@cosmicdrift/kumiko-bundled-features 0.297.0 → 0.304.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.297.0",
+  "version": "0.304.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.297.0",
-    "@cosmicdrift/kumiko-framework": "0.297.0",
-    "@cosmicdrift/kumiko-headless": "0.297.0",
-    "@cosmicdrift/kumiko-renderer": "0.297.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.297.0",
-    "@cosmicdrift/kumiko-types": "0.297.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.304.0",
+    "@cosmicdrift/kumiko-framework": "0.304.0",
+    "@cosmicdrift/kumiko-headless": "0.304.0",
+    "@cosmicdrift/kumiko-renderer": "0.304.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.304.0",
+    "@cosmicdrift/kumiko-types": "0.304.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.297.0",
-    "@cosmicdrift/kumiko-locale-es": "0.297.0",
+    "@cosmicdrift/kumiko-locale-de": "0.304.0",
+    "@cosmicdrift/kumiko-locale-es": "0.304.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -393,12 +393,12 @@ describe("scenario 6: logout", () => {
   });
 
   test("unauthenticated call to logout is rejected by framework access", async () => {
-    // roles: ["all"] — no authenticated role. Handler's access is
+    // roles: ["anonymous"] — no authenticated role. Handler's access is
     // access.authenticated which requires User/Admin/SystemAdmin.
     const guest = createTestUser({
       id: 0,
       tenantId: "00000000-0000-4000-8000-000000000000",
-      roles: ["all"],
+      roles: ["anonymous"],
     });
     const error = await stack.http.writeErr(AuthHandlers.logout, {}, guest);
     expectErrorIncludes(error, "access_denied");

package/src/auth-email-password/__tests__/invite-accept-with-login-gates.integration.test.ts

@@ -166,14 +166,14 @@ function aliceSession(): SessionUser {
   return { id: aliceId, tenantId: TENANT_A_ID, roles: ["Admin"] };
 }
 
-// auth-mfa:write:verify runs pre-session (access: { roles: ["all"] }) —
+// auth-mfa:write:verify runs pre-session (access: { roles: ["anonymous"] }) —
 // dispatched here the same way the framework's /api/auth/mfa/verify route
-// would, with a guest identity. The handler derives everything it needs
-// from the challenge token, not from this actor.
+// would, with the anonymous identity. The handler derives everything it
+// needs from the challenge token, not from this actor.
 const GUEST: SessionUser = {
-  id: "00000000-0000-0000-0000-000000000000",
+  id: "anonymous",
   tenantId: "00000000-0000-4000-8000-000000000000" as TenantId,
-  roles: ["all"],
+  roles: ["anonymous"],
 };
 
 async function inviteEmail(email: string, role: string): Promise<string> {

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -82,9 +82,9 @@ function newTenantId(_suffix: string): TenantId {
 }
 
 const GUEST: SessionUser = {
-  id: "00000000-0000-0000-0000-000000000000",
+  id: "anonymous",
   tenantId: SYSTEM_TENANT_ID,
-  roles: ["all"],
+  roles: ["anonymous"],
 };
 
 function extractTokenFromMail(html: string): string {

package/src/auth-email-password/__tests__/login-anonymous-identity-rate-limit.integration.test.ts

