@cosmicdrift/kumiko-server-runtime 0.1.0

package/src/__tests__/compose-features-mfa-wiring.integration.test.ts

@@ -0,0 +1,308 @@
+// Full-stack wiring test for kumiko-framework#266 Step 6: proves the exact
+// bootstrap path runProdApp/runDevApp produce — composeFeatures() auto-
+// detecting a mounted auth-mfa app-feature and wiring its status-checker
+// into the login handler — actually completes a two-step login over real
+// HTTP. compose-features-wiring.integration.test.ts pins the same pattern
+// for passwordReset/emailVerification; this is the auth-mfa analogue.
+//
+// No mocking: setupTestStack boots a real DB + Redis.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  AuthHandlers,
+  hashPassword,
+} from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import {
+  AuthMfaHandlers,
+  base32Decode,
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  createAuthMfaFeature,
+  mfaRequiredConfigHandle,
+  userMfaEntity,
+} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import { currentTotpCode } from "@cosmicdrift/kumiko-bundled-features/auth-mfa/testing";
+import {
+  configValuesTable,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createSessionCallbacks,
+  userSessionEntity,
+} from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
+import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createTestEnvelopeCipher, deleteRows } from "@cosmicdrift/kumiko-framework/testing";
+import { composeFeatures } from "../compose-features";
+
+const CHALLENGE_TOKEN_SECRET = "test-mfa-challenge-secret-at-least-32-bytes!!";
+const SETUP_TOKEN_SECRET = "test-mfa-setup-secret-at-least-32-bytes-long!!";
+const TEST_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
+const systemAdmin = TestUsers.systemAdmin;
+
+async function bootStack(): Promise<TestStack> {
+  configureEntityFieldEncryption(createTestEnvelopeCipher());
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    challengeTokenSecret: CHALLENGE_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+  });
+
+  // Exactly what runProdApp/runDevApp do: composeFeatures sees auth-mfa in
+  // the app-feature list and threads mfaStatusChecker into the bundled
+  // auth-email-password feature's login handler on its own — no authOptions
+  // override needed here, which is the thing this test proves.
+  const features = composeFeatures([mfaFeature], { includeBundled: true });
+
+  const stack = await setupTestStack({
+    features,
+    extraContext: () => ({ configResolver: createConfigResolver() }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      mfaVerifyHandler: AuthMfaHandlers.verify,
+    },
+  });
+
+  const sessionCallbacks = createSessionCallbacks({ db: stack.db });
+  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers);
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+
+  return stack;
+}
+
+async function seedUser(
+  stack: TestStack,
+  opts: { email: string; password: string; roles?: readonly string[] },
+): Promise<{ id: string }> {
+  const hash = await hashPassword(opts.password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    { email: opts.email, passwordHash: hash, displayName: opts.email.split("@")[0] ?? "user" },
+    systemAdmin,
+  );
+  await seedTenantMembership(stack.db, {
+    userId: created.id,
+    tenantId: TEST_TENANT_ID,
+    roles: opts.roles ?? ["User"],
+  });
+  return { id: created.id };
+}
+
+describe("composeFeatures wiring — auth-mfa (kumiko-framework#266 Step 6)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await bootStack();
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(stack.db, userTable, {});
+    await deleteRows(stack.db, tenantMembershipsTable, {});
+  });
+
+  test("full login-with-MFA flow: password login → mfa-challenge → /auth/mfa/verify → session", async () => {
+    const user = await seedUser(stack, {
+      email: "alice@example.com",
+      password: "correct-password-1234",
+    });
+
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "alice@example.com" },
+      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
+    );
+
+    // Step 1: a correct password no longer mints a session directly — it
+    // hands back a challenge, proving composeFeatures actually wired
+    // mfaStatusChecker into the login handler (without the wiring this
+    // would 200 straight to a session and the test would fail below).
