hecks 5.0.0 → 7.0.0

data/rust/host/src/web.rs

@@ -9,13 +9,14 @@ use crate::extension::{self, Ctx};
 use crate::field_hints::{EMAIL_HINT, TEL_HINT, TEXTAREA_HINT, URL_HINT};
 use crate::host::Host;
 use crate::ir::ir;
-use crate::journal::LineageConfig;
 use crate::lambda_client::LambdaInvoker;
+use crate::platform_signin::jti::JtiStore;
+use crate::store::journal_sql::LineageConfig;
+use crate::store::Store;
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use std::path::Path;
-use tokio::sync::Mutex;
-use tokio_postgres::Client;
+use std::sync::OnceLock;
 
 mod commerce;
 mod newsletter;
@@ -23,9 +24,11 @@ mod newsletter_send;
 mod registration_receipt;
 mod registrations;
 mod resend_webhook;
+#[cfg(test)]
+mod signin_tests;
 
 pub use commerce::Commerce;
-use registrations::payments_routes;
+use registrations::{payments_routes, CheckoutRequest};
 // payments.rs, its tests and the boot check reach these through `web::`.
 pub use registrations::checkout_enabled;
 #[cfg(test)]
@@ -73,7 +76,7 @@ pub async fn render(body: &Value, host: Host<'_>) -> Option<Value> {
         raw_body: &raw_body,
         cookies: &cookies,
         domain_ir: ir(),
-        client: host.client,
+        store: host.store,
         wasm_path: host.wasm_path,
         config: host.config,
         invoker: host.invoker,
@@ -189,7 +192,7 @@ async fn route(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client, wasm_path, ..
+        store, wasm_path, ..
     } = host;
     let domain_name = domain_ir.get("name").and_then(|v| v.as_str()).unwrap_or("");
     let secret = session_secret();
@@ -259,7 +262,7 @@ async fn route(
     };
 
     if segments.len() == 2 {
-        return aggregate_index(domain_name, aggregate, &format, client, wasm_path).await;
+        return aggregate_index(domain_name, aggregate, &format, store, wasm_path).await;
     }
 
     if segments.len() == 3 {
@@ -276,6 +279,7 @@ async fn route(
                 method,
                 query,
                 raw_body,
+                crate::auth::caller(session.as_ref()),
                 host,
             )
             .await;
@@ -285,7 +289,7 @@ async fn route(
             aggregate,
             &verb_or_id,
             &format,
-            client,
+            store,
             wasm_path,
         )
         .await;
@@ -309,10 +313,9 @@ async fn auth_route(
     host: Host<'_>,
 ) -> Option<Value> {
     let Host {
-        client,
+        store,
         wasm_path,
         config,
-        invoker,
         ..
     } = host;
     let ctx = Ctx {
@@ -323,7 +326,7 @@ async fn auth_route(
         raw_body,
         cookies,
         domain_ir: Some(domain_ir),
-        client: host.client,
+        store: host.store,
         wasm_path: host.wasm_path,
         config: host.config,
         invoker: host.invoker,
@@ -341,10 +344,7 @@ async fn auth_route(
             &login_page(query.get("error").map(std::string::String::as_str)),
         )),
 
-        ("POST", "/logout") => Some(redirect_with_cookie(
-            "/login",
-            &format!("session=; Max-Age=0{}", cookie_flags()),
-        )),
+        ("POST", "/logout") => Some(logout_response()),
 
         // No password login: Google OAuth is the only sign-in path, and the
         // /accounts/* routes here are just the session-cookie family that
@@ -360,15 +360,15 @@ async fn auth_route(
             ),
         )),
 
-        ("GET", "/accounts/me") => {
-            Some(accounts_me_route(domain_ir, cookies, secret, client).await)
-        }
+        ("GET", "/accounts/me") => Some(accounts_me_route(domain_ir, cookies, secret, store).await),
+
+        ("POST", "/accounts/google-handoff") => Some(google_handoff_route(raw_body, secret)),
 
-        ("GET", "/members") => Some(members_route(domain_ir, cookies, secret, client).await),
+        ("GET", "/members") => Some(members_route(domain_ir, cookies, secret, store).await),
 
         ("POST", "/members") => Some(
             add_member_route(
-                domain_ir, raw_body, cookies, secret, client, wasm_path, config,
+                domain_ir, raw_body, cookies, secret, store, wasm_path, config,
             )
             .await,
         ),
@@ -376,46 +376,50 @@ async fn auth_route(
         ("POST", "/signups") => Some(signup_route(raw_body, secret, host).await),
 
         ("POST", "/members/disable") => Some(
-            set_member_disabled_route(domain_ir, raw_body, cookies, secret, client, config, true)
+            set_member_disabled_route(domain_ir, raw_body, cookies, secret, store, config, true)
                 .await,
         ),
 
         ("POST", "/members/enable") => Some(
-            set_member_disabled_route(domain_ir, raw_body, cookies, secret, client, config, false)
+            set_member_disabled_route(domain_ir, raw_body, cookies, secret, store, config, false)
                 .await,
         ),
 
         ("POST", "/members/role") => {
-            Some(set_member_role_route(domain_ir, raw_body, cookies, secret, client, config).await)
+            Some(set_member_role_route(domain_ir, raw_body, cookies, secret, store, config).await)
         }
 
         ("POST", "/members/delete") => Some(
-            set_member_deleted_route(domain_ir, raw_body, cookies, secret, client, config).await,
+            set_member_deleted_route(domain_ir, raw_body, cookies, secret, store, config).await,
         ),
 
         // cms/src/endpoints/sso.ts verifies this with the same account_token
         // wire format; deploy-aws/platform/template.yaml shares SessionSecret
         // with the cms container as AUTH_SECRET so both sides agree on it.
         ("GET", "/accounts/sso-token") => {
-            Some(accounts_sso_token_route(domain_ir, cookies, secret, client).await)
+            Some(accounts_sso_token_route(domain_ir, cookies, secret, store).await)
         }
 
-        ("GET", "/auth/google") => match auth::authorization_url(&redirect_uri(), secret) {
-            Ok(url) => Some(redirect(&url)),
-            Err(e) => Some(respond(
-                500,
-                "text/plain",
-                &format!("Google sign-in isn't configured: {e}"),
-            )),
-        },
+        ("GET", "/auth/google") => Some(google_start()),
 
-        ("GET", "/auth/google/callback") => Some(
-            google_callback(domain_ir, query, client, wasm_path, config, secret, invoker).await,
-        ),
+        // The sign-in cookie is cleared whatever the outcome: one cookie, one attempt.
+        ("GET", "/auth/google/callback") => {
+            let secure = secure_cookies();
+            let response = match google_signin_for(query, cookies, secure) {
+                Some(signin) => {
+                    google_callback(domain_ir, query, &signin.nonce, secret, host).await
+                }
+                None => redirect("/login?error=google_failed"),
+            };
+            Some(with_cookie(
+                response,
+                &auth::google_signin_clear_header(secure),
+            ))
+        }
 
         ("GET" | "POST", "/admin/members") => Some(
             admin_members_route(
-                method, domain_ir, raw_body, cookies, session, secret, client, wasm_path, config,
+                method, domain_ir, raw_body, cookies, session, secret, store, wasm_path, config,
             )
             .await,
         ),
@@ -433,11 +437,11 @@ async fn members_page_caller(
     cookies: &HashMap<String, String>,
     session: Option<&Session>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
 ) -> Result<(), Value> {
     if let Some(session) = session {
-        if is_admin(client, wasm_path, domain_ir, &session.identity_id).await {
+        if is_admin(store, wasm_path, domain_ir, &session.identity_id).await {
             return Ok(());
         }
     }
@@ -445,7 +449,7 @@ async fn members_page_caller(
         .get(&auth::account_cookie_name())
         .and_then(|token| auth::verify_account_token(secret, token));
     if let Some(email) = &account {
-        if auth::caller_is_admin(client, domain_ir, email)
+        if auth::caller_is_admin(store, domain_ir, email)
             .await
             .unwrap_or(false)
         {
@@ -469,17 +473,17 @@ async fn admin_members_route(
     cookies: &HashMap<String, String>,
     session: Option<&Session>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Value {
     if let Err(response) =
-        members_page_caller(domain_ir, cookies, session, secret, client, wasm_path).await
+        members_page_caller(domain_ir, cookies, session, secret, store, wasm_path).await
     {
         return response;
     }
     if method == "GET" {
-        return html(200, &admin_members_page(client, domain_ir).await);
+        return html(200, &admin_members_page(store, domain_ir).await);
     }
 
     let form = parse_form(raw_body);
@@ -503,36 +507,72 @@ async fn admin_members_route(
     {
         return html(400, "<p>Give a valid email.</p>");
     }
+    let days = match expiry_days(
+        form.get("expires_in_days")
+            .map(|s| Value::String(s.clone())),
+    ) {
+        Ok(days) => days,
+        Err(message) => return html(400, &format!("<p>{}</p>", esc(message))),
+    };
     let name = form
         .get("name")
         .map(|s| s.trim().to_string())
         .filter(|s| !s.is_empty())
         .unwrap_or_else(|| email.split('@').next().unwrap_or_default().to_string());
     // Ok(false) is "already admitted": the grant below is then all there is to do.
-    if let Err(e) = auth::admit_person(client, config, domain_ir, &email, &name).await {
+    if let Err(e) = auth::admit_person(store, config, domain_ir, &email, &name).await {
         return html(500, &format!("<p>{}</p>", esc(&e.to_string())));
     }
-    match auth::grant_access(client, wasm_path, config, domain_ir, &email, &role).await {
-        Ok(true) => redirect("/admin/members"),
-        Ok(false) => html(404, "<p>No member with that email.</p>"),
+    let until = days.map(auth::expiry_after_days);
+    match auth::grant_access_until(
+        store,
+        wasm_path,
+        config,
+        domain_ir,
+        &email,
+        &role,
+        until.as_deref(),
+    )
+    .await
+    {
+        Ok(auth::GrantOutcome::Done) => redirect("/admin/members"),
+        Ok(auth::GrantOutcome::UnknownPerson) => html(404, "<p>No member with that email.</p>"),
+        Ok(auth::GrantOutcome::LastOpenAdmin) => {
+            html(409, &format!("<p>{}</p>", esc(NEEDS_OPEN_ADMIN)))
+        }
         Err(e) => html(500, &format!("<p>{}</p>", esc(&e.to_string()))),
     }
 }
 