@@ -0,0 +1,124 @@
+// login.write.ts's access.roles: ["anonymous"] carries a mandatory
+// handler-level rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 }
+// (boot-validator's validateAnonymousRateLimit). Proves that L3 handler
+// rate-limit fires over real HTTP, and that a legitimate login still succeeds.
+//
+// loginRateLimit is disabled (null): the route's own in-memory limiter
+// buckets on "ip|email" and would trip before the handler-level "ip+handler"
+// bucket under the same IP — this isolates the handler-level rateLimit.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+let stack: TestStack;
+const encryptionKey = randomBytes(32).toString("base64");
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      loginRateLimit: null,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+      },
+    },
+  });
+
+  await stack.redis.flushNamespace();
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await stack.redis.flushNamespace();
+});
+
+const systemAdmin = TestUsers.systemAdmin;
+
+async function seedLoginUser(email: string, password: string): Promise<void> {
+  const hash = await hashPassword(password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    { email, passwordHash: hash, displayName: email.split("@")[0] ?? "user" },
+    systemAdmin,
+  );
+  await seedTenantMembership(stack.db, {
+    userId: created.id,
+    tenantId: "00000000-0000-4000-8000-000000000001",
+    roles: ["User"],
+  });
+}
+
+async function postLogin(ip: string, email: string, password: string): Promise<Response> {
+  return await stack.app.request("/api/auth/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "x-forwarded-for": ip },
+    body: JSON.stringify({ email, password }),
+  });
+}
+
+describe("POST /auth/login — anonymous identity handler rateLimit (ip+handler)", () => {
+  test("21st failed login from the same IP is rejected with rate_limited (429)", async () => {
+    const ip = "10.60.0.1";
+    for (let i = 0; i < 20; i++) {
+      const res = await postLogin(ip, `nope-${i}@example.com`, "wrong-password");
+      expect(res.status).toBe(401);
+    }
+    const last = await postLogin(ip, "nope-20@example.com", "wrong-password");
+    expect(last.status).toBe(429);
+    const body = (await last.json()) as { error?: { code?: string } | string };
+    const code = typeof body.error === "string" ? body.error : body.error?.code;
+    expect(code).toBe("rate_limited");
+  });
+
+  test("a legitimate login still succeeds (anonymous dispatch identity didn't break the happy path)", async () => {
+    const ip = "10.60.0.2";
+    await seedLoginUser("legit@example.com", "correct horse battery staple");
+
+    const res = await postLogin(ip, "legit@example.com", "correct horse battery staple");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean };
+    expect(body.isSuccess).toBe(true);
+  });
+});

package/src/auth-email-password/__tests__/login-mfa-setup-required.integration.test.ts

@@ -47,14 +47,14 @@ const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
 const TENANT_ID: TenantId = testTenantId(400);
 
 // auth-mfa:write:enable-start-preauth / enable-confirm-preauth both run
-// pre-session (access: { roles: ["all"] }) — dispatched here the same way
-// the framework's /api/auth/mfa/preauth-enable-start and preauth-confirm
-// routes would, with a guest identity. Both handlers derive everything they
-// need from the verified token, not from this actor.
+// pre-session (access: { roles: ["anonymous"] }) — dispatched here the same
+// way the framework's /api/auth/mfa/preauth-enable-start and preauth-confirm
+// routes would, with the anonymous identity. Both handlers derive everything
+// they need from the verified token, not from this actor.
 const GUEST: SessionUser = {
-  id: "00000000-0000-0000-0000-000000000000",
+  id: "anonymous",
   tenantId: "00000000-0000-4000-8000-000000000000" as TenantId,
-  roles: ["all"],
+  roles: ["anonymous"],
 };
 
 beforeAll(async () => {

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -10,6 +10,7 @@ import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   setupTestStack,
   type TestStack,
+  TestUsers,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
@@ -22,10 +23,12 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
+import { UserHandlers } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthHandlers } from "../constants";
@@ -174,3 +177,28 @@ describe("L2 rate-limit covers public token routes", () => {
     expect(victimFirst.status).toBe(200);
   });
 });
+
+// The 200-for-unknown-email tests above prove nothing about the handler
+// actually running — registerTokenRequestRoute swallows every handler
+// failure into an always-200 response (anti-enumeration). Only a seeded,
+// real user distinguishes "mail sent" from "silently swallowed" — which is
+// exactly what an anonymous-dispatch switch could silently break.
+describe("request-password-reset actually dispatches mail for a real user", () => {
+  test("a seeded user gets the reset mail (anonymous dispatch didn't swallow it)", async () => {
+    const hash = await hashPassword("correct horse battery staple");
+    await stack.http.writeOk(
+      UserHandlers.create,
+      { email: "reset-target@example.com", passwordHash: hash, displayName: "reset-target" },
+      TestUsers.systemAdmin,
+    );
+
+    const before = emailTransport.sent.length;
+    const res = await postFrom("/api/auth/request-password-reset", "10.50.0.200", {
+      email: "reset-target@example.com",
+    });
+
+    expect(res.status).toBe(200);
+    expect(emailTransport.sent.length).toBe(before + 1);
+    expect(emailTransport.sent.at(-1)?.to).toBe("reset-target@example.com");
+  });
+});

