@cosmicdrift/kumiko-bundled-features 0.319.0 → 0.321.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.319.0",
+  "version": "0.321.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -134,12 +134,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.319.0",
-    "@cosmicdrift/kumiko-framework": "0.319.0",
-    "@cosmicdrift/kumiko-headless": "0.319.0",
-    "@cosmicdrift/kumiko-renderer": "0.319.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.319.0",
-    "@cosmicdrift/kumiko-types": "0.319.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.321.0",
+    "@cosmicdrift/kumiko-framework": "0.321.0",
+    "@cosmicdrift/kumiko-headless": "0.321.0",
+    "@cosmicdrift/kumiko-renderer": "0.321.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.321.0",
+    "@cosmicdrift/kumiko-types": "0.321.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -168,8 +168,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.319.0",
-    "@cosmicdrift/kumiko-locale-es": "0.319.0",
+    "@cosmicdrift/kumiko-locale-de": "0.321.0",
+    "@cosmicdrift/kumiko-locale-es": "0.321.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/auth-tenants-rate-limit.integration.test.ts

@@ -50,6 +50,9 @@ beforeAll(async () => {
     rateLimit: {
       auth: { onFailClosed: () => {} },
     },
+    // Tests below assert the literal IP in the rate-limit bucket key, so the
+    // resolver needs a trusted hop to read x-forwarded-for at all.
+    trustedProxyHops: 1,
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/auth-email-password/__tests__/post-auth-landing.integration.test.ts

