@cosmicdrift/kumiko-samples 0.340.0 → 0.342.0

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -23,8 +23,15 @@ import {
   access,
   assignableAppRolesOf,
   defineWriteHandler,
+  type HandlerContext,
+  type SessionUser,
+  type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
@@ -40,14 +47,19 @@ import {
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles.js";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
 import { renderInviteEmail } from "../email-templates.js";
+import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 
 const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
 
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+
 const InviteCreateSchema = z.object({
   email: z.email(),
   role: z.string().min(1).max(50),
@@ -59,6 +71,7 @@ export type InviteCreateData = {
   readonly tenantId: string;
   readonly email: string;
   readonly role: string;
+  readonly globalRoles: readonly GlobalRole[];
   readonly expiresAt: string;
 };
 
@@ -97,15 +110,160 @@ function findRankedRole(roles: readonly string[]): string | undefined {
   return roles.find((role) => findForbiddenRoleAssignment(["system"], [role], []) === undefined);
 }
 
-export function createInviteCreateHandler(opts: InviteCreateOptions) {
+type InviteIssueRequest = {
+  readonly email: string;
+  readonly role: string;
+  readonly globalRoles: readonly GlobalRole[];
+};
+
+function checkAssignableInviteRole(
+  opts: InviteCreateOptions,
+  inviterRoles: readonly string[],
+  role: string,
+  ctx: HandlerContext,
+): WriteFailure | undefined {
+  const forbiddenRole = findForbiddenMembershipRole([role]);
+  if (forbiddenRole !== undefined) return writeFailure(reservedMembershipRoleError(forbiddenRole));
+
+  const elevationForbidden = findForbiddenRoleAssignment(
+    inviterRoles,
+    [role],
+    [],
+    assignableAppRolesOf(ctx.registry),
+  );
+  if (
+    elevationForbidden !== undefined &&
+    !opts.additionalAssignableRoles?.includes(elevationForbidden)
+  ) {
+    return writeFailure(unassignableMembershipRoleError(elevationForbidden));
+  }
+
+  if (opts.canAssignRole && !opts.canAssignRole(inviterRoles, role)) {
+    return writeFailure(unassignableMembershipRoleError(role));
+  }
+  return undefined;
+}
+
+async function issueInvitation(
+  opts: InviteCreateOptions,
+  ttlSeconds: number,
+  request: InviteIssueRequest,
+  inviter: SessionUser,
+  ctx: HandlerContext,
+  refuseAccepted = false,
+): Promise<WriteResult<InviteCreateData>> {
+  if (!ctx.redis) {
+    return writeFailure(
+      new InternalError({ message: "invite-create requires ctx.redis for token store" }),
+    );
+  }
+
+  const email = request.email.toLowerCase();
+  const tenantId = inviter.tenantId;
+  const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+
+  // The unique index allows one row per (tenantId, email). Whatever its
+  // status, a re-invite resets it to pending with a fresh token.
+  const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
+
+  let invitationId: string;
+  if (existing) {
+    // Provisioning callers (waitlist) must not flip an accepted invite back to
+    // pending: that would let them cancel a live membership's invitation.
+    // The tenant-admin path keeps resetting because re-inviting a member is
+    // how roles get re-assigned.
+    if (refuseAccepted && existing["status"] === INVITATION_STATUS.accepted) {
+      return inviteAlreadyAccepted();
+    }
+    invitationId = existing["id"] as string; // @cast-boundary db-row
+    const existingVersion = existing["version"] as number; // @cast-boundary db-row
+    // At most one live invite token per invitation: invalidate
+    // whatever's there before minting the new one.
+    await invalidateExistingInviteToken(ctx.redis, invitationId);
+
+    const updateResult = await executor.update(
+      {
+        id: invitationId,
+        version: existingVersion,
+        changes: {
+          role: request.role,
+          // Always written, also as []: a tenant-admin resend must drop
+          // global roles a previous system invite put on this row.
+          globalRoles: [...request.globalRoles],
+          status: INVITATION_STATUS.pending,
+          invitedBy: inviter.id,
+          expiresAt,
+        },
+      },
+      inviter,
+      ctx.db,
+    );
+    if (!updateResult.isSuccess) return updateResult;
+  } else {
+    const createResult = await executor.create(
+      {
+        email,
+        role: request.role,
+        globalRoles: [...request.globalRoles],
+        status: INVITATION_STATUS.pending,
+        invitedBy: inviter.id,
+        expiresAt,
+      },
+      inviter,
+      ctx.db,
+    );
+    if (!createResult.isSuccess) return createResult;
+    invitationId = (createResult.data as { id: string }).id; // @cast-boundary engine-payload
+  }
+
+  const token = generateToken();
+  await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
+
+  const locale = resolveHandlerMailLocale(ctx, opts.locale);
+
+  await dispatchMagicLinkMail(
+    ctx.notify,
+    {
+      handlerName: "invite-create",
+      notificationType: INVITE_NOTIFICATION_TYPE,
+      renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+    },
+    {
+      email,
+      appUrl: opts.appUrl,
+      token,
+      expiresAt: expiresAt.toString(),
+      ...(opts.appName !== undefined && { appName: opts.appName }),
+      locale,
+    },
+  );
+
+  return {
+    isSuccess: true,
+    data: {
+      kind: "invite-created",
+      invitationId,
+      tenantId,
+      email,
+      role: request.role,
+      globalRoles: request.globalRoles,
+      expiresAt: expiresAt.toString(),
+    },
+  };
+}
+
+function assertAppDefinedAdditionalRoles(opts: InviteCreateOptions): void {
   const rankedRole = findRankedRole(opts.additionalAssignableRoles ?? []);
   if (rankedRole !== undefined) {
     throw new Error(
       `[auth-email-password] invite.additionalAssignableRoles must list app-defined roles only; "${rankedRole}" is a framework-ranked role`,
     );
   }
-  const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES;
-  const ttlSeconds = ttlMinutes * 60;
+}
+
+export function createInviteCreateHandler(opts: InviteCreateOptions) {
+  assertAppDefinedAdditionalRoles(opts);
+  const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
 
