@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-email-password/web/__tests__/login-screen.test.tsx

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 import { fireEvent, screen, waitFor } from "@testing-library/react";
 
 import { LoginScreen } from "../login-screen";
+import type { SessionApi } from "../session";
 import { makeSessionApi, renderWithProviders } from "./test-utils";
 
 const requestEmailVerificationMock = mock<() => Promise<unknown>>(() => Promise.resolve());
@@ -48,7 +49,10 @@ describe("LoginScreen", () => {
     const session = makeSessionApi({
       status: "unauthenticated",
       user: null,
-      login: mock(async () => ({ ok: false, error: { reason: "invalid_credentials" } })),
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "failure",
+        error: { reason: "invalid_credentials" },
+      })),
     });
     renderWithProviders(<LoginScreen />, { session });
 
@@ -70,8 +74,8 @@ describe("LoginScreen", () => {
     const session = makeSessionApi({
       status: "unauthenticated",
       user: null,
-      login: mock(async () => ({
-        ok: false,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "failure",
         error: { reason: "account_locked", retryAfterSeconds: 540 },
       })),
     });
@@ -148,7 +152,10 @@ describe("LoginScreen", () => {
       return makeSessionApi({
         status: "unauthenticated",
         user: null,
-        login: mock(async () => ({ ok: false, error: { reason: "email_not_verified" } })),
+        login: mock<SessionApi["login"]>(async () => ({
+          kind: "failure",
+          error: { reason: "email_not_verified" },
+        })),
       });
     }
 
@@ -230,11 +237,148 @@ describe("LoginScreen", () => {
       const session = makeSessionApi({
         status: "unauthenticated",
         user: null,
-        login: mock(async () => ({ ok: false, error: { reason: "invalid_credentials" } })),
+        login: mock<SessionApi["login"]>(async () => ({
+          kind: "failure",
+          error: { reason: "invalid_credentials" },
+        })),
       });
       renderWithProviders(<LoginScreen />, { session });
       await loginUntilEmailNotVerified();
       expect(screen.queryByRole("button", { name: /erneut senden/i })).toBeNull();
     });
   });
+
+  test("account_locked without retry → unlock link when href set", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "failure",
+        error: { reason: "account_locked" },
+      })),
+    });
+    renderWithProviders(<LoginScreen unlockAccountHref="/unlock" />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("vorübergehend gesperrt");
+    });
+    expect(screen.getByRole("link", { name: /Konto entsperren/i }).getAttribute("href")).toBe(
+      "/unlock",
+    );
+  });
+
+  test("reasonToKey covers no_membership, rate_limited, invalid_body, default", async () => {
+    const cases: Array<{ reason: string; needle: string }> = [
+      { reason: "no_membership", needle: "keinen Tenant-Zugang" },
+      { reason: "rate_limited", needle: "Zu viele Login-Versuche" },
+      { reason: "invalid_body", needle: "Ungültige Eingabe" },
+      { reason: "weird_unknown", needle: "Login fehlgeschlagen" },
+      { reason: "mfa_setup_required", needle: "Zwei-Faktor-Authentifizierung erforderlich" },
+    ];
+    for (const { reason, needle } of cases) {
+      const session = makeSessionApi({
+        status: "unauthenticated",
+        user: null,
+        login: mock<SessionApi["login"]>(async () => ({
+          kind: "failure",
+          error: { reason },
+        })),
+      });
+      const { unmount } = renderWithProviders(<LoginScreen />, { session });
+      fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+      fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+      fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+      await waitFor(() => {
+        expect(screen.getByRole("alert").textContent).toContain(needle);
+      });
+      unmount();
+    }
+  });
+
+  test("mfa-challenge with onMfaChallenge fires token", async () => {
+    const onMfaChallenge = mock<(t: string) => void>();
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen onMfaChallenge={onMfaChallenge} />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaChallenge).toHaveBeenCalledWith("chal-1");
+    });
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  test("mfa-challenge without callback → mfa_not_supported", async () => {
+    const session = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-challenge",
+        challengeToken: "chal-1",
+      })),
+    });
+    renderWithProviders(<LoginScreen />, { session });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("unterstützt keine Zwei-Faktor");
+    });
+  });
+
+  test("mfa-setup-required with and without onMfaSetupRequired", async () => {
+    const onMfaSetupRequired = mock<(preauthSetupToken: string, accountLabel: string) => void>();
+    const sessionOk = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
+    });
+    const { unmount } = renderWithProviders(
+      <LoginScreen onMfaSetupRequired={onMfaSetupRequired} />,
+      { session: sessionOk },
+    );
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(onMfaSetupRequired).toHaveBeenCalledWith("setup-token-value", "a@b.c");
+    });
+    unmount();
+
+    const sessionBare = makeSessionApi({
+      status: "unauthenticated",
+      user: null,
+      login: mock<SessionApi["login"]>(async () => ({
+        kind: "mfa-setup-required",
+        preauthSetupToken: "setup-token-value",
+      })),
+    });
+    renderWithProviders(<LoginScreen />, { session: sessionBare });
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), { target: { value: "a@b.c" } });
+    fireEvent.change(screen.getByLabelText(/^Passwort/), { target: { value: "x" } });
+    fireEvent.click(screen.getByRole("button", { name: "Einloggen" }));
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain(
+        "Zwei-Faktor-Authentifizierung erforderlich",
+      );
+    });
+  });
+
+  test("signupHref renders signup link", () => {
+    renderWithProviders(<LoginScreen signupHref="/signup" />);
+    const link = screen.getByRole("link", { name: "Account erstellen" });
+    expect(link.getAttribute("href")).toBe("/signup");
+  });
 });