@@ -0,0 +1,321 @@
+// auth.postAuthLanding full-stack integration: login, signup-confirm, and
+// the invite-accept branches all consult the SAME resolver and thread the
+// same args through the real HTTP routes — plus the open-redirect / throw
+// protections from post-auth-landing.ts, proven through the wire instead of
+// just at the unit level.
+//
+// currentResolver is a module-local mutable slot behind one thin
+// authConfig.postAuthLanding indirection — beforeEach resets it to an
+// offlot-artige default rule; individual tests override it to capture args
+// or exercise the safety rails.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import type {
+  PostAuthLandingArgs,
+  PostAuthLandingResolver,
+} from "@cosmicdrift/kumiko-framework/api";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+import { seedUser } from "../seeding";
+
+const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+
+// offlot-style default rule: invite routes by the inviting tenant (not the
+// role); otherwise the highest role wins.
+function defaultResolver(args: PostAuthLandingArgs): string | undefined {
+  if (args.flow === "invite") return `/a/invited/${args.tenantId}`;
+  if (args.roles.includes("SystemAdmin")) return "/a/waitlist-list";
+  if (args.roles.includes("TenantAdmin") || args.roles.includes("Admin"))
+    return "/a/vehicle-create";
+  return "/a/profile";
+}
+
+let currentResolver: PostAuthLandingResolver = defaultResolver;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      signup: {
+        requestHandler: AuthHandlers.signupRequest,
+        confirmHandler: AuthHandlers.signupConfirm,
+      },
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+      postAuthLanding: (args) => currentResolver(args),
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  currentResolver = defaultResolver;
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const signupKeys = await stack.redis.redis.keys("signup:*");
+  if (signupKeys.length > 0) await stack.redis.redis.del(...signupKeys);
+  const inviteKeys = await stack.redis.redis.keys("invite:*");
+  if (inviteKeys.length > 0) await stack.redis.redis.del(...inviteKeys);
+});
+
+function newTenantId(): TenantId {
+  return crypto.randomUUID() as TenantId;
+}
+
+async function postLogin(email: string, password: string): Promise<Response> {
+  return stack.http.raw("POST", "/api/auth/login", { email, password });
+}
+
+async function seedTenantAdmin(
+  email: string,
+  password: string,
+  roles: readonly string[],
+): Promise<TenantId> {
+  const tenantId = newTenantId();
+  await seedTenant(stack.db, { id: tenantId, key: `tenant-${tenantId.slice(0, 8)}`, name: "T" });
+  const { id: userId } = await seedUser(stack.db, {
+    email,
+    displayName: "Landing Test User",
+    passwordHash: await hashPassword(password),
+    emailVerified: true,
+  });
+  await seedTenantMembership(stack.db, { userId, tenantId, roles: [...roles] });
+  return tenantId;
+}
+
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
+async function requestSignupAndCaptureToken(email: string): Promise<string> {
+  emailTransport.sent.length = 0;
+  const res = await stack.http.raw("POST", "/api/auth/signup-request", { email });
+  expect(res.status).toBe(200);
+  const sent = emailTransport.sent[0];
+  if (!sent) throw new Error("signup-request fixture didn't send mail");
+  return extractTokenFromMail(sent.html);
+}
+
+async function aliceSession(): Promise<{ session: SessionUser; tenantId: TenantId }> {
+  const tenantId = newTenantId();
+  await seedTenant(stack.db, {
+    id: tenantId,
+    key: `tenant-alice-${tenantId.slice(0, 8)}`,
+    name: "A",
+  });
+  const { id: userId } = await seedUser(stack.db, {
+    email: "alice-landing@example.com",
+    displayName: "Alice",
+    passwordHash: await hashPassword("alice-landing-pw-1234"),
+    emailVerified: true,
+  });
+  await seedTenantMembership(stack.db, { userId, tenantId, roles: ["Admin"] });
+  return { session: { id: userId, tenantId, roles: ["Admin"] }, tenantId };
+}
+
+async function inviteEmail(admin: SessionUser, email: string, role: string): Promise<string> {
+  await stack.http.writeOk(AuthHandlers.inviteCreate, { email, role }, admin);
+  const sent = emailTransport.sent.at(-1);
+  if (!sent) throw new Error("invite-create didn't send a mail");
+  return extractTokenFromMail(sent.html);
+}
+
+describe("login", () => {
+  test("TenantAdmin role → /a/vehicle-create", async () => {
+    await seedTenantAdmin("landing-tenantadmin@example.com", "landing-pw-1234", ["TenantAdmin"]);
+    const res = await postLogin("landing-tenantadmin@example.com", "landing-pw-1234");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { landingPath?: string };
+    expect(body.landingPath).toBe("/a/vehicle-create");
+  });
+
+  test("plain User role → /a/profile", async () => {
+    await seedTenantAdmin("landing-user@example.com", "landing-pw-1234", ["User"]);
+    const res = await postLogin("landing-user@example.com", "landing-pw-1234");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { landingPath?: string };
+    expect(body.landingPath).toBe("/a/profile");
+  });
+});
+
+describe("signup-confirm", () => {
+  test("INITIAL_SIGNUP_ROLES path with tenantKey passed to resolver", async () => {
+    let receivedArgs: PostAuthLandingArgs | undefined;
+    currentResolver = (args) => {
+      receivedArgs = args;
+      return defaultResolver(args);
+    };
+
+    const token = await requestSignupAndCaptureToken("landing-signup@example.com");
+    const res = await stack.http.raw("POST", "/api/auth/signup-confirm", {
+      token,
+      password: "landing-signup-pw-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { tenantKey?: string; landingPath?: string };
+
+    // INITIAL_SIGNUP_ROLES grants TenantAdmin → same branch as the login test.
+    expect(body.landingPath).toBe("/a/vehicle-create");
+    expect(receivedArgs?.flow).toBe("signup");
+    expect(receivedArgs?.tenantKey).toBe(body.tenantKey);
+  });
+});
+
+describe("invite", () => {
+  test("invite-signup-complete (Branch 3) → /a/invited/<tenantId>", async () => {
+    const { session } = await aliceSession();
+    const token = await inviteEmail(session, "landing-invite-new@example.com", "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "landing-invite-pw-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { tenantId?: string; landingPath?: string };
+    expect(body.landingPath).toBe(`/a/invited/${body.tenantId}`);
+  });
+
+  test("invite-accept-with-login (Branch 2) → /a/invited/<tenantId> — uses the invited tenant, not the acceptor's own", async () => {
+    const { session } = await aliceSession();
+    const bobTenantId = await seedTenantAdmin(
+      "landing-invite-bob@example.com",
+      "landing-bob-pw-1234",
+      ["User"],
+    );
+    const token = await inviteEmail(session, "landing-invite-bob@example.com", "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: "landing-invite-bob@example.com",
+      password: "landing-bob-pw-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { tenantId?: string; landingPath?: string };
+    expect(body.tenantId).not.toBe(bobTenantId);
+    expect(body.landingPath).toBe(`/a/invited/${body.tenantId}`);
+  });
+});
+
+describe("open-redirect / throwing resolver protections", () => {
+  const unsafeCandidates: ReadonlyArray<[string, string]> = [
+    ["protocol-relative", "//evil.com"],
+    ["absolute URL", "https://evil.com"],
+    ["backslash", "/\\evil.com"],
+    ["empty string", ""],
+  ];
+
+  for (const [label, candidate] of unsafeCandidates) {
+    test(`${label} candidate → login stays 200 with token, landingPath omitted`, async () => {
+      currentResolver = () => candidate;
+      await seedTenantAdmin("landing-unsafe@example.com", "landing-unsafe-pw-1234", ["User"]);
+
+      const res = await postLogin("landing-unsafe@example.com", "landing-unsafe-pw-1234");
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { token?: string; landingPath?: string };
+      expect(body.token).toBeTruthy();
+      expect(res.headers.get("set-cookie") ?? "").toContain("kumiko_auth=");
+      expect(body).not.toHaveProperty("landingPath");
+    });
+  }
+
+  test("rejecting async resolver → login stays 200 with token, landingPath omitted", async () => {
+    // @cast-boundary test — simulates a JS consumer bypassing the sync signature
+    currentResolver = (async () => {
+      throw new Error("boom");
+    }) as unknown as PostAuthLandingResolver;
+    await seedTenantAdmin("landing-async@example.com", "landing-async-pw-1234", ["User"]);
+
+    const res = await postLogin("landing-async@example.com", "landing-async-pw-1234");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { token?: string; landingPath?: string };
+    expect(body.token).toBeTruthy();
+    expect(body).not.toHaveProperty("landingPath");
+  });
+
+  test("throwing resolver → login stays 200 with token, landingPath omitted", async () => {
+    currentResolver = () => {
+      throw new Error("boom");
+    };
+    await seedTenantAdmin("landing-throw@example.com", "landing-throw-pw-1234", ["User"]);
+
+    const res = await postLogin("landing-throw@example.com", "landing-throw-pw-1234");
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { token?: string; landingPath?: string };
+    expect(body.token).toBeTruthy();
+    expect(res.headers.get("set-cookie") ?? "").toContain("kumiko_auth=");
+    expect(body).not.toHaveProperty("landingPath");
+  });
+});

