@adonis-agora/durable 1.0.0-rc.2 → 1.0.0-rc.20

package/dist/providers/dashboard_provider.js

@@ -3,18 +3,24 @@ import { basename, resolve as resolvePath } from 'node:path';
 import { PassThrough } from 'node:stream';
 import { fileURLToPath } from 'node:url';
 import { resolveAccessDeniedPage, } from '../src/dashboard/access_denied_page.js';
-import { performLogin, performSession, readSession, SESSION_COOKIE_NAME, sanitizeReturnTo, } from '../src/dashboard/auth.js';
+import { recordConsoleAudit } from '../src/dashboard/audit.js';
 import { compat, enumerateLiveFleet, mergeFleets, } from '../src/dashboard/compat.js';
-import { isProduction, normalizeAuthorizeResult, resolveConfig, } from '../src/dashboard/define_config.js';
+import { resolveSignOut, resolveViewer } from '../src/dashboard/console_shell.js';
+import { durableConsoleSearch, listVisibleConsoles, otherConsoles, readAgoraConsoles, registerAgoraConsole, searchConsoles, } from '../src/dashboard/console_switcher.js';
+import { NO_AUTHORIZE_WARNING, resolveConfig, } from '../src/dashboard/define_config.js';
+import { registerDurableDevTools } from '../src/dashboard/dev_tools.js';
 import { BlockedDiagnosticsRecorder } from '../src/dashboard/diagnostics-recorder.js';
-import { dashboardEngineForRole } from '../src/dashboard/gateway-adapter.js';
+import { dashboardEngineForTopology } from '../src/dashboard/gateway-adapter.js';
 import { bulkAction, cancelRun, completeTaskRun, continueRun, deliverWebhook, failTaskRun, getFanMembers, getRun, getRunEvent, health, listRuns, listSchedules, metricsText, redispatchPendingRun, republishLifecycleRun, retryRun, retryWithInputRun, runValues, scheduleAction, signalRun, topology, updateRun, workers, workflowLifecycle, } from '../src/dashboard/handlers.js';
-import { renderLoginPage } from '../src/dashboard/login_page.js';
 import { openApiDocument } from '../src/dashboard/openapi.js';
 import { contentTypeFor, renderIndexHtml } from '../src/dashboard/spa.js';
+import { resolveConsoleTenantScope, scopedDashboardEngine, } from '../src/dashboard/tenant_scope.js';
+import { registerDoctorChecks } from '../src/doctor/agora_doctor.js';
+import { durableConsoleDoctorChecks } from '../src/doctor/checks.js';
 import { WorkflowEngine } from '../src/index.js';
 import { collectMetrics } from '../src/metrics.js';
 import { DURABLE_TRANSPORT } from '../src/role_bindings.js';
+import { tenancyEnabled, tenancySlot } from '../src/tenancy.js';
 /**
  * Directory of the built SPA (`dist/spa`, copied in by `copy:stubs` — see `package.json`), relative to
  * this compiled provider (`dist/providers`). Resolved lazily (not at module scope) for the same reason
@@ -22,6 +28,8 @@ import { DURABLE_TRANSPORT } from '../src/role_bindings.js';
  * on any non-`file:` `import.meta.url`, which would make this provider unimportable under a test
  * runner that doesn't use real file URLs.
  */
+/** This console's id in the app's `'agora.consoles'` registry. */
+const CONSOLE_ID = 'durable';
 let spaDir;
 function spaDirectory() {
     spaDir ??= fileURLToPath(new URL('../assets/spa/', import.meta.url));
@@ -57,8 +65,10 @@ function spaDirectory() {
  * - `POST /api/bulk/:action`          -> bulk retry/cancel every run matching a filter
  * - `GET  /api/health`                -> worker-group health (compact shape)
  * - `GET  /api/workers`               -> worker-group health (full heartbeats; SPA)
- * - `GET  /api/topology`              -> this deployment's durable role
+ * - `GET  /api/topology`              -> this deployment's durable topology
  * - `GET  /api/compat`                -> fleet health / protocol-compatibility panel
+ * - `GET  /api/consoles`              -> the other Agora consoles this viewer may open (switcher)
+ * - `GET  /api/consoles/search?q=`    -> search across those consoles (and this one)
  * - `GET  /api/openapi.json`          -> the machine-readable API contract (OpenAPI 3.1)
  */
 export default class DashboardProvider {
@@ -66,65 +76,229 @@ export default class DashboardProvider {
     constructor(app) {
         this.app = app;
     }
-    /** Warn once so a throwing `login`/`session` hook doesn't spam the logs on every failed attempt. */
-    warnedOnHookThrow = false;
     warnedOnAuthorizeThrow = false;
-    /** Login-attempt timestamps per client address — a simple sliding window (10/min) so a brute
-     *  force can't hammer the host's `login` hook at line rate. In-memory per instance: a cluster
-     *  multiplies the budget by pod count, which still reduces the attack by orders of magnitude. */
-    loginAttempts = new Map();
-    /** True (and reply 429) when this address exhausted its login window. */
-    loginRateLimited(ctx) {
-        const WINDOW_MS = 60_000;
-        const MAX_ATTEMPTS = 10;
-        const key = ctx.request.ip() || 'unknown';
-        const now = Date.now();
-        const recent = (this.loginAttempts.get(key) ?? []).filter((t) => now - t < WINDOW_MS);
-        if (recent.length >= MAX_ATTEMPTS) {
-            this.loginAttempts.set(key, recent);
-            ctx.response.status(429).json({ error: 'too many login attempts — retry in a minute' });
-            return true;
-        }
-        recent.push(now);
-        this.loginAttempts.set(key, recent);
-        // Bounded: prune other addresses opportunistically so the map can't grow without limit.
