@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/audit/web/client-plugin.tsx

@@ -0,0 +1,22 @@
+// @runtime client
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { AUDIT_FEATURE, AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID } from "../constants";
+import { AuditLogDetailScreen } from "./audit-log-detail-screen";
+import { AuditLogScreen } from "./audit-log-screen";
+import { defaultTranslations } from "./i18n";
+
+export type AuditClientOptions = {
+  readonly translations?: TranslationsByLocale;
+};
+
+export function auditClient(options?: AuditClientOptions): ClientFeatureDefinition {
+  return {
+    name: AUDIT_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [AUDIT_LOG_SCREEN_ID]: AuditLogScreen,
+      [AUDIT_LOG_DETAIL_SCREEN_ID]: AuditLogDetailScreen,
+    },
+  };
+}

package/src/audit/web/i18n.ts

@@ -0,0 +1,12 @@
+// @runtime client
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import { AUDIT_I18N } from "../i18n";
+
+const LOCALES = ["de", "en"] as const;
+
+export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
+  LOCALES.map((locale) => [
+    locale,
+    Object.fromEntries(Object.entries(AUDIT_I18N).map(([key, value]) => [key, value[locale]])),
+  ]),
+);

package/src/audit/web/index.ts

@@ -0,0 +1,5 @@
+// @runtime client
+
+export { AuditLogDetailScreen } from "./audit-log-detail-screen";
+export { AuditLogScreen } from "./audit-log-screen";
+export { type AuditClientOptions, auditClient } from "./client-plugin";

package/src/auth-email-password/__tests__/account-lockout-no-redis.integration.test.ts

@@ -13,7 +13,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -22,9 +21,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 
@@ -42,8 +42,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/account-lockout.integration.test.ts

@@ -12,7 +12,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -21,9 +20,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -34,7 +35,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { getLockoutState, type LockoutState } from "../lockout-store";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 
@@ -48,8 +48,8 @@ const MAX_ATTEMPTS = 3;
 const LOCK_MINUTES = 1;
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/account-unlock.integration.test.ts