   return defineWriteHandler<"invite-create", typeof InviteCreateSchema, InviteCreateData>({
     name: "invite-create",
@@ -114,119 +272,58 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
     description:
       "Invites an email address into the caller's tenant with a chosen membership role, creating or reusing the invitation and mailing the invitee a fresh accept link; re-inviting the same address invalidates the previous link.",
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
-        return writeFailure(
-          new InternalError({ message: "invite-create requires ctx.redis for token store" }),
-        );
-      }
-
-      const forbiddenRole = findForbiddenMembershipRole([event.payload.role]);
-      if (forbiddenRole !== undefined) {
-        return writeFailure(reservedMembershipRoleError(forbiddenRole));
-      }
-
-      const elevationForbidden = findForbiddenRoleAssignment(
+      const roleRejection = checkAssignableInviteRole(
+        opts,
         event.user.roles,
-        [event.payload.role],
-        [],
-        assignableAppRolesOf(ctx.registry),
+        event.payload.role,
+        ctx,
       );
-      if (
-        elevationForbidden !== undefined &&
-        !opts.additionalAssignableRoles?.includes(elevationForbidden)
-      ) {
-        return writeFailure(unassignableMembershipRoleError(elevationForbidden));
-      }
-
-      if (opts.canAssignRole && !opts.canAssignRole(event.user.roles, event.payload.role)) {
-        return writeFailure(unassignableMembershipRoleError(event.payload.role));
-      }
-
-      const email = event.payload.email.toLowerCase();
-      const tenantId = event.user.tenantId;
-      const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
-
-      // Existing row für (tenantId, email) — unique-index garantiert
-      // max. eine Row. Status egal (cancelled/accepted/expired/pending);
-      // wir setzen sie auf pending zurück und vergeben einen frischen
-      // Token wenn der bisherige nicht mehr lebt.
-      const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
-
-      let invitationId: string;
-      let token: string;
-      if (existing) {
-        invitationId = existing["id"] as string; // @cast-boundary db-row
-        const existingVersion = existing["version"] as number; // @cast-boundary db-row
-        // At most one live invite token per invitation: invalidate
-        // whatever's there before minting the new one.
-        await invalidateExistingInviteToken(ctx.redis, invitationId);
-        token = generateToken();
-
-        const updateResult = await executor.update(
-          {
-            id: invitationId,
-            version: existingVersion,
-            changes: {
-              role: event.payload.role,
-              status: INVITATION_STATUS.pending,
-              invitedBy: event.user.id,
-              expiresAt,
-            },
-          },
-          event.user,
-          ctx.db,
-        );
-        if (!updateResult.isSuccess) return updateResult;
-      } else {
-        const createResult = await executor.create(
-          {
-            email,
-            role: event.payload.role,
-            status: INVITATION_STATUS.pending,
-            invitedBy: event.user.id,
-            expiresAt,
-          },
-          event.user,
-          ctx.db,
-        );
-        if (!createResult.isSuccess) return createResult;
-        invitationId = (createResult.data as { id: string }).id; // @cast-boundary engine-payload
-        token = generateToken();
-      }
-
-      await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
-
-      const locale = resolveHandlerMailLocale(ctx, opts.locale);
-
-      await dispatchMagicLinkMail(
-        ctx.notify,
-        {
-          handlerName: "invite-create",
-          notificationType: INVITE_NOTIFICATION_TYPE,
-          renderContent: (renderArgs) =>
-            renderInviteEmail({ ...renderArgs, role: event.payload.role }),
-        },
-        {
-          email,
-          appUrl: opts.appUrl,
-          token,
-          expiresAt: expiresAt.toString(),
-          ...(opts.appName !== undefined && { appName: opts.appName }),
-          locale,
-        },
+      if (roleRejection) return roleRejection;
+      return issueInvitation(
+        opts,
+        ttlSeconds,
+        { email: event.payload.email, role: event.payload.role, globalRoles: [] },
+        event.user,
+        ctx,
       );
+    },
+  });
+}
 