-        if (this.loginAttempts.size > 10_000)
-            this.loginAttempts.clear();
-        return false;
-    }
+    /** Each request's `authorize` verdict, read again for the console's tenant scope. */
+    decisions = new WeakMap();
+    /** Each request's resolved tenant scope. */
+    scopes = new WeakMap();
     /** SSE connections currently open, per client address (and in total) — see streamRun. */
     sseByAddress = new Map();
     sseTotal = 0;
     /**
      * Captures the engine's `capability.unavailable` / `protocol.incompatible` diagnostics events so the
      * `/compat` health panel can render each blocked run's structured delta + the live-fleet compat view
-     * (design §7.6, §10). Store-role only — attached in {@link boot}; a `tenant` pod owns no engine.
+     * (design §7.6, §10). Store-topology only — attached in {@link boot}; a `tenant` pod owns no engine.
      */
     diagnostics = new BlockedDiagnosticsRecorder();
     /** Detach handle for the diagnostics subscription, released on {@link shutdown}. */
     detachDiagnostics = null;
-    /** This process's event counters for `GET /metrics` (store roles; a tenant pod has no engine). */
+    /** This process's event counters for `GET /metrics` (store topologies; a tenant pod has no engine). */
     metricsCollector = null;
-    /** The active durable role (`standalone` when no `durable` config is present — today's default). */
-    durableRole() {
-        return this.app.config.get('durable', {}).role ?? 'standalone';
+    /** The active durable topology (`standalone` when no `durable` config is present — today's default). */
+    durableTopology() {
+        return this.app.config.get('durable', {}).topology ?? 'standalone';
     }
     async boot() {
-        const config = resolveConfig(this.app.config.get('durable_dashboard', {}));
+        await registerDoctorChecks(this.app.container, durableConsoleDoctorChecks).catch(() => undefined);
+        const config = resolveConfig(this.app.config.get('durable_dashboard', {}), { inProduction: this.app.inProduction });
         if (!config.enabled)
             return;
-        const role = this.durableRole();
+        if (!config.authorizeConfigured)
+            await this.warnNoAuthorize();
+        const durableTopology = this.durableTopology();
+        // Developer tools on the app's dev MCP endpoint, when `@adonis-agora/agent/mcp_provider` bound
+        // its hub (its `register()` ran before any `boot()`). Gated by this console's own `authorize`.
+        await this.registerDevTools(config, durableTopology);
+        // The console switcher: this console joins the app's `'agora.consoles'` registry so the other
+        // Agora consoles can link to it (and search it), and it can link to them.
+        await this.registerConsole(config, durableTopology);
         // Route registration can't happen synchronously in `boot()` — see the long-standing note this
         // provider always carried: the router singleton isn't committed until the app's "booted" hooks
         // run, which fire strictly AFTER every provider's own `boot()`.
         await this.app.booted(async () => {
             const router = await this.app.container.make('router');
-            this.registerRoutes(router, config, role);
-            await this.attachDiagnostics(role);
+            this.registerRoutes(router, config, durableTopology);
+            await this.attachDiagnostics(durableTopology);
+        });
+    }
+    /**
+     * The console's read/control port, resolved per request (see {@link registerRoutes}). With tenancy
+     * on and a request at hand, it is confined to the tenants this viewer may see (see
+     * {@link consoleTenantScope}); the process counters, which span every tenant, are then left out
+     * unless the viewer sees every tenant.
+     */
+    consoleDeps(config, durableTopology) {
+        return async (ctx) => {
+            const base = await dashboardEngineForTopology(durableTopology, this.app.container, WorkflowEngine);
+            const scope = ctx ? await this.consoleTenantScope(config, ctx) : undefined;
+            const slot = scope ? tenancySlot() : undefined;
+            const engine = scope
+                ? scopedDashboardEngine(base, scope.ids, slot ? (fn) => slot.allTenants(fn) : undefined)
+                : base;
+            const metrics = scope && scope.ids !== undefined ? undefined : this.metricsCollector;
+            return {
+                engine,
+                ...(config.redact ? { redact: config.redact } : {}),
+                ...(metrics ? { metrics } : {}),
+            };
+        };
+    }
+    /** Whether tenancy is on for durable (config/durable.ts `tenancy`, else config/context.ts). */
+    tenancyOn() {
+        return tenancyEnabled(this.app.config.get('durable', {}).tenancy);
+    }
+    /**
+     * The tenants this viewer may see in the console, once per request, or `undefined` with tenancy
+     * off. `authorize` may grant `tenants` (`'*'` or a list); otherwise it is the viewer's own active
+     * tenant. A `?tenant=` pick outside the grant is answered with nothing and audited.
+     */
+    async consoleTenantScope(config, ctx) {
+        if (!this.tenancyOn())
+            return undefined;
+        const known = this.scopes.get(ctx);
+        if (known)
+            return known;
+        let decision = this.decisions.get(ctx);
+        if (decision === undefined) {
+            decision = await config.authorize(ctx);
+            this.decisions.set(ctx, decision);
+        }
+        const granted = decision.allowed ? decision.tenants : undefined;
+        const slot = tenancySlot();
+        const option = this.app.config.get('durable', {}).tenancy;
+        const kinds = typeof option === 'object' ? option.kinds : undefined;
+        // `tenancy.required` makes a missing tenant throw: in the console that is just "no organization".