+    const loginRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: "alice@example.com",
+      password: "correct-password-1234",
+    });
+    expect(loginRes.status).toBe(200);
+    const loginBody = (await loginRes.json()) as {
+      isSuccess: boolean;
+      mfaRequired?: boolean;
+      challengeToken?: string;
+    };
+    expect(loginBody.mfaRequired).toBe(true);
+    expect(loginBody.challengeToken).toBeTruthy();
+    const challengeToken = loginBody.challengeToken;
+    if (!challengeToken) throw new Error("no challengeToken in login response");
+
+    // Step 2: completing the challenge over the REAL /api/auth/mfa/verify
+    // route (not a direct handler dispatch) mints the session.
+    const verifyRes = await stack.http.raw("POST", "/api/auth/mfa/verify", {
+      challengeToken,
+      code: currentTotpCode(secret),
+    });
+    expect(verifyRes.status).toBe(200);
+    const verifyBody = (await verifyRes.json()) as {
+      isSuccess: boolean;
+      token: string;
+      user: { id: string; tenantId: string };
+    };
+    expect(verifyBody.isSuccess).toBe(true);
+    expect(verifyBody.token).toBeTruthy();
+    expect(verifyBody.user.id).toBe(user.id);
+  });
+
+  test("a user without MFA enabled logs in with a straight session (no challenge)", async () => {
+    await seedUser(stack, { email: "bob@example.com", password: "any-password-1234" });
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "bob@example.com",
+      password: "any-password-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      mfaRequired?: boolean;
+      token?: string;
+    };
+    expect(body.mfaRequired).toBeUndefined();
+    expect(body.token).toBeTruthy();
+  });
+});
+
+async function setPolicy(stack: TestStack, policy: "optional" | "admins" | "all"): Promise<void> {
+  await stack.http.writeOk(
+    "config:write:set",
+    { key: mfaRequiredConfigHandle.name, value: policy },
+    { id: systemAdmin.id, tenantId: TEST_TENANT_ID, roles: ["SystemAdmin"] },
+  );
+}
+
+// Step 7: enforcement policy only matters for UNENROLLED users — an
+// enrolled user always gets a challenge regardless of policy (they opted
+// in themselves). ponytail (see auth-mfa's config.ts): "admins"/"all"
+// hard-block an unenrolled matching user with mfaSetupRequired — there is
+// no enrollment-during-login UI yet (PR3). By design for this backend step.
+describe("composeFeatures wiring — auth-mfa enforcement policy (kumiko-framework#266 Step 7)", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await bootStack();
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(stack.db, userTable, {});
+    await deleteRows(stack.db, tenantMembershipsTable, {});
+    await setPolicy(stack, "optional");
+  });
+
+  test("optional (default): unenrolled user still gets a straight session", async () => {
+    await seedUser(stack, { email: "carol@example.com", password: "any-password-1234" });
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "carol@example.com",
+      password: "any-password-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { mfaSetupRequired?: boolean; token?: string };
+    expect(body.mfaSetupRequired).toBeUndefined();
+    expect(body.token).toBeTruthy();
+  });
+
+  test("all: unenrolled user is blocked with mfaSetupRequired, no session/challenge", async () => {
+    await setPolicy(stack, "all");
+    await seedUser(stack, { email: "dave@example.com", password: "any-password-1234" });
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "dave@example.com",
+      password: "any-password-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      mfaSetupRequired?: boolean;
+      mfaRequired?: boolean;
+      token?: string;
+    };
+    expect(body.mfaSetupRequired).toBe(true);
+    expect(body.mfaRequired).toBeUndefined();
+    expect(body.token).toBeUndefined();
+  });
+
+  test("all: an already-enrolled user still gets a challenge, not a block", async () => {
+    await setPolicy(stack, "all");
+    const user = await seedUser(stack, {
+      email: "erin@example.com",
+      password: "any-password-1234",
+    });
+    const start = await stack.http.writeOk<{ setupToken: string; otpauthUri: string }>(
+      AuthMfaHandlers.enableStart,
+      { accountLabel: "erin@example.com" },
+      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
+    );
+    const secretParam = new URLSearchParams(start.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+    await stack.http.writeOk(
