@cosmicdrift/kumiko-bundled-features 0.319.0 → 0.321.0

package/src/auth-email-password/web/auth-client.ts

@@ -33,6 +33,9 @@ export type LoginResponse = {
     readonly tenantId: string;
     readonly roles: readonly string[];
   };
+  // Present only when the server's auth.postAuthLanding resolver returned a
+  // valid path — see auth-routes.ts. Screens prefer this over loggedInHref.
+  readonly landingPath?: string;
 };
 
 // Reason codes the login-handler is known to emit today (login-screen.tsx's
@@ -93,6 +96,14 @@ export type LoginResult =
   | { readonly kind: "mfa-setup-required"; readonly preauthSetupToken: string }
   | { readonly kind: "failure"; readonly error: LoginFailure };
 
+function toLoginResponse(
+  token: string,
+  user: LoginResponse["user"],
+  landingPath: unknown,
+): LoginResponse {
+  return typeof landingPath === "string" ? { token, user, landingPath } : { token, user };
+}
+
 // POST /api/auth/login. Success → token + user; MFA-enrolled user → a
 // challenge token the caller completes via auth-mfa's verify screen;
 // unenrolled user blocked by enforcement policy → mfa-setup-required;
@@ -118,6 +129,7 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
     challengeToken?: string;
     mfaSetupRequired?: boolean;
     preauthSetupToken?: string;
+    landingPath?: string;
     error?:
       | {
           code?: string;
@@ -140,7 +152,7 @@ export async function login(req: LoginRequest): Promise<LoginResult> {
       return { kind: "failure", error: { reason: "mfa_setup_required" } };
     }
     if (body.token !== undefined && body.user !== undefined) {
-      return { kind: "success", data: { token: body.token, user: body.user } };
+      return { kind: "success", data: toLoginResponse(body.token, body.user, body.landingPath) };
     }
   }
   // Der Server schickt error entweder als string ("invalid_body") oder als
@@ -343,6 +355,9 @@ export type SignupConfirmSuccess = {
   // Present only when a bound handover grant existed and its claim
   // succeeded — see signup-confirm.write.ts.
   readonly handover?: { readonly entityType: string; readonly id: string };
+  // Present only when the server's auth.postAuthLanding resolver returned a
+  // valid path — see auth-routes.ts.
+  readonly landingPath?: string;
 };
 
 export async function confirmSignup(

package/src/auth-email-password/web/auth-form-logic.ts

@@ -28,3 +28,13 @@ export function resolveLoggedInHref<Args>(
 ): string {
   return typeof href === "function" ? href(args) : href;
 }
+
+/** The server's `landingPath` (auth.postAuthLanding) wins over the screen's
+ *  loggedInHref prop — that prop is a deprecated per-app fallback. */
+export function resolvePostAuthHref<Args>(
+  landingPath: string | undefined,
+  href: string | ((args: Args) => string),
+  args: Args,
+): string {
+  return landingPath ?? resolveLoggedInHref(href, args);
+}

package/src/auth-email-password/web/invite-accept-screen.tsx

@@ -19,7 +19,7 @@
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useContext, useState } from "react";
 import { csrfHeader } from "./auth-client";
-import { resolveLoggedInHref } from "./auth-form-logic";
+import { resolvePostAuthHref } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 import { SessionContext, UNAUTHENTICATED } from "./session";
 
@@ -29,7 +29,9 @@ export type InviteAcceptScreenProps = {
   /** Where to redirect on success. Default "/" — multi-tenant apps can pass
    *  `(data) => "/${data.tenantId}/"`. Function-form receives the roles this
    *  flow grants in the target tenant; branch 1 reports the invitation's
-   *  role, which for an existing member is not their full role set there. */
+   *  role, which for an existing member is not their full role set there.
+   *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
+   *  Kept as fallback. */
   readonly loggedInHref?:
     | string
     | ((args: { tenantId: string; roles: readonly string[] }) => string);
@@ -46,6 +48,9 @@ type InviteAcceptResponse = {
   readonly tenantId: string;
   readonly role?: string;
   readonly user?: { readonly roles?: readonly string[] };
+  // Present only when the server's auth.postAuthLanding resolver returned a
+  // valid path — see auth-routes.ts.
+  readonly landingPath?: string;
 };
 
