@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -20,18 +20,14 @@
 // stays always-200 + resend-idempotent so the request path leaks nothing;
 // suppressing the link on the request side would be defense-in-depth, but
 // with an enumeration risk of its own (separate concern).
-import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { findSignupHandoverProvider } from "../../shared/index.js";
-import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants.js";
-import { renderActivationEmail } from "../email-templates.js";
-import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
+import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
-import { invalidateExistingSignupToken, normalizeEmail, storeSignupHandover, storeSignupToken, takeOverSignupHandoverForResend, } from "../signup-token-store.js";
-const SIGNUP_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+import { issueSignupActivation } from "../signup-activation.js";
+import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.js";
 const SignupRequestSchema = z.object({
     email: z.email(),
     // Cross-device try-first handover (kumiko-framework#3035 follow-up,
@@ -47,8 +43,6 @@ const SignupRequestSchema = z.object({
 });
 const HANDOVER_GRANT_VERIFY_REASON = "verifies a tenant-handover grant against its root row in the source tenant (read-only anchor lookup) before binding it to the signup token";
 export function createSignupRequestHandler(opts) {
-    const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES;
-    const ttlSeconds = ttlMinutes * 60;
     return defineWriteHandler({
         name: "signup-request",
         schema: SignupRequestSchema,
@@ -93,84 +87,64 @@ export function createSignupRequestHandler(opts) {
             // the visitor just retyped their email) must still carry the earlier
             // verified grant over to the new token instead of silently dropping it.
             const priorBinding = await takeOverSignupHandoverForResend(ctx.redis, email);
-            // At most one live signup token per email: invalidate whatever's
-            // there before minting the new one (see signup-token-store.ts).
-            await invalidateExistingSignupToken(ctx.redis, email);
-            // 32 random bytes = 256 bits unguessable randomness, base64url
-            // encoded to 43 chars. Math.random used to be a bug here:
-            // xorshift128+ has ~128 bits of state that's reconstructible after
-            // ~5 observed outputs — an attacker could trigger their own
-            // signup-requests and predict other users' tokens. generateToken
-            // uses randomBytes from node:crypto, the same source as CSRF/
-            // session tokens.
-            const token = generateToken();
-            const issuedAt = Temporal.Now.instant();
-            const expiresAt = issuedAt.add({ seconds: ttlSeconds });
-            const expiresAtIso = expiresAt.toString();
-            await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
-            // A handover grant in this request re-verifies and replaces the prior
-            // binding; anything short of a fresh, verified grant (no provider
-            // mounted, or verification failed) falls back to it instead —
-            // dropping a still-live binding on a bad request would strand the
-            // visitor's run. A throw here must never skip the mail below, or the
-            // signup itself silently breaks for a bug in a provider this handler
-            // doesn't own.
-            let binding = priorBinding;
-            if (event.payload.handover) {
-                const { entityType, token: grantToken } = event.payload.handover;
-                const provider = findSignupHandoverProvider(ctx.registry);
-                if (!provider) {
-                    ctx.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
-                }
-                else {
-                    try {
-                        const verified = await provider.verifyGrant({
-                            db: ctx.db.unsafeRaw(),
-                            registry: ctx.registry,
-                            entityType,
-                            token: grantToken,
-                        });
-                        if (verified) {
-                            binding = verified;
+            const locale = resolveHandlerMailLocale(ctx, opts.locale);
