@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-mfa/__tests__/disable-and-regenerate.integration.test.ts

@@ -0,0 +1,265 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createTestEnvelopeCipher,
+  expectErrorIncludes,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createTenantFeature } from "../../tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers, AuthMfaQueries } from "../constants";
+import { createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+
+const SETUP_TOKEN_SECRET = "test-setup-token-secret-do-not-use-in-prod";
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher();
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthMfaFeature({
+        setupTokenSecret: SETUP_TOKEN_SECRET,
+        issuer: "Kumiko Test",
+        challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// Runs enable-start + enable-confirm for a fresh user and returns the
+// user + the live secret so tests can derive current TOTP codes.
+async function enableMfaFor(userId: string): Promise<{
+  user: ReturnType<typeof createTestUser>;
+  secret: Buffer;
+  recoveryCodes: string[];
+}> {
+  const user = createTestUser({ id: userId, roles: ["User"] });
+  const start = await stack.http.writeOk<{
+    setupToken: string;
+    otpauthUri: string;
+    recoveryCodes: string[];
+  }>(AuthMfaHandlers.enableStart, { accountLabel: `${userId}@example.com` }, user);
+
+  const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+  const secret = base32Decode(secretParam);
+  await stack.http.writeOk(
+    AuthMfaHandlers.enableConfirm,
+    { setupToken: start.setupToken, code: currentTotpCode(secret) },
+    user,
+  );
+
+  return { user, secret, recoveryCodes: start.recoveryCodes };
+}
+
+describe("disable", () => {
+  test("a valid TOTP code disables MFA, and a fresh enable-start succeeds afterward", async () => {
+    const { user, secret } = await enableMfaFor("disable-totp-1");
+
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+
+    const secondStart = await stack.http.writeOk<{ setupToken: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "disable-totp-1@example.com" },
+      user,
+    );
+    expect(secondStart.setupToken).toBeTruthy();
+  });
+
+  test("MFA can be fully re-enabled after disable (re-create on a deleted aggregate)", async () => {
+    const { user, secret: firstSecret } = await enableMfaFor("disable-reenable-1");
+
+    await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(firstSecret) },
+      user,
+    );
+
+    const restart = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "disable-reenable-1@example.com" },
+      user,
+    );
+    const secretParam = new URLSearchParams(restart.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secondSecret = base32Decode(secretParam);
+
+    const confirm = await stack.http.writeOk<{ enabled: boolean }>(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: restart.setupToken, code: currentTotpCode(secondSecret) },
+      user,
+    );
+    expect(confirm.enabled).toBe(true);
+
+    // The re-enabled row is fully usable — a real code disables it again.
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secondSecret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("a valid recovery code also disables MFA", async () => {
+    const { user, recoveryCodes } = await enableMfaFor("disable-recovery-1");
+
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: recoveryCodes[0] },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("a recovery code typed lowercase and without the dash still matches", async () => {
+    const { user, recoveryCodes } = await enableMfaFor("disable-recovery-normalize-1");
+    const code = recoveryCodes[0];
+    if (code === undefined) throw new Error("test setup produced no recovery code");
+
+    const sloppy = code.toLowerCase().replace("-", "");
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: sloppy },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("a wrong code is rejected and MFA stays enabled", async () => {
+    const { user, secret } = await enableMfaFor("disable-wrong-1");
+
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "000000" }, user);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    // Still enabled — a real code still works.
+    const res = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.disabled).toBe(true);
+  });
+
+  test("disable on a user without MFA is rejected", async () => {
+    const user = createTestUser({ id: "disable-never-enabled-1", roles: ["User"] });
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: "123456" }, user);
+    expectErrorIncludes(err, "mfa_not_enabled");
+  });
+});
+
+describe("regenerate-recovery", () => {
+  test("issues 8 fresh codes and invalidates the old ones", async () => {
+    const { user, secret, recoveryCodes: oldCodes } = await enableMfaFor("regen-1");
+
+    const res = await stack.http.writeOk<{ recoveryCodes: string[] }>(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: currentTotpCode(secret) },
+      user,
+    );
+    expect(res.recoveryCodes).toHaveLength(8);
+    expect(res.recoveryCodes).not.toEqual(oldCodes);
+
+    // An old code no longer works to disable MFA.
