@bevel-software/platform-core-backend 0.32.0 → 0.34.0

package/src/modules/auth/__tests__/auth.service.test.ts

@@ -3,11 +3,12 @@ import { PgDialect } from 'drizzle-orm/pg-core';
 import type { SQL } from 'drizzle-orm';
 import type { Database } from '../../database/connection.js';
 import type { CoreConfig } from '../../../core-config.js';
-import { AuthService } from '../auth.service.js';
-import { AccountAdmissionRefusedError, type IAccountAdmission } from '../account-admission.js';
+import jwt from 'jsonwebtoken';
+import { AuthService, PasswordChangedMeanwhileError, PasswordRefusedError } from '../auth.service.js';
+import { AccountAdmissionRefusedError, SessionEndedError, type IAccountAdmission } from '../account-admission.js';
 import { hashPassword, verifyPassword } from '../password-hash.js';
-import { RECOVERY_BOT_EMAIL } from '../../workflow/recovery-bot.js';
-import { DIRECTORY_SYNC_BOT_EMAIL } from '../../access/directory-sync-bot.js';
+import { RECOVERY_BOT_EMAIL } from '../../workflow/index.js';
+import { DIRECTORY_SYNC_BOT_EMAIL } from '../../access/index.js';
 
 /**
  * Minimal drizzle chain stub (same idiom as the secrets-vault tests): each
@@ -78,8 +79,12 @@ const ROW = {
   // always has a boolean here, so the fixture carries one rather than letting
   // every asserted payload read `undefined`.
   onboardingDone: false,
+  sessionVersion: 0,
 };
 
+/** What a password change's conditional write hands back: the row, one session generation on. */
+const CHANGED = [{ ...ROW, sessionVersion: 1 }];
+
 describe('AuthService.loginWithPassword — env bootstrap admin', () => {
   const config = makeConfig({ adminEmail: 'root@example.com', adminPassword: 'sup3r-secret' });
 
@@ -283,14 +288,14 @@ describe('AuthService.createAccount / changePassword', () => {
       new AuthService(wrong.db, makeConfig()).changePassword('user-1', 'not-it', 'new-password-1'),
     ).rejects.toThrow('Current password is incorrect');
 
-    const right = makeFakeDb([[{ ...ROW, passwordHash }], undefined]);
+    const right = makeFakeDb([[{ ...ROW, passwordHash }], CHANGED]);
     await expect(
       new AuthService(right.db, makeConfig()).changePassword('user-1', 'old-password', 'new-password-1'),
-    ).resolves.toBeUndefined();
+    ).resolves.toMatchObject({ token: expect.any(String) });
   });
 
   it('changePassword lets an SSO-only account set its first password without one', async () => {
-    const { db, captured } = makeFakeDb([[{ ...ROW, passwordHash: null }], undefined]);
+    const { db, captured } = makeFakeDb([[{ ...ROW, passwordHash: null }], CHANGED]);
     await new AuthService(db, makeConfig()).changePassword('user-1', undefined, 'first-password');
     const set = captured.set[0] as { passwordHash: string };
     expect(set.passwordHash.startsWith('scrypt:')).toBe(true);
@@ -452,7 +457,7 @@ describe('AuthService.changePassword — the three account kinds', () => {
       });
 
       it('stores a new hash for the right current password', async () => {
-        const { db, captured } = makeFakeDb([[await row()], undefined]);
+        const { db, captured } = makeFakeDb([[await row()], CHANGED]);
         await new AuthService(db, makeConfig(ENV_ADMIN)).changePassword(
           kind.id,
           'old-password',
@@ -585,7 +590,7 @@ describe('AuthService.changePassword — the three account kinds', () => {
       ).getUserById('user-root');
       expect(flagged?.isEnvAdmin).toBe(false);
 
-      const { db, captured } = makeFakeDb([[{ ...rootRow, passwordHash }], undefined]);
+      const { db, captured } = makeFakeDb([[{ ...rootRow, passwordHash }], CHANGED]);
       await new AuthService(db, config).changePassword('user-root', 'old-password', 'new-password-1');
       expect((captured.set[0] as { passwordHash: string }).passwordHash.startsWith('scrypt:')).toBe(
         true,
@@ -594,6 +599,82 @@ describe('AuthService.changePassword — the three account kinds', () => {
   });
 });
 
