@cosmicdrift/kumiko-bundled-features 0.306.0 → 0.307.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.306.0",
+  "version": "0.307.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -133,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.306.0",
-    "@cosmicdrift/kumiko-framework": "0.306.0",
-    "@cosmicdrift/kumiko-headless": "0.306.0",
-    "@cosmicdrift/kumiko-renderer": "0.306.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.306.0",
-    "@cosmicdrift/kumiko-types": "0.306.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.307.0",
+    "@cosmicdrift/kumiko-framework": "0.307.0",
+    "@cosmicdrift/kumiko-headless": "0.307.0",
+    "@cosmicdrift/kumiko-renderer": "0.307.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.307.0",
+    "@cosmicdrift/kumiko-types": "0.307.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.306.0",
-    "@cosmicdrift/kumiko-locale-es": "0.306.0",
+    "@cosmicdrift/kumiko-locale-de": "0.307.0",
+    "@cosmicdrift/kumiko-locale-es": "0.307.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.307.0",
+    "type": "improvement",
+    "title": "Anonymous signup-confirm and invite-signup-complete (auth-email-password) and verify / enable-confirm-preauth (auth-mfa) declare personalData: public-intake, since they write personal data through a TenantDb derived from ctx.db.unsafeRaw (fw#3185)"
+  },
   {
     "version": "0.305.0",
     "type": "breaking",

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -92,7 +92,7 @@ export function createInviteSignupCompleteHandler() {
   >({
     name: "invite-signup-complete",
     schema: InviteSignupCompleteSchema,
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -67,7 +67,7 @@ export function createSignupConfirmHandler() {
   return defineWriteHandler<"signup-confirm", typeof SignupConfirmSchema, SignupConfirmData>({
     name: "signup-confirm",
     schema: SignupConfirmSchema,
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {

package/src/auth-mfa/__tests__/session-scoped-sse-revoke.integration.test.ts

@@ -0,0 +1,270 @@
+// Session-scoped SSE revocation (kumiko-framework "session-scoped-revoke").
+//
+// enable-confirm (and disable/regenerate-recovery) call
+// sessionRevokeAllOthers, which appends sessions:event:session-revoked with
+// an optional `keptSessionId` set to the caller's own sid — the ONE sid this
+// write deliberately does NOT revoke. Before this fix,
+// createAccessInvalidationEventConsumer ignored that and called
+// sseBroker.publishAccessInvalidation USERWIDE, which closed the caller's
+// own just-opened SSE stream along with every other session's — the exact
+// bug this test proves fixed: studio's live MFA-status panel never saw the
+// state flip because its own stream died with everyone else's.
+//
+// This is a KEEP-list (spare exactly keptSessionId), not a kill-list
+// (scope to the revoked sessionIds) — the first test below proves why: a
+// third session (C) that was already logged out through the real
+// /api/auth/logout endpoint BEFORE enable-confirm runs never appears in any
+// session-revoked event's sessionIds (logout revokes via the raw
+// sessionRevoker callback with no event at all). A kill-list keyed on
+// sessionIds would silently leave C's still-open stream running; the
+// keep-list closes it like every other non-kept stream, exactly as the
+// pre-scoping userwide invalidation always did.
+//
+// Real stack throughout: setupTestStack + real HTTP (createLiveDispatcher for
+// the SSE streams, stack.http for the writes), never createTestDispatcher.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { z } from "zod";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { makeSessionHelpers } from "../../sessions/__tests__/test-helpers";
+import { createSessionsFeature } from "../../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
+import { createTenantFeature } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { bindMfaRevokeAllOtherSessionsFromFeature, createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const SETUP_TOKEN_SECRET = "test-mfa-setup-token-secret-at-least-32-bytes!!";
+const TENANT = testTenantId(1);
+
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  chunkGates.set(gateId, { promise, release });
+  return release;
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
+      yield { phase: "open" as const };
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
+      yield { phase: "survived" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(authJwt: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const cookieHeader = `kumiko_auth=${authJwt}; kumiko_csrf=${csrfToken}`;
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Cookie: cookieHeader,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+async function openProbeStream(token: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(token);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      mfaFeature,
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(callbacks.get().sessionRevokeAllOthers);
+
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  chunkGates.clear();
+});
+
+describe("session-scoped SSE revoke (enable-confirm keeps the caller's own stream open)", () => {
+  test("enable-confirm from session A keeps A's stream alive, closes B's, and also closes C's even though C was already logged out through the eventless /api/auth/logout path", async () => {
+    await h.seedUser("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionC = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+    const streamC = await openProbeStream(sessionC.token);
+
+    // C logs out through the REAL endpoint — sessionRevoker (session-
+    // callbacks.ts) revokes the row directly, no session-revoked event at
+    // all. C's sid therefore never appears in any later event's sessionIds.
+    const logoutRes = await h.authedPost("/api/auth/logout", sessionC.token);
+    expect(logoutRes.status).toBe(200);
+
+    const start = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableStart,
+      payload: { accountLabel: "mfa-scope-a@example.com" },
+    });
+    expect(start.status).toBe(200);
+    const startBody = (await start.json()) as {
+      data: { setupToken: string; otpauthUri: string };
+    };
+    const secretParam =
+      new URLSearchParams(startBody.data.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+
+    const confirm = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableConfirm,
+      payload: { setupToken: startBody.data.setupToken, code: currentTotpCode(secret) },
+    });
+    expect(confirm.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    // Assert B and C first, without releasing A's gate: their rejections are
+    // proof the publish already reached every listener (they fire from the
+    // same publish loop), so a still-pending A cannot pass "by being slow".
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamC.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    streamA.release();
+    const survivedChunk = await streamA.iter.next();
+    expect(survivedChunk.done).toBe(false);
+    expect(survivedChunk.value).toEqual({ phase: "survived" });
+  });
+
+  test("an invalidation reason with no keptSessionId (role change) still closes every session's stream, unscoped", async () => {
+    const { userId } = await h.seedUser("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    await expect(streamA.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+  });
+});