+    const oldCode = oldCodes[0];
+    if (oldCode === undefined) throw new Error("test setup produced no old recovery code");
+    const err = await stack.http.writeErr(AuthMfaHandlers.disable, { code: oldCode }, user);
+    expectErrorIncludes(err, "invalid_totp_code");
+
+    // A NEW code works.
+    const newCode = res.recoveryCodes[0];
+    if (newCode === undefined) throw new Error("regenerate produced no new recovery code");
+    const disableRes = await stack.http.writeOk<{ disabled: boolean }>(
+      AuthMfaHandlers.disable,
+      { code: newCode },
+      user,
+    );
+    expect(disableRes.disabled).toBe(true);
+  });
+
+  test("regenerate on a user without MFA is rejected", async () => {
+    const user = createTestUser({ id: "regen-never-enabled-1", roles: ["User"] });
+    const err = await stack.http.writeErr(
+      AuthMfaHandlers.regenerateRecovery,
+      { code: "123456" },
+      user,
+    );
+    expectErrorIncludes(err, "mfa_not_enabled");
+  });
+});
+
+// pr-review kumiko-framework #1062/4 — the only prior coverage of
+// user-mfa:status was the false → true transition (implicit in
+// enableMfaFor's own setup); the more interesting true → false after
+// disable, and tenant isolation, had no assertion anywhere.
+describe("status query", () => {
+  test("true → false after disable", async () => {
+    const { user, secret } = await enableMfaFor("status-disable-1");
+
+    const before = await stack.http.queryOk<{ enabled: boolean }>(AuthMfaQueries.status, {}, user);
+    expect(before.enabled).toBe(true);
+
+    await stack.http.writeOk(AuthMfaHandlers.disable, { code: currentTotpCode(secret) }, user);
+
+    const after = await stack.http.queryOk<{ enabled: boolean }>(AuthMfaQueries.status, {}, user);
+    expect(after.enabled).toBe(false);
+  });
+
+  test("tenant isolation: same userId enrolled in tenant A stays invisible to the same id in tenant B", async () => {
+    // The entity's uniqueness is [userId, tenantId] — a second tenant CAN
+    // have a distinct (non-enrolled) row for the identical userId. The
+    // query filters only by userId (see status.query.ts's own comment) and
+    // relies on ctx.db's tenant scoping to keep them apart; assert that
+    // scoping actually holds instead of just trusting it.
+    const { user: tenantAUser } = await enableMfaFor("status-tenant-iso-1");
+    const tenantBUser = createTestUser({
+      id: tenantAUser.id,
+      tenantId: testTenantId(2),
+      roles: ["User"],
+    });
+
+    const tenantAStatus = await stack.http.queryOk<{ enabled: boolean }>(
+      AuthMfaQueries.status,
+      {},
+      tenantAUser,
+    );
+    expect(tenantAStatus.enabled).toBe(true);
+
+    const tenantBStatus = await stack.http.queryOk<{ enabled: boolean }>(
+      AuthMfaQueries.status,
+      {},
+      tenantBUser,
+    );
+    expect(tenantBStatus.enabled).toBe(false);
+  });
+});

package/src/auth-mfa/__tests__/enable-confirm-preauth.integration.test.ts

@@ -0,0 +1,321 @@
+// #1456: completes both the enrollment #1465 started AND the login that
+// mfa-setup-required blocked. Real HTTP through setupTestStack, exercising
+// the full chain: login → preauthSetupToken → preauth-enable-start →
+// preauth-confirm → the minted JWT actually authenticates a follow-up
+// request. That end-to-end seam is the thing a mocked test would fake.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  AuthErrors as AuthEmailPasswordErrors,
+  AuthHandlers as AuthEmailPasswordHandlers,
+  createAuthEmailPasswordFeature,
+} from "../../auth-email-password";
+import { ConfigHandlers, createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { mfaRequiredConfigHandle } from "../config";
+import { AuthMfaHandlers } from "../constants";
+import {
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  createAuthMfaFeature,
+  mfaStatusCheckerFromFeature,
+} from "../feature";
+import { userMfaEntity, userMfaTable } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+const revokedForUserIds: string[] = [];
+
+const CHALLENGE_TOKEN_SECRET = "integration-test-challenge-token-secret-not-real-0001";
+const SETUP_TOKEN_SECRET = "integration-test-setup-token-secret-not-real-0002";
+const TENANT_ID: TenantId = testTenantId(420);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthEmailPasswordHandlers.login,
+      loginErrorStatusMap: {
+        [AuthEmailPasswordErrors.invalidCredentials]: 401,
+        [AuthEmailPasswordErrors.noMembership]: 403,
+      },
+      mfaPreauthEnableStartHandler: AuthMfaHandlers.enableStartPreauth,
+      mfaPreauthConfirmHandler: AuthMfaHandlers.enableConfirmPreauth,
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Wire a spy in place of the real session-revoke callback (run-prod-app
+  // only binds this once the sessions feature is mounted — not the case in
+  // this test stack) so #1467's regression can observe whether
+  // revokeAllOtherSessions actually fires, instead of silently no-op'ing.