+            const redis = ctx.redis;
+            const issued = await issueSignupActivation({
+                redis,
+                notify: ctx.notify,
+                email,
+                appUrl: opts.appUrl,
+                timeZone: ctx.tz.user,
+                ...(opts.tokenTtlMinutes !== undefined && { tokenTtlMinutes: opts.tokenTtlMinutes }),
+                ...(opts.appName !== undefined && { appName: opts.appName }),
+                ...(locale !== undefined && { locale }),
+                // A handover grant in this request re-verifies and replaces the prior
+                // binding; anything short of a fresh, verified grant (no provider
+                // mounted, or verification failed) falls back to it instead —
+                // dropping a still-live binding on a bad request would strand the
+                // visitor's run. A throw here must never skip the mail, or the
+                // signup itself silently breaks for a bug in a provider this handler
+                // doesn't own.
+                onTokenStored: async ({ token, ttlSeconds }) => {
+                    let binding = priorBinding;
+                    if (event.payload.handover) {
+                        const { entityType, token: grantToken } = event.payload.handover;
+                        const provider = findSignupHandoverProvider(ctx.registry);
+                        if (!provider) {
+                            ctx.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
                         }
                         else {
-                            ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                            try {
+                                const verified = await provider.verifyGrant({
+                                    db: ctx.db.unsafeRaw(),
+                                    registry: ctx.registry,
+                                    entityType,
+                                    token: grantToken,
+                                });
+                                if (verified) {
+                                    binding = verified;
+                                }
+                                else {
+                                    ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                                }
+                            }
+                            catch {
+                                ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                            }
                         }
                     }
-                    catch {
-                        ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                    if (binding) {
+                        await storeSignupHandover(redis, { token, binding, ttlSeconds });
                     }
-                }
-            }
-            if (binding) {
-                await storeSignupHandover(ctx.redis, { token, binding, ttlSeconds });
-            }
-            // normalizeEmail from the store — one source of truth for
-            // normalization; the delivery recipient + lookup path consistently
-            // get the same format.
-            const normalizedEmail = normalizeEmail(email);
-            const locale = resolveHandlerMailLocale(ctx, opts.locale);
-            await dispatchMagicLinkMail(ctx.notify, {
-                handlerName: "signup-request",
-                notificationType: SIGNUP_NOTIFICATION_TYPE,
-                renderContent: renderActivationEmail,
-            }, {
-                email: normalizedEmail,
-                appUrl: opts.appUrl,
-                token,
-                expiresAt: expiresAtIso,
-                issuedAt: issuedAt.toString(),
-                timeZone: ctx.tz.user,
-                ...(opts.appName !== undefined && { appName: opts.appName }),
-                locale,
+                },
             });
             return {
                 isSuccess: true,
                 data: {
                     kind: "signup-requested",
-                    email: normalizedEmail,
-                    token,
-                    expiresAt: expiresAtIso,
+                    email: issued.email,
+                    token: issued.token,
+                    expiresAt: issued.expiresAt,
                 },
             };
         },

