@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.389.0

package/dist/auth-email-password/web/index.d.ts

@@ -22,6 +22,7 @@ export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-s
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.tsx";
 export type { ResetPasswordScreenProps } from "./reset-password-screen.tsx";
 export { ResetPasswordScreen } from "./reset-password-screen.tsx";
+export { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch, } from "./return-path.ts";
 export type { SessionApi, SessionBootstrapFailure, SessionState, SessionStatus, } from "./session.tsx";
 export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.tsx";
 export type { SessionBootstrapErrorScreenProps } from "./session-bootstrap-error.tsx";

package/dist/auth-email-password/web/index.js

@@ -16,6 +16,7 @@ export { InviteAcceptScreen } from "./invite-accept-screen.js";
 export { LoginScreen } from "./login-screen.js";
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
 export { ResetPasswordScreen } from "./reset-password-screen.js";
+export { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch, } from "./return-path.js";
 export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.js";
 export { retryDelayMs, SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
 export { SignupCompleteScreen } from "./signup-complete-screen.js";

package/dist/auth-email-password/web/login-screen.js

@@ -1,12 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
 // reason code needs a bundle entry plus a line in that mapping.
-import { useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { prependBasePath, useBasePath, useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
 import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
-import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
+import { appendReturnTo, followNextOrLandingAfterLogin, readNextFromWindow, } from "./auth-redirect.js";
 import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
 // Maps login-handler reason codes to i18n keys and optional interpolation parameters.
@@ -51,14 +51,19 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
     // Hides the resend button once the email input changes; otherwise resend
     // would silently go to the edited, possibly mistyped address.
     const [failedLoginEmail, setFailedLoginEmail] = useState(null);
+    const basePath = useBasePath();
+    // The page the user was sent away from rides along so the reset or signup mail leads back to it.
+    const returnTo = readNextFromWindow();
     const effectiveForgotHref = forgotPasswordHref === undefined
         ? loginOptions?.passwordReset === true
-            ? DEFAULT_FORGOT_PASSWORD_PATH
+            ? appendReturnTo(prependBasePath(DEFAULT_FORGOT_PASSWORD_PATH, basePath), returnTo)
             : null
-        : forgotPasswordHref;
+        : forgotPasswordHref === null
+            ? null
+            : appendReturnTo(forgotPasswordHref, returnTo);
     const effectiveUnlockHref = unlockAccountHref === undefined
         ? loginOptions?.accountUnlock === true
-            ? DEFAULT_AUTH_PATHS.unlockAccount
+            ? prependBasePath(DEFAULT_AUTH_PATHS.unlockAccount, basePath)
             : null
         : unlockAccountHref;
     const doSubmit = async () => {
@@ -123,7 +128,7 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
                                     email.trim().length > 0 &&
                                     email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
                                             ? t("auth.login.submitting")
-                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: appendReturnTo(signupHref, returnTo), variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }
 function LoginScreenWithQueriedOptions(props) {
     const { data } = useQuery(AuthQueries.loginOptions, {}, { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined });

package/dist/auth-email-password/web/reset-password-screen.js

@@ -13,6 +13,7 @@ import { useState } from "react";
 import { resetPassword } from "./auth-client.js";
 import { passwordPairIssue } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -22,6 +23,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     const [submitting, setSubmitting] = useState(false);
     const [done, setDone] = useState(false);
     const [error, setError] = useState(null);
+    const [afterResetHref, setAfterResetHref] = useState(loginHref);
     const doSubmit = async () => {
         setError(null);
         const issue = passwordPairIssue(newPassword, confirmPassword);
@@ -37,6 +39,10 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
         const res = await resetPassword(token, newPassword);
         setSubmitting(false);
         if (res.ok) {
+            const returnTo = readReturnToFromWindow();
+            if (returnTo !== null) {
+                setAfterResetHref(buildLoginRedirectUrl(loginHref, returnTo, window.location.origin));
+            }
             setDone(true);
             return;
         }
@@ -62,5 +68,5 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: afterResetHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/return-path.d.ts