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -96,6 +96,10 @@ beforeAll(async () => {
     rateLimit: {
       auth: { limit: 2, windowSeconds: 60, onFailClosed: () => {} },
     },
+    // Tests below rely on distinct per-test IPs to keep buckets from
+    // cross-contaminating, so the resolver needs a trusted hop to read
+    // x-forwarded-for at all.
+    trustedProxyHops: 1,
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -115,6 +115,10 @@ beforeAll(async () => {
       sessionCreator: callbacks.sessionCreator,
       sessionRevoker: callbacks.sessionRevoker,
     },
+    // "login wires into sessionCreator" below asserts the literal ip stored
+    // by sessionCreator, so the resolver needs a trusted hop to read
+    // x-forwarded-for at all.
+    trustedProxyHops: 1,
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -149,6 +149,15 @@ beforeAll(async () => {
         confirmHandler: AuthHandlers.signupConfirm,
       },
     },
+    // signup-request declares rateLimit: { per: "ip+handler", limit: 10 }.
+    // Since e7bf543ad, an unset socket address resolves to the shared
+    // "unknown" IP rather than skipping the bucket — every postSignupRequest
+    // call in this file (14+ across all tests) would otherwise collapse
+    // into that one 10/60s bucket and fail later tests with rate_limited,
+    // regardless of the test's own scenario. trustedProxyHops: 1 lets
+    // postSignupRequest hand each distinct signup its own resolved IP via
+    // X-Forwarded-For, mirroring distinct real callers instead of one.
+    trustedProxyHops: 1,
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
@@ -186,7 +195,15 @@ async function postSignupRequest(
   email: string,
   headers?: Record<string, string>,
 ): Promise<Response> {
-  return stack.http.raw("POST", "/api/auth/signup-request", { email }, headers);
+  // Distinct email → distinct resolved IP (trustedProxyHops: 1 above), so
+  // each test's own signup-request calls land in their own rate-limit
+  // bucket instead of sharing the file-wide "unknown" one.
+  return stack.http.raw(
+    "POST",
+    "/api/auth/signup-request",
+    { email },
+    { "x-forwarded-for": email, ...headers },
+  );
 }
 
 async function postSignupConfirm(token: string, password: string): Promise<Response> {
@@ -273,6 +290,9 @@ describe("POST /api/auth/signup-confirm", () => {
     expect(body.user?.tenantId).toBeTruthy();
     expect(body.user?.roles).toContain("TenantAdmin");
     expect(body.tenantKey).toBeTruthy();
+    // No auth.postAuthLanding configured on this stack — the field must be
+    // absent entirely, not `landingPath: undefined`.
+    expect(body).not.toHaveProperty("landingPath");
 
