@cosmicdrift/kumiko-bundled-features 0.290.0 → 0.292.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.290.0",
+  "version": "0.292.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.290.0",
-    "@cosmicdrift/kumiko-framework": "0.290.0",
-    "@cosmicdrift/kumiko-headless": "0.290.0",
-    "@cosmicdrift/kumiko-renderer": "0.290.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.290.0",
-    "@cosmicdrift/kumiko-types": "0.290.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.292.0",
+    "@cosmicdrift/kumiko-framework": "0.292.0",
+    "@cosmicdrift/kumiko-headless": "0.292.0",
+    "@cosmicdrift/kumiko-renderer": "0.292.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.292.0",
+    "@cosmicdrift/kumiko-types": "0.292.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.290.0",
-    "@cosmicdrift/kumiko-locale-es": "0.290.0",
+    "@cosmicdrift/kumiko-locale-de": "0.292.0",
+    "@cosmicdrift/kumiko-locale-es": "0.292.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/audit/__tests__/audit-screens.boot.test.ts

@@ -1,19 +1,37 @@
 import { describe, expect, test } from "bun:test";
 import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  isFieldsEditSection,
+  normalizeEditField,
+  normalizeListColumn,
+  sectionFieldSpecs,
+} from "@cosmicdrift/kumiko-framework/ui-types";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant/feature";
+import { createUserFeature } from "../../user/feature";
 import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 import { AUDIT_I18N } from "../i18n";
 
 describe("audit log screen + handler access alignment", () => {
-  const features = [createConfigFeature(), createTenantFeature(), createAuditFeature()];
+  const features = [
+    createConfigFeature(),
+    createTenantFeature(),
+    createUserFeature(),
+    createAuditFeature(),
+  ];
 
   test("boot-validates with audit-log screen registered", () => {
     expect(() => validateBoot(features)).not.toThrow();
   });
 
+  test("the user:user actor reference makes `user` a hard boot dependency (fw#3103)", () => {
+    expect(() =>
+      validateBoot([createConfigFeature(), createTenantFeature(), createAuditFeature()]),
+    ).toThrow(/requires feature "user"/);
+  });
+
   test("audit-log screen is declarative, access.admin-gated", () => {
     const audit = createAuditFeature();
     const screen = audit.screens[AUDIT_LOG_SCREEN_ID];
@@ -63,6 +81,27 @@ describe("audit log screen + handler access alignment", () => {
     expect(AUDIT_I18N[aggregateTypeKey]?.en).not.toBe(AUDIT_I18N[aggregateIdKey]?.en);
   });
 
+  test("actor column and detail field declare the user:user reference (fw#3103)", () => {
+    const audit = createAuditFeature();
+    expect(audit.requires).toContain("user");
+
+    const list = audit.screens[AUDIT_LOG_SCREEN_ID];
+    if (list?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const actorColumn = list.columns.map(normalizeListColumn).find((c) => c.field === "createdBy");
+    expect(actorColumn?.refEntity).toBe("user:user");
+    expect(actorColumn?.refLabelField).toBe("displayName");
+
+    const detail = audit.screens[AUDIT_LOG_DETAIL_SCREEN_ID];
+    if (detail?.type !== "projectionDetail") throw new Error("expected a projectionDetail screen");
+    const actorField = detail.layout.sections
+      .filter(isFieldsEditSection)
+      .flatMap((section) => sectionFieldSpecs(section))
+      .map(normalizeEditField)
+      .find((f) => f.field === "createdBy");
+    expect(actorField?.refEntity).toBe("user:user");
+    expect(actorField?.refLabelField).toBe("displayName");
+  });
+
   test("audit queries use access.admin (screen ⊆ handler)", () => {
     const audit = createAuditFeature();
     expect(rolesOf(audit.queryHandlers["list"]?.access)).toEqual([...access.admin]);

package/src/audit/__tests__/audit.integration.test.ts

@@ -21,9 +21,11 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { withoutAmbientTemporal } from "@cosmicdrift/kumiko-framework/testing";
+import { buildDateRangePayload, resolveDateRangeFacets } from "@cosmicdrift/kumiko-renderer";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
-import { AuditQueries } from "../constants";
+import { createUserFeature } from "../../user";
+import { AUDIT_LOG_SCREEN_ID, AuditQueries } from "../constants";
 import { createAuditFeature } from "../feature";
 