-      return {
-        isSuccess: true,
-        data: {
-          kind: "invite-created",
-          invitationId,
-          tenantId,
-          email,
-          role: event.payload.role,
-          expiresAt: expiresAt.toString(),
-        },
-      };
+const SystemInviteCreateSchema = z.object({
+  email: z.email(),
+  role: z.string().min(1).max(50),
+  globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+});
+
+// System-only sibling of invite-create: the only path that can put global
+// roles (SystemAdmin) on an invitation. No session mint path yields the
+// "system" role (users.roles only accepts GLOBAL_ROLE_OPTIONS), so only
+// in-process callers dispatching as createSystemUser (runBootstrap) get here.
+export function createSystemInviteCreateHandler(opts: InviteCreateOptions) {
+  assertAppDefinedAdditionalRoles(opts);
+  const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
+
+  return defineWriteHandler<
+    "system-invite-create",
+    typeof SystemInviteCreateSchema,
+    InviteCreateData
+  >({
+    name: "system-invite-create",
+    schema: SystemInviteCreateSchema,
+    access: { roles: access.system },
+    agent: { expose: false },
+    description:
+      "System-only invite into the dispatching tenant that may additionally carry global roles, which the invitee receives only when accepting; used by provisioning such as runBootstrap.",
+    handler: async (event, ctx) => {
+      const roleRejection = checkAssignableInviteRole(
+        opts,
+        event.user.roles,
+        event.payload.role,
+        ctx,
+      );
+      if (roleRejection) return roleRejection;
+      return issueInvitation(opts, ttlSeconds, event.payload, event.user, ctx, true);
     },
   });
 }

package/packages/bundled-features/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -46,6 +46,8 @@ import {
 } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
 import { seedTenantMembership } from "../../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import existence-check
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken } from "../errors.js";
@@ -113,6 +115,7 @@ export function createInviteSignupCompleteHandler() {
         readonly tenantId: TenantId;
         readonly email: string;
         readonly role: string;
+        readonly globalRoles: unknown;
         readonly version: number;
       };
 
@@ -133,6 +136,7 @@ export function createInviteSignupCompleteHandler() {
           "auth:invite-signup-complete",
         );
         const invitationRole = invitation.role;
+        const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
         const invitationVersion = invitation.version;
 
         // User-Not-Exists-Check: wenn die Email schon registriert ist,
@@ -157,6 +161,7 @@ export function createInviteSignupCompleteHandler() {
           password: event.payload.password,
           displayName: invitationEmail.split("@")[0] ?? invitationEmail,
           emailVerified: true,
+          ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
         });
 
