@cosmicdrift/kumiko-dev-server 0.160.0 → 0.162.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.160.0",
+  "version": "0.162.0",
   "description": "Dev-tooling for Kumiko apps: local dev-server bootstrap (runDevApp), scaffolding, codegen. Not shipped into production node_modules — see @cosmicdrift/kumiko-server-runtime for the prod boot path.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -54,9 +54,9 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.160.0",
-    "@cosmicdrift/kumiko-framework": "0.160.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.160.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.162.0",
+    "@cosmicdrift/kumiko-framework": "0.162.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.162.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/compose-stacks.test.ts

@@ -1,5 +1,4 @@
 import { describe, expect, test } from "bun:test";
-import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { composeFeatures } from "@cosmicdrift/kumiko-server-runtime/compose-features";
@@ -56,6 +55,7 @@ describe("composeStacks", () => {
       "data-retention",
       "compliance-profiles",
       "tenant-lifecycle",
+      "auth-foundation",
       "sessions",
     ]);
   });
@@ -87,12 +87,13 @@ describe("composeStacks", () => {
     ]);
   });
 
-  test("composeIdentityStack defaults sessions only", () => {
-    expect(stackFeatureNames(composeIdentityStack())).toEqual(["sessions"]);
+  test("composeIdentityStack defaults auth-foundation + sessions", () => {
+    expect(stackFeatureNames(composeIdentityStack())).toEqual(["auth-foundation", "sessions"]);
   });
 
   test("composeIdentityStack mounts auth-mfa when mfa options given", () => {
     expect(stackFeatureNames(composeIdentityStack({ mfa: TEST_MFA }))).toEqual([
+      "auth-foundation",
       "sessions",
       "auth-mfa",
     ]);
@@ -114,7 +115,6 @@ describe("composeStacks", () => {
       validateBoot(
         composeFeatures(
           [
-            authFoundationFeature,
             createPersonalAccessTokensFeature({ scopes: {} }),
             ...composeIdentityStack(),
             ...composeGdprStack({ sessions: true }),
@@ -131,7 +131,6 @@ describe("composeStacks boots for real", () => {
   test("studio-shaped combined stack passes validateBoot (not just name-list comparison)", () => {
     const features = composeFeatures(
       [
-        authFoundationFeature,
         createPersonalAccessTokensFeature({ scopes: {} }),
         ...composeOpsStack({ rateLimiting: true }),
         ...composePagesStack(),

package/src/__tests__/saas-identity-wire.integration.test.ts

@@ -12,7 +12,6 @@ import {
   seedAdmin,
   seedUserWithPassword,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   AuthMfaHandlers,
   base32Decode,
@@ -118,7 +117,6 @@ beforeAll(async () => {
 
   const features = composeFeatures(
     [
-      authFoundationFeature,
       ...identity,
       ...composeOpsStack({ delivery: true, audit: false, jobs: false }),
       ...composeRendererStack(),

package/src/compose-stacks.ts

@@ -3,6 +3,7 @@
 // or tier maps (those stay in bin/server.ts / app run-config).
 
 import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   type AuthMfaFeatureOptions,
   createAuthMfaFeature,
@@ -76,10 +77,17 @@ export type OpsStackOptions = {
 };
 
 /** sessions (+ optional auth-mfa). config/user/tenant/auth-email-password stay
- *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP. */
+ *  on composeFeatures(includeBundled). Pass `mfa` options to mount TOTP.
+ *  When `sessions` is on (the default), auth-foundation is mounted alongside it —
+ *  the framework's registry now hard-requires it (sessions.requires("auth-foundation")).
+ *  Pass `providers` for the tokenVerifier(s) auth-foundation itself requires at least
+ *  one of (e.g. createPersonalAccessTokensFeature({ scopes })) — PAT scopes are
+ *  app-specific (which write-handlers an API token may call), so they stay caller-owned
+ *  instead of a framework default. */
 export type IdentityStackOptions = {
   readonly sessions?: boolean;
   readonly mfa?: AuthMfaFeatureOptions;
+  readonly providers?: readonly FeatureDefinition[];
 };
 
 export function stackFeatureNames(features: readonly FeatureDefinition[]): string[] {
@@ -131,7 +139,7 @@ export function composeGdprStack(options: GdprStackOptions = {}): FeatureDefinit
   const out: FeatureDefinition[] =
     order === "compliance-first" ? [compliance, retention] : [retention, compliance];
   if (options.tenantLifecycle) out.push(createTenantLifecycleFeature());
-  if (options.sessions) out.push(createSessionsFeature());
+  if (options.sessions) out.push(authFoundationFeature, createSessionsFeature());
   return out;
 }
 
