@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-email-password/web/__tests__/auth-gate.test.tsx

@@ -1,7 +1,7 @@
-import { describe, expect, test } from "bun:test";
-import { screen } from "@testing-library/react";
+import { describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
-import { makeAuthGate } from "../auth-gate";
+import { createLoginRoute, makeAuthGate } from "../auth-gate";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 describe("makeAuthGate", () => {
@@ -10,7 +10,7 @@ describe("makeAuthGate", () => {
   }
 
   test("loading → renders placeholder, not children, not login", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     const session = makeSessionApi({ status: "loading", user: null });
     const { container } = renderWithProviders(
       <Gate>
@@ -25,7 +25,7 @@ describe("makeAuthGate", () => {
   });
 
   test("unauthenticated → renders LoginComponent, not children", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     const session = makeSessionApi({ status: "unauthenticated", user: null });
     renderWithProviders(
       <Gate>
@@ -38,7 +38,7 @@ describe("makeAuthGate", () => {
   });
 
   test("authenticated → renders children, not login", () => {
-    const Gate = makeAuthGate(CustomLogin);
+    const Gate = makeAuthGate({ loginScreen: CustomLogin });
     renderWithProviders(
       <Gate>
         <div data-testid="protected">secret</div>
@@ -48,3 +48,191 @@ describe("makeAuthGate", () => {
     expect(screen.queryByTestId("custom-login")).toBeNull();
   });
 });
+
+describe("createLoginRoute", () => {
+  function CustomLogin(): ReactNode {
+    return <div data-testid="custom-login">custom-login</div>;
+  }
+
+  function LoginWithMfaTrigger({
+    onMfaChallenge,
+  }: {
+    readonly onMfaChallenge?: (challengeToken: string) => void;
+  }): ReactNode {
+    return (
+      <button type="button" data-testid="trigger-mfa" onClick={() => onMfaChallenge?.("token-123")}>
+        trigger
+      </button>
+    );
+  }
+
+  function CustomMfaVerify({ challengeToken }: { readonly challengeToken: string }): ReactNode {
+    return <div data-testid="mfa-verify">{challengeToken}</div>;
+  }
+
+  function LoginWithMfaSetupTrigger({
+    onMfaSetupRequired,
+  }: {
+    readonly onMfaSetupRequired?: (preauthSetupToken: string, accountLabel: string) => void;
+  }): ReactNode {
+    return (
+      <button
+        type="button"
+        data-testid="trigger-mfa-setup"
+        onClick={() => onMfaSetupRequired?.("setup-token-123", "user@example.com")}
+      >
+        trigger
+      </button>
+    );
+  }
+
+  function CustomMfaSetup({
+    preauthSetupToken,
+    accountLabel,
+    onSuccess,
+  }: {
+    readonly preauthSetupToken: string;
+    readonly accountLabel: string;
+    readonly onSuccess?: () => void;
+  }): ReactNode {
+    return (
+      <div data-testid="mfa-setup">
+        <span data-testid="mfa-setup-info">
+          {preauthSetupToken}:{accountLabel}
+        </span>
+        <button type="button" data-testid="complete-mfa-setup" onClick={() => onSuccess?.()}>
+          complete
+        </button>
+      </div>
+    );
+  }
+
+  test("authenticated + onAuthenticated → renders nothing, fires onAuthenticated exactly once", () => {
+    const onAuthenticated = mock(() => {});
+    const LoginRoute = createLoginRoute({ loginScreen: CustomLogin, onAuthenticated });
+    const session = makeSessionApi({ status: "authenticated" });
+    const { container } = renderWithProviders(<LoginRoute />, { session });
+    expect(container.firstChild).toBeNull();
+    expect(onAuthenticated).toHaveBeenCalledTimes(1);
+  });
+
+  test("authenticated without onAuthenticated → falls through to LoginComponent (standalone mount)", () => {
+    const LoginRoute = createLoginRoute({ loginScreen: CustomLogin });
