@cosmicdrift/kumiko-server-runtime 0.160.0 → 0.162.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.160.0",
+  "version": "0.162.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.160.0",
-    "@cosmicdrift/kumiko-framework": "0.160.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.162.0",
+    "@cosmicdrift/kumiko-framework": "0.162.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/run-prod-app.integration.test.ts

@@ -823,7 +823,12 @@ describe("runProdApp — auth allowedOrigins forwarding", () => {
   test("cookieDomain without allowedOrigins fails closed — guard is wired through runProdApp", async () => {
     await expect(
       boot(undefined, {
-        auth: { admin: ADMIN, cookieDomain: "example.eu", sessions: false },
+        features: [
+          authFoundationFeature,
+          createPersonalAccessTokensFeature({ scopes: {} }),
+          createSessionsFeature(),
+        ],
+        auth: { admin: ADMIN, cookieDomain: "example.eu" },
         allowPlaintextPii: "test: origin-guard focus, not crypto",
       }),
     ).rejects.toThrow(/allowedOrigins is empty/);
@@ -836,11 +841,15 @@ describe("runProdApp — auth allowedOrigins forwarding", () => {
     let bootError: unknown;
     try {
       const handle = await boot(undefined, {
+        features: [
+          authFoundationFeature,
+          createPersonalAccessTokensFeature({ scopes: {} }),
+          createSessionsFeature(),
+        ],
         auth: {
           admin: ADMIN,
           cookieDomain: "example.eu",
           allowedOrigins: ["https://app.example.eu"],
-          sessions: false,
         },
       });
       expect(handle).toBeDefined();
@@ -861,7 +870,7 @@ describe("runProdApp — session boot gate (#1262/#1275)", () => {
     memberships: [],
   };
 
-  test("auth mounted, sessions feature missing, no opt-out → aborts boot", async () => {
+  test("auth mounted, sessions feature missing → aborts boot", async () => {
     await expect(
       boot(undefined, {
         auth: {
@@ -871,7 +880,7 @@ describe("runProdApp — session boot gate (#1262/#1275)", () => {
         },
         allowPlaintextPii: "test: session-gate focus, not crypto",
       }),
-    ).rejects.toThrow(/BOOT ABORTED.*sessions.*stateless/s);
+    ).rejects.toThrow(/BOOT ABORTED.*sessionStore/);
   });
 
   test("auth mounted, sessions feature mounted → boots cleanly (the happy path the gate guards)", async () => {

package/src/__tests__/session-boot-gate.test.ts

@@ -1,54 +1,22 @@
 import { describe, expect, test } from "bun:test";
 import { assertSessionBootInvariants } from "../session-boot-gate";
 
-describe("assertSessionBootInvariants", () => {
-  test("no auth mounted → nothing to gate", () => {
+describe("assertSessionBootInvariants (#1372)", () => {
+  test("no auth → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: false,
-        sessionsFeatureMounted: false,
-        sessionsOption: undefined,
-      }),
+      assertSessionBootInvariants({ hasAuth: false, sessionStoreProviderMounted: false }),
     ).not.toThrow();
   });
 
-  test("auth mounted, sessions feature missing, no opt-out → aborts boot", () => {
+  test("auth + sessionStore → no throw", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: false,
-        sessionsOption: undefined,
-      }),
-    ).toThrow(/BOOT ABORTED.*sessions.*stateless/s);
-  });
-
-  test("auth mounted, sessions feature missing, explicit sessions:false → boots", () => {
-    expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: false,
-        sessionsOption: false,
-      }),
-    ).not.toThrow();
-  });
-
-  test("auth mounted, sessions feature wired → boots", () => {
-    expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: true,
-        sessionsOption: undefined,
-      }),
+      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: true }),
     ).not.toThrow();
   });
 