+/**
+ * A password change ends the sessions opened before it. The real-Postgres
+ * half (`password-change-sessions.pg.test.ts`) proves it end to end; these
+ * pin the service's side without a database.
+ */
+describe('AuthService.changePassword — the sessions opened before it', () => {
+  const ON = { deactivatedAt: null };
+
+  it('refuses a session issued before the change, and accepts the token the change hands back', async () => {
+    const passwordHash = await hashPassword('old-password');
+    const { db } = makeFakeDb([
+      [{ ...ROW, passwordHash }], // sign-in
+      [{ ...ROW, passwordHash }], // the change reads the row...
+      CHANGED, // ...and writes it one generation on
+      [{ ...ON, ...CHANGED[0] }], // the old token's lookup...
+      [{ ...ON, ...CHANGED[0] }], // ...and the new one's: a session is never answered from the cache
+    ]);
+    const svc = new AuthService(db, makeConfig());
+    const before = await svc.loginWithPassword('alice@example.com', 'old-password');
+    const { token } = await svc.changePassword('user-1', 'old-password', 'new-password-1');
+    // Named, and worded for the person: the middleware shows these words
+    // where a bare "invalid token" would leave them guessing.
+    const ended = svc.resolveSession(before.token);
+    await expect(ended).rejects.toBeInstanceOf(SessionEndedError);
+    await expect(ended).rejects.toThrow(/password was changed after this session was opened/);
+    await expect(svc.resolveSession(token)).resolves.toEqual({ userId: ROW.id, email: ROW.email });
+  });
+
+  it('refuses a wrong current password as a refusal the caller is told, not a fault', async () => {
+    const passwordHash = await hashPassword('old-password');
+    const { db } = makeFakeDb([[{ ...ROW, passwordHash }]]);
+    const refused = new AuthService(db, makeConfig()).changePassword('user-1', 'not-it', 'new-password-1');
+    await expect(refused).rejects.toBeInstanceOf(PasswordRefusedError);
+    await expect(refused).rejects.toThrow('Current password is incorrect');
+  });
+
+  it('reads the account row for every session it resolves, whatever the cache holds', async () => {
+    // Another replica's password change is only visible in the row, so a
+    // session answered from the cache would outlive it by up to 30 seconds.
+    const live = [{ ...ON, ...ROW }];
+    const { db } = makeFakeDb([live, live, live]);
+    const svc = new AuthService(db, makeConfig());
+    const token = jwt.sign({ userId: ROW.id, email: ROW.email, sv: 0 }, 'test-jwt-secret', { expiresIn: '7d' });
+    const select = vi.mocked(db.select);
+
+    await svc.resolveSession(token);
+    expect(select).toHaveBeenCalledTimes(1);
+    // The cache now holds the account; isActive may use it...
+    await expect(svc.isActive(ROW.id)).resolves.toBe(true);
+    expect(select).toHaveBeenCalledTimes(1);
+    // ...but a session never does.
+    await svc.resolveSession(token);
+    expect(select).toHaveBeenCalledTimes(2);
+    await svc.resolveSession(token);
+    expect(select).toHaveBeenCalledTimes(3);
+  });
+
+  it('keeps a token issued before sessions had generations while the password never changed', async () => {
+    const { db } = makeFakeDb([[{ ...ON, ...ROW }]]);
+    const legacy = jwt.sign({ userId: ROW.id, email: ROW.email }, 'test-jwt-secret', { expiresIn: '7d' });
+    await expect(new AuthService(db, makeConfig()).resolveSession(legacy)).resolves.toEqual({
+      userId: ROW.id,
+      email: ROW.email,
+    });
+  });
+
+  it('is refused, in words, when another session changed the password between the read and the write', async () => {
+    const passwordHash = await hashPassword('old-password');
+    // The conditional write finds the row no longer at the generation read.
+    const { db } = makeFakeDb([[{ ...ROW, passwordHash }], []]);
+    const refused = new AuthService(db, makeConfig()).changePassword('user-1', 'old-password', 'new-password-1');
+    await expect(refused).rejects.toBeInstanceOf(PasswordChangedMeanwhileError);
+    await expect(refused).rejects.toThrow(/changed from another session.*nothing was changed/);
+  });
+});
+
 describe('AuthService.listAccounts', () => {
   it('reports hasPassword without ever exposing the hash', async () => {
     const passwordHash = await hashPassword('pw-longer-than-8');