+      AuthMfaHandlers.enableConfirm,
+      { setupToken: start.setupToken, code: currentTotpCode(secret) },
+      { id: user.id, tenantId: TEST_TENANT_ID, roles: ["User"] },
+    );
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "erin@example.com",
+      password: "any-password-1234",
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { mfaSetupRequired?: boolean; mfaRequired?: boolean };
+    expect(body.mfaRequired).toBe(true);
+    expect(body.mfaSetupRequired).toBeUndefined();
+  });
+
+  test("admins: unenrolled admin is blocked, unenrolled non-admin logs in normally", async () => {
+    await setPolicy(stack, "admins");
+    await seedUser(stack, {
+      email: "frank-admin@example.com",
+      password: "any-password-1234",
+      roles: ["Admin"],
+    });
+    await seedUser(stack, { email: "gina-user@example.com", password: "any-password-1234" });
+
+    const adminRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: "frank-admin@example.com",
+      password: "any-password-1234",
+    });
+    const adminBody = (await adminRes.json()) as { mfaSetupRequired?: boolean };
+    expect(adminBody.mfaSetupRequired).toBe(true);
+
+    const userRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: "gina-user@example.com",
+      password: "any-password-1234",
+    });
+    const userBody = (await userRes.json()) as { mfaSetupRequired?: boolean; token?: string };
+    expect(userBody.mfaSetupRequired).toBeUndefined();
+    expect(userBody.token).toBeTruthy();
+  });
+});

package/src/__tests__/compose-features-wiring.integration.test.ts

@@ -0,0 +1,382 @@
+// Wrapper-spezifischer Integration-Test für composeFeatures + auth-routes-
+// Verdrahtung. Ergänzt password-reset.integration.ts (das das Feature
+// direkt instantiiert) — hier wird der EXAKTE Bootstrap-Pfad gefahren den
+// runProdApp / runDevApp produzieren:
+//
+//   composeFeatures([], { includeBundled: true, authOptions: {...} })
+//     → setupTestStack(features=..., authConfig=...)
+//     → POST /api/auth/request-password-reset
+//
+// Bug-Pattern den dieser Test pinst: composeFeatures.authOptions wird
+// NICHT an createAuthEmailPasswordFeature durchgereicht → routes mounten
+// (auth-routes-config tut das blind), aber die request-password-reset/
+// reset-password Handler fehlen im Feature → dispatcher kennt den
+// QualifiedName nicht → 5xx in Production. Whitebox-Variante in
+// compose-features.test.ts checkt nur Object.keys(writeHandlers); dieser
+// Test fährt den vollen HTTP-Roundtrip und kann den dispatch-error nicht
+// übersehen.
+//
+// Kein Mocking: setupTestStack bootet echte DB + Redis. reset/verify mailen
+// via delivery (ctx.notify → channel-email); der In-Memory-Transport fängt
+// die echte Mail ab — gewollter Capture ohne Mock-API (CLAUDE.md "Kein Mock
+// in *.integration.ts").
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import {
+  AuthErrors,
+  AuthHandlers,
+  hashPassword,
+} from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import {
+  createChannelEmailFeature,
+  createInMemoryTransport,
+} from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import {
+  configValuesTable,
+  createConfigResolver,
+} from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createDeliveryFeature,
+  createDeliveryTestContext,
+  notificationPreferencesTable,
+} from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/renderer-foundation";
+import {
+  createRendererSimpleFeature,
+  simpleRenderer,
+} from "@cosmicdrift/kumiko-bundled-features/renderer-simple";
+import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
+import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { deleteRows } from "@cosmicdrift/kumiko-framework/testing";
+import { composeFeatures } from "../compose-features";
+
+const RESET_HMAC = randomBytes(32).toString("base64");
+const VERIFY_HMAC = randomBytes(32).toString("base64");
+const APP_RESET_URL = "https://app.example.com/reset-password";
+const APP_VERIFY_URL = "https://app.example.com/verify-email";
+const TEST_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
+const systemAdmin = TestUsers.systemAdmin;
+
+// Pulls the magic-link out of the rendered mail HTML — the renderer-simple
+// button carries it as the only href. Replaces the old callback-captured
+// resetUrl now that reset/verify mail via delivery.
