@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.390.0

package/dist/auth-email-password/web/auth-redirect.js

@@ -1,36 +1,31 @@
 // Redirect targets for external login pages. `next` travels through the query
 // string, so anything read back from it is untrusted: only same-origin
 // root-relative paths pass (no "//host", no "/\host", no scheme).
+import { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch } from "./return-path.js";
 export const NEXT_QUERY_PARAM = "next";
-function hasControlOrWhitespace(candidate) {
-    for (let i = 0; i < candidate.length; i++) {
-        const code = candidate.charCodeAt(i);
-        if (code <= 0x20 || code === 0x7f)
-            return true;
-    }
-    return false;
-}
-// The URL parse is a backstop: browsers strip tabs/newlines, so "/\t/evil.com"
-// would otherwise normalize to "//evil.com" past the leading-slash check.
-export function isSafeNextPath(candidate) {
-    if (typeof candidate !== "string" || !candidate.startsWith("/"))
-        return false;
-    if (candidate[1] === "/" || candidate.includes("\\"))
-        return false;
-    if (hasControlOrWhitespace(candidate))
-        return false;
-    try {
-        const parsed = new URL(candidate, "https://next.invalid");
-        return parsed.origin === "https://next.invalid" && !parsed.pathname.startsWith("//");
-    }
-    catch {
-        return false;
-    }
-}
+export const isSafeNextPath = isSafeReturnPath;
 export function readNextFromSearch(search) {
     const candidate = new URLSearchParams(search).get(NEXT_QUERY_PARAM);
     return isSafeNextPath(candidate) ? candidate : null;
 }
+// The returnTo a mail link or sibling auth page carried in this page's own URL; null on native, where there is no window.
+export function readReturnToFromWindow() {
+    return typeof window === "undefined" ? null : readReturnToFromSearch(window.location.search);
+}
+// Adds returnTo to an href of a sibling auth page; a missing value leaves the href untouched.
+export function appendReturnTo(href, returnTo) {
+    if (returnTo === null)
+        return href;
+    const hashAt = href.indexOf("#");
+    const base = hashAt === -1 ? href : href.slice(0, hashAt);
+    const hash = hashAt === -1 ? "" : href.slice(hashAt);
+    const separator = base.includes("?") ? "&" : "?";
+    return `${base}${separator}${RETURN_TO_QUERY_PARAM}=${encodeURIComponent(returnTo)}${hash}`;
+}
+// The safe `next` of this page's URL; null on native, where there is no window.
+export function readNextFromWindow() {
+    return typeof window === "undefined" ? null : readNextFromSearch(window.location.search);
+}
 // loginUrl/postLogoutUrl come from app code (trusted), but a typo like
 // "javascript:" must fail at startup instead of becoming a navigation target.
 export function assertNavigableUrl(url, optionName) {

package/dist/auth-email-password/web/default-auth-pages-gate.js

@@ -1,4 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
+import { stripBasePath, useBasePath } from "@cosmicdrift/kumiko-renderer";
 import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
 import { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
 import { ForgotPasswordScreen } from "./forgot-password-screen.js";
@@ -7,8 +8,9 @@ import { ResetPasswordScreen } from "./reset-password-screen.js";
 function hasToken(search) {
     return (new URLSearchParams(search).get("token") ?? "") !== "";
 }
-function pickDefaultAuthPage(pathname, search) {
-    const path = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+function pickDefaultAuthPage(pathname, search, basePath) {
+    const trimmed = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname;
+    const path = stripBasePath(trimmed, basePath);
     switch (path) {
         case DEFAULT_FORGOT_PASSWORD_PATH:
             return _jsx(ForgotPasswordScreen, {});
@@ -24,5 +26,6 @@ function pickDefaultAuthPage(pathname, search) {
 // (outer) still win on the same path. The pages are public: no session needed.
 export function DefaultAuthPagesGate({ children }) {
     const { pathname, search } = window.location;
-    return pickDefaultAuthPage(pathname, search) ?? _jsx(_Fragment, { children: children });
+    const basePath = useBasePath();
+    return pickDefaultAuthPage(pathname, search, basePath) ?? _jsx(_Fragment, { children: children });
 }