     // Cookies gesetzt (auth + csrf)
     const setCookies = confirmRes.headers.get("set-cookie") ?? "";

package/src/auth-email-password/__tests__/signup-handover.integration.test.ts

@@ -143,6 +143,11 @@ beforeAll(async () => {
         requestHandler: AuthHandlers.signupRequest,
         confirmHandler: AuthHandlers.signupConfirm,
       },
+      // Pins that a claimed handover grant reaches the resolver's `handover`
+      // arg — the offlot-style rule this mirrors routes a claimed run to a
+      // dedicated landing page, everything else to the generic profile.
+      postAuthLanding: ({ handover }) =>
+        handover !== undefined ? `/a/run/${encodeURIComponent(handover.id)}` : "/a/profile",
     },
   });
 
@@ -273,11 +278,13 @@ describe("cross-device try-first handover :: signup-request + signup-confirm", (
     const body = (await confirmRes.json()) as {
       user?: { id: string; tenantId: string };
       handover?: { entityType: string; id: string };
+      landingPath?: string;
     };
     const destinationTenantId = body.user?.tenantId;
     if (!destinationTenantId) throw new Error("confirm did not return a tenantId");
 
     expect(body.handover).toEqual({ entityType: "run", id: runId });
+    expect(body.landingPath).toBe(`/a/run/${runId}`);
     expect(await readTenantId("signup_handover_run", runId)).toBe(destinationTenantId);
     expect(await readTenantId("signup_handover_photo", photoId)).toBe(destinationTenantId);
 
@@ -320,10 +327,13 @@ describe("cross-device try-first handover :: signup-request + signup-confirm", (
       token?: string;
       user?: { id: string; tenantId: string };
       handover?: { entityType: string; id: string };
+      landingPath?: string;
     };
     expect(body.isSuccess).toBe(true);
     expect(body.token).toBeTruthy();
     expect(body.handover).toBeUndefined();
+    // No claim landed → resolver's `handover` arg is undefined → generic path.
+    expect(body.landingPath).toBe("/a/profile");
 
     // Account/login for the signup still works — a failed claim redeem
     // must never fail the signup itself.

package/src/auth-email-password/auth-paths.ts

@@ -2,22 +2,26 @@
 // resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
 // the handlers append `?token=…` and mail via delivery (ctx.notify).
 
+/** A plain path, or a function picking the path per resolved mail locale
+ *  (e.g. `/en/reset-password`, `/de/reset-password`). */
+export type AuthPath = string | ((locale: string) => string);
+
 /** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
 export type AuthPaths = {
-  readonly resetPassword: string;
-  readonly verifyEmail: string;
-  readonly signupComplete: string;
-  readonly inviteAccept: string;
+  readonly resetPassword: AuthPath;
+  readonly verifyEmail: AuthPath;
+  readonly signupComplete: AuthPath;
+  readonly inviteAccept: AuthPath;
 };
 
 /** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
  *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
-export const DEFAULT_AUTH_PATHS: AuthPaths = {
+export const DEFAULT_AUTH_PATHS = {
   resetPassword: "/reset-password",
   verifyEmail: "/verify-email",
   signupComplete: "/signup/complete",
   inviteAccept: "/invite/accept",
-};
+} as const satisfies AuthPaths;
 
 export function makeAuthPaths(overrides: Partial<AuthPaths> = {}): AuthPaths {
   return { ...DEFAULT_AUTH_PATHS, ...overrides };

package/src/auth-email-password/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.320.0",
+    "type": "fix",
+    "title": "AuthPaths entries accept a locale function, not just a plain path",
+    "detail": "AuthPaths (and DEFAULT_AUTH_PATHS/makeAuthPaths) previously typed every entry as a plain string, so an app needing a locale-in-path reset link (/de/reset-password) had to set auth.passwordReset explicitly instead of auth.mail.paths — and since that block requires its own hmacSecret, the app ended up threading its own secret instead of the one auth.mail resolves, decoupling reset-token signing from that secret's rotation. Each AuthPaths entry now accepts a plain path or a (locale) => path function, mirroring the appUrl shape every flow's options already take, so a locale-aware reset link needs only auth.mail.paths.resetPassword, never a hand-rolled passwordReset block."
+  },
+  {
+    "version": "0.320.0",
+    "type": "improvement",
+    "title": "auth routes return a server-computed landingPath from auth.postAuthLanding",
+    "detail": "`AuthRoutesConfig.postAuthLanding` lets an app resolve, in one server-side place, where a user lands after auth instead of every frontend screen re-deriving it from roles/tenantId. The resolver runs for login, mfa-verify, mfa-preauth-confirm, signup-confirm, and all three invite-accept branches, and its result is validated (root-relative only, no protocol-relative/backslash/control-character paths, no cross-origin resolution) before it is ever added to the response as `landingPath`. An invalid path or a throwing resolver just omits the field — auth never fails because of it.\n`run-prod-app`'s and `run-dev-app`'s auth options now accept `postAuthLanding` and thread it through to the framework config unchanged.\n`SignupCompleteScreen` and `InviteAcceptScreen` now prefer the server's `landingPath` over their `loggedInHref` prop, which becomes a deprecated per-app fallback for apps that haven't configured a resolver yet.\nCloses #3320."
+  },
   {
     "version": "0.314.0",
     "type": "improvement",