package/src/modules/auth/__tests__/password-change-sessions.pg.test.ts

@@ -0,0 +1,269 @@
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import express from 'express';
+import type { Server } from 'node:http';
+import { eq } from 'drizzle-orm';
+import { users, type Database } from '../../database/index.js';
+import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, openMigratedScratchDb } from '../../../__tests__/pg-scratch.js';
+import { AuthService } from '../auth.service.js';
+import { SessionEndedError } from '../account-admission.js';
+import { createAuthRoutes } from '../auth.routes.js';
+import { AUTH_COOKIE_NAME, createAuthMiddleware } from '../auth.middleware.js';
+import { verifyPassword } from '../password-hash.js';
+
+/**
+ * Something to run once, the next time a password is hashed: a change hashes
+ * its new password after reading the row and proving the current one, and
+ * before writing, so this is where "another session changed it first" lands.
+ */
+const beforeNextHash = vi.hoisted(() => ({ run: null as null | (() => Promise<void>) }));
+vi.mock('../password-hash.js', async (importOriginal) => {
+  const original = await importOriginal<typeof import('../password-hash.js')>();
+  return {
+    ...original,
+    hashPassword: async (password: string) => {
+      const run = beforeNextHash.run;
+      beforeNextHash.run = null;
+      if (run) await run();
+      return original.hashPassword(password);
+    },
+  };
+});
+
+/**
+ * Changing your password ends the sessions opened with the old one, and a
+ * change whose current password stopped being current is refused. Both are
+ * a row's session generation and a conditional write on it, which no stub
+ * can stand in for, so this crosses a real Postgres (see `pg-scratch.ts`)
+ * through the real routes and the real auth middleware.
+ */
+const JWT_SECRET = 'test-jwt-secret';
+
+describe.skipIf(!PG_ADMIN_URL)('a password change and the sessions opened before it, on a real Postgres', () => {
+  let db: Database;
+  let closeDb: () => Promise<void>;
+  let auth: AuthService;
+  let server: Server;
+  let base: string;
+
+  beforeAll(async () => {
+    ({ db, close: closeDb } = await openMigratedScratchDb('hexis_pwchange'));
+    auth = new AuthService(db, { jwtSecret: JWT_SECRET, adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+    const app = express();
+    app.use(express.json());
+    app.use('/api', createAuthRoutes(auth, createAuthMiddleware(auth)));
+    await new Promise<void>((resolve) => {
+      server = app.listen(0, resolve);
+    });
+    const address = server.address();
+    if (typeof address === 'string' || !address) throw new Error('no port');
+    base = `http://127.0.0.1:${address.port}`;
+  }, PG_TEST_TIMEOUT);
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => {
+      if (server) server.close(() => resolve());
+      else resolve();
+    });
+    if (db) await closeDb();
+    await dropScratchDatabases();
+  }, PG_TEST_TIMEOUT);
+
+  /** A sign-in: its bearer token, and the auth cookie a browser would keep. */
+  async function signIn(email: string, password: string): Promise<{ token: string; cookie: string }> {
+    const res = await fetch(`${base}/api/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    });
+    expect(res.status).toBe(200);
+    return { token: ((await res.json()) as { token: string }).token, cookie: authCookie(res) };
+  }
+
+  function authCookie(res: Response): string {
+    const set = res.headers.getSetCookie().find((c) => c.startsWith(`${AUTH_COOKIE_NAME}=`));
+    if (!set) throw new Error('no auth cookie set');
+    return set.split(';')[0];
+  }
+
+  function changePassword(token: string, currentPassword: string, newPassword: string) {
+    return fetch(`${base}/api/auth/change-password`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ currentPassword, newPassword }),
+    });
+  }
+
+  const meWithBearer = (token: string) =>
+    fetch(`${base}/api/auth/me`, { headers: { Authorization: `Bearer ${token}` } }).then((r) => r.status);
+  const meWithCookie = (cookie: string) =>
+    fetch(`${base}/api/auth/me`, { headers: { Cookie: cookie } }).then((r) => r.status);
+
+  async function storedRow(email: string) {
+    const [row] = await db.select().from(users).where(eq(users.emailBidx, email)).limit(1);
+    return row;
+  }
+
+  it(
+    'ends every token and browser session issued before the change, except the one that made it',
+    async () => {
+      await auth.createAccount('kim@acme.test', 'Kim', 'old-password-1');
+      const changer = await signIn('kim@acme.test', 'old-password-1');
+      const laptop = await signIn('kim@acme.test', 'old-password-1');
+      const browser = await signIn('kim@acme.test', 'old-password-1');
+      // All three are live, and the cached answer the middleware now holds
+      // is exactly what the change has to get past.
+      expect(await meWithBearer(changer.token)).toBe(200);
+      expect(await meWithBearer(laptop.token)).toBe(200);
+      expect(await meWithCookie(browser.cookie)).toBe(200);
+
+      const res = await changePassword(changer.token, 'old-password-1', 'new-password-1');
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { ok: boolean; token: string };
+      expect(body.ok).toBe(true);
+
+      // Every session opened before the change answers 401 on its next request...
+      expect(await meWithBearer(laptop.token)).toBe(401);
+      expect(await meWithCookie(browser.cookie)).toBe(401);
+      expect(await meWithBearer(browser.token)).toBe(401);
+      expect(await meWithCookie(laptop.cookie)).toBe(401);
+      // ...the changer's old credentials included: what it carries on with is
+      // the fresh token and cookie the change handed back.
+      expect(await meWithBearer(changer.token)).toBe(401);
+      expect(await meWithCookie(changer.cookie)).toBe(401);
+      expect(await meWithBearer(body.token)).toBe(200);
+      expect(await meWithCookie(authCookie(res))).toBe(200);
+
+      // The old password signs nobody in; the new one does, and its session lives.
+      const old = await fetch(`${base}/api/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: 'kim@acme.test', password: 'old-password-1' }),
+      });
+      expect(old.status).toBe(401);
+      const again = await signIn('kim@acme.test', 'new-password-1');
+      expect(await meWithBearer(again.token)).toBe(200);
+      // ...and so does the changer's, alongside it.
+      expect(await meWithBearer(body.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'refuses, in words, a change whose current password another session changed first, and writes nothing',
+    async () => {
+      await auth.createAccount('lena@acme.test', 'Lena', 'old-password-1');
+      const first = await signIn('lena@acme.test', 'old-password-1');
+      const second = await signIn('lena@acme.test', 'old-password-1');
+
+      // The second session's change has read the row and proven the old
+      // password when the first session's change lands.
+      let firstStatus = 0;
+      beforeNextHash.run = async () => {
+        firstStatus = (await changePassword(first.token, 'old-password-1', 'first-new-password')).status;
+      };
+      const raced = await changePassword(second.token, 'old-password-1', 'second-new-password');
+      expect(firstStatus).toBe(200);
+      expect(raced.status).toBe(409);
+      expect(((await raced.json()) as { error: string }).error).toMatch(
+        /changed from another session.*nothing was changed/,
+      );
+
+      // Nothing of the refused change was written: the first change's
+      // password is the account's, and the generation moved on once.
+      const afterRace = await storedRow('lena@acme.test');
+      expect(await verifyPassword('first-new-password', afterRace.passwordHash!)).toBe(true);
+      expect(await verifyPassword('second-new-password', afterRace.passwordHash!)).toBe(false);
+      expect(afterRace.sessionVersion).toBe(1);
+
+      // A session opened since, typing the password that is no longer
+      // current, is refused in words and changes nothing either.
+      const third = await signIn('lena@acme.test', 'first-new-password');
+      const stale = await changePassword(third.token, 'old-password-1', 'third-new-password');
+      expect(stale.status).toBe(400);
+      expect(((await stale.json()) as { error: string }).error).toBe('Current password is incorrect');
+      const afterStale = await storedRow('lena@acme.test');
+      expect(afterStale.passwordHash).toBe(afterRace.passwordHash);
+      expect(afterStale.sessionVersion).toBe(1);
+      expect(await meWithBearer(third.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'ends the sessions opened before an admin reset, and refuses a change that read the row before it',
+    async () => {
+      await auth.createAccount('noor@acme.test', 'Noor', 'old-password-1');
+      const laptop = await signIn('noor@acme.test', 'old-password-1');
+      const changer = await signIn('noor@acme.test', 'old-password-1');
+      expect(await meWithBearer(laptop.token)).toBe(200);
+      expect(await meWithCookie(laptop.cookie)).toBe(200);
+
+      // The reset lands after the self-service change has proven the old password.
+      beforeNextHash.run = async () => {
+        await auth.createAccount('noor@acme.test', undefined, 'reset-password-1');
+      };
+      const raced = await changePassword(changer.token, 'old-password-1', 'self-new-password');
+      expect(raced.status).toBe(409);
+
+      // The reset is the account's password, and the generation moved on once.
+      const row = await storedRow('noor@acme.test');
+      expect(await verifyPassword('reset-password-1', row.passwordHash!)).toBe(true);
+      expect(row.sessionVersion).toBe(1);
+      expect(await meWithBearer(laptop.token)).toBe(401);
+      expect(await meWithCookie(laptop.cookie)).toBe(401);
+      expect(await meWithBearer(changer.token)).toBe(401);
+      const fresh = await signIn('noor@acme.test', 'reset-password-1');
+      expect(await meWithBearer(fresh.token)).toBe(200);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'ends the old sessions on another replica at their next request too',
+    async () => {
+      // A second process on the same database, with its own cache, which has
+      // just seen the session live.
+      const replica = new AuthService(db, { jwtSecret: JWT_SECRET, adminEmail: '', adminPassword: '', allowedEmailDomains: [] });
+      await auth.createAccount('omar@acme.test', 'Omar', 'old-password-1');
+      const laptop = await signIn('omar@acme.test', 'old-password-1');
+      const changer = await signIn('omar@acme.test', 'old-password-1');
+      await expect(replica.resolveSession(laptop.token)).resolves.toMatchObject({ email: 'omar@acme.test' });
+
+      const res = await changePassword(changer.token, 'old-password-1', 'new-password-1');
+      expect(res.status).toBe(200);
+      const { token } = (await res.json()) as { token: string };
+
+      const ended = replica.resolveSession(laptop.token);
+      await expect(ended).rejects.toBeInstanceOf(SessionEndedError);
+      await expect(ended).rejects.toThrow(/password was changed after this session was opened/);
+      await expect(replica.resolveSession(token)).resolves.toMatchObject({ email: 'omar@acme.test' });
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'refuses a first password set from the Account page when an admin set a starting one meanwhile',
+    async () => {
+      // Single sign-on only: no password yet, so the Account page asks for no current one.
+      const { token: sso } = await auth.loginWithSso('pia@acme.test', 'Pia', { admittedByProvider: true });
+      expect(await meWithBearer(sso)).toBe(200);
+
+      beforeNextHash.run = async () => {
+        const set = await auth.createAccountWithStartingPassword('pia@acme.test', 'starting-password-1');
+        expect(set.passwordSet).toBe(true);
+      };
+      const raced = await fetch(`${base}/api/auth/change-password`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${sso}` },
+        body: JSON.stringify({ newPassword: 'self-new-password' }),
+      });
+      expect(raced.status).toBe(409);
+
+      const row = await storedRow('pia@acme.test');
+      expect(await verifyPassword('starting-password-1', row.passwordHash!)).toBe(true);
+      expect(row.sessionVersion).toBe(1);
+      expect(await meWithBearer(sso)).toBe(401);
+    },
+    PG_TEST_TIMEOUT,
+  );
+});

package/src/modules/auth/account-admission.ts

@@ -82,6 +82,25 @@ export class AccountDeactivatedError extends Error {
   }
 }
 
+/**
+ * A session token that verifies but is no longer honoured: the account's
+ * password was changed after the token was issued, which ends every session
+ * opened before it. A 401 with these words, so the person knows why they are
+ * back at the sign-in form rather than reading "invalid token".
+ */
+export class SessionEndedError extends Error {
+  readonly status = 401;
+
+  constructor(message = SESSION_ENDED_MESSAGE) {
+    super(message);
+    this.name = 'SessionEndedError';
+  }
+}
+
+/** What a person whose session a password change ended is told. */
+export const SESSION_ENDED_MESSAGE =
+  'Your password was changed after this session was opened. Sign in again with the new password.';
+
 /**
  * Whether the account behind a credential is on could not be asked — the
  * database failed. Not the caller's fault and not a verdict on them: a

package/src/modules/auth/account-erasure.service.ts

@@ -4,8 +4,8 @@ import { logger } from '../../shared/logging.js';
 const log = logger('account-erasure');
 import { and, eq, notExists } from 'drizzle-orm';
 import { isEncryptedBlob } from '../../shared/column-crypto.js';
-import type { Database } from '../database/connection.js';
-import type { IReviewWorkflowService } from '../workflow/review-workflow/review-workflow.interface.js';
+import type { Database } from '../database/index.js';
+import type { IReviewWorkflowService } from '../workflow/index.js';
 import {
   changeRequests,
   externalApiKeys,
@@ -14,11 +14,10 @@ import {
   oauthTokens,
   pendingCommits,
   pluginJoinRequests,
-  prComments,
   prFileApprovals,
   prMergeLog,
   users,
-} from '../database/schema.js';
+} from '../database/index.js';
 
 /** The anonymised id of one erasure — how a commit or log may name the account. */
 export function erasedAccountId(erasureId: string): string {
@@ -88,7 +87,7 @@ export interface IErasureParticipant {
  *    CASCADE (account links, watchlist sources/findings, connector configs,
  *    vault secrets); deleting a connection key cascades its usage metering.
  *  - Audit rows that must survive for the review trail (approvals, merge log,
- *    review comments, change requests, queued commits — and, via participants,
+ *    change requests, queued commits — and, via participants,
  *    e.g. routine authorship) are kept but ANONYMIZED with the per-erasure
  *    placeholder identity.
  *
@@ -225,10 +224,6 @@ export class AccountErasureService implements IAccountErasureService {
         .update(prMergeLog)
         .set({ triggeredByEmail: target.erasedEmail, triggeredByEmailBidx: erasedBidx, triggeredByName: target.erasedName })
         .where(eq(prMergeLog.triggeredByEmailBidx, emailBidx));
-      await tx
-        .update(prComments)
-        .set({ authorEmail: target.erasedEmail, authorEmailBidx: erasedBidx, authorName: target.erasedName })
-        .where(eq(prComments.authorEmailBidx, emailBidx));
       await tx
         .update(changeRequests)
         .set({ authorEmail: target.erasedEmail, authorEmailBidx: erasedBidx, authorName: target.erasedName })

package/src/modules/auth/account-switch-lock.ts

@@ -1,8 +1,8 @@
 import { sql } from 'drizzle-orm';
-import type { Database } from '../database/connection.js';
+import type { Database } from '../database/index.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
-import { pgErrorCode } from '../database/pg-error.js';
+import { pgErrorCode } from '../database/index.js';
 
 /** The handle `db.transaction` hands its callback. */
 type Tx = Parameters<Parameters<Database['transaction']>[0]>[0];

package/src/modules/auth/account.routes.ts

@@ -9,9 +9,9 @@ import type { AuthService } from './auth.service.js';
 import type { IAccountHooks } from './account-hooks.js';
 import { AccountAdmissionRefusedError, AccountChangeRefusedError } from './account-admission.js';
 import { erasedAccountId, type IAccountErasureService } from './account-erasure.service.js';
-import type { IAdminAccessService } from '../admin/admin.interface.js';
-import type { UserAccessRemovalService } from '../access/user-access-removal.service.js';
-import { sendError } from '../access/admin-route-helpers.js';
+import type { IAdminAccessService } from '../admin/index.js';
+import type { UserAccessRemovalService } from '../access/index.js';
+import { sendError } from '../access/index.js';
 import { WorkflowDomainError } from '../../shared/domain-errors.js';
 import { canonicalEmail } from '../../shared/email-identity.js';
 import './auth.middleware.js'; // Express Request augmentation

package/src/modules/auth/auth.middleware.ts

@@ -1,6 +1,6 @@
 import type { Request, Response, NextFunction } from 'express';
 import type { AuthService } from './auth.service.js';
-import { AccountDeactivatedError, AuthBackendError } from './account-admission.js';
+import { AccountDeactivatedError, AuthBackendError, SessionEndedError } from './account-admission.js';
 
 // Augment Express Request so userId/userEmail are available after auth middleware
 declare global {
@@ -20,10 +20,49 @@ declare global {
  * header, which the frontend stores in memory and attaches via `authFetch`.
  *
  * Same JWT value as the Bearer token. The cookie is `HttpOnly` + `SameSite=Lax`
- * + `Secure` (in prod) — see `auth.routes.ts` for the issue site.
+ * + `Secure` when the deployment is reached over https — {@link setAuthCookie}
+ * is its one issue site, for every sign-in path and the password change.
  */
 export const AUTH_COOKIE_NAME = 'bevel_token';
 
+/**
+ * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
+ * '7d'` so the cookie expires when the token does — browsers stop
+ * sending it past expiry, sparing the auth middleware verifying tokens
+ * that are guaranteed to fail.
+ */
+export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
+
+/**
+ * Whether the auth cookie is marked `Secure`, from the scheme the deployment
+ * is reached on: a browser never sends a `Secure` cookie over plain http, so
+ * deriving it from `NODE_ENV` left a production deployment served over http
+ * (a private network, a proxy that terminates nothing) without SSE and
+ * images. One rule, asked by the composition root for every path that sets
+ * the cookie. Read by the URL parser, as the deployment's URL is everywhere
+ * else: a scheme is case-insensitive, and `HTTPS://` is https.
+ */
+export function authCookieSecure(publicUrl: string): boolean {
+  return new URL(publicUrl).protocol === 'https:';
+}
+
+/**
+ * Set the JWT as the HttpOnly auth cookie so transports that can't carry
+ * headers (EventSource for SSE, image tags) authenticate automatically. JSON
+ * callers continue to use the Bearer header returned in the body. The one
+ * place the cookie's attributes are spelled: password login, the password
+ * change and every SSO provider set it through here.
+ */
+export function setAuthCookie(res: Response, token: string, secure: boolean): void {
+  res.cookie(AUTH_COOKIE_NAME, token, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure,
+    maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
+    path: '/',
+  });
+}
+
 /**
  * Read the auth cookie out of the raw `Cookie` header without pulling in
  * `cookie-parser`. We only ever look for one cookie, so a tiny parser
@@ -78,8 +117,10 @@ export function createAuthMiddleware(authService: Pick<AuthService, 'resolveSess
         return;
       }
       // A 401 otherwise, so the app drops the session and shows the login
-      // page; a switched-off account is told why there.
-      res.status(401).json({ error: err instanceof AccountDeactivatedError ? err.message : 'Invalid or expired token' });
+      // page; a switched-off account, and a session a password change
+      // ended, are told why there.
+      const worded = err instanceof AccountDeactivatedError || err instanceof SessionEndedError;
+      res.status(401).json({ error: worded ? err.message : 'Invalid or expired token' });
       return;
     }
     req.userId = session.userId;