+        let filter;
+        try {
+            filter = slot?.tenantFilter(kinds ? { kinds } : undefined);
+        }
+        catch {
+            filter = undefined;
+        }
+        const own = filter?.mode === 'tenant'
+            ? filter.tenant
+            : undefined;
+        const picked = ctx.request.qs().tenant;
+        const scope = resolveConsoleTenantScope({
+            granted,
+            own: own ? { id: own.id, kind: own.kind, slug: own.slug } : undefined,
+            selected: typeof picked === 'string' ? picked : undefined,
+        });
+        if (scope.forged) {
+            this.recordAudit(config, {
+                at: new Date(),
+                actor: auditActor(ctx),
+                method: 'TENANT',
+                path: `${ctx.request.url(false)} outside scope: tenant=${scope.selected ?? ''}`,
+            });
+        }
+        this.scopes.set(ctx, scope);
+        return scope;
+    }
+    async registerDevTools(config, durableTopology) {
+        const deps = this.consoleDeps(config, durableTopology);
+        // An auxiliary feature: a hub that throws must not take the app's boot down with it.
+        try {
+            await this.registerDurableDevToolsInto(config, deps);
+        }
+        catch (error) {
+            try {
+                const logger = await this.app.container.make('logger');
+                logger.warn(`[durable_dashboard] could not register the developer tools: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            catch {
+                /* logging must never break boot */
+            }
+        }
+    }
+    async registerDurableDevToolsInto(config, deps) {
+        await registerDurableDevTools(this.app.container, {
+            authorize: config.authorize,
+            deps,
+            audit: (entry) => this.recordAudit(config, {
+                at: new Date(),
+                actor: entry.actor,
+                method: 'MCP',
+                path: `${entry.tool} ${entry.target}`,
+            }),
+            compat: async () => {
+                const result = await compat(await this.compatSource((await deps()).engine));
+                return result.body;
+            },
         });
     }
-    async attachDiagnostics(role) {
-        if (role === 'tenant')
+    async registerConsole(config, durableTopology) {
+        const deps = this.consoleDeps(config, durableTopology);
+        let logger;
+        try {
+            logger = await this.app.container.make('logger');
+        }
+        catch {
+            logger = undefined;
+        }
+        await registerAgoraConsole(this.app.container, {
+            id: CONSOLE_ID,
+            title: 'Workflows',
+            package: '@adonis-agora/durable',
+            icon: 'workflow',
+            path: config.path === '' ? '/' : config.path,
+            order: 10,
+            authorize: config.authorize,
+            search: durableConsoleSearch(async (ctx) => {
+                const d = await deps(ctx);
+                return {
+                    getRun: (id) => d.engine.getRun(id),
+                    workflows: async (q, limit) => {
+                        const res = await runValues(d, {
+                            params: {},
+                            query: { field: 'workflow', search: q, limit: String(limit) },
+                        });
+                        return res.status === 200
+                            ? res.body
+                            : [];
+                    },
+                };
+            }, config.path),
+        }, logger);
+    }
+    /**
+     * What the console's "Organization" control shows: off (tenancy off), `none` (a viewer with no
+     * tenant), `fixed` (one tenant), or `pick` (several, or every tenant with `all`).
+     */
+    async tenantPicker(config, ctx) {
+        const scope = await this.consoleTenantScope(config, ctx);
+        if (!scope)
+            return { mode: 'off', all: false, selected: null, tenants: [] };
+        if (scope.authorized === 'none')
+            return { mode: 'none', all: false, selected: null, tenants: [] };
+        let ids;
+        if (scope.authorized === '*') {
+            // Every tenant that has runs, read across tenants.
+            const base = await dashboardEngineForTopology(this.durableTopology(), this.app.container, WorkflowEngine);
+            const slot = tenancySlot();
+            // Paged: every organization that has runs, not only the first page of them.
+            ids = [];
+            const facets = base.runValueFacets?.bind(base);
+            for (let offset = 0; facets && offset < 10_000; offset += 200) {
+                const page = () => facets({ field: 'tenant' }, {}, { limit: 200, offset });
+                const rows = (await (slot ? slot.allTenants(page) : page())) ?? [];
+                for (const row of rows)
+                    if (typeof row.value === 'string')
+                        ids.push(row.value);
+                if (rows.length < 200)
+                    break;
+            }
+        }
+        else {
+            ids = scope.authorized;
+        }
+        const labels = await tenantLabelsFor(ids, scope.own);
+        const tenants = ids.map((id) => ({ id, label: labels[id] ?? id }));
+        const mode = scope.authorized === '*' || ids.length > 1 ? 'pick' : 'fixed';
+        return { mode, all: scope.authorized === '*', selected: scope.selected ?? null, tenants };
+    }
+    async attachDiagnostics(durableTopology) {
+        if (durableTopology === 'tenant')
             return;
         // A warmed-up app (`node ace codegen`) never starts nor shuts down: resolving the engine would open
         // the transport/store connections nothing closes, and the command would never exit. The routes are
@@ -142,23 +316,12 @@ export default class DashboardProvider {
             // No store-backed engine available — the compat panel degrades to reason-only blocked runs.