+    const session = makeSessionApi({ status: "authenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    expect(screen.getByTestId("custom-login")).toBeTruthy();
+  });
+
+  test("onMfaChallenge → renders MfaVerifyComponent with the challenge token", () => {
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaTrigger,
+      mfaVerifyScreen: CustomMfaVerify,
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa"));
+    expect(screen.getByTestId("mfa-verify").textContent).toBe("token-123");
+  });
+
+  test("no mfaVerifyScreen → onMfaChallenge passes through to loginScreenProps.onMfaChallenge (#266 footgun)", () => {
+    // The silent-no-MFA-fallback path: an app that wires its own
+    // onMfaChallenge via loginScreenProps but forgets mfaVerifyScreen still
+    // gets that callback invoked (createLoginRoute can't detect the
+    // omission) instead of the internal setChallengeToken/MfaVerifyComponent
+    // machinery kicking in. Covered here so a future refactor of that
+    // ternary can't silently swap the fallback direction.
+    const onMfaChallenge = mock<(challengeToken: string) => void>();
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaTrigger,
+      loginScreenProps: { onMfaChallenge },
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa"));
+    expect(onMfaChallenge).toHaveBeenCalledWith("token-123");
+    expect(screen.queryByTestId("mfa-verify")).toBeNull();
+  });
+
+  test("makeAuthGate delegates mfaVerifyScreen wiring to createLoginRoute", () => {
+    const Gate = makeAuthGate({
+      loginScreen: LoginWithMfaTrigger,
+      mfaVerifyScreen: CustomMfaVerify,
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(
+      <Gate>
+        <div data-testid="protected">secret</div>
+      </Gate>,
+      { session },
+    );
+    fireEvent.click(screen.getByTestId("trigger-mfa"));
+    expect(screen.getByTestId("mfa-verify").textContent).toBe("token-123");
+  });
+
+  test("onMfaSetupRequired → renders MfaSetupComponent with token and accountLabel", () => {
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa-setup"));
+    expect(screen.getByTestId("mfa-setup-info").textContent).toBe(
+      "setup-token-123:user@example.com",
+    );
+  });
+
+  test("MfaSetupComponent onSuccess → gate clears the request and refreshes the session", async () => {
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa-setup"));
+    expect(screen.getByTestId("mfa-setup")).toBeTruthy();
+    fireEvent.click(screen.getByTestId("complete-mfa-setup"));
+    expect(session.refresh).toHaveBeenCalledTimes(1);
+    await waitFor(() => {
+      expect(screen.queryByTestId("mfa-setup")).toBeNull();
+    });
+  });
+
+  test("MfaSetupComponent onSuccess → keeps setup screen when refresh rejects", async () => {
+    const LoginRoute = createLoginRoute({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      refresh: mock(async () => {
+        throw new Error("refresh failed");
+      }),
+    });
+    renderWithProviders(<LoginRoute />, { session });
+    fireEvent.click(screen.getByTestId("trigger-mfa-setup"));
+    fireEvent.click(screen.getByTestId("complete-mfa-setup"));
+    expect(session.refresh).toHaveBeenCalledTimes(1);
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(screen.getByTestId("mfa-setup")).toBeTruthy();
+  });
+
+  test("makeAuthGate delegates mfaSetupScreen wiring to createLoginRoute", () => {
+    const Gate = makeAuthGate({
+      loginScreen: LoginWithMfaSetupTrigger,
+      mfaSetupScreen: CustomMfaSetup,
+    });
+    const session = makeSessionApi({ status: "unauthenticated" });
+    renderWithProviders(
+      <Gate>
+        <div data-testid="protected">secret</div>
+      </Gate>,
+      { session },
+    );
+    fireEvent.click(screen.getByTestId("trigger-mfa-setup"));
+    expect(screen.getByTestId("mfa-setup-info").textContent).toBe(
+      "setup-token-123:user@example.com",
+    );
+  });
+});