         // Membership-Add via seed-helper (gleiches Pattern wie
@@ -192,7 +197,7 @@ export function createInviteSignupCompleteHandler() {
           tenantId: invitationTenantId,
           // buildSessionRoles calls stripForbiddenMembershipRoles internally —
           // a reserved role on the invitation itself must never reach the session.
-          roles: buildSessionRoles([], [invitationRole]),
+          roles: buildSessionRoles(invitationGlobalRoles, [invitationRole]),
         };
 
         committed = true;

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -93,6 +93,7 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
     schema: SignupRequestSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
     description:
       "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
     escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -100,6 +100,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
     schema: RequestTokenSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
     escapeHatch: {
       reason:
         "Anonymous requester has no session — looks up the target user by email via " +

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -7,6 +7,19 @@
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export type {
+  BootstrapConfigValue,
+  BootstrapDeps,
+  BootstrapInvite,
+  BootstrapInviteOutcome,
+  BootstrapPlan,
+  BootstrapReport,
+  BootstrapSeedDeps,
+  BootstrapSystemAdmin,
+  BootstrapTenant,
+  BootstrapTenantOutcome,
+} from "./bootstrap.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 // Renderers for the auth mails. All four magic-link flows (reset, verify,
 // signup-activation, invite) emit structured AuthMailContent through delivery

package/packages/bundled-features/src/auth-email-password/invite-token-store.ts

@@ -76,3 +76,9 @@ export async function deleteInviteToken(
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnInviteToken = store.unburn;
+
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export async function hasLiveInviteToken(redis: Redis, invitationId: string): Promise<boolean> {
+  return (await store.getTokenHashForSubject(redis, invitationId)) !== null;
+}

package/packages/bundled-features/src/auth-email-password/magic-link-mail.ts

@@ -82,6 +82,7 @@ export async function dispatchMagicLinkMail(
   await notify(spec.notificationType, {
     route: { email: params.email },
     data: content,
+    locale,
     priority: "critical",
   });
 }

package/packages/bundled-features/src/auth-email-password/web/auth-form-primitives.tsx

@@ -15,7 +15,7 @@
 // die früheren authButtonClass/authMutedLinkClass sind dorthin gewandert.
 
 import { usePrimitives } from "@cosmicdrift/kumiko-renderer";
-import { BareFormProvider } from "@cosmicdrift/kumiko-renderer-web";
+import { BareFormProvider, cn } from "@cosmicdrift/kumiko-renderer-web";
 import { createContext, type ReactNode, useContext, useEffect, useState } from "react";
 
 // Wrappt die zentrierte Auth-Card in ihre Umgebung. Default = Fullscreen-
@@ -47,25 +47,41 @@ export function useAuthShell(): AuthShellRenderer | null {
 export type AuthCardProps = {
   readonly title?: string;
   readonly subtitle?: ReactNode;
+  /** Merged onto the Card (default `w-full max-w-sm`). */
+  readonly className?: string;
+  readonly headerClassName?: string;
+  readonly titleClassName?: string;
+  /** Merged onto the body wrapper (default `p-6 pt-0 flex flex-col gap-4`). */
+  readonly bodyClassName?: string;
   readonly children: ReactNode;
 };
 
 // kumiko-lint-ignore no-custom-primitives Wraps usePrimitives().Card, pure domain name for the auth-screen chrome, not a primitive reimplementation
-export function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNode {
+export function AuthCard({
+  title,
+  subtitle,
+  className,
+  headerClassName,
+  titleClassName,
+  bodyClassName,
+  children,
+}: AuthCardProps): ReactNode {
   const { Card } = usePrimitives();
   const shell = useAuthShell() ?? defaultAuthShell;
   // h1 (Seiten-Hauptüberschrift) via Header-Slot erhalten — die Card-Default-
   // Header wäre h3. padded:false = Form sitzt randlos wie bisher (bare form).
   const card = (
     <Card
-      className="w-full max-w-sm"
+      className={cn("w-full max-w-sm", className)}
       options={{ padded: false }}
       slots={{
         header:
           title !== undefined || subtitle !== undefined ? (
-            <div className="flex flex-col space-y-1.5 p-6 pb-4">
+            <div className={cn("flex flex-col space-y-1.5 p-6 pb-4", headerClassName)}>
               {title !== undefined && (
-                <h1 className="text-xl font-semibold tracking-tight">{title}</h1>
+                <h1 className={cn("text-xl font-semibold tracking-tight", titleClassName)}>
+                  {title}
+                </h1>
               )}
               {subtitle !== undefined && (
                 <p className="text-sm text-muted-foreground">{subtitle}</p>
@@ -74,7 +90,9 @@ export function AuthCard({ title, subtitle, children }: AuthCardProps): ReactNod
           ) : undefined,
       }}
     >
-      <BareFormProvider>{children}</BareFormProvider>
+      <BareFormProvider>
+        <div className={cn("p-6 pt-0 flex flex-col gap-4", bodyClassName)}>{children}</div>
+      </BareFormProvider>
     </Card>
   );
   return shell(card);