-  test("auth mounted, sessions feature wired AND an expiresInMs override → boots", () => {
+  test("auth without sessionStore → throws", () => {
     expect(() =>
-      assertSessionBootInvariants({
-        hasAuth: true,
-        sessionsFeatureMounted: true,
-        sessionsOption: { expiresInMs: 60_000 },
-      }),
-    ).not.toThrow();
+      assertSessionBootInvariants({ hasAuth: true, sessionStoreProviderMounted: false }),
+    ).toThrow(/BOOT ABORTED/);
   });
 });

package/src/__tests__/session-wiring.test.ts

@@ -1,51 +1,16 @@
 import { describe, expect, it } from "bun:test";
-import {
-  createSessionsFeature,
-  SESSIONS_FEATURE,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
-import { resolveProdSessionsConfig, shouldWireProdSessions } from "../session-wiring";
+import { shouldWireProdSessions } from "../session-wiring";
 
-describe("shouldWireProdSessions — secure-by-default with opt-out (KF-1)", () => {
-  it("wires sessions when the feature is mounted, even without an explicit config", () => {
-    // The publicstatus bug: sessions feature mounted + auth set, but no auth.sessions —
-    // previously left stateless (no revocation). Now it wires automatically.
-    expect(shouldWireProdSessions(true, true, undefined)).toBe(true);
+describe("shouldWireProdSessions — secure-by-default (#1372)", () => {
+  it("wires when auth + sessionStore provider mounted", () => {
+    expect(shouldWireProdSessions(true, true)).toBe(true);
   });
 
-  it("wires sessions when a config object is given", () => {
-    expect(shouldWireProdSessions(true, true, { expiresInMs: 1000 })).toBe(true);
+  it("does not wire without auth", () => {
+    expect(shouldWireProdSessions(false, true)).toBe(false);
   });
 
-  it("does not wire when sessions: false (explicit opt-out)", () => {
-    expect(shouldWireProdSessions(true, true, false)).toBe(false);
-  });
-
-  it("does not wire when the sessions feature is not mounted", () => {
-    expect(shouldWireProdSessions(true, false, undefined)).toBe(false);
-  });
-
-  it("does not wire when the app has no auth at all", () => {
-    expect(shouldWireProdSessions(false, true, undefined)).toBe(false);
-  });
-});
-
-describe("SESSIONS_FEATURE constant matches the real feature name", () => {
-  it("createSessionsFeature()'s name equals SESSIONS_FEATURE", () => {
-    // shouldWireProdSessions's own arm only tests the pure boolean helper —
-    // the actual run-prod-app.ts integration seam
-    // (`features.some((f) => f.name === SESSIONS_FEATURE)`) drifts silently
-    // if the feature is ever renamed without updating this constant.
-    expect(createSessionsFeature().name).toBe(SESSIONS_FEATURE);
-  });
-});
-
-describe("resolveProdSessionsConfig", () => {
-  it("passes a config object through", () => {
-    expect(resolveProdSessionsConfig({ expiresInMs: 5000 })).toEqual({ expiresInMs: 5000 });
-  });
-
-  it("collapses false / undefined to defaults", () => {
-    expect(resolveProdSessionsConfig(undefined)).toEqual({});
-    expect(resolveProdSessionsConfig(false)).toEqual({});
+  it("does not wire without sessionStore provider", () => {
+    expect(shouldWireProdSessions(true, false)).toBe(false);
   });
 });

package/src/run-prod-app-boot-context.ts

@@ -1,4 +1,5 @@
 import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { bindMfaRevokeAllOtherSessionsFromFeature } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import {
@@ -15,10 +16,7 @@ import {
   createSecretsContext,
   SECRETS_FEATURE_NAME,
 } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import {
-  bindAutoRevokeFromFeature,
-  createSessionCallbacks,
-} from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { bindAutoRevokeFromFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
 import { createTextContentApi } from "@cosmicdrift/kumiko-bundled-features/text-content";
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { KmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
@@ -38,7 +36,6 @@ import type {
   PasswordResetSetup,
   SignupSetup,
 } from "./run-prod-app";
-import type { ProdSessionsConfig } from "./session-wiring";
 