         }
     }
-    registerRoutes(router, config, role) {
+    registerRoutes(router, config, durableTopology) {
         const apiBase = `${config.path}/api`;
-        // Resolve the dashboard's read/control port lazily per request, branched by role (design §5/§8):
-        // a store role adapts the engine (built by @adonis-agora/durable's provider); a store-less `tenant`
+        // Resolve the dashboard's read/control port lazily per request, branched by topology (design §5/§8):
+        // a store topology adapts the engine (built by @adonis-agora/durable's provider); a store-less `tenant`
         // pod resolves the DURABLE_RUN_GATEWAY token (a ProxyRunGateway) and adapts it — NO engine, NO store.
-        const resolveEngine = () => dashboardEngineForRole(role, this.app.container, WorkflowEngine);
-        const deps = async () => ({
-            engine: await resolveEngine(),
-            ...(config.redact ? { redact: config.redact } : {}),
-            ...(this.metricsCollector ? { metrics: this.metricsCollector } : {}),
-        });
-        // Built-in `dashboardAuth` (Mode A `session` and/or Mode B `login`, opt-in). Registered ONLY when
-        // configured, so omitting `dashboardAuth` leaves route registration byte-for-byte as it was. These
-        // endpoints are public (behind NEITHER guard): they MINT the session the guard checks for.
-        if (config.dashboardAuth) {
-            this.registerAuthRoutes(router, config, config.dashboardAuth);
-        }
+        const deps = this.consoleDeps(config, durableTopology);
         this.registerSpaRoutes(router, config, apiBase);
         // JSON API.
         const json = (handler) => {
@@ -170,7 +333,7 @@ export default class DashboardProvider {
                 if (isMutatingMethod(ctx))
                     this.audit(config, ctx);
                 try {
-                    const result = await handler(await deps(), toApiRequest(ctx));
+                    const result = await handler(await deps(ctx), toApiRequest(ctx));
                     for (const [name, value] of Object.entries(result.headers ?? {})) {
                         ctx.response.header(name, value);
                     }
@@ -238,7 +401,7 @@ export default class DashboardProvider {
             if (!(await this.enforce(config, ctx, 'api')))
                 return;
             try {
-                const text = await metricsText(await deps());
+                const text = await metricsText(await deps(ctx));
                 ctx.response.header('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
                 return ctx.response.status(200).send(text);
             }
@@ -263,6 +426,60 @@ export default class DashboardProvider {
             .post(`${apiBase}/schedules/:key/:action`, json(scheduleAction))
             .as('durable_dashboard.schedules.action');
         router.post(`${apiBase}/bulk/:action`, json(bulkAction)).as('durable_dashboard.bulk');
+        // Tenancy: which organizations this viewer may pick, and an audited record of a switch.
+        router
+            .get(`${apiBase}/tenants`, async (ctx) => {
+            if (!(await this.enforce(config, ctx, 'api')))
+                return;
+            ctx.response.header('cache-control', 'private, no-store');
+            try {
+                return ctx.response.status(200).json(await this.tenantPicker(config, ctx));
+            }
+            catch (error) {
+                void this.logServerError(error);
+                return ctx.response.status(500).json({ error: 'internal error' });
+            }
+        })
+            .as('durable_dashboard.tenants');
+        router
+            .post(`${apiBase}/tenants/:id/select`, async (ctx) => {
+            if (!(await this.enforce(config, ctx, 'api')))
+                return;
+            // The audit line (actor, `POST …/tenants/<id>/select`) is the record of the switch.
+            this.audit(config, ctx);
+            const scope = await this.consoleTenantScope(config, ctx);
+            const id = String(ctx.params.id);
+            const allowed = scope === undefined ||
+                id === '*' ||
+                scope.authorized === '*' ||
+                (Array.isArray(scope.authorized) && scope.authorized.includes(id));
+            return ctx.response
+                .status(allowed ? 200 : 404)
+                .json(allowed ? { tenant: id } : { error: 'not found' });
+        })
+            .as('durable_dashboard.tenants.select');
+        // The console switcher: the other Agora consoles this viewer may open, and a search across them.
+        router
+            .get(`${apiBase}/consoles`, async (ctx) => {
+            if (!(await this.enforce(config, ctx, 'api')))
+                return;
+            const registry = await readAgoraConsoles(this.app.container);
+            ctx.response.header('cache-control', 'private, no-store');
+            return ctx.response.status(200).json(await listVisibleConsoles(registry, CONSOLE_ID, ctx));
+        })
+            .as('durable_dashboard.consoles');
+        router
+            .get(`${apiBase}/consoles/search`, async (ctx) => {
+            if (!(await this.enforce(config, ctx, 'api')))
+                return;
+            const registry = await readAgoraConsoles(this.app.container);
+            const q = ctx.request.qs().q;
+            ctx.response.header('cache-control', 'private, no-store');
+            return ctx.response
+                .status(200)
+                .json(await searchConsoles(registry, CONSOLE_ID, ctx, typeof q === 'string' ? q : ''));
+        })
+            .as('durable_dashboard.consoles.search');
         router
             .get(`${apiBase}/health`, json((d) => health(d)))
             .as('durable_dashboard.health');
@@ -276,8 +493,8 @@ export default class DashboardProvider {
             // Only a `TenantConfig` carries a `partition` (its `<name>@<tenant>` routing suffix, spec
             // §6.1) — the field this dashboard's `DurableTopology.tenant` badge actually names.
             const durableConfig = this.app.config.get('durable', {});
-            const tenant = durableConfig.role === 'tenant' ? durableConfig.partition : undefined;
-            const result = topology(role, tenant);
+            const tenant = durableConfig.topology === 'tenant' ? durableConfig.partition : undefined;
+            const result = topology(durableTopology, tenant);
             return ctx.response.status(result.status).json(result.body);
         })
             .as('durable_dashboard.topology');
@@ -288,7 +505,11 @@ export default class DashboardProvider {
             if (!(await this.enforce(config, ctx, 'api')))
                 return;
             const id = ctx.params.id;
-            const engine = await resolveEngine();
+            const { engine } = await deps(ctx);
+            // A run outside the viewer's tenants streams nothing: answer like an unknown run.