package/dist/auth-email-password/web/forgot-password-screen.d.ts

@@ -5,5 +5,8 @@ export type ForgotPasswordScreenProps = {
     /** href for the "Back to login" link in the success and form states. App-
      * specific — defaults to "/login". */
     readonly loginHref?: string;
+    /** Page the reset mail should lead back to after the new password is set; defaults to the
+     *  `returnTo` query parameter of this page. Unsafe values are dropped. */
+    readonly returnTo?: string;
 };
-export declare function ForgotPasswordScreen({ title, subtitle, loginHref, }: ForgotPasswordScreenProps): ReactNode;
+export declare function ForgotPasswordScreen({ title, subtitle, loginHref, returnTo, }: ForgotPasswordScreenProps): ReactNode;

package/dist/auth-email-password/web/forgot-password-screen.js

@@ -12,7 +12,12 @@ import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestPasswordReset } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
-export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", }) {
+import { readReturnToFromWindow } from "./auth-redirect.js";
+import { isSafeReturnPath } from "./return-path.js";
+function resolveReturnTo(prop) {
+    return (isSafeReturnPath(prop) ? prop : readReturnToFromWindow()) ?? undefined;
+}
+export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", returnTo, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const [email, setEmail] = useState("");
@@ -24,7 +29,7 @@ export function ForgotPasswordScreen({ title, subtitle, loginHref = "/login", })
         setSubmitting(true);
         setError(null);
         try {
-            const res = await requestPasswordReset(email);
+            const res = await requestPasswordReset(email, resolveReturnTo(returnTo));
             if (res.ok) {
                 setDone(true);
             }

package/dist/auth-email-password/web/index.d.ts

@@ -22,6 +22,7 @@ export type { RequestAccountUnlockScreenProps } from "./request-account-unlock-s
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.tsx";
 export type { ResetPasswordScreenProps } from "./reset-password-screen.tsx";
 export { ResetPasswordScreen } from "./reset-password-screen.tsx";
+export { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch, } from "./return-path.ts";
 export type { SessionApi, SessionBootstrapFailure, SessionState, SessionStatus, } from "./session.tsx";
 export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.tsx";
 export type { SessionBootstrapErrorScreenProps } from "./session-bootstrap-error.tsx";

package/dist/auth-email-password/web/index.js

@@ -16,6 +16,7 @@ export { InviteAcceptScreen } from "./invite-accept-screen.js";
 export { LoginScreen } from "./login-screen.js";
 export { RequestAccountUnlockScreen } from "./request-account-unlock-screen.js";
 export { ResetPasswordScreen } from "./reset-password-screen.js";
+export { isSafeReturnPath, RETURN_TO_QUERY_PARAM, readReturnToFromSearch, } from "./return-path.js";
 export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session.js";
 export { retryDelayMs, SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
 export { SignupCompleteScreen } from "./signup-complete-screen.js";

package/dist/auth-email-password/web/login-screen.js

@@ -1,12 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
 // reason code needs a bundle entry plus a line in that mapping.
-import { useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { prependBasePath, useBasePath, useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
 import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
-import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
+import { appendReturnTo, followNextOrLandingAfterLogin, readNextFromWindow, } from "./auth-redirect.js";
 import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
 // Maps login-handler reason codes to i18n keys and optional interpolation parameters.
@@ -51,14 +51,19 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
     // Hides the resend button once the email input changes; otherwise resend
     // would silently go to the edited, possibly mistyped address.
     const [failedLoginEmail, setFailedLoginEmail] = useState(null);
+    const basePath = useBasePath();
+    // The page the user was sent away from rides along so the reset or signup mail leads back to it.
+    const returnTo = readNextFromWindow();
     const effectiveForgotHref = forgotPasswordHref === undefined
         ? loginOptions?.passwordReset === true
-            ? DEFAULT_FORGOT_PASSWORD_PATH
+            ? appendReturnTo(prependBasePath(DEFAULT_FORGOT_PASSWORD_PATH, basePath), returnTo)
             : null
-        : forgotPasswordHref;
+        : forgotPasswordHref === null
+            ? null
+            : appendReturnTo(forgotPasswordHref, returnTo);
     const effectiveUnlockHref = unlockAccountHref === undefined
         ? loginOptions?.accountUnlock === true
-            ? DEFAULT_AUTH_PATHS.unlockAccount
+            ? prependBasePath(DEFAULT_AUTH_PATHS.unlockAccount, basePath)
             : null
         : unlockAccountHref;
     const doSubmit = async () => {
@@ -123,7 +128,7 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
                                     email.trim().length > 0 &&
                                     email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
                                             ? t("auth.login.submitting")
-                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: appendReturnTo(signupHref, returnTo), variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }
 function LoginScreenWithQueriedOptions(props) {
     const { data } = useQuery(AuthQueries.loginOptions, {}, { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined });

package/dist/auth-email-password/web/reset-password-screen.js

@@ -13,6 +13,7 @@ import { useState } from "react";
 import { resetPassword } from "./auth-client.js";
 import { passwordPairIssue } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -22,6 +23,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     const [submitting, setSubmitting] = useState(false);
     const [done, setDone] = useState(false);
     const [error, setError] = useState(null);
+    const [afterResetHref, setAfterResetHref] = useState(loginHref);
     const doSubmit = async () => {
         setError(null);
         const issue = passwordPairIssue(newPassword, confirmPassword);
@@ -37,6 +39,10 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
         const res = await resetPassword(token, newPassword);
         setSubmitting(false);
         if (res.ok) {
+            const returnTo = readReturnToFromWindow();
+            if (returnTo !== null) {
+                setAfterResetHref(buildLoginRedirectUrl(loginHref, returnTo, window.location.origin));
+            }
             setDone(true);
             return;
         }
@@ -62,5 +68,5 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: afterResetHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/return-path.d.ts

@@ -0,0 +1,4 @@
+export declare const RETURN_TO_QUERY_PARAM = "returnTo";
+export declare const MAX_RETURN_PATH_LENGTH = 2048;
+export declare function isSafeReturnPath(candidate: unknown): candidate is string;
+export declare function readReturnToFromSearch(search: string): string | null;

package/dist/auth-email-password/web/return-path.js

@@ -0,0 +1,34 @@
+// Shared by the server (mail link) and the web pages (landing page), so it is plain string logic:
+// no DOM, no window, no `new URL` (React Native's URL getters throw).
+export const RETURN_TO_QUERY_PARAM = "returnTo";
+export const MAX_RETURN_PATH_LENGTH = 2048;
+const DOT_SEGMENTS = new Set([".", "..", ".%2e", "%2e.", "%2e%2e", "%2e"]);
+function hasForbiddenCharacter(candidate) {
+    for (let i = 0; i < candidate.length; i++) {
+        const code = candidate.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f || (code >= 0x80 && code <= 0x9f))
+            return true;
+        if (code === 0x5c)
+            return true;
+    }
+    return false;
+}
+// A dot segment is resolved by URL normalization, so "/.//evil" would become "//evil".
+function hasDotSegment(candidate) {
+    const pathEnd = candidate.search(/[?#]/);
+    const path = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+    return path.split("/").some((segment) => DOT_SEGMENTS.has(segment.toLowerCase()));
+}
+export function isSafeReturnPath(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    if (candidate.length < 1 || candidate.length > MAX_RETURN_PATH_LENGTH)
+        return false;
+    if (!candidate.startsWith("/") || candidate[1] === "/")
+        return false;
+    return !hasForbiddenCharacter(candidate) && !hasDotSegment(candidate);
+}
+export function readReturnToFromSearch(search) {
+    const candidate = new URLSearchParams(search).get(RETURN_TO_QUERY_PARAM);
+    return isSafeReturnPath(candidate) ? candidate : null;
+}

