@cosmicdrift/kumiko-server-runtime 0.166.0 → 0.167.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.166.0",
+  "version": "0.167.1",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -72,8 +72,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.166.0",
-    "@cosmicdrift/kumiko-framework": "0.166.0",
+    "@cosmicdrift/kumiko-bundled-features": "0.167.1",
+    "@cosmicdrift/kumiko-framework": "0.167.1",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/__tests__/compose-features-wiring.integration.test.ts

@@ -329,6 +329,75 @@ describe("composeFeatures wiring — asymmetric activation", () => {
   });
 });
 
+describe("composeFeatures wiring — accountLockout (kumiko-framework#1627)", () => {
+  // Pinst dass authOptions.accountLockout genauso durchgereicht wird wie
+  // passwordReset/emailVerification — der Bug-Fall war, dass runDevApp die
+  // Option gar nicht erst annahm (kein Feld auf RunDevAppAuthOptions) und
+  // buildComposeAuthOptions sie ignoriert hätte, selbst wenn doch. Anders als
+  // reset/verify mountet accountLockout keine eigenen Routes — der Beweis
+  // ist Login-Verhalten, kein Mail-Capture.
+  let stack: TestStack;
+  const MAX_ATTEMPTS = 2;
+
+  beforeAll(async () => {
+    const features = composeFeatures([], {
+      includeBundled: true,
+      authOptions: {
+        accountLockout: { maxFailedAttempts: MAX_ATTEMPTS, lockoutDurationMinutes: 1 },
+      },
+    });
+    stack = await setupTestStack({
+      features,
+      extraContext: { configResolver: createConfigResolver() },
+      authConfig: {
+        membershipQuery: "tenant:query:memberships",
+        loginHandler: AuthHandlers.login,
+        loginErrorStatusMap: {
+          [AuthErrors.invalidCredentials]: 401,
+          [AuthErrors.noMembership]: 403,
+          [AuthErrors.accountLocked]: 423,
+        },
+      },
+    });
+    await unsafeCreateEntityTable(stack.db, userEntity);
+    await unsafeCreateEntityTable(stack.db, tenantEntity);
+    await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  afterEach(async () => {
+    await deleteRows(stack.db, userTable, {});
+    await deleteRows(stack.db, tenantMembershipsTable, {});
+    await stack.redis.flushNamespace();
+  });
+
+  test("MAX_ATTEMPTS wrong passwords via the wrapper path lock the account (423)", async () => {
+    await seedUser(stack, { email: "lockout@example.com", password: "right-pw-1234" });
+
+    for (let i = 0; i < MAX_ATTEMPTS; i++) {
+      const res = await stack.http.raw("POST", "/api/auth/login", {
+        email: "lockout@example.com",
+        password: `wrong-${i}`,
+      });
+      expect(res.status).toBe(401);
+    }
+
+    // Correct password no longer helps once locked — proves the option
+    // actually reached createLoginHandler's accountLockout param, not just
+    // the type.
+    const lockedRes = await stack.http.raw("POST", "/api/auth/login", {
+      email: "lockout@example.com",
+      password: "right-pw-1234",
+    });
+    expect(lockedRes.status).toBe(423);
+    const body = (await lockedRes.json()) as { error?: { details?: { reason?: string } } };
+    expect(body.error?.details?.reason).toBe(AuthErrors.accountLocked);
+  });
+});
+
 describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
   // Der Bug den der Review-Agent gefangen hat. Whitebox-Variante in
   // compose-features.test.ts checkt nur Object.keys(writeHandlers); hier

package/src/compose-features.ts

@@ -14,6 +14,7 @@
 // ones (e.g. authClaims hooks on user/tenant).
 