@@ -0,0 +1,283 @@
+// Account-unlock integration tests (#1266) — the self-service escape hatch
+// for the account-lockout monotonic counter: after a lock expires, the next
+// wrong password immediately re-locks (see account-lockout.integration.test.ts
+// "expired lock + wrong password → immediate re-lock"). This flow gives a
+// legitimate user a way out via mailbox-ownership proof instead of being
+// stuck retrying.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+import { getLockoutState, type LockoutState } from "../lockout-store";
+import { signUnlockToken } from "../unlock-token";
+
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+const systemAdmin = TestUsers.systemAdmin;
+const encryptionKey = randomBytes(32).toString("base64");
+const unlockSecret = randomBytes(32).toString("base64");
+const appUnlockUrl = "https://app.example.com/unlock-account";
+
+const MAX_ATTEMPTS = 3;
+const LOCK_MINUTES = 1;
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        accountLockout: {
+          maxFailedAttempts: MAX_ATTEMPTS,
+          lockoutDurationMinutes: LOCK_MINUTES,
+        },
+        accountUnlock: { hmacSecret: unlockSecret, tokenTtlMinutes: 15, appUrl: appUnlockUrl },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: resolver,
+      configEncryption: encryption,
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+        [AuthErrors.accountLocked]: 423,
+      },
+      accountUnlock: {
+        requestHandler: AuthHandlers.requestAccountUnlock,
+        confirmHandler: AuthHandlers.confirmAccountUnlock,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await stack.redis.flushNamespace();
+  emailTransport.sent.length = 0;
+});
+
+async function seedLoginUser(
+  email: string,
+  password: string,
+): Promise<{ id: string; tenantId: TenantId }> {
+  const hash = await hashPassword(password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    { email, passwordHash: hash, displayName: email.split("@")[0] ?? "user" },
+    systemAdmin,
+  );
+  const tenantId: TenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
+  await seedTenantMembership(stack.db, { userId: created.id, tenantId, roles: ["User"] });
+  return { id: created.id, tenantId };
+}
+
+async function loginAttempt(email: string, password: string): Promise<Response> {
+  return stack.http.raw("POST", "/api/auth/login", { email, password });
+}
+
+async function post(path: string, body: unknown): Promise<Response> {
+  return stack.http.raw("POST", path, body);
+}
+
+async function readLockoutState(userId: string): Promise<LockoutState | null> {
+  return getLockoutState(stack.redis.redis, userId);
+}
+
+async function lockAccount(email: string): Promise<void> {
+  for (let i = 0; i < MAX_ATTEMPTS; i++) {
+    await loginAttempt(email, `wrong-${i}`);
+  }
+}
+
+describe("POST /auth/request-account-unlock", () => {
+  test("known email → 200, delivery sends mail with unlock URL", async () => {
+    await seedLoginUser("alice@example.com", "initial-pw!");
+
+    const res = await post("/api/auth/request-account-unlock", { email: "alice@example.com" });
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ isSuccess: true });
+    expect(emailTransport.sent).toHaveLength(1);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(sent.to).toBe("alice@example.com");
+    expect(sent.html).toContain(`${appUnlockUrl}?token=`);
+  });
+
+  test("unknown email → 200 with NO mail sent (enumeration-safe)", async () => {
+    const res = await post("/api/auth/request-account-unlock", { email: "ghost@example.com" });
+
+    expect(res.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+});
+
+describe("POST /auth/confirm-account-unlock", () => {
+  test("valid token on a locked account → clears failureCount AND lockedUntil", async () => {
+    const seed = await seedLoginUser("bob@example.com", "right-pw");
+    await lockAccount("bob@example.com");
+    expect((await readLockoutState(seed.id))?.lockedUntil).not.toBeNull();
+
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    const res = await post("/api/auth/confirm-account-unlock", { token });
+
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ isSuccess: true });
+    expect(await readLockoutState(seed.id)).toBeNull();
+  });
+
+  // This is the actual bug fix from #1266: the monotonic counter otherwise
+  // re-locks on the very next wrong password once the lock window expires.
+  // Confirming the unlock token must clear the COUNT key, not just the
+  // until key — otherwise the escape hatch doesn't actually escape anything.
+  test("after unlock, a subsequent wrong password does NOT immediately re-lock", async () => {
+    const seed = await seedLoginUser("carol@example.com", "right-pw");
+    await lockAccount("carol@example.com");
+
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    await post("/api/auth/confirm-account-unlock", { token });
+
+    const res = await loginAttempt("carol@example.com", "still-wrong-once");
+    expect(res.status).toBe(401);
+    const body = await res.json();
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidCredentials);
+
+    const state = await readLockoutState(seed.id);
+    expect(state?.failureCount).toBe(1);
+    expect(state?.lockedUntil).toBeNull();
+  });
+
+  test("unlocked account can log in again with the correct password", async () => {
+    const seed = await seedLoginUser("dana@example.com", "right-pw");
+    await lockAccount("dana@example.com");
+
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    await post("/api/auth/confirm-account-unlock", { token });
+
+    const res = await loginAttempt("dana@example.com", "right-pw");
+    expect(res.status).toBe(200);
+  });
+
+  test("confirming on a non-locked account is a harmless no-op", async () => {
+    const seed = await seedLoginUser("erin@example.com", "right-pw");
+
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    const res = await post("/api/auth/confirm-account-unlock", { token });
+
+    expect(res.status).toBe(200);
+    expect(await readLockoutState(seed.id)).toBeNull();
+  });
+
+  test("replaying the same unlock token twice is harmless (no burn-store)", async () => {
+    const seed = await seedLoginUser("frank@example.com", "right-pw");
+    await lockAccount("frank@example.com");
+
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    const res1 = await post("/api/auth/confirm-account-unlock", { token });
+    const res2 = await post("/api/auth/confirm-account-unlock", { token });
+
+    expect(res1.status).toBe(200);
+    expect(res2.status).toBe(200);
+  });
+
+  test("tampered token → 422 invalid_unlock_token; lockout state untouched", async () => {
+    const seed = await seedLoginUser("greta@example.com", "right-pw");
+    await lockAccount("greta@example.com");
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret);
+    const tampered = `${token.slice(0, -3)}XXX`;
+
+    const res = await post("/api/auth/confirm-account-unlock", { token: tampered });
+
+    expect(res.status).toBe(422);
+    const body = await res.json();
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidUnlockToken);
+    expect((await readLockoutState(seed.id))?.lockedUntil).not.toBeNull();
+  });
+
+  test("token signed with a different secret → 422", async () => {
+    const seed = await seedLoginUser("henry@example.com", "right-pw");
+    const { token } = signUnlockToken(seed.id, 15, "wrong-secret-wrong-secret-wrong!!");
+
+    const res = await post("/api/auth/confirm-account-unlock", { token });
+
+    expect(res.status).toBe(422);
+  });
+
+  test("expired token → 422 invalid_unlock_token", async () => {
+    const seed = await seedLoginUser("iris@example.com", "right-pw");
+    const past = Temporal.Now.instant().subtract({ minutes: 30 });
+    const { token } = signUnlockToken(seed.id, 15, unlockSecret, past);
+
+    const res = await post("/api/auth/confirm-account-unlock", { token });
+
+    expect(res.status).toBe(422);
+    const body = await res.json();
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidUnlockToken);
+  });
+
+  test("malformed body → 400 invalid_body", async () => {
+    const res = await post("/api/auth/confirm-account-unlock", { wrong: "shape" });
+    expect(res.status).toBe(400);
+  });
+});