package/dist/auth-email-password/web/session.js

@@ -10,6 +10,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // and transitions.
 import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
 import { readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
+import { clearRememberedListState } from "@cosmicdrift/kumiko-renderer/web";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
@@ -127,6 +128,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     }, [doRefresh]);
     const logout = useCallback(async () => {
         await logoutApi();
+        // The reload below would hide the identity change from the list-state boot.
+        clearRememberedListState();
         if (postLogoutUrl !== undefined && typeof window !== "undefined") {
             // State stays untouched: flipping to unauthenticated would let an AuthGate
             // with loginUrl race this navigation to its own redirect.
@@ -160,6 +163,7 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     const userEmail = profile?.email;
     const userDisplayName = profile?.displayName;
     const userTimeZone = profile?.effectiveTimeZone;
+    const activeTenantId = state.activeTenantId ?? undefined;
     const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
         ? undefined
         : {
@@ -167,7 +171,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             email: userEmail,
             displayName: userDisplayName,
             ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
-        }, [userId, userEmail, userDisplayName, userTimeZone]);
+            ...(activeTenantId !== undefined && { tenantId: activeTenantId }),
+        }, [userId, userEmail, userDisplayName, userTimeZone, activeTenantId]);
     return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -21,7 +21,7 @@ import { useState } from "react";
 import { confirmSignup } from "./auth-client.js";
 import { passwordPairIssue, resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
-import { buildLoginRedirectUrl } from "./auth-redirect.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "/", loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -47,11 +47,19 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         const res = await confirmSignup(token, password);
         setSubmitting(false);
         if (res.ok) {
+            // The page the signup started from beats the server's landing path.
+            const returnTo = readReturnToFromWindow();
             if (res.data.kind === "mfa-pending") {
                 setMfaPending(true);
-                setContinueHref(res.data.landingPath === undefined
+                const next = returnTo ?? res.data.landingPath;
+                setContinueHref(next === undefined
                     ? loginHref
-                    : buildLoginRedirectUrl(loginHref, res.data.landingPath, window.location.origin));
+                    : buildLoginRedirectUrl(loginHref, next, window.location.origin));
+                return;
+            }
+            // A claimed handover keeps its app-defined target.
+            if (returnTo !== null && res.data.handover === undefined) {
+                setContinueHref(returnTo);
                 return;
             }
             // Cookies are already set (auto-login). Show a confirmation with an

package/dist/auth-email-password/web/signup-screen.d.ts

@@ -5,5 +5,8 @@ export type SignupScreenProps = {
     /** href for the "Already have an account?" link. App-specific; defaults to
      *  "/login". */
     readonly loginHref?: string;
+    /** Page the activation mail should lead to after signup; defaults to the `returnTo` query
+     *  parameter of this page. Unsafe values are dropped. */
+    readonly returnTo?: string;
 };
-export declare function SignupScreen({ title, subtitle, loginHref, }: SignupScreenProps): ReactNode;
+export declare function SignupScreen({ title, subtitle, loginHref, returnTo, }: SignupScreenProps): ReactNode;

package/dist/auth-email-password/web/signup-screen.js

@@ -16,7 +16,12 @@ import { useState } from "react";
 import { requestSignup } from "./auth-client.js";
 import { retryAfterMinutes } from "./auth-form-logic.js";
 import { AuthCard } from "./auth-form-primitives.js";
-export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
+import { readReturnToFromWindow } from "./auth-redirect.js";
+import { isSafeReturnPath } from "./return-path.js";
+function resolveReturnTo(prop) {
+    return (isSafeReturnPath(prop) ? prop : readReturnToFromWindow()) ?? undefined;
+}
+export function SignupScreen({ title, subtitle, loginHref = "/login", returnTo, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const [email, setEmail] = useState("");
@@ -27,7 +32,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            const res = await requestSignup(email);
+            const res = await requestSignup(email, undefined, resolveReturnTo(returnTo));
             if (res.ok) {
                 setDone(true);
             }
@@ -59,7 +64,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            await requestSignup(email);
+            await requestSignup(email, undefined, resolveReturnTo(returnTo));
         }
         finally {
             setSubmitting(false);