-async fn is_admin(
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-    domain_ir: &Value,
-    identity_id: &str,
-) -> bool {
-    let provider = crate::ir::authorization_provider(domain_ir);
-    dispatch::read(client, wasm_path).await.is_ok_and(|read| {
-        auth::holds_admin(
-            read.get("instances").unwrap_or(&json!({})),
-            identity_id,
-            provider.as_ref(),
-        )
-    })
+// The refusal when a change would leave no active admin without an end date.
+const NEEDS_OPEN_ADMIN: &str = "a site must keep at least one admin without an end date";
+
+// The optional `expires_in_days` of a grant: absent, null or blank means an
+// open-ended grant; otherwise a whole number of days, 1 to `MAX_EXPIRY_DAYS`.
+// A JSON number or a numeric string (a form field) both read.
+fn expiry_days(raw: Option<Value>) -> Result<Option<u32>, &'static str> {
+    const MESSAGE: &str = "expires_in_days must be a whole number of days from 1 to 365";
+    let days = match raw {
+        None | Some(Value::Null) => return Ok(None),
+        Some(Value::Number(n)) => n.as_u64(),
+        Some(Value::String(s)) if s.trim().is_empty() => return Ok(None),
+        Some(Value::String(s)) => s.trim().parse::<u64>().ok(),
+        Some(_) => None,
+    };
+    days.filter(|d| (1..=u64::from(auth::MAX_EXPIRY_DAYS)).contains(d))
+        .map(|d| Some(d as u32))
+        .ok_or(MESSAGE)
+}
+
+async fn is_admin(store: &Store, wasm_path: &Path, domain_ir: &Value, identity_id: &str) -> bool {
+    let Some(query) = crate::ir::authorization_provider(domain_ir).and_then(|p| p.live_assignments)
+    else {
+        return false;
+    };
+    let args = json!({"actor_id": {"value": identity_id}});
+    dispatch::query(store, wasm_path, &query, args)
+        .await
+        .is_ok_and(|answer| auth::holds_admin(&auth::answer_rows(&answer)))
 }
 
 // Verifies the token AND that the person still has access, so a
@@ -541,7 +581,7 @@ async fn active_session_email(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
 ) -> Result<String, Value> {
     let not_logged_in = || {
         respond(
@@ -556,7 +596,7 @@ async fn active_session_email(
     else {
         return Err(not_logged_in());
     };
-    match auth::has_access(client, domain_ir, &email).await {
+    match auth::has_access(store, domain_ir, &email).await {
         Ok(true) => Ok(email),
         Ok(false) => Err(not_logged_in()),
         Err(e) => Err(respond(
@@ -571,10 +611,10 @@ async fn accounts_me_route(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
 ) -> Value {
-    match active_session_email(domain_ir, cookies, secret, client).await {
-        Ok(email) => match auth::member_identity_id(client, domain_ir, &email).await {
+    match active_session_email(domain_ir, cookies, secret, store).await {
+        Ok(email) => match auth::member_identity_id(store, domain_ir, &email).await {
             Ok(identity_id) => respond(
                 200,
                 "application/json",
@@ -597,13 +637,12 @@ async fn members_route(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
 ) -> Value {
-    if let Err(response) = newsletter_send::require_admin(domain_ir, cookies, secret, client).await
-    {
+    if let Err(response) = newsletter_send::require_admin(domain_ir, cookies, secret, store).await {
         return response;
     }
-    match auth::all_people(client, domain_ir).await {
+    match auth::all_people(store, domain_ir).await {
         Ok(people) => respond(
             200,
             "application/json",
@@ -624,7 +663,7 @@ pub(crate) async fn add_member_route(
     raw_body: &str,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Value {
@@ -634,7 +673,7 @@ pub(crate) async fn add_member_route(
     else {
         return json_error(401, "not logged in");
     };
-    match auth::caller_is_admin(client, domain_ir, &caller).await {
+    match auth::caller_is_admin(store, domain_ir, &caller).await {
         Ok(true) => {}
         Ok(false) => return json_error(403, "admins only"),
         Err(e) => return json_error(500, &format!("members lookup failed: {e}")),
@@ -668,19 +707,36 @@ pub(crate) async fn add_member_route(
         );
     }
 
-    match auth::admit_person(client, config, domain_ir, &email, &name).await {
+    let days = match expiry_days(body.get("expires_in_days").cloned()) {
+        Ok(days) => days,
+        Err(message) => return json_error(400, message),
+    };
+
+    match auth::admit_person(store, config, domain_ir, &email, &name).await {
         Ok(true) => {}
         Ok(false) => return json_error(409, "that email is already admitted"),
         Err(e) => return json_error(500, &format!("admit failed: {e}")),
     }
     let email = email.to_lowercase();
-    match auth::grant_access(client, wasm_path, config, domain_ir, &email, &role).await {
-        Ok(true) => respond(
+    let until = days.map(auth::expiry_after_days);
+    match auth::grant_access_until(
+        store,
+        wasm_path,
+        config,
+        domain_ir,
+        &email,
+        &role,
+        until.as_deref(),
+    )
+    .await
+    {
+        Ok(auth::GrantOutcome::Done) => respond(
             201,
             "application/json",
-            &json!({"name": name, "email": email, "role": role, "linked": false, "granted": true, "disabled": false, "identity_id": null}).to_string(),
+            &json!({"name": name, "email": email, "role": role, "linked": false, "granted": true, "disabled": false, "access_expires_at": until, "expired": false, "identity_id": null}).to_string(),
         ),
-        Ok(false) => json_error(500, &format!("the person was admitted but the {role} role was not granted")),
+        Ok(auth::GrantOutcome::UnknownPerson) => json_error(500, &format!("the person was admitted but the {role} role was not granted")),
+        Ok(auth::GrantOutcome::LastOpenAdmin) => json_error(409, NEEDS_OPEN_ADMIN),
         Err(e) => json_error(500, &format!("the person was admitted but the {role} role was not granted: {e}")),
     }
 }
@@ -739,7 +795,7 @@ async fn set_member_disabled_route(
     raw_body: &str,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
     disable: bool,
 ) -> Value {
@@ -760,7 +816,7 @@ async fn set_member_disabled_route(
         return json_error(400, "an email is required");
     }
 
-    match auth::set_person_disabled(client, config, domain_ir, &caller, &email, disable).await {
+    match auth::set_person_disabled(store, config, domain_ir, &caller, &email, disable).await {
         Ok(auth::DisableOutcome::Done) => {
             let key = if disable { "disabled" } else { "enabled" };
             respond(
@@ -774,6 +830,7 @@ async fn set_member_disabled_route(
             json_error(403, "you can't disable your own admin access")
         }
         Ok(auth::DisableOutcome::UnknownPerson) => json_error(404, "no member with that email"),
+        Ok(auth::DisableOutcome::LastOpenAdmin) => json_error(409, NEEDS_OPEN_ADMIN),
         Ok(auth::DisableOutcome::LastAdmin) => {
             json_error(409, "there must always be at least one admin")
         }
@@ -790,7 +847,7 @@ async fn set_member_deleted_route(
     raw_body: &str,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
 ) -> Value {
     let Some(caller) = cookies
@@ -810,7 +867,7 @@ async fn set_member_deleted_route(
         return json_error(400, "an email is required");
     }
 
-    match auth::set_person_deleted(client, config, domain_ir, &caller, &email).await {
+    match auth::set_person_deleted(store, config, domain_ir, &caller, &email).await {
         Ok(auth::DeleteOutcome::Done) => respond(
             200,
             "application/json",
@@ -830,7 +887,7 @@ async fn set_member_role_route(
     raw_body: &str,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     config: &LineageConfig,
 ) -> Value {
     let Some(caller) = cookies
@@ -858,7 +915,7 @@ async fn set_member_role_route(
         );
     }
 