 const widgetEntity = createEntity({
@@ -61,7 +63,13 @@ const otherTenantAdmin: SessionUser = createTestUser({
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [widgetFeature, createConfigFeature(), createTenantFeature(), createAuditFeature()],
+    features: [
+      widgetFeature,
+      createConfigFeature(),
+      createTenantFeature(),
+      createUserFeature(),
+      createAuditFeature(),
+    ],
   });
   await unsafeCreateEntityTable(stack.db, widgetEntity);
 });
@@ -251,6 +259,92 @@ describe("audit: list query", () => {
     expect((untilRow.payload as { name?: string }).name).toBe("before-window");
   });
 
+  // fw#3104: the audit screen's dateRange facet is the only UI that produces
+  // these bounds. The risk is not the handler (covered above) but the
+  // conversion of a calendar date into an instant: pick "the 14th" as the
+  // upper bound and an event at 23:59 local that day has to stay in the
+  // result. Bounds are derived from the live screen declaration, so a change
+  // to either end of the chain fails here.
+  test("dateRange facet bounds include an event at 23:59 of the `to` day", async () => {
+    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
+    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
+    expect(specs).toHaveLength(1);
+
+    await createWidget(admin, "late-on-the-14th");
+    await createWidget(admin, "just-after-midnight");
+
+    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
+    const byName = new Map(
+      listed.rows
+        .filter((r) => r.type === "widget.created")
+        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
+    );
+    // 23:59 and 00:00 Europe/Vienna, expressed as the UTC instants the
+    // event store stores.
+    const stamps: ReadonlyArray<readonly [string, string]> = [
+      ["late-on-the-14th", "2020-06-14T21:59:00Z"],
+      ["just-after-midnight", "2020-06-14T22:00:00Z"],
+    ];
+    for (const [name, createdAt] of stamps) {
+      const id = byName.get(name);
+      if (!id) throw new Error(`missing event for ${name}`);
+      await asRawClient(stack.db).unsafe(
+        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
+        [createdAt, id],
+      );
+    }
+
+    const bounds = buildDateRangePayload(
+      specs,
+      { "createdAt.from": ["2020-06-14"], "createdAt.to": ["2020-06-14"] },
+      "Europe/Vienna",
+    );
+    const inRange = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
+    const names = inRange.rows.map((r) => (r.payload as { name?: string }).name);
+    expect(names).toContain("late-on-the-14th");
+    expect(names).not.toContain("just-after-midnight");
+  });
+
+  // Open interval from the same declaration — only one bound set must still
+  // reach the handler as a single param.
+  test("dateRange facet with only the `from` bound sends an open interval", async () => {
+    const screen = createAuditFeature().screens[AUDIT_LOG_SCREEN_ID];
+    if (screen?.type !== "projectionList") throw new Error("expected a projectionList screen");
+    const specs = resolveDateRangeFacets(screen.facets, (key) => key);
+
+    await createWidget(admin, "old");
+    await createWidget(admin, "recent");
+    const listed = await stack.http.queryOk<AuditResponse>(AuditQueries.list, {}, admin);
+    const byName = new Map(
+      listed.rows
+        .filter((r) => r.type === "widget.created")
+        .map((r) => [(r.payload as { name?: string }).name ?? "", r.id]),
+    );
+    for (const [name, createdAt] of [
+      ["old", "2020-06-01T12:00:00Z"],
+      ["recent", "2020-06-20T12:00:00Z"],
+    ] as const) {
+      const id = byName.get(name);
+      if (!id) throw new Error(`missing event for ${name}`);
+      await asRawClient(stack.db).unsafe(
+        `UPDATE kumiko_events SET created_at = $1::timestamptz WHERE id = $2::bigint`,
+        [createdAt, id],
+      );
+    }
+
+    const bounds = buildDateRangePayload(
+      specs,
+      { "createdAt.from": ["2020-06-10"] },
+      "Europe/Vienna",
+    );
+    expect(Object.keys(bounds)).toEqual(["from"]);
+    const sinceFrom = await stack.http.queryOk<AuditResponse>(AuditQueries.list, bounds, admin);
+    const names = sinceFrom.rows.map((r) => (r.payload as { name?: string }).name);
+    expect(names).toContain("recent");
+    expect(names).not.toContain("old");
+  });
+
   test("rejects inverted from/to range with validation_error", async () => {
     // from > to would silently return empty — confusing. Schema-level refine
     // turns it into a clean 400 at the gate.