 import {
+  type AccountLockoutOptions,
   type AccountUnlockOptions,
   type AuthEmailPasswordOptions,
   type AuthMailLocale,
@@ -116,6 +117,7 @@ export type AuthOptionsCarrier = {
   readonly signup?: SignupOptions;
   readonly invite?: InviteOptions;
   readonly accountUnlock?: AccountUnlockOptions;
+  readonly accountLockout?: AccountLockoutOptions;
 };
 
 /** Baut den authOptions-Block für composeFeatures aus einem
@@ -178,11 +180,12 @@ export function buildComposeAuthOptions(
       ...pickMailFields(auth.accountUnlock),
     };
   }
-  return opts.passwordReset ||
-    opts.emailVerification ||
-    opts.signup ||
-    opts.invite ||
-    opts.accountUnlock
-    ? opts
-    : undefined;
+  if (auth.accountLockout) {
+    opts.accountLockout = auth.accountLockout;
+  }
+  return hasAnyAuthFlow(opts) ? opts : undefined;
+}
+
+function hasAnyAuthFlow(opts: AuthEmailPasswordOptions): boolean {
+  return Object.values(opts).some(Boolean);
 }

package/src/run-prod-app-boot-context.ts

@@ -159,10 +159,9 @@ type AuthMailNormalizable = {
 
 // accountUnlock (#1266) deliberately does NOT join this convenience block —
 // unlike reset/verify/signup/invite it's only meaningful paired with
-// `accountLockout`, which itself isn't wired through RunProdAppAuthOptions
-// today. Apps that mount `accountLockout` set `auth.accountUnlock` alongside
-// it explicitly (same shape as `passwordReset`), so `mail` alone can't
-// silently expose a new public endpoint an app didn't ask for.
+// `accountLockout` (kumiko-framework#1627), and apps set both explicitly
+// alongside each other (same shape as `passwordReset`), so `mail` alone
+// can't silently expose a new public endpoint an app didn't ask for.
 
 export function resolveAuthMail<T extends AuthMailNormalizable>(
   auth: T,

package/src/run-prod-app.ts

@@ -40,6 +40,7 @@
 //   KUMIKO_INSTANCE_ID=<stable per replica>
 
 import {
+  type AccountLockoutOptions,
   type AccountUnlockOptions,
   AuthErrors,
   AuthHandlers,
@@ -270,6 +271,14 @@ export type InviteSetup = InviteOptions;
  *  independently like the other flows. */
 export type AccountUnlockSetup = AccountUnlockOptions;
 
+/** Wrapper API for the account-lockout brute-force guard on the login
+ *  handler. = AccountLockoutOptions (maxFailedAttempts, lockoutDurationMinutes
+ *  — no mail/appUrl fields, it doesn't mount any routes). Symmetric to
+ *  RunDevAppAuthOptions.accountLockout (kumiko-framework#1627) — before this,
+ *  `accountUnlock` existed on both wrappers with no way to ever set the
+ *  lockout it's meant to escape. */
+export type AccountLockoutSetup = AccountLockoutOptions;
+
 /** Auth-Mail-Convenience-Optionen — shared zwischen runProdApp + runDevApp.
  *  Verdrahtet alle 4 Mail-Flows aus einem env-SMTP-Transport + Standard-
  *  Templates (siehe `auth.mail` + resolveAuthMail). */
@@ -331,6 +340,11 @@ export type RunProdAppAuthOptions = {
    *  hatch for accountLockout's monotonic failure-counter — confirming
    *  clears the Redis lockout state, no entity write. */
   readonly accountUnlock?: AccountUnlockSetup;
+  /** Brute-force guard on the login handler (maxFailedAttempts,
+   *  lockoutDurationMinutes). Mounts no routes — unlike the other flows,
+   *  it's a login-handler config knob, not a magic-link flow. Pair with
+   *  `accountUnlock` for a self-service escape hatch. */
+  readonly accountLockout?: AccountLockoutSetup;
   /** Domain attribute for both auth cookies (see
    *  AuthRoutesConfig.cookieDomain). Set to the registrable parent
    *  domain when login and app live on different subdomains. */