-    match auth::set_person_role(client, config, domain_ir, &caller, &email, &role).await {
+    match auth::set_person_role(store, config, domain_ir, &caller, &email, &role).await {
         Ok(auth::RoleOutcome::Done) => respond(
             200,
             "application/json",
@@ -866,6 +923,7 @@ async fn set_member_role_route(
         ),
         Ok(auth::RoleOutcome::CallerNotAdmin) => json_error(403, "admins only"),
         Ok(auth::RoleOutcome::UnknownPerson) => json_error(404, "no member with that email"),
+        Ok(auth::RoleOutcome::LastOpenAdmin) => json_error(409, NEEDS_OPEN_ADMIN),
         Ok(auth::RoleOutcome::LastAdmin) => {
             json_error(409, "there must always be at least one admin")
         }
@@ -879,7 +937,7 @@ async fn registrations_list_route(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Value {
@@ -889,13 +947,13 @@ async fn registrations_list_route(
     else {
         return json_error(401, "not logged in");
     };
-    match auth::caller_is_admin(client, domain_ir, &caller).await {
+    match auth::caller_is_admin(store, domain_ir, &caller).await {
         Ok(true) => {}
         Ok(false) => return json_error(403, "admins only"),
         Err(e) => return json_error(500, &format!("members lookup failed: {e}")),
     }
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(read) => read,
         Err(e) => return json_error(500, &format!("registrations lookup failed: {e:#}")),
     };
@@ -960,10 +1018,10 @@ async fn accounts_sso_token_route(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    store: &Store,
 ) -> Value {
     const SSO_TOKEN_TTL_SECS: u64 = 60;
-    let email = match active_session_email(domain_ir, cookies, secret, client).await {
+    let email = match active_session_email(domain_ir, cookies, secret, store).await {
         Ok(email) => email,
         Err(response) => return response,
     };
@@ -974,29 +1032,100 @@ async fn accounts_sso_token_route(
         &json!({"token": sso_token}).to_string(),
     )
 }
+// Logging out ends both sessions: the Governance `session` cookie and the account cookie.
+fn logout_response() -> Value {
+    with_cookie(
+        redirect_with_cookie("/login", &format!("session=; Max-Age=0{}", cookie_flags())),
+        &format!(
+            "{}=; Max-Age=0{}",
+            auth::account_cookie_name(),
+            cookie_flags()
+        ),
+    )
+}
+
+// Starts a Google sign-in bound to this browser: the cookie set here holds the state and nonce
+// the callback must bring back (auth/google_signin.rs).
+fn google_start() -> Value {
+    let signin = auth::GoogleSignin::fresh();
+    match auth::authorization_url(&redirect_uri(), &signin) {
+        Ok(url) => redirect_with_cookie(
+            &url,
+            &auth::google_signin_set_header(&signin, secure_cookies()),
+        ),
+        Err(e) => respond(
+            500,
+            "text/plain",
+            &format!("Google sign-in isn't configured: {e}"),
+        ),
+    }
+}
+
+// The sign-in this browser started, when the callback's `state` is the one its cookie holds.
+fn google_signin_for(
+    query: &HashMap<String, String>,
+    cookies: &HashMap<String, String>,
+    secure: bool,
+) -> Option<auth::GoogleSignin> {
+    let Some(signin) = auth::read_google_signin(cookies, secure) else {
+        eprintln!("google_callback: no sign-in cookie");
+        return None;
+    };
+    let state = query.get("state").map_or("", String::as_str);
+    if !signin.state_matches(state) {
+        eprintln!("google_callback: state does not match the sign-in cookie");
+        return None;
+    }
+    Some(signin)
+}
+
+// A site on another origin than this host trades the handoff token from the callback's redirect
+// for the account token here, server-to-server, so the long-lived token never rides a URL.
+fn google_handoff_route(raw_body: &str, secret: &str) -> Value {
+    static SPENT: OnceLock<JtiStore> = OnceLock::new();
+    let spent = SPENT.get_or_init(JtiStore::new);
+    let token = serde_json::from_str::<Value>(raw_body)
+        .ok()
+        .and_then(|body| body.get("token")?.as_str().map(str::to_string));
+    token
+        .and_then(|token| auth::redeem_handoff_token(secret, &token, spent))
+        .map_or_else(
+            || {
+                json_error(
+                    401,
+                    "this sign-in handoff is invalid, expired or already used",
+                )
+            },
+            |account| {
+                respond(
+                    200,
+                    "application/json",
+                    &json!({ "token": account }).to_string(),
+                )
+            },
+        )
+}
+
 async fn google_callback(
     domain_ir: &Value,
     query: &HashMap<String, String>,
-    client: &Mutex<Client>,
-    wasm_path: &Path,
-    config: &LineageConfig,
+    nonce: &str,
     secret: &str,
-    invoker: &dyn LambdaInvoker,
+    host: Host<'_>,
 ) -> Value {
+    let Host {
+        store,
+        wasm_path,
+        config,
+        invoker,
+        ..
+    } = host;
     let Some(code) = query.get("code") else {
         eprintln!("google_callback: missing code");
         return redirect("/login?error=google_failed");
     };
-    let Some(state) = query.get("state") else {
-        eprintln!("google_callback: missing state");
-        return redirect("/login?error=google_failed");
-    };
-    if let Err(e) = auth::verify_state(state, secret) {
-        eprintln!("google_callback: state: {e}");
-        return redirect("/login?error=google_failed");
-    }
 
-    let claims = match auth::verify(code, &redirect_uri()).await {
+    let claims = match auth::verify(code, &redirect_uri(), nonce).await {
         Ok(c) => c,
         Err(e) => {
             eprintln!("google_callback: token exchange: {e}");
@@ -1004,7 +1133,7 @@ async fn google_callback(
         }
     };
 
-    let read = match dispatch::read(client, wasm_path).await {
+    let read = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => {
             eprintln!("google_callback: read: {e:#}");
@@ -1016,7 +1145,7 @@ async fn google_callback(
     // PostgresEra head first — Identity is not in the WASM journal.
     // Journal `instances` is only a fallback for Lambda-era rows.
     let identity_id =
-        match auth::resolve_identity_from_head(client, domain_ir, &claims.issuer, &claims.subject)
+        match auth::resolve_identity_from_head(store, domain_ir, &claims.issuer, &claims.subject)
             .await
         {
             Ok(found) => found,
@@ -1030,7 +1159,7 @@ async fn google_callback(
 
     let session = match identity_id {
         Some(ref identity_id) => {
-            match auth::session_for_member_by_identity(client, domain_ir, identity_id).await {
+            match auth::session_for_member_by_identity(store, domain_ir, identity_id).await {
                 Ok(s) => s,
                 Err(e) => {
                     eprintln!("google_callback: member by identity: {e:#}");
@@ -1045,7 +1174,7 @@ async fn google_callback(
         None if claims.email_verified => {
             let email = claims.email.clone().unwrap_or_default();
             match auth::provision(
-                client,
+                store,
                 wasm_path,
                 config,
                 domain_ir,
@@ -1072,11 +1201,12 @@ async fn google_callback(
 
     // The site's admin authenticates on the account cookie, not this
     // host's own session cookie. Cross-origin, a cookie here would never
-    // reach the site, so the token is handed across via /api/google-handoff.
+    // reach the site, so a one-minute handoff token goes to its
+    // /api/google-handoff, which trades it at /accounts/google-handoff.
     let site = site_url();
     let site = site.trim_end_matches('/');
-    let token = auth::account_token(secret, &session.email, auth::SESSION_TTL_SECS);
     if same_origin(site, &redirect_uri()) {
+        let token = auth::account_token(secret, &session.email, auth::SESSION_TTL_SECS);
         let cookie = format!(
             "{}={token}{}; Max-Age={}",
             auth::account_cookie_name(),
@@ -1089,7 +1219,7 @@ async fn google_callback(
         redirect(&format!(
             "{}/api/google-handoff?token={}",
             site,
-            auth::urlencode(&token)
+            auth::urlencode(&auth::handoff_token(secret, &session.email))
         ))
     }
 }
@@ -1133,26 +1263,34 @@ fn login_page(error: Option<&str>) -> String {
     )
 }
 