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -35,6 +35,7 @@ export function createTokenRequestHandler(spec, opts) {
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +
                 "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
         },

package/dist/auth-email-password/handlers/verify-email.write.js

@@ -21,6 +21,7 @@ export function createVerifyEmailHandler(opts) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
                 "target user via ctx.writeAs(SYSTEM, user:update) to set emailVerified.",
         },

package/dist/auth-email-password/index.d.ts

@@ -9,3 +9,5 @@ export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOpti
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.js";
+export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
+export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/index.js

@@ -17,3 +17,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 // statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
 // Cross-Replay zwischen Flows.
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
+export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
+export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/seeding.d.ts

@@ -64,6 +64,8 @@ export type ProvisionSignupAccountOptions = {
     readonly tenantName: string;
     readonly tenantId: TenantId;
     readonly memberRoles?: readonly string[];
+    /** Stored on the new user row so the first session already carries the locale claim. */
+    readonly locale?: string;
 };
 export declare function provisionSignupAccount(db: DbConnection, options: ProvisionSignupAccountOptions, hooks?: SeedTenantHooks): Promise<{
     readonly userId: string;

package/dist/auth-email-password/seeding.js

@@ -14,6 +14,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredBlindIndexKey, configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { ConflictError } from "@cosmicdrift/kumiko-framework/errors";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { hashPassword } from "../shared/index.js";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
@@ -21,7 +22,8 @@ import { seedTenant, seedTenantMembership } from "../tenant/seeding.js";
 // kumiko-lint-ignore cross-feature-import signup create-only guard reads the user projection by email
 import { USER_STATUS, userTable } from "../user/schema/user.js";
 // kumiko-lint-ignore cross-feature-import auth-tests need user+tenant seed-helpers
-import { reconcileSeededUserEmailVerified, seedUser } from "../user/seeding.js";
+import { reconcileSeededUserEmailVerified, rewriteSeededUserEmail, seedUser, } from "../user/seeding.js";
+const log = createFallbackLogger("auth-email-password-seeding");
 // Re-export für ergonomische Single-Import-Site in tests/seed-scripts.
 // Das Auth-Feature ist der natürliche Aufrufer für "seed admin user mit
 // password + tenant + membership" — wer das nutzt soll nicht aus drei
@@ -114,6 +116,7 @@ hooks) {
         password: options.password,
         displayName: options.displayName,
         emailVerified: true,
+        ...(options.locale !== undefined && { locale: options.locale }),
     }, hooks);
     await seedTenantMembership(db, {
         userId,
@@ -186,16 +189,30 @@ async function findExistingUserIdForEmail(db, kms, email) {
         status: { ne: USER_STATUS.Deleted },
     });
     const matches = [];
+    let undecryptableRows = 0;
     for (const row of rows) {
         // Compared byte-exact, deliberately not case-folded: email_bidx is an
         // HMAC over the raw value and login matches case-sensitively, so a case
         // variant is a different account to every other code path.
-        const decrypted = await decryptPiiFieldValues({ email: row.email }, ["email"], kms, {
-            requestId: "seed-admin-guarded",
-        });
+        // One undecryptable foreign row (missing key row, ciphertext from another
+        // KMS store) must not abort the boot seed: the account we look for is
+        // decryptable by definition.
+        let decrypted;
+        try {
+            decrypted = await decryptPiiFieldValues({ email: row.email }, ["email"], kms, {
+                requestId: "seed-admin-guarded",
+            });
+        }
+        catch {
+            undecryptableRows += 1;
+            continue;
+        }
         if (decrypted["email"] === email)
             matches.push(row);
     }
+    if (undecryptableRows > 0) {
+        log.warn(`seedAdminGuarded: skipped ${undecryptableRows} user row(s) whose email could not be decrypted`);
+    }
     return matches.length === 0 ? undefined : pickCanonicalUserId(matches);
 }
 /**
@@ -225,10 +242,15 @@ export async function seedAdminGuarded(db, options) {
     if (existingId === undefined)
         return seedAdmin(db, options);
     const by = options.by ?? TestUsers.systemAdmin;
-    if (options.emailVerified === true) {
-        const existingRow = await fetchOne(db, userTable, { id: existingId });
-        if (existingRow)
-            await reconcileSeededUserEmailVerified(db, existingRow, by);
+    const existingRow = await fetchOne(db, userTable, { id: existingId });
+    if (existingRow) {
+        // Re-write the email so email_bidx is recomputed; without it the account
+        // stays unfindable for login and every boot re-scans the whole table.
+        await rewriteSeededUserEmail(db, existingRow, options.email, by);
+        if (options.emailVerified === true) {
+            const refreshed = (await fetchOne(db, userTable, { id: existingId })) ?? existingRow;
+            await reconcileSeededUserEmailVerified(db, refreshed, by);
+        }
     }
     for (const m of options.memberships) {
         await seedTenant(db, { id: m.tenantId, key: m.tenantKey, name: m.tenantName, by });

package/dist/auth-email-password/signup-activation.d.ts

@@ -0,0 +1,24 @@
+import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
+import type { Redis } from "ioredis";
+export declare const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+export type IssueSignupActivationArgs = {
+    readonly redis: Redis;
+    readonly notify: NotifyFn | undefined;
+    readonly email: string;
+    readonly appUrl: string | ((locale: string) => string);
+    readonly appName?: string;
+    readonly locale?: string;
+    readonly timeZone?: string;
+    readonly tokenTtlMinutes?: number;
+    /** Runs after the token is stored and before the mail goes out. */
+    readonly onTokenStored?: (stored: {
+        readonly token: string;
+        readonly ttlSeconds: number;
+    }) => Promise<void>;
+};
+export type IssuedSignupActivation = {
+    readonly email: string;
+    readonly token: string;
+    readonly expiresAt: string;
+};
+export declare function issueSignupActivation(args: IssueSignupActivationArgs): Promise<IssuedSignupActivation>;