+  const bind = bindMfaRevokeAllOtherSessionsFromFeature(authMfaFeature);
+  // If the binder ever returns undefined, the spy below never wires up and
+  // the #1467 regression check further down would pass vacuously (nothing
+  // to revoke because nothing observed) instead of catching a real re-break.
+  expect(bind).toBeDefined();
+  bind?.((userId) => {
+    revokedForUserIds.push(userId);
+    return Promise.resolve(0);
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  revokedForUserIds.length = 0;
+});
+
+async function loginBlockedByEnforcement(
+  email = "unenrolled@example.com",
+): Promise<{ preauthSetupToken: string; userId: string }> {
+  const password = "correct-horse-battery-2026";
+  const hash = await hashPassword(password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    { email, passwordHash: hash, displayName: "Unenrolled" },
+    createTestUser({ id: 421, tenantId: TENANT_ID, roles: ["SystemAdmin"] }),
+  );
+  await seedTenantMembership(stack.db, {
+    userId: created.id,
+    tenantId: TENANT_ID,
+    roles: ["User"],
+  });
+  await stack.http.writeOk(
+    ConfigHandlers.set,
+    { key: mfaRequiredConfigHandle.name, value: "all" },
+    createTestUser({ id: 422, tenantId: TENANT_ID, roles: ["Admin"] }),
+  );
+
+  const loginRes = await stack.http.raw("POST", "/api/auth/login", { email, password });
+  const loginBody = await loginRes.json();
+  return { preauthSetupToken: loginBody.preauthSetupToken as string, userId: created.id };
+}
+
+async function startEnrollment(
+  preauthSetupToken: string,
+  accountLabel: string,
+): Promise<{ setupToken: string; secret: Buffer }> {
+  const startRes = await stack.http.raw("POST", "/api/auth/mfa/preauth-enable-start", {
+    preauthSetupToken,
+    accountLabel,
+  });
+  const startBody = await startRes.json();
+  const secretParam = new URLSearchParams(startBody.otpauthUri.split("?")[1]).get("secret") ?? "";
+  return { setupToken: startBody.setupToken as string, secret: base32Decode(secretParam) };
+}
+
+describe("POST /auth/mfa/preauth-confirm", () => {
+  test("completes enrollment + login: full chain, minted JWT authenticates a follow-up request", async () => {
+    const email = "chain@example.com";
+    const { preauthSetupToken } = await loginBlockedByEnforcement(email);
+    const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code: currentTotpCode(secret),
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(typeof body.token).toBe("string");
+    expect(body.user.tenantId).toBe(TENANT_ID);
+
+    // The proof that matters: the minted JWT actually authenticates.
+    const meRes = await stack.http.raw(
+      "POST",
+      "/api/query",
+      { type: "user:query:user:me", payload: {} },
+      { Authorization: `Bearer ${body.token}` },
+    );
+    expect(meRes.status).toBe(200);
+
+    // Positive control for the #1467 regression below — proves the spy
+    // wiring actually observes a real revoke call, not just silent no-ops.