package/dist/auth-foundation/feature.js

@@ -10,6 +10,7 @@
 // Middleware / runProdApp resolve providers from the registry at boot
 // (tokenVerifier/sessionStore) or request-time (tokenVerifier shape match).
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { systemScopedRunner } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import { validateSessionStoreMultiplicity, validateTenantExistenceMultiplicity, validateTenantResolverMultiplicity, validateTokenVerifierMultiplicity, } from "./boot-checks.js";
 import { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, isAuthProviderPlugin, isSessionStoreProvider, isTenantExistenceProvider, isTenantResolverProvider, tokenShapeMatches, } from "./types.js";
 export { EXT_SESSION_STORE, EXT_TENANT_EXISTENCE, EXT_TENANT_RESOLVER, EXT_TOKEN_VERIFIER, } from "./types.js";
@@ -49,6 +50,13 @@ export function createAuthFoundationFeature() {
         r.bootCheck(({ features }) => validateTenantExistenceMultiplicity(features));
     }, { dedupeOptions: {} });
 }
+// Providers run before any tenant or session exists (token verify, host to tenant), so their reads are cross-tenant by nature.
+function systemScopedDeps(deps) {
+    return {
+        ...deps,
+        db: systemScopedRunner(deps.db, "auth lookups run before a tenant is established"),
+    };
+}
 /**
  * Tries every registered tokenVerifier provider's shape against `rawToken`
  * in registration order and calls the first match's verifier. Returns null
@@ -62,7 +70,7 @@ export async function resolveTokenVerifier(deps, rawToken) {
             continue;
         if (!tokenShapeMatches(usage.options.shape, rawToken))
             continue;
-        const verify = await usage.options.build(deps);
+        const verify = await usage.options.build(systemScopedDeps(deps));
         return verify(rawToken);
     }
     return null;
@@ -78,7 +86,7 @@ export async function resolveSessionStore(deps) {
     if (!usage || !isSessionStoreProvider(usage.options)) {
         throw new Error("[auth-foundation] no sessionStore provider registered — did the boot validator run?");
     }
-    return usage.options.build(deps);
+    return usage.options.build(systemScopedDeps(deps));
 }
 /** Optional tenantResolver — null when no provider registered. */
 export async function resolveTenantResolver(deps) {
@@ -88,7 +96,7 @@ export async function resolveTenantResolver(deps) {
     if (!isTenantResolverProvider(usage.options)) {
         throw new Error("[auth-foundation] tenantResolver provider registered without a valid TenantResolverProvider");
     }
-    const resolve = await usage.options.build(deps);
+    const resolve = await usage.options.build(systemScopedDeps(deps));
     return { resolve, trust: usage.options.trust };
 }
 /** Optional tenantExistence — null when no provider registered. */
@@ -99,5 +107,5 @@ export async function resolveTenantExistence(deps) {
     if (!isTenantExistenceProvider(usage.options)) {
         throw new Error("[auth-foundation] tenantExistence provider registered without a valid TenantExistenceProvider");
     }
-    return usage.options.build(deps);
+    return usage.options.build(systemScopedDeps(deps));
 }

package/dist/auth-mfa/config.d.ts

@@ -1,5 +1,5 @@
 import { type ConfigKeyHandle } from "@cosmicdrift/kumiko-framework/engine";
-export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "admins", "all"];
+export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "systemAdmins", "admins", "all"];
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
 export declare const mfaRequiredConfigHandle: ConfigKeyHandle<"select">;
 export declare function mfaRequiredConfigKey(defaultPolicy?: MfaRequiredPolicy): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;

package/dist/auth-mfa/config.js

@@ -2,14 +2,10 @@
 // they haven't opted in themselves? Default "optional" means the feature
 // is fully opt-in (existing tenants/users unaffected — no migration step).
 //
-// ponytail: "admins"/"all" HARD-BLOCK login for an unenrolled user (see
-// mfa-status-checker.ts's setupRequired branch) — there is no in-band way
-// for a blocked user to complete enrollment yet (that flow ships in PR3's
-// UI). Flipping this away from "optional" before PR3 locks out every
-// unenrolled matching user with no recovery path. Fine for a tenant that
-// enrolls its admins out-of-band first; a footgun otherwise.
+// Every non-optional policy blocks login for an unenrolled matching user until
+// they finish the pre-auth enrollment step (mfa-status-checker.ts setupRequired).
 import { access, createTenantConfig, } from "@cosmicdrift/kumiko-framework/engine";
-export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"];
+export const MFA_REQUIRED_POLICIES = ["optional", "systemAdmins", "admins", "all"];
 export const mfaRequiredConfigHandle = {
     name: "auth-mfa:config:required",
     type: "select",