package/dist/auth-email-password/signup-activation.js

@@ -0,0 +1,41 @@
+// Mints a signup activation link: invalidates any live token for the email,
+// stores a fresh one and mails the activation link. Shared by the
+// signup-request handler and by apps that issue the same link from their own
+// flow (e.g. a waitlist invite), so TTL, store keys and notification type
+// cannot drift between the two.
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./constants.js";
+import { renderActivationEmail } from "./email-templates.js";
+import { dispatchMagicLinkMail } from "./magic-link-mail.js";
+import { invalidateExistingSignupToken, normalizeEmail, storeSignupToken, } from "./signup-token-store.js";
+export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+export async function issueSignupActivation(args) {
+    const ttlSeconds = (args.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES) * 60;
+    // At most one live signup token per email.
+    await invalidateExistingSignupToken(args.redis, args.email);
+    // 256 bits from node:crypto — never Math.random: xorshift128+ state is
+    // reconstructible from a few observed outputs, which would let an attacker
+    // predict other users' tokens.
+    const token = generateToken();
+    const issuedAt = Temporal.Now.instant();
+    const expiresAt = issuedAt.add({ seconds: ttlSeconds }).toString();
+    await storeSignupToken(args.redis, { email: args.email, token, ttlSeconds });
+    await args.onTokenStored?.({ token, ttlSeconds });
+    const email = normalizeEmail(args.email);
+    await dispatchMagicLinkMail(args.notify, {
+        handlerName: "signup-request",
+        notificationType: SIGNUP_ACTIVATION_NOTIFICATION_TYPE,
+        renderContent: renderActivationEmail,
+    }, {
+        email,
+        appUrl: args.appUrl,
+        token,
+        expiresAt,
+        issuedAt: issuedAt.toString(),
+        ...(args.timeZone !== undefined && { timeZone: args.timeZone }),
+        ...(args.appName !== undefined && { appName: args.appName }),
+        ...(args.locale !== undefined && { locale: args.locale }),
+    });
+    return { email, token, expiresAt };
+}

package/dist/auth-email-password/signup-token-store.d.ts

@@ -5,6 +5,11 @@ import { type SignupHandoverBinding } from "../shared/index.js";
  *  in the return body / mail send). Previously two places called
  *  `.toLowerCase()` — one source means no drift. */
 export declare function normalizeEmail(email: string): string;
+export declare const SIGNUP_TOKEN_KEY_PREFIXES: {
+    readonly token: "signup:by-token:";
+    readonly email: "signup:by-email:";
+    readonly burn: "signup:burn:";
+};
 /** Stores the pair bidirectionally and sets TTL on both keys.
  *  Idempotent — re-writing the same token-email pair is fine. */
 export declare function storeSignupToken(redis: Redis, args: {

package/dist/auth-email-password/signup-token-store.js

@@ -18,10 +18,15 @@ import { createSingleUseTokenStore, hashSingleUseToken, } from "../shared/index.
 export function normalizeEmail(email) {
     return email.toLowerCase();
 }
+export const SIGNUP_TOKEN_KEY_PREFIXES = {
+    token: "signup:by-token:",
+    email: "signup:by-email:",
+    burn: "signup:burn:",
+};
 const store = createSingleUseTokenStore({
-    tokenPrefix: "signup:by-token:",
-    subjectPrefix: "signup:by-email:",
-    burnPrefix: "signup:burn:",
+    tokenPrefix: SIGNUP_TOKEN_KEY_PREFIXES.token,
+    subjectPrefix: SIGNUP_TOKEN_KEY_PREFIXES.email,
+    burnPrefix: SIGNUP_TOKEN_KEY_PREFIXES.burn,
 });
 /** Stores the pair bidirectionally and sets TTL on both keys.
  *  Idempotent — re-writing the same token-email pair is fine. */

