@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -18,19 +18,27 @@
     "runtime": "runtime"
   },
   "exports": {
+    "./agent-tools": "./src/agent-tools/index.ts",
     "./audit": "./src/audit/index.ts",
+    "./audit/web": "./src/audit/web/index.ts",
+    "./admin-shell": "./src/admin-shell/index.ts",
+    "./admin-shell/web": "./src/admin-shell/web/index.ts",
     "./compliance-profiles": "./src/compliance-profiles/index.ts",
+    "./compliance-profiles/web": "./src/compliance-profiles/web/index.ts",
     "./config": "./src/config/index.ts",
+    "./crypto-shredding": "./src/crypto-shredding/index.ts",
     "./config/web": "./src/config/web/index.ts",
     "./data-retention": "./src/data-retention/index.ts",
     "./readiness": "./src/readiness/index.ts",
     "./jobs": "./src/jobs/index.ts",
+    "./jobs/web": "./src/jobs/web/index.ts",
     "./tier-engine": "./src/tier-engine/index.ts",
     "./tier-engine/web": "./src/tier-engine/web/index.ts",
     "./cap-counter": "./src/cap-counter/index.ts",
     "./custom-fields": "./src/custom-fields/index.ts",
     "./custom-fields/web": "./src/custom-fields/web/index.ts",
     "./tags": "./src/tags/index.ts",
+    "./tenant-settings": "./src/tenant-settings/index.ts",
     "./tags/web": "./src/tags/web/index.ts",
     "./folders": "./src/folders/index.ts",
     "./folders/web": "./src/folders/web/index.ts",
@@ -41,11 +49,16 @@
     "./subscription-stripe": "./src/subscription-stripe/index.ts",
     "./subscription-mollie": "./src/subscription-mollie/index.ts",
     "./foundation-shared": "./src/foundation-shared/index.ts",
+    "./auth-foundation": "./src/auth-foundation/index.ts",
     "./mail-foundation": "./src/mail-foundation/index.ts",
+    "./inbound-mail-foundation": "./src/inbound-mail-foundation/index.ts",
+    "./inbound-provider-inmemory": "./src/inbound-provider-inmemory/index.ts",
+    "./inbound-provider-imap": "./src/inbound-provider-imap/index.ts",
     "./mail-transport-smtp": "./src/mail-transport-smtp/index.ts",
     "./mail-transport-inmemory": "./src/mail-transport-inmemory/index.ts",
     "./file-foundation": "./src/file-foundation/index.ts",
     "./file-provider-s3": "./src/file-provider-s3/index.ts",
+    "./document-ingest-foundation": "./src/document-ingest-foundation/index.ts",
     "./file-provider-s3-env": "./src/file-provider-s3-env/index.ts",
     "./file-provider-inmemory": "./src/file-provider-inmemory/index.ts",
     "./files": "./src/files/index.ts",
@@ -54,7 +67,9 @@
     "./user-data-rights-defaults": "./src/user-data-rights-defaults/index.ts",
     "./tenant": "./src/tenant/index.ts",
     "./tenant/constants": "./src/tenant/constants.ts",
+    "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
+    "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -67,6 +82,7 @@
     "./auth-email-password/testing": "./src/auth-email-password/testing.ts",
     "./auth-email-password/web": "./src/auth-email-password/web/index.ts",
     "./delivery": "./src/delivery/index.ts",
+    "./delivery/web": "./src/delivery/web/index.ts",
     "./channel-in-app": "./src/channel-in-app/index.ts",
     "./channel-email": "./src/channel-email/index.ts",
     "./channel-push": "./src/channel-push/index.ts",
@@ -76,8 +92,15 @@
     "./presets": "./src/presets/index.ts",
     "./secrets": "./src/secrets/index.ts",
     "./sessions": "./src/sessions/index.ts",
+    "./auth-mfa": "./src/auth-mfa/index.ts",
+    "./auth-mfa-user-data": "./src/auth-mfa-user-data/index.ts",
+    "./auth-mfa/web": "./src/auth-mfa/web/index.ts",
+    "./auth-mfa/testing": "./src/auth-mfa/testing.ts",
     "./sessions/testing": "./src/sessions/testing.ts",
+    "./personal-access-tokens": "./src/personal-access-tokens/index.ts",
+    "./personal-access-tokens/web": "./src/personal-access-tokens/web/index.ts",
     "./feature-toggles": "./src/feature-toggles/index.ts",