package/src/auth-email-password/web/__tests__/request-account-unlock-screen.test.tsx

@@ -0,0 +1,137 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { RequestAccountUnlockScreen } from "../request-account-unlock-screen";
+import { renderWithProviders } from "./test-utils";
+
+const originalFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe("RequestAccountUnlockScreen", () => {
+  test("renders title + email input + submit (de)", () => {
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    expect(screen.getByText("Konto entsperren")).toBeTruthy();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Link anfordern" })).toBeTruthy();
+  });
+
+  test("submit posts /api/auth/request-account-unlock with email", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/request-account-unlock",
+        expect.objectContaining({
+          method: "POST",
+          headers: expect.objectContaining({ "Content-Type": "application/json" }),
+          credentials: "same-origin",
+          body: JSON.stringify({ email: "user@example.com" }),
+        }),
+      );
+    });
+  });
+
+  test("success → silent-success banner + back-to-login link", async () => {
+    renderWithProviders(<RequestAccountUnlockScreen loginHref="/signin" />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Mail gesendet")).toBeTruthy();
+    });
+    expect(screen.getByRole("link", { name: /Zurück zum Login/i }).getAttribute("href")).toBe(
+      "/signin",
+    );
+  });
+
+  test("429 with retryAfterSeconds → requestUnlock.rateLimited banner (#1333)", async () => {
+    globalThis.fetch = mock(
+      async () =>
+        new Response(JSON.stringify({ error: { details: { retryAfterSeconds: 180 } } }), {
+          status: 429,
+        }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("3 Minuten");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+
+  test("429 without retryAfterSeconds → generic rateLimited banner", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("Zu viele Login-Versuche");
+    });
+  });
+
+  test("server 5xx → unknownError banner, stays on form", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 500 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+    expect(screen.getByLabelText(/^E-Mail/)).toBeTruthy();
+  });
+
+  test("fetch throw → unknownError banner", async () => {
+    globalThis.fetch = mock(async () => {
+      throw new Error("network down");
+    }) as unknown as typeof fetch;
+
+    renderWithProviders(<RequestAccountUnlockScreen />);
+    fireEvent.change(screen.getByLabelText(/^E-Mail/), {
+      target: { value: "user@example.com" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: "Link anfordern" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+  });
+
+  test("custom title prop overrides default", () => {
+    renderWithProviders(<RequestAccountUnlockScreen title="Custom Unlock" />);
+    expect(screen.getByText("Custom Unlock")).toBeTruthy();
+  });
+});

package/src/auth-email-password/web/__tests__/reset-password-screen.test.tsx

@@ -3,12 +3,16 @@ import { fireEvent, screen, waitFor } from "@testing-library/react";
 import { ResetPasswordScreen } from "../reset-password-screen";
 import { renderWithProviders } from "./test-utils";
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
   ) as unknown as typeof fetch;
 });
-afterEach(() => {});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
 
 describe("ResetPasswordScreen", () => {
   test("ohne Token in URL UND ohne token-Prop → missing-token-Page", () => {