package/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.300.0",
+    "type": "breaking",
+    "title": "auth handlers switch from GUEST_USER (roles: [\"all\"]) to the anonymous identity with a per-IP rateLimit",
+    "migration": "The auth-email-password and auth-mfa handlers reachable from unauthenticated /auth/* routes (login, invite-accept-with-login, invite-signup-complete, reset-password, signup-confirm, verify-email, confirm-account-unlock, signup-request, the token-request handlers, mfa verify, mfa enable-start-preauth, mfa enable-confirm-preauth) now declare access: { roles: [\"anonymous\"] } instead of access: { roles: [\"all\"] }, each with its own rateLimit: { per: \"ip+handler\", limit, windowSeconds }. Enforcing that rateLimit on a request that carries a client IP requires a RateLimitResolver (Redis), same as the already rate-limited self-registration-status query; without one these handlers fail with InternalError (fail-closed, #1467). The password-reset, email-verification and account-unlock request routes keep answering 200 for anti-enumeration, so there the failure shows up as a \"[kumiko] token request handler ... failed\" error log line and no mail is sent. Wire Redis (or context.rateLimit) before relying on these routes. Test fixtures that hand-roll a guest SessionUser with roles: [\"all\"] must switch to roles: [\"anonymous\"] (or createAnonymousUser from @cosmicdrift/kumiko-framework/engine)."
+  },
   {
     "version": "0.291.0",
     "type": "improvement",

package/src/auth-email-password/handlers/confirm-account-unlock.write.ts

@@ -29,7 +29,8 @@ export function createConfirmAccountUnlockHandler(opts: ConfirmAccountUnlockOpti
     schema: z.object({
       token: z.string().min(1),
     }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     handler: async (event, ctx) => {
       if (!opts.hmacSecret) {

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -115,7 +115,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
   >({
     name: "invite-accept-with-login",
     schema: InviteAcceptWithLoginSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -78,9 +78,9 @@ export function createInviteAcceptHandler() {
   return defineWriteHandler<"invite-accept", typeof InviteAcceptSchema, InviteAcceptData>({
     name: "invite-accept",
     schema: InviteAcceptSchema,
-    // openToAll: any authenticated user (Branch 1). Branch 2+3 (anon)
-    // nutzen `roles: ["all"]` weil dort GUEST_USER mit ["all"]-role
-    // dispatched wird.
+    // openToAll: any authenticated user (Branch 1). Branch 2+3 (anon) live
+    // in the sibling invite-accept-with-login / invite-signup-complete
+    // handlers, which declare roles: ["anonymous"] instead.
     access: {
       openToAll: {
         reason:

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -92,7 +92,8 @@ export function createInviteSignupCompleteHandler() {
   >({
     name: "invite-signup-complete",
     schema: InviteSignupCompleteSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {
       reason: INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON,

package/src/auth-email-password/handlers/login.write.ts

@@ -257,9 +257,10 @@ export async function gateBuildSession(
 }
 
 // Login — unauthenticated entry point. The route is wired public (no JWT
-// middleware), synthesising a guest SessionUser for the handler's access
-// check. Everything inside the handler goes through ctx.queryAs(system, ...)
-// so the user feature stays the single owner of its table.
+// middleware), dispatching with the framework's anonymous identity for the
+// handler's access check. Everything inside the handler goes through
+// ctx.queryAs(system, ...) so the user feature stays the single owner of its
+// table.
 export function createLoginHandler(opts: LoginHandlerOptions = {}) {
   const strictVerification = opts.strictEmailVerification === true;
   const maxFailedAttempts =
@@ -273,7 +274,8 @@ export function createLoginHandler(opts: LoginHandlerOptions = {}) {
       email: z.email(),
       password: z.string().min(1),
     }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Unauthenticated login has no caller identity yet — it looks up the user row by " +

