@cosmicdrift/kumiko-server-runtime 0.200.1 → 0.202.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-server-runtime",
-  "version": "0.200.1",
+  "version": "0.202.0",
   "description": "Production server-boot runtime for Kumiko apps: connections, schema-drift-gate, seeds, lifecycle, graceful shutdown. Symmetric to kumiko-dev-server's runDevApp, without dev/scaffold/codegen tooling.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -80,8 +80,8 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.200.1",
-    "@cosmicdrift/kumiko-framework": "0.200.1",
+    "@cosmicdrift/kumiko-bundled-features": "0.202.0",
+    "@cosmicdrift/kumiko-framework": "0.202.0",
     "temporal-polyfill": "^0.3.2"
   },
   "publishConfig": {

package/src/run-prod-app-boot-context.ts

@@ -1,6 +1,9 @@
 import { makeAuthPaths } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
 import { resolveSessionStore } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
-import { bindMfaRevokeAllOtherSessionsFromFeature } from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
+import {
+  bindMfaRevokeAllOtherSessionsFromFeature,
+  bindRevokeAllPatTokensFromFeature,
+} from "@cosmicdrift/kumiko-bundled-features/auth-mfa";
 import { createSmtpTransportFromEnv } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import {
   buildEnvConfigOverrides,
@@ -12,6 +15,10 @@ import {
   createDeliveryService,
   DELIVERY_FEATURE,
 } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import {
+  bindPatAutoRevokeOnPasswordChangeFromFeature,
+  revokeAllPatTokensForUser,
+} from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
 import {
   createSecretsContext,
   SECRETS_FEATURE_NAME,
@@ -215,6 +222,7 @@ export async function buildProdSessionAuth(
   registry: Registry,
   sessionsFeature: FeatureDefinition | undefined,
   mfaFeature: FeatureDefinition | undefined,
+  patFeature: FeatureDefinition | undefined,
 ): Promise<{
   readonly sessionCreator: Awaited<ReturnType<typeof resolveSessionStore>>["creator"];
   readonly sessionRevoker: Awaited<ReturnType<typeof resolveSessionStore>>["revoker"];
@@ -228,9 +236,26 @@ export async function buildProdSessionAuth(
   if (mfaFeature) {
     bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(store.revokeAllOthers);
   }
+  if (mfaFeature && patFeature) {
+    bindRevokeAllPatTokensFromFeature(mfaFeature)?.((userId) =>
+      revokeAllPatTokensForUser(db, userId),
+    );
+  }
   return {
     sessionCreator: store.creator,
     sessionRevoker: store.revoker,
     sessionChecker: store.checker,
   };
 }
+
+// Password-change → PAT-revoke, independent of sessions/MFA being mounted
+// (unlike buildProdSessionAuth, which only runs when a sessionStore provider
+// is registered). Call unconditionally whenever personal-access-tokens is
+// mounted — a no-op if it isn't (bindPatAutoRevokeOnPasswordChangeFromFeature
+// returns undefined for an unmounted feature.exports shape, but callers
+// should still gate on patFeature being defined at all).
+export function wireProdPatAutoRevoke(db: DbConnection, patFeature: FeatureDefinition): void {
+  bindPatAutoRevokeOnPasswordChangeFromFeature(patFeature)?.((userId) =>
+    revokeAllPatTokensForUser(db, userId),
+  );
+}

package/src/run-prod-app.ts

@@ -148,6 +148,7 @@ import {
   buildBootExtraContext,
   buildProdSessionAuth,
   resolveAuthMail,
+  wireProdPatAutoRevoke,
 } from "./run-prod-app-boot-context";
 import { buildStaticFallback } from "./run-prod-app-static-files";
 import { type SecurityHeadersOption, withSecurityHeaders } from "./security-headers";
@@ -955,20 +956,30 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
   // über die auth-routes.
   // Secure-by-default (#1372): sessionStore provider → resolveSessionStore.
   const mfaFeature = features.find((f) => f.name === AUTH_MFA_FEATURE);
+  // Hoisted above buildProdSessionAuth: that call also wires MFA-enable/
+  // disable → PAT-revoke (bindRevokeAllPatTokensFromFeature), so it needs
+  // patFeature too.
+  const patFeature = features.find((f) => f.name === PAT_FEATURE);
   const sessionAuthFragment = shouldWireProdSessions(
     Boolean(effectiveAuth),
     registry.getExtensionUsages(EXT_SESSION_STORE).length > 0,
   )
-    ? await buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature)
+    ? await buildProdSessionAuth(db, registry, sessionsFeature, mfaFeature, patFeature)
     : undefined;
 
+  // Password-change → PAT-revoke: independent of sessions/MFA being mounted
+  // (buildProdSessionAuth only runs when a sessionStore provider is
+  // registered), so wired unconditionally here whenever PAT itself is.
+  if (patFeature) {
+    wireProdPatAutoRevoke(db, patFeature);
+  }
+
   // Token-verifier opt-in: any provider feature (personal-access-tokens, a
   // future auth-provider-jwt, ...) self-registers via
   // r.useExtension(EXT_TOKEN_VERIFIER, ...) — wire one generic resolver
   // whenever at least one is mounted, resolved by shape at request-time.
   // PAT keeps its own per-token rate limiter (patRateLimiter), unrelated to
   // verification.
-  const patFeature = features.find((f) => f.name === PAT_FEATURE);
   const hasTokenVerifierProviders = registry.getExtensionUsages(EXT_TOKEN_VERIFIER).length > 0;
   let patAuthFragment:
     | {