package/src/auth-email-password/web/__tests__/client-plugin.test.tsx

@@ -0,0 +1,34 @@
+import { describe, expect, mock, test } from "bun:test";
+
+// #1472: emailPasswordClient() built the session gate without threading
+// options.mfaSetupScreen through to makeSessionAuthGate — the option was
+// typed and documented but silently dropped on the standard mount path.
+// makeSessionAuthGate wraps its own real SessionProvider (unlike
+// makeAuthGate, which auth-gate.test.tsx exercises directly), so the
+// cheapest live check is spying on the call args instead of rendering
+// through a real session fetch.
+const makeSessionAuthGateCalls: unknown[][] = [];
+mock.module("../auth-gate", () => ({
+  makeSessionAuthGate: (...args: unknown[]) => {
+    makeSessionAuthGateCalls.push(args);
+    return () => null;
+  },
+}));
+
+const { emailPasswordClient } = await import("../client-plugin");
+
+describe("emailPasswordClient — mfaSetupScreen wiring", () => {
+  test("passes options.mfaSetupScreen through to makeSessionAuthGate", () => {
+    makeSessionAuthGateCalls.length = 0;
+    function CustomMfaSetup() {
+      return null;
+    }
+
+    emailPasswordClient({ mfaSetupScreen: CustomMfaSetup });
+
+    expect(makeSessionAuthGateCalls).toHaveLength(1);
+    expect((makeSessionAuthGateCalls[0]?.[0] as { mfaSetupScreen?: unknown })?.mfaSetupScreen).toBe(
+      CustomMfaSetup,
+    );
+  });
+});

package/src/auth-email-password/web/__tests__/confirm-account-unlock-screen.test.tsx

@@ -0,0 +1,64 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { screen, waitFor } from "@testing-library/react";
+import { ConfirmAccountUnlockScreen } from "../confirm-account-unlock-screen";
+import { renderWithProviders } from "./test-utils";
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("ConfirmAccountUnlockScreen", () => {
+  test("ohne Token → missing-token page", () => {
+    renderWithProviders(<ConfirmAccountUnlockScreen />);
+    expect(screen.getByText(/enthält keinen Token/i)).toBeTruthy();
+    expect(screen.getByRole("link", { name: "Zum Login" }).getAttribute("href")).toBe("/login");
+  });
+
+  test("mit Token + 200 → success after auto-submit", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<ConfirmAccountUnlockScreen token="unlock-tok" loginHref="/home" />);
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/confirm-account-unlock",
+        expect.objectContaining({
+          method: "POST",
+          headers: expect.objectContaining({ "Content-Type": "application/json" }),
+          credentials: "same-origin",
+          body: JSON.stringify({ token: "unlock-tok" }),
+        }),
+      );
+      expect(screen.getByText("Konto entsperrt")).toBeTruthy();
+    });
+    expect(screen.getByRole("link", { name: "Zum Login" }).getAttribute("href")).toBe("/home");
+  });
+
+  test("mit Token + 422 → error state", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ error: { code: "invalid_unlock_token" } }), { status: 422 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<ConfirmAccountUnlockScreen token="bad" />);
+
+    await waitFor(() => {
+      expect(screen.getByText("Entsperren fehlgeschlagen")).toBeTruthy();
+    });
+    expect(screen.getByRole("link", { name: "Zum Login" })).toBeTruthy();
+  });
+
+  test("custom title on missing-token uses errorTitle slot only when set", () => {
+    renderWithProviders(<ConfirmAccountUnlockScreen title="Unlock kaputt" />);
+    expect(screen.getByText("Unlock kaputt")).toBeTruthy();
+    expect(screen.queryByText("Entsperren fehlgeschlagen")).toBeNull();
+  });
+});

package/src/auth-email-password/web/__tests__/forgot-password-screen.test.tsx

@@ -3,12 +3,16 @@ import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { ForgotPasswordScreen } from "../forgot-password-screen";
 import { renderWithProviders } from "./test-utils";
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
   ) as unknown as typeof fetch;
 });
-afterEach(() => {});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
 
 describe("ForgotPasswordScreen", () => {
   test("rendert title + email-input + submit-button (de)", () => {

package/src/auth-email-password/web/__tests__/invite-accept-screen.test.tsx

@@ -3,16 +3,17 @@
 // useSession() throws without a provider, so any consumer mounting this
 // screen on a public route outside SessionAuthGate crashed at runtime.
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 import {
   createStaticLocaleResolver,
   LocaleProvider,
   PrimitivesProvider,
 } from "@cosmicdrift/kumiko-renderer";
 import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
-import { render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { defaultTranslations } from "../../i18n";
 import { InviteAcceptScreen } from "../invite-accept-screen";
+import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 const resolver = createStaticLocaleResolver({ locale: "de" });
 