package/dist/auth-mfa/handlers/disable.write.js

@@ -30,18 +30,18 @@ export function createDisableHandler(opts) {
             if (!row)
                 return mfaNotEnabled();
             // Fail closed, matching verify.write.ts/enable-confirm-preauth.write.ts
-            // without ctx.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
+            // without ctx.services.redis, verifyMfaFactor's TOTP-replay burn is skipped, and
             // a code observed once (phishing proxy/shoulder-surfing) could be
             // replayed within the ±1-step window to disable MFA outright.
-            // "no ctx.redis means no one gets through MFA login" doesn't cover
+            // "no ctx.services.redis means no one gets through MFA login" doesn't cover
             // this route — it's session-authed, and JWTs issued before Redis was
             // unwired stay valid until they expire.
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "disable (mfa) requires ctx.redis for TOTP replay protection",
+                    message: "disable (mfa) requires ctx.services.redis for TOTP replay protection",
                 }));
             }
-            const replay = { redis: ctx.redis, userId: event.user.id };
+            const replay = { redis: ctx.services.redis, userId: event.user.id };
             const verify = await verifyMfaFactor(row, event.payload.code, replay);
             if (!verify.ok)
                 return invalidTotpCode();

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -37,8 +37,8 @@ export function createEnableConfirmPreauthHandler(opts) {
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
             grants: ["systemIdentity", "unsafeRaw"],
-            reason: "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.queryAs(SYSTEM, " +
-                "user:findForAuth) and membership via ctx.resolveActiveMembership for the setup token's user. " +
+            reason: "Pre-auth MFA enrollment step has no session yet — re-checks status via ctx.dispatch.queryAs(SYSTEM, " +
+                "user:findForAuth) and membership via ctx.auth.resolveActiveMembership for the setup token's user. " +
                 "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +
                 "guest dispatch tenant.",
         },
@@ -60,19 +60,19 @@ export function createEnableConfirmPreauthHandler(opts) {
             // endpoint has NO gate before it (access: { roles: ["anonymous"] }, no JWT,
             // no prior challenge-token from a successful login) — its only secret
             // is a 6-digit TOTP code. Silently skipping the brute-force cap and
-            // single-use burn when ctx.redis is absent would let the setup token
+            // single-use burn when ctx.services.redis is absent would let the setup token
             // be guessed against unboundedly until its TTL expires. The route's
             // IP rate limiter is not a substitute: it's IP-scoped and resets on
             // every success.
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "enable-confirm-preauth requires ctx.redis for the brute-force cap and single-use burn",
+                    message: "enable-confirm-preauth requires ctx.services.redis for the brute-force cap and single-use burn",
                 }));
             }
             // Same guessing surface as /auth/mfa/verify (a short TOTP code) and
             // the same per-userId cap — deliberately shared counter, see
             // mfa-verify-attempts.ts.
-            const state = await getMfaVerifyLockoutState(ctx.redis, userId);
+            const state = await getMfaVerifyLockoutState(ctx.services.redis, userId);
             if (state?.lockedUntil !== null && state?.lockedUntil !== undefined) {
                 const now = Date.now();
                 if (state.lockedUntil > now) {
@@ -82,17 +82,22 @@ export function createEnableConfirmPreauthHandler(opts) {
             }
             const secret = base32Decode(verify.payload.totpSecretBase32);
             if (verifyTotp(secret, event.payload.code) === false) {
-                await recordFailedMfaVerifyAttempt(ctx.redis, userId, maxAttempts, lockoutMinutes);
+                await recordFailedMfaVerifyAttempt(ctx.services.redis, userId, maxAttempts, lockoutMinutes);
                 return invalidTotpCode();
             }
             // Burn the setup token on the first successful confirm — same
             // single-use guarantee as enable-confirm.write.ts.
-            const burnResult = await burnToken(ctx.redis, "mfa-setup", userId, verify.expiresAtMs);
+            const burnResult = await burnToken(ctx.services.redis, "mfa-setup", userId, verify.expiresAtMs);
             if (burnResult === "already-used")
                 return invalidSetupToken();
             // "system" mode: no session exists yet, tenantId comes from the
             // verified token, mirroring enable-start-preauth.write.ts.
-            const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+            const scopedDb = createTenantDb({
+                db: ctx.db.unsafeRaw(),
+                tenantId,
+                mode: "system",
+                reason: "pre-auth MFA setup has no session, the tenant comes from the verified setup token",
+            });
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)
@@ -112,7 +117,7 @@ export function createEnableConfirmPreauthHandler(opts) {
             // existing userId-unique-constraint backstop between the
             // `existing` check above and executor.create() below.
             const systemUser = createSystemUser(tenantId, ["SystemAdmin"]);
-            const userRow = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+            const userRow = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
                 id: userId,
             })); // @cast-boundary engine-payload
             if (!userRow)
@@ -123,7 +128,7 @@ export function createEnableConfirmPreauthHandler(opts) {
                 return invalidSetupToken();
             }
             const globalRoles = parseRoles(userRow?.roles ?? null);
-            const active = await ctx.resolveActiveMembership(userId, tenantId);
+            const active = await ctx.auth.resolveActiveMembership(userId, tenantId);
             if (active.kind === "rejected")
                 return invalidSetupToken();
             const result = await executor.create({
@@ -135,8 +140,8 @@ export function createEnableConfirmPreauthHandler(opts) {
             }, scopedUser, scopedDb);
             if (!result.isSuccess)
                 return result;
-            // ctx.redis is guaranteed by the fail-closed check above.
-            await clearMfaVerifyAttempts(ctx.redis, userId);
+            // ctx.services.redis is guaranteed by the fail-closed check above.
+            await clearMfaVerifyAttempts(ctx.services.redis, userId);
             // Re-derive the full session the way verify.write.ts does — the
             // setupToken only proves "password + new TOTP secret", not roles;
             // roles come from the membership lookup above, same as every other
@@ -157,7 +162,7 @@ export function createEnableConfirmPreauthHandler(opts) {
                 ...sessionTimezoneField(userRow?.timezone),
                 ...sessionLocaleField(userRow?.locale),
             };
-            const claims = await ctx.resolveAuthClaims(baseSession);
+            const claims = await ctx.auth.resolveClaims(baseSession);
             const session = Object.keys(claims).length > 0 ? { ...baseSession, claims } : baseSession;
             // Last step before returning success: every gate above (status,
             // membership, entity-write) has passed, so this is the point of no