package/src/auth-email-password/__tests__/auth-claims.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -12,10 +11,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -25,7 +25,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // Sample-style extension feature that shows the real-world shape of a claims
 // hook: look something up in a tenant-scoped table and stuff it into the JWT.
@@ -68,8 +67,8 @@ const segmentsByUserAndTenant = new Map<string, string>();
 const plansByTenant = new Map<TenantId, string>();
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -260,8 +259,8 @@ describe("scenario 2: switch-tenant recomputes claims (no stale tenant-A claims
 
 describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
   test("one feature returns key with ':' → only that key dropped, other features merge cleanly", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
     // A polluted feature that tries to smuggle in a qualified-name-shaped
     // inner key (injecting ":" would otherwise let it spoof another
     // feature's prefix). Plus a clean companion to prove the drop is
@@ -337,8 +336,8 @@ describe("scenario 2.5: reserved separator + multi-feature isolation", () => {
 
 describe("scenario 2.6: multi-feature drift warnings fire independently", () => {
   test("feature A + feature B both return undeclared keys → each logs its own warning", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
 
     // Capture warn() calls to verify drift warnings fire per-feature, not
     // globally collapsed.
@@ -425,8 +424,8 @@ describe("scenario 2.6: multi-feature drift warnings fire independently", () =>
 
 describe("scenario 3: a broken claims hook does not break login", () => {
   test("hook throws → login still succeeds, broken feature simply contributes nothing, warn logged with featureName+err", async () => {
-    const localEncryption = createEncryptionProvider(encryptionKey);
-    const localResolver = createConfigResolver({ encryption: localEncryption });
+    const localEncryption = createTestEnvelopeCipher(encryptionKey);
+    const localResolver = createConfigResolver({ cipher: localEncryption });
 
     // Capture warn-calls so the test can verify the resolver actually
     // logged the broken hook with featureName + err.message — previously

package/src/auth-email-password/__tests__/auth-user-row.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "bun:test";
+import { parseAuthUserRow } from "../auth-user-row";
+
+describe("parseAuthUserRow", () => {
+  test("returns null for null/undefined", () => {
+    expect(parseAuthUserRow(null)).toBeNull();
+    expect(parseAuthUserRow(undefined)).toBeNull();
+  });
+
+  test("returns null for a non-object value", () => {
+    expect(parseAuthUserRow("nope")).toBeNull();
+    expect(parseAuthUserRow(42)).toBeNull();
+  });
+
+  test("returns null when id is missing or not a string", () => {
+    expect(parseAuthUserRow({})).toBeNull();
+    expect(parseAuthUserRow({ id: 123 })).toBeNull();
+  });
+
+  test("returns the row as-is once id is a string", () => {
+    const row = {
+      id: "u1",
+      email: "a@example.com",
+      version: 3,
+      passwordHash: "hash",
+      status: "active",
+    };
+    expect(parseAuthUserRow(row)).toEqual(row);
+  });
+
+  test("passes through a row with only id set — other fields stay undefined", () => {
+    const result = parseAuthUserRow({ id: "u2" });
+    expect(result?.id).toBe("u2");
+    expect(result?.email).toBeUndefined();
+  });
+});