@@ -26,6 +27,27 @@ function renderWithoutSessionProvider(token: string) {
   );
 }
 
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(JSON.stringify({ tenantId: "tenant-new" }), { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+
+// Capture once — afterEach must restore the real Location, not `{...location}`
+// (plain objects break `new URL(window.location.href)` in useUrlToken → ResetPasswordScreen).
+const originalLocation = window.location;
+
+afterEach(() => {
+  Object.defineProperty(window, "location", {
+    configurable: true,
+    writable: true,
+    value: originalLocation,
+  });
+  globalThis.fetch = originalFetch;
+});
+
 describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
   test("renders the anonymous accept-form instead of throwing", () => {
     renderWithoutSessionProvider("tok-123");
@@ -40,5 +62,110 @@ describe("InviteAcceptScreen — no <SessionProvider> ancestor (632/1)", () => {
     expect(
       screen.getByText("Der Einladungs-Link enthält keinen Token oder ist ungültig."),
     ).toBeTruthy();
+    expect(screen.getByRole("link", { name: "Zum Login" }).getAttribute("href")).toBe("/login");
+  });
+});
+
+describe("InviteAcceptScreen — logged-in branch", () => {
+  test("authenticated session shows 1-click accept form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    expect(screen.getByText(/Du bist eingeloggt/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Annehmen" })).toBeTruthy();
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+  });
+
+  test("accept logged-in success redirects via loggedInHref function", async () => {
+    const assign = mock<(url: string) => void>();
+    Object.defineProperty(window, "location", {
+      configurable: true,
+      writable: true,
+      value: { href: originalLocation.href, search: originalLocation.search, assign },
+    });
+    renderWithProviders(
+      <InviteAcceptScreen token="tok-123" loggedInHref={({ tenantId }) => `/${tenantId}/home`} />,
+      { session: makeSessionApi({ status: "authenticated" }) },
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(assign).toHaveBeenCalledWith("/tenant-new/home");
+    });
+  });
+
+  test("accept logged-in failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithProviders(<InviteAcceptScreen token="bad" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
+  });
+
+  test("use other account switches to anon-existing form", () => {
+    renderWithProviders(<InviteAcceptScreen token="tok-123" />, {
+      session: makeSessionApi({ status: "authenticated" }),
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Mit anderem Account anmelden" }));
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+});
+
+describe("InviteAcceptScreen — anonymous branches", () => {
+  test("anon-existing submit posts invite-accept-with-login", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "secret123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-accept-with-login",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ token: "tok-123", email: "a@example.com", password: "secret123" }),
+        }),
+      );
+    });
+  });
+
+  test("toggle to anon-new hides email and posts invite-signup-complete", async () => {
+    const fetchMock = mock(
+      async () => new Response(JSON.stringify({ tenantId: "t1" }), { status: 200 }),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.click(screen.getByRole("button", { name: "Ich habe noch keinen Account" }));
+    expect(screen.queryByLabelText(/^E-Mail/)).toBeNull();
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "newpass123" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/invite-signup-complete",
+        expect.objectContaining({
+          body: JSON.stringify({ token: "tok-123", password: "newpass123" }),
+        }),
+      );
+    });
+  });
+
+  test("anon failure shows invalidInviteToken banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 422 }),
+    ) as unknown as typeof fetch;
+    renderWithoutSessionProvider("tok-123");
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@example.com" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "wrong" } });
+    fireEvent.click(screen.getByRole("button", { name: "Annehmen + Anmelden" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("auth.errors.invalidInviteToken");
+    });
   });
 });