package/src/auth-email-password/index.ts

@@ -6,7 +6,7 @@
 // hashPassword/verifyPassword; removing it is a breaking change that needs
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing";
-export { type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
+export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants";
 // Renderers for the auth mails. All four magic-link flows (reset, verify,
 // signup-activation, invite) emit structured AuthMailContent through delivery

package/src/auth-email-password/web/__tests__/auth-form-logic.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { passwordPairIssue, resolveLoggedInHref, retryAfterMinutes } from "../auth-form-logic";
+import {
+  passwordPairIssue,
+  resolveLoggedInHref,
+  resolvePostAuthHref,
+  retryAfterMinutes,
+} from "../auth-form-logic";
 
 describe("passwordPairIssue", () => {
   test("too_short when under min length", () => {
@@ -71,3 +76,31 @@ describe("resolveLoggedInHref", () => {
     ).toBe("/t1/Editor");
   });
 });
+
+describe("resolvePostAuthHref", () => {
+  type SignupArgs = { tenantKey: string; roles: readonly string[] };
+
+  test("server landingPath wins over loggedInHref", () => {
+    expect(
+      resolvePostAuthHref<SignupArgs>("/a/vehicle-create", "/", {
+        tenantKey: "acme",
+        roles: ["User"],
+      }),
+    ).toBe("/a/vehicle-create");
+  });
+
+  test("undefined landingPath falls back to loggedInHref (string form)", () => {
+    expect(
+      resolvePostAuthHref<SignupArgs>(undefined, "/fixed", { tenantKey: "acme", roles: [] }),
+    ).toBe("/fixed");
+  });
+
+  test("undefined landingPath falls back to loggedInHref (function form)", () => {
+    expect(
+      resolvePostAuthHref<SignupArgs>(undefined, ({ tenantKey }) => `/${tenantKey}/`, {
+        tenantKey: "acme",
+        roles: [],
+      }),
+    ).toBe("/acme/");
+  });
+});

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -121,6 +121,36 @@ describe("InviteAcceptScreen — logged-in branch", () => {
     });
   });
 
+  test("server landingPath gewinnt über loggedInHref", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            tenantId: "tenant-new",
+            role: "Dealer",
+            alreadyMember: false,
+            landingPath: "/a/vehicle-create",
+          }),
+          { status: 200 },
+        ),
+    ) as unknown as typeof fetch;
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+
+    renderWithProviders(
+      <InviteAcceptScreen token="tok-123" loggedInHref={({ tenantId }) => `/${tenantId}/home`} />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Accept" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/a/vehicle-create");
+    });
+  });
+
   test("String-Form bleibt unverändert gültig", async () => {
     const assign = mock<(url: string) => void>();
     Object.defineProperty(window, "location", {

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -245,6 +245,32 @@ describe("SignupCompleteScreen", () => {
     expect(receivedArgs).toStrictEqual({ tenantKey: "acme", roles: ["User"] });
   });
 
+  test("server landingPath gewinnt über loggedInHref", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["User"] },
+            tenantKey: "acme",
+            landingPath: "/a/vehicle-create",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(
+      <SignupCompleteScreen token="abc-token" loggedInHref={({ tenantKey }) => `/${tenantKey}/`} />,
+    );
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Activate account" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("link", { name: "Continue" }).getAttribute("href")).toBe(
+        "/a/vehicle-create",
+      );
+    });
+  });
+
   test("mismatch → client-side error, kein fetch-Call", async () => {
     const fetchMock = mock(async () => new Response(null, { status: 200 }));
     globalThis.fetch = fetchMock as unknown as typeof fetch;