-async fn admin_members_page(client: &Mutex<Client>, domain_ir: &Value) -> String {
-    let people = auth::all_people(client, domain_ir)
-        .await
-        .unwrap_or_default();
+async fn admin_members_page(store: &Store, domain_ir: &Value) -> String {
+    let people = auth::all_people(store, domain_ir).await.unwrap_or_default();
     let rows: String = people
         .iter()
         .map(|p| {
             let name = p.get("name").and_then(|v| v.as_str()).unwrap_or("");
             let email = p.get("email").and_then(|v| v.as_str()).unwrap_or("");
             let role = p.get("role").and_then(|v| v.as_str()).unwrap_or("—");
-            let access = if p.get("linked").and_then(serde_json::Value::as_bool) == Some(true) {
-                "linked"
+            let until = p
+                .get("access_expires_at")
+                .and_then(|v| v.as_str())
+                .unwrap_or("");
+            let expired = p.get("expired").and_then(serde_json::Value::as_bool) == Some(true);
+            let mut access = if expired {
+                format!("access ended {until}")
+            } else if p.get("linked").and_then(serde_json::Value::as_bool) == Some(true) {
+                "linked".to_string()
             } else if p.get("granted").and_then(serde_json::Value::as_bool) == Some(true) {
-                "granted, not yet signed in"
+                "granted, not yet signed in".to_string()
             } else {
-                "no access"
+                "no access".to_string()
             };
+            if !expired && !until.is_empty() {
+                access = format!("{access}, until {until}");
+            }
             format!(
                 r#"<tr class="border-b border-slate-100"><td class="py-2 pr-4">{}</td><td class="py-2 pr-4">{}</td><td class="py-2 pr-4">{}</td><td class="py-2">{}</td></tr>"#,
-                esc(name), esc(email), esc(role), esc(access)
+                esc(name), esc(email), esc(role), esc(&access)
             )
         })
         .collect::<Vec<_>>()
@@ -1164,10 +1302,11 @@ async fn admin_members_page(client: &Mutex<Client>, domain_ir: &Value) -> String
         <p class="mb-4"><a href="/" class="text-slate-500 hover:text-slate-700">&larr; back</a></p>
         <h1 class="text-xl font-semibold mb-4">Members</h1>
         <table class="w-full text-sm mb-6"><thead><tr class="text-left text-slate-500 text-xs uppercase"><th class="py-2 pr-4">Name</th><th class="py-2 pr-4">Email</th><th class="py-2 pr-4">Role</th><th class="py-2">Access</th></tr></thead><tbody>{rows}</tbody></table>
-        <form method="post" action="/admin/members" class="flex gap-2 items-center">
+        <form method="post" action="/admin/members" class="flex flex-wrap gap-2 items-center">
         <input type="text" name="name" placeholder="Name" class="w-40 border border-slate-300 rounded-md px-3 py-2 text-sm" />
         <input type="email" name="email" placeholder="Email (their Google account)" required class="flex-1 border border-slate-300 rounded-md px-3 py-2 text-sm" />
         <select name="role" class="border border-slate-300 rounded-md px-3 py-2 text-sm"><option value="Admin">Admin</option><option value="Owner">Owner</option><option value="Member">Member</option></select>
+        <input type="number" name="expires_in_days" min="1" max="365" step="1" placeholder="Days (optional)" title="Leave empty for access with no end date" class="w-32 border border-slate-300 rounded-md px-3 py-2 text-sm" />
         <button type="submit" class="px-4 py-2 bg-slate-900 text-white rounded-md text-sm">Grant access</button>
         </form></main></body></html>"#
     )
@@ -1276,7 +1415,7 @@ fn humanize(path: &str) -> String {
 const PRIMITIVES: &[&str] = &["String", "Integer", "Float", "TrueClass", "FalseClass"];
 
 // Dispatch order: list? -> reference? -> admits -> value object ->
-// primitive. `domain_ir` is the whole chapter, needed for cross-aggregate lookups.
+// primitive. `domain_ir` is the whole bluebook, needed for cross-aggregate lookups.
 fn resolve_field(domain_ir: &Value, attribute: &Value, aggregate: &Value, path: &str) -> Field {
     let is_list = attribute
         .get("list")
@@ -1752,12 +1891,12 @@ async fn aggregate_index(
     domain_name: &str,
     aggregate: &Value,
     format: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
 ) -> Value {
     let agg = agg_name(aggregate);
     let prefix = format!("{domain_name}::{agg}#");
-    let records = match dispatch::read(client, wasm_path).await {
+    let records = match dispatch::read(store, wasm_path).await {
         Ok(result) => instances_for(&result, &prefix),
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -1841,12 +1980,12 @@ async fn record_show(
     aggregate: &Value,
     id: &str,
     format: &str,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
 ) -> Value {
     let agg = agg_name(aggregate);
     let prefix = format!("{domain_name}::{agg}#");
-    let result = match dispatch::read(client, wasm_path).await {
+    let result = match dispatch::read(store, wasm_path).await {
         Ok(r) => r,
         Err(e) => return respond(500, "text/plain", &format!("{e:#}")),
     };
@@ -1923,10 +2062,11 @@ async fn command_route(
     method: &str,
     query: &HashMap<String, String>,
     raw_body: &str,
+    caller: dispatch::Caller<'_>,
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client,
+        store,
         wasm_path,
         config,
         invoker,
@@ -1937,20 +2077,37 @@ async fn command_route(
 
     if format != "html" {
         if method == "GET" {
+            if query.get("schema").map(String::as_str) == Some("1") {
+                return crate::ir::command_schema(agg_name(aggregate), cname).map_or_else(
+                    || respond(404, "text/plain", &format!("no schema for {cname}")),
+                    |schema| respond(200, "application/json", &schema.to_string()),
+                );
+            }
             return respond(200, "application/json", &command.to_string());
         }
         let raw = parse_form(raw_body);
+        if crate::validation::requested(query) {
+            let facts = Preview {
+                domain_name,
+                aggregate,
+                command,
+                fields: &fields,
+                raw: &raw,
+            };
+            return preview_submission(&facts, host, caller).await;
+        }
         return submit(
             domain_name,
             aggregate,
             command,
             &fields,
             &raw,
-            client,
+            store,
             wasm_path,
             config,
             true,
             invoker,
+            caller,
         )
         .await;
     }
@@ -1980,14 +2137,54 @@ async fn command_route(
         command,
         &fields,
         &raw,
-        client,
+        store,
         wasm_path,
         config,
         false,
         invoker,
+        caller,
     )
     .await
 }
+// What a preview of a submitted form is asked about: the command and the values posted for it.
+struct Preview<'a> {
+    domain_name: &'a str,
+    aggregate: &'a Value,
+    command: &'a Value,
+    fields: &'a [Field],
+    raw: &'a HashMap<String, String>,
+}
+
+// Whether the submitted command would be accepted, answered as the client envelope with 200 whether
+// or not it would be refused, and kept nowhere. A malformed submission is a 400, as a real one is.
+async fn preview_submission(
+    asked: &Preview<'_>,
+    host: Host<'_>,
+    caller: dispatch::Caller<'_>,
+) -> Value {
+    let Preview {
+        domain_name,
+        aggregate,
+        command,
+        fields,
+        raw,
+    } = *asked;
+    let cname = command.get("name").and_then(|v| v.as_str()).unwrap_or("");
+    let verb = format!("{domain_name}::{}.{cname}", agg_name(aggregate));
+    let args = match extract_args(fields, raw) {
+        Ok(args) => args,
+        Err(e) => return bad_request(domain_name, aggregate, command, fields, raw, true, &e),
+    };
+    match dispatch::preview_request(host, &verb, args, caller).await {
+        Ok(outcome) => respond(
+            200,
+            "application/json",
+            &crate::validation::answer(&outcome.result).to_string(),
+        ),
+        Err(e) => respond(500, "text/plain", &format!("{e:#}")),
+    }
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn submit(
     domain_name: &str,
@@ -1995,11 +2192,12 @@ async fn submit(
     command: &Value,
     fields: &[Field],
     raw: &HashMap<String, String>,
-    client: &Mutex<Client>,
+    store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
     json_mode: bool,
     invoker: &dyn LambdaInvoker,
+    caller: dispatch::Caller<'_>,
 ) -> Value {
     let agg = agg_name(aggregate);
     let cname = command.get("name").and_then(|v| v.as_str()).unwrap_or("");
@@ -2012,13 +2210,12 @@ async fn submit(
         Err(e) => return bad_request(domain_name, aggregate, command, fields, raw, json_mode, &e),
     };
 
-    // `None`: this web UI has no concept of an authenticated caller's
-    // role yet (see auth.rs's own session handling for that).
-    let outcome = match dispatch::handle(
-        Host::new(client, wasm_path, config, invoker),
+    // Dispatched as the signed-in caller, checked against the role the command declares.
+    let outcome = match dispatch::handle_request(
+        Host::new(store, wasm_path, config, invoker),
         &verb,
         args,
-        None,
+        caller,
     )
     .await
     {
@@ -2414,6 +2611,20 @@ fn redirect_with_cookie(location: &str, cookie: &str) -> Value {
     json!({"statusCode": 302, "headers": {"location": location}, "cookies": [cookie], "body": "", "isBase64Encoded": false})
 }
 
+// `response` with one more `Set-Cookie` beside any it already carries.
+fn with_cookie(mut response: Value, cookie: &str) -> Value {
+    match response.get_mut("cookies").and_then(Value::as_array_mut) {
+        Some(cookies) => cookies.push(json!(cookie)),
+        None => response["cookies"] = json!([cookie]),
+    }
+    response
+}
+
+// Whether cookies this host sets carry `Secure` (see `cookie_flags`).
+fn secure_cookies() -> bool {
+    cookie_flags() == COOKIE_FLAGS_SECURE
+}
+
 const DEFAULT_SITE_URL: &str = "http://localhost:4321";
 
 /// The public site's origin: `SITE_URL`, else the local development address.
@@ -2441,6 +2652,8 @@ fn respond_with_cookie(status: u16, content_type: &str, body: &str, cookie: &str
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[allow(unused_imports)]
+    use crate::store::StoreFixtures;
 
     // A record's id is user-supplied; left unescaped, a malicious one
     // would render as live markup — these tests pin that it can't.
@@ -2851,6 +3064,190 @@ mod tests {
         );
     }
 