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -25,7 +25,8 @@ export function createResetPasswordHandler(opts: ResetPasswordOptions) {
       token: z.string().min(1),
       newPassword: passwordSchema,
     }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -67,7 +67,8 @@ export function createSignupConfirmHandler() {
   return defineWriteHandler<"signup-confirm", typeof SignupConfirmSchema, SignupConfirmData>({
     name: "signup-confirm",
     schema: SignupConfirmSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {
       reason: SIGNUP_CONFIRM_PROVISION_REASON,

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -75,7 +75,8 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
   return defineWriteHandler<"signup-request", typeof SignupRequestSchema, SignupRequestData>({
     name: "signup-request",
     schema: SignupRequestSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
     description:
       "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
     handler: async (event, ctx) => {

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -94,7 +94,8 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
   return defineWriteHandler<TName, typeof RequestTokenSchema, TokenRequestData<TSuccessKind>>({
     name: spec.handlerName,
     schema: RequestTokenSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Anonymous requester has no session — looks up the target user by email via " +

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -26,7 +26,8 @@ export function createVerifyEmailHandler(opts: VerifyEmailOptions) {
   return defineWriteHandler<"verify-email", typeof VerifyEmailSchema, VerifyEmailData>({
     name: "verify-email",
     schema: VerifyEmailSchema,
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +

package/src/auth-mfa/__tests__/no-redis.integration.test.ts

@@ -14,6 +14,7 @@ import {
   createTenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
+  createAnonymousUser,
   type SessionUser,
   SYSTEM_TENANT_ID,
   type TenantId,
@@ -45,14 +46,10 @@ const CHALLENGE_TOKEN_SECRET = "no-redis-test-challenge-token-secret-not-real-00
 const SETUP_TOKEN_SECRET = "no-redis-test-setup-token-secret-not-real-0002";
 const TENANT_ID: TenantId = testTenantId(421);
 
-// Mirrors framework's auth-routes.ts GUEST_USER — verify/enable-confirm-preauth
-// are guest-callable (access: { roles: ["all"] }), the real identity comes
+// Mirrors framework's auth-routes.ts anonymous dispatch — verify/enable-confirm-preauth
+// are guest-callable (access: { roles: ["anonymous"] }), the real identity comes
 // entirely from the signed token, not from this dispatch-level user.
-const GUEST_USER: SessionUser = {
-  id: "00000000-0000-0000-0000-000000000000",
-  tenantId: SYSTEM_TENANT_ID,
-  roles: ["all"],
-};
+const ANONYMOUS_USER: SessionUser = createAnonymousUser(SYSTEM_TENANT_ID);
 
 beforeAll(async () => {
   const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
@@ -125,7 +122,7 @@ describe("auth-mfa handlers — ctx.redis unset (#1467)", () => {
     const err = await stack.http.writeErr(
       AuthMfaHandlers.verify,
       { challengeToken: token, code: "123456" },
-      GUEST_USER,
+      ANONYMOUS_USER,
     );
     expect(err.httpStatus).toBeGreaterThanOrEqual(500);
     expect(err.code).toBe("internal_error");
@@ -148,7 +145,7 @@ describe("auth-mfa handlers — ctx.redis unset (#1467)", () => {
     const err = await stack.http.writeErr(
       AuthMfaHandlers.enableConfirmPreauth,
       { setupToken: token, code: "123456" },
-      GUEST_USER,
+      ANONYMOUS_USER,
     );
     expect(err.httpStatus).toBeGreaterThanOrEqual(500);
     expect(err.code).toBe("internal_error");

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -44,14 +44,14 @@ let stack: TestStack;
 const SETUP_TOKEN_SECRET = "test-mfa-setup-secret-at-least-32-bytes-long!!";
 const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
 