+function tokenUrlFromHtml(html: string): URL {
+  const match = html.match(/href="([^"]*\?token=[^"]*)"/);
+  if (!match?.[1]) throw new Error("no magic-link href in mail html");
+  return new URL(match[1]);
+}
+
+async function bootStack(
+  authOptionsKind: "with-both" | "with-reset-only" | "without-auth-options",
+): Promise<{ stack: TestStack; emailTransport: ReturnType<typeof createInMemoryTransport> }> {
+  const emailTransport = createInMemoryTransport();
+
+  // Genau das was runProdApp/runDevApp machen würde — composeFeatures als
+  // single-source der Feature-Liste. delivery + channel-email kommen als
+  // App-Features dazu, weil reset/verify ihre Mail via ctx.notify schicken.
+  const features = composeFeatures(
+    [
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+    ],
+    {
+      includeBundled: true,
+      ...(authOptionsKind !== "without-auth-options" && {
+        authOptions: {
+          passwordReset: { hmacSecret: RESET_HMAC, tokenTtlMinutes: 15, appUrl: APP_RESET_URL },
+          ...(authOptionsKind === "with-both" && {
+            emailVerification: {
+              hmacSecret: VERIFY_HMAC,
+              tokenTtlMinutes: 60,
+              mode: "off",
+              appUrl: APP_VERIFY_URL,
+            },
+          }),
+        },
+      }),
+    },
+  );
+
+  const stack = await setupTestStack({
+    features,
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
+    authConfig: {
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+      // Routes IMMER mounten — egal welche authOptionsKind. Genau das
+      // ist die Bug-Bedingung: Routes da, Handler eventuell nicht.
+      passwordReset: {
+        requestHandler: AuthHandlers.requestPasswordReset,
+        confirmHandler: AuthHandlers.resetPassword,
+      },
+      ...(authOptionsKind === "with-both" && {
+        emailVerification: {
+          requestHandler: AuthHandlers.requestEmailVerification,
+          confirmHandler: AuthHandlers.verifyEmail,
+        },
+      }),
+    },
+  });
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+
+  return { stack, emailTransport };
+}
+
+async function seedUser(
+  stack: TestStack,
+  opts: { email: string; password: string },
+): Promise<{ id: string }> {
+  const hash = await hashPassword(opts.password);
+  const created = await stack.http.writeOk<{ id: string }>(
+    UserHandlers.create,
+    {
+      email: opts.email,
+      passwordHash: hash,
+      displayName: opts.email.split("@")[0] ?? "user",
+    },
+    systemAdmin,
+  );
+  await seedTenantMembership(stack.db, {
+    userId: created.id,
+    tenantId: TEST_TENANT_ID,
+    roles: ["User"],
+  });
+  return { id: created.id };
+}
+
+describe("composeFeatures wiring — passwordReset", () => {
+  let suite: Awaited<ReturnType<typeof bootStack>>;
+
+  beforeAll(async () => {
+    suite = await bootStack("with-both");
+  });
+
+  afterAll(async () => {
+    await suite.stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
+    suite.emailTransport.sent.length = 0;
+  });
+
+  test("full reset roundtrip: request → email → reset → login with new password", async () => {
+    // Beweis: composeFeatures(authOptions.passwordReset) hat den Handler
+    // im Feature registriert UND auth-routes hat die /api/auth/...-Routes
+    // gemountet — der Wrapper-Pfad ist konsistent. password-reset.
+    // integration.ts beweist das gleiche für direkten Feature-Aufruf;
+    // dieser Test pinst dass der Wrapper das Pattern repliziert.