@@ -0,0 +1,4 @@
+export declare const RETURN_TO_QUERY_PARAM = "returnTo";
+export declare const MAX_RETURN_PATH_LENGTH = 2048;
+export declare function isSafeReturnPath(candidate: unknown): candidate is string;
+export declare function readReturnToFromSearch(search: string): string | null;

package/dist/auth-email-password/web/return-path.js

@@ -0,0 +1,34 @@
+// Shared by the server (mail link) and the web pages (landing page), so it is plain string logic:
+// no DOM, no window, no `new URL` (React Native's URL getters throw).
+export const RETURN_TO_QUERY_PARAM = "returnTo";
+export const MAX_RETURN_PATH_LENGTH = 2048;
+const DOT_SEGMENTS = new Set([".", "..", ".%2e", "%2e.", "%2e%2e", "%2e"]);
+function hasForbiddenCharacter(candidate) {
+    for (let i = 0; i < candidate.length; i++) {
+        const code = candidate.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f || (code >= 0x80 && code <= 0x9f))
+            return true;
+        if (code === 0x5c)
+            return true;
+    }
+    return false;
+}
+// A dot segment is resolved by URL normalization, so "/.//evil" would become "//evil".
+function hasDotSegment(candidate) {
+    const pathEnd = candidate.search(/[?#]/);
+    const path = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+    return path.split("/").some((segment) => DOT_SEGMENTS.has(segment.toLowerCase()));
+}
+export function isSafeReturnPath(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    if (candidate.length < 1 || candidate.length > MAX_RETURN_PATH_LENGTH)
+        return false;
+    if (!candidate.startsWith("/") || candidate[1] === "/")
+        return false;
+    return !hasForbiddenCharacter(candidate) && !hasDotSegment(candidate);
+}
+export function readReturnToFromSearch(search) {
+    const candidate = new URLSearchParams(search).get(RETURN_TO_QUERY_PARAM);
+    return isSafeReturnPath(candidate) ? candidate : null;
+}

package/dist/auth-email-password/web/session.js

@@ -10,6 +10,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // and transitions.
 import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
 import { readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
+import { clearRememberedListState } from "@cosmicdrift/kumiko-renderer/web";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
@@ -127,6 +128,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     }, [doRefresh]);
     const logout = useCallback(async () => {
         await logoutApi();
+        // The reload below would hide the identity change from the list-state boot.
+        clearRememberedListState();
         if (postLogoutUrl !== undefined && typeof window !== "undefined") {
             // State stays untouched: flipping to unauthenticated would let an AuthGate
             // with loginUrl race this navigation to its own redirect.
@@ -160,6 +163,7 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     const userEmail = profile?.email;
     const userDisplayName = profile?.displayName;
     const userTimeZone = profile?.effectiveTimeZone;
+    const activeTenantId = state.activeTenantId ?? undefined;
     const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
         ? undefined
         : {
@@ -167,7 +171,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             email: userEmail,
             displayName: userDisplayName,
             ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
-        }, [userId, userEmail, userDisplayName, userTimeZone]);
+            ...(activeTenantId !== undefined && { tenantId: activeTenantId }),
+        }, [userId, userEmail, userDisplayName, userTimeZone, activeTenantId]);
     return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -21,7 +21,7 @@ import { useState } from "react";
 import { confirmSignup } from "./auth-client.js";
 import { passwordPairIssue, resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
-import { buildLoginRedirectUrl } from "./auth-redirect.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "/", loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -47,11 +47,19 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         const res = await confirmSignup(token, password);
         setSubmitting(false);
         if (res.ok) {
+            // The page the signup started from beats the server's landing path.
+            const returnTo = readReturnToFromWindow();
             if (res.data.kind === "mfa-pending") {
                 setMfaPending(true);
-                setContinueHref(res.data.landingPath === undefined
+                const next = returnTo ?? res.data.landingPath;
+                setContinueHref(next === undefined
                     ? loginHref
-                    : buildLoginRedirectUrl(loginHref, res.data.landingPath, window.location.origin));
+                    : buildLoginRedirectUrl(loginHref, next, window.location.origin));
+                return;
+            }
+            // A claimed handover keeps its app-defined target.
+            if (returnTo !== null && res.data.handover === undefined) {
+                setContinueHref(returnTo);
                 return;
             }
             // Cookies are already set (auto-login). Show a confirmation with an