+    "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
     "./text-content": "./src/text-content/index.ts",
     "./text-content/seeding": "./src/text-content/seeding.ts",
     "./text-content/web": "./src/text-content/web/index.ts",
@@ -88,23 +111,29 @@
     "./legal-pages": "./src/legal-pages/index.ts",
     "./legal-pages/web": "./src/legal-pages/web/index.ts",
     "./page-render": "./src/page-render/index.ts",
+    "./page-render/web": "./src/page-render/web.ts",
     "./managed-pages": "./src/managed-pages/index.ts",
+    "./managed-pages/web": "./src/managed-pages/web/index.ts",
     "./managed-pages/seeding": "./src/managed-pages/seeding.ts",
+    "./seo": "./src/seo/index.ts",
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "1.0.0",
-    "@cosmicdrift/kumiko-framework": "1.0.0",
-    "@cosmicdrift/kumiko-headless": "1.0.0",
-    "@cosmicdrift/kumiko-renderer": "1.0.0",
-    "@cosmicdrift/kumiko-renderer-web": "1.0.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "2.0.0",
+    "@cosmicdrift/kumiko-framework": "2.0.0",
+    "@cosmicdrift/kumiko-headless": "2.0.0",
+    "@cosmicdrift/kumiko-renderer": "2.0.0",
+    "@cosmicdrift/kumiko-renderer-web": "2.0.0",
     "@mollie/api-client": "^4.5.0",
+    "imapflow": "^1.3.3",
+    "mailparser": "^3.9.8",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",
     "clsx": "^2.1.1",
     "lucide-react": "^1.14.0",
     "marked": "^18.0.3",
     "nodemailer": "^9.0.1",
+    "qrcode": "^1.5.4",
     "react": "^19.2.6",
     "stripe": "^22.1.1",
     "tailwind-merge": "^3.6.0"
@@ -118,7 +147,12 @@
     "README.md",
     "LICENSE"
   ],
+  "peerDependencies": {
+    "@cosmicdrift/kumiko-types": "^2.0.0"
+  },
   "devDependencies": {
-    "@testing-library/user-event": "^14.6.1"
+    "@testing-library/user-event": "^14.6.1",
+    "@types/mailparser": "^3.4.6",
+    "@types/qrcode": "^1.5.5"
   }
 }

package/src/__tests__/access-invalidation-consumer.integration.test.ts

@@ -0,0 +1,279 @@
+// createAccessInvalidationEventConsumer (kumiko-framework#1560) — the last
+// leg of #1524's push-based mid-stream access revocation. Proves the
+// consumer reacts to the two real event sources it's specced against:
+//
+//   - sessions:event:session-revoked (#1559), both the self-service revoke
+//     path AND the privileged, cross-tenant revoke-all-for-user (DSGVO
+//     Art.18 account-freeze, appended anchored on SYSTEM_TENANT_ID).
+//   - tenant-membership.updated / .deleted (role change / member removal),
+//     where userId is read from the previous-snapshot rather than
+//     payload.changes.
+//
+// Asserted directly against stack.sseBroker.subscribeAccessInvalidation —
+// no real SSE connection or HTTP-stream needed, mirrors how sse-broker.test.ts
+// tests the broker itself. Mid-stream teardown (the actual AccessDeniedError
+// thrown into an open dispatch-stream) is #1561's job, not this one.
+//
+// Every write below MUST go through the real write handlers (never a
+// hand-crafted StoredEvent) — that's what pins the hardcoded event-type
+// literals in system-hooks.ts to their actual bundled-features sources. A
+// future "simplification" to synthetic events would silently destroy that
+// guard.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { SessionHandlers } from "../sessions/constants";
+import { createSessionsFeature } from "../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { TenantHandlers } from "../tenant/constants";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { UserHandlers } from "../user";
+import { createUserFeature } from "../user/feature";
+import { userEntity, userTable } from "../user/schema/user";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const TENANT = testTenantId(1);
+
+// Collects every userId the consumer pushed an invalidation for during the
+// running test, in push order. Reset in beforeEach.