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
@@ -13,6 +12,7 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import {
+  createTestEnvelopeCipher,
   expectErrorIncludes,
   getSetCookieRaw,
   getSetCookieValue,
@@ -20,6 +20,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -29,7 +30,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 
@@ -37,8 +37,8 @@ const systemAdmin = TestUsers.systemAdmin;
 const encryptionKey = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -236,6 +236,33 @@ describe("scenario 5: change-password success", () => {
   });
 });
 
+describe("scenario 5c: change-password common-password rejection (#1340)", () => {
+  test("common newPassword → 400 (schema rejects breach-list password)", async () => {
+    const seed = await seedLoginUser({ email: "common-cp@example.com", password: "good-old-pw" });
+    const signedIn = createTestUser({ id: seed.id, tenantId: seed.tenantId, roles: ["User"] });
+
+    const error = await stack.http.writeErr(
+      AuthHandlers.changePassword,
+      { oldPassword: "good-old-pw", newPassword: "password1" },
+      signedIn,
+    );
+    expect(error.httpStatus).toBe(400);
+    // "errors.validation.custom" alone is generic — any .refine() failure
+    // on the schema would match. Pin the field too, so this only passes
+    // for a rejection on newPassword specifically (the common-password
+    // refine), not an unrelated validation error elsewhere in the schema.
+    expectErrorIncludes(error, "errors.validation.custom");
+    expectErrorIncludes(error, "newPassword");
+
+    // Old password still works — the rejected change never landed.
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: "common-cp@example.com",
+      password: "good-old-pw",
+    });
+    expect(loginRes.status).toBe(200);
+  });
+});
+
 describe("scenario 5b: change-password when the aggregate stream tenant != session tenant (sysadmin pattern)", () => {
   test("user whose stream lives in a non-session tenant still changes password", async () => {
     // Sysadmin pattern: created via systemAdmin (stream = systemAdmin.tenantId),
@@ -374,8 +401,8 @@ describe("scenario 7b: login rate limiting", () => {
   let rlStack: TestStack;
 
   beforeAll(async () => {
-    const encryption = createEncryptionProvider(encryptionKey);
-    const resolver = createConfigResolver({ encryption });
+    const encryption = createTestEnvelopeCipher(encryptionKey);
+    const resolver = createConfigResolver({ cipher: encryption });
     const { createInMemoryLoginRateLimiter } = await import("@cosmicdrift/kumiko-framework/api");
 
     rlStack = await setupTestStack({

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,7 +9,11 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow, updateRows } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createTestEnvelopeCipher,
+  seedRow,
+  updateRows,
+} from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -20,6 +23,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -30,7 +34,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 import { signVerificationToken } from "../verification-token";
 
@@ -50,8 +53,8 @@ const appVerifyUrl = "https://app.example.com/verify";
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -283,7 +286,7 @@ describe("POST /auth/verify-email", () => {
     // memberships + recoverable stream", never blanket-opens zero-membership.
     // Build a fully-populated user row with NO event stream: seed a normal
     // user (gets all NOT-NULL columns), capture its row, then re-key it to a
-    // fresh id + email. getAggregateStreamTenant(orphanId) finds no events
+    // fresh id + email. getUnscopedAggregateStreamTenant(orphanId) finds no events
     // (the stream lives under the original id), and no membership is seeded
     // → tenantOrder is empty.
     const donor = await seedUser({ email: "donor@example.com", password: "donor-pw-1234" });