 function grantedRoles(data: InviteAcceptResponse): readonly string[] {
@@ -92,7 +97,7 @@ export function InviteAcceptScreen({
       // @cast-boundary engine-payload — auth route JSON
       const data = (await res.json()) as InviteAcceptResponse;
       window.location.assign(
-        resolveLoggedInHref(loggedInHref, {
+        resolvePostAuthHref(data.landingPath, loggedInHref, {
           tenantId: data.tenantId,
           roles: grantedRoles(data),
         }),
@@ -117,7 +122,7 @@ export function InviteAcceptScreen({
       // @cast-boundary engine-payload — auth route JSON
       const data = (await res.json()) as InviteAcceptResponse;
       window.location.assign(
-        resolveLoggedInHref(loggedInHref, {
+        resolvePostAuthHref(data.landingPath, loggedInHref, {
           tenantId: data.tenantId,
           roles: grantedRoles(data),
         }),
@@ -142,7 +147,7 @@ export function InviteAcceptScreen({
       // @cast-boundary engine-payload — auth route JSON
       const data = (await res.json()) as InviteAcceptResponse;
       window.location.assign(
-        resolveLoggedInHref(loggedInHref, {
+        resolvePostAuthHref(data.landingPath, loggedInHref, {
           tenantId: data.tenantId,
           roles: grantedRoles(data),
         }),

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -10,15 +10,17 @@
 // server-side token pass `token` as a prop instead.
 //
 // On success: shows a confirmation (account active, signed in) with a
-// button to loggedInHref, instead of navigating away immediately — the
-// server already logged the user in via cookies, but a silent redirect
-// leaves no signal that activation worked. Default pattern is "/" — apps
-// with multi-tenant routing pass `(data) => "/" + data.tenantKey + "/"`.
+// button to the continue target, instead of navigating away immediately —
+// the server already logged the user in via cookies, but a silent redirect
+// leaves no signal that activation worked. Server-side auth.postAuthLanding
+// (landingPath) wins over loggedInHref; loggedInHref is the deprecated
+// per-app fallback. Default pattern is "/" — apps with multi-tenant routing
+// pass `(data) => "/" + data.tenantKey + "/"`.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup, type SignupConfirmSuccess } from "./auth-client";
-import { passwordPairIssue, resolveLoggedInHref } from "./auth-form-logic";
+import { passwordPairIssue, resolvePostAuthHref } from "./auth-form-logic";
 import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
@@ -27,7 +29,9 @@ export type SignupCompleteScreenProps = {
   readonly token?: string;
   /** Where to send the user after activation. Function-form receives the tenantKey, the
    *  roles granted by this flow in that tenant, and the claimed `handover` entity when
-   *  signup claimed a try-first grant. Default "/". */
+   *  signup claimed a try-first grant. Default "/".
+   *  @deprecated Configure auth.postAuthLanding on the server; its landingPath wins.
+   *  Kept as fallback. */
   readonly loggedInHref?:
     | string
     | ((args: {
@@ -73,7 +77,7 @@ export function SignupCompleteScreen({
       // explicit continue button instead of navigating away silently —
       // the user otherwise gets no signal that activation worked.
       setContinueHref(
-        resolveLoggedInHref(loggedInHref, {
+        resolvePostAuthHref(res.data.landingPath, loggedInHref, {
           tenantKey: res.data.tenantKey,
           roles: res.data.user.roles,
           ...(res.data.handover !== undefined && { handover: res.data.handover }),

package/src/auth-mfa/web/mfa-client.ts

@@ -32,6 +32,7 @@ export async function verifyMfaChallenge(
     isSuccess?: boolean;
     token?: string;
     user?: LoginResponse["user"];
+    landingPath?: string;
     error?:
       | {
           code?: string;
@@ -41,7 +42,14 @@ export async function verifyMfaChallenge(
       | string;
   };
   if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
-    return { kind: "success", data: { token: body.token, user: body.user } };
+    return {
+      kind: "success",
+      data: {
+        token: body.token,
+        user: body.user,
+        ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
+      },
+    };
   }
   const err = body.error;
   if (typeof err === "string") {
@@ -156,6 +164,7 @@ export async function confirmMfaSetupPreauth(
     isSuccess?: boolean;
     token?: string;
     user?: LoginResponse["user"];
+    landingPath?: string;
     error?:
       | {
           code?: string;
@@ -165,7 +174,14 @@ export async function confirmMfaSetupPreauth(
       | string;
   };
   if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
-    return { kind: "success", data: { token: body.token, user: body.user } };
+    return {
+      kind: "success",
+      data: {
+        token: body.token,
+        user: body.user,
+        ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
+      },
+    };
   }
   const err = body.error;
   if (typeof err === "string") {

