@cosmicdrift/kumiko-bundled-features 0.87.0 → 0.87.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.87.0",
+  "version": "0.87.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -86,11 +86,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.87.0",
-    "@cosmicdrift/kumiko-framework": "0.87.0",
-    "@cosmicdrift/kumiko-headless": "0.87.0",
-    "@cosmicdrift/kumiko-renderer": "0.87.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.87.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.87.1",
+    "@cosmicdrift/kumiko-framework": "0.87.1",
+    "@cosmicdrift/kumiko-headless": "0.87.1",
+    "@cosmicdrift/kumiko-renderer": "0.87.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.87.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/web/__tests__/session-auth-bootstrap.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, test } from "bun:test";
+import { emailPasswordClient } from "../client-plugin";
+import { hasLikelyAuthSession } from "../session";
+
+describe("hasLikelyAuthSession", () => {
+  test("no kumiko_csrf cookie → false", () => {
+    expect(hasLikelyAuthSession("theme=dark")).toBe(false);
+  });
+
+  test("kumiko_csrf present → true", () => {
+    expect(hasLikelyAuthSession("kumiko_csrf=abc-123")).toBe(true);
+  });
+});
+
+describe("emailPasswordClient", () => {
+  test("registers SessionAuthGate as gate, not SessionProvider as provider", () => {
+    const feature = emailPasswordClient();
+    expect(feature.providers).toEqual([]);
+    expect(feature.gates).toHaveLength(1);
+    expect(feature.gates[0]?.name).toBe("SessionAuthGate");
+  });
+});

package/src/auth-email-password/web/auth-gate.tsx

@@ -11,7 +11,7 @@
 
 import type { ComponentType, ReactNode } from "react";
 import { LoginScreen, type LoginScreenProps } from "./login-screen";
-import { useSession } from "./session";
+import { SessionProvider, useSession } from "./session";
 
 export function makeAuthGate(
   LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
@@ -31,3 +31,22 @@ export function makeAuthGate(
   }
   return AuthGate;
 }
+
+/** SessionProvider + AuthGate als ein Gate — damit öffentliche Gates davor
+ *  (z.B. /rechner) den Session-Bootstrap nicht mounten. createKumikoApp
+ *  stackt providers außerhalb aller gates; SessionProvider darf deshalb
+ *  kein provider mehr sein. */
+export function makeSessionAuthGate(
+  LoginComponent: ComponentType<LoginScreenProps> = LoginScreen,
+  loginProps?: LoginScreenProps,
+): ComponentType<{ children: ReactNode }> {
+  const AuthGate = makeAuthGate(LoginComponent, loginProps);
+  function SessionAuthGate({ children }: { readonly children: ReactNode }): ReactNode {
+    return (
+      <SessionProvider>
+        <AuthGate>{children}</AuthGate>
+      </SessionProvider>
+    );
+  }
+  return SessionAuthGate;
+}

package/src/auth-email-password/web/client-plugin.ts

@@ -8,9 +8,8 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
 import { defaultTranslations, mergeTranslations } from "../i18n";
-import { makeAuthGate } from "./auth-gate";
+import { makeSessionAuthGate } from "./auth-gate";
 import type { LoginScreenProps } from "./login-screen";
-import { SessionProvider } from "./session";
 
 export type EmailPasswordClientOptions = {
   /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
@@ -41,8 +40,8 @@ export function emailPasswordClient(
   const translations = mergeTranslations(defaultTranslations, options.translations ?? {});
   return {
     name: "auth-email-password",
-    providers: [SessionProvider],
-    gates: [makeAuthGate(options.loginScreen, options.loginScreenProps)],
+    providers: [],
+    gates: [makeSessionAuthGate(options.loginScreen, options.loginScreenProps)],
     translations,
   };
 }

package/src/auth-email-password/web/index.ts

@@ -26,7 +26,7 @@ export {
 } from "./auth-client";
 export type { AuthShellRenderer } from "./auth-form-primitives";
 export { AuthShellProvider, useAuthShell } from "./auth-form-primitives";
-export { makeAuthGate } from "./auth-gate";
+export { makeAuthGate, makeSessionAuthGate } from "./auth-gate";
 export type {
   EmailPasswordClientFeature,
   EmailPasswordClientOptions,
@@ -43,7 +43,7 @@ export { LoginScreen } from "./login-screen";
 export type { ResetPasswordScreenProps } from "./reset-password-screen";
 export { ResetPasswordScreen } from "./reset-password-screen";
 export type { SessionApi, SessionState, SessionStatus } from "./session";
-export { SessionContext, SessionProvider, useSession } from "./session";
+export { hasLikelyAuthSession, SessionContext, SessionProvider, useSession } from "./session";
 export type { SignupCompleteScreenProps } from "./signup-complete-screen";
 export { SignupCompleteScreen } from "./signup-complete-screen";
 export type { SignupScreenProps } from "./signup-screen";

package/src/auth-email-password/web/session.tsx

@@ -9,6 +9,7 @@
 // unter `<SessionProvider>`; der `useSession()`-Hook liefert den State
 // und die Transitions.
 
+import { readCsrfToken } from "@cosmicdrift/kumiko-dispatcher-live";
 import { createContext, type ReactNode, useCallback, useContext, useEffect, useState } from "react";
 import {
   type CurrentUserProfile,
@@ -43,6 +44,14 @@ export type SessionApi = SessionState & {
   readonly switchTenant: (tenantId: string) => Promise<void>;
 };
 
+const UNAUTHENTICATED: SessionState = {
+  status: "unauthenticated",
+  user: null,
+  activeTenantId: null,
+  tenants: [],
+  roles: [],
+};
+
 const INITIAL: SessionState = {
   status: "loading",
   user: null,
@@ -51,6 +60,11 @@ const INITIAL: SessionState = {
   roles: [],
 };
 
+// kumiko_auth ist HttpOnly — kumiko_csrf wird beim Login gemeinsam gesetzt.
+export function hasLikelyAuthSession(cookieSource?: string): boolean {
+  return readCsrfToken(cookieSource) !== undefined;
+}
+
 // Exported damit tests den merge-pfad direkt pinnen können — der hier
 // muss byte-identisch zum server-side merge in auth-routes.ts +
 // login.write.ts sein, sonst sieht der Client andere session-rollen
@@ -76,27 +90,18 @@ export function computeActiveRoles(
 export const SessionContext = createContext<SessionApi | undefined>(undefined);
 
 // Eine Refresh-Runde: /auth/tenants → wenn 401 nicht-eingeloggt, sonst
-// parallel /user:me. Beides zusammen ergibt den vollen SessionState.
+// /user:me. Beides zusammen ergibt den vollen SessionState.
 async function refresh(): Promise<SessionState> {
+  if (!hasLikelyAuthSession()) {
+    return UNAUTHENTICATED;
+  }
   const tenants = await fetchTenants();
   if (tenants === null) {
-    return {
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    };
+    return UNAUTHENTICATED;
   }
   const user = await fetchCurrentUser();
   if (user === null) {
-    return {
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    };
+    return UNAUTHENTICATED;
   }
   return {
     status: "authenticated",
@@ -131,13 +136,7 @@ export function SessionProvider({ children }: { readonly children: ReactNode }):
 
   const logout = useCallback<SessionApi["logout"]>(async () => {
     await logoutApi();
-    setState({
-      status: "unauthenticated",
-      user: null,
-      activeTenantId: null,
-      tenants: [],
-      roles: [],
-    });
+    setState(UNAUTHENTICATED);
     // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
     // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
     // sauberer Ausgangslage, ohne dass wir jeden einzelnen Consumer