+    expect(revokedForUserIds).toContain(body.user.id);
+  });
+
+  test("wrong TOTP code → invalid_totp_code, no enrollment persisted", async () => {
+    const email = "wrongcode@example.com";
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
+    const { setupToken } = await startEnrollment(preauthSetupToken, email);
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code: "000000",
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.error.details.reason).toBe("invalid_totp_code");
+    expect(body.token).toBeUndefined();
+    // "no enrollment persisted" is the actual claim in the test name — the
+    // reason string alone doesn't prove it. Scoped to this test's own user:
+    // the table isn't truncated between tests in this file.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(0);
+  });
+
+  test("replaying the same setupToken after a successful confirm → invalid_setup_token (burned), not a second enrollment", async () => {
+    const email = "race@example.com";
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
+    const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
+    const code = currentTotpCode(secret);
+
+    const first = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code,
+    });
+    expect(first.status).toBe(200);
+
+    // Same setupToken again — this integration stack wires real Redis, so
+    // the single-use burn from the first call rejects the replay before it
+    // ever reaches the already-enrolled DB check.
+    const second = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code,
+    });
+    expect(second.status).not.toBe(200);
+    const secondBody = await second.json();
+    expect(secondBody.error.details.reason).toBe("invalid_setup_token");
+    // "not a second enrollment" — pin the row count, not just the error reason.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(1);
+  });
+
+  test("a session-issued setupToken (no tenantId) is rejected, not silently accepted", async () => {
+    const email = "sessionissued@example.com";
+    const password = "correct-horse-battery-2026";
+    const hash = await hashPassword(password);
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email, passwordHash: hash, displayName: "Session Issued" },
+      createTestUser({ id: 423, tenantId: TENANT_ID, roles: ["SystemAdmin"] }),
+    );
+    await seedTenantMembership(stack.db, {
+      userId: created.id,
+      tenantId: TENANT_ID,
+      roles: ["User"],
+    });
+    const sessionUser = createTestUser({ id: created.id, tenantId: TENANT_ID, roles: ["User"] });
+
+    // The session-authed enable-start signs a setupToken with the SAME
+    // secret + format, but never carries tenantId (see mfa-setup-token.ts).
+    // A malicious or confused client resubmitting it to the pre-auth
+    // endpoint must not be able to piggyback on tenantId inference.
+    const start = await stack.http.writeOk<{ setupToken: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: email },
+      sessionUser,
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken: start.setupToken,
+      code: "123456",
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.error.details.reason).toBe("invalid_setup_token");
+  });
+
+  // #1467: findForAuth's status check + membership lookup used to run AFTER
+  // the entity-write and the revokeAllOtherSessions call — an admin
+  // restricting/deleting the account between preauth-enable-start and
+  // preauth-confirm still got invalid_setup_token back correctly (the
+  // handler's whole DB transaction rolls back on a non-success return, so
+  // the MFA row itself never actually persisted), but revokeAllOtherSessions
+  // is an external side effect outside that transaction — it fired
+  // regardless, logging the user's other devices out over an enrollment
+  // attempt that was rejected. Regression: with status/membership checked
+  // BEFORE the write, the revoke call must not fire at all for this case.
+  test("user restricted between start and confirm → invalid_setup_token, no session revoked (#1467)", async () => {
+    const email = "restricted-midflight@example.com";
+    const { preauthSetupToken, userId } = await loginBlockedByEnforcement(email);
+    const { setupToken, secret } = await startEnrollment(preauthSetupToken, email);
+
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET "status" = 'restricted' WHERE "id" = $1`,
+      [userId],
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken,
+      code: currentTotpCode(secret),
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.error.details.reason).toBe("invalid_setup_token");
+    expect(revokedForUserIds).not.toContain(userId);
+    // Enrollment write itself rolls back with the handler's failure return —
+    // pinned here too so a future change to that transactional behavior
+    // doesn't silently reintroduce the original "row persists" half of the bug.
+    const rows = await selectMany(stack.db, userMfaTable, { userId });
+    expect(rows).toHaveLength(0);
+  });
+
+  test("expired/garbage setupToken → invalid_setup_token, no session minted", async () => {
+    const res = await stack.http.raw("POST", "/api/auth/mfa/preauth-confirm", {
+      setupToken: "not-a-real-token",
+      code: "123456",
+    });
+
+    expect(res.status).not.toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(false);
+    expect(body.token).toBeUndefined();
+  });
+});