+    // A form submitted through the generated UI dispatches as the signed-in caller, so a role the
+    // command does not declare is refused as it is over the internal protocol.
+    #[tokio::test]
+    async fn a_form_submit_dispatches_as_the_signed_in_caller() {
+        let client = crate::dispatch_tests::tests::memory_store();
+        let wasm = crate::dispatch_tests::tests::wasm_path();
+        let ir: Value = serde_json::from_str(
+            &std::fs::read_to_string(
+                std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../dist/banking.ir.json"),
+            )
+            .expect("hecks build_wasm writes banking.ir.json beside the wasm"),
+        )
+        .expect("valid IR");
+        let lineage = LineageConfig {
+            domain: "Banking".to_string(),
+            era: None,
+            mirrored: None,
+            seal_every: None,
+        };
+        let invoker = crate::lambda_client::NeverInvoker;
+        let submit_as = |role: &'static str, reference: &'static str| {
+            let (client, wasm, ir, lineage, invoker) = (&client, &wasm, &ir, &lineage, &invoker);
+            async move {
+                let cookies = signed_in_cookies(role);
+                let form = format!(
+                    "reference.value={reference}&name.given=Ada&name.family=Lovelace&email.address=ada%40example.com"
+                );
+                let host = Host::new(client, wasm, lineage, invoker);
+                let path = "/Banking/Customer/Register.json";
+                route(ir, "POST", path, &HashMap::new(), &form, &cookies, host).await
+            }
+        };
+
+        let teller = submit_as("Teller", "CUST-9201").await;
+        assert_eq!(teller["statusCode"], 422, "{teller}");
+        assert!(
+            teller["body"]
+                .as_str()
+                .unwrap_or_default()
+                .contains("Unauthorized"),
+            "{teller}"
+        );
+        let clerk = submit_as("Branch clerk", "CUST-9202").await;
+        assert_eq!(clerk["statusCode"], 201, "{clerk}");
+    }
+
+    // `?dry_run=1` on the JSON command route: the signed-in caller's verdict, as the client envelope,
+    // with nothing kept.
+    #[tokio::test]
+    async fn a_preview_of_a_submitted_form_answers_the_envelope_as_the_signed_in_caller() {
+        let client = crate::dispatch_tests::tests::memory_store();
+        let wasm = crate::dispatch_tests::tests::wasm_path();
+        let ir: Value = serde_json::from_str(
+            &std::fs::read_to_string(
+                std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../dist/banking.ir.json"),
+            )
+            .expect("hecks build_wasm writes banking.ir.json beside the wasm"),
+        )
+        .expect("valid IR");
+        let lineage = LineageConfig {
+            domain: "Banking".to_string(),
+            era: None,
+            mirrored: None,
+            seal_every: None,
+        };
+        let invoker = crate::lambda_client::NeverInvoker;
+        let post = |role: &'static str, asked: &'static str| {
+            let (client, wasm, ir, lineage, invoker) = (&client, &wasm, &ir, &lineage, &invoker);
+            async move {
+                let cookies = signed_in_cookies(role);
+                let form = "reference.value=CUST-9301&name.given=Ada&name.family=Lovelace&email.address=ada%40example.com";
+                let query = HashMap::from([("dry_run".to_string(), asked.to_string())]);
+                let host = Host::new(client, wasm, lineage, invoker);
+                let path = "/Banking/Customer/Register.json";
+                route(ir, "POST", path, &query, form, &cookies, host).await
+            }
+        };
+        let verdict = |response: &Value| -> Value {
+            serde_json::from_str(response["body"].as_str().unwrap_or("{}")).expect("a JSON body")
+        };
+
+        let teller = post("Teller", "1").await;
+        assert_eq!(teller["statusCode"], 200, "{teller}");
+        let refusal = &verdict(&teller)["refusals"][0];
+        assert_eq!(
+            (refusal["kind"].as_str(), refusal["stage"].as_str()),
+            (Some("unauthorized"), Some("role"))
+        );
+
+        let clerk = post("Branch clerk", "1").await;
+        assert_eq!(clerk["statusCode"], 200, "{clerk}");
+        assert_eq!(
+            verdict(&clerk),
+            serde_json::json!({ "ok": true, "refusals": [] })
+        );
+
+        // Kept nothing: the same registration, for real, is still accepted.
+        let real = post("Branch clerk", "0").await;
+        assert_eq!(real["statusCode"], 201, "{real}");
+    }
+
+    // `?schema=1` on a command's JSON route: the JSON Schema the build wrote beside the IR.
+    #[tokio::test]
+    async fn a_command_json_route_serves_its_schema_when_asked() {
+        let client = crate::dispatch_tests::tests::memory_store();
+        let wasm = crate::dispatch_tests::tests::wasm_path();
+        let ir_path =
+            std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../dist/banking.ir.json");
+        let ir: Value =
+            serde_json::from_str(&std::fs::read_to_string(&ir_path).expect("banking.ir.json"))
+                .expect("valid IR");
+        crate::ir::install_schemas(ir_path.to_str());
+        let lineage = LineageConfig {
+            domain: "Banking".to_string(),
+            era: None,
+            mirrored: None,
+            seal_every: None,
+        };
+        let invoker = crate::lambda_client::NeverInvoker;
+        let host = Host::new(&client, &wasm, &lineage, &invoker);
+        let cookies = signed_in_cookies("Branch clerk");
+        let query = HashMap::from([("schema".to_string(), "1".to_string())]);
+
+        let found = route(
+            &ir,
+            "GET",
+            "/Banking/Customer/Register.json",
+            &query,
+            "",
+            &cookies,
+            host,
+        )
+        .await;
+        assert_eq!(found["statusCode"], 200, "{found}");
+        let schema: Value =
+            serde_json::from_str(found["body"].as_str().unwrap_or("{}")).expect("JSON");
+        assert_eq!(
+            schema["$schema"],
+            "https://json-schema.org/draft/2020-12/schema"
+        );
+        assert!(schema["properties"].get("reference").is_some(), "{schema}");
+
+        let host = Host::new(&client, &wasm, &lineage, &invoker);
+        let plain = route(
+            &ir,
+            "GET",
+            "/Banking/Customer/Register.json",
+            &HashMap::new(),
+            "",
+            &cookies,
+            host,
+        )
+        .await;
+        assert_eq!(plain["statusCode"], 200);
+        assert!(
+            plain["body"].as_str().unwrap_or("").contains("\"name\""),
+            "the descriptor is unchanged"
+        );
+    }
+
+    // A session cookie signed with the host's own secret, for a caller Governance knows nothing of.
+    fn signed_in_cookies(role: &str) -> HashMap<String, String> {
+        if crate::secrets::var("SESSION_SECRET")
+            .unwrap_or_default()
+            .is_empty()
+        {
+            crate::secrets::provide("SESSION_SECRET", "a-session-secret-for-tests".to_string());
+        }
+        let session = Session {
+            identity_id: String::new(),
+            email: "clerk@example.com".to_string(),
+            name: "Clerk".to_string(),
+            role: Some(role.to_string()),
+        };
+        let mut cookies = HashMap::new();
+        cookies.insert(
+            "session".to_string(),
+            auth::session_cookie(&session_secret(), &session),
+        );
+        cookies
+    }
+
     #[test]
     fn extract_args_surfaces_a_collision_as_an_error_rather_than_panicking() {
         let scalar_field = Field {
@@ -2925,9 +3322,9 @@ mod tests {
 
     // scratch_db provisions a real Postgres schema; only the Stripe hop
     // in payments.rs's own tests is faked, aimed at a local recording server.
-    use tokio_postgres::NoTls;
+    use tokio_postgres::{Client, NoTls};
 
-    pub(super) async fn scratch_db(name: &str) -> Mutex<Client> {
+    pub(super) async fn scratch_db(name: &str) -> Store {
         let (admin, conn) = tokio_postgres::connect(&crate::test_pg::conninfo("postgres"), NoTls)
             .await
             .expect("connect to postgres");
@@ -2949,8 +3346,10 @@ mod tests {
         tokio::spawn(async move {
             let _ = conn.await;
         });
-        crate::journal::ensure_schema(&client).await.unwrap();
-        Mutex::new(client)
+        crate::store::journal_sql::ensure_schema(&client)
+            .await
+            .unwrap();
+        crate::store::postgres_store(client)
     }
 
     // Duplicates dispatch.rs's own provision_lineage shape rather than
@@ -2975,7 +3374,7 @@ mod tests {
             .await
             .unwrap();
 
-        let journal_table = format!("hecks_journal_{}", crate::journal::snake(domain));
+        let journal_table = format!("hecks_journal_{}", crate::store::journal_sql::snake(domain));
         client
             .batch_execute(&format!(
                 "CREATE TABLE IF NOT EXISTS \"{journal_table}\" (
@@ -2993,9 +3392,12 @@ mod tests {
         for name in aggregate_storage_names {
             // domain-qualified (docs/decisions/0059) — matches what a real
             // `journal::append_lineage_mutation` write actually targets now.
-            let snapshot_table = crate::journal::qualified_name(
+            let snapshot_table = crate::store::journal_sql::qualified_name(
                 domain,
-                &format!("{}_head_snapshot_{era}", crate::journal::snake(name)),
+                &format!(
+                    "{}_head_snapshot_{era}",
+                    crate::store::journal_sql::snake(name)
+                ),
             );
             client
                 .batch_execute(&format!("CREATE TABLE IF NOT EXISTS \"{snapshot_table}\" (id text PRIMARY KEY, ordinal bigint NOT NULL, state jsonb NOT NULL)"))
@@ -3098,7 +3500,7 @@ mod tests {
     // Same head-view shape auth.rs's own tests build for the Membership
     // aggregate, seeded with one granted, linked admin and one admitted
     // person with no access yet.
-    async fn scratch_members_db(name: &str) -> (Mutex<Client>, Value) {
+    async fn scratch_members_db(name: &str) -> (Store, Value) {
         let client = scratch_db(name).await;
         {
             let guard = client.lock().await;
@@ -3154,11 +3556,11 @@ mod tests {
         assert_eq!(names, ["amy", "Zed"], "sorted case-insensitively by name");
         assert_eq!(
             people[1],
-            json!({"name": "Zed", "email": "zed@example.com", "role": "Admin", "linked": true, "granted": true, "disabled": false, "identity_id": "id-1"})
+            json!({"name": "Zed", "email": "zed@example.com", "role": "Admin", "linked": true, "granted": true, "disabled": false, "access_expires_at": null, "expired": false, "identity_id": "id-1"})
         );
         assert_eq!(
             people[0],
-            json!({"name": "amy", "email": "amy@example.com", "role": null, "linked": false, "granted": false, "disabled": false, "identity_id": null})
+            json!({"name": "amy", "email": "amy@example.com", "role": null, "linked": false, "granted": false, "disabled": false, "access_expires_at": null, "expired": false, "identity_id": null})
         );
     }
 