package/dist/auth-email-password/web/auth-gate.d.ts

@@ -2,13 +2,13 @@ import { type ComponentType, type ReactNode } from "react";
 import { type LoginScreenProps } from "./login-screen.js";
 export type MfaVerifyComponentProps = {
     readonly challengeToken: string;
-    readonly onSuccess?: () => void;
+    readonly onSuccess?: (landingPath?: string) => void;
     readonly onCancel?: () => void;
 };
 export type MfaSetupComponentProps = {
     readonly preauthSetupToken: string;
     readonly accountLabel: string;
-    readonly onSuccess?: () => void;
+    readonly onSuccess?: (landingPath?: string) => void;
     readonly onCancel?: () => void;
 };
 export type LoginRouteOptions = {

package/dist/auth-email-password/web/auth-gate.js

@@ -11,7 +11,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
 import { useEffect, useState } from "react";
-import { assertNavigableUrl, buildLoginRedirectUrl, followNextAfterLogin, } from "./auth-redirect.js";
+import { assertNavigableUrl, buildLoginRedirectUrl, followNextOrLandingAfterLogin, } from "./auth-redirect.js";
 import { LoginScreen } from "./login-screen.js";
 import { SessionProvider, useSession } from "./session.js";
 import { SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
@@ -59,15 +59,15 @@ export function createLoginRoute(opts = {}) {
         if (status === "authenticated" && onAuthenticated)
             return null;
         if (challengeToken !== null && MfaVerifyComponent) {
-            return (_jsx(MfaVerifyComponent, { challengeToken: challengeToken, onSuccess: () => {
+            return (_jsx(MfaVerifyComponent, { challengeToken: challengeToken, onSuccess: (landingPath) => {
                     setChallengeToken(null);
-                    followNextAfterLogin();
+                    followNextOrLandingAfterLogin(landingPath);
                 }, onCancel: () => setChallengeToken(null) }));
         }
         // Pending preauthSetupToken from LoginScreen's onMfaSetupRequired. Same
         // reasoning as challengeToken — a UI-only transition, not session state.
         if (setupRequest !== null && MfaSetupComponent) {
-            return (_jsx(MfaSetupComponent, { preauthSetupToken: setupRequest.preauthSetupToken, accountLabel: setupRequest.accountLabel, onSuccess: () => {
+            return (_jsx(MfaSetupComponent, { preauthSetupToken: setupRequest.preauthSetupToken, accountLabel: setupRequest.accountLabel, onSuccess: (landingPath) => {
                     // MfaSetupPreauthScreen has no session to refresh itself with
                     // (it runs pre-auth) — the gate owns the session, so it refreshes.
                     // refresh() never rejects: a failed refresh surfaces as status
@@ -75,7 +75,7 @@ export function createLoginRoute(opts = {}) {
                     // success path needs to clear setupRequest.
                     void refresh().then(() => {
                         setSetupRequest(null);
-                        followNextAfterLogin();
+                        followNextOrLandingAfterLogin(landingPath);
                     });
                 }, onCancel: () => setSetupRequest(null) }));
         }

package/dist/auth-email-password/web/auth-redirect.d.ts

@@ -4,3 +4,4 @@ export declare function readNextFromSearch(search: string): string | null;
 export declare function assertNavigableUrl(url: string, optionName: string): void;
 export declare function buildLoginRedirectUrl(loginUrl: string, returnPath: string, currentOrigin: string): string;
 export declare function followNextAfterLogin(location?: Pick<Location, "search" | "pathname" | "replace">): boolean;
+export declare function followNextOrLandingAfterLogin(landingPath: string | undefined, location?: Pick<Location, "search" | "pathname" | "replace">): boolean;

package/dist/auth-email-password/web/auth-redirect.js

@@ -69,3 +69,17 @@ export function followNextAfterLogin(location = window.location) {
     location.replace(next);
     return true;
 }
+// An explicit `next` (the page the user was sent away from) beats the server's
+// landingPath (auth.postAuthLanding); without either the caller keeps its own
+// client-side routing. landingPath is re-validated like `next`, so a
+// misconfigured resolver cannot turn the login into an open redirect.
+export function followNextOrLandingAfterLogin(landingPath, location = window.location) {
+    if (followNextAfterLogin(location))
+        return true;
+    if (landingPath === undefined || !isSafeNextPath(landingPath))
+        return false;
+    if (new URL(landingPath, "https://next.invalid").pathname === location.pathname)
+        return false;
+    location.replace(landingPath);
+    return true;
+}