+            if ((await engine.getRun(id)) === null && this.tenancyOn()) {
+                return ctx.response.status(404).json({ error: `run ${id} not found` });
+            }
             await this.streamRun(ctx, engine, id);
         })
             .as('durable_dashboard.runs.stream');
@@ -299,7 +520,7 @@ export default class DashboardProvider {
             if (!(await this.enforce(config, ctx, 'api')))
                 return;
             try {
-                const result = await compat(await this.compatSource(await resolveEngine()));
+                const result = await compat(await this.compatSource((await deps(ctx)).engine));
                 return ctx.response.status(result.status).json(result.body);
             }
             catch (error) {
@@ -309,6 +530,22 @@ export default class DashboardProvider {
         })
             .as('durable_dashboard.compat');
     }
+    /**
+     * The console-shell fields of the page's data block: the switcher, ⌘K search (whenever a console
+     * registry exists — this console registers its own search), the signed-in viewer and the
+     * sign-out (the host's option, else the one an account console announced on the registry).
+     */
+    async shellFields(config, ctx, apiBase) {
+        const registry = await readAgoraConsoles(this.app.container);
+        const viewer = await resolveViewer(ctx, config.viewer);
+        const signOut = resolveSignOut(ctx, config.signOut, registry);
+        return {
+            switcher: { endpoint: `${apiBase}/consoles`, others: otherConsoles(registry, CONSOLE_ID) },
+            ...(registry ? { search: { endpoint: `${apiBase}/consoles/search` } } : {}),
+            ...(viewer ? { viewer } : {}),
+            ...(signOut ? { signOut } : {}),
+        };
+    }
     /** Mount the React SPA at `config.path` plus its hashed asset bundle. */
     registerSpaRoutes(router, config, apiBase) {
         const indexPath = config.path === '' ? '/' : config.path;
@@ -328,7 +565,7 @@ export default class DashboardProvider {
             return ctx.response
                 .header('content-type', 'text/html; charset=utf-8')
                 .header('cache-control', 'no-store, must-revalidate')
-                .send(renderIndexHtml(html, config.path, apiBase));
+                .send(renderIndexHtml(html, config.path, apiBase, await this.shellFields(config, ctx, apiBase)));
         })
             .as('durable_dashboard.index');
         router
@@ -424,131 +661,24 @@ export default class DashboardProvider {
             return null;
         }
     }
-    /**
-     * Mount the built-in `dashboardAuth` endpoints under `basePath`. All are public (no guard): they
-     * create/destroy the session the {@link enforce} guard checks for.
-     *
-     * - `GET  <base>/login`  -> the server-rendered login page (Mode B only).
-     * - `POST <base>/login`  -> verifies credentials via the host `login` hook and mints the cookie.
-     * - `POST <base>/session` -> Mode A: verifies the HOST APP's own auth (off the raw request) via the
-     *    `session` hook and mints the cookie. No body — the hook reads whatever it needs off `request`.
-     *    `204` on success, uniform `401` on denial. Mirrors `@dudousxd/nestjs-durable-dashboard`'s
-     *    `DurableAuthController.session` and `client/console-session.ts`'s `mintDurableConsoleSession`.
-     * - `GET  <base>/logout` -> clears the cookie and redirects to the login page (Mode B) or the
-     *    dashboard root (Mode A only). A plain `GET` (idempotent, only ever destroys the caller's own
-     *    session) so a simple `<a href>` works.
-     */
-    registerAuthRoutes(router, config, auth) {
-        const loginPath = `${config.path}/login`;
-        const sessionPath = `${config.path}/session`;
-        const logoutPath = `${config.path}/logout`;
-        if (auth.login) {
-            router
-                .get(loginPath, async (ctx) => {
-                ctx.response.header('content-type', 'text/html; charset=utf-8');
-                ctx.response.header('cache-control', 'no-store, must-revalidate');
-                const qs = ctx.request.qs();
-                const nonce = cspNonce(ctx);
-                return ctx.response.send(renderLoginPage(config.path, {
-                    ...(nonce !== undefined ? { nonce } : {}),
-                    error: qs.error !== undefined,
-                    returnTo: qs.returnTo,
-                }));
-            })
-                .as('durable_dashboard.login.page');
-            // Two callers: the page's own `fetch` (JSON in, JSON out — `{ redirectTo }` / `{ error }`)
-            // and, with JavaScript off or its inline script dropped by a CSP, the same page as a classic
-            // form post (form-encoded in, a redirect out: to `returnTo` on success, back to the login
-            // page with `?error` on failure). Same hook, same cookie, same uniform failure either way.