@@ -3249,6 +3651,7 @@ mod tests {
             domain: "Acme".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         }
     }
 
@@ -3498,7 +3901,7 @@ mod tests {
         body: &str,
         cookies: &HashMap<String, String>,
         secret: &str,
-        client: &Mutex<Client>,
+        client: &Store,
         domain_ir: &Value,
     ) -> Value {
         admin_members_route(
@@ -3642,7 +4045,7 @@ mod tests {
         let created: Value = serde_json::from_str(response["body"].as_str().unwrap()).unwrap();
         assert_eq!(
             created,
-            json!({"name": "New Person", "email": "new@example.com", "role": "Admin", "linked": false, "granted": true, "disabled": false, "identity_id": null})
+            json!({"name": "New Person", "email": "new@example.com", "role": "Admin", "linked": false, "granted": true, "disabled": false, "access_expires_at": null, "expired": false, "identity_id": null})
         );
 
         let listing = members_route(&domain_ir, &cookies, secret, &client).await;
@@ -3671,7 +4074,7 @@ mod tests {
 
     // The scratch members database with amy also granted Admin, so two
     // active admins exist and one can act on the other.
-    async fn scratch_two_admins(name: &str) -> (Mutex<Client>, Value) {
+    async fn scratch_two_admins(name: &str) -> (Store, Value) {
         let (client, domain_ir) = scratch_members_db(name).await;
         let granted = auth::grant_access(
             &client,
@@ -3688,7 +4091,7 @@ mod tests {
     }
 
     async fn switch_access(
-        client: &Mutex<Client>,
+        client: &Store,
         domain_ir: &Value,
         caller: &str,
         email: &str,
@@ -3713,7 +4116,7 @@ mod tests {
         body["error"].as_str().unwrap_or_default().to_string()
     }
 
-    async fn person(client: &Mutex<Client>, domain_ir: &Value, email: &str) -> Value {
+    async fn person(client: &Store, domain_ir: &Value, email: &str) -> Value {
         let people = auth::all_people(client, domain_ir).await.unwrap();
         people
             .into_iter()
@@ -3721,7 +4124,7 @@ mod tests {
             .unwrap_or_else(|| panic!("{email} is not listed"))
     }
 
-    async fn journal_rows(client: &Mutex<Client>, id: &str) -> i64 {
+    async fn journal_rows(client: &Store, id: &str) -> i64 {
         let guard = client.lock().await;
         guard
             .query_one(
@@ -3835,7 +4238,7 @@ mod tests {
     }
 
     async fn set_role(
-        client: &Mutex<Client>,
+        client: &Store,
         domain_ir: &Value,
         caller: &str,
         email: &str,
@@ -4439,6 +4842,7 @@ mod tests {
             domain: "Studio".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         };
         // The wasm path doesn't exist: every refusal below must come before any registration read.
         let wasm_path = Path::new("does-not-exist.wasm");
@@ -4530,6 +4934,7 @@ mod tests {
             domain: "Studio".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         };
         // No wasm at all: clearing the admin gate then fails with a 500, never 401/403.
         let missing_wasm = Path::new("does-not-exist.wasm");
@@ -4874,6 +5279,931 @@ mod tests {
         );
     }
 