@@ -162,7 +170,10 @@ export function composeOpsStack(options: OpsStackOptions = {}): FeatureDefinitio
 export function composeIdentityStack(options: IdentityStackOptions = {}): FeatureDefinition[] {
   const sessions = options.sessions ?? true;
   const out: FeatureDefinition[] = [];
-  if (sessions) out.push(createSessionsFeature());
+  if (sessions) {
+    out.push(authFoundationFeature, createSessionsFeature());
+    if (options.providers) out.push(...options.providers);
+  }
   if (options.mfa !== undefined) out.push(createAuthMfaFeature(options.mfa));
   return out;
 }

package/src/create-kumiko-server.ts

@@ -19,6 +19,7 @@ import { existsSync, mkdtempSync, statSync } from "node:fs";
 import { readFile, watch } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { resolveAnonymousAccessFromRegistry } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { type AuthRoutesConfig, generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { buildAppSchema, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -673,6 +674,7 @@ export async function createKumikoServer(
     ...(options.auth !== undefined && { authConfig: options.auth }),
     ...(options.extraContext !== undefined && { extraContext: options.extraContext }),
     ...(options.anonymousAccess !== undefined && { anonymousAccess: options.anonymousAccess }),
+    enrichAnonymousAccess: (base, deps) => resolveAnonymousAccessFromRegistry(base, deps),
     ...(options.files !== undefined && { files: options.files }),
     ...(options.effectiveFeatures !== undefined && {
       effectiveFeatures: options.effectiveFeatures,

package/src/run-dev-app.ts

@@ -18,7 +18,12 @@ import {
   type SeedAdminOptions,
   seedAdmin,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
-import { resolveTokenVerifier } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import {
+  EXT_SESSION_STORE,
+  resolveSessionStore,
+  resolveTokenVerifier,
+  type SessionStore,
+} from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import {
   AUTH_MFA_FEATURE,
   AuthMfaHandlers,
@@ -34,9 +39,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
   bindAutoRevokeFromFeature,
-  createSessionCallbacks,
   SESSIONS_FEATURE,
-  type SessionCallbacks,
 } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { TenantQueries } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import {
@@ -118,17 +121,6 @@ export type RunDevAppAuthOptions = {
   /** Optional override of the login error → HTTP status map. Default
    *  maps invalidCredentials → 401, noMembership → 403. */
   readonly loginErrorStatusMap?: Readonly<Record<string, number>>;
-  /** Opt-in: revocable server-side sessions. Caller MUSS
-   *  `createSessionsFeature()` zu `features` adden — runDevApp wired
-   *  hier nur die Auth-Callbacks (creator/revoker/checker) gegen
-   *  stack.db (sidless JWTs werden dann abgelehnt).
-   *
-   *  Standardverhalten ohne diese Option: stateless JWTs ohne sid,
-   *  Logout ist client-side cookie-clear, Karten­haus existing-Apps
-   *  bleibt unangefasst. */
-  readonly sessions?: {
-    readonly expiresInMs?: number;
-  };
   /** Auth-Mail-Convenience — symmetrisch zu RunProdAppAuthOptions.mail.
    *  Verdrahtet alle 4 Mail-Flows aus env-SMTP + Standard-Templates;
    *  hmacSecret = `JWT_SECRET`-env (Dev-Fallback wenn ungesetzt). Ohne
@@ -395,19 +387,15 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
     return { ...boot, ...base };
   };
 