-            router
-                .post(loginPath, async (ctx) => {
-                if (this.loginRateLimited(ctx))
-                    return;
-                const body = ctx.request.body();
-                const outcome = await performLogin(auth, body, config.path);
-                const form = isFormPost(ctx);
-                const backToLogin = () => ctx.response
-                    .redirect()
-                    .withQs({
-                    error: '1',
-                    returnTo: sanitizeReturnTo(body?.returnTo, config.path || '/'),
-                })
-                    .toPath(loginPath);
-                if (outcome.kind === 'bad-request') {
-                    if (form)
-                        return backToLogin();
-                    return ctx.response.status(400).json({ error: outcome.message });
-                }
-                if (outcome.kind === 'unauthorized') {
-                    void this.warnHookThrow(outcome.hookError).catch(() => undefined);
-                    if (form)
-                        return backToLogin();
-                    return ctx.response.status(401).json({ error: outcome.message });
-                }
-                this.writeSessionCookie(ctx, auth, outcome.cookieValue);
-                if (form)
-                    return ctx.response.redirect().toPath(outcome.redirectTo);
-                return ctx.response.status(200).json({ redirectTo: outcome.redirectTo });
-            })
-                .as('durable_dashboard.login.submit');
-        }
-        if (auth.session) {
-            router
-                .post(sessionPath, async (ctx) => {
-                if (this.loginRateLimited(ctx))
-                    return;
-                const outcome = await performSession(auth, ctx.request.request);
-                if (outcome.kind === 'unauthorized') {
-                    void this.warnHookThrow(outcome.hookError).catch(() => undefined);
-                    return ctx.response.status(401).json({ error: 'unauthorized' });
-                }
-                this.writeSessionCookie(ctx, auth, outcome.cookieValue);
-                return ctx.response.status(204).send('');
-            })
-                .as('durable_dashboard.session.mint');
-        }
-        const logout = async (ctx) => {
-            ctx.response.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
-            return ctx.response.redirect().toPath(auth.login ? loginPath : config.path || '/');
-        };
-        router.get(logoutPath, logout).as('durable_dashboard.logout');
-        // POST too: the CSRF-proof spelling for clients that prefer it (the GET stays for plain <a>
-        // links — it only ever destroys the caller's own session, so a forced logout is an annoyance,
-        // not a compromise).
-        router.post(logoutPath, logout).as('durable_dashboard.logout.post');
-    }
     /** Record one mutating console action (see DashboardAuditEntry). Never throws into the request. */
     audit(config, ctx) {
         try {
-            const auth = config.dashboardAuth;
-            const session = auth ? readSession(auth, this.readSessionCookie(ctx)) : null;
-            const fromToken = ctx.request.header('authorization') !== undefined ||
-                ctx.request.header('x-durable-token') !== undefined;
-            const actor = session?.name ?? session?.sub ?? (fromToken ? 'token' : 'anonymous');
-            const entry = {
+            this.recordAudit(config, {
                 at: new Date(),
-                actor,
+                actor: auditActor(ctx),
                 method: ctx.request.method().toUpperCase(),
                 path: ctx.request.url(false),
-            };
-            if (config.audit) {
-                // Typed `void`, but an async hook is assignable to it: catch its rejection too.
-                const pending = config.audit(entry);
-                if (pending instanceof Promise)
-                    pending.catch(() => undefined);
-                return;
-            }
-            void this.app.container
-                .make('logger')
-                .then((logger) => {
-                logger.info(`[durable_dashboard] audit actor=${entry.actor} ${entry.method} ${entry.path}`);
-            })
-                .catch(() => undefined);
+            });
         }
         catch {
             /* auditing must never break the action */
         }
     }
+    /** Hand one audit entry to the host's sink, or the default logger line. Never throws. */
+    recordAudit(config, entry) {
+        recordConsoleAudit(config.audit, () => this.app.container.make('logger'), entry);
+    }
     /** Route a handler 500's detail to the app logger (the client only ever sees a generic body). */
     async logServerError(error) {
         try {
@@ -567,95 +697,67 @@ export default class DashboardProvider {
         const logger = await this.app.container.make('logger');
         logger.warn(`[durable_dashboard] authorize hook threw; treating as denial (403). ${message}`);
     }
-    async warnHookThrow(hookError) {
-        if (hookError === undefined || this.warnedOnHookThrow)
-            return;
-        this.warnedOnHookThrow = true;
-        const message = hookError instanceof Error ? hookError.message : String(hookError);
-        const logger = await this.app.container.make('logger');
-        logger.warn(`dashboardAuth login/session hook threw; treating as denial. ${message}`);
+    /** The once-per-boot warning for a console with no `authorize` (open in dev, 403 in production). */
+    async warnNoAuthorize() {
+        try {
+            const logger = await this.app.container.make('logger');
+            logger.warn(NO_AUTHORIZE_WARNING);
+        }
+        catch {
+            console.warn(NO_AUTHORIZE_WARNING);
+        }
     }
     /**
-     * Run the guards for a dashboard resource. Composes the existing `authorize` hook (bearer
-     * token/custom) with the optional `dashboardAuth` session guard — BOTH must pass:
+     * Run `authorize` for a dashboard resource. On a denial:
      *
-     * 1. `authorize` denies -> the built-in (or host-customised) access-denied PAGE for a `page`
-     *    request, JSON for an `api` request. `reason: 'unauthenticated'` is a `401`
-     *    (`{ error: 'unauthorized' }`); `false`, `{ allowed: false }`, `reason: 'forbidden'` or a
-     *    throwing hook is a `403` (`{ error: 'forbidden' }`). A hook that already answered the request
-     *    (a redirect, a body) keeps its answer.