+    // ---- time-boxed access: a window on the row that ends by itself ----
+
+    const PAST: &str = "2020-01-01T00:00:00Z";
+    const FUTURE: &str = "2099-01-01T00:00:00Z";
+
+    // Writes `access_expires_at` straight onto a row, the way a window that
+    // ran out (or was mangled) looks to the host, whatever wrote it.
+    async fn set_window(client: &Store, email: &str, window: Value) {
+        client
+            .lock()
+            .await
+            .execute(
+                "UPDATE acme_member_head_snapshot_1 SET state = jsonb_set(state, '{access_expires_at}', $2::jsonb) WHERE id = $1",
+                &[&email, &window],
+            )
+            .await
+            .unwrap();
+    }
+
+    fn form_grant(email: &str, role: &str, days: &str) -> String {
+        format!("email={email}&role={role}&expires_in_days={days}")
+    }
+
+    const NEEDS_OPEN: &str = "a site must keep at least one admin without an end date";
+
+    // Posts a grant through the members form as `caller`; returns the status.
+    async fn form_status(
+        client: &Store,
+        domain_ir: &Value,
+        caller: &str,
+        email: &str,
+        role: &str,
+        days: &str,
+    ) -> Value {
+        let secret = "s3cret";
+        members_page(
+            "POST",
+            &form_grant(email, role, days),
+            &session_cookies(secret, caller),
+            secret,
+            client,
+            domain_ir,
+        )
+        .await
+    }
+
+    async fn expires_of(client: &Store, domain_ir: &Value, email: &str) -> Value {
+        person(client, domain_ir, email).await["access_expires_at"].clone()
+    }
+
+    #[tokio::test]
+    async fn a_lone_open_ended_admin_cannot_be_given_a_window_or_a_lesser_role() {
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_open_lone").await;
+        let before = journal_rows(&client, "zed@example.com").await;
+
+        for days in ["7", "365"] {
+            let r = form_status(
+                &client,
+                &domain_ir,
+                "zed@example.com",
+                "zed%40example.com",
+                "Admin",
+                days,
+            )
+            .await;
+            assert_eq!(r["statusCode"], 409, "{r:?}");
+            assert!(r["body"].as_str().unwrap().contains(NEEDS_OPEN), "{r:?}");
+        }
+        // The same grant that drops the admin role also takes the open-ended admin away.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "zed%40example.com",
+            "Member",
+            "",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        assert_eq!(
+            journal_rows(&client, "zed@example.com").await,
+            before,
+            "nothing was written"
+        );
+        assert_eq!(
+            expires_of(&client, &domain_ir, "zed@example.com").await,
+            Value::Null
+        );
+
+        // A plain grant that keeps the role is fine, and so is anything for a non-admin.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "zed%40example.com",
+            "Owner",
+            "",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy%40example.com",
+            "Member",
+            "5",
+        )
+        .await;
+        assert_eq!(
+            r["statusCode"], 302,
+            "a non-admin takes a window freely: {r:?}"
+        );
+        assert!(expires_of(&client, &domain_ir, "amy@example.com")
+            .await
+            .is_string());
+    }
+
+    #[tokio::test]
+    async fn with_two_open_ended_admins_either_may_take_a_window_but_not_both() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_open_two").await;
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy%40example.com",
+            "Admin",
+            "10",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+        assert!(expires_of(&client, &domain_ir, "amy@example.com")
+            .await
+            .is_string());
+
+        // zed is now the one open-ended admin left.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed%40example.com",
+            "Admin",
+            "10",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        assert_eq!(
+            expires_of(&client, &domain_ir, "zed@example.com").await,
+            Value::Null
+        );
+    }
+
+    #[tokio::test]
+    async fn an_open_ended_admin_beside_a_windowed_one_is_protected_on_every_path() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_open_beside").await;
+        set_window(&client, "amy@example.com", json!(FUTURE)).await;
+
+        // Renewing the windowed admin, or lifting the window, is always allowed.
+        for days in ["30", ""] {
+            let r = form_status(
+                &client,
+                &domain_ir,
+                "zed@example.com",
+                "amy%40example.com",
+                "Admin",
+                days,
+            )
+            .await;
+            assert_eq!(r["statusCode"], 302, "{r:?}");
+        }
+        set_window(&client, "amy@example.com", json!(FUTURE)).await;
+
+        // Windowing, disabling or demoting zed would leave only a window that will end.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed%40example.com",
+            "Admin",
+            "9",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        let r = switch_access(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed@example.com",
+            true,
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        assert_eq!(error_of(&r), NEEDS_OPEN);
+        let r = set_role(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed@example.com",
+            "Member",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        assert_eq!(error_of(&r), NEEDS_OPEN);
+        let zed = person(&client, &domain_ir, "zed@example.com").await;
+        assert_eq!(
+            (zed["role"].clone(), zed["disabled"].clone()),
+            (json!("Admin"), json!(false))
+        );
+
+        // The windowed admin itself may be disabled, demoted or re-enabled: zed stays.
+        let r = switch_access(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy@example.com",
+            true,
+        )
+        .await;
+        assert_eq!(r["statusCode"], 200, "{r:?}");
+        let r = switch_access(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy@example.com",
+            false,
+        )
+        .await;
+        assert_eq!(r["statusCode"], 200, "{r:?}");
+        let r = set_role(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy@example.com",
+            "Member",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 200, "{r:?}");
+    }
+
+    #[tokio::test]
+    async fn a_lapsed_or_unreadable_admin_is_not_an_open_ended_active_one() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_open_lapsed").await;
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        // amy's window ended, so zed is the only active admin and is protected.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "zed%40example.com",
+            "Admin",
+            "3",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        let r = switch_access(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy@example.com",
+            true,
+        )
+        .await;
+        assert_eq!(
+            r["statusCode"], 200,
+            "disabling an admin who already lapsed is harmless: {r:?}"
+        );
+
+        // An unreadable window fails closed: zed is lapsed, so amy is the one left.
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_open_unreadable").await;
+        set_window(&client, "zed@example.com", json!("whenever")).await;
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "amy%40example.com",
+            "Admin",
+            "3",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        let r = set_role(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "amy@example.com",
+            "Member",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 409, "{r:?}");
+        // Renewing the unreadable row, or clearing it with a plain grant, is allowed.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed%40example.com",
+            "Admin",
+            "3",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+        set_window(&client, "zed@example.com", json!("whenever")).await;
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed%40example.com",
+            "Admin",
+            "",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+        assert_eq!(
+            expires_of(&client, &domain_ir, "zed@example.com").await,
+            Value::Null
+        );
+    }
+
+    #[tokio::test]
+    async fn a_client_admin_stays_open_ended_while_an_operator_works_on_a_window() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_open_operator").await;
+        // amy is the operator, with a window; zed is the client's open-ended admin.
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy%40example.com",
+            "Admin",
+            "30",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy%40example.com",
+            "Admin",
+            "60",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "the operator's window renews: {r:?}");
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed%40example.com",
+            "Admin",
+            "1",
+        )
+        .await;
+        assert_eq!(
+            r["statusCode"], 409,
+            "the operator cannot window the client admin: {r:?}"
+        );
+        // Even after the operator's window ends, the client admin still opens the gate.
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        assert!(
+            auth::caller_is_admin(&client, &domain_ir, "zed@example.com")
+                .await
+                .unwrap()
+        );
+        assert!(
+            !auth::caller_is_admin(&client, &domain_ir, "amy@example.com")
+                .await
+                .unwrap()
+        );
+    }
+
+    #[tokio::test]
+    async fn the_first_admin_of_a_site_must_be_open_ended() {
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_open_first").await;
+        // Nobody holds an admin role yet.
+        client
+            .lock()
+            .await
+            .execute("UPDATE acme_member_head_snapshot_1 SET state = state - 'role' WHERE id = 'zed@example.com'", &[])
+            .await
+            .unwrap();
+        let outcome = |days: Option<&'static str>, who: &'static str| {
+            let (client, domain_ir) = (&client, &domain_ir);
+            async move {
+                auth::grant_access_until(
+                    client,
+                    Path::new("unused"),
+                    &members_config(),
+                    domain_ir,
+                    who,
+                    "Admin",
+                    days,
+                )
+                .await
+                .unwrap()
+            }
+        };
+        assert_eq!(
+            outcome(Some(FUTURE), "zed@example.com").await,
+            auth::GrantOutcome::LastOpenAdmin
+        );
+        assert_eq!(
+            person(&client, &domain_ir, "zed@example.com").await["role"],
+            Value::Null
+        );
+
+        // Open-ended first admin is allowed, and a windowed second one after it.
+        assert_eq!(
+            outcome(None, "zed@example.com").await,
+            auth::GrantOutcome::Done
+        );
+        let r = form_status(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy%40example.com",
+            "Admin",
+            "5",
+        )
+        .await;
+        assert_eq!(r["statusCode"], 302, "{r:?}");
+    }
+
+    #[tokio::test]
+    async fn a_json_grant_to_a_new_person_never_trips_the_open_ended_guard() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_open_json").await;
+        let body = json!({"email": "new@example.com", "name": "New", "role": "Admin", "expires_in_days": 5}).to_string();
+        let r = add_member_route(
+            &domain_ir,
+            &body,
+            &session_cookies(secret, "zed@example.com"),
+            secret,
+            &client,
+            Path::new("unused"),
+            &members_config(),
+        )
+        .await;
+        assert_eq!(r["statusCode"], 201, "{r:?}");
+        // The lone open-ended admin is still zed; windowing him is refused.
+        let outcome = auth::grant_access_until(
+            &client,
+            Path::new("unused"),
+            &members_config(),
+            &domain_ir,
+            "zed@example.com",
+            "Admin",
+            Some(FUTURE),
+        )
+        .await
+        .unwrap();
+        assert_eq!(outcome, auth::GrantOutcome::LastOpenAdmin);
+        let outcome = auth::grant_access_until(
+            &client,
+            Path::new("unused"),
+            &members_config(),
+            &domain_ir,
+            "nobody@example.com",
+            "Admin",
+            None,
+        )
+        .await
+        .unwrap();
+        assert_eq!(outcome, auth::GrantOutcome::UnknownPerson);
+    }
+
+    #[tokio::test]
+    async fn a_person_whose_window_has_ended_gets_no_access_anywhere_but_the_row_keeps_its_role() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_access").await;
+        client
+            .lock()
+            .await
+            .execute(
+                "UPDATE acme_member_head_snapshot_1 SET state = state || '{\"identity_id\": {\"value\": \"id-amy\"}}'::jsonb WHERE id = 'amy@example.com'",
+                &[],
+            )
+            .await
+            .unwrap();
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        let amy_cookies = session_cookies(secret, "amy@example.com");
+
+        assert!(!auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        assert_eq!(
+            auth::active_role(&client, &domain_ir, "amy@example.com")
+                .await
+                .unwrap(),
+            None
+        );
+        assert!(
+            !auth::caller_is_admin(&client, &domain_ir, "amy@example.com")
+                .await
+                .unwrap()
+        );
+        // The CMS-facing session check and the SSO token route both refuse her.
+        assert_eq!(
+            accounts_me_route(&domain_ir, &amy_cookies, secret, &client).await["statusCode"],
+            401
+        );
+        assert_eq!(
+            accounts_sso_token_route(&domain_ir, &amy_cookies, secret, &client).await["statusCode"],
+            401
+        );
+        // A new Google sign-in through her linked identity is refused too.