package/dist/auth-email-password/web/signup-screen.d.ts

@@ -5,5 +5,8 @@ export type SignupScreenProps = {
     /** href for the "Already have an account?" link. App-specific; defaults to
      *  "/login". */
     readonly loginHref?: string;
+    /** Page the activation mail should lead to after signup; defaults to the `returnTo` query
+     *  parameter of this page. Unsafe values are dropped. */
+    readonly returnTo?: string;
 };
-export declare function SignupScreen({ title, subtitle, loginHref, }: SignupScreenProps): ReactNode;
+export declare function SignupScreen({ title, subtitle, loginHref, returnTo, }: SignupScreenProps): ReactNode;

package/dist/auth-email-password/web/signup-screen.js

@@ -16,7 +16,12 @@ import { useState } from "react";
 import { requestSignup } from "./auth-client.js";
 import { retryAfterMinutes } from "./auth-form-logic.js";
 import { AuthCard } from "./auth-form-primitives.js";
-export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
+import { readReturnToFromWindow } from "./auth-redirect.js";
+import { isSafeReturnPath } from "./return-path.js";
+function resolveReturnTo(prop) {
+    return (isSafeReturnPath(prop) ? prop : readReturnToFromWindow()) ?? undefined;
+}
+export function SignupScreen({ title, subtitle, loginHref = "/login", returnTo, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const [email, setEmail] = useState("");
@@ -27,7 +32,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            const res = await requestSignup(email);
+            const res = await requestSignup(email, undefined, resolveReturnTo(returnTo));
             if (res.ok) {
                 setDone(true);
             }
@@ -59,7 +64,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            await requestSignup(email);
+            await requestSignup(email, undefined, resolveReturnTo(returnTo));
         }
         finally {
             setSubmitting(false);

package/dist/auth-mfa/config.d.ts

@@ -1,5 +1,5 @@
 import { type ConfigKeyHandle } from "@cosmicdrift/kumiko-framework/engine";
-export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "admins", "all"];
+export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "systemAdmins", "admins", "all"];
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
 export declare const mfaRequiredConfigHandle: ConfigKeyHandle<"select">;
 export declare function mfaRequiredConfigKey(defaultPolicy?: MfaRequiredPolicy): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;

package/dist/auth-mfa/config.js

@@ -2,14 +2,10 @@
 // they haven't opted in themselves? Default "optional" means the feature
 // is fully opt-in (existing tenants/users unaffected — no migration step).
 //
-// ponytail: "admins"/"all" HARD-BLOCK login for an unenrolled user (see
-// mfa-status-checker.ts's setupRequired branch) — there is no in-band way
-// for a blocked user to complete enrollment yet (that flow ships in PR3's
-// UI). Flipping this away from "optional" before PR3 locks out every
-// unenrolled matching user with no recovery path. Fine for a tenant that
-// enrolls its admins out-of-band first; a footgun otherwise.
+// Every non-optional policy blocks login for an unenrolled matching user until
+// they finish the pre-auth enrollment step (mfa-status-checker.ts setupRequired).
 import { access, createTenantConfig, } from "@cosmicdrift/kumiko-framework/engine";
-export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"];
+export const MFA_REQUIRED_POLICIES = ["optional", "systemAdmins", "admins", "all"];
 export const mfaRequiredConfigHandle = {
     name: "auth-mfa:config:required",
     type: "select",