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -0,0 +1,134 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { SignupCompleteScreen } from "../signup-complete-screen";
+import { renderWithProviders } from "./test-utils";
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () =>
+      new Response(
+        JSON.stringify({
+          user: { id: "u1", tenantId: "t1", roles: ["User"] },
+          tenantKey: "acme",
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      ),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+function fillPasswords(password: string, confirm: string): void {
+  fireEvent.change(document.getElementById("signup-password") as HTMLInputElement, {
+    target: { value: password },
+  });
+  fireEvent.change(document.getElementById("signup-confirm-password") as HTMLInputElement, {
+    target: { value: confirm },
+  });
+}
+
+describe("SignupCompleteScreen", () => {
+  test("ohne Token in URL UND ohne token-Prop → missing-token-Page", () => {
+    renderWithProviders(<SignupCompleteScreen />);
+    expect(screen.getByText(/enthält keinen Token/i)).toBeTruthy();
+  });
+
+  test("mit token-Prop → Form rendert", () => {
+    renderWithProviders(<SignupCompleteScreen token="abc-token" />);
+    expect(document.getElementById("signup-password")).toBeTruthy();
+    expect(document.getElementById("signup-confirm-password")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Account aktivieren" })).toBeTruthy();
+  });
+
+  test("Passwort < 8 Zeichen → client-side error, kein fetch-Call", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="abc" />);
+    fillPasswords("short", "short");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("8 Zeichen");
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("happy path: gültiges Passwort → signup-confirm fetch + location.assign", async () => {
+    const assigned: string[] = [];
+    const assignOrig = window.location.assign.bind(window.location);
+    window.location.assign = ((url: string | URL) => {
+      assigned.push(String(url));
+    }) as typeof window.location.assign;
+
+    const fetchMock = mock(
+      async () =>
+        new Response(
+          JSON.stringify({
+            user: { id: "u1", tenantId: "t1", roles: ["User"] },
+            tenantKey: "acme",
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+    );
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    try {
+      renderWithProviders(
+        <SignupCompleteScreen
+          token="abc-token"
+          loggedInHref={({ tenantKey }) => `/${tenantKey}/`}
+        />,
+      );
+      fillPasswords("validpass1", "validpass1");
+      fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+      await waitFor(() => {
+        expect(fetchMock).toHaveBeenCalledWith(
+          "/api/auth/signup-confirm",
+          expect.objectContaining({
+            method: "POST",
+            body: JSON.stringify({ token: "abc-token", password: "validpass1" }),
+          }),
+        );
+        expect(assigned).toEqual(["/acme/"]);
+      });
+    } finally {
+      window.location.assign = assignOrig;
+    }
+  });
+
+  test("mismatch → client-side error, kein fetch-Call", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="abc" />);
+    fillPasswords("validpass1", "differentpass");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("nicht überein");
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("server invalid_signup_token → mapped i18n-error im UI", async () => {
+    const errBody = JSON.stringify({
+      error: { code: "invalid_signup_token", details: { reason: "invalid_signup_token" } },
+    });
+    globalThis.fetch = mock(
+      async () => new Response(errBody, { status: 422 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupCompleteScreen token="bad" />);
+    fillPasswords("validpass1", "validpass1");
+    fireEvent.click(screen.getByRole("button", { name: "Account aktivieren" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/ungültig|abgelaufen/i);
+    });
+  });
+});

package/src/auth-email-password/web/__tests__/signup-screen.test.tsx

@@ -0,0 +1,93 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { SignupScreen } from "../signup-screen";
+import { renderWithProviders } from "./test-utils";
+
+const realFetch = globalThis.fetch;
+
+beforeEach(() => {
+  globalThis.fetch = mock(
+    async () => new Response(null, { status: 200 }),
+  ) as unknown as typeof fetch;
+});
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+function fillEmail(value: string): void {
+  fireEvent.change(document.getElementById("signup-email") as HTMLInputElement, {
+    target: { value },
+  });
+}
+
+describe("SignupScreen", () => {
+  test("rendert title + email-input + submit-button (de)", () => {
+    renderWithProviders(<SignupScreen />);
+    expect(screen.getByText("Account erstellen")).toBeTruthy();
+    expect(document.getElementById("signup-email")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Aktivierungs-Link senden" })).toBeTruthy();
+  });
+
+  test("submit ruft /api/auth/signup-request mit der Email", async () => {
+    const fetchMock = mock(async () => new Response(null, { status: 200 }));
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(fetchMock).toHaveBeenCalledWith(
+        "/api/auth/signup-request",
+        expect.objectContaining({
+          method: "POST",
+          body: JSON.stringify({ email: "new@example.com" }),
+        }),
+      );
+    });
+  });
+
+  test("nach erfolgreichem Submit: success-Banner + Resend", async () => {
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByText("Mail gesendet")).toBeTruthy();
+    });
+    expect(screen.getByRole("button", { name: /Mail erneut senden/i })).toBeTruthy();
+  });
+
+  test("rate_limited mit retryAfterSeconds → interpolated minutes", async () => {
+    const errBody = JSON.stringify({
+      error: { code: "rate_limited", details: { retryAfterSeconds: 120 } },
+    });
+    globalThis.fetch = mock(
+      async () => new Response(errBody, { status: 429 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toMatch(/2/);
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+
+  test("server 5xx → error-banner statt Success-State", async () => {
+    globalThis.fetch = mock(
+      async () => new Response(null, { status: 500 }),
+    ) as unknown as typeof fetch;
+
+    renderWithProviders(<SignupScreen />);
+    fillEmail("new@example.com");
+    fireEvent.click(screen.getByRole("button", { name: "Aktivierungs-Link senden" }));
+
+    await waitFor(() => {
+      expect(screen.getByRole("alert").textContent).toContain("schief");
+    });
+    expect(screen.queryByText("Mail gesendet")).toBeNull();
+  });
+});

