@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-email-password/__tests__/feature-options.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test";
+import { MIN_HMAC_SECRET_LENGTH } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+// A short HMAC secret makes reset/verify tokens forgeable (account takeover),
+// so the factory must fail fast — same bar as the ≥32-char JWT_SECRET check.
+
+const okSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH);
+const shortSecret = "x".repeat(MIN_HMAC_SECRET_LENGTH - 1);
+const appUrl = "https://app.example.com/flow";
+
+describe("createAuthEmailPasswordFeature hmacSecret validation", () => {
+  test("rejects a short passwordReset.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ passwordReset: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/passwordReset\.hmacSecret must be/);
+  });
+
+  test("rejects a short emailVerification.hmacSecret", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({ emailVerification: { hmacSecret: shortSecret, appUrl } }),
+    ).toThrow(/emailVerification\.hmacSecret must be/);
+  });
+
+  test("accepts secrets at the minimum length", () => {
+    expect(() =>
+      createAuthEmailPasswordFeature({
+        passwordReset: { hmacSecret: okSecret, appUrl },
+        emailVerification: { hmacSecret: okSecret, appUrl },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/auth-email-password/__tests__/identity-v3-login.integration.test.ts

@@ -8,7 +8,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { pbkdf2Sync, randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -18,6 +17,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
@@ -50,8 +50,8 @@ function buildBmcStyleV3Hash(password: string, salt: Buffer): string {
 }
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [

package/src/auth-email-password/__tests__/invite-flow-kms.integration.test.ts

@@ -0,0 +1,283 @@
+// Auth-Flows mit aktivem PII-KMS + Blind-Index (#818 PR 2): user.email und
+// invitation.email liegen als Ciphertext in der DB. Login und alle drei
+// Invite-Accept-Branches müssen über die generierte email_bidx-Spalte
+// (Equality-Lookup) bzw. decryptStoredEmail (Vergleich/Weiterverwendung)
+// unverändert funktionieren — vor diesem PR war jeder dieser Pfade mit
+// KMS silently broken.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenant, seedTenantMembership } from "../../tenant/seeding";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+import { seedUser } from "../seeding";
+
+const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
+const BOB_EMAIL = "bob.kms@example.com";
+const BOB_PASSWORD = "bob-existing-pw-1234";
+const CAROL_EMAIL = "carol.kms@example.com";
+const CAROL_PASSWORD = "carol-new-pw-1234";
+const BIDX_KEY = Buffer.alloc(32, 7).toString("base64");
+
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+let aliceId: string;
+let bobId: string;
+let TENANT_A_ID: TenantId;
+let TENANT_B_ID: TenantId;
+
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in invite mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
+      }),
+    ],
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      invite: {
+        acceptHandler: AuthHandlers.inviteAccept,
+        acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
+        signupCompleteHandler: AuthHandlers.inviteSignupComplete,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  // KMS + bidx-Key MUESSEN vor den Seeds stehen — seedUser läuft über den
+  // Executor, die Rows sollen den verschlüsselten Prod-Zustand abbilden.
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+  configureBlindIndexKey(BIDX_KEY);
+
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
+  emailTransport.sent.length = 0;
+  const allKeys = await stack.redis.redis.keys("invite:*");
+  if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
+
+  TENANT_A_ID = crypto.randomUUID() as TenantId;
+  TENANT_B_ID = crypto.randomUUID() as TenantId;
+  await seedTenant(stack.db, {
+    id: TENANT_A_ID,
+    key: `kms-a-${TENANT_A_ID.slice(0, 8)}`,
+    name: "KMS Tenant A",
+  });
+  await seedTenant(stack.db, {
+    id: TENANT_B_ID,
+    key: `kms-b-${TENANT_B_ID.slice(0, 8)}`,
+    name: "KMS Tenant B",
+  });
+
+  ({ id: aliceId } = await seedUser(stack.db, {
+    email: "alice.kms@example.com",
+    displayName: "Alice",
+    passwordHash: await hashPassword("alice-pw-1234"),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: aliceId,
+    tenantId: TENANT_A_ID,
+    roles: ["Admin"],
+  });
+
+  ({ id: bobId } = await seedUser(stack.db, {
+    email: BOB_EMAIL,
+    displayName: "Bob",
+    passwordHash: await hashPassword(BOB_PASSWORD),
+    emailVerified: true,
+  }));
+  await seedTenantMembership(stack.db, {
+    userId: bobId,
+    tenantId: TENANT_B_ID,
+    roles: ["User"],
+  });
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+function aliceSession(): SessionUser {
+  return { id: aliceId, tenantId: TENANT_A_ID, roles: ["Admin"] };
+}
+
+function bobSession(): SessionUser {
+  return { id: bobId, tenantId: TENANT_B_ID, roles: ["User"] };
+}
+
+async function inviteEmail(email: string, role: string): Promise<string> {
+  await stack.http.writeOk(AuthHandlers.inviteCreate, { email, role }, aliceSession());
+  const sent = emailTransport.sent.at(-1);
+  if (!sent) throw new Error("invite-create didn't send a mail");
+  return extractTokenFromMail(sent.html);
+}
+
+async function rawUserRow(id: string): Promise<Record<string, unknown>> {
+  const rows = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
+    `SELECT * FROM "${userTable.tableName}" WHERE id = $1`,
+    [id],
+  );
+  const row = rows[0];
+  if (!row) throw new Error(`no user row for ${id}`);
+  return row;
+}
+
+describe("auth flows with active KMS + blind index", () => {
+  test("seeded user row: ciphertext email + populated bidx column", async () => {
+    const row = await rawUserRow(bobId);
+    expect(isPiiCiphertext(row["email"])).toBe(true);
+    expect(String(row["email_bidx"])).toStartWith("kumiko-bidx:v1:");
+  });
+
+  test("login with plaintext email finds the encrypted row via bidx", async () => {
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; token?: string };
+    expect(body.isSuccess).toBe(true);
+    expect(body.token).toBeTruthy();
+  });
+
+  test("Branch 1: logged-in accept matches emails across two ciphertexts", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const invitations = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
+    expect(invitations).toHaveLength(1);
+
+    const result = (await stack.http.writeOk(
+      AuthHandlers.inviteAccept,
+      { token },
+      bobSession(),
+    )) as {
+      tenantId: string;
+      alreadyMember: boolean;
+    };
+    expect(result.tenantId).toBe(TENANT_A_ID);
+    expect(result.alreadyMember).toBe(false);
+  });
+
+  test("Branch 2: invite-accept-with-login (anon + password)", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: BOB_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; tenantId: string };
+    expect(body.isSuccess).toBe(true);
+    expect(body.tenantId).toBe(TENANT_A_ID);
+
+    const memberships = await selectMany(stack.db, tenantMembershipsTable, { userId: bobId });
+    expect(memberships).toHaveLength(2);
+  });
+
+  test("Branch 3: invite-signup-complete creates the user from the DECRYPTED invitation email", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Admin");
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: CAROL_PASSWORD,
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { isSuccess: boolean; user: { id: string } };
+    expect(body.isSuccess).toBe(true);
+
+    // Carol-Row: eigener user-Subject-Ciphertext (nicht der invitation-
+    // Ciphertext durchgereicht) + Klartext-abgeleiteter displayName.
+    const row = await rawUserRow(body.user.id);
+    expect(isPiiCiphertext(row["email"])).toBe(true);
+    expect(String(row["email"])).toContain(body.user.id);
+    const decrypted = await decryptPiiFieldValues(
+      { displayName: row["display_name"] },
+      ["displayName"],
+      kms,
+      { requestId: "test" },
+    );
+    expect(decrypted["displayName"]).toBe("carol.kms");
+
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: CAROL_EMAIL,
+      password: CAROL_PASSWORD,
+    });
+    expect(loginRes.status).toBe(200);
+  });
+});

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -37,6 +37,7 @@ import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery
 import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { hashPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import {
@@ -52,7 +53,6 @@ import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 import { storeInviteToken } from "../invite-token-store";
-import { hashPassword } from "../password-hashing";
 import { seedUser } from "../seeding";
 
 const APP_ACCEPT_URL = "https://app.example.com/invite/accept";
@@ -362,6 +362,25 @@ describe("invite-accept-with-login (Branch 2: anon + existing email)", () => {
     const body = (await res.json()) as { error?: { details?: { reason?: string } } };
     expect(body.error?.details?.reason).toBe(AuthErrors.invalidInviteToken);
   });
+
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(BOB_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email: BOB_EMAIL,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    // A 400 for a completely different reason (bad token format, email
+    // shape) would also pass a bare status assertion — pin the field-level
+    // reason so the test actually proves the breach-list rejection fired.
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
 });
 
 describe("invite-signup-complete (Branch 3: anon + new email)", () => {
@@ -397,6 +416,21 @@ describe("invite-signup-complete (Branch 3: anon + new email)", () => {
     expect(loginRes.status).toBe(200);
   });
 
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const token = await inviteEmail(CAROL_EMAIL, "Editor");
+    const res = await stack.http.raw("POST", "/api/auth/invite-signup-complete", {
+      token,
+      password: "password1",
+    });
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as {
+      error?: { details?: { fields?: ReadonlyArray<{ path?: string; code?: string }> } };
+    };
+    expect(body.error?.details?.fields).toContainEqual(
+      expect.objectContaining({ path: "password", code: "custom" }),
+    );
+  });
+
   test("Existing email → invalid_invite_token (User soll Branch 2 nutzen)", async () => {
     const token = await inviteEmail(BOB_EMAIL, "Admin");
 

package/src/auth-email-password/__tests__/login-mfa-setup-required.integration.test.ts

@@ -0,0 +1,129 @@
+// #1455: enforcement policy blocks an unenrolled user at login
+// (mfa-setup-required) — the response must carry a preauthSetupToken so a
+// later pre-auth enroll step (#1231) can look the user back up without a
+// session. Real HTTP through setupTestStack, both auth-mfa and
+// auth-email-password mounted together (mirrors auth.integration.test.ts).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createAuthMfaFeature,
+  mfaRequiredConfigHandle,
+  mfaStatusCheckerFromFeature,
+} from "../../auth-mfa";
+import { userMfaEntity } from "../../auth-mfa/schema/user-mfa";
+import { ConfigHandlers, createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
+import { UserHandlers } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthErrors, AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+
+let stack: TestStack;
+
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+const TENANT_ID: TenantId = testTenantId(400);
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+  const resolver = createConfigResolver({ cipher: encryption });
+  const authMfaFeature = createAuthMfaFeature({
+    setupTokenSecret: "test-mfa-setup-token-secret-at-least-32-bytes!!",
+    issuer: "Kumiko Test",
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      authMfaFeature,
+      createAuthEmailPasswordFeature({
+        mfaStatusChecker: mfaStatusCheckerFromFeature(authMfaFeature),
+      }),
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      loginErrorStatusMap: {
+        [AuthErrors.invalidCredentials]: 401,
+        [AuthErrors.noMembership]: 403,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+});
+
+describe("login: mfa-setup-required carries a verifiable preauthSetupToken", () => {
+  test("unenrolled user blocked by 'all' policy gets a token instead of a session", async () => {
+    const password = "correct-horse-battery-2026";
+    const hash = await hashPassword(password);
+    const created = await stack.http.writeOk<{ id: string }>(
+      UserHandlers.create,
+      { email: "unenrolled@example.com", passwordHash: hash, displayName: "Unenrolled" },
+      createTestUser({ id: 401, tenantId: TENANT_ID, roles: ["SystemAdmin"] }),
+    );
+    await seedTenantMembership(stack.db, {
+      userId: created.id,
+      tenantId: TENANT_ID,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(
+      ConfigHandlers.set,
+      { key: mfaRequiredConfigHandle.name, value: "all" },
+      createTestUser({ id: 402, tenantId: TENANT_ID, roles: ["Admin"] }),
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "unenrolled@example.com",
+      password,
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(body.mfaSetupRequired).toBe(true);
+    expect(body.token).toBeUndefined();
+    expect(typeof body.preauthSetupToken).toBe("string");
+
+    const { verifyMfaPreauthSetupToken } = await import("../../auth-mfa/mfa-preauth-setup-token");
+    const verified = verifyMfaPreauthSetupToken(body.preauthSetupToken, CHALLENGE_TOKEN_SECRET);
+    expect(verified.ok).toBe(true);
+    if (verified.ok) {
+      expect(verified.payload).toEqual({ userId: created.id, tenantId: TENANT_ID });
+    }
+  });
+});

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -23,6 +23,7 @@ import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -31,7 +32,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 let stack: TestStack;
 const systemAdmin = TestUsers.systemAdmin;

package/src/auth-email-password/__tests__/password-policy.test.ts

@@ -0,0 +1,15 @@
+import { expect, test } from "bun:test";
+import { isCommonPassword, passwordSchema } from "../password-policy";
+
+test("rejects a breach-list password (case-insensitive)", () => {
+  expect(isCommonPassword("Password1")).toBe(true);
+  expect(passwordSchema.safeParse("password1").success).toBe(false);
+});
+
+test("accepts a long unique password", () => {
+  expect(passwordSchema.safeParse("aX9-not-in-any-list-42").success).toBe(true);
+});
+
+test("still enforces min length", () => {
+  expect(passwordSchema.safeParse("tiny").success).toBe(false);
+});

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,7 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,7 +10,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { createTestEnvelopeCipher, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { Temporal } from "temporal-polyfill";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
@@ -21,6 +21,7 @@ import { notificationPreferencesTable } from "../../delivery/tables";
 import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
 import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createSessionsFeature, userSessionTable } from "../../sessions";
+import { hashPassword, verifyPassword } from "../../shared";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -31,7 +32,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword, verifyPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 
 // Reset mails now go through delivery (ctx.notify → channel-email). The
@@ -51,8 +51,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const appResetUrl = "https://app.example.com/reset";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [
@@ -77,6 +77,7 @@ beforeAll(async () => {
       // "user.postSave" that triggers autoRevokeOnPasswordChange whenever
       // the passwordHash delta is present. Integration-test proves the
       // reset-flow's changes.passwordHash triggers the same hook.
+      authFoundationFeature,
       createSessionsFeature({
         autoRevokeOnPasswordChange: async (userId) => {
           autoRevokeCalls.push(userId);
@@ -253,6 +254,18 @@ describe("POST /auth/reset-password", () => {
     expect(res.status).toBe(400);
   });
 
+  test("common newPassword → 400 (schema rejects breach-list password)", async () => {
+    const seed = await seedUser({ email: "frank@example.com", password: "original" });
+    const { token } = signResetToken(seed.id, 15, resetSecret);
+
+    const res = await post("/api/auth/reset-password", {
+      token,
+      newPassword: "password1",
+    });
+
+    expect(res.status).toBe(400);
+  });
+
   test("expired token via the route → 422 invalid_reset_token", async () => {
     const seed = await seedUser({ email: "time@example.com", password: "once-valid-1234" });
     // Sign with now set far in the past so expiry already fired.
@@ -349,7 +362,7 @@ describe("POST /auth/reset-password", () => {
     // never blanket-opens zero-membership.
     // Build a fully-populated user row with NO event stream: seed a normal
     // user (gets all NOT-NULL columns), capture its row, then re-key it to a
-    // fresh id + email. getAggregateStreamTenant(orphanId) finds no events
+    // fresh id + email. getUnscopedAggregateStreamTenant(orphanId) finds no events
     // (the stream lives under the original id), and no membership is seeded
     // → tenantOrder is empty.
     const donor = await seedUser({ email: "donor@example.com", password: "donor-pw-1234" });

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -7,13 +7,13 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import {
   setupTestStack,
   type TestStack,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -40,8 +40,8 @@ const resetSecret = randomBytes(32).toString("base64");
 const verifySecret = randomBytes(32).toString("base64");
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   stack = await setupTestStack({
     features: [