 // Boot-time context helpers for runProdApp: ctx-extra-context wiring
 // (textContent/delivery/secrets/config-resolver), auth-mail convenience
@@ -214,33 +211,27 @@ export function resolveAuthMail<T extends AuthMailNormalizable>(
   };
 }
 
-export function buildProdSessionAuth(
+export async function buildProdSessionAuth(
   db: DbConnection,
-  opts: ProdSessionsConfig,
+  registry: Registry,
   sessionsFeature: FeatureDefinition | undefined,
   mfaFeature: FeatureDefinition | undefined,
-): {
-  readonly sessionCreator: ReturnType<typeof createSessionCallbacks>["sessionCreator"];
-  readonly sessionRevoker: ReturnType<typeof createSessionCallbacks>["sessionRevoker"];
-  readonly sessionChecker: ReturnType<typeof createSessionCallbacks>["sessionChecker"];
-} {
-  const cbs = createSessionCallbacks({
-    db,
-    ...(opts.expiresInMs !== undefined && { expiresInMs: opts.expiresInMs }),
-  });
-  // Secure-by-default: password-change/-reset mass-revokes the user's live
-  // sessions without the app opting in via autoRevokeOnPasswordChange.
+): Promise<{
+  readonly sessionCreator: Awaited<ReturnType<typeof resolveSessionStore>>["creator"];
+  readonly sessionRevoker: Awaited<ReturnType<typeof resolveSessionStore>>["revoker"];
+  readonly sessionChecker: Awaited<ReturnType<typeof resolveSessionStore>>["checker"];
+}> {
+  // Resolve the sessions feature sessionStore provider (#1372).
+  const store = await resolveSessionStore({ db, registry });
   if (sessionsFeature) {
-    bindAutoRevokeFromFeature(sessionsFeature)?.(cbs.sessionMassRevoker);
+    bindAutoRevokeFromFeature(sessionsFeature)?.(store.massRevoker);
   }
-  // MFA enable/disable/regenerate mass-revokes every OTHER live session
-  // (stolen-session defense) — only wired when auth-mfa is mounted.
   if (mfaFeature) {
-    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(cbs.sessionRevokeAllOthers);
+    bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
   }
   return {
-    sessionCreator: cbs.sessionCreator,
-    sessionRevoker: cbs.sessionRevoker,
-    sessionChecker: cbs.sessionChecker,
+    sessionCreator: store.creator,
+    sessionRevoker: store.revoker,
+    sessionChecker: store.checker,
   };
 }

package/src/run-prod-app.ts

@@ -46,7 +46,9 @@ import {
   seedAdmin,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/seeding";
 import {
+  EXT_SESSION_STORE,
   EXT_TOKEN_VERIFIER,
+  resolveAnonymousAccessFromRegistry,
   resolveTokenVerifier,
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { AUTH_MFA_FEATURE, AuthMfaHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
@@ -140,11 +142,7 @@ import {
 import { buildStaticFallback } from "./run-prod-app-static-files";
 import { type SecurityHeadersOption, withSecurityHeaders } from "./security-headers";
 import { assertSessionBootInvariants } from "./session-boot-gate";
-import {
-  type ProdSessionsOption,
-  resolveProdSessionsConfig,
-  shouldWireProdSessions,
-} from "./session-wiring";
+import { shouldWireProdSessions } from "./session-wiring";
 
 export { buildBunServeOptions } from "./bun-serve-options";
 export {
@@ -287,14 +285,6 @@ export type RunProdAppAuthOptions = {
   readonly admin: SeedAdminOptions;
   /** Optional override of the login error → HTTP status map. */
   readonly loginErrorStatusMap?: Readonly<Record<string, number>>;
-  /** Opt-in: revocable server-side sessions. Caller MUSS
-   *  `createSessionsFeature()` zu `features` adden — runProdApp wired
-   *  hier nur die Auth-Callbacks (creator/revoker/checker) gegen die
-   *  echte db-connection (sidless JWTs werden dann abgelehnt).
-   *
-   *  Standardverhalten ohne diese Option: stateless JWTs ohne sid
-   *  (legacy-Verhalten, Karten­haus existing-Apps unangefasst). */
-  readonly sessions?: ProdSessionsOption;
   /** Auth-Mail-Convenience: verdrahtet alle 4 Mail-Flows (passwordReset,
    *  emailVerification, signup, invite) aus `auth.mail.baseUrl` + Standard-
    *  Pfaden. Alle vier mailen via delivery (ctx.notify) — ersetzt das per-App
@@ -368,10 +358,8 @@ export type RunProdAppDeps = {
 };
 