+    await seedUser(suite.stack, { email: "alice@example.com", password: "old-password-1234" });
+
+    const requestRes = await suite.stack.http.raw("POST", "/api/auth/request-password-reset", {
+      email: "alice@example.com",
+    });
+    expect(requestRes.status).toBe(200);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(sent.to).toBe("alice@example.com");
+
+    // Token aus der Mail-URL extrahieren — wie der echte User es täte (Mail
+    // klicken, Browser parsed query-string). Das pinst den vollen
+    // URL-zu-Handler-Roundtrip über delivery.
+    const resetUrl = tokenUrlFromHtml(sent.html);
+    expect(`${resetUrl.origin}${resetUrl.pathname}`).toBe(APP_RESET_URL);
+    const token = resetUrl.searchParams.get("token");
+    expect(token).toBeTruthy();
+    if (!token) return;
+
+    const resetRes = await suite.stack.http.raw("POST", "/api/auth/reset-password", {
+      token,
+      newPassword: "brand-new-pw-9876",
+    });
+    expect(resetRes.status).toBe(200);
+
+    // Confirmation: das neue Passwort funktioniert für /api/auth/login.
+    // Das ist der echte End-to-End-Beweis (DB-Read würde nur
+    // password_hash != old verifizieren — hier prüfen wir die User-
+    // visible Konsequenz).
+    const loginRes = await suite.stack.http.raw("POST", "/api/auth/login", {
+      email: "alice@example.com",
+      password: "brand-new-pw-9876",
+    });
+    expect(loginRes.status).toBe(200);
+  });
+
+  test("invalid token via wrapper-routes → 422 invalid_reset_token", async () => {
+    await seedUser(suite.stack, { email: "carol@example.com", password: "keep-me-1234" });
+
+    const res = await suite.stack.http.raw("POST", "/api/auth/reset-password", {
+      token: "tampered.totally.fake",
+      newPassword: "should-not-stick-1234",
+    });
+    expect(res.status).toBe(422);
+    const body = (await res.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.invalidResetToken);
+  });
+});
+
+describe("composeFeatures wiring — emailVerification", () => {
+  let suite: Awaited<ReturnType<typeof bootStack>>;
+
+  beforeAll(async () => {
+    suite = await bootStack("with-both");
+  });
+
+  afterAll(async () => {
+    await suite.stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
+    suite.emailTransport.sent.length = 0;
+  });
+
+  test("emailVerification authOption durchgereicht → request handler dispatched", async () => {
+    // Symmetric zum reset-Test — pinst dass authOptions.emailVerification
+    // genauso durchgereicht wird wie passwordReset. Bug-Pattern wäre dass
+    // der Wrapper EINS funktioniert, ANDERES vergisst.
+    await seedUser(suite.stack, { email: "bob@example.com", password: "any-pw-1234" });
+
+    const res = await suite.stack.http.raw("POST", "/api/auth/request-email-verification", {
+      email: "bob@example.com",
+    });
+    expect(res.status).toBe(200);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no verification email sent");
+    expect(sent.to).toBe("bob@example.com");
+    const verifyUrl = tokenUrlFromHtml(sent.html);
+    expect(`${verifyUrl.origin}${verifyUrl.pathname}`).toBe(APP_VERIFY_URL);
+    expect(verifyUrl.searchParams.get("token")).toBeTruthy();
+  });
+});
+
+describe("composeFeatures wiring — asymmetric activation", () => {
+  // Pinst dass passwordReset und emailVerification UNABHÄNGIG durchgereicht
+  // werden. Bug-Pattern: ein Refactor des Helpers könnte einen Block
+  // versehentlich an den anderen koppeln (z.B. emailVerification nur
+  // durchreichen wenn passwordReset auch gesetzt ist) — dann würde eine
+  // App die NUR Reset-Flow will plötzlich keine Reset-Mails mehr kriegen,
+  // oder eine die NUR Verify-Flow will keine Verify-Mails. Asymmetric-
+  // activation ist also ein eigenständiger Wrapper-Vertrag.