+        assert!(
+            auth::session_for_member_by_identity(&client, &domain_ir, "id-amy")
+                .await
+                .unwrap()
+                .is_none()
+        );
+        let amy = person(&client, &domain_ir, "amy@example.com").await;
+        assert_eq!(
+            (
+                amy["role"].as_str(),
+                amy["granted"].clone(),
+                amy["disabled"].clone(),
+                amy["expired"].clone(),
+                amy["access_expires_at"].as_str()
+            ),
+            (
+                Some("Admin"),
+                json!(false),
+                json!(false),
+                json!(true),
+                Some(PAST)
+            )
+        );
+        // Her window has not touched zed's access.
+        assert!(auth::has_access(&client, &domain_ir, "zed@example.com")
+            .await
+            .unwrap());
+    }
+
+    #[tokio::test]
+    async fn a_window_still_open_changes_nothing_until_it_ends() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_open").await;
+        set_window(&client, "amy@example.com", json!(FUTURE)).await;
+
+        assert!(auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        assert!(
+            auth::caller_is_admin(&client, &domain_ir, "amy@example.com")
+                .await
+                .unwrap()
+        );
+        assert_eq!(
+            accounts_me_route(
+                &domain_ir,
+                &session_cookies(secret, "amy@example.com"),
+                secret,
+                &client
+            )
+            .await["statusCode"],
+            200
+        );
+        let amy = person(&client, &domain_ir, "amy@example.com").await;
+        assert_eq!(
+            (
+                amy["granted"].clone(),
+                amy["expired"].clone(),
+                amy["access_expires_at"].as_str()
+            ),
+            (json!(true), json!(false), Some(FUTURE))
+        );
+    }
+
+    #[tokio::test]
+    async fn a_malformed_window_counts_as_ended_and_fails_closed() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_malformed").await;
+        for bad in [
+            json!("tomorrow"),
+            json!(""),
+            json!(12345),
+            json!(true),
+            json!("2099-13-40T00:00:00Z"),
+            json!("2099-01-01T00:00:00+02:00"),
+            json!({"value": "not a time"}),
+        ] {
+            set_window(&client, "amy@example.com", bad.clone()).await;
+            assert!(
+                !auth::has_access(&client, &domain_ir, "amy@example.com")
+                    .await
+                    .unwrap(),
+                "{bad}"
+            );
+            assert_eq!(
+                person(&client, &domain_ir, "amy@example.com").await["expired"],
+                true,
+                "{bad}"
+            );
+        }
+        // A wrapped value reads like a bare one; null is no window at all.
+        set_window(&client, "amy@example.com", json!({"value": FUTURE})).await;
+        assert!(auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        set_window(&client, "amy@example.com", Value::Null).await;
+        assert!(auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+    }
+
+    #[tokio::test]
+    async fn an_expired_admin_neither_passes_the_admin_gate_nor_counts_as_the_last_admin() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_admins").await;
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+
+        // The expired admin cannot act as one.
+        let response = switch_access(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed@example.com",
+            true,
+        )
+        .await;
+        assert_eq!(response["statusCode"], 403, "{response:?}");
+        let response = set_role(
+            &client,
+            &domain_ir,
+            "amy@example.com",
+            "zed@example.com",
+            "Member",
+        )
+        .await;
+        assert_eq!(response["statusCode"], 403, "{response:?}");
+
+        // Zed is the only admin that counts, so the last-admin guard protects him
+        // even though two rows hold the Admin role.
+        let response = set_role(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "zed@example.com",
+            "Member",
+        )
+        .await;
+        assert_eq!(response["statusCode"], 409, "{response:?}");
+        assert_eq!(
+            auth::set_person_disabled(
+                &client,
+                &members_config(),
+                &domain_ir,
+                "zed@example.com",
+                "zed@example.com",
+                true
+            )
+            .await
+            .unwrap(),
+            auth::DisableOutcome::SelfDisable
+        );
+
+        // Removing the expired admin is not refused: she was never one of the active admins.
+        let response = switch_access(
+            &client,
+            &domain_ir,
+            "zed@example.com",
+            "amy@example.com",
+            true,
+        )
+        .await;
+        assert_eq!(response["statusCode"], 200, "{response:?}");
+        assert_eq!(
+            person(&client, &domain_ir, "amy@example.com").await["disabled"],
+            true
+        );
+    }
+
+    #[tokio::test]
+    async fn a_second_admin_whose_window_ended_does_not_unlock_removing_the_last_active_one() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_last").await;
+        // amy would be the second admin, but she has run out: demoting zed through any
+        // other admin is impossible and zed alone is still protected from demotion.
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        assert_eq!(
+            auth::set_person_role(
+                &client,
+                &members_config(),
+                &domain_ir,
+                "zed@example.com",
+                "zed@example.com",
+                "Member"
+            )
+            .await
+            .unwrap(),
+            auth::RoleOutcome::LastAdmin
+        );
+    }
+
+    #[tokio::test]
+    async fn granting_with_a_window_sets_it_and_granting_again_renews_or_clears_it() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_expiry_grant").await;
+        let admin = session_cookies(secret, "zed@example.com");
+        let now = || {
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_secs() as i64
+        };
+        let ends = |person: &Value| {
+            crate::clock::parse_iso_utc(person["access_expires_at"].as_str().unwrap()).unwrap()
+        };
+
+        let first = members_page(
+            "POST",
+            &form_grant("amy%40example.com", "Member", "7"),
+            &admin,
+            secret,
+            &client,
+            &domain_ir,
+        )
+        .await;
+        assert_eq!(first["statusCode"], 302, "{first:?}");
+        let amy = person(&client, &domain_ir, "amy@example.com").await;
+        assert_eq!(amy["granted"], true);
+        assert!(
+            (ends(&amy) - (now() + 7 * 86_400)).abs() < 120,
+            "a seven day window: {amy}"
+        );
+
+        // Granting again extends the window from now.
+        let renewed = members_page(
+            "POST",
+            &form_grant("amy%40example.com", "Member", "30"),
+            &admin,
+            secret,
+            &client,
+            &domain_ir,
+        )
+        .await;
+        assert_eq!(renewed["statusCode"], 302, "{renewed:?}");
+        let amy = person(&client, &domain_ir, "amy@example.com").await;
+        assert!((ends(&amy) - (now() + 30 * 86_400)).abs() < 120, "{amy}");
+
+        // Renewal revives a lapsed row: the role comes back with the new window.
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        assert!(!auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        let revived = members_page(
+            "POST",
+            &form_grant("amy%40example.com", "Member", "1"),
+            &admin,
+            secret,
+            &client,
+            &domain_ir,
+        )
+        .await;
+        assert_eq!(revived["statusCode"], 302, "{revived:?}");
+        assert!(auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+
+        // A grant with an empty field makes the access open-ended again.
+        let open = members_page(
+            "POST",
+            &form_grant("amy%40example.com", "Member", ""),
+            &admin,
+            secret,
+            &client,
+            &domain_ir,
+        )
+        .await;
+        assert_eq!(open["statusCode"], 302, "{open:?}");
+        let amy = person(&client, &domain_ir, "amy@example.com").await;
+        assert_eq!(
+            (amy["access_expires_at"].clone(), amy["expired"].clone()),
+            (Value::Null, json!(false))
+        );
+    }
+
+    #[tokio::test]
+    async fn a_grant_with_an_unusable_expires_in_days_is_refused_and_writes_nothing() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_expiry_refuse").await;
+        let admin = session_cookies(secret, "zed@example.com");
+        let before = journal_rows(&client, "amy@example.com").await;
+
+        for bad in ["0", "-3", "366", "1.5", "soon", "99999999999999999999"] {
+            let form = members_page(
+                "POST",
+                &form_grant("amy%40example.com", "Member", bad),
+                &admin,
+                secret,
+                &client,
+                &domain_ir,
+            )
+            .await;
+            assert_eq!(form["statusCode"], 400, "form {bad}: {form:?}");
+        }
+        for bad in [
+            json!(0),
+            json!(366),
+            json!(1.5),
+            json!("soon"),
+            json!([7]),
+            json!(-1),
+        ] {
+            let body = json!({"email": "new@example.com", "name": "New", "expires_in_days": bad})
+                .to_string();
+            let response = add_member_route(
+                &domain_ir,
+                &body,
+                &admin,
+                secret,
+                &client,
+                Path::new("unused"),
+                &members_config(),
+            )
+            .await;
+            assert_eq!(response["statusCode"], 400, "json {bad}: {response:?}");
+        }
+        assert_eq!(journal_rows(&client, "amy@example.com").await, before);
+        assert_eq!(
+            auth::all_people(&client, &domain_ir).await.unwrap().len(),
+            2,
+            "nobody was admitted by a refused grant"
+        );
+        for edge in ["1", "365"] {
+            let form = members_page(
+                "POST",
+                &form_grant("amy%40example.com", "Member", edge),
+                &admin,
+                secret,
+                &client,
+                &domain_ir,
+            )
+            .await;
+            assert_eq!(form["statusCode"], 302, "{edge}: {form:?}");
+        }
+    }
+
+    #[tokio::test]
+    async fn the_json_admit_and_grant_route_takes_expires_in_days_as_a_number_or_a_string() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_expiry_json").await;
+        let admin = session_cookies(secret, "zed@example.com");
+        for (email, days) in [("a@example.com", json!(14)), ("b@example.com", json!("14"))] {
+            let body =
+                json!({"email": email, "name": "N", "role": "Member", "expires_in_days": days})
+                    .to_string();
+            let response = add_member_route(
+                &domain_ir,
+                &body,
+                &admin,
+                secret,
+                &client,
+                Path::new("unused"),
+                &members_config(),
+            )
+            .await;
+            assert_eq!(response["statusCode"], 201, "{response:?}");
+            let created: Value = serde_json::from_str(response["body"].as_str().unwrap()).unwrap();
+            assert_eq!(created["expired"], false);
+            let listed = person(&client, &domain_ir, email).await;
+            assert_eq!(listed["access_expires_at"], created["access_expires_at"]);
+            assert!(listed["access_expires_at"].as_str().unwrap().ends_with('Z'));
+            assert_eq!(listed["granted"], true);
+        }
+    }
+
+    #[tokio::test]
+    async fn the_members_page_shows_each_window_and_offers_the_days_field() {
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_page").await;
+        set_window(&client, "amy@example.com", json!(PAST)).await;
+        set_window(&client, "zed@example.com", json!(FUTURE)).await;
+        let page = admin_members_page(&client, &domain_ir).await;
+        assert!(page.contains(&format!("access ended {PAST}")), "{page}");
+        assert!(page.contains(&format!("linked, until {FUTURE}")), "{page}");
+        assert!(page.contains(r#"name="expires_in_days""#));
+    }
+
+    #[tokio::test]
+    async fn rows_without_a_window_behave_exactly_as_before() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_two_admins("hecks_host_web_test_expiry_none").await;
+        assert!(auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        assert_eq!(
+            auth::active_role(&client, &domain_ir, "amy@example.com")
+                .await
+                .unwrap()
+                .as_deref(),
+            Some("Admin")
+        );
+        assert_eq!(
+            accounts_me_route(
+                &domain_ir,
+                &session_cookies(secret, "zed@example.com"),
+                secret,
+                &client
+            )
+            .await["statusCode"],
+            200
+        );
+        // The disabled flag still works on its own, and a plain grant adds no field to the row.
+        assert_eq!(
+            switch_access(
+                &client,
+                &domain_ir,
+                "zed@example.com",
+                "amy@example.com",
+                true
+            )
+            .await["statusCode"],
+            200
+        );
+        assert!(!auth::has_access(&client, &domain_ir, "amy@example.com")
+            .await
+            .unwrap());
+        let guard = client.lock().await;
+        let with_field: i64 = guard
+            .query_one(
+                "SELECT count(*) FROM acme_member_head_snapshot_1 WHERE state ? 'access_expires_at'",
+                &[],
+            )
+            .await
+            .unwrap()
+            .get(0);
+        assert_eq!(with_field, 0);
+    }
+
     #[test]
     fn sorted_by_name_orders_case_insensitively_and_puts_a_missing_name_first() {
         let people = vec![