-// Handler access is `{ roles: ["all"] }`, matching how the framework route
-// dispatches with a guest identity — a literal here is enough since the
-// handler derives everything from the challenge-token payload, not from
-// event.user.
+// Handler access is `{ roles: ["anonymous"] }`, matching how the framework
+// route dispatches with the anonymous identity — a literal here is enough
+// since the handler derives everything from the challenge-token payload,
+// not from event.user.
 const GUEST: SessionUser = {
-  id: "00000000-0000-0000-0000-000000000000",
+  id: "anonymous",
   tenantId: "00000000-0000-4000-8000-000000000001" as TenantId,
-  roles: ["all"],
+  roles: ["anonymous"],
 };
 
 beforeAll(async () => {

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -63,7 +63,8 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       setupToken: z.string().min(1),
       code: z.string().length(6),
     }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.queryAs(SYSTEM, " +
@@ -86,7 +87,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       if (tenantId === undefined) return invalidSetupToken();
 
       // Fail closed: unlike verify.write.ts/enable-confirm.write.ts, this
-      // endpoint has NO gate before it (access: { roles: ["all"] }, no JWT,
+      // endpoint has NO gate before it (access: { roles: ["anonymous"] }, no JWT,
       // no prior challenge-token from a successful login) — its only secret
       // is a 6-digit TOTP code. Silently skipping the brute-force cap and
       // single-use burn when ctx.redis is absent would let the setup token

package/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -29,7 +29,8 @@ export type EnableStartPreauthOptions = {
 // preauthSetupToken (minted by login.write.ts when enforcement policy
 // blocks an unenrolled user), not from event.user — there is no session at
 // this point. Runs pre-session the same way verify.write.ts does (dispatched
-// by the framework's /auth/mfa/preauth-enable-start route with GUEST_USER).
+// by the framework's /auth/mfa/preauth-enable-start route with the
+// anonymous identity).
 export function createEnableStartPreauthHandler(opts: EnableStartPreauthOptions) {
   return defineWriteHandler({
     name: "enable-start-preauth",
@@ -37,7 +38,8 @@ export function createEnableStartPreauthHandler(opts: EnableStartPreauthOptions)
       preauthSetupToken: z.string().min(1),
       accountLabel: z.string().min(1).max(200),
     }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
     description:
       "Begins TOTP enrollment for a user whose sign-in was blocked because the tenant requires two-factor authentication, taking identity from the pre-auth token login issued instead of from a session.",
     // Same secret-bearing result as enable-start.

package/src/auth-mfa/handlers/verify.write.ts

@@ -35,7 +35,7 @@ const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
 });
 
 // Completes the two-step login. Runs pre-session (dispatched by the
-// framework's /auth/mfa/verify route with a guest identity, same as
+// framework's /auth/mfa/verify route with the anonymous identity, same as
 // login.write.ts) — everything it needs (which user, which tenant) comes
 // from the challenge token, not from an authenticated caller.
 export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
@@ -45,7 +45,8 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
   return defineWriteHandler({
     name: "verify",
     schema: z.object({ challengeToken: z.string().min(1), code: z.string().min(6).max(9) }),
-    access: { roles: ["all"] },
+    access: { roles: ["anonymous"] },
+    rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:
         "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +

package/src/auth-mfa/mfa-status-checker.ts

@@ -65,8 +65,8 @@ export function createMfaStatusChecker(opts: {
       return { required: true, challengeToken: token };
     }
 
-    // ctx.config is bound to the CALLING user's tenant (GUEST_USER for
-    // login) — wrong tenant here. ctx.configResolver takes tenantId
+    // ctx.config is bound to the CALLING user's tenant (the anonymous
+    // identity's tenant for login) — wrong tenant here. ctx.configResolver takes tenantId
     // explicitly, which is what a pre-session check against the LOGGING-IN
     // user's tenant needs.
     // @cast-boundary engine-payload — "select" config values are validated