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -63,7 +63,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       setupToken: z.string().min(1),
       code: z.string().length(6),
     }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/auth-mfa/handlers/verify.write.ts

@@ -45,7 +45,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
   return defineWriteHandler({
     name: "verify",
     schema: z.object({ challengeToken: z.string().min(1), code: z.string().min(6).max(9) }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/cap-counter/__tests__/enforce-cap.test.ts

@@ -114,6 +114,13 @@ describe("enforceCap — burstable profile (mails / tokens)", () => {
     await expect(enforceCap(ctx, opts)).rejects.toThrow(CapExceededError);
   });
 
+  test("amount checks the last of the booked units: 1190 + 10 units passes, + 11 throws", async () => {
+    const ctx = stubCalendarCtx([{ value: 1190, lastSoftWarnedAt: null }]);
+    const passing = await enforceCap(ctx, { ...opts, amount: 10 });
+    expect(passing).toEqual({ state: "soft-hit", value: 1199, crossed: true });
+    await expect(enforceCap(ctx, { ...opts, amount: 11 })).rejects.toThrow(CapExceededError);
+  });
+
   test("CapExceededError carries cap-name + limit + currentValue", async () => {
     const ctx = stubCalendarCtx([{ value: 1500, lastSoftWarnedAt: null }]);
     try {

package/src/cap-counter/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.307.0",
+    "type": "improvement",
+    "title": "enforceCap accepts an amount for multi-unit bookings"
+  },
   {
     "version": "0.278.0",
     "type": "improvement",

package/src/cap-counter/enforce-cap.ts

@@ -93,6 +93,9 @@ export async function enforceCap(
     readonly periodStartIso: string;
     readonly limit: number;
     readonly profile: CapToleranceProfileName;
+    // Units the caller is about to book in one go (default 1), checked with
+    // the same outcome as booking them one by one.
+    readonly amount?: number;
   },
 ): Promise<EnforceCapResult> {
   if (!ctx.db) {
@@ -110,7 +113,9 @@ export async function enforceCap(
   );
 
   const row = rows[0];
-  const value = row ? (row["value"] as number) : 0; // @cast-boundary db-row
+  const storedValue = row ? (row["value"] as number) : 0; // @cast-boundary db-row
+  // The last of `amount` units sees this value before its own increment.
+  const value = storedValue + (options.amount ?? 1) - 1;
 
   if (value >= hardThreshold) {
     throw new CapExceededError(options.capName, options.limit, value, tolerance);
@@ -285,6 +290,7 @@ export async function enforceCapAndMaybeNotify(
     readonly limit: number;
     readonly profile: CapToleranceProfileName;
     readonly notify: SoftHitNotifier;
+    readonly amount?: number;
   },
 ): Promise<EnforceCapResult> {
   const result = await enforceCap(ctx, {
@@ -292,6 +298,7 @@ export async function enforceCapAndMaybeNotify(
     periodStartIso: options.periodStartIso,
     limit: options.limit,
     profile: options.profile,
+    ...(options.amount !== undefined && { amount: options.amount }),
   });
 
   if (result.state === "soft-hit" && result.crossed) {

package/src/sessions/handlers/revoke-all-others.write.ts

@@ -55,6 +55,7 @@ export const revokeAllOthersWrite = defineWriteHandler({
         payload: {
           userId: event.user.id,
           sessionIds: updated.map((row) => row.id),
+          keptSessionId: keepSid,
         },
       });
     }

package/src/sessions/session-callbacks.ts

@@ -244,6 +244,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
         const payload = sessionRevokedSchema.parse({
           userId,
           sessionIds: result.map((row: { id: string }) => row.id),
+          keptSessionId: currentSid,
         });
         await append(db, {
           aggregateId: generateId(),

package/src/sessions/session-revoked-event.ts

@@ -24,6 +24,9 @@ export const SESSION_REVOKED_AGGREGATE_TYPE = "user-session-revocation" as const
 export const sessionRevokedSchema = z.object({
   userId: z.string().min(1),
   sessionIds: z.array(z.uuid()).min(1),
+  // The caller's own session a "revoke all others" write spared. Optional so
+  // events appended before it existed still replay.
+  keptSessionId: z.uuid().optional(),
 });
 
 export type SessionRevokedPayload = z.infer<typeof sessionRevokedSchema>;

package/src/workflow-runner/__tests__/workflow-runner.integration.test.ts

@@ -187,6 +187,11 @@ describe("workflow-runner event-trigger", () => {
     // The registrar namespaces every MSP as `<feature>:projection:<name>`.
     const consumerName = `workflow-runner-integration-test-triggers:projection:workflow-${failingWorkflow.name}`;
 
+    // Consumers run their turns concurrently, so events an earlier test's
+    // workflow emitted may still be ahead of this consumer's cursor; drain
+    // them first so `processed` below counts only this test's trigger.
+    while (((await stack.eventDispatcher?.runOnce())?.processed ?? 0) > 0) {}
+
     await insertOne(stack.db, eventsTable, {
       aggregateId: crypto.randomUUID(),
       aggregateType: "wr-test-source",