package/src/billing-foundation/__tests__/billing-plans.integration.test.ts

@@ -232,6 +232,7 @@ async function createSubscription(
     tier: string;
     providerSubscriptionId: string;
     providerCustomerId: string;
+    cancelAtIso: string | null;
   }> = {},
   onStack: TestStack = stack,
 ) {
@@ -247,6 +248,7 @@ async function createSubscription(
       status: overrides.status ?? SubscriptionStatuses.active,
       tier: overrides.tier ?? "starter",
       currentPeriodEndIso: "2026-06-01T00:00:00Z",
+      ...(overrides.cancelAtIso !== undefined && { cancelAtIso: overrides.cancelAtIso }),
       rawPayload: '{"raw":"payload"}',
     },
     admin,
@@ -503,6 +505,31 @@ describe("switch-plan", () => {
     expect(error.httpStatus).toBe(409);
   });
 
+  test("switching a subscription that is scheduled to cancel is a conflict, and the query offers unavailable instead of switch", async () => {
+    const admin = adminFor(7034);
+    await createSubscription(admin.tenantId, {
+      tier: "starter",
+      providerSubscriptionId: "sub_switch_7034",
+      cancelAtIso: "2026-07-01T00:00:00Z",
+    });
+
+    const result = (await stack.http.queryOk(
+      "billing-foundation:query:billing-plans",
+      {},
+      admin,
+    )) as { plans: Array<{ tier: string; action: string }> };
+    expect(result.plans.find((p) => p.tier === "pro")?.action).toBe("unavailable");
+
+    const error = await stack.http.writeErr(
+      SubscriptionFoundationHandlers.switchPlan,
+      { tier: "pro" },
+      admin,
+    );
+    expect(error.httpStatus).toBe(409);
+    expect(error.i18nKey).toBe("billing-foundation.errors.cancellationScheduled");
+    expect(switchCalls).toHaveLength(0);
+  });
+
   test("the provider rejecting the switch because two tiers share one Stripe product surfaces as a 422, not a 500", async () => {
     const admin = adminFor(7024);
     await createSubscription(admin.tenantId, {

package/src/billing-foundation/__tests__/checkout-core.test.ts

@@ -1,15 +1,18 @@
 import { describe, expect, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 // Aliased — an un-aliased `Temporal` would shadow the ambient global
 // `Temporal` TYPE `SubscriptionView.lastChangedAt` resolves against.
 import { Temporal as TemporalPolyfill } from "temporal-polyfill";
 import {
   assertRedirectOrigins,
+  isBillingEnabled,
   isNonEmptyStringArray,
   isOwnProviderCustomer,
   joinBaseUrl,
 } from "../checkout-core";
 import type { SubscriptionView } from "../get-subscription-for-tenant";
+import type { SubscriptionProviderPlugin } from "../types";
 
 function subscriptionView(overrides: Partial<SubscriptionView> = {}): SubscriptionView {
   return {
@@ -151,3 +154,35 @@ describe("isOwnProviderCustomer", () => {
     expect(isOwnProviderCustomer(subscriptionView(), "mock", "cus_own")).toBe(true);
   });
 });
+
+function fakeCtxWithProvider(
+  entries: ReadonlyArray<{ readonly entityName: string; readonly options: unknown }>,
+): HandlerContext {
+  return {
+    registry: {
+      getExtensionUsages: () => entries,
+    },
+  } as unknown as HandlerContext; // @cast-boundary test-fixture — only registry is exercised
+}
+
+describe("isBillingEnabled", () => {
+  test("false when no provider with that name is registered", async () => {
+    const ctx = fakeCtxWithProvider([]);
+    expect(await isBillingEnabled(ctx, "stripe")).toBe(false);
+  });
+
+  test("false when the registered plugin's own isBillingEnabled reports false", async () => {
+    const plugin: SubscriptionProviderPlugin = {
+      verifyAndParseWebhook: async () => null,
+      isBillingEnabled: async () => false,
+    };
+    const ctx = fakeCtxWithProvider([{ entityName: "stripe", options: plugin }]);
+    expect(await isBillingEnabled(ctx, "stripe")).toBe(false);
+  });
+
+  test("true when the registered plugin has no isBillingEnabled (defaults to enabled)", async () => {
+    const plugin: SubscriptionProviderPlugin = { verifyAndParseWebhook: async () => null };
+    const ctx = fakeCtxWithProvider([{ entityName: "stripe", options: plugin }]);
+    expect(await isBillingEnabled(ctx, "stripe")).toBe(true);
+  });
+});