-     * 2. `dashboardAuth` configured AND no valid session -> for a `page` request, redirect `302` to
-     *    the login page (Mode B) carrying a sanitized `returnTo`, or the `401` "open this console
-     *    from your app" page (Mode A only, no login page to redirect to); for an `api` request, a
-     *    plain `401 { error: 'unauthorized', auth: { modes } }` — the `modes` list lets the SPA's
-     *    client (`durable-client.ts`) decide whether to offer the login page.
+     * - `{ redirectTo }`: a `page` request is redirected there (`302`); an `api` request gets
+     *   `401 { error: 'unauthenticated', redirectTo }`;
+     * - `reason: 'unauthenticated'`: `401` (the access-denied page, or `{ error: 'unauthenticated' }`);
+     * - anything else (`false`, `{ allowed: false }`, a throw): `403` (the access-denied page, or
+     *   `{ error: 'forbidden' }`).
      *
-     * When `dashboardAuth` is unconfigured only step 1 runs.
+     * A hook that already answered the request (a redirect, a body) keeps its answer.
      * Returns `false` (and has already written the response) when the request must short-circuit.
      */
     async enforce(config, ctx, mode) {
-        // CSRF defense-in-depth over the Lax session cookie: a browser-originated CROSS-SITE mutating
-        // request is rejected outright, whatever guard would have passed it. The mutating endpoints
-        // need no body and read flags from the query string, so without this a malicious page could
-        // fire them as SIMPLE cross-origin POSTs (no preflight) against a console the operator's
-        // browser is authenticated to. Non-browser clients send neither header and pass.
+        // CSRF defense-in-depth: a browser-originated CROSS-SITE mutating request is rejected outright,
+        // whatever `authorize` would say. The mutating endpoints need no body and read flags from the
+        // query string, so without this a malicious page could fire them as SIMPLE cross-origin POSTs
+        // (no preflight) against a console the operator's browser is signed in to. Non-browser clients
+        // send neither header and pass.
         if (mode === 'api' && isMutatingMethod(ctx) && crossSiteRequest(ctx)) {
             ctx.response.status(403).json({ error: 'cross-site request rejected' });
             return false;
         }
-        // Never test the raw result: a decision OBJECT is truthy, so `{ allowed: false }` would pass a
-        // `!result` check. A throwing hook is a denial (403), never a 500 and never a pass.
-        let decision;
-        try {
-            decision = normalizeAuthorizeResult(await config.authorize(ctx));
-        }
-        catch (error) {
-            void this.warnAuthorizeThrow(error).catch(() => undefined);
-            decision = { allowed: false, reason: 'forbidden' };
-        }
-        if (!decision.allowed) {
-            const unauthenticated = decision.reason === 'unauthenticated';
-            if (mode === 'page') {
-                await this.denyPage(ctx, config, unauthenticated
-                    ? { status: 401, reason: 'unauthenticated' }
-                    : { status: 403, reason: 'forbidden' });
-            }
-            else if (!responseAnswered(ctx)) {
-                ctx.response
-                    .status(unauthenticated ? 401 : 403)
-                    .json({ error: unauthenticated ? 'unauthorized' : 'forbidden' });
-            }
-            return false;
-        }
-        const auth = config.dashboardAuth;
-        if (!auth)
+        // The resolved gate never throws: a throwing `authorize` comes back as a 403 carrying the error.
+        const decision = await config.authorize(ctx);
+        this.decisions.set(ctx, decision);
+        if (decision.allowed)
             return true;
-        const session = readSession(auth, this.readSessionCookie(ctx));
-        if (session) {
-            // Role convention: a session WITHOUT roles keeps full access (back-compat — most host hooks
-            // never set them); a session WITH roles must carry `operator` (or `admin`) to mutate.
-            // Previously every authenticated principal — including a read-only support login — could
-            // bulk-cancel with compensation or fix-and-replay.
-            if (mode === 'api' && isMutatingMethod(ctx) && !sessionCanMutate(session)) {
-                ctx.response
-                    .status(403)
-                    .json({ error: "this session's roles do not include 'operator' (or 'admin')" });
-                return false;
-            }
-            return true;
-        }
+        if (decision.error !== undefined)
+            void this.warnAuthorizeThrow(decision.error).catch(() => undefined);
+        const unauthenticated = decision.reason === 'unauthenticated';
         if (mode === 'page') {
-            if (auth.login) {
-                const returnTo = ctx.request.url(true);
-                ctx.response.redirect().withQs('returnTo', returnTo).toPath(`${config.path}/login`);
+            if (decision.redirectTo !== undefined && !responseAnswered(ctx)) {
+                ctx.response.redirect().toPath(decision.redirectTo);
                 return false;
             }
-            // Mode A only: there's no login page to send the browser to — this deployment expects the
-            // host app to mint a session via `POST <path>/session` before ever navigating here.
-            await this.denyPage(ctx, config, { status: 401, reason: 'session-required' });
+            await this.denyPage(ctx, config, unauthenticated
+                ? { status: 401, reason: 'unauthenticated' }
+                : { status: 403, reason: 'forbidden' });
+            return false;
+        }
+        if (responseAnswered(ctx))
             return false;
+        if (!unauthenticated) {
+            ctx.response.status(403).json({ error: 'forbidden' });
+        }
+        else if (decision.redirectTo !== undefined) {
+            ctx.response.status(401).json({ error: 'unauthenticated', redirectTo: decision.redirectTo });
+        }
+        else {
+            ctx.response.status(401).json({ error: 'unauthenticated' });
         }
-        ctx.response.status(401).json({ error: 'unauthorized', auth: { modes: auth.modes } });
         return false;
     }
     /**
@@ -672,7 +774,6 @@ export default class DashboardProvider {
         const info = {
             ...denial,
             basePath: config.path,
-            ...(config.dashboardAuth?.login ? { loginHref: `${config.path}/login` } : {}),
             ...(nonce !== undefined ? { nonce } : {}),
         };
         const html = await resolveAccessDeniedPage(info, config.accessDenied, ctx, answered);
@@ -684,22 +785,6 @@ export default class DashboardProvider {
             .header('cache-control', 'no-store, must-revalidate')
             .send(html);
     }
-    readSessionCookie(ctx) {
-        const value = ctx.request.plainCookie(SESSION_COOKIE_NAME, undefined, false);
-        return typeof value === 'string' && value !== '' ? value : undefined;
-    }
-    writeSessionCookie(ctx, auth, value) {
-        ctx.response.plainCookie(SESSION_COOKIE_NAME, value, {
-            httpOnly: true,
-            sameSite: 'lax',
-            // Forced on in production even when `request.secure()` reads false (a TLS-terminating proxy
-            // without AdonisJS trustProxy) — exactly the deployments that most need the Secure flag.
-            secure: isProduction() || ctx.request.secure(),
-            path: '/',
-            maxAge: Math.floor(auth.ttlMs / 1000),
-            encode: false,
-        });
-    }
     async shutdown() {
         this.detachDiagnostics?.();
         this.detachDiagnostics = null;
@@ -707,12 +792,6 @@ export default class DashboardProvider {
         this.metricsCollector = null;
     }
 }
-/**
- * Whether something already answered this request: a redirect (`location` header — the signal the
- * `authorize` contract has always honoured) or a body queued on the response. The body check reads
- * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
- * (which has neither) still works.
- */
 /** Whether this request can change state (everything but GET/HEAD/OPTIONS). Exported for tests. */
 export function isMutatingMethod(ctx) {
     const method = ctx.request.method().toUpperCase();
@@ -739,15 +818,12 @@ export function crossSiteRequest(ctx) {
         return true; // an unparseable Origin is not a browser being honest — reject
     }
 }
-/** Role convention (see enforce): no roles = full access; with roles, mutating needs operator/admin. */
-export function sessionCanMutate(session) {
-    if (session.roles.length === 0)
-        return true;
-    return session.roles.some((r) => {
-        const role = r.toLowerCase();
-        return role === 'operator' || role === 'admin';
-    });
-}
+/**
+ * Whether something already answered this request: a redirect (`location` header — the signal the
+ * `authorize` contract has always honoured) or a body queued on the response. The body check reads
+ * AdonisJS's `response.hasLazyBody` structurally so a plain-object `ctx` double in a unit test
+ * (which has neither) still works.
+ */
 function responseAnswered(ctx) {
     if (ctx.response.getHeader('location'))
         return true;
@@ -764,21 +840,56 @@ function cspNonce(ctx) {
     return typeof nonce === 'string' && nonce !== '' ? nonce : undefined;
 }
 /**
- * Whether a login `POST` came from a classic HTML form submit (form-encoded — JavaScript off, or
- * the page's inline script dropped by a CSP) rather than the page's own JSON `fetch`. Decides
- * whether the reply is a redirect (a browser navigating) or JSON (a script awaiting it).
+ * Who a mutating console action is attributed to: the signed-in user (`ctx.auth.user`'s `email`,
+ * `name` or `id`, read structurally — this package does not depend on `@adonisjs/auth`), `'bearer'`
+ * for a caller with an `Authorization` header and no user, else `'anonymous'`.
  */
-function isFormPost(ctx) {
-    const type = ctx.request.header('content-type') ?? '';
-    return type.includes('application/x-www-form-urlencoded') || type.includes('multipart/form-data');
+export function auditActor(ctx) {
+    const user = ctx.auth?.user;
+    if (user) {
+        for (const key of ['email', 'name', 'id']) {
+            const value = user[key];
+            if (typeof value === 'string' && value !== '')
+                return value;
+            if (typeof value === 'number')
+                return String(value);
+        }
+    }
+    return ctx.request.header('authorization') !== undefined ? 'bearer' : 'anonymous';
 }
 /** Adapt an AdonisJS `HttpContext` to the framework-light {@link ApiRequest}. */
 function toApiRequest(ctx) {
     return {
         params: ctx.params,
-        query: ctx.request.qs(),
+        // `tenant` picks the console's organization (see consoleTenantScope); it is not a run filter.
+        query: withoutTenantParam(ctx.request.qs()),
         body: ctx.request.body(),
         headers: { 'if-none-match': ctx.request.header('if-none-match') },
     };
 }
+function withoutTenantParam(query) {
+    if (!('tenant' in query))
+        return query;
+    const { tenant: _tenant, ...rest } = query;
+    return rest;
+}
+/**
+ * Display labels for tenant ids: the viewer's own tenant by its slug, the rest through context's
+ * label resolver (`tenancy.label` in config/context.ts, or the one authkit installs), else the id.
+ */
+async function tenantLabelsFor(ids, own) {
+    const labels = {};
+    const slot = tenancySlot();
+    if (slot?.tenantLabels && ids.length > 0) {
+        try {
+            Object.assign(labels, await slot.tenantLabels(ids));
+        }
+        catch {
+            /* labels are cosmetic: fall back to ids */
+        }
+    }
+    if (own?.slug && labels[own.id] === undefined)
+        labels[own.id] = own.slug;
+    return labels;
+}
 //# sourceMappingURL=dashboard_provider.js.map