 export type AnonymousAccessOption =
-  | import("@cosmicdrift/kumiko-framework/api").ServerOptions["anonymousAccess"]
-  | ((
-      deps: RunProdAppDeps,
-    ) => import("@cosmicdrift/kumiko-framework/api").ServerOptions["anonymousAccess"]);
+  | import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig
+  | ((deps: RunProdAppDeps) => import("@cosmicdrift/kumiko-framework/api").AnonymousAccessConfig);
 
 export type ExtraContextOption =
   | Record<string, unknown>
@@ -726,12 +714,11 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     mode: "prod",
   });
   const sessionsFeature = features.find((f) => f.name === SESSIONS_FEATURE);
+  const registry = createRegistry(features);
   assertSessionBootInvariants({
     hasAuth: Boolean(effectiveAuth),
-    sessionsFeatureMounted: sessionsFeature !== undefined,
-    sessionsOption: effectiveAuth?.sessions,
+    sessionStoreProviderMounted: registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
   });
-  const registry = createRegistry(features);
 
   // C1 boot-mode exit: validators ran + registry built; no DB/Redis client
   // is constructed at all in this branch (the eager `new Redis(...)` below
@@ -861,10 +848,15 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     { ...autoExtraContext, ...resolvedExtraContext },
     registry,
   );
-  const resolvedAnonymousAccess =
+  const baseAnonymousAccess =
     typeof options.anonymousAccess === "function"
       ? options.anonymousAccess(deps)
       : options.anonymousAccess;
+  // #1374: tenantResolver / tenantExists come from auth-foundation providers.
+  const resolvedAnonymousAccess = await resolveAnonymousAccessFromRegistry(baseAnonymousAccess, {
+    db,
+    registry,
+  });
 
   // Sessions opt-in: db ist hier schon konkret (createDbConnection oben),
   // also direkt verdrahten — kein late-bound nötig wie bei runDevApp.
@@ -874,22 +866,13 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // AuthRoutesConfig-Surface — der geht via bindAutoRevokeFromFeature ans
   // sessions-Feature (Password-Change/-Reset revoked alle Sessions), nicht
   // über die auth-routes.
-  // Secure-by-default: if the sessions feature is mounted, server-side revocation +
-  // auto-revoke-on-password-change are wired automatically;
-  // `auth.sessions` only overrides the config, and `auth.sessions: false` is the
-  // explicit opt-out (back to stateless JWTs).
+  // Secure-by-default (#1372): sessionStore provider → resolveSessionStore.
   const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
-    sessionsFeature !== undefined,
-    effectiveAuth?.sessions,
+    registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
   )
-    ? buildProdSessionAuth(
-        db,
-        resolveProdSessionsConfig(effectiveAuth?.sessions),
-        sessionsFeature,
-        mfaFeature,
-      )
+    ? await buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature)
     : undefined;
 