package/src/audit/__tests__/escape-hatch-audit.integration.test.ts

@@ -15,6 +15,7 @@ import {
 import { z } from "zod";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user";
 import { AuditQueries } from "../constants";
 import { createEscapeHatchAuditSink, ESCAPE_HATCH_USED_EVENT } from "../escape-hatch-audit-sink";
 import { createAuditFeature } from "../feature";
@@ -41,7 +42,13 @@ const adminOfSameTenant: SessionUser = createTestUser({ id: 10, tenantId, roles:
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [probeFeature, createConfigFeature(), createTenantFeature(), createAuditFeature()],
+    features: [
+      probeFeature,
+      createConfigFeature(),
+      createTenantFeature(),
+      createUserFeature(),
+      createAuditFeature(),
+    ],
     extraContext: ({ db }) => ({ _escapeHatchAuditSink: createEscapeHatchAuditSink({ db }) }),
   });
 });

package/src/audit/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.292.0",
+    "type": "improvement",
+    "title": "Audit log shows actor display names instead of raw UUIDs (fw#3103)",
+    "detail": "The `Actor` column of `audit:screen:audit-log` and the `createdBy` field of its detail screen rendered the raw `createdBy` UUID. The framework primitive for this already existed — `ListColumnSpec.refEntity` / `refLabelField`, used by `sessions` and `delivery` — the audit feature just did not declare it. Both now carry `refEntity: \"user:user\"`, `refLabelField: \"displayName\"`, which also makes the `createdBy → user:user` relation machine-readable in the app schema instead of implicit.\n`audit:query:list` and `audit:query:details` are unchanged and still return the plain id.\nA system write (`SYSTEM_USER_ID`, the null UUID) has no `read_users` row, so the bulk reference lookup can never resolve it. `SYSTEM_REFERENCE_LABELS` gained a `user:user` entry with the new `kumiko.reference.system-user` key, so every screen referencing `user:user` — not just the audit log — renders \"System\" for it. An actor that resolves to no row at all (deleted user) keeps the existing generic fallback: the raw id, no throw.\n`SYSTEM_USER_ID` moved from `framework/engine/system-user` to `kumiko-types/identifiers`, next to `SYSTEM_TENANT_ID`, so the client-side reference-label map can read it without importing a runtime module. `engine/system-user` re-exports it — every existing import keeps working.",
+    "migration": "The audit feature now declares `r.requires(\"tenant\", \"user\")`. An app that mounts `createAuditFeature()` without the `user` feature fails at boot with `Feature \"audit\" requires feature \"user\" which is not registered` — mount `createUserFeature()`. Apps using `securityBaselineFeatures()` already had to mount it."
+  },
   {
     "version": "0.271.0",
     "type": "improvement",

package/src/audit/feature.ts

@@ -35,8 +35,7 @@ export function createAuditFeature(): FeatureDefinition {
         recommended: false,
       });
       r.translations({ keys: AUDIT_I18N });
-      // Screens resolve actor names via tenant:query:members.
-      r.requires("tenant");
+      r.requires("tenant", "user");
 
       // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
       r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
@@ -57,10 +56,25 @@ export function createAuditFeature(): FeatureDefinition {
             renderer: { format: "timestamp" },
           },
           { field: "type", label: i18nKey("audit.log.col.type") },
-          { field: "createdBy", label: i18nKey("audit.log.col.actor") },
+          {
+            field: "createdBy",
+            label: i18nKey("audit.log.col.actor"),
+            // Resolves only for SystemAdmin until fw#3107: the lookup QN this
+            // derives, user:query:user:list, is SystemAdmin-only.
+            refEntity: "user:user",
+            refLabelField: "displayName",
+          },
         ],
         searchable: true,
         defaultSort: { field: "createdAt", dir: "desc" },
+        facets: [
+          {
+            type: "dateRange",
+            field: "createdAt",
+            label: i18nKey("audit.log.col.when"),
+            params: { from: "from", to: "to" },
+          },
+        ],
         rowActions: [
           {
             kind: "navigate",
@@ -99,7 +113,7 @@ export function createAuditFeature(): FeatureDefinition {
                 { field: "createdAt", renderer: { format: "timestamp" } },
                 "aggregateType",
                 "aggregateId",
-                "createdBy",
+                { field: "createdBy", refEntity: "user:user", refLabelField: "displayName" },
                 "id",
               ],
             },

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.291.0",
+    "type": "improvement",
+    "title": "loggedInHref callbacks on SignupCompleteScreen and InviteAcceptScreen now receive the roles granted by the flow",
+    "detail": "Apps can route a freshly activated user to a screen their role can actually open, instead of a fixed path that may render Access denied. The string form of loggedInHref is unchanged; the function form gains a roles field next to the existing tenantKey/tenantId."
+  },
   {
     "version": "0.286.0",
     "type": "improvement",

package/src/auth-email-password/web/__tests__/auth-form-logic.test.ts

@@ -34,11 +34,40 @@ describe("retryAfterMinutes", () => {
 });
 
 describe("resolveLoggedInHref", () => {
+  type SignupArgs = { tenantKey: string; roles: readonly string[] };
+
   test("string href returned as-is", () => {
-    expect(resolveLoggedInHref("/", "acme")).toBe("/");
+    expect(resolveLoggedInHref<SignupArgs>("/", { tenantKey: "acme", roles: ["User"] })).toBe("/");
   });
 
   test("function href receives tenantKey", () => {
-    expect(resolveLoggedInHref(({ tenantKey }) => `/${tenantKey}/`, "acme")).toBe("/acme/");
+    expect(
+      resolveLoggedInHref<SignupArgs>(({ tenantKey }) => `/${tenantKey}/`, {
+        tenantKey: "acme",
+        roles: [],
+      }),
+    ).toBe("/acme/");
+  });
+
+  test("function href can route on the roles the server returned", () => {
+    const byRole = ({ tenantKey, roles }: SignupArgs): string =>
+      roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`;
+
+    expect(resolveLoggedInHref(byRole, { tenantKey: "acme", roles: ["Dealer"] })).toBe(
+      "/acme/vehicle-start",
+    );
+    expect(resolveLoggedInHref(byRole, { tenantKey: "acme", roles: ["SystemAdmin"] })).toBe(
+      "/a/waitlist-list",
+    );
+  });
+
+  test("args object shape is per-screen — invite passes tenantId", () => {
+    expect(
+      resolveLoggedInHref(
+        ({ tenantId, roles }: { tenantId: string; roles: readonly string[] }) =>
+          `/${tenantId}/${roles[0] ?? "none"}`,
+        { tenantId: "t1", roles: ["Editor"] },
+      ),
+    ).toBe("/t1/Editor");
   });
 });

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -91,6 +91,53 @@ describe("InviteAcceptScreen — logged-in branch", () => {
     });
   });
 
+  test("branch 1: loggedInHref-Function bekommt die Rolle aus der invite-accept-Response", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({ tenantId: "tenant-new", role: "Dealer", alreadyMember: false }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    renderWithProviders(
+      <InviteAcceptScreen
+        token="tok-123"
+        loggedInHref={({ tenantId, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantId}/vehicle-start`
+        }
+      />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Accept" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/tenant-new/vehicle-start");
+    });
+  });
+
+  test("String-Form bleibt unverändert gültig", async () => {
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    renderWithProviders(<InviteAcceptScreen token="tok-123" loggedInHref="/fixed-landing" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Accept" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/fixed-landing");
+    });
+  });
+
   test("accept logged-in failure shows invalidInviteToken banner", async () => {
     globalThis.fetch = mock(
       async () => new Response(null, { status: 422 }),
@@ -154,6 +201,79 @@ describe("InviteAcceptScreen — anonymous branches", () => {
     });
   });
 