package/dist/auth-mfa/feature-exports.d.ts

@@ -2,11 +2,11 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { MfaCodeVerifier } from "./mfa-code-verifier.ts";
 import type { MfaStatusChecker } from "./mfa-status-checker.ts";
 import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
-export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
+export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => () => void;
 export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;
 export declare function mfaStatusCheckerFromFeature(feature: FeatureDefinition): MfaStatusChecker | undefined;
 export declare function mfaVerifierFromFeature(feature: FeatureDefinition): MfaCodeVerifier | undefined;
 export type BindMfaTokenSecrets = (masterSecret: string, env: MfaTokenSecretsEnv) => void;
 export declare function bindMfaTokenSecretsFromFeature(feature: FeatureDefinition): BindMfaTokenSecrets | undefined;
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => () => void;
 export declare function bindRevokeAllPatTokensFromFeature(feature: FeatureDefinition): BindRevokeAllPatTokens | undefined;

package/dist/auth-mfa/feature.js

@@ -147,9 +147,17 @@ export function createAuthMfaFeature(opts) {
         const verifyMfaCode = createMfaCodeVerifier();
         const bindRevokeAllOtherSessions = (revoker) => {
             revokeAllOtherSessions = revoker;
+            return () => {
+                if (revokeAllOtherSessions === revoker)
+                    revokeAllOtherSessions = undefined;
+            };
         };
         const bindRevokeAllPatTokens = (revoker) => {
             revokeAllPatTokens = revoker;
+            return () => {
+                if (revokeAllPatTokens === revoker)
+                    revokeAllPatTokens = undefined;
+            };
         };
         return {
             handlers,

package/dist/auth-mfa/mfa-status-checker.js

@@ -1,3 +1,4 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { access, declareEscapeHatch, } from "@cosmicdrift/kumiko-framework/engine";
 import { mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.js";
@@ -32,9 +33,10 @@ export function createMfaStatusChecker(opts) {
         const buildSetupToken = () => signMfaPreauthSetupToken({ userId, tenantId }, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, opts.challengeTokenSecret).token;
         if (policy === "all")
             return { setupRequired: true, preauthSetupToken: buildSetupToken() };
-        // policy === "admins"
-        const isAdmin = roles.some((role) => access.admin.includes(role));
-        return isAdmin
+        const isEnforced = policy === "systemAdmins"
+            ? roles.includes(ROLES.SystemAdmin)
+            : roles.some((role) => access.admin.includes(role));
+        return isEnforced
             ? { setupRequired: true, preauthSetupToken: buildSetupToken() }
             : { required: false };
     };

package/dist/auth-mfa/web/i18n.js

@@ -10,6 +10,10 @@ export const defaultTranslations = {
         "auth.mfa.verify.submit": "Verify",
         "auth.mfa.verify.submitting": "…",
         "auth.mfa.verify.backToLogin": "Back to login",
+        "auth.mfa.verify.recoveryCode": "Recovery code",
+        "auth.mfa.verify.recoverySubtitle": "Enter one of the recovery codes you saved when you set up two-factor authentication.",
+        "auth.mfa.verify.useAuthenticatorCode": "Use the code from your app",
+        "auth.mfa.verify.useRecoveryCode": "Use a recovery code instead",
         "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
         "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
@@ -35,7 +39,7 @@ export const defaultTranslations = {
         "auth.mfa.setup.confirm": "Complete setup",
         "auth.mfa.disable.title": "Disable two-factor authentication",
         "auth.mfa.disable.description": "Confirm with a code from your authenticator app or a recovery code. Your account will then be protected by your password alone.",
-        "auth.mfa.disable.code": "Code from your authenticator app or a recovery code",
+        "auth.mfa.disable.code": "Code from your authenticator app",
         "auth.mfa.disable.confirm": "Disable",
         "auth.mfa.disable.cancel": "Cancel",
         "auth.mfa.disable.trigger": "Disable two-factor authentication",

package/dist/auth-mfa/web/mfa-code-or-recovery-field.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from "react";
+export type MfaCodeOrRecoveryFieldProps = {
+    readonly id: string;
+    readonly codeLabel: string;
+    readonly code: string;
+    readonly onCodeChange: (code: string) => void;
+    readonly useRecovery: boolean;
+    readonly onUseRecoveryChange: (useRecovery: boolean) => void;
+    readonly disabled?: boolean;
+};
+export declare function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }: MfaCodeOrRecoveryFieldProps): ReactNode;