   // Token-verifier opt-in: any provider feature (personal-access-tokens, a
@@ -975,12 +958,20 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
         ...tenantLifecycleAuthFragment,
         ...(mfaFeature && {
           mfaVerifyHandler: AuthMfaHandlers.verify,
+          mfaPreauthEnableStartHandler: AuthMfaHandlers.enableStartPreauth,
+          mfaPreauthConfirmHandler: AuthMfaHandlers.enableConfirmPreauth,
           mfaVerifyRateLimit: createRedisLoginRateLimiter(
             redis,
             undefined,
             undefined,
             "mfa-verify",
           ),
+          mfaPreauthConfirmRateLimit: createRedisLoginRateLimiter(
+            redis,
+            undefined,
+            undefined,
+            "mfa-preauth-confirm",
+          ),
         }),
         ...(effectiveAuth.passwordReset && {
           passwordReset: {

package/src/session-boot-gate.ts

@@ -1,29 +1,20 @@
-import type { ProdSessionsOption } from "./session-wiring";
-
 export type SessionBootGateOptions = {
   readonly hasAuth: boolean;
-  readonly sessionsFeatureMounted: boolean;
-  readonly sessionsOption: ProdSessionsOption | undefined;
+  readonly sessionStoreProviderMounted: boolean;
 };
 
-// Mirrors pii-boot-gate.ts: catch a forgotten wiring at boot instead of
-// letting it degrade silently into stateless JWTs (no server-side
-// revocation, valid for the full 24h token TTL). `auth.sessions: false` is
-// already the sanctioned opt-out (see session-wiring.ts) — reusing it here
-// instead of inventing a second acknowledgment param.
+// Catch a forgotten sessions mount at boot instead of silently degrading
+// into stateless JWTs (#1372). Mount createSessionsFeature() for revocable
+// sessions; there is no auth.sessions opt-out anymore.
 export function assertSessionBootInvariants(opts: SessionBootGateOptions): void {
   // skip: no auth mounted — nothing to gate.
   if (!opts.hasAuth) return;
-  // skip: explicit opt-out, operator acknowledged stateless JWTs.
-  if (opts.sessionsOption === false) return;
-  // skip: sessions feature is wired.
-  if (opts.sessionsFeatureMounted) return;
+  // skip: sessionStore provider is wired (sessions feature).
+  if (opts.sessionStoreProviderMounted) return;
 
   throw new Error(
-    "[runProdApp] BOOT ABORTED — auth is mounted but the `sessions` feature is not. " +
-      "JWTs would be stateless (no server-side revocation, valid until the 24h expiry) " +
-      "with no warning. Mount createSessionsFeature() " +
-      "(@cosmicdrift/kumiko-bundled-features/sessions) for revocable sessions, or pass " +
-      "{ auth: { sessions: false } } to acknowledge stateless JWTs are intentional.",
+    "[runProdApp] BOOT ABORTED — auth is mounted but no sessionStore provider is registered. " +
+      "JWTs would be stateless (no server-side revocation). Mount createSessionsFeature() " +
+      "(@cosmicdrift/kumiko-bundled-features/sessions) alongside auth-foundation.",
   );
 }

package/src/session-wiring.ts

@@ -2,28 +2,16 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default: mounting the `sessions` feature turns server-side session
- * revocation ON automatically — there is no separate opt-in. The
- * `auth.sessions` option only overrides the config, and `auth.sessions: false` is the
- * explicit opt-out (back to stateless JWTs).
+ * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * turns server-side session revocation ON automatically. There is no
+ * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
+ * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged
+ * via a future flag if needed; today auth without sessions fails the gate).
  */
 
-export type ProdSessionsConfig = { readonly expiresInMs?: number };
-
-/** Config object to override defaults, or `false` to disable session wiring entirely. */
-export type ProdSessionsOption = ProdSessionsConfig | false;
-
 export function shouldWireProdSessions(
   hasAuth: boolean,
-  sessionsFeatureMounted: boolean,
-  sessionsOption: ProdSessionsOption | undefined,
+  sessionStoreProviderMounted: boolean,
 ): boolean {
-  return hasAuth && sessionsFeatureMounted && sessionsOption !== false;
-}
-
-/** The config passed to buildProdSessionAuth — `false`/absent collapse to defaults. */
-export function resolveProdSessionsConfig(
-  sessionsOption: ProdSessionsOption | undefined,
-): ProdSessionsConfig {
-  return sessionsOption || {};
+  return hasAuth && sessionStoreProviderMounted;
 }