package/src/auth-email-password/web/__tests__/test-utils.tsx

@@ -26,9 +26,10 @@ export type MakeSessionApiOptions = Partial<SessionState> & {
   readonly login?: SessionApi["login"];
   readonly logout?: SessionApi["logout"];
   readonly switchTenant?: SessionApi["switchTenant"];
+  readonly refresh?: SessionApi["refresh"];
 };
 export function makeSessionApi(overrides: MakeSessionApiOptions = {}): SessionApi {
-  const { login, logout, switchTenant, ...stateOverrides } = overrides;
+  const { login, logout, switchTenant, refresh, ...stateOverrides } = overrides;
   const base: SessionState = {
     status: "authenticated",
     user: {
@@ -44,9 +45,18 @@ export function makeSessionApi(overrides: MakeSessionApiOptions = {}): SessionAp
   };
   return {
     ...base,
-    login: login ?? mock<SessionApi["login"]>(async () => ({ ok: true })),
+    login:
+      login ??
+      mock<SessionApi["login"]>(async () => ({
+        kind: "success",
+        data: {
+          token: "test-token",
+          user: { id: "test-user", tenantId: "tenant-1", roles: ["Admin"] },
+        },
+      })),
     logout: logout ?? mock<SessionApi["logout"]>(async () => {}),
     switchTenant: switchTenant ?? mock<SessionApi["switchTenant"]>(async () => {}),
+    refresh: refresh ?? mock<SessionApi["refresh"]>(async () => {}),
   };
 }
 export function renderWithProviders(

package/src/auth-email-password/web/__tests__/use-url-token.test.tsx

@@ -0,0 +1,29 @@
+import { describe, expect, test } from "bun:test";
+import { renderHook } from "@testing-library/react";
+import { useUrlToken } from "../auth-form-primitives";
+
+// #774: magic-link tokens must not linger in browser history / Referer.
+// useUrlToken reads the token once, then scrubs the param via replaceState.
+// (dom.preload resets window.location to http://localhost/ after each test.)
+describe("useUrlToken (magic-link history hygiene)", () => {
+  test("reads ?token= and strips it from the URL, keeping other params", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?token=secret-abc&keep=1");
+    const { result } = renderHook(() => useUrlToken());
+    expect(result.current).toBe("secret-abc");
+    expect(window.location.search).toBe("?keep=1");
+  });
+
+  test("no token param → URL untouched", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?keep=1");
+    const { result } = renderHook(() => useUrlToken());
+    expect(result.current).toBe("");
+    expect(window.location.search).toBe("?keep=1");
+  });
+
+  test("explicit override short-circuits both URL read and scrub", () => {
+    window.history.replaceState(null, "", "http://localhost/reset?token=url-token");
+    const { result } = renderHook(() => useUrlToken("prop-token"));
+    expect(result.current).toBe("prop-token");
+    expect(window.location.search).toBe("?token=url-token");
+  });
+});

package/src/auth-email-password/web/__tests__/verify-email-screen.test.tsx

@@ -3,12 +3,16 @@ import { screen, waitFor } from "@testing-library/react";
 import { VerifyEmailScreen } from "../verify-email-screen";
 import { renderWithProviders } from "./test-utils";
 
+const originalFetch = globalThis.fetch;
+
 beforeEach(() => {
   globalThis.fetch = mock(
     async () => new Response(null, { status: 200 }),
   ) as unknown as typeof fetch;
 });
-afterEach(() => {});
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
 
 describe("VerifyEmailScreen", () => {
   test("ohne Token → missing-token-Page", () => {