package/dist/auth-email-password/web/login-screen.js

@@ -13,7 +13,7 @@ import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
-import { followNextAfterLogin } from "./auth-redirect.js";
+import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
 import { useSession } from "./session.js";
 // Map vom Reason-Code des Login-Handlers auf einen i18n-Key plus
 // optional extrahierte Interpolations-Parameter. Ungekannte Codes
@@ -66,7 +66,7 @@ export function LoginScreen({ title, subtitle, submitLabel, forgotPasswordHref,
         const res = await session.login({ email, password });
         setSubmitting(false);
         if (res.kind === "success") {
-            followNextAfterLogin();
+            followNextOrLandingAfterLogin(res.data.landingPath);
             return;
         }
         if (res.kind === "mfa-challenge") {

package/dist/auth-email-password/web/user-menu.js

@@ -34,7 +34,7 @@ export function UserMenu({ children, variant = "pill" }) {
     const hasName = user.displayName.length > 0;
     const displayName = hasName ? user.displayName : user.email;
     const avatarText = initials(displayName);
-    const content = (_jsxs(DropdownMenuContent, { align: variant === "sidebar" ? "start" : "end", "aria-label": t("auth.user.menu.label"), children: [_jsxs(DropdownMenuLabel, { className: "text-xs", children: [_jsx("div", { className: "font-medium text-foreground truncate", children: displayName }), hasName && _jsx("div", { className: "truncate", children: user.email })] }), _jsx(DropdownMenuSeparator, {}), children !== undefined && (_jsxs(_Fragment, { children: [children, _jsx(DropdownMenuSeparator, {})] })), _jsxs(DropdownMenuItem, { onSelect: () => void logout(), children: [_jsx(LogOut, { className: "h-4 w-4" }), _jsx("span", { children: t("auth.user.menu.logout") })] })] }));
+    const content = (_jsxs(DropdownMenuContent, { align: variant === "sidebar" ? "start" : "end", "aria-label": t("auth.user.menu.label"), children: [_jsxs(DropdownMenuLabel, { className: "text-xs", children: [_jsx("div", { className: "font-medium text-foreground truncate", children: displayName }), hasName && _jsx("div", { className: "truncate", children: user.email })] }), _jsx(DropdownMenuSeparator, {}), children !== undefined && (_jsxs(_Fragment, { children: [children, _jsx(DropdownMenuSeparator, {})] })), _jsxs(DropdownMenuItem, { "data-testid": "user-menu-logout", onSelect: () => void logout(), children: [_jsx(LogOut, { className: "h-4 w-4" }), _jsx("span", { children: t("auth.user.menu.logout") })] })] }));
     // Sidebar-Footer: volle NavUser-Row (sidebar-07) als Dropdown-Trigger —
     // gleiche Optik wie SidebarUser, aber klickbar mit Logout/Profil.
     if (variant === "sidebar") {

package/dist/auth-mfa/feature.js

@@ -1,4 +1,5 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { secretsEnvSchema } from "../secrets/index.js";
 import { mfaRequiredConfigKey } from "./config.js";
 import { createDisableHandler } from "./handlers/disable.write.js";
 import { createEnableConfirmHandler } from "./handlers/enable-confirm.write.js";
@@ -81,6 +82,10 @@ export function createAuthMfaFeature(opts) {
             category: "identity",
             recommended: true,
         });
+        // Same field instances as `secrets`, so composeEnvSchema treats them as one
+        // shared variable; an app mounting auth-mfa without `secrets` still gets the
+        // KEK slot (and its _CIPHERTEXT twin) declared.
+        r.envSchema(secretsEnvSchema);
         r.requires("user");
         r.requires("config");
         // verify.write.ts dispatches "tenant:query:memberships" — without this