+let invalidated: string[];
+let unsubscribe: (() => void) | undefined;
+
+function trackInvalidation(userId: string): void {
+  unsubscribe = stack.sseBroker.subscribeAccessInvalidation(userId, () => {
+    invalidated.push(userId);
+  });
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  invalidated = [];
+  unsubscribe?.();
+  unsubscribe = undefined;
+});
+
+describe("access-invalidation event consumer", () => {
+  test("session-revoked (self-service revoke) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("revoke1@example.com", "pw-long-enough");
+    const { token, sid } = await h.login("revoke1@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const res = await h.authedPost("/api/write", token, {
+      type: SessionHandlers.revoke,
+      payload: { id: sid },
+    });
+    expect(res.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("session-revoked via the privileged cross-tenant revoke-all-for-user (SYSTEM_TENANT_ID) still routes on payload.userId", async () => {
+    const { userId } = await h.seedUser("revoke2@example.com", "pw-long-enough");
+    await h.login("revoke2@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    // Fresh sid per test — withMintedSession mints synchronously instead of
+    // relying on stack.http's per-userId sid cache, which would otherwise
+    // hand back a sid truncated out from under it by the next beforeEach's
+    // resetTestTables(userSessionTable).
+    const systemActor = await withMintedSession(sessionCreator, {
+      id: TestUsers.systemAdmin.id,
+      tenantId: TENANT,
+      roles: ["system"],
+    });
+    const result = await stack.http.write(
+      SessionHandlers.revokeAllForUser,
+      { userId },
+      systemActor,
+    );
+    expect(result.status).toBe(200);
+
+    // The write itself is anchored on SYSTEM_TENANT_ID (not TENANT) — this
+    // is exactly the asymmetry #1559's handoff comment warns about. If the
+    // consumer routed on event.tenantId instead of payload.userId, this
+    // event would never surface here.
+    const events = await selectMany(stack.db, eventsTable, {
+      type: "sessions:event:session-revoked",
+    });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.updated (role change) reads userId from the previous snapshot and invalidates", async () => {
+    const { userId } = await h.seedUser("rolechange@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.deleted (member removed) reads userId from the previous snapshot and invalidates", async () => {
+    const { userId } = await h.seedUser("removed@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.removeMember,
+      { userId, tenantId: TENANT },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("tenant-membership.created (new member added) does not push an invalidation", async () => {
+    // A genuine tenant-membership.created event, not h.seedUser's direct-DB
+    // seedTenantMembership bypass — go through the real addMember write
+    // handler so this negative case exercises the actual event the
+    // consumer must ignore, not just "some other unrelated event type".
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "newmember@example.com", displayName: "newmember" },
+      TestUsers.systemAdmin,
+    );
+    trackInvalidation(created.id);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    await stack.http.writeOk(
+      TenantHandlers.addMember,
+      { userId: created.id, tenantId: TENANT, roles: ["User"] },
+      admin,
+    );
+
+    const events = await selectMany(stack.db, eventsTable, { type: "tenant-membership.created" });
+    expect(events.length).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([]);
+  });
+
+  test("password change (sessionMassRevoker) pushes an invalidation for that user", async () => {
+    const { userId } = await h.seedUser("pwchange@example.com", "old-pw-long-enough");
+    const { token } = await h.login("pwchange@example.com", "old-pw-long-enough");
+    trackInvalidation(userId);
+
+    // The industry-standard "password change signs you out everywhere" flow
+    // — goes through the sessionMassRevoker callback (feature.ts's postSave
+    // hook on passwordHash changes), NOT one of the *.write.ts handlers.
+    // This is exactly the gap a security review of #1560 caught: that
+    // callback did a raw updateMany with no event, so an already-open SSE
+    // stream survived a password change.
+    const res = await h.authedPost("/api/write", token, {
+      type: AuthHandlers.changePassword,
+      payload: { oldPassword: "old-pw-long-enough", newPassword: "new-pw-long-enough" },
+    });
+    expect(res.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+
+  test("sessionRevokeAllOthers callback (used by auth-mfa, distinct from the revoke-all-others.write.ts handler) pushes an invalidation", async () => {
+    const { userId } = await h.seedUser("mfarevoke@example.com", "pw-long-enough");
+    await h.login("mfarevoke@example.com", "pw-long-enough");
+    trackInvalidation(userId);
+
+    // currentSid undefined → revokes every live session, mirrors how
+    // auth-mfa calls this callback directly (no dispatcher ctx available).