+
+  let suite: Awaited<ReturnType<typeof bootStack>>;
+
+  beforeAll(async () => {
+    suite = await bootStack("with-reset-only");
+  });
+
+  afterAll(async () => {
+    await suite.stack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
+    suite.emailTransport.sent.length = 0;
+  });
+
+  test("nur passwordReset gesetzt → reset-flow live, verify-flow fail-closed", async () => {
+    await seedUser(suite.stack, { email: "alice@example.com", password: "any-pw-1234" });
+
+    // Reset-flow funktioniert: Mail wird produziert.
+    const resetRes = await suite.stack.http.raw("POST", "/api/auth/request-password-reset", {
+      email: "alice@example.com",
+    });
+    expect(resetRes.status).toBe(200);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+
+    // Verify-Routes sind in dieser bootStack-Variante NICHT gemounted
+    // (authConfig.emailVerification fehlt). Der Endpoint existiert also
+    // gar nicht — Hono returnt 404. Unterscheidet sich vom 200-silent-
+    // success-Pfad: hier ist die ROUTE selbst nicht da. Kein zweites Mail.
+    const verifyRes = await suite.stack.http.raw("POST", "/api/auth/request-email-verification", {
+      email: "alice@example.com",
+    });
+    expect(verifyRes.status).toBe(404);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+  });
+});
+
+describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
+  // Der Bug den der Review-Agent gefangen hat. Whitebox-Variante in
+  // compose-features.test.ts checkt nur Object.keys(writeHandlers); hier
+  // pinst der Test das User-visible Verhalten: WENN user existiert + POST
+  // request-password-reset gefeuert wird, MUSS der Wrapper-Pfad eine Mail
+  // produzieren. Tut er das nicht, ist der composeFeatures-authOptions-
+  // Bug zurück.
+  //
+  // Subtilität: auth-routes mountet die request-Route by-design als
+  // enumeration-safe (always-200, silently swallow handler-Failures —
+  // siehe registerTokenRequestRoute in auth-routes.ts). Ein fehlender
+  // Handler endet daher nicht in 4xx/5xx, sondern silent in "200 + 0
+  // mails". Genau das pinnt dieser Test gegen die Regression: ohne
+  // resetEmails-Capture als Counter-Evidence wäre der Bug unsichtbar.
+
+  let suite: Awaited<ReturnType<typeof bootStack>>;
+
+  beforeAll(async () => {
+    suite = await bootStack("without-auth-options");
+  });
+
+  afterAll(async () => {
+    await suite.stack.cleanup();
+  });
+
+  afterEach(async () => {
+    await deleteRows(suite.stack.db, userTable, {});
+    await deleteRows(suite.stack.db, tenantMembershipsTable, {});
+    suite.emailTransport.sent.length = 0;
+  });
+
+  test("authOptions fehlt → POST returnt enumeration-safe 200, ABER NULL Mails (der echte Bug-Beweis)", async () => {
+    // User EXISTIERT — das pinst dass die fehlende Mail auf dem
+    // composeFeatures-bug beruht, nicht auf "user not found"
+    // (welcher legitim 0 mails produziert: enumeration-safety).
+    await seedUser(suite.stack, { email: "noop@example.com", password: "any-pw-1234" });
+
+    const res = await suite.stack.http.raw("POST", "/api/auth/request-password-reset", {
+      email: "noop@example.com",
+    });
+
+    // 200 ist by-design (registerTokenRequestRoute swallowt handler-
+    // Failures). Bug-Beweis ist die fehlende Mail — wenn der "with-both"-
+    // Test 1 Mail bekommt und dieser Test 0 bekommt für denselben
+    // existierenden User, ist die Differenz EXAKT der composeFeatures-
+    // Bug. Diese Asymmetrie zwischen den beiden describe-Blöcken IST
+    // der Test.
+    expect(res.status).toBe(200);
+    expect(suite.emailTransport.sent).toHaveLength(0);
+  });
+});