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -36,6 +36,7 @@ export function createEnableConfirmPreauthHandler(opts) {
         access: { roles: ["anonymous"], personalData: "public-intake" },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity", "unsafeRaw"],
             reason: "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.queryAs(SYSTEM, " +
                 "user:findForAuth) and membership via ctx.resolveActiveMembership for the setup token's user. " +
                 "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +

package/dist/auth-mfa/handlers/verify.write.js

@@ -28,6 +28,7 @@ export function createMfaVerifyHandler(opts) {
         access: { roles: ["anonymous"], personalData: "public-intake" },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity", "unsafeRaw"],
             reason: "Pre-auth MFA step has no session yet — re-derives it via ctx.queryAs(SYSTEM, " +
                 "user:findForAuth) and ctx.resolveActiveMembership for the user the challenge token names. " +
                 "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -3,6 +3,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -24,6 +25,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -45,6 +47,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -98,6 +101,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -119,6 +123,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -140,6 +145,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/auth-mfa/screens.js

@@ -47,7 +47,7 @@ export const mfaEnableScreen = {
     confirm: {
         handler: AuthMfaHandlers.enableConfirm,
         fields: {
-            code: { type: "text", required: true, maxLength: 6 },
+            code: { type: "text", required: true, minLength: 6, maxLength: 6 },
         },
         layout: { sections: [{ fields: ["code"] }] },
         carry: ["setupToken"],
@@ -57,7 +57,7 @@ export const mfaEnableScreen = {
 };
 // Either a 6-digit TOTP code or a 9-char recovery code proves possession —
 // same bounds as the disable/regenerate-recovery handler schemas.
-const possessionCodeField = { type: "text", required: true, maxLength: 9 };
+const possessionCodeField = { type: "text", required: true, minLength: 6, maxLength: 9 };
 export const mfaDisableScreen = {
     id: MFA_DISABLE_SCREEN_ID,
     type: "actionForm",

package/dist/auth-mfa/web/mfa-recovery-codes-reveal.js

@@ -11,5 +11,5 @@ export function MfaRecoveryCodesReveal({ codes, onDismiss, }) {
     const t = useTranslation();
     const { Button, Field, Input, Section } = usePrimitives();
     const [acknowledged, setAcknowledged] = useState(false);
-    return (_jsxs(Section, { testId: "mfa-regenerate-reveal", actions: _jsx(Button, { variant: "primary", onClick: onDismiss, disabled: !acknowledged, children: t("auth.mfa.regenerate.done") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.regenerate.newCodesTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.regenerate.newCodesHint") }), _jsx("code", { className: "inline-block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: codes.join("\n") })] }), _jsx(Field, { id: "mfa-regenerate-ack", label: t("auth.mfa.regenerate.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-regenerate-ack", name: "mfa-regenerate-ack", value: acknowledged, onChange: setAcknowledged }) })] }));
+    return (_jsxs(Section, { testId: "mfa-regenerate-reveal", children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.regenerate.newCodesTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.regenerate.newCodesHint") }), _jsx("code", { className: "inline-block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: codes.join("\n") })] }), _jsx(Field, { id: "mfa-regenerate-ack", label: t("auth.mfa.regenerate.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-regenerate-ack", name: "mfa-regenerate-ack", value: acknowledged, onChange: setAcknowledged }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { variant: "primary", onClick: onDismiss, disabled: !acknowledged, children: t("auth.mfa.regenerate.done") }) })] }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.d.ts

@@ -8,7 +8,7 @@ export type MfaSetupPreauthScreenProps = {
     readonly subtitle?: ReactNode;
     /** Fired once confirm succeeds — the caller owns session refresh, see the
      *  file-level comment above. */
-    readonly onSuccess?: () => void;
+    readonly onSuccess?: (landingPath?: string) => void;
     readonly onCancel?: () => void;
 };
 export declare function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title, subtitle, onSuccess, onCancel, }: MfaSetupPreauthScreenProps): ReactNode;