+    const revoked = await callbacks.get().sessionRevokeAllOthers(userId, undefined);
+    expect(revoked).toBeGreaterThan(0);
+
+    await stack.eventDispatcher?.runOnce();
+
+    expect(invalidated).toEqual([userId]);
+  });
+});

package/src/__tests__/access-invalidation-stream.integration.test.ts

@@ -0,0 +1,217 @@
+// #1561 — mid-stream access revocation tears down an open HTTP SSE stream.
+// Complements access-invalidation-consumer.integration.test.ts (#1560), which
+// only asserts broker.publishAccessInvalidation. Here we open a real
+// POST /api/stream via createLiveDispatcher + setupTestStack, revoke access
+// while the generator is gated between chunks, and assert the client sees
+// access_denied instead of further yields.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { z } from "zod";
+import { AuthHandlers } from "../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../auth-email-password/feature";
+import { createConfigFeature } from "../config";
+import { createConfigResolver } from "../config/resolver";
+import { configValuesTable } from "../config/table";
+import { makeSessionHelpers } from "../sessions/__tests__/test-helpers";
+import { SessionHandlers } from "../sessions/constants";
+import { createSessionsFeature } from "../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../sessions/testing";
+import { createTenantFeature } from "../tenant";
+import { TenantHandlers } from "../tenant/constants";
+import { tenantMembershipsTable } from "../tenant/membership-table";
+import { tenantEntity } from "../tenant/schema/tenant";
+import { createUserFeature } from "../user/feature";
+import { userEntity, userTable } from "../user/schema/user";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const TENANT = testTenantId(1);
+
+// Gate between chunk 0 and chunk 1 so the test can revoke + drain the event
+// consumer before the stream's next pull — otherwise an eager pump would
+// race past the invalidation window.
+let releaseNextChunk: (() => void) | undefined;
+let nextChunkGate: Promise<void>;
+
+function resetGate(): void {
+  nextChunkGate = new Promise<void>((resolve) => {
+    releaseNextChunk = resolve;
+  });
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({}).optional(),
+    async function* () {
+      yield { phase: "open" as const };
+      await nextChunkGate;
+      // Reached only if mid-stream access check failed to cut the generator.
+      yield { phase: "should-not-reach-client" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(authJwt: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const cookieHeader = `kumiko_auth=${authJwt}; kumiko_csrf=${csrfToken}`;
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Cookie: cookieHeader,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  resetGate();
+});
+
+describe("access-invalidation mid-stream SSE teardown (#1561)", () => {
+  test("session revoke mid-stream terminates the open HTTP SSE stream", async () => {
+    await h.seedUser("stream-revoke@example.com", "pw-long-enough");
+    const { token, sid } = await h.login("stream-revoke@example.com", "pw-long-enough");
+
+    const { fetch, csrfToken } = buildLiveFetch(token);
+    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+
+    const iter = dispatcher
+      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
+      [Symbol.asyncIterator]();
+
+    const first = await iter.next();
+    expect(first.done).toBe(false);
+    expect(first.value).toEqual({ phase: "open" });
+
+    const revokeRes = await h.authedPost("/api/write", token, {
+      type: SessionHandlers.revoke,
+      payload: { id: sid },
+    });
+    expect(revokeRes.status).toBe(200);
+    await stack.eventDispatcher?.runOnce();
+
+    releaseNextChunk?.();
+
+    let thrown: unknown;
+    try {
+      await iter.next();
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toMatchObject({ code: "access_denied" });
+  });
+
+  test("tenant role strip mid-stream terminates the open HTTP SSE stream", async () => {
+    const { userId } = await h.seedUser("stream-roles@example.com", "pw-long-enough");
+    const { token } = await h.login("stream-roles@example.com", "pw-long-enough");
+
+    const { fetch, csrfToken } = buildLiveFetch(token);
+    const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+
+    const iter = dispatcher
+      .stream<{ phase: string }>("stream-probe:stream:probe:tail", {})
+      [Symbol.asyncIterator]();
+
+    const first = await iter.next();
+    expect(first.done).toBe(false);
+    expect(first.value).toEqual({ phase: "open" });
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    releaseNextChunk?.();
+
+    let thrown: unknown;
+    try {
+      await iter.next();
+    } catch (e) {
+      thrown = e;
+    }
+    expect(thrown).toMatchObject({ code: "access_denied" });
+  });
+});