package/packages/bundled-features/src/auth-email-password/web/confirm-account-unlock-screen.tsx

@@ -47,12 +47,10 @@ export function ConfirmAccountUnlockScreen({
   if (status === "missing-token") {
     return (
       <AuthCard title={title ?? t("auth.unlockAccount.errorTitle")}>
-        <div className="p-6 pt-0 flex flex-col gap-4">
-          <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.missingToken")}</p>
-          <Link href={loginHref} variant="muted">
-            {t("auth.unlockAccount.goToLogin")}
-          </Link>
-        </div>
+        <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.missingToken")}</p>
+        <Link href={loginHref} variant="muted">
+          {t("auth.unlockAccount.goToLogin")}
+        </Link>
       </AuthCard>
     );
   }
@@ -72,12 +70,10 @@ export function ConfirmAccountUnlockScreen({
   if (status === "success") {
     return (
       <AuthCard title={title ?? t("auth.unlockAccount.successTitle")}>
-        <div className="p-6 pt-0 flex flex-col gap-4">
-          <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.successBody")}</p>
-          <Link href={loginHref} variant="button">
-            {t("auth.unlockAccount.goToLogin")}
-          </Link>
-        </div>
+        <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.successBody")}</p>
+        <Link href={loginHref} variant="button">
+          {t("auth.unlockAccount.goToLogin")}
+        </Link>
       </AuthCard>
     );
   }
@@ -85,12 +81,10 @@ export function ConfirmAccountUnlockScreen({
   // status === "error"
   return (
     <AuthCard title={title ?? t("auth.unlockAccount.errorTitle")}>
-      <div className="p-6 pt-0 flex flex-col gap-4">
-        <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.errorBody")}</p>
-        <Link href={loginHref} variant="muted">
-          {t("auth.unlockAccount.goToLogin")}
-        </Link>
-      </div>
+      <p className="text-sm text-muted-foreground">{t("auth.unlockAccount.errorBody")}</p>
+      <Link href={loginHref} variant="muted">
+        {t("auth.unlockAccount.goToLogin")}
+      </Link>
     </AuthCard>
   );
 }

package/packages/bundled-features/src/auth-email-password/web/forgot-password-screen.tsx

@@ -72,7 +72,7 @@ export function ForgotPasswordScreen({
   return (
     <AuthCard title={effectiveTitle} subtitle={subtitle}>
       {done ? (
-        <div className="p-6 pt-0 flex flex-col gap-4">
+        <>
           <Banner variant="info">
             <p className="font-medium text-foreground">{t("auth.forgotPassword.successTitle")}</p>
             <p className="mt-1">{t("auth.forgotPassword.successBody")}</p>
@@ -80,9 +80,9 @@ export function ForgotPasswordScreen({
           <Link href={loginHref} variant="muted">
             {t("auth.forgotPassword.backToLogin")}
           </Link>
-        </div>
+        </>
       ) : (
-        <div className="p-6 pt-0 flex flex-col gap-4">
+        <>
           <p className="text-sm text-muted-foreground">{t("auth.forgotPassword.intro")}</p>
           <Form onSubmit={onSubmit}>
             <Field id="forgot-email" label={t("auth.forgotPassword.email")} required>
@@ -104,7 +104,7 @@ export function ForgotPasswordScreen({
           <Link href={loginHref} variant="muted" className="self-center">
             {t("auth.forgotPassword.backToLogin")}
           </Link>
-        </div>
+        </>
       )}
     </AuthCard>
   );