package/dist/auth-mfa/web/mfa-code-or-recovery-field.js

@@ -0,0 +1,12 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+export function MfaCodeOrRecoveryField({ id, codeLabel, code, onCodeChange, useRecovery, onUseRecoveryChange, disabled, }) {
+    const t = useTranslation();
+    const { Button, Field, Input } = usePrimitives();
+    return (_jsxs(_Fragment, { children: [_jsx(Field, { id: id, label: useRecovery ? t("auth.mfa.verify.recoveryCode") : codeLabel, required: true, children: useRecovery ? (_jsx(Input, { kind: "text", id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true, autoComplete: "off" })) : (_jsx(Input, { kind: "code", length: 6, id: id, name: id, value: code, onChange: onCodeChange, disabled: disabled, autoFocus: true })) }), _jsx(Button, { type: "button", variant: "link", disabled: disabled, onClick: () => {
+                    onUseRecoveryChange(!useRecovery);
+                    onCodeChange("");
+                }, children: useRecovery
+                    ? t("auth.mfa.verify.useAuthenticatorCode")
+                    : t("auth.mfa.verify.useRecoveryCode") })] }));
+}

package/dist/auth-mfa/web/mfa-disable-dialog.js

@@ -12,20 +12,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({ open, onOpenChange, onDisabled, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.disable, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onDisabled();
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(Field, { id: "mfa-disable-code", label: t("auth.mfa.disable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-disable-code", name: "mfa-disable-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, variant: "danger", title: t("auth.mfa.disable.title"), description: t("auth.mfa.disable.description"), confirmLabel: t("auth.mfa.disable.confirm"), cancelLabel: t("auth.mfa.disable.cancel"), onConfirm: confirm, testId: "mfa-disable-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-disable-code", codeLabel: t("auth.mfa.disable.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-regenerate-recovery-dialog.js

@@ -9,20 +9,31 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { AuthMfaHandlers } from "./constants.js";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({ open, onOpenChange, onRegenerated, onError, }) {
     const t = useTranslation();
-    const { Dialog, Field, Input } = usePrimitives();
+    const { Dialog } = usePrimitives();
     const dispatcher = useDispatcher();
     const [code, setCode] = useState("");
+    const [useRecovery, setUseRecovery] = useState(false);
+    const reset = () => {
+        setCode("");
+        setUseRecovery(false);
+    };
+    const handleOpenChange = (nextOpen) => {
+        if (!nextOpen)
+            reset();
+        onOpenChange(nextOpen);
+    };
     const confirm = async () => {
         const res = await dispatcher.write(AuthMfaHandlers.regenerateRecovery, { code });
-        setCode("");
+        reset();
         if (!res.isSuccess) {
             onError(res.error.i18nKey);
             return;
         }
         onRegenerated(res.data.recoveryCodes);
     };
-    return (_jsx(Dialog, { open: open, onOpenChange: onOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(Field, { id: "mfa-regenerate-code", label: t("auth.mfa.regenerate.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-regenerate-code", name: "mfa-regenerate-code", value: code, onChange: setCode, autoComplete: "one-time-code" }) }) }));
+    return (_jsx(Dialog, { open: open, onOpenChange: handleOpenChange, title: t("auth.mfa.regenerate.title"), description: t("auth.mfa.regenerate.description"), confirmLabel: t("auth.mfa.regenerate.confirm"), cancelLabel: t("auth.mfa.regenerate.cancel"), onConfirm: confirm, testId: "mfa-regenerate-recovery-dialog", children: _jsx(MfaCodeOrRecoveryField, { id: "mfa-regenerate-code", codeLabel: t("auth.mfa.regenerate.code"), code: code, onCodeChange: setCode, useRecovery: useRecovery, onUseRecoveryChange: setUseRecovery }) }));
 }

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -48,6 +48,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     const [setup, setSetup] = useState(null);
     const [acknowledged, setAcknowledged] = useState(false);
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState(null);
     const [retryAfterSeconds, setRetryAfterSeconds] = useState(null);
@@ -78,14 +79,14 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
             setBusy(false);
         }
     };
-    const confirmSetup = async () => {
-        if (!setup)
+    const confirmSetup = async (submittedCode) => {
+        if (!setup || busy)
             return;
         setBusy(true);
         setError(null);
         setRetryAfterSeconds(null);
         try {
-            const res = await confirmMfaSetupPreauth(setup.setupToken, code);
+            const res = await confirmMfaSetupPreauth(setup.setupToken, submittedCode);
             if (res.kind !== "success") {
                 setError(res.error.reason);
                 setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
@@ -98,7 +99,11 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                     setSetup(null);
                     setAcknowledged(false);
                     setCode("");
+                    return;
                 }
+                // Remount: the field was disabled during confirm and lost focus.
+                setCode("");
+                setAttempt((n) => n + 1);
                 return;
             }
             onSuccess?.(res.data.landingPath);
@@ -112,7 +117,7 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void confirmSetup();
+        void confirmSetup(code);
     };
     return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
                     ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
@@ -124,5 +129,5 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                                             copyable: false,
                                             multiline: false,
                                         },
-                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
+                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "code", length: 6, id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, onComplete: (next) => void confirmSetup(next), disabled: busy || !acknowledged, hasError: error !== null, autoFocus: attempt > 0 }, attempt) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -10,6 +10,7 @@ import { useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only barrel, the feature's server barrel has no web/ re-export
 import { AuthCard, useSession } from "../../auth-email-password/web/index.js";
 import { verifyMfaChallenge } from "./mfa-client.js";
+const MFA_CODE_LENGTH = 6;
 function reasonToKey(reason) {
     switch (reason) {
         case "invalid_totp_code":
@@ -31,13 +32,17 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner } = usePrimitives();
     const session = useSession();
+    const [mode, setMode] = useState("authenticator");
     const [code, setCode] = useState("");
+    const [attempt, setAttempt] = useState(0);
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
-    const doSubmit = async () => {
+    const doSubmit = async (submittedCode) => {
+        if (submitting)
+            return;
         setSubmitting(true);
         setError(null);
-        const res = await verifyMfaChallenge(challengeToken, code);
+        const res = await verifyMfaChallenge(challengeToken, submittedCode);
         if (res.kind === "success") {
             await session.refresh();
             setSubmitting(false);
@@ -46,12 +51,28 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         }
         setSubmitting(false);
         setError(res.error.reason);
+        // Remount: the input was disabled during submit and lost focus.
+        setAttempt((n) => n + 1);
+        if (mode === "authenticator")
+            setCode("");
     };
     const onSubmit = (e) => {
         e?.preventDefault();
-        void doSubmit();
+        void doSubmit(code);
+    };
+    const toggleMode = () => {
+        setMode(mode === "authenticator" ? "recovery" : "authenticator");
+        setCode("");
+        setError(null);
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+    const isRecovery = mode === "recovery";
+    const fieldId = isRecovery ? "mfa-verify-recovery-code" : "mfa-verify-code";
+    const defaultSubtitle = isRecovery
+        ? t("auth.mfa.verify.recoverySubtitle")
+        : t("auth.mfa.verify.subtitle");
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? defaultSubtitle, children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: fieldId, label: isRecovery ? t("auth.mfa.verify.recoveryCode") : t("auth.mfa.verify.code"), required: true, children: isRecovery ? (_jsx(Input, { kind: "text", id: fieldId, name: fieldId, value: code, onChange: setCode, disabled: submitting, required: true, autoFocus: true, autoComplete: "off" }, `${mode}-${attempt}`)) : (_jsx(Input, { kind: "code", length: MFA_CODE_LENGTH, id: fieldId, name: fieldId, value: code, onChange: setCode, onComplete: (next) => void doSubmit(next), disabled: submitting, hasError: error !== null, required: true, autoFocus: true }, `${mode}-${attempt}`)) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
                         ? t("auth.mfa.verify.submitting")
-                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), _jsx(Button, { type: "button", variant: "link", onClick: toggleMode, disabled: submitting, children: isRecovery
+                        ? t("auth.mfa.verify.useAuthenticatorCode")
+                        : t("auth.mfa.verify.useRecoveryCode") }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }