@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/auth-email-password/__tests__/seed-admin.integration.test.ts

@@ -23,12 +23,12 @@ import {
 import { createConfigFeature } from "../../config/feature";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { verifyPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
-import { verifyPassword } from "../password-hashing";
 import { seedAdmin } from "../testing";
 
 let stack: TestStack;

package/src/auth-email-password/__tests__/self-registration-toggle.integration.test.ts

@@ -0,0 +1,264 @@
+// Runtime on/off switch for self-signup (#self-registration-toggle). Pins:
+//   1. Default (no override row) → signup-request works.
+//   2. runtime.apply(off) → signup-request still 200 (silent no-op, anti-enumeration), no mail sent.
+//   3. runtime.apply(on) → works again.
+// Mirrors samples/recipes/feature-toggles' runtime.apply() pattern — flips the
+// in-memory snapshot directly instead of going through the set-handler/HTTP,
+// since that wiring is already covered by feature-toggles' own tests.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  createFeatureTogglesFeature,
+  GlobalFeatureToggleRuntime,
+  globalFeatureStateTable,
+} from "@cosmicdrift/kumiko-bundled-features/feature-toggles";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createLateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { AuthHandlers } from "../constants";
+import { createAuthEmailPasswordFeature } from "../feature";
+import {
+  AUTH_SELF_REGISTRATION_FEATURE,
+  createAuthSelfRegistrationToggleFeature,
+} from "../self-registration-toggle";
+
+const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
+const emailTransport = createInMemoryTransport();
+
+let stack: TestStack;
+let runtime: GlobalFeatureToggleRuntime;
+
+beforeAll(async () => {
+  let effective: () => ReadonlySet<string> = () => new Set();
+  const runtimeHolder = createLateBoundHolder<GlobalFeatureToggleRuntime>("runtime");
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+      createAuthEmailPasswordFeature({
+        signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
+      }),
+      createAuthSelfRegistrationToggleFeature(),
+      createFeatureTogglesFeature({ getRuntime: () => runtimeHolder.get() }),
+    ],
+    effectiveFeatures: () => effective(),
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    systemHooks: [],
+    anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      signup: {
+        requestHandler: AuthHandlers.signupRequest,
+        confirmHandler: AuthHandlers.signupConfirm,
+      },
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  // globalFeatureStateTable is auto-provisioned by setupTestStack — no
+  // manual push needed (that used to mask a missing r.storeTable()
+  // registration entirely).
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+
+  runtime = new GlobalFeatureToggleRuntime(stack.db, stack.registry);
+  await runtime.initialize();
+  effective = runtime.effectiveFeatures;
+  runtimeHolder.set(runtime);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${globalFeatureStateTable.tableName}"`);
+  await runtime.refresh();
+  emailTransport.sent.length = 0;
+  const allKeys = await stack.redis.redis.keys("signup:*");
+  if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
+});
+
+async function postSignupRequest(email: string): Promise<Response> {
+  return stack.http.raw("POST", "/api/auth/signup-request", { email });
+}
+
+describe("auth-self-registration toggle", () => {
+  test("default (no override) → signup-request works", async () => {
+    const res = await postSignupRequest("alice@example.com");
+    expect(res.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(1);
+  });
+
+  test("runtime off → signup-request still 200 (anti-enumeration silent-success) but no mail sent", async () => {
+    runtime.apply(AUTH_SELF_REGISTRATION_FEATURE, false);
+
+    const res = await postSignupRequest("blocked@example.com");
+    expect(res.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(0);
+  });
+
+  test("runtime back on → mail sends again", async () => {
+    runtime.apply(AUTH_SELF_REGISTRATION_FEATURE, false);
+    await postSignupRequest("still-blocked@example.com");
+    expect(emailTransport.sent).toHaveLength(0);
+
+    runtime.apply(AUTH_SELF_REGISTRATION_FEATURE, true);
+    const res = await postSignupRequest("reenabled@example.com");
+    expect(res.status).toBe(200);
+    expect(emailTransport.sent).toHaveLength(1);
+  });
+
+  test("status query reflects the runtime flip", async () => {
+    const onRes = await stack.http.raw("POST", "/api/query", {
+      type: "auth-email-password:query:signup-registration-status",
+      payload: {},
+    });
+    expect((await onRes.json()) as { data?: { enabled: boolean } }).toMatchObject({
+      data: { enabled: true },
+    });
+
+    runtime.apply(AUTH_SELF_REGISTRATION_FEATURE, false);
+    const offRes = await stack.http.raw("POST", "/api/query", {
+      type: "auth-email-password:query:signup-registration-status",
+      payload: {},
+    });
+    expect((await offRes.json()) as { data?: { enabled: boolean } }).toMatchObject({
+      data: { enabled: false },
+    });
+  });
+});
+
+// Regression for Finding 1 (#1468): the suite above always composes the
+// companion toggle feature alongside feature-toggles. An app that mounts
+// createFeatureTogglesFeature + a real effectiveFeatures resolver but
+// forgets (or never knew to) compose createAuthSelfRegistrationToggleFeature
+// must not go silently signup-dead — ctx.hasFeature() is checked against a
+// feature name the registry never registered.
+describe("auth-self-registration toggle — companion feature NOT composed", () => {
+  const bareEmailTransport = createInMemoryTransport();
+  let bareStack: TestStack;
+  let bareRuntime: GlobalFeatureToggleRuntime;
+
+  beforeAll(async () => {
+    const runtimeHolder = createLateBoundHolder<GlobalFeatureToggleRuntime>("bare-runtime");
+    let effective: () => ReadonlySet<string> = () => new Set();
+
+    bareStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createUserFeature(),
+        createTenantFeature(),
+        createTemplateResolverFeature(),
+        createRendererFoundationFeature(),
+        createDeliveryFeature(),
+        createRendererSimpleFeature(),
+        createChannelEmailFeature({
+          transport: bareEmailTransport,
+          renderer: simpleRenderer,
+          resolveEmail: async () => "unused@test.local",
+        }),
+        createAuthEmailPasswordFeature({
+          signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
+        }),
+        // Deliberately NO createAuthSelfRegistrationToggleFeature().
+        createFeatureTogglesFeature({ getRuntime: () => runtimeHolder.get() }),
+      ],
+      effectiveFeatures: () => effective(),
+      extraContext: (deps) => ({
+        ...createDeliveryTestContext(deps),
+        configResolver: createConfigResolver(),
+      }),
+      systemHooks: [],
+      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
+      authConfig: {
+        membershipQuery: "tenant:query:memberships",
+        loginHandler: AuthHandlers.login,
+        signup: {
+          requestHandler: AuthHandlers.signupRequest,
+          confirmHandler: AuthHandlers.signupConfirm,
+        },
+      },
+    });
+
+    await unsafeCreateEntityTable(bareStack.db, userEntity);
+    await unsafeCreateEntityTable(bareStack.db, tenantEntity);
+    await unsafePushTables(bareStack.db, {
+      configValuesTable,
+      tenantMembershipsTable,
+      notificationPreferencesTable,
+    });
+
+    bareRuntime = new GlobalFeatureToggleRuntime(bareStack.db, bareStack.registry);
+    await bareRuntime.initialize();
+    effective = bareRuntime.effectiveFeatures;
+    runtimeHolder.set(bareRuntime);
+  });
+
+  afterAll(async () => {
+    await bareStack.cleanup();
+  });
+
+  // Fixed (#1468): ctx.hasFeature() is fail-closed for a name nothing ever
+  // registered — signup-request and the status query now only gate on the
+  // toggle when registry.getFeature(AUTH_SELF_REGISTRATION_FEATURE) proves
+  // the companion feature is actually composed, so an app that mounts
+  // auth-email-password without it keeps self-signup working.
+  test("signup-request still sends mail when the companion toggle feature was never composed", async () => {
+    const res = await bareStack.http.raw("POST", "/api/auth/signup-request", {
+      email: "not-toggle-aware@example.com",
+    });
+    expect(res.status).toBe(200);
+    expect(bareEmailTransport.sent).toHaveLength(1);
+  });
+
+  test("signup-registration-status reports enabled:true with no toggle feature mounted", async () => {
+    const res = await bareStack.http.raw("POST", "/api/query", {
+      type: "auth-email-password:query:signup-registration-status",
+      payload: {},
+    });
+    expect((await res.json()) as { data?: { enabled: boolean } }).toMatchObject({
+      data: { enabled: true },
+    });
+  });
+});

package/src/auth-email-password/__tests__/session-callbacks.integration.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEncryptionProvider } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
@@ -10,10 +9,12 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher } from "@cosmicdrift/kumiko-framework/testing";
 import * as jose from "jose";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -23,7 +24,6 @@ import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
-import { hashPassword } from "../password-hashing";
 
 // In-memory fake of a real sessions-store — just enough to observe that the
 // framework calls the callbacks at the right moments and threads the sid back
@@ -90,8 +90,8 @@ const TENANT_A: TenantId = "00000000-0000-4000-8000-0000000000a1";
 const TENANT_B: TenantId = "00000000-0000-4000-8000-0000000000b1";
 
 beforeAll(async () => {
-  const encryption = createEncryptionProvider(encryptionKey);
-  const resolver = createConfigResolver({ encryption });
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  const resolver = createConfigResolver({ cipher: encryption });
 
   store = createFakeStore();
   sidStream = deterministicSids();
@@ -120,6 +120,22 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  // Prime request-helper's per-user sid cache for systemAdmin (the seed
+  // actor every test's seedUser() call authenticates as) here, once,
+  // before any test's observation window opens — otherwise whichever
+  // test happens to call seedUser() first would observe an extra
+  // store.created entry for seed plumbing, not the auth-route behavior
+  // under test (#1452: authHeader() now mints one sid per user.id, not
+  // one per call, so this only ever fires here).
+  await seedUser({
+    email: "warmup-seed-actor@example.com",
+    password: "warmup-password-not-asserted-on",
+    tenants: [],
+  });
+  store.live.clear();
+  store.created.length = 0;
+  store.revoked.length = 0;
 });
 
 afterAll(async () => {

package/src/auth-email-password/__tests__/session-strict-mode.integration.test.ts

@@ -1,8 +1,6 @@
-// Tests the `sessionStrictMode` flag on AuthRoutesConfig. When enabled, a
-// JWT that arrives WITHOUT a `jti` is rejected at the middleware — useful
-// after a rolling deploy has been emitting sids longer than the JWT TTL,
-// so legacy stateless tokens are expected to have expired. Default false
-// keeps pre-upgrade tokens working; this suite flips it on and asserts.
+// Pins the default sessionChecker behavior: a JWT that arrives WITHOUT a
+// `jti` is rejected at the middleware. There is no relaxed mode — any app
+// that wires sessionChecker gets this for free.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -21,12 +19,8 @@ let stack: TestStack;
 const TENANT: TenantId = testTenantId(1);
 const userId = TestUsers.systemAdmin.id;
 
-// Stub checker that always accepts. The strictMode branch runs BEFORE the
-// checker is even consulted (no jti → nothing to check), so the stub never
-// fires in the strict-mode path. It's present to satisfy the framework's
-// "you wired sessionChecker, so we'll run it if we have an sid" contract.
-// Accepts the full AuthSessionChecker signature (sid + expectedUserId)
-// even though it doesn't use the args.
+// Stub checker that always accepts. Accepts the full AuthSessionChecker
+// signature (sid + expectedUserId) even though it doesn't use the args.
 async function stubChecker(_sid: string, _expectedUserId: string): Promise<"live"> {
   return "live";
 }
@@ -42,7 +36,6 @@ beforeAll(async () => {
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       sessionChecker: stubChecker,
-      sessionStrictMode: true,
     },
   });
 });
@@ -51,7 +44,7 @@ afterAll(async () => {
   await stack.cleanup();
 });
 
-describe("sessionStrictMode: sidless JWTs are rejected", () => {
+describe("sessionChecker wired: sidless JWTs are rejected", () => {
   test("JWT without jti → 401 with reason=no_sid", async () => {
     // Hand-signed JWT that carries id + tenantId + roles but NO jti. The
     // standard testing request-helper signs JWTs the same way on user
@@ -93,7 +86,7 @@ describe("sessionStrictMode: sidless JWTs are rejected", () => {
     expect(res.status).not.toBe(401);
     // Narrow the "not 401" to exclude other 4xx middleware errors too.
     // A 403 from access-layer or a 400 from shape-validation wouldn't
-    // come from sessionStrictMode, but either would be a different code
+    // come from the sid gate, but either would be a different code
     // path than the one we're testing — flag them if they surface.
     expect(res.status).not.toBe(403);
     expect(res.status).not.toBe(400);

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -26,6 +26,8 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -44,11 +46,53 @@ import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+// kumiko-lint-ignore cross-feature-import regression-proof for #1463: seedTenant
+// must fire tier-engine's entity postSave hook on self-signup, not just on the
+// TenantHandlers.create HTTP path.
+import { tierAssignmentEntity } from "../../tier-engine/entity";
+import { createTierEngineFeature } from "../../tier-engine/feature";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 
+const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+
+// Regression-proof for #1478: provisionSignupAccount only threaded `hooks`
+// into seedTenant, leaving seedUserWithPassword's `user`-entity and
+// seedTenantMembership's `tenantMembership`-entity postSave hooks unfired
+// on self-signup — same bug class as #1463, just for the other two
+// entities in the same call. This vendor feature's hook is the user-side
+// analog of tier-engine's tenant hook above.
+const userPostSaveFired = { count: 0 };
+const userHookVendorFeature = defineFeature("user-hook-vendor-test", (r) => {
+  r.requires("user");
+  r.hook("postSave", { allOf: "user" }, async (ctx) => {
+    if (ctx.isNew) userPostSaveFired.count++;
+  });
+});
+
+// Regression-proof for #1478/#1526: seedTenantMembership must fire the
+// `tenantMembership` entity's postSave hooks (e.g. a Welcome-notification
+// hook) on self-signup too — pins the `fireEntityPostSave` call added at
+// seeding.ts's seedTenantMembership, not just the `user`/`tenant` ones.
+// #1566: also record ctx._tenantId so a shallow-only rescope regresses.
+const tenantMembershipPostSaveFired = { count: 0, seenTenantIds: [] as string[] };
+const tenantMembershipHookVendorFeature = defineFeature(
+  "tenant-membership-hook-vendor-test",
+  (r) => {
+    r.requires("tenant");
+    r.hook("postSave", { allOf: "tenant-membership" }, async (result, context) => {
+      if (result.isNew) {
+        tenantMembershipPostSaveFired.count++;
+        if (context._tenantId !== undefined) {
+          tenantMembershipPostSaveFired.seenTenantIds.push(String(context._tenantId));
+        }
+      }
+    });
+  },
+);
+
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
 
 // Activation mails now go through delivery (ctx.notify → channel-email). The
@@ -78,6 +122,14 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature({
         signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
       }),
+      // Regression-proof for #1463: seedTenant must fire the entity postSave
+      // hook on self-signup too, not just on the TenantHandlers.create path.
+      createTierEngineFeature({
+        defaultTier: "free",
+        tierMap: { free: { features: [], caps: {} } },
+      }),
+      userHookVendorFeature,
+      tenantMembershipHookVendorFeature,
     ],
     extraContext: (deps) => ({
       ...createDeliveryTestContext(deps),
@@ -102,6 +154,7 @@ beforeAll(async () => {
     configValuesTable,
     tenantMembershipsTable,
     notificationPreferencesTable,
+    tierAssignmentTable,
   });
 });
 
@@ -112,8 +165,12 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${tierAssignmentTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
   emailTransport.sent.length = 0;
+  userPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.count = 0;
+  tenantMembershipPostSaveFired.seenTenantIds = [];
   // Redis-cleanup damit Resend-Tests keine state-leaks haben.
   const allKeys = await stack.redis.redis.keys("signup:*");
   if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
@@ -220,6 +277,28 @@ describe("POST /api/auth/signup-confirm", () => {
       expect(JSON.parse(rolesRaw) as string[]).toContain("Admin");
     }
 
+    // #1463 regression: seedTenant fires the tenant entity's postSave
+    // hooks — tier-engine's auto-default-tier hook must run on self-signup
+    // exactly like it does on the regular TenantHandlers.create HTTP path.
+    const tierRows = await selectMany(stack.db, tierAssignmentTable, {
+      tenantId: body.user?.tenantId ?? "",
+    });
+    expect(tierRows).toHaveLength(1);
+    expect(tierRows[0]?.["tier"]).toBe("free");
+
+    // #1478 regression: seedUserWithPassword (called from
+    // provisionSignupAccount) fires the `user` entity's postSave hooks too —
+    // before this fix, only seedTenant's hooks param was wired through.
+    expect(userPostSaveFired.count).toBe(1);
+
+    // #1478/#1526 regression: seedTenantMembership (called from
+    // provisionSignupAccount) fires the `tenant-membership` entity's postSave
+    // hooks too — before this fix, only seedTenant's hooks param was wired.
+    expect(tenantMembershipPostSaveFired.count).toBe(1);
+    // #1566: rescope must put the new tenant on the hook context, not the
+    // anonymous/system caller's tenantId.
+    expect(tenantMembershipPostSaveFired.seenTenantIds).toEqual([body.user?.tenantId ?? ""]);
+
     // Authority-Beweis: Login mit dem gesetzten Password funktioniert.
     const loginRes = await postLogin(email, password);
     expect(loginRes.status).toBe(200);
@@ -320,4 +399,16 @@ describe("POST /api/auth/signup-confirm", () => {
     const loginAttacker = await postLogin(email, attackerPassword);
     expect(loginAttacker.status).not.toBe(200);
   });
+
+  test("common password → 400 (schema rejects breach-list password) (#1340)", async () => {
+    const email = "common-signup@example.com";
+    const token = await requestSignup(email);
+
+    const confirmRes = await postSignupConfirm(token, "password1");
+    expect(confirmRes.status).toBe(400);
+
+    // No user created — the rejected confirm never landed.
+    const userRows = await selectMany(stack.db, userTable, { email });
+    expect(userRows).toHaveLength(0);
+  });
 });

package/src/auth-email-password/constants.ts

@@ -6,6 +6,10 @@
 // der server-side Zugriff (handlers, dispatcher) erhalten.
 export const AUTH_EMAIL_PASSWORD_FEATURE = "auth-email-password" as const;
 
+// Minimum length for reset/verify hmacSecret — mirrors the ≥32-char
+// JWT_SECRET env check (HMAC-SHA256 key material).
+export const MIN_HMAC_SECRET_LENGTH = 32;
+
 // Qualified handler names. Non-CRUD handlers, no entity prefix.
 export const AuthHandlers = {
   login: "auth-email-password:write:login",
@@ -15,6 +19,12 @@ export const AuthHandlers = {
   resetPassword: "auth-email-password:write:reset-password",
   requestEmailVerification: "auth-email-password:write:request-email-verification",
   verifyEmail: "auth-email-password:write:verify-email",
+  // Account-Unlock Magic-Link (fixes the lockout-DoS where the monotonic
+  // failure-counter re-locks immediately after expiry, #1266). Mirrors
+  // reset: request mints an HMAC token + mails it, confirm clears the
+  // Redis lockout state.
+  requestAccountUnlock: "auth-email-password:write:request-account-unlock",
+  confirmAccountUnlock: "auth-email-password:write:confirm-account-unlock",
   // Magic-Link Self-Signup (Pre-Activation-Token-Pattern). request mintet
   // einen opaken Random-Token, speichert ihn bidirektional in Redis und
   // sendet eine Aktivierungs-Mail. confirm löst den Token ein und legt
@@ -36,6 +46,12 @@ export const AuthHandlers = {
   inviteCancel: "auth-email-password:write:invite-cancel",
 } as const;
 
+// Qualified query names. Anonymous-readable status so the (unauthenticated)
+// signup page can decide whether to show its own link/form.
+export const AuthQueries = {
+  signupRegistrationStatus: "auth-email-password:query:signup-registration-status",
+} as const;
+
 // Error codes — kept intentionally generic so clients can't distinguish
 // "email doesn't exist" from "password wrong". Both surface as invalid_credentials.
 // Soft-deleted users also collapse into invalid_credentials to avoid enumeration.
@@ -55,6 +71,11 @@ export const AuthErrors = {
   invalidVerificationToken: "invalid_verification_token",
   verificationNotConfigured: "email_verification_not_configured",
   emailNotVerified: "email_not_verified",
+  // Account-Unlock: mirrors the reset-token handling — every verify
+  // failure (malformed/bad-signature/expired) collapses to this single
+  // code so a probing client can't distinguish tampered from stale.
+  invalidUnlockToken: "invalid_unlock_token",
+  unlockNotConfigured: "account_unlock_not_configured",
   // Self-Signup: alle confirm-Failures (unbekannter Token, schon
   // konsumiert, abgelaufen) collapsen auf diesen Code — gleicher
   // anti-enumeration-Trade-off wie reset/verify.
@@ -99,6 +120,10 @@ export const AuthErrors = {
 export const AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS = 5;
 export const AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES = 15;
 
+// Account-unlock token TTL — same as reset (15min): short-lived, the user
+// clicks it right after hitting the lockout screen.
+export const AUTH_UNLOCK_DEFAULT_TTL_MINUTES = 15;
+
 export const AUTH_RESET_DEFAULT_TTL_MINUTES = 15;
 // Verification tokens live longer by default because the user may not be
 // at their computer the moment they sign up — 24h covers "verify after

package/src/auth-email-password/email-templates.ts

@@ -73,6 +73,14 @@ const STRINGS = {
     inviteExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
     inviteIgnore:
       "Falls du diese Einladung nicht erwartet hast, kannst du diese E-Mail ignorieren.",
+    unlockSubject: (app: string) => `${app} — Konto entsperren`,
+    unlockGreeting: "Hallo,",
+    unlockIntro: (app: string) =>
+      `dein ${app}-Konto wurde nach mehreren fehlgeschlagenen Anmeldeversuchen vorübergehend gesperrt. Klicke auf den folgenden Link, um es sofort zu entsperren:`,
+    unlockButton: "Konto entsperren",
+    unlockExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
+    unlockIgnore:
+      "Falls du diese Sperre nicht ausgelöst hast, kannst du diese E-Mail ignorieren — die Sperre läuft von selbst ab.",
   },
   en: {
     resetSubject: (app: string) => `${app} — Reset your password`,
@@ -105,6 +113,14 @@ const STRINGS = {
     inviteButton: "Accept invitation",
     inviteExpiry: (when: string) => `The link expires on ${when}.`,
     inviteIgnore: "If you weren't expecting this invitation, you can ignore this email.",
+    unlockSubject: (app: string) => `${app} — Unlock your account`,
+    unlockGreeting: "Hi,",
+    unlockIntro: (app: string) =>
+      `your ${app} account was temporarily locked after several failed sign-in attempts. Click the link below to unlock it immediately:`,
+    unlockButton: "Unlock account",
+    unlockExpiry: (when: string) => `The link expires on ${when}.`,
+    unlockIgnore:
+      "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
   },
 } as const;
 
@@ -151,6 +167,22 @@ export function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMail
   });
 }
 
+export function renderUnlockAccountEmail(args: RenderTokenContentArgs): AuthMailContent {
+  const locale = args.locale ?? "en";
+  const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
+  const t = STRINGS[locale];
+  return tokenMailContent({
+    subject: t.unlockSubject(appName),
+    header: t.unlockButton,
+    greeting: t.unlockGreeting,
+    intro: t.unlockIntro(appName),
+    buttonLabel: t.unlockButton,
+    buttonUrl: args.url,
+    expiry: t.unlockExpiry(formatExpiry(args.expiresAt)),
+    ignore: t.unlockIgnore,
+  });
+}
+
 export function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
   const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");

package/src/auth-email-password/errors.ts

@@ -37,6 +37,15 @@ export function invalidResetToken() {
   );
 }
 
+// @wrapper-known error-helper
+export function invalidUnlockToken() {
+  return writeFailure(
+    new UnprocessableError(AuthErrors.invalidUnlockToken, {
+      i18nKey: "auth.errors.invalidUnlockToken",
+    }),
+  );
+}
+
 // @wrapper-known error-helper
 export function invalidVerificationToken() {
   return writeFailure(