running the lockout, email-verification, account-status, tenant-membership and MFA gates, and answering with a session or with an MFA challenge or setup requirement.",
     handler: async (event, ctx): Promise<WriteResult<LoginResult>> => {

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -26,6 +26,11 @@ export function createResetPasswordHandler(opts: ResetPasswordOptions) {
       newPassword: passwordSchema,
     }),
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
+        "target user via ctx.writeAs(SYSTEM, user:update) to set the new password hash.",
+    },
     agent: { expose: false },
     handler: async (event, ctx) => {
       if (!opts.hmacSecret) {

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -95,6 +95,11 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
     name: spec.handlerName,
     schema: RequestTokenSchema,
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Anonymous requester has no session — looks up the target user by email via " +
+        "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
+    },
     description: spec.description,
     handler: async (event, ctx) => {
       if (!opts.hmacSecret) {

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -27,6 +27,11 @@ export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
     name: "verify-email",
     schema: VerifyEmailSchema,
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
+        "target user via ctx.writeAs(SYSTEM, user:update) to set emailVerified.",
+    },
     agent: { expose: false },
     handler: async (event, ctx) => {
       if (!opts.hmacSecret) {

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -64,6 +64,11 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       code: z.string().length(6),
     }),
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Pre-auth MFA enrollment step has no session yet — re-checks status and membership via " +
+        "ctx.queryAs(SYSTEM, user:findForAuth / tenant:query:memberships) for the setup token's user.",
+    },
     description:
       "Completes the enrollment that unblocks a sign-in forced into two-factor setup: verifies the code against the pre-auth setup token, stores the factor and derives the session the blocked login never got.",
     // Changes the caller's authentication state and mints a session.

package/src/auth-mfa/handlers/verify.write.ts

@@ -46,6 +46,11 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
     name: "verify",
     schema: z.object({ challengeToken: z.string().min(1), code: z.string().min(6).max(9) }),
     access: { roles: ["all"] },
+    escapeHatch: {
+      reason:
+        "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +
+        "user:findForAuth / tenant:query:memberships) for the user the challenge token names.",
+    },
     description:
       "Finishes a two-step sign-in by checking a TOTP or recovery code against the challenge token that login handed back, under a per-account attempt cap, and derives the resulting session.",
     handler: async (event, ctx) => {

package/src/personal-access-tokens/handlers/create.write.ts

@@ -58,6 +58,11 @@ export function createPatCreateHandler(opts: CreatePatOptions = {}) {
       mfaCode: z.string().optional(),
     }),
     access: { openToAll: true },
+    escapeHatch: {
+      reason:
+        "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, " +
+        "user:findForAuth) to re-verify the current password before minting the token.",
+    },
     description:
       "Mints a personal access token for the calling user after re-verifying their password (and MFA code when enrolled) and returns the plaintext token exactly once; use it when a user needs a long-lived API credential.",
     // Returns the plaintext token once; an agent turn would archive it in the

package/src/user-data-rights/handlers/confirm-deletion-by-token.write.ts

@@ -50,6 +50,12 @@ export function createConfirmDeletionByTokenHandler(opts: ConfirmDeletionByToken
     name: "confirm-deletion-by-token",
     schema: z.object({ token: z.string().min(1) }),
     access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+    escapeHatch: {
+      reason:
+        "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+        "...) to compute the grace period end — the anonymous token holder has no read access " +
+        "to that tenant-config projection.",
+    },
     agent: { expose: false },
     rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
     handler: async (event, ctx) => {

package/src/user-data-rights/handlers/request-deletion.write.ts

@@ -44,6 +44,12 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
     name: "request-deletion",
     schema: z.object({}),
     access: { openToAll: true },
+    escapeHatch: {
+      reason:
+        "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+        "...) to compute the grace period end — the calling user's own identity has no read " +
+        "access to that tenant-config projection.",
+    },
     description:
       "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
     agent: { risk: "high" },

package/src/user-data-rights/handlers/restrict-account.write.ts

@@ -46,6 +46,12 @@ export const restrictAccountWrite = defineWriteHandler({
   name: "restrict-account",
   schema: z.object({ userId: z.string().uuid().optional() }),
   access: { openToAll: true },
+  escapeHatch: {
+    reason:
+      "Revokes all live sessions of the (possibly self-)restricted user via ctx.writeAs(SYSTEM, " +
+      "sessions:write:user-session:revoke-all-for-user) — that handler's own access gate needs " +
+      "privileged roles the acting caller doesn't necessarily have.",
+  },
   description:
     "Freezes an account under GDPR Art. 18 by flipping it to restricted and revoking all of its live sessions, locking the user out until an admin calls lift-restriction; targets the caller by default, an admin may name another userId.",
   agent: { risk: "high" },

package/src/user-profile/handlers/change-email.write.ts

@@ -37,6 +37,12 @@ export const changeEmailWrite = defineWriteHandler({
     newEmail: z.email(),
   }),
   access: { roles: access.authenticated },
+  escapeHatch: {
+    reason:
+      "Reads the caller's own passwordHash via ctx.queryAs(SYSTEM, user:findForAuth), checks " +
+      "email uniqueness the same way, and writes the new email via ctx.writeAs(SYSTEM, " +
+      "user:update) — field-access on passwordHash/email is privileged-only.",
+  },
   description:
     "Replaces the signed-in caller's own email address after re-checking their current password, refusing an unchanged or already-taken address and clearing the verified flag so the app can re-run email verification.",
   handler: async (event, ctx) => {