+  test("branch 2/3: die Session-Rollen aus user.roles schlagen die Invitation-Rolle", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            token: "jwt",
+            user: { id: "u1", tenantId: "t1", roles: ["Dealer"] },
+            tenantId: "t1",
+            role: "SystemAdmin",
+          }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    render(
+      <PrimitivesProvider value={defaultPrimitives}>
+        <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+          <InviteAcceptScreen
+            token="tok-123"
+            loggedInHref={({ tenantId, roles }) => `/${tenantId}/${roles.join("+")}`}
+          />
+        </LocaleProvider>
+      </PrimitivesProvider>,
+    );
+    fireEvent.change(screen.getByLabelText(/^Email/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Password/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Accept + sign in" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/t1/Dealer");
+    });
+  });
+
+  test("MFA-Challenge (200 ohne Rollen) liefert eine leere Rollenliste statt undefined", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ mfaRequired: true, challengeToken: "ch" }), { status: 200 }),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+    const seen: (readonly string[])[] = [];
+
+    render(
+      <PrimitivesProvider value={defaultPrimitives}>
+        <LocaleProvider resolver={resolver} fallbackBundles={[defaultTranslations]}>
+          <InviteAcceptScreen
+            token="tok-123"
+            loggedInHref={({ roles }) => {
+              seen.push(roles);
+              return "/";
+            }}
+          />
+        </LocaleProvider>
+      </PrimitivesProvider>,
+    );
+    fireEvent.change(screen.getByLabelText(/^Email/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Password/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Accept + sign in" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalled();
+    });
+    expect(seen).toEqual([[]]);
+  });
+
   test("anon failure shows invalidInviteToken banner", async () => {
     globalThis.fetch = mock(
       async () => new Response(null, { status: 422 }),

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -107,6 +107,78 @@ describe("SignupCompleteScreen", () => {
     }
   });
 
+  test("loggedInHref-Function bekommt die Rollen aus der signup-confirm-Response", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["Dealer"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(
+      <SignupCompleteScreen
+        token="abc-token"
+        loggedInHref={({ tenantKey, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`
+        }
+      />,
+    );
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/acme/vehicle-start",
+      );
+    });
+  });
+
+  test("gleiche Function, SystemAdmin-Rolle → anderes Ziel", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["SystemAdmin"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(
+      <SignupCompleteScreen
+        token="abc-token"
+        loggedInHref={({ tenantKey, roles }) =>
+          roles.includes("SystemAdmin") ? "/a/waitlist-list" : `/${tenantKey}/vehicle-start`
+        }
+      />,
+    );
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/a/waitlist-list",
+      );
+    });
+  });
+
+  test("String-Form bleibt unverändert gültig und ignoriert die Rollen", async () => {
+    renderWithProviders(<SignupCompleteScreen token="abc-token" loggedInHref="/fixed-landing" />);
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/fixed-landing",
+      );
+    });
+  });
+
   test("mismatch → client-side error, kein fetch-Call", async () => {
     const fetchMock = mock(async () => new Response(null, { status: 200 }));
     globalThis.fetch = fetchMock as unknown as typeof fetch;

package/src/auth-email-password/web/auth-form-logic.ts

@@ -21,10 +21,10 @@ export function retryAfterMinutes(retryAfterSeconds?: number): number | undefine
   return Math.ceil(retryAfterSeconds / 60);
 }
 
-/** Resolves post-login redirect: string template or function of tenantKey. */
-export function resolveLoggedInHref(
-  href: string | ((args: { readonly tenantKey: string }) => string),
-  tenantKey: string,
+/** Resolves post-login redirect: string template or function of the screen's args. */
+export function resolveLoggedInHref<Args>(
+  href: string | ((args: Args) => string),
+  args: Args,
 ): string {
-  return typeof href === "function" ? href({ tenantKey }) : href;
+  return typeof href === "function" ? href(args) : href;
 }