-  // Sessions opt-in: Holder lebt im closure, `createSessionCallbacks`
-  // kennt erst nach setupTestStack die echte db-connection. Inline
-  // statt @cosmicdrift/kumiko-framework/testing's createLateBoundHolder zu reusen,
-  // weil dev-server (dev-runtime) keine Tooling aus framework/testing
-  // (test-runtime) importieren darf — Runtime-Isolation Guard.
-  // Server-Start passiert NACH onAfterSetup (siehe create-kumiko-server.ts),
-  // daher ist `sessionCallbacks` zur ersten Login-Request konkret.
-  let sessionCallbacks: SessionCallbacks | undefined;
-  const requireSessions = (): SessionCallbacks => {
-    if (!sessionCallbacks) {
-      throw new Error("[runDevApp] session-callbacks accessed before onAfterSetup");
+  // Sessions: late-bound holder — resolveSessionStore needs concrete db+
+  // registry (only after setupTestStack). Wired when sessions feature is
+  // mounted (#1372); no auth.sessions opt-in anymore.
+  let sessionStore: SessionStore | undefined;
+  const requireSessionStore = (): SessionStore => {
+    if (!sessionStore) {
+      throw new Error("[runDevApp] sessionStore accessed before onAfterSetup");
     }
-    return sessionCallbacks;
+    return sessionStore;
   };
   // Token-verifier opt-in: same late-bound holder pattern — resolveTokenVerifier
   // needs the real db+registry (only concrete after setupTestStack). Wired
@@ -444,14 +432,19 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       }
     : {};
 
+  // Parity with runProdApp (#1372 review): gate on sessionStore provider, not
+  // the sessions feature name — a custom provider must also wire auth callbacks.
+  const sessionStoreProviderMounted = features.some((f) =>
+    f.extensionUsages.some((u) => u.extensionName === EXT_SESSION_STORE),
+  );
   const sessionAuthFragment =
-    effectiveAuth?.sessions !== undefined
+    effectiveAuth && sessionStoreProviderMounted
       ? {
           sessionCreator: (user: SessionUser, meta: SessionMetadata) =>
-            requireSessions().sessionCreator(user, meta),
-          sessionRevoker: (sid: string) => requireSessions().sessionRevoker(sid),
+            requireSessionStore().creator(user, meta),
+          sessionRevoker: (sid: string) => requireSessionStore().revoker(sid),
           sessionChecker: (sid: string, userId: string) =>
-            requireSessions().sessionChecker(sid, userId),
+            requireSessionStore().checker(sid, userId),
         }
       : {};
 
@@ -494,7 +487,11 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
         ...sessionAuthFragment,
         ...patAuthFragment,
         ...tenantLifecycleAuthFragment,
-        ...(mfaFeature && { mfaVerifyHandler: AuthMfaHandlers.verify }),
+        ...(mfaFeature && {
+          mfaVerifyHandler: AuthMfaHandlers.verify,
+          mfaPreauthEnableStartHandler: AuthMfaHandlers.enableStartPreauth,
+          mfaPreauthConfirmHandler: AuthMfaHandlers.enableConfirmPreauth,
+        }),
         ...(effectiveAuth.passwordReset && {
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
@@ -540,26 +537,21 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           registry: stack.registry,
         });
       }
-      if (effectiveAuth?.sessions !== undefined) {
-        const expiresInMs = effectiveAuth.sessions.expiresInMs;
-        sessionCallbacks = createSessionCallbacks({
+      if (effectiveAuth && stack.registry.getExtensionUsages(EXT_SESSION_STORE).length > 0) {
+        // Secure-by-default (#1372): resolve sessionStore provider; bind
+        // password-change mass-revoke + MFA revokeAllOthers.
+        const store = await resolveSessionStore({
           db: stack.db,
-          ...(expiresInMs !== undefined && { expiresInMs }),
+          registry: stack.registry,
         });
-        // Secure-by-default (symmetrisch zu runProdApp): Password-Change/
-        // -Reset mass-revoked die Sessions des Users ohne App-Opt-in.
         const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
         if (sessionsFeature) {
-          bindAutoRevokeFromFeature(sessionsFeature)?.(sessionCallbacks.sessionMassRevoker);
+          bindAutoRevokeFromFeature(sessionsFeature)?.(store.massRevoker);
         }
-        // MFA enable/disable/regenerate mass-revokes every OTHER live
-        // session (stolen-session defense) — only wired when auth-mfa is
-        // mounted.
         if (mfaFeature) {
-          bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(
-            sessionCallbacks.sessionRevokeAllOthers,
-          );
+          bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
         }
+        sessionStore = store;
       }
       if (patFeature) {
         tokenVerifier = (rawToken) =>