package/dist/auth-mfa/handlers/enable-confirm.write.js

@@ -45,9 +45,9 @@ export function createEnableConfirmHandler(opts) {
             // second seeing invalidSetupToken(). Checked before the TOTP verify
             // for the same reason the other two handlers check it early: fail
             // closed before doing any of the guarded work, not partway through.
-            if (!ctx.redis) {
+            if (!ctx.services.redis) {
                 return writeFailure(new InternalError({
-                    message: "enable-confirm requires ctx.redis for the single-use setup-token burn",
+                    message: "enable-confirm requires ctx.services.redis for the single-use setup-token burn",
                 }));
             }
             const secret = base32Decode(verify.payload.totpSecretBase32);
@@ -65,7 +65,7 @@ export function createEnableConfirmHandler(opts) {
             // concurrent mfa_already_enabled() write) is meant to leave the burn
             // standing. Add unburnToken here if create-failure retries turn out
             // to matter.
-            const burnResult = await burnToken(ctx.redis, "mfa-setup", event.user.id, verify.expiresAtMs);
+            const burnResult = await burnToken(ctx.services.redis, "mfa-setup", event.user.id, verify.expiresAtMs);
             if (burnResult === "already-used")
                 return invalidSetupToken();
             const existing = await findUserMfaRow(ctx.db, event.user);

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -44,7 +44,12 @@ export function createEnableStartPreauthHandler(opts) {
             // "system" mode: the guest dispatch identity's own tenantId is
             // meaningless here — the preauthSetupToken is the source of truth
             // for which tenant's row to read, mirroring verify.write.ts.
-            const scopedDb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
+            const scopedDb = createTenantDb({
+                db: ctx.db.unsafeRaw(),
+                tenantId,
+                mode: "system",
+                reason: "pre-auth MFA setup has no